@rebasepro/server-postgres 0.16.1-canary.ge71347e → 0.17.0

package/dist/{ensure-collection-tables-C_Gr59le.js → collection-index-DxJBvVTH.js}

@@ -1,11 +1,50 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { d as __require, l as __commonJSMin, u as __exportAll } from "./connection-GOKU3Hu5.js";
-import { a as policy, i as ANONYMOUS_USER_IDS, r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
-import { _ as isRelationAggregateSort, a as rewriteLegacyRlsFunctions, b as toCanonicalOp, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, n as REBASE_SCHEMA, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections, y as sortKeyToString } from "./src-DiDgtX8P.js";
-import { isConcurrentDdlRace, isDuplicateObjectRace, logger } from "@rebasepro/server";
-import { createHash } from "node:crypto";
+import { d as __require, l as __commonJSMin } from "./connection-GOKU3Hu5.js";
+import { _ as isRelationAggregateSort, a as rewriteLegacyRlsFunctions, b as toCanonicalOp, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections, y as sortKeyToString } from "./src-DiDgtX8P.js";
+//#region ../types/src/errors.ts
+/**
+* The single error type thrown across the entire Rebase client surface —
+* HTTP data/control-plane calls, realtime/WebSocket operations, and
+* client-side logic errors (e.g. an unknown collection accessor). A `catch`
+* block only ever needs to check for this one class:
+*
+* ```ts
+* import { RebaseApiError } from "@rebasepro/client"; // re-exported
+*
+* try {
+*   await client.data.products.update(id, { price: 9 });
+* } catch (e) {
+*   if (e instanceof RebaseApiError) {
+*     if (e.status === 404) { ... }   // HTTP failures carry a status
+*     console.error(e.code, e.details);
+*   }
+* }
+* ```
+*
+* `status` is present for HTTP failures and `undefined` otherwise, so its
+* presence distinguishes transport-level errors from realtime/logic errors.
+*
+* @group Errors
+*/
+var RebaseApiError = class extends Error {
+	/** HTTP status code, or `undefined` for non-HTTP errors. */
+	status;
+	/** Stable machine-readable error code, when the server supplied one. See {@link RebaseErrorCode}. */
+	code;
+	/** Structured error payload from the server, when present. */
+	details;
+	constructor(message, init = {}) {
+		super(message);
+		this.name = "RebaseApiError";
+		this.status = init.status;
+		this.code = init.code;
+		this.details = init.details;
+		if (init.cause !== void 0) this.cause = init.cause;
+	}
+};
+//#endregion
 //#region ../types/src/types/entities.ts
 /**
 * Class used to create a reference to a entity in a different path
@@ -58,6 +97,151 @@ function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
 //#endregion
+//#region ../types/src/types/policy.ts
+/**
+* The id a request without a logged-in user reports as `rebase.uid()`.
+*
+* A user-context request always sets `app.uid`: blank would read back as
+* `NULL`, and `NULL` is how the trusted server context is recognised, so an
+* anonymous visitor would be promoted to server privileges. The driver
+* therefore substitutes this sentinel at the single chokepoint where the GUC
+* is set.
+*
+* The consequence for policy authors is that **`rebase.uid() IS NOT NULL` is a
+* tautology on the user path** — it is true for anonymous visitors too. Use
+* {@link policy.authenticated} to mean "signed in", and
+* {@link policy.serverContext} to mean "the trusted server context". Do not
+* hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
+* literal is not enough.
+*
+* @group Models
+*/
+var ANONYMOUS_USER_ID = "anonymous";
+/**
+* Every uid that has ever meant "nobody is signed in" — newest first.
+*
+* There are two because there were two. The types, the policy compiler, the
+* JavaScript evaluator and the linter were all built on
+* {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
+* callers as `'anon'` — so `policy.authenticated()`, which compiled to
+* `rebase.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+* sanctioned way to write "signed in" granted to everyone, and the linter
+* flagged the spelling that actually worked as a foreign convention.
+*
+* The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
+* because policies outlive the server that generated them: a database still
+* holding policies from before the fix, or a project whose server has not been
+* upgraded yet, must not become a grant in either direction. Compile against
+* this list, not against a single literal.
+*
+* No real user id is ever one of these, so a match is always "not signed in".
+*
+* @group Models
+*/
+var ANONYMOUS_USER_IDS = [ANONYMOUS_USER_ID, "anon"];
+/** @group Models */
+var policy = {
+	true: () => ({ kind: "true" }),
+	false: () => ({ kind: "false" }),
+	and: (...operands) => ({
+		kind: "and",
+		operands
+	}),
+	or: (...operands) => ({
+		kind: "or",
+		operands
+	}),
+	not: (operand) => ({
+		kind: "not",
+		operand
+	}),
+	compare: (left, op, right) => ({
+		kind: "compare",
+		op,
+		left,
+		right
+	}),
+	rolesOverlap: (roles) => ({
+		kind: "rolesOverlap",
+		roles
+	}),
+	rolesContain: (roles) => ({
+		kind: "rolesContain",
+		roles
+	}),
+	authenticated: () => ({ kind: "authenticated" }),
+	serverContext: () => ({ kind: "serverContext" }),
+	existsIn: (args) => ({
+		kind: "existsIn",
+		collection: args.collection,
+		where: args.where
+	}),
+	raw: (sql) => ({
+		kind: "raw",
+		sql
+	}),
+	field: (name) => ({
+		kind: "field",
+		name
+	}),
+	outerField: (name) => ({
+		kind: "outerField",
+		name
+	}),
+	literal: (value) => ({
+		kind: "literal",
+		value
+	}),
+	authUid: () => ({ kind: "authUid" }),
+	authRoles: () => ({ kind: "authRoles" })
+};
+/**
+* Thrown by {@link resolveClientListLimit} for a `limit` the platform will not
+* serve. Carries an HTTP status so an ingress that speaks HTTP can forward it
+* verbatim, and `maxLimit` so one can be built without re-deriving the ceiling.
+*
+* @group Errors
+*/
+var ListLimitError = class ListLimitError extends RebaseApiError {
+	/** The ceiling that was exceeded — what the caller should page by instead. */
+	maxLimit;
+	constructor(message, maxLimit) {
+		super(message, {
+			status: 400,
+			code: "INVALID_LIMIT"
+		});
+		this.name = "ListLimitError";
+		this.maxLimit = maxLimit;
+		Object.setPrototypeOf(this, ListLimitError.prototype);
+	}
+};
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - An absent / blank limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+* - A limit that is present must be an integer in `[1, maxLimit]`. Anything
+*   else — `0`, a negative, `1.5`, `abc`, `100000000` — throws
+*   {@link ListLimitError} rather than being coerced into range, because every
+*   coercion answers a question the caller did not ask with a page it cannot
+*   tell apart from the whole collection.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*
+* @throws {ListLimitError} when a present `limit` is not an integer in range.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : Number(String(rawLimit).trim());
+		if (!Number.isInteger(parsed) || parsed < 1) throw new ListLimitError(`Invalid \`limit\`: ${String(rawLimit)}. Expected a whole number between 1 and ${maxLimit}.`, maxLimit);
+		if (parsed > maxLimit) throw new ListLimitError(`\`limit\` ${parsed} is above the maximum of ${maxLimit}. Ask for at most ${maxLimit} rows per read and page through the rest with \`offset\` — answering with a smaller page would be indistinguishable from there being no more rows.`, maxLimit);
+		return parsed;
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
+//#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
 var DEFAULT_ONE_OF_VALUE = "value";
@@ -1409,9 +1593,28 @@ function legacyForeignKeyName(name) {
 * and `TextDecoder` are standard in both runtimes and need no ambient types.
 */
 function toPostgresIdentifier(name) {
+	return truncateToBytes(name, 63);
+}
+/**
+* {@link toPostgresIdentifier} with the bound lifted to a parameter.
+*
+* Exists for names that end in something load-bearing. Truncating at 63 keeps
+* the *head* of a name and discards the tail, which is right for a descriptive
+* identifier and wrong for a hashed one: the hash is the part that makes it
+* unique, and it is at the end. A caller that appends a fingerprint truncates
+* the readable head to `63 - <tail>` itself and then appends, so the bound is
+* still 63 and the hash always survives.
+*
+* `contracts/derived-names.txt` records what the alternative costs — a foreign
+* key frozen as `..._corres`, its `_fkey` suffix truncated away, so a second
+* foreign key on that table would derive a byte-identical name.
+*
+* One truncation rule, in one function, so the two cannot drift.
+*/
+function truncateToBytes(name, maxBytes) {
 	const bytes = new TextEncoder().encode(name);
-	if (bytes.byteLength <= 63) return name;
-	return new TextDecoder("utf-8").decode(bytes.subarray(0, 63)).replace(/�+$/, "");
+	if (bytes.byteLength <= maxBytes) return name;
+	return new TextDecoder("utf-8").decode(bytes.subarray(0, maxBytes)).replace(/�+$/, "");
 }
 /**
 * The API name a database column is served under.
@@ -2517,10 +2720,10 @@ function compile(expr, scope) {
 		}
 		case "rolesOverlap": return `string_to_array(${RLS_ROLES_SQL}, ',') && ${rolesArraySql(expr.roles)}`;
 		case "rolesContain": return `string_to_array(${RLS_ROLES_SQL}, ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
+		case "authenticated": return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral$1).join(", ")})`;
 		case "serverContext": return `${RLS_UID_SQL} IS NULL`;
 		case "existsIn": return compileExistsIn(expr, scope);
-		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName$1(col, scope.outerCollection)}`);
+		case "raw": return rewriteLegacyRlsFunctions(expr.sql).replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
 	}
 }
 /**
@@ -2531,7 +2734,7 @@ function compile(expr, scope) {
 function compileExistsIn(expr, scope) {
 	const join = scope.resolveCollection?.(expr.collection);
 	const joinTable = join ? getTableName(join) : toSnakeCase(expr.collection);
-	const joinSchema = schemaOf$1(join) ?? schemaOf$1(scope.outerCollection) ?? "public";
+	const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
 	const alias = `_ex${scope.alias.n++}`;
 	const outerPrefix = outerQualifier(scope);
 	const innerScope = {
@@ -2554,9 +2757,9 @@ var COMPARE_SQL = {
 };
 function operandToSql(operand, scope) {
 	switch (operand.kind) {
-		case "field": return `${scope.fieldPrefix}${resolveColumnName$1(operand.name, scope.fieldCollection)}`;
-		case "outerField": return `${scope.outerPrefix}${resolveColumnName$1(operand.name, scope.outerCollection)}`;
-		case "literal": return quoteLiteral(operand.value);
+		case "field": return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
+		case "outerField": return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
+		case "literal": return quoteLiteral$1(operand.value);
 		case "authUid": return RLS_UID_SQL;
 		case "authRoles": return `string_to_array(${RLS_ROLES_SQL}, ',')`;
 	}
@@ -2568,12 +2771,12 @@ function operandToSql(operand, scope) {
 function outerQualifier(scope) {
 	const table = scope.outerCollection ? getTableName(scope.outerCollection) : void 0;
 	if (!table) return "";
-	return `"${schemaOf$1(scope.outerCollection) ?? "public"}"."${table}".`;
+	return `"${schemaOf(scope.outerCollection) ?? "public"}"."${table}".`;
 }
-function schemaOf$1(collection) {
+function schemaOf(collection) {
 	return collection?.schema || void 0;
 }
-function resolveColumnName$1(propName, collection) {
+function resolveColumnName(propName, collection) {
 	const prop = collection?.properties?.[propName];
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return quoteColumnIdentifier(prop.columnName);
 	return quoteColumnIdentifier(toSnakeCase(propName));
@@ -2717,7 +2920,7 @@ function quoteColumnIdentifier(name) {
 	if (BARE_IDENTIFIER.test(name) && !RESERVED_SQL_WORDS.has(name)) return name;
 	return `"${name.replace(/"/g, "\"\"")}"`;
 }
-function quoteLiteral(value) {
+function quoteLiteral$1(value) {
 	if (value === null) return "NULL";
 	if (typeof value === "boolean") return value ? "true" : "false";
 	if (typeof value === "number") return String(value);
@@ -2783,7 +2986,7 @@ var DEFAULT_GUARDED_OPS = [
 	"delete"
 ];
 /** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection$1(collection) {
+function isAuthCollection(collection) {
 	const auth = collection.auth;
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
@@ -2821,7 +3024,7 @@ function getEffectiveSecurityRules(collection) {
 	const explicit = [...collection.securityRules ?? []];
 	const tableName = getTableName(collection);
 	const injected = [];
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection$1(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
@@ -2833,7 +3036,7 @@ function getEffectiveSecurityRules(collection) {
 		condition: SERVER_OR_ADMIN_EXPR$1,
 		check: SERVER_OR_ADMIN_EXPR$1
 	});
-	if (isAuthCollection$1(collection)) {
+	if (isAuthCollection(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
@@ -2855,7 +3058,7 @@ function getEffectiveSecurityRules(collection) {
 * DDL, which policies are injected and how to take them off.
 */
 function getInjectedSecurityRules(collection) {
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection$1(collection) ? [adminWriteGate(getTableName(collection))] : [];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection(collection) ? [adminWriteGate(getTableName(collection))] : [];
 	const explicitCount = (collection.securityRules ?? []).length;
 	return getEffectiveSecurityRules(collection).slice(explicitCount);
 }
@@ -3335,25 +3538,8 @@ function getJunctionSecurityRules(spec) {
 	});
 })))();
 /**
-* How wide a `varchar`/`char` column should be for a given property.
-*
-* One definition, three call sites, because they used to disagree. For the same
-* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
-* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
-* reads as *unbounded* — so which of the two you ran decided whether the column
-* had a limit at all. Introspection then dropped the length entirely, so reading
-* an existing `character varying(500)` column back and regenerating it produced
-* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
-*
-* `validation.max` is the property's own statement about how long the value may
-* be, so it is the only sensible source for the column's width — and it keeps
-* the constraint the database enforces in step with the one the app enforces,
-* rather than inventing a second, different limit underneath it.
+* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
 */
-function resolveStringColumnLength(prop) {
-	const max = prop.validation?.max;
-	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
-}
 //#endregion
 //#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
@@ -5261,1917 +5447,244 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-//#region src/schema/search-column.ts
-/**
-* The one place a collection's `search` block becomes SQL.
-*
-* Four things describe a Postgres table in this codebase — the DDL generator,
-* the Drizzle schema generator, the runtime table builder for BaaS mode, and
-* the boot-time schema ensure — and each of them has, at some point, described
-* a column differently from the others. The `varchar(255)` note in
-* `generate-postgres-ddl-logic` is one such scar: the same property produced a
-* capped column down one path and an uncapped one down the other, and nothing
-* failed until a user hit the cap.
-*
-* So the search column is not implemented four times. It is computed once,
-* here, and every generator renders the same {@link SearchColumnSpec}. There is
-* a test asserting exactly that (`search-column-contract.test.ts`); the point of
-* this module is that the test has something to assert *about*.
-*
-* ## Why the expressions look the way they do
-*
-* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
-* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
-*
-* | expression                              | immutable |
-* |-----------------------------------------|-----------|
-* | `to_tsvector('spanish', col)`           | yes       |
-* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
-* | `array_to_string(col, ' ')`             | **no**    |
-* | `col::text` on `text[]`                 | **no**    |
-* | `to_jsonb(col)`                         | **no**    |
-* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
-* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
-* | `setweight(...) || setweight(...)`      | yes       |
-*
-* Three of the four things a real search column needs are therefore unavailable
-* directly, which is why {@link searchHelperFunctions} exists: each wraps a
-* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
-* promise, and it is a true one for these three — array joining, JSON string
-* extraction and accent folding are all deterministic for a given input; the
-* built-ins are marked stable only because they must account for element types
-* and dictionaries in general.
-*
-* The alternative was to skip `unaccent` and text arrays entirely. That is not
-* a real option in an accented language: Postgres stems `auditoría` to
-* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
-* typed without accents misses every row that carries them.
-*/
-/** Schema-qualified so a collection outside `public` still resolves them. */
-var HELPER_SCHEMA = "public";
-/**
-* Names of the helper functions. Frozen: they are recorded in the stored
-* generation expression of every search column ever created, so renaming one
-* orphans every table that already has a search column.
-*/
-var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
-var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
-/** Raised when a `search` block names something that cannot be searched. */
-var SearchConfigError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SearchConfigError";
-	}
-};
-/** The `search` block of a collection, or undefined when it has none. */
-var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
-/**
-* Refuse a `search` block on a collection this engine does not store.
-*
-* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
-* already stops the ordinary case. This catches the rest — a JS config, a cast,
-* a collection whose `engine` was changed after the block was written — because
-* the alternative is the exact failure the block exists to prevent: a developer
-* who declared what to index, saw no error, and got the substring fallback.
-*
-* Called with *every* collection, before the Postgres ones are filtered out.
-*/
-var assertSearchIsPostgresOnly = (collections) => {
-	for (const collection of collections) {
-		if (isPostgresCollectionConfig(collection)) continue;
-		if (!collection.search) continue;
-		const engine = collection.engine ?? "non-postgres";
-		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
-	}
-};
-var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
+//#region src/schema/collection-index.ts
 /**
-* Classify a property for search purposes.
-*
-* Deliberately narrower than `getSqlColumnType`: search only cares whether a
-* value reaches text, and the mapping from property to *physical* type is
-* asserted against `getSqlColumnType` in the contract test rather than
-* duplicated here.
+* A declaration that cannot become an index.
 *
-* Returns null for anything that is not text-bearing, which the caller turns
-* into a boot error naming the property.
+* Thrown at build time, naming the collection and the array position, because
+* the alternative is a `CREATE INDEX` that fails during a push with a Postgres
+* error mentioning a column the author never wrote.
 */
-var classify = (prop) => {
-	switch (prop.type) {
-		case "string": {
-			const sp = prop;
-			if (sp.enum) return {
-				kind: "text",
-				reason: "enum"
-			};
-			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
-				kind: "text",
-				reason: "uuid"
-			};
-			return { kind: "text" };
-		}
-		case "map":
-			if (prop.columnType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			return { kind: "jsonb" };
-		case "array": {
-			const ap = prop;
-			let colType = ap.columnType;
-			if (!colType && ap.of && !Array.isArray(ap.of)) {
-				const of = ap.of;
-				if (of.type === "string") colType = "text[]";
-				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
-				else if (of.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "text[]") return { kind: "text_array" };
-			if (colType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
-				kind: "text_array",
-				reason: "non_text_array"
-			};
-			return { kind: "jsonb" };
-		}
-		default: return null;
+var CollectionIndexConfigError = class extends Error {
+	collectionSlug;
+	position;
+	constructor(collectionSlug, position, message) {
+		super(`${collectionSlug}.indexes[${position}]: ${message}`);
+		this.name = "CollectionIndexConfigError";
+		this.collectionSlug = collectionSlug;
+		this.position = position;
 	}
 };
-var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
-/** SQL reading one field as plain text, before normalization. */
-var rawTextSql = (field) => {
-	const col = `"${field.column}"`;
-	if (field.kind === "text") return `coalesce(${col}, '')`;
-	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
-	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
-};
-var quote = (v) => `'${v.replace(/'/g, "''")}'`;
-/**
-* Resolve and validate one declared field path.
-*
-* A path that does not resolve throws. The whole point of an explicit block is
-* that the author knows what is indexed; a silently dropped field would make it
-* a guess again, and the failure — a search that returns nothing for content
-* that is plainly in the row — is invisible from the outside.
-*/
-var resolveField = (entry, collection, cfg) => {
-	const path = typeof entry === "string" ? entry : entry.path;
-	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? "B";
-	const where = `${collection.slug}.search`;
-	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
-	const [head, ...rest] = path.split(".");
-	const prop = collection.properties?.[head];
-	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
-	const classified = classify(prop);
-	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
-	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
-	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
-	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
-	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
-	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
-	const column = columnNameOf(head, prop);
-	const textSql = normalize(rawTextSql({
-		column,
-		jsonPath: rest,
-		kind: classified.kind
-	}), cfg.unaccent === true);
-	const language = cfg.language ?? "simple";
-	return {
-		path,
-		column,
-		jsonPath: rest,
-		kind: classified.kind,
-		weight,
-		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
-		textSql
-	};
-};
 /**
-* Build the full spec for a collection, or undefined when it has not opted in.
-*
-* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
-* at boot surface that as a startup failure — a search block that half-works is
-* worse than one that refuses.
-*/
-var buildSearchColumnSpec = (collection) => {
-	const cfg = getSearchConfig(collection);
-	if (!cfg) return void 0;
-	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
-	const table = getTableName(collection);
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const column = cfg.column ?? "search_vector";
-	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
-	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
-	const seen = /* @__PURE__ */ new Set();
-	for (const f of fields) {
-		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
-		seen.add(f.path);
-	}
-	const extensions = [];
-	if (cfg.unaccent) extensions.push("unaccent");
-	if (cfg.fuzzy) extensions.push("pg_trgm");
-	const spec = {
-		schema,
-		table,
-		column,
-		language: cfg.language ?? "simple",
-		unaccent: cfg.unaccent === true,
-		fields,
-		expression: fields.map((f) => f.sql).join(" || "),
-		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
-		extensions
-	};
-	if (cfg.fuzzy) {
-		const fuzzyColumn = `${column}_text`;
-		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
-		spec.fuzzy = {
-			column: fuzzyColumn,
-			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
-			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
-			threshold: cfg.fuzzyThreshold ?? .3
-		};
-	}
-	return spec;
+* `_ix`/`_ux` plus `_` plus 7 hex — the part of the name that must always
+* survive truncation, and therefore is never inside the truncated portion.
+*/
+var NAME_SUFFIX_BYTES = 11;
+var isOrderedMethod = (method) => method === "btree";
+/**
+* The parts of an index that decide what it *is*.
+*
+* A semantic projection, not the rendered statement — the same arrangement as
+* `getPolicyNameHash`, and for the same reason. A change to how this file
+* formats SQL (eliding a default `USING btree`, quoting differently, emitting
+* `NULLS LAST` explicitly) must not silently rename every index in every
+* deployed database. Hashing generator output would make every cosmetic edit a
+* fleet-wide DROP + CREATE.
+*
+* `reason` is deliberately absent: rewording a comment must not rebuild an
+* index. `nulls` is the *effective* placement, so writing Postgres's own
+* default down is a no-op rather than a redefinition.
+*
+* `v` is the only escape hatch, and it is expensive on purpose: bumping it
+* renames every index in the field.
+*/
+var indexFingerprint = (spec) => sha1Hex(JSON.stringify({
+	v: 1,
+	s: spec.schema,
+	t: spec.table,
+	m: spec.method,
+	u: spec.unique,
+	k: spec.keys.map((k) => [
+		k.column,
+		k.direction,
+		k.nulls
+	]),
+	i: spec.include,
+	w: spec.predicate
+})).substring(0, 7);
+/**
+* `<table>_<columns>_ix_<hash>`, or `_ux_` when unique.
+*
+* Truncation eats the readable head and never the hash. `toPostgresIdentifier`
+* truncates the whole string at 63 bytes, which on a hashed name would cut off
+* the one part that makes it unique — the failure already frozen into
+* `contracts/derived-names.txt`, where a foreign key is recorded with its
+* `_fkey` suffix truncated away, so a second foreign key on that table would
+* derive a byte-identical name.
+*/
+var deriveIndexName = (spec) => {
+	const suffix = `_${spec.unique ? "ux" : "ix"}_${indexFingerprint(spec)}`;
+	return `${truncateToBytes(`${spec.table}_${spec.keys.map((k) => k.column).join("_")}`, 63 - NAME_SUFFIX_BYTES)}${suffix}`;
 };
-/**
-* The IMMUTABLE wrappers the generated expressions call.
-*
-* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
-* than an error, and idempotent for the same reason every other boot-time DDL
-* statement here is.
-*
-* The bodies are stable built-ins wrapped in an immutable promise — see the
-* module comment for why that promise is sound. `STRICT` matters: it makes NULL
-* in mean NULL out without executing the body, which is what the `coalesce` at
-* each call site then absorbs.
-*/
-var searchHelperFunctions = (spec) => {
-	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
-	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
-	return statements;
-};
-/**
-* `CREATE EXTENSION` statements the spec's expressions depend on.
-*
-* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
-* `CREATE EXTENSION` installs into the first schema on `search_path`, which
-* defaults to `"$user", public` — and the scaffold's database role is named
-* `rebase`, the same as the schema the generator creates one statement earlier.
-* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
-* dictionary in `rebase`, and every reference to `public.unaccent` below fails
-* with "text search dictionary does not exist". Observed, not theorised.
-*/
-var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
-/** The column definition as it appears inside `CREATE TABLE`. */
-var searchColumnDefinition = (spec) => `"${spec.column}" tsvector GENERATED ALWAYS AS (${spec.expression}) STORED`;
-/** The fuzzy column definition, when the spec asks for one. */
-var fuzzyColumnDefinition = (spec) => spec.fuzzy ? `"${spec.fuzzy.column}" text GENERATED ALWAYS AS (${spec.fuzzy.expression}) STORED` : void 0;
-/**
-* Index statements for the spec.
-*
-* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
-* SQL file replayed as one unit — a migration, or `search.sql` — where a
-* concurrent build is not allowed. The boot-time ensure path runs statement by
-* statement against tables that are live and populated, and uses the
-* concurrent form instead; see `ensureSearchColumns`.
-*/
-var searchIndexStatements = (spec) => {
-	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
-	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
-	return statements;
-};
-/**
-* Marker on the comment of every generated search column this module creates.
-*
-* Versioned because the fingerprint below is only comparable against itself: a
-* future change to how it is computed has to read as "not stamped by this
-* version" rather than as drift on every existing column.
-*/
-var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
-/**
-* A stable fingerprint of one generated column's expression.
-*
-* Why a stamp rather than reading the expression back: Postgres stores a
-* generated column's expression *parsed*, and hands it back deparsed — casts
-* made explicit, identifiers requoted, schema qualifications added or dropped
-* according to `search_path`. Comparing that text to the text we generated
-* would report drift on wording, and this comparison decides whether a boot
-* refuses, so a false positive is an outage. The stamp is written by the same
-* code that writes the column, so equality means what it says.
-*/
-var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
-/**
-* The stamps for a spec's generated columns — one per column, never shared.
-*
-* Per column on purpose: turning `fuzzy` on adds a second column and changes
-* nothing about the first, and a spec-wide fingerprint would report the
-* untouched `tsvector` column as drifted and refuse a boot over a change that
-* is purely additive.
-*/
-var searchColumnStamps = (spec) => {
-	const stamp = (column, expression) => {
-		const fingerprint = searchExpressionFingerprint(expression);
-		return {
-			column,
-			expression,
-			fingerprint,
-			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
-		};
-	};
-	const stamps = [stamp(spec.column, spec.expression)];
-	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
-	return stamps;
+var quoteLiteral = (value) => {
+	if (typeof value === "number") return String(value);
+	if (typeof value === "boolean") return value ? "TRUE" : "FALSE";
+	return `'${value.replace(/'/g, "''")}'`;
 };
-/**
-* The same drift check as the boot ensure, for the SQL file.
-*
-* Needed because {@link searchColumnStamps} would otherwise *launder* drift on
-* the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
-* exists, so a re-generated `search.sql` would stamp a stale column with the
-* new block's fingerprint and the next boot would find them in agreement.
-* Guarding first means the file refuses instead — `rebase db push` is attended,
-* and the operator reading the failure is the person who changed the block.
-*/
-var searchStampGuards = (spec) => searchColumnStamps(spec).map((stamp) => {
-	const relation = quote(`"${spec.schema}"."${spec.table}"`);
-	return `DO $rebase_search$
-DECLARE recorded text;
-BEGIN
-    SELECT col_description(a.attrelid, a.attnum) INTO recorded
-    FROM pg_attribute a
-    WHERE a.attrelid = ${relation}::regclass AND a.attname = ${quote(stamp.column)} AND NOT a.attisdropped;
-    IF recorded LIKE ${quote(`${SEARCH_STAMP_PREFIX}%`)} AND recorded <> ${quote(stamp.fingerprint)} THEN
-        RAISE EXCEPTION 'Rebase: the search block for ${spec.schema}.${spec.table} changed after the generated column "${stamp.column}" was built (recorded %, expected ${stamp.fingerprint}). Postgres cannot alter a generated expression in place. Drop the column and re-apply this file — it rewrites the table and rebuilds the index: ALTER TABLE ${relation.slice(1, -1)} DROP COLUMN "${stamp.column}";', recorded;
-    END IF;
-END
-$rebase_search$;`;
-});
-/**
-* The generated column names a collection's search block adds, if any.
-*
-* These are physical columns on the table, so `SELECT *` returns them. They are
-* an index in column form — a list of lexeme positions, or a concatenation of
-* every searchable field on the row — and nothing outside the query planner has
-* any use for them. Left in, every list response carries a second, larger copy
-* of the row's text.
-*/
-var searchColumnNames = (collection) => {
-	let spec;
-	try {
-		spec = buildSearchColumnSpec(collection);
-	} catch {
-		return [];
+/** Render a resolved predicate as the body of a `WHERE` clause. */
+var renderPredicate = (predicate) => {
+	if ("and" in predicate) return predicate.and.map(renderPredicate).join(" AND ");
+	switch (predicate.op) {
+		case "is null":
+		case "is not null": return `"${predicate.column}" ${predicate.op.toUpperCase()}`;
+		case "in": return `"${predicate.column}" IN (${predicate.value.map(quoteLiteral).join(", ")})`;
+		default: return `"${predicate.column}" ${predicate.op} ${quoteLiteral(predicate.value)}`;
 	}
-	if (!spec) return [];
-	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
 };
 /**
-* True for a column whose type only ever holds a search index.
-*
-* Independent of any collection config on purpose: an introspected database
-* (BaaS mode) can carry a `tsvector` column this framework never created —
-* Pagila's `film.fulltext` is the canonical one — and it should not be returned
-* to callers either. `isDerivedIndexColumn` already keeps such a column out of
-* the *properties*; this keeps it out of the *rows*.
-*/
-var isSearchIndexColumn = (column) => {
-	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
-	return sqlType === "tsvector" || sqlType === "tsquery";
-};
-/**
-* A drizzle select projection over `table` with the search columns dropped.
+* The `CREATE INDEX` for one spec.
 *
-* Returns undefined when nothing needs dropping, so the common case keeps using
-* a plain `select()` and this stays invisible in the generated SQL.
-*/
-var visibleColumnProjection = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (!tableColumns || excluded.length === 0) return void 0;
-	const projection = {};
-	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
-	return projection;
-};
-/** The same exclusion as a drizzle `db.query` `columns` denylist. */
-var hiddenColumnsOption = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (excluded.length === 0) return void 0;
-	return Object.fromEntries(excluded.map((name) => [name, false]));
+* `concurrently` is a parameter rather than a string replacement on the way
+* out. `search-column.ts` and `vector-index.ts` both reach for
+* `.replace("CREATE INDEX IF NOT EXISTS", …)` instead, which silently does
+* nothing for a UNIQUE index — the rendered text is `CREATE UNIQUE INDEX …`
+* and the pattern never matches.
+*/
+var collectionIndexStatement = (spec, options = {}) => {
+	const unique = spec.unique ? "UNIQUE " : "";
+	const concurrently = options.concurrently ? "CONCURRENTLY " : "";
+	const ifNotExists = options.ifNotExists ? "IF NOT EXISTS " : "";
+	const using = spec.method === "btree" ? "" : ` USING ${spec.method}`;
+	const keys = spec.keys.map((k) => {
+		if (!isOrderedMethod(spec.method)) return `"${k.column}"`;
+		const direction = k.direction === "desc" ? " DESC" : "";
+		const impliedNulls = k.direction === "desc" ? "first" : "last";
+		const nulls = k.nulls === impliedNulls ? "" : ` NULLS ${k.nulls.toUpperCase()}`;
+		return `"${k.column}"${direction}${nulls}`;
+	}).join(", ");
+	const include = spec.include.length > 0 ? ` INCLUDE (${spec.include.map((c) => `"${c}"`).join(", ")})` : "";
+	const where = spec.predicate ? ` WHERE ${renderPredicate(spec.predicate)}` : "";
+	return `CREATE ${unique}INDEX ${concurrently}${ifNotExists}"${spec.indexName}" ON "${spec.schema}"."${spec.table}"${using} (${keys})${include}${where};`;
 };
+var collectionIndexStatements = (specs, options = {}) => specs.map((spec) => collectionIndexStatement(spec, options));
+var relationOf = (collection, propKey) => resolveCollectionRelations(collection)[propKey];
 /**
-* The columns to keep out of a response, by name.
+* The column a property key indexes.
 *
-* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
-* for anything that is not a real drizzle table — a stub in a test, a derived
-* or nested path with no table behind it. Nothing to exclude is the right
-* answer there, and it has to be an answer rather than a throw: this runs on
-* the read path of every collection, opted in or not.
-*/
-var excludedColumnNames = (tableColumns, collection) => {
-	if (!tableColumns || typeof tableColumns !== "object") return [];
-	const byName = new Set(collection ? searchColumnNames(collection) : []);
-	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
-};
-//#endregion
-//#region src/schema/auth-users-columns.ts
-/**
-* `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
-* — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
-* The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
-* separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
-* table that already holds a longer row.
-*/
-var AUTH_USERS_COLUMNS = [
-	{
-		column: "email",
-		type: "TEXT",
-		notNull: true
-	},
-	{
-		column: "display_name",
-		type: "TEXT"
-	},
-	{
-		column: "photo_url",
-		type: "TEXT"
-	},
-	{
-		column: "roles",
-		type: "TEXT[]",
-		default: "'{}'",
-		notNull: true
-	},
-	{
-		column: "password_hash",
-		type: "TEXT"
-	},
-	{
-		column: "email_verified",
-		type: "BOOLEAN",
-		default: "FALSE",
-		notNull: true
-	},
-	{
-		column: "email_verification_token",
-		type: "TEXT"
-	},
-	{
-		column: "email_verification_sent_at",
-		type: "TIMESTAMP WITH TIME ZONE"
-	},
-	{
-		column: "is_anonymous",
-		type: "BOOLEAN",
-		default: "FALSE",
-		notNull: true
-	},
-	{
-		column: "metadata",
-		type: "JSONB",
-		default: "'{}'",
-		notNull: true
-	},
-	{
-		column: "tokens_valid_after",
-		type: "TIMESTAMP WITH TIME ZONE"
-	},
-	{
-		column: "created_at",
-		type: "TIMESTAMP WITH TIME ZONE",
-		default: "NOW()",
-		notNull: true
-	},
-	{
-		column: "updated_at",
-		type: "TIMESTAMP WITH TIME ZONE",
-		default: "NOW()",
-		notNull: true
-	}
-];
-var BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map((c) => [c.column, c]));
-/** Type + inline constraints, as they appear after the column name. */
-function authUsersColumnSql(spec) {
-	return [
-		spec.type,
-		spec.default !== void 0 ? `DEFAULT ${spec.default}` : "",
-		spec.notNull ? "NOT NULL" : ""
-	].filter(Boolean).join(" ");
-}
-/**
-* The auth-owned definition for a physical column name, or `undefined` when
-* auth does not own it.
+* A `belongsTo` resolves to its `localKey` — `primaryCategory` becomes
+* `primary_category_id` — which is the case an index is most often wanted for
+* and the case where the property key and the column differ. Everything else
+* goes through `resolveColumnName`.
 *
-* Callers pass the RESOLVED column name (after `columnName` mapping), because
-* that is the only name the three creators agree on: the scaffold's users
-* collection spells the property `displayName` and the column `display_name`.
+* The other relation kinds have no local column at all: the foreign key lives
+* on the target's table, or in a junction. Indexing them here is refused
+* rather than resolved to a column that does not exist.
 */
-function authUsersColumnDefinition(column) {
-	const spec = BY_COLUMN.get(column);
-	return spec ? authUsersColumnSql(spec) : void 0;
-}
-/**
-* Whether a collection is an auth collection, i.e. whether the definitions in
-* this module apply to its table at all.
-*
-* Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
-* that one takes a `CollectionConfig`, this one is called from DDL code paths
-* that hold looser objects, and both spellings must accept `auth: true` as well
-* as `auth: { enabled: true }`.
-*/
-function isAuthCollection(collection) {
-	const auth = collection?.auth;
-	if (auth === true) return true;
-	return typeof auth === "object" && auth !== null && auth.enabled === true;
-}
-//#endregion
-//#region src/schema/vector-index.ts
-/**
-* The widest `vector` pgvector will build an HNSW or IVFFlat index over.
-* Storage and exact search are unaffected by this limit.
-*/
-var MAX_INDEXABLE_VECTOR_DIMENSIONS = 2e3;
-/**
-* Operator class per distance. These strings are part of the database contract:
-* they appear in `CREATE INDEX`, so renaming one renames an index.
-*/
-var OPERATOR_CLASS = {
-	cosine: "vector_cosine_ops",
-	l2: "vector_l2_ops",
-	inner_product: "vector_ip_ops"
-};
-/** Short, stable tag per distance, used to name the index. */
-var DISTANCE_TAG = {
-	cosine: "cosine",
-	l2: "l2",
-	inner_product: "ip"
-};
-var VectorIndexConfigError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "VectorIndexConfigError";
+var resolveIndexableColumn = (collection, propKey, resolveColumnName, fail) => {
+	const relation = relationOf(collection, propKey);
+	if (relation) {
+		if (relation.kind === "belongsTo") return relation.localKey;
+		fail(`"${propKey}" is a ${relation.kind} relation, which has no column on this table — the foreign key lives on "${relation.targetSlug}". Declare the index there.`);
 	}
+	const property = collection.properties?.[propKey];
+	if (!property) fail(`"${propKey}" is not a property of this collection.`);
+	return resolveColumnName(propKey, property);
 };
-var isVectorProperty = (prop) => !!prop && typeof prop === "object" && prop.type === "vector";
-var asDistances = (config, label) => {
-	const raw = config.distance ?? "cosine";
-	const list = Array.isArray(raw) ? raw : [raw];
-	if (list.length === 0) throw new VectorIndexConfigError(`${label}: \`index.distance\` is an empty array. Name at least one distance, or set \`index: false\` to create no index.`);
-	const seen = /* @__PURE__ */ new Set();
-	for (const distance of list) {
-		if (!(distance in OPERATOR_CLASS)) throw new VectorIndexConfigError(`${label}: \`index.distance\` is "${distance}", which is not a pgvector distance. Use ${Object.keys(OPERATOR_CLASS).map((d) => `"${d}"`).join(", ")}.`);
-		if (seen.has(distance)) throw new VectorIndexConfigError(`${label}: \`index.distance\` lists "${distance}" twice.`);
-		seen.add(distance);
-	}
-	return list;
-};
-var assertPositiveInteger = (value, key, label) => {
-	if (value === void 0) return;
-	if (!Number.isInteger(value) || value <= 0) throw new VectorIndexConfigError(`${label}: \`index.${key}\` is ${JSON.stringify(value)}. It must be a positive integer.`);
-};
-/**
-* Index parameters for one method. Parameters belonging to the *other* method
-* are rejected rather than ignored, because a silently dropped `lists` on an
-* HNSW index reads, from the config, exactly like a tuned index.
-*/
-var parametersFor = (method, config, label) => {
-	assertPositiveInteger(config.m, "m", label);
-	assertPositiveInteger(config.efConstruction, "efConstruction", label);
-	assertPositiveInteger(config.lists, "lists", label);
-	if (method === "hnsw") {
-		if (config.lists !== void 0) throw new VectorIndexConfigError(`${label}: \`index.lists\` only applies to \`method: "ivfflat"\`. Remove it, or switch the method.`);
-		const params = [];
-		if (config.m !== void 0) params.push(["m", config.m]);
-		if (config.efConstruction !== void 0) params.push(["ef_construction", config.efConstruction]);
-		return params;
-	}
-	for (const key of ["m", "efConstruction"]) if (config[key] !== void 0) throw new VectorIndexConfigError(`${label}: \`index.${key}\` only applies to \`method: "hnsw"\`. Remove it, or switch the method.`);
-	return config.lists !== void 0 ? [["lists", config.lists]] : [];
-};
-/**
-* Every ANN index a collection's vector properties call for.
-*
-* `resolveColumn` is passed in rather than imported so that this module stays
-* free of the DDL generator, which imports *it*. Both callers hand it the same
-* `resolveColumnName`, and a contract test asserts the names agree.
-*/
-var buildVectorIndexPlan = (collection, resolveColumn) => {
-	const specs = [];
-	const skipped = [];
-	const properties = collection.properties ?? {};
-	const table = getTableName(collection);
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	for (const [propName, prop] of Object.entries(properties)) {
-		if (!isVectorProperty(prop)) continue;
-		if (prop.index === false) continue;
-		const label = `${collection.slug}.${propName}`;
-		const column = resolveColumn(propName, prop);
-		const config = prop.index ?? {};
-		const method = config.method ?? "hnsw";
-		if (method !== "hnsw" && method !== "ivfflat") throw new VectorIndexConfigError(`${label}: \`index.method\` is "${method}". Use "hnsw" or "ivfflat".`);
-		const distances = asDistances(config, label);
-		const parameters = parametersFor(method, config, label);
-		if (!Number.isInteger(prop.dimensions) || prop.dimensions <= 0) throw new VectorIndexConfigError(`${label}: \`dimensions\` is ${JSON.stringify(prop.dimensions)}. It must be a positive integer.`);
-		if (prop.dimensions > 2e3) {
-			skipped.push({
-				schema,
-				table,
-				column,
-				dimensions: prop.dimensions,
-				reason: `pgvector cannot index a vector wider than ${MAX_INDEXABLE_VECTOR_DIMENSIONS} dimensions, and ${label} declares ${prop.dimensions}. The column works and \`vectorSearch\` still answers, as an exact scan. To index it, reduce the dimensions (many embedding models support a shorter output) or set \`index: false\` to state that the scan is intended.`
-			});
-			continue;
-		}
-		for (const distance of distances) specs.push({
-			schema,
-			table,
+var resolvePredicate = (collection, predicate, resolveColumnName, fail) => {
+	if ("and" in predicate) return { and: predicate.and.map((p) => resolvePredicate(collection, p, resolveColumnName, fail)) };
+	const column = resolveIndexableColumn(collection, predicate.prop, resolveColumnName, fail);
+	switch (predicate.op) {
+		case "is null":
+		case "is not null": return {
 			column,
-			indexName: toPostgresIdentifier(`${table}_${column}_${method}_${DISTANCE_TAG[distance]}`),
-			method,
-			distance,
-			operatorClass: OPERATOR_CLASS[distance],
-			parameters
-		});
-	}
-	return {
-		specs,
-		skipped
-	};
-};
-/**
-* The `CREATE INDEX` for one spec.
-*
-* `CONCURRENTLY` is deliberately absent, for the same reason it is absent from
-* `searchIndexStatements`: this form is replayed as part of a migration, where
-* a concurrent build is not allowed. The boot-time ensure rewrites it — see
-* `ensureCollectionTables`.
-*/
-var vectorIndexStatement = (spec) => {
-	const params = spec.parameters.length ? ` WITH (${spec.parameters.map(([key, value]) => `${key} = ${value}`).join(", ")})` : "";
-	return `CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING ${spec.method} ("${spec.column}" ${spec.operatorClass})${params};`;
-};
-/** Every statement for a plan, in a stable order. */
-var vectorIndexStatements = (plan) => plan.specs.map(vectorIndexStatement);
-//#endregion
-//#region src/schema/generate-postgres-ddl-logic.ts
-var resolveColumnName = (propName, prop) => {
-	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
-	return toSnakeCase(propName);
-};
-var getPrimaryKeyProp = (collection) => {
-	if (collection.properties) {
-		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
-		if (idPropEntry) {
-			const prop = idPropEntry[1];
-			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			op: predicate.op
+		};
+		case "in":
+			if (new Set(predicate.value).size !== predicate.value.length) fail(`the \`in\` list for "${predicate.prop}" repeats a value, which changes nothing.`);
 			return {
-				name: idPropEntry[0],
-				type: prop.type === "number" ? "number" : "string",
-				isUuid
+				column,
+				op: "in",
+				value: [...predicate.value]
 			};
-		}
-	}
-	const idProp = collection.properties?.["id"];
-	if (idProp?.type === "number") return {
-		name: "id",
-		type: "number",
-		isUuid: false
-	};
-	return {
-		name: "id",
-		type: "string",
-		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
-	};
-};
-var isNumericId = (collection) => {
-	return getPrimaryKeyProp(collection).type === "number";
-};
-var getPrimaryKeyName = (collection) => {
-	return getPrimaryKeyProp(collection).name;
-};
-/** The column type a junction holds for one endpoint's primary key. */
-var junctionKeyType = (collection) => isNumericId(collection) ? "INTEGER" : getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT";
-var isIdProperty = (propName, prop, collection) => {
-	if ("isId" in prop && Boolean(prop.isId)) return true;
-	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
-};
-/**
-* Render statements produced by {@link generatePolicyStatements} back into the
-* exact string the DDL/policies files have always carried: each statement on
-* its own line, terminated by a newline. Keeping the string form derived from
-* the statement array means the two can never drift — the boot-time applier and
-* the generated `policies.sql` emit the same SQL, from the same source.
-*/
-var statementsToDdl = (statements) => statements.map((s) => `${s}\n`).join("");
-var generatePolicyDdl = (collection, rule, resolveCollection) => statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
-/**
-* The individual SQL statements a single security rule compiles to: a
-* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
-* statement (terminated by `;`, no trailing newline).
-*
-* This is the primitive the boot-time RLS applier runs one statement at a time
-* (the runtime's DB handle speaks the extended query protocol, which forbids
-* multiple commands in one execute), while `db push` writes the joined string.
-*/
-var generatePolicyStatements = (collection, rule, resolveCollection) => {
-	const tableName = getTableName(collection);
-	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const policyNames = getPolicyNamesForRule(rule, tableName);
-	return ops.flatMap((op, opIdx) => {
-		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
-	});
-};
-var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const tableName = getTableName(collection);
-	const mode = (rule.mode ?? "permissive").toUpperCase();
-	const operationUpper = operation.toUpperCase();
-	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
-	const needsUsing = operation !== "insert";
-	const needsWithCheck = operation !== "select" && operation !== "delete";
-	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
-	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
-	if (!usingClause && needsUsing) usingClause = "false";
-	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
-	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
-	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
-	if (usingClause) create += ` USING (${usingClause})`;
-	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
-	create += ";";
-	return [drop, create];
-};
-/**
-* Single-quote escaping for a SQL string literal (PostgreSQL doubles the
-* quote). Enum labels come straight from user-authored collection config, so a
-* label like `it's` closes the literal early and the whole generated file stops
-* parsing at the `CREATE TYPE`. Lives here rather than next to its other caller
-* because ensure-collection-tables already imports from this module — the
-* reverse would be a cycle.
-*/
-var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
-var getSqlColumnType = (propName, prop, collection, collections) => {
-	switch (prop.type) {
-		case "string": {
-			const stringProp = prop;
-			if (stringProp.enum) {
-				const tableName = getTableName(collection);
-				const colName = resolveColumnName(propName, prop);
-				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
-			}
-			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
-			if (stringProp.columnType === "char") return `CHAR(${resolveStringColumnLength(stringProp)})`;
-			if (stringProp.columnType === "varchar") return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
-			return "TEXT";
-		}
-		case "number": {
-			const numProp = prop;
-			const isId = isIdProperty(propName, prop, collection);
-			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
-			if (numProp.columnType) {
-				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
-				return numProp.columnType.toUpperCase();
-			}
-			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
-		}
-		case "boolean": return "BOOLEAN";
-		case "date": {
-			const dateProp = prop;
-			if (dateProp.columnType === "date") return "DATE";
-			if (dateProp.columnType === "time") return "TIME";
-			return "TIMESTAMP WITH TIME ZONE";
-		}
-		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
-		case "geopoint": return "JSONB";
-		case "array": {
-			const arrayProp = prop;
-			let colType = arrayProp.columnType;
-			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
-				const ofProp = arrayProp.of;
-				if (ofProp.type === "string") colType = "text[]";
-				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
-				else if (ofProp.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "json") return "JSON";
-			if (colType === "text[]") return "TEXT[]";
-			if (colType === "integer[]") return "INTEGER[]";
-			if (colType === "boolean[]") return "BOOLEAN[]";
-			if (colType === "numeric[]") return "NUMERIC[]";
-			return "JSONB";
-		}
-		case "vector": return `VECTOR(${prop.dimensions})`;
-		case "binary": return "BYTEA";
-		case "relation": {
-			const refProp = prop;
-			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
-			let targetCollection;
-			try {
-				targetCollection = relation.target();
-			} catch {
-				return "TEXT";
-			}
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
-		}
-		case "reference": {
-			const refProp = prop;
-			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-			if (!targetCollection) return "TEXT";
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
-		}
-		default: throw new Error(`No Postgres column type for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getSqlColumnType\` (and to \`getDrizzleColumn\`, which must agree).`);
-	}
-};
-var generatePostgresSearchDdl = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const specs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
-	if (specs.length === 0) return "";
-	const extensions = Array.from(new Set(specs.flatMap(searchExtensionStatements)));
-	const helpers = Array.from(new Set(specs.flatMap(searchHelperFunctions)));
-	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n";
-	ddl += "--\n";
-	ddl += "-- Full-text search for the collections declaring a `search` block.\n";
-	ddl += "-- Applied by Rebase, not by Atlas — see generatePostgresSearchDdl.\n\n";
-	extensions.forEach((s) => {
-		ddl += `${s}\n`;
-	});
-	if (extensions.length > 0) ddl += "\n";
-	helpers.forEach((s) => {
-		ddl += `${s}\n\n`;
-	});
-	for (const collection of collections) {
-		const spec = buildSearchColumnSpec(collection);
-		if (!spec) continue;
-		const table = `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${getTableName(collection)}"`;
-		searchStampGuards(spec).forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${searchColumnDefinition(spec)};\n`;
-		const fuzzyDef = fuzzyColumnDefinition(spec);
-		if (fuzzyDef) ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${fuzzyDef};\n`;
-		searchColumnStamps(spec).forEach((s) => {
-			ddl += `${s.sql}\n`;
-		});
-		searchIndexStatements(spec).forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		ddl += "\n";
-	}
-	return ddl;
-};
-var generatePostgresDdl = async (allCollections, options = {
-	includePolicies: true,
-	includeSearch: true
-}) => {
-	const collections = relationalCollections(allCollections);
-	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n\n";
-	const uniqueSchemas = Array.from(/* @__PURE__ */ new Set([REBASE_SCHEMA, ...collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)]));
-	uniqueSchemas.forEach((schema) => {
-		if (schema) ddl += `CREATE SCHEMA IF NOT EXISTS "${schema}";\n`;
-	});
-	if (uniqueSchemas.length > 0) ddl += "\n";
-	const searchSpecs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
-	if (searchSpecs.length > 0) if (options.includeSearch === false) ddl += "-- Full-text search support lives in `search.sql`, applied separately.\n\n";
-	else {
-		const extensions = Array.from(new Set(searchSpecs.flatMap(searchExtensionStatements)));
-		const helpers = Array.from(new Set(searchSpecs.flatMap(searchHelperFunctions)));
-		ddl += "-- Full-text search support (collections declaring a `search` block)\n";
-		extensions.forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		if (extensions.length > 0) ddl += "\n";
-		helpers.forEach((s) => {
-			ddl += `${s}\n\n`;
-		});
-	}
-	const emittedEnums = /* @__PURE__ */ new Set();
-	collections.forEach((collection) => {
-		const collectionTable = getTableName(collection);
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
-				const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;
-				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
-				if (values.length > 0 && !emittedEnums.has(`${schema}.${enumDbName}`)) {
-					emittedEnums.add(`${schema}.${enumDbName}`);
-					ddl += `CREATE TYPE "${schema}"."${enumDbName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});\n`;
-				}
-			}
-		});
-	});
-	if (ddl.endsWith(";\n")) ddl += "\n";
-	const junctionSpecs = resolveJunctionSpecs(collections);
-	const allTablesToGenerate = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (tableName) allTablesToGenerate.set(tableName, { collection });
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
-			const junctionTableName = relation.through.table;
-			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
-				collection: {
-					table: junctionTableName,
-					properties: {}
-				},
-				isJunction: true,
-				relation,
-				sourceCollection: collection
-			});
-		}
-	}
-	const fkStatements = [];
-	const indexStatements = [];
-	const policyStatements = [];
-	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
-			const targetCollection = relation.target();
-			const sourceTable = getTableName(sourceCollection);
-			const targetTable = getTableName(targetCollection);
-			const sourceSchema = isPostgresCollectionConfig(sourceCollection) && sourceCollection.schema ? sourceCollection.schema : "public";
-			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-			const { sourceColumn, targetColumn } = relation.through;
-			const sourceColType = isNumericId(sourceCollection) ? "INTEGER" : getPrimaryKeyProp(sourceCollection).isUuid ? "UUID" : "TEXT";
-			const targetColType = isNumericId(targetCollection) ? "INTEGER" : getPrimaryKeyProp(targetCollection).isUuid ? "UUID" : "TEXT";
-			const sourceId = getPrimaryKeyName(sourceCollection);
-			const targetId = getPrimaryKeyName(targetCollection);
-			const onDelete = relation.onDelete ?? "CASCADE";
-			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
-			ddl += `  "${sourceColumn}" ${sourceColType} NOT NULL,\n`;
-			ddl += `  "${targetColumn}" ${targetColType} NOT NULL,\n`;
-			ddl += `  PRIMARY KEY ("${sourceColumn}", "${targetColumn}")\n`;
-			ddl += `);\n\n`;
-			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${sourceColumn}_fkey`)}" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
-			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${targetColumn}_fkey`)}" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-			if (options.includePolicies) {
-				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-				ddl += `\n`;
-				const spec = junctionSpecs.get(baseTableName);
-				if (spec) {
-					const junctionCollection = getJunctionCollectionConfig(spec);
-					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-					getJunctionSecurityRules(spec).forEach((rule) => {
-						policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
-					});
-				}
-			}
-		} else if (!isJunction) {
-			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
-			const columns = [];
-			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-				if (prop.type === "relation") {
-					const refProp = prop;
-					const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-					if (relInfo?.kind !== "belongsTo") return;
-					if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) return;
-					let targetCollection;
-					try {
-						targetCollection = relInfo.target();
-					} catch {
-						return;
-					}
-					const targetTable = getTableName(targetCollection);
-					const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-					const targetId = getPrimaryKeyName(targetCollection);
-					const fkColType = getSqlColumnType(propName, prop, collection, collections);
-					const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : "";
-					const required = prop.validation?.required;
-					const onDeleteVal = relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL");
-					let colDef = `  "${relInfo.localKey}" ${fkColType}`;
-					if (required) colDef += " NOT NULL";
-					columns.push(colDef);
-					fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${relInfo.localKey}_fkey`)}" FOREIGN KEY ("${relInfo.localKey}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);
-				} else if (prop.type === "reference") {
-					const refProp = prop;
-					const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-					const colName = resolveColumnName(propName, prop);
-					const colType = getSqlColumnType(propName, prop, collection, collections);
-					const required = prop.validation?.required;
-					if (!targetCollection) {
-						let colDef = `  "${colName}" ${colType}`;
-						if (required) colDef += " NOT NULL";
-						columns.push(colDef);
-					} else {
-						const targetTable = getTableName(targetCollection);
-						const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-						const targetId = getPrimaryKeyName(targetCollection);
-						const onDelete = required ? "CASCADE" : "SET NULL";
-						let colDef = `  "${colName}" ${colType}`;
-						if (required) colDef += " NOT NULL";
-						columns.push(colDef);
-						fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${colName}_fkey`)}" FOREIGN KEY ("${colName}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-					}
-				} else {
-					const colName = resolveColumnName(propName, prop);
-					const authDefinition = isAuthCollection(collection) ? authUsersColumnDefinition(colName) : void 0;
-					if (authDefinition && !isIdProperty(propName, prop, collection)) {
-						columns.push(`  "${colName}" ${authDefinition}`);
-						return;
-					}
-					let colDef = `  "${colName}" ${getSqlColumnType(propName, prop, collection, collections)}`;
-					if (isIdProperty(propName, prop, collection)) colDef += " PRIMARY KEY";
-					if ("isId" in prop && prop.isId !== "manual" && prop.isId !== true && prop.isId !== "increment") {
-						if (prop.isId === "uuid") colDef += " DEFAULT gen_random_uuid()";
-						else if (prop.isId === "cuid") colDef += " DEFAULT cuid()";
-						else if (typeof prop.isId === "string") colDef += ` DEFAULT ${prop.isId}`;
-					}
-					if (!isIdProperty(propName, prop, collection) && prop.validation?.unique) colDef += " UNIQUE";
-					if (prop.type === "date") {
-						const dateProp = prop;
-						if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") colDef += " DEFAULT now()";
-					}
-					if (prop.validation?.required && !colDef.includes("PRIMARY KEY")) colDef += " NOT NULL";
-					columns.push(colDef);
-				}
-			});
-			if (isAuthCollection(collection)) {
-				const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
-				for (const spec of AUTH_USERS_COLUMNS) {
-					if (declared.has(spec.column)) continue;
-					columns.push(`  "${spec.column}" ${authUsersColumnSql(spec)}`);
-				}
-			}
-			const searchSpec = options.includeSearch === false ? void 0 : buildSearchColumnSpec(collection);
-			if (searchSpec) {
-				columns.push(`  ${searchColumnDefinition(searchSpec)}`);
-				const fuzzyDef = fuzzyColumnDefinition(searchSpec);
-				if (fuzzyDef) columns.push(`  ${fuzzyDef}`);
-				indexStatements.push(...searchIndexStatements(searchSpec));
-			}
-			const vectorPlan = buildVectorIndexPlan(collection, resolveColumnName);
-			indexStatements.push(...vectorIndexStatements(vectorPlan));
-			for (const skip of vectorPlan.skipped) indexStatements.push(`-- No ANN index on "${skip.schema}"."${skip.table}"."${skip.column}": ${skip.reason}`);
-			if (!columns.some((c) => c.includes("PRIMARY KEY"))) columns.unshift("  \"id\" TEXT PRIMARY KEY");
-			ddl += columns.join(",\n");
-			ddl += `\n);\n\n`;
-			if (options.includePolicies) {
-				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-				ddl += `\n`;
-				const securityRules = getEffectiveSecurityRules(collection);
-				if (securityRules.length > 0) {
-					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-					securityRules.forEach((rule) => {
-						policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
-					});
-				}
-			}
-		}
-	}
-	if (fkStatements.length > 0) {
-		ddl += "-- Foreign Key Constraints\n";
-		ddl += fkStatements.join("\n") + "\n\n";
-	}
-	if (indexStatements.length > 0) {
-		ddl += "-- Indexes\n";
-		ddl += indexStatements.join("\n") + "\n\n";
-	}
-	if (policyStatements.length > 0) {
-		ddl += "-- Row Level Security Policies\n";
-		ddl += policyStatements.join("");
-		ddl += "\n";
-	}
-	return ddl;
-};
-var schemaOfCollection = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
-/**
-* Truncate a derived identifier the way Postgres does: to 63 bytes, silently.
-*
-* This is not cosmetic, and not really a naming choice at all — it is agreeing
-* with the name the database ALREADY stored. `ADD CONSTRAINT` on a longer name
-* succeeds and records the truncated form, so the untruncated name this used to
-* derive matched nothing in the catalogue. Boot-ensure compares its planned
-* constraints against `readExistingSchema`, which reads catalogue names, so the
-* comparison could never hit: every boot re-issued `ADD CONSTRAINT` for the same
-* constraint, forever, and got "already exists" every time. Non-fatal (foreign
-* keys are the one action allowed to fail) and therefore permanent — an error in
-* the log on every restart of a project whose table and column names happened to
-* be long.
-*
-* Byte length, not string length: NAMEDATALEN is 64 bytes, and a multi-byte
-* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
-*/
-var foreignKeyPlan = (args) => {
-	const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
-	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
-	return {
-		constraintName,
-		schema: args.schema,
-		table: args.table,
-		column: args.column,
-		targetSchema: args.targetSchema,
-		targetTable: args.targetTable,
-		targetColumn: args.targetColumn,
-		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
-	};
-};
-/**
-* The FK columns the declared collections own — one entry per `relation`
-* (`belongsTo` side) or `reference` property.
-*
-* Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
-* create the same columns with the same names, types and constraints. Before
-* this it skipped them outright, which was survivable only because `db push`
-* always followed; on a managed tenant nothing follows, so a table arrived
-* without the column its own collection reads and wrote 400 on every insert.
-*
-* A relation whose target is not in the bundle yields no column at all (the
-* generator returns early on an unresolvable target); a `reference` whose target
-* is unknown yields the column without a constraint. Both mirror the generator
-* exactly — a divergence here is a schema fork between boot and `db push`.
-*/
-var planRelationalColumns = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const plans = [];
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (!tableName) continue;
-		const schema = schemaOfCollection(collection);
-		const table = bareTableName(tableName);
-		for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
-			const prop = rawProp;
-			if (prop.type === "relation") {
-				const refProp = prop;
-				const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-				if (relInfo?.kind !== "belongsTo") continue;
-				if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
-				let targetCollection;
-				try {
-					targetCollection = relInfo.target();
-				} catch {
-					continue;
-				}
-				if (!targetCollection) continue;
-				const required = prop.validation?.required;
-				const relationName = refProp.relation?.relationName ?? propName;
-				const legacyKey = legacyForeignKeyName(relationName);
-				const derived = relInfo.localKey === generateForeignKeyName(relationName);
-				plans.push({
-					schema,
-					table,
-					column: relInfo.localKey,
-					legacyColumn: derived && legacyKey !== relInfo.localKey ? legacyKey : void 0,
-					type: getSqlColumnType(propName, prop, collection, collections),
-					foreignKey: foreignKeyPlan({
-						schema,
-						table,
-						column: relInfo.localKey,
-						targetSchema: schemaOfCollection(targetCollection),
-						targetTable: bareTableName(getTableName(targetCollection)),
-						targetColumn: getPrimaryKeyName(targetCollection),
-						onDelete: relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL"),
-						onUpdate: relInfo.onUpdate
-					})
-				});
-			} else if (prop.type === "reference") {
-				const refProp = prop;
-				const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-				const column = resolveColumnName(propName, prop);
-				const type = getSqlColumnType(propName, prop, collection, collections);
-				const required = prop.validation?.required;
-				plans.push({
-					schema,
-					table,
-					column,
-					type,
-					foreignKey: targetCollection ? foreignKeyPlan({
-						schema,
-						table,
-						column,
-						targetSchema: schemaOfCollection(targetCollection),
-						targetTable: bareTableName(getTableName(targetCollection)),
-						targetColumn: getPrimaryKeyName(targetCollection),
-						onDelete: required ? "CASCADE" : "SET NULL"
-					}) : void 0
-				});
-			}
-		}
-	}
-	return plans;
-};
-/**
-* The junction tables a bundle's many-to-many relations imply.
-*
-* Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
-* comes from, so a table created here always has policies planned for it — a
-* junction with row-level security left off is readable and writable by every
-* signed-in user, which is why the two must ship together.
-*/
-var planJunctionTables = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const plans = [];
-	for (const spec of resolveJunctionSpecs(collections).values()) {
-		const [source, target] = spec.endpoints;
-		const legacyFor = (endpoint) => {
-			const slug = toSnakeCase(endpoint.collection.slug ?? endpoint.collection.name ?? "");
-			const legacy = legacyForeignKeyName(slug);
-			return endpoint.junctionColumn === generateForeignKeyName(slug) && legacy !== endpoint.junctionColumn ? legacy : void 0;
+		default: return {
+			column,
+			op: predicate.op,
+			value: predicate.value
 		};
-		const columns = [{
-			name: source.junctionColumn,
-			type: junctionKeyType(source.collection),
-			legacyName: legacyFor(source)
-		}, {
-			name: target.junctionColumn,
-			type: junctionKeyType(target.collection),
-			legacyName: legacyFor(target)
-		}];
-		const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
-		plans.push({
-			schema: spec.schema,
-			table: spec.table,
-			columns,
-			createTable: `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` + columns.map((c) => `"${c.name}" ${c.type} NOT NULL`).join(", ") + `, PRIMARY KEY (${columns.map((c) => `"${c.name}"`).join(", ")}));`,
-			foreignKeys: [source, target].map((endpoint, i) => foreignKeyPlan({
-				schema: spec.schema,
-				table: spec.table,
-				column: columns[i].name,
-				targetSchema: schemaOfCollection(endpoint.collection),
-				targetTable: bareTableName(getTableName(endpoint.collection)),
-				targetColumn: getPrimaryKeyName(endpoint.collection),
-				onDelete
-			}))
-		});
-	}
-	return plans;
-};
-/**
-* The per-table RLS plan for the *declared* collections, as executable
-* statements — what the managed runtime applies at boot so a freshly
-* provisioned tenant database serves data instead of 401ing every read.
-*
-* Mirrors {@link generatePostgresPoliciesDdl} exactly (same
-* `generatePolicyStatements`, same enable-RLS, same effective rules, same
-* derived junction rules), so boot and `db push` produce identical policies from
-* identical collections.
-*
-* Junction tables are included, and have to be: boot creates them now
-* ({@link planJunctionTables}), and a junction with RLS left off is readable and
-* writable by every signed-in user. A junction whose table is still absent is
-* skipped by the applier, not planned away here.
-*/
-var planCollectionPolicies = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-	const plans = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (!tableName) continue;
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-		const qualified = `${schema}.${baseTableName}`;
-		if (seen.has(qualified)) continue;
-		seen.add(qualified);
-		const policyStatements = [];
-		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
-		plans.push({
-			schema,
-			table: baseTableName,
-			qualified,
-			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
-			policyStatements
-		});
-	}
-	for (const spec of resolveJunctionSpecs(collections).values()) {
-		const qualified = `${spec.schema}.${spec.table}`;
-		if (seen.has(qualified)) continue;
-		seen.add(qualified);
-		const junctionCollection = getJunctionCollectionConfig(spec);
-		const policyStatements = [];
-		for (const rule of getJunctionSecurityRules(spec)) policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
-		plans.push({
-			schema: spec.schema,
-			table: spec.table,
-			qualified,
-			enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
-			policyStatements
-		});
 	}
-	return plans;
 };
-var generatePostgresPoliciesDdl = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
-	const allTablesToGenerate = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (tableName) allTablesToGenerate.set(tableName, { collection });
-	}
-	for (const [tableName, { collection }] of allTablesToGenerate.entries()) {
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-		ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-		ddl += `\n`;
-		const securityRules = getEffectiveSecurityRules(collection);
-		if (securityRules.length > 0) {
-			const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-			const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
-			securityRules.forEach((rule) => {
-				if (rule.name && injectedNames.has(rule.name)) {
-					ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
-					ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
-				}
-				ddl += generatePolicyDdl(collection, rule, resolveCollection);
-			});
-			ddl += "\n";
-		}
-	}
-	const junctionSpecs = resolveJunctionSpecs(collections);
-	for (const spec of junctionSpecs.values()) {
-		ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
-		ddl += `\n`;
-		const junctionRules = getJunctionSecurityRules(spec);
-		if (junctionRules.length === 0) continue;
-		const junctionCollection = getJunctionCollectionConfig(spec);
-		const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-		const declaringSlugs = spec.declaringSides.map((s) => s.collection.slug).join("\", \"");
-		ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
-		ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
-		ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
-		ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
-		junctionRules.forEach((rule) => {
-			ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
-		});
-		ddl += "\n";
-	}
-	return ddl;
-};
-//#endregion
-//#region src/schema/ensure-collection-tables.ts
+/** The primary key columns of a collection, for the "you already have this" refusal. */
+var primaryKeyColumns = (collection, resolveColumnName) => Object.entries(collection.properties ?? {}).filter(([, prop]) => prop && typeof prop === "object" && "isId" in prop && Boolean(prop.isId)).map(([key, prop]) => resolveColumnName(key, prop));
 /**
-* Bringing a database up to date with a bundle's collections, additively.
+* Every index one collection declares, resolved and named.
 *
-* ## Why this exists
-*
-* A managed runtime boots someone else's compiled project against a database it
-* has never seen. Auth tables are ensured at boot already, but collection tables
-* were not created by anything: the platform ran the app and every `/api/data/*`
-* request answered 500 on a missing relation. `rebase db push` cannot help — it
-* is an Atlas-driven CLI command, and the runtime image ships no CLI.
-*
-* ## Why additive-only, forever
-*
-* This runs unattended, against a database with customers' data in it, with no
-* human reading a diff. So it may only ever do things that cannot lose data:
-* create a missing table, add a missing column, create a missing enum type.
-*
-* It will **never** drop a table or a column, narrow a type, or alter a
-* constraint. A removed field leaves its column behind; a renamed field looks
-* like an addition and the old column stays. That is the correct trade for an
-* automated path — the alternative is an unattended process that can silently
-* destroy a column, which is precisely the failure `db push` was hardened
-* against. Destructive changes stay a deliberate, human-reviewed migration.
-*
-* Because of that, this is safe to run on every boot, and re-running it is a
-* no-op.
-*/
-var ensure_collection_tables_exports = /* @__PURE__ */ __exportAll({
-	ensureCollectionTables: () => ensureCollectionTables,
-	planCollectionSchemaEnsure: () => planCollectionSchemaEnsure,
-	readExistingSchema: () => readExistingSchema,
-	readSchemaFactsFor: () => readSchemaFactsFor
-});
-/** Postgres identifiers this module is willing to interpolate. */
-var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-function assertSafeIdentifier(value, what) {
-	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
-	return value;
-}
-function schemaOf(collection) {
-	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-}
-function qualified(collection) {
-	return `${schemaOf(collection)}.${getTableName(collection)}`;
-}
-/**
-* Enum types a collection's properties require, as `schema.typename`.
-*
-* Named exactly as the DDL generator names them (`<table>_<column>`), because
-* a column added here has to reference the same type the generator would have
-* created — a second, differently-named type for the same field would be a
-* silent schema fork.
+* Throws {@link CollectionIndexConfigError} rather than dropping a bad entry:
+* an index that silently does not exist is the failure mode this whole feature
+* is here to remove.
 */
-function requiredEnums(collection) {
+var buildCollectionIndexSpecs = (collection, resolveColumnName) => {
+	if (!isPostgresCollectionConfig(collection)) return [];
+	const declared = collection.indexes;
+	if (!declared || declared.length === 0) return [];
+	const slug = collection.slug ?? getTableName(collection);
+	const schema = collection.schema ?? "public";
 	const table = getTableName(collection);
-	const schema = schemaOf(collection);
-	const out = [];
-	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
-		const p = prop;
-		if (!("enum" in p) || !p.enum) continue;
-		if (p.type !== "string" && p.type !== "number") continue;
-		const values = p.enum.map((entry) => entry && typeof entry === "object" && "id" in entry ? String(entry.id) : String(entry)).filter((v) => v.length > 0);
-		if (values.length === 0) continue;
-		out.push({
-			name: `${schema}.${table}_${resolveColumnName(propName, p)}`,
-			values
-		});
-	}
-	return out;
-}
-/**
-* Decide what to add. Pure — the caller supplies what exists and runs the result.
-*
-* Ordering matters and is deliberate: enum types before the tables and columns
-* that reference them, tables before the columns added to other tables (a new
-* table may be the target of a relation), and nothing is emitted twice.
-*/
-function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
-	const constraintPolicy = options.constraints ?? "additive";
-	const withheldConstraints = [];
-	assertSearchIsPostgresOnly(allCollections);
-	const collections = relationalCollections(allCollections);
-	const actions = [];
-	const plannedEnums = /* @__PURE__ */ new Set();
-	for (const collection of collections) for (const { name, values } of requiredEnums(collection)) {
-		if (existing.enums.has(name) || plannedEnums.has(name)) {
-			const current = existing.enumValues?.get(name);
-			if (!current || plannedEnums.has(name)) continue;
-			const [schema, typeName] = name.split(".");
-			for (const value of values) {
-				if (current.includes(value)) continue;
-				actions.push({
-					kind: "add-enum-value",
-					target: `${name}.${value}`,
-					sql: `ALTER TYPE "${schema}"."${typeName}" ADD VALUE IF NOT EXISTS ${quoteSqlLiteral(value)};`
-				});
-			}
-			continue;
+	const pk = primaryKeyColumns(collection, resolveColumnName).sort().join(",");
+	const specs = [];
+	const byName = /* @__PURE__ */ new Map();
+	declared.forEach((index, position) => {
+		const fail = (message) => {
+			throw new CollectionIndexConfigError(slug, position, message);
+		};
+		if (typeof index.reason !== "string" || index.reason.trim() === "") fail("`reason` is required — see the doc comment. An index nobody can justify is one nobody can delete.");
+		if (!Array.isArray(index.on) || index.on.length === 0) fail("`on` must name at least one property.");
+		if (index.on.length > 5) fail(`\`on\` has ${index.on.length} keys; the limit is 5. Payload columns belong in \`include\`.`);
+		const method = index.using ?? "btree";
+		const unique = method === "btree" && Boolean(index.unique);
+		if (!isOrderedMethod(method)) {
+			for (const key of index.on) if (typeof key !== "string" && ("direction" in key || "nulls" in key)) fail(`access method "${method}" does not support ASC/DESC or NULLS options.`);
 		}
-		plannedEnums.add(name);
-		const [schema, typeName] = name.split(".");
-		actions.push({
-			kind: "create-enum",
-			target: name,
-			sql: `CREATE TYPE "${schema}"."${typeName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});`
-		});
-	}
-	const searchSpecs = collections.map((c) => buildSearchColumnSpec(c)).filter((spec) => spec !== void 0);
-	const plannedExtensions = /* @__PURE__ */ new Set();
-	for (const spec of searchSpecs) for (const statement of searchExtensionStatements(spec)) {
-		if (plannedExtensions.has(statement)) continue;
-		plannedExtensions.add(statement);
-		actions.push({
-			kind: "create-extension",
-			target: statement.replace(/^CREATE EXTENSION IF NOT EXISTS |;$/g, ""),
-			sql: statement
-		});
-	}
-	const plannedFunctions = /* @__PURE__ */ new Set();
-	for (const spec of searchSpecs) for (const statement of searchHelperFunctions(spec)) {
-		if (plannedFunctions.has(statement)) continue;
-		plannedFunctions.add(statement);
-		actions.push({
-			kind: "create-function",
-			target: statement.includes("unaccent") ? SEARCH_UNACCENT_FN : SEARCH_TEXT_FN,
-			sql: statement
-		});
-	}
-	const created = /* @__PURE__ */ new Set();
-	for (const collection of collections) {
-		const key = qualified(collection);
-		if (existing.tables.has(key) || created.has(key)) continue;
-		created.add(key);
-		const schema = schemaOf(collection);
-		const table = getTableName(collection);
-		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
-		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
-		const idProp = idEntry?.[1];
-		let idDef = `"${idName}" ${idProp ? getSqlColumnType(idEntry[0], idProp, collection, collections) : "TEXT"} PRIMARY KEY`;
-		if (idProp?.type === "string" && idProp.isId === "uuid") idDef += " DEFAULT gen_random_uuid()";
-		actions.push({
-			kind: "create-table",
-			target: key,
-			sql: `CREATE TABLE IF NOT EXISTS "${schema}"."${table}" (${idDef});`
-		});
-	}
-	const junctions = planJunctionTables(collections);
-	for (const junction of junctions) {
-		const key = `${junction.schema}.${junction.table}`;
-		if (existing.tables.has(key) || created.has(key)) continue;
-		created.add(key);
-		actions.push({
-			kind: "create-table",
-			target: key,
-			sql: junction.createTable
-		});
-	}
-	const legacyForeignKeys = [];
-	/**
-	* Move a relation column that is only missing because it was renamed.
-	*
-	* Returns true when it handled the column, so the caller skips the ordinary
-	* ADD. Adding here would be the wrong move and a quiet one: the data is in
-	* the old column, `ADD COLUMN` creates the new one empty beside it, every
-	* statement succeeds, and the relation reads the empty one. A rename is
-	* metadata-only in Postgres, keeps the values, and carries the column's
-	* indexes and constraints with it.
-	*
-	* Only ever reached when the new name is absent and the old name is
-	* present, so there is nothing to overwrite and nothing to choose between.
-	*/
-	const renameLegacyColumn = (key, schema, table, column, legacyName) => {
-		const present = existing.tables.get(key);
-		if (!legacyName || !present) return false;
-		if (present.has(column) || !present.has(legacyName)) return false;
-		legacyForeignKeys.push({
-			table: key,
-			expected: column,
-			legacy: legacyName
-		});
-		actions.push({
-			kind: "rename-column",
-			target: `${key}.${column}`,
-			sql: `ALTER TABLE "${schema}"."${table}" RENAME COLUMN "${legacyName}" TO "${column}";`
-		});
-		return true;
-	};
-	const addColumn = (key, schema, table, column, definition) => {
-		if (existing.tables.get(key)?.has(column)) return;
-		actions.push({
-			kind: "add-column",
-			target: `${key}.${column}`,
-			sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${definition};`
+		const keys = index.on.map((key) => {
+			const column = resolveIndexableColumn(collection, typeof key === "string" ? key : key.prop, resolveColumnName, fail);
+			const direction = (typeof key === "string" ? void 0 : key.direction) ?? "asc";
+			return {
+				column,
+				direction,
+				nulls: (typeof key === "string" ? void 0 : key.nulls) ?? (direction === "desc" ? "first" : "last")
+			};
 		});
-	};
-	for (const collection of collections) {
-		const key = qualified(collection);
-		const schema = schemaOf(collection);
-		const table = getTableName(collection);
-		const fresh = created.has(key);
-		const auth = isAuthCollection(collection);
-		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
-			const p = prop;
-			if (isIdProperty(propName, p, collection)) continue;
-			if (p.type === "reference" || p.type === "relation") continue;
-			const column = resolveColumnName(propName, p);
-			const authDefinition = auth ? authUsersColumnDefinition(column) : void 0;
-			if (authDefinition) {
-				addColumn(key, schema, table, column, authDefinition);
-				continue;
-			}
-			let definition = getSqlColumnType(propName, p, collection, collections);
-			if (fresh && p.validation?.unique) definition += " UNIQUE";
-			const autoValue = p.autoValue;
-			const hasDefault = p.type === "date" && (autoValue === "on_create" || autoValue === "on_update");
-			if (hasDefault) definition += " DEFAULT now()";
-			const required = p.validation?.required === true;
-			const columnKey = `${key}.${column}`;
-			const columnExists = existing.tables.get(key)?.has(column) === true;
-			const tableIsEmpty = existing.populatedTables !== void 0 && existing.tables.has(key) && !existing.populatedTables.has(key);
-			const notNullIsSafe = fresh || tableIsEmpty || hasDefault;
-			if (required && !columnExists) if (notNullIsSafe) definition += " NOT NULL";
-			else withheldConstraints.push({
-				target: columnKey,
-				kind: "not-null",
-				reason: `"${column}" is required, but "${key}" already holds rows and the column has no default to backfill them with, so NOT NULL would be checked against data that does not have a value yet.`,
-				remedy: "Backfill the column, then add the constraint — or give the property a default so every existing row gets one."
-			});
-			addColumn(key, schema, table, column, definition);
-			if (columnExists && constraintPolicy === "converge") {
-				const isNotNull = existing.notNullColumns?.has(columnKey) === true;
-				if (required && !isNotNull) if (tableIsEmpty) actions.push({
-					kind: "set-not-null",
-					target: columnKey,
-					sql: `ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${column}" SET NOT NULL;`
-				});
-				else withheldConstraints.push({
-					target: columnKey,
-					kind: "not-null",
-					reason: `"${column}" became required, but "${key}" holds rows and any of them with no value would make SET NOT NULL fail.`,
-					remedy: "Backfill the column first — `UPDATE … SET \"" + column + "\" = … WHERE \"" + column + "\" IS NULL` — then apply this again."
-				});
-				if (!required && isNotNull) actions.push({
-					kind: "drop-not-null",
-					target: columnKey,
-					sql: `ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${column}" DROP NOT NULL;`
-				});
-			}
-		}
-		if (auth) {
-			const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
-			for (const spec of AUTH_USERS_COLUMNS) {
-				if (declared.has(spec.column)) continue;
-				addColumn(key, schema, table, spec.column, authUsersColumnSql(spec));
-			}
-		}
-	}
-	const searchDrift = [];
-	const searchAdopted = [];
-	for (const spec of searchSpecs) {
-		const key = `${spec.schema}.${spec.table}`;
-		const definitions = { [spec.column]: `tsvector GENERATED ALWAYS AS (${spec.expression}) STORED` };
-		if (spec.fuzzy) definitions[spec.fuzzy.column] = `text GENERATED ALWAYS AS (${spec.fuzzy.expression}) STORED`;
-		for (const stamp of searchColumnStamps(spec)) {
-			const definition = definitions[stamp.column];
-			const exists = existing.tables.get(key)?.has(stamp.column) === true;
-			const recorded = existing.columnComments?.get(`${key}.${stamp.column}`);
-			if (exists && recorded?.startsWith("rebase:search:v1:") && recorded !== stamp.fingerprint) {
-				searchDrift.push({
-					table: key,
-					column: stamp.column,
-					found: recorded,
-					expected: stamp.fingerprint,
-					rebuild: [
-						`ALTER TABLE "${spec.schema}"."${spec.table}" DROP COLUMN "${stamp.column}";`,
-						`ALTER TABLE "${spec.schema}"."${spec.table}" ADD COLUMN "${stamp.column}" ${definition};`,
-						stamp.sql
-					]
-				});
-				continue;
-			}
-			addColumn(key, spec.schema, spec.table, stamp.column, definition);
-			if (exists && recorded === void 0) searchAdopted.push({
-				table: key,
-				column: stamp.column
-			});
-			if (recorded !== stamp.fingerprint) actions.push({
-				kind: "comment-column",
-				target: `${key}.${stamp.column}`,
-				sql: stamp.sql
-			});
-		}
-	}
-	for (const junction of junctions) {
-		const key = `${junction.schema}.${junction.table}`;
-		if (created.has(key)) continue;
-		for (const column of junction.columns) {
-			if (renameLegacyColumn(key, junction.schema, junction.table, column.name, column.legacyName)) continue;
-			addColumn(key, junction.schema, junction.table, column.name, column.type);
+		const duplicateKey = keys.map((k) => k.column).find((c, i, all) => all.indexOf(c) !== i);
+		if (duplicateKey) fail(`"${duplicateKey}" appears twice in \`on\`.`);
+		if (keys.map((k) => k.column).sort().join(",") === pk && pk !== "") fail(`this is the primary key — "${table}_pkey" already indexes exactly these columns.`);
+		const include = (index.include ?? []).map((propKey) => resolveIndexableColumn(collection, propKey, resolveColumnName, fail));
+		const overlap = include.find((c) => keys.some((k) => k.column === c));
+		if (overlap) fail(`"${overlap}" is in both \`on\` and \`include\`; Postgres rejects the overlap.`);
+		if (unique && keys.length === 1) {
+			const propKey = typeof index.on[0] === "string" ? index.on[0] : index.on[0].prop;
+			if ((collection.properties?.[propKey])?.validation?.unique) fail(`"${propKey}" already declares \`validation.unique\`, which compiles to an inline UNIQUE. Two declarations of one guarantee — remove one.`);
 		}
-	}
-	for (const relational of planRelationalColumns(collections)) {
-		const relKey = `${relational.schema}.${relational.table}`;
-		if (renameLegacyColumn(relKey, relational.schema, relational.table, relational.column, relational.legacyColumn)) continue;
-		addColumn(relKey, relational.schema, relational.table, relational.column, relational.type);
-	}
-	const knownConstraints = existing.constraints ?? /* @__PURE__ */ new Set();
-	const plannedConstraints = /* @__PURE__ */ new Set();
-	const foreignKeys = [...planRelationalColumns(collections).map((r) => r.foreignKey), ...junctions.flatMap((j) => j.foreignKeys)];
-	for (const fk of foreignKeys) {
-		if (!fk) continue;
-		const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;
-		if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;
-		plannedConstraints.add(name);
-		actions.push({
-			kind: "add-constraint",
-			target: `${fk.schema}.${fk.table}.${fk.constraintName}`,
-			sql: fk.sql
+		const predicate = index.where ? resolvePredicate(collection, index.where, resolveColumnName, fail) : null;
+		const withoutName = {
+			schema,
+			table,
+			method,
+			unique,
+			keys,
+			include,
+			predicate,
+			reason: index.reason
+		};
+		const indexName = deriveIndexName(withoutName);
+		const clash = byName.get(indexName);
+		if (clash !== void 0) fail(`derives the same name as indexes[${clash}] — they are the same index declared twice.`);
+		byName.set(indexName, position);
+		specs.push({
+			...withoutName,
+			indexName
 		});
-	}
-	for (const spec of searchSpecs) for (const statement of searchIndexStatements(spec)) actions.push({
-		kind: "create-index",
-		target: `${spec.schema}.${spec.table}`,
-		sql: statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS")
 	});
-	const vectorIndexSkipped = [];
-	for (const collection of collections) {
-		const plan = buildVectorIndexPlan(collection, resolveColumnName);
-		for (const spec of plan.specs) actions.push({
-			kind: "create-index",
-			target: `${spec.schema}.${spec.table}`,
-			sql: vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS")
-		});
-		vectorIndexSkipped.push(...plan.skipped);
-	}
-	return {
-		actions,
-		statements: actions.map((a) => a.sql),
-		legacyForeignKeys,
-		searchDrift,
-		searchAdopted,
-		vectorIndexSkipped,
-		withheldConstraints
-	};
-}
-/** Read what the database has, for the schemas the collections live in. */
-async function readExistingSchema(client, schemas) {
-	const tables = /* @__PURE__ */ new Map();
-	const enums = /* @__PURE__ */ new Set();
-	if (schemas.length === 0) return {
-		tables,
-		enums
-	};
-	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
-	const notNullColumns = /* @__PURE__ */ new Set();
-	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name, is_nullable
-         FROM information_schema.columns
-         WHERE table_schema IN (${inList})`);
-	for (const row of columns) {
-		const key = `${row.table_schema}.${row.table_name}`;
-		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
-		tables.get(key).add(row.column_name);
-		if (row.is_nullable === "NO") notNullColumns.add(`${key}.${row.column_name}`);
-	}
-	const populatedTables = /* @__PURE__ */ new Set();
-	const { rows: realTables } = await client.query(`SELECT n.nspname AS schema, c.relname AS name
-         FROM pg_class c
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         WHERE c.relkind IN ('r', 'p') AND n.nspname IN (${inList})`);
-	if (realTables.length > 0) {
-		const probes = realTables.map((row) => {
-			const schema = assertSafeIdentifier(row.schema, "schema name");
-			const table = assertSafeIdentifier(row.name, "table name");
-			return `SELECT ${quoteSqlLiteral(`${schema}.${table}`)} AS key, EXISTS(SELECT 1 FROM "${schema}"."${table}" LIMIT 1) AS populated`;
-		});
-		const { rows: populationRows } = await client.query(probes.join(" UNION ALL "));
-		for (const row of populationRows) if (row.populated) populatedTables.add(row.key);
-	}
-	const enumValues = /* @__PURE__ */ new Map();
-	const { rows: enumValueRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name, e.enumlabel AS value
-         FROM pg_enum e
-         JOIN pg_type t ON e.enumtypid = t.oid
-         JOIN pg_namespace n ON t.typnamespace = n.oid
-         WHERE n.nspname IN (${inList})
-         ORDER BY t.typname, e.enumsortorder`);
-	for (const row of enumValueRows) {
-		const key = `${row.schema}.${row.name}`;
-		if (!enumValues.has(key)) enumValues.set(key, []);
-		enumValues.get(key).push(row.value);
-	}
-	const { rows: enumRows } = await client.query(`SELECT n.nspname AS schema, t.typname AS name
-         FROM pg_type t
-         JOIN pg_namespace n ON t.typnamespace = n.oid
-         WHERE t.typtype = 'e' AND n.nspname IN (${inList})`);
-	for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
-	const constraints = /* @__PURE__ */ new Set();
-	const { rows: constraintRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, con.conname AS name
-         FROM pg_constraint con
-         JOIN pg_class c ON con.conrelid = c.oid
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         WHERE n.nspname IN (${inList})`);
-	for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);
-	const columnComments = /* @__PURE__ */ new Map();
-	const { rows: commentRows } = await client.query(`SELECT n.nspname AS schema, c.relname AS table, a.attname AS column, d.description AS comment
-         FROM pg_description d
-         JOIN pg_class c ON d.objoid = c.oid
-         JOIN pg_namespace n ON c.relnamespace = n.oid
-         JOIN pg_attribute a ON a.attrelid = c.oid AND a.attnum = d.objsubid
-         WHERE d.objsubid > 0 AND n.nspname IN (${inList})`);
-	for (const row of commentRows) {
-		if (row.comment == null) continue;
-		columnComments.set(`${row.schema}.${row.table}.${row.column}`, row.comment);
-	}
-	return {
-		tables,
-		enums,
-		constraints,
-		columnComments,
-		enumValues,
-		notNullColumns,
-		populatedTables
-	};
-}
-/**
-* What to tell an operator whose `search` block no longer matches its column.
-*
-* Every line here is doing work: naming the collection is not enough, because
-* the symptom (a search that finds nothing) points at the data, not the schema;
-* and the remediation has to be exact, because it is a table rewrite the
-* operator is being asked to schedule rather than discover.
-*/
-function searchDriftMessage(drift) {
-	return "The `search` block changed after its generated column was created, and Postgres cannot alter a generated expression in place.\nRebase will not rebuild it for you: dropping and re-adding a STORED generated column rewrites the whole table under an ACCESS EXCLUSIVE lock and rebuilds its GIN index, which is an outage this unattended path may not schedule on your behalf.\nUntil it is rebuilt the column keeps indexing the previous fields, weights and language — searches for anything added since return nothing, which reads from outside as \"no such row\".\nRun these (or revert the block to what the column was built from), then boot again:\n" + drift.map((d) => `  "${d.table}"."${d.column}" was generated from a different \`search\` block (recorded ${d.found}, current ${d.expected}).\n` + d.rebuild.map((s) => `      ${s}`).join("\n")).join("\n") + "\n  The GIN index is dropped with the column and recreated concurrently on the next boot.";
-}
-/**
-* The missing-pgvector explanation, appended to the error that reveals it.
-*
-* A `{ type: "vector" }` property compiles to `VECTOR(n)`, and nothing in the
-* OSS pipeline installs pgvector — not this ensure, not `db push`. Installing
-* an extension on someone's database is a decision with a deployment behind it
-* (image, superuser, cloud allow-list), so this path stays a refusal; what it
-* must not stay is a bare `type "vector" does not exist` on a crash-looping
-* pod, which names nothing the reader can act on.
-*
-* The scaffold now ships `pgvector/pgvector:pg18`, so this is reached by a
-* project pointed at a database someone else provisioned — which is exactly
-* the case where naming the extension and the image is worth the words.
-*/
-function vectorExtensionHint(message) {
-	if (!/type "(vector|halfvec|sparsevec)" does not exist/i.test(message)) return "";
-	return "\n  pgvector is not installed on this database, and Rebase does not install it: it is a server extension, so it needs an image that ships it (the scaffold's `pgvector/pgvector:pg18` does; a stock `postgres:18` does not) and a role allowed to run `CREATE EXTENSION vector;`. Install it once, then boot again. Rebase then creates an ANN index for the column automatically — see the `index` option on the property.";
-}
-/**
-* Read what the database looks like, for the schemas a set of collections
-* lives in.
-*
-* The same read `ensureCollectionTables` does at boot, exposed on its own for
-* the callers that want to *plan* against a real database without changing it —
-* the live schema editor, which has to tell somebody what a change would do
-* before they agree to it.
-*/
-async function readSchemaFactsFor(client, collections) {
-	const relational = relationalCollections(collections);
-	return readExistingSchema(client, Array.from(/* @__PURE__ */ new Set([...relational.map(schemaOf), ...planJunctionTables(relational).map((junction) => junction.schema)])));
-}
-/**
-* Bring the database up to date. Returns what it did.
-*
-* Each statement runs on its own rather than in one transaction: they are all
-* independently safe and idempotent, and a single failure (an enum label that
-* cannot be added, say) should not roll back the tables that were created fine.
-* The error is surfaced with the statement that caused it.
-*/
-async function ensureCollectionTables(client, collections, log) {
-	const schemas = Array.from(/* @__PURE__ */ new Set([...collections.map(schemaOf), ...planJunctionTables(collections).map((j) => j.schema)]));
-	for (const schema of schemas) {
-		assertSafeIdentifier(schema, "schema name");
-		if (schema !== "public") await client.query(`CREATE SCHEMA IF NOT EXISTS "${schema}";`);
-	}
-	const plan = planCollectionSchemaEnsure(collections, await readExistingSchema(client, schemas));
-	const failures = [];
-	for (const legacy of plan.legacyForeignKeys) {
-		const message = `Renaming "${legacy.table}"."${legacy.legacy}" to "${legacy.expected}". The old name is the one Rebase derived for this relation before it singularized properly; the column keeps its data, indexes and constraints. To keep the old name instead, set \`localKey: "${legacy.legacy}"\` on the relation and this will stop.`;
-		logger.info(`[schema] ${message}`);
-		log?.(message);
-	}
-	if (plan.searchDrift.length > 0) throw new Error(searchDriftMessage(plan.searchDrift));
-	for (const adopted of plan.searchAdopted) {
-		const message = `Adopting the existing generated column "${adopted.table}"."${adopted.column}" and recording what the current \`search\` block would generate. Any later change to that block will be detected and refused; a change made *before* this version was deployed cannot be, so if search has been missing content, rebuild the column once: ALTER TABLE "${adopted.table.split(".").join("\".\"")}" DROP COLUMN "${adopted.column}"; and boot again.`;
-		logger.info(`[schema] ${message}`);
-		log?.(message);
-	}
-	for (const skip of plan.vectorIndexSkipped) {
-		const message = `No ANN index on "${skip.table}"."${skip.column}": ${skip.reason}`;
-		logger.warn(`[schema] ${message}`);
-		log?.(message);
-	}
-	for (const withheld of plan.withheldConstraints) {
-		const message = `No NOT NULL on "${withheld.target}": ${withheld.reason} ${withheld.remedy}`;
-		logger.warn(`[schema] ${message}`);
-		log?.(message);
-	}
-	if (plan.actions.length === 0) {
-		log?.("Schema is up to date; nothing to create.");
-		return {
-			...plan,
-			failures
-		};
-	}
-	for (const action of plan.actions) try {
-		if (await applyAction(client, action)) log?.(`${action.kind}: ${action.target}`);
-		else log?.(`${action.kind}: ${action.target} (already created by a peer)`);
-	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (action.kind === "add-constraint" || action.kind === "comment-column") {
-			failures.push({
-				kind: action.kind,
-				target: action.target,
-				error: message
-			});
-			continue;
-		}
-		throw new Error(`Failed to ${action.kind} ${action.target}: ${message}${vectorExtensionHint(message)}\n  ${action.sql}`);
-	}
-	return {
-		...plan,
-		failures
-	};
-}
-/** Attempts per action, including the first. Matches the server's bootstraps. */
-var DDL_ATTEMPTS = 4;
+	return specs;
+};
 /**
-* Run one planned statement, surviving a simultaneous boot.
+* Every declared index across a set of collections, in a stable order.
 *
-* Every statement in a plan is written to be idempotent, and that is not the
-* same as being safe to run concurrently: `CREATE … IF NOT EXISTS` reads the
-* catalog and then writes to it as two steps, so peers starting together both
-* see "absent" and the loser gets a duplicate key on a *catalog* index. Measured
-* against Postgres 18: five instances, 8 of 10 calls lost. `CREATE TYPE` is
-* worse, because Postgres has no `IF NOT EXISTS` for it at all.
-*
-* What made that fatal here rather than merely noisy is the loop this sits in.
-* A losing statement threw, and the throw abandoned **every remaining action in
-* the plan** — so a replica that lost one race came up missing tables it never
-* attempted, and the boot log blamed the one statement that failed.
-*
-* @returns `true` if this process applied the statement, `false` if a peer had
-*   already created the object. The distinction is only for the log; both mean
-*   the object is now there.
-* @throws the original error for anything that is not a race — a syntax error, a
-*   permission failure, a unique constraint the customer's own rows violate.
+* Sorted because the result reaches `schema.sql`, which `doctor` string-
+* compares against a regenerated copy — `generatePostgresDdl` does not sort its
+* collections, so leaving this in declaration order would make the artifact
+* depend on the order files happened to load in.
 */
-async function applyAction(client, action) {
-	for (let attempt = 1;; attempt++) try {
-		await client.query(action.sql);
-		return true;
-	} catch (err) {
-		if (isDuplicateObjectRace(err)) {
-			logger.debug(`[schema] ${action.kind} ${action.target}: already created by another instance`);
-			return false;
-		}
-		if (isConcurrentDdlRace(err) && attempt < DDL_ATTEMPTS) {
-			logger.debug(`[schema] ${action.kind} ${action.target}: lost a race with another instance (attempt ${attempt}/${DDL_ATTEMPTS}) — retrying`);
-			await new Promise((resolve) => setTimeout(resolve, 40 * attempt * (1 + Math.random())));
-			continue;
-		}
-		throw err;
-	}
-}
+var buildCollectionIndexPlan = (collections, resolveColumnName) => collections.flatMap((collection) => buildCollectionIndexSpecs(collection, resolveColumnName)).sort((a, b) => a.schema.localeCompare(b.schema) || a.table.localeCompare(b.table) || a.indexName.localeCompare(b.indexName));
 //#endregion
-export { camelCase as $, fieldKeyForColumn as A, parseIdValues as B, getJunctionCollectionConfig as C, policyToPostgres as D, getEffectiveSecurityRules as E, getTableVarName as F, updateDateAutoValues as G, createRelationRef as H, resolveCollectionRelations as I, legacyForeignKeyName as J, firstFreeKey as K, buildCompositeId as L, getColumnName as M, getEnumVarName as N, securityRuleToConditions as O, getTableName as P, mergeDeep as Q, getDeclaredPrimaryKeys as R, resolveStringColumnLength as S, resolveJunctionSpecs as T, createRelationRefWithData as U, sortCollectionsBySlug as V, normalizeToEntityRelation as W, getPolicyNamesForRule as X, toWireKey as Y, isPrototypePollutingKey as Z, OrderBySpecError as _, generatePostgresDdl as a, Vector as at, CollectionRegistry as b, planCollectionPolicies as c, authUsersColumnSql as d, toSnakeCase as et, SEARCH_UNACCENT_FN as f, buildSdkData as g, visibleColumnProjection as h, readSchemaFactsFor as i, isManyToMany as it, findRelation as j, findAnonymousGrants as k, resolveColumnName as l, hiddenColumnsOption as m, planCollectionSchemaEnsure as n, DEFAULT_ONE_OF_VALUE as nt, generatePostgresPoliciesDdl as o, buildSearchColumnSpec as p, generateForeignKeyName as q, readExistingSchema as r, hasForeignKeyOnTarget as rt, generatePostgresSearchDdl as s, ensure_collection_tables_exports as t, DEFAULT_ONE_OF_TYPE as tt, AUTH_USERS_COLUMNS as u, normalizeDriverOrderBy as v, getJunctionSecurityRules as w, relationalCollections as x, parseOrderBySpecStrict as y, isAddressableId as z };
+export { sortCollectionsBySlug as A, getPolicyNamesForRule as B, getTableName as C, getDeclaredPrimaryKeys as D, buildCompositeId as E, firstFreeKey as F, DEFAULT_ONE_OF_TYPE as G, mergeDeep as H, generateForeignKeyName as I, resolveClientListLimit as J, DEFAULT_ONE_OF_VALUE as K, legacyForeignKeyName as L, createRelationRefWithData as M, normalizeToEntityRelation as N, isAddressableId as O, updateDateAutoValues as P, Vector as Q, toPostgresIdentifier as R, getEnumVarName as S, resolveCollectionRelations as T, camelCase as U, isPrototypePollutingKey as V, toSnakeCase as W, hasForeignKeyOnTarget as X, ANONYMOUS_USER_ID as Y, isManyToMany as Z, securityRuleToConditions as _, buildSdkData as a, findRelation as b, parseOrderBySpecStrict as c, getJunctionCollectionConfig as d, getJunctionSecurityRules as f, policyToPostgres as g, getInjectedSecurityRules as h, collectionIndexStatements as i, createRelationRef as j, parseIdValues as k, CollectionRegistry as l, getEffectiveSecurityRules as m, buildCollectionIndexSpecs as n, OrderBySpecError as o, resolveJunctionSpecs as p, ListLimitError as q, collectionIndexStatement as r, normalizeDriverOrderBy as s, buildCollectionIndexPlan as t, relationalCollections as u, findAnonymousGrants as v, getTableVarName as w, getColumnName as x, fieldKeyForColumn as y, toWireKey as z };
 
-//# sourceMappingURL=ensure-collection-tables-C_Gr59le.js.map
+//# sourceMappingURL=collection-index-DxJBvVTH.js.map