@rebasepro/server-postgres 0.17.3 → 0.18.0

package/dist/{ensure-collection-tables-DgVixhX3.js → ensure-collection-tables-DbAhrjnG.js}

@@ -1,31 +1,47 @@
 import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { u as __exportAll } from "./connection-GOKU3Hu5.js";
-import { B as getPolicyNamesForRule, C as getTableName, I as generateForeignKeyName, L as legacyForeignKeyName, R as toPostgresIdentifier, T as resolveCollectionRelations, W as toSnakeCase, Z as isManyToMany, _ as securityRuleToConditions, b as findRelation, d as getJunctionCollectionConfig, f as getJunctionSecurityRules, g as policyToPostgres, h as getInjectedSecurityRules, i as collectionIndexStatements, m as getEffectiveSecurityRules, n as buildCollectionIndexSpecs, p as resolveJunctionSpecs, r as collectionIndexStatement, t as buildCollectionIndexPlan, u as relationalCollections } from "./collection-index-BRUg10H5.js";
-import { l as isPostgresCollectionConfig, r as REBASE_SCHEMA, t as declaredDatabaseExtensions } from "./src-DiB5RP2Z.js";
+import process from "process";
+const require = __createRequire(import.meta.url);
+import { i as collectionIndexStatements, n as buildCollectionIndexSpecs, r as collectionIndexStatement, t as buildCollectionIndexPlan } from "./collection-index-C7LopMyX.js";
 import { isConcurrentDdlRace, isDuplicateObjectRace, logger } from "@rebasepro/server";
+import { DEFAULT_FUZZY_THRESHOLD, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_WEIGHT, REBASE_SCHEMA, declaredDatabaseExtensions, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
+import { findRelation, getEffectiveSecurityRules, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getTableName, policyToPostgres, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, resolveStringColumnLength, securityRuleToConditions } from "@rebasepro/common";
+import { generateForeignKeyName, getPolicyNamesForRule, legacyForeignKeyName, toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
 import { createHash } from "node:crypto";
-/**
-* How wide a `varchar`/`char` column should be for a given property.
-*
-* One definition, three call sites, because they used to disagree. For the same
-* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
-* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
-* reads as *unbounded* — so which of the two you ran decided whether the column
-* had a limit at all. Introspection then dropped the length entirely, so reading
-* an existing `character varying(500)` column back and regenerating it produced
-* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
-*
-* `validation.max` is the property's own statement about how long the value may
-* be, so it is the only sensible source for the column's width — and it keeps
-* the constraint the database enforces in step with the one the app enforces,
-* rather than inventing a second, different limit underneath it.
-*/
-function resolveStringColumnLength(prop) {
-	const max = prop.validation?.max;
-	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
-}
+//#region \0rolldown/runtime.js
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
+};
+var __copyProps = (to, from, except, desc) => {
+	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
+		key = keys[i];
+		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
+			get: ((k) => from[k]).bind(null, key),
+			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
+		});
+	}
+	return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+	value: mod,
+	enumerable: true
+}) : target, mod));
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
+	if (typeof require !== "undefined") return require.apply(this, arguments);
+	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
+});
 //#endregion
 //#region src/schema/search-column.ts
 /**
@@ -184,7 +200,7 @@ var quote$1 = (v) => `'${v.replace(/'/g, "''")}'`;
 */
 var resolveField = (entry, collection, cfg) => {
 	const path = typeof entry === "string" ? entry : entry.path;
-	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? "B";
+	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? DEFAULT_SEARCH_WEIGHT;
 	const where = `${collection.slug}.search`;
 	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
 	const [head, ...rest] = path.split(".");
@@ -203,7 +219,7 @@ var resolveField = (entry, collection, cfg) => {
 		jsonPath: rest,
 		kind: classified.kind
 	}), cfg.unaccent === true);
-	const language = cfg.language ?? "simple";
+	const language = cfg.language ?? DEFAULT_SEARCH_LANGUAGE;
 	return {
 		path,
 		column,
@@ -227,7 +243,7 @@ var buildSearchColumnSpec = (collection) => {
 	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
 	const table = getTableName(collection);
 	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const column = cfg.column ?? "search_vector";
+	const column = cfg.column ?? DEFAULT_SEARCH_COLUMN;
 	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
 	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
 	const seen = /* @__PURE__ */ new Set();
@@ -242,7 +258,7 @@ var buildSearchColumnSpec = (collection) => {
 		schema,
 		table,
 		column,
-		language: cfg.language ?? "simple",
+		language: cfg.language ?? DEFAULT_SEARCH_LANGUAGE,
 		unaccent: cfg.unaccent === true,
 		fields,
 		expression: fields.map((f) => f.sql).join(" || "),
@@ -256,7 +272,7 @@ var buildSearchColumnSpec = (collection) => {
 			column: fuzzyColumn,
 			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
 			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
-			threshold: cfg.fuzzyThreshold ?? .3
+			threshold: cfg.fuzzyThreshold ?? DEFAULT_FUZZY_THRESHOLD
 		};
 	}
 	return spec;
@@ -440,6 +456,284 @@ var excludedColumnNames = (tableColumns, collection) => {
 	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
 };
 //#endregion
+//#region src/utils/pg-error-utils.ts
+/**
+* Shared PostgreSQL error extraction and user-friendly message formatting.
+*
+* Drizzle wraps native PG errors in a `.cause` chain. These utilities
+* unwrap that chain to get the real PostgreSQL error (identified by a
+* 5-character alphanumeric `code` such as `42P01`) and translate it into
+* a message that is safe and helpful to show to end-users.
+*/
+/**
+* Return the error when it is a deliberate 4xx, otherwise null.
+*
+* A thrown `ApiError` is a decision the server made about the request, not a
+* database failure: its message and code are already written for the client.
+*/
+function asClientFacingError(error) {
+	if (!(error instanceof Error)) return null;
+	const e = error;
+	if (typeof e.statusCode !== "number" || e.statusCode < 400 || e.statusCode >= 500) return null;
+	return e;
+}
+/**
+* Extract the underlying PostgreSQL error from a Drizzle wrapper.
+* Drizzle wraps PG errors in a `cause` property — this function
+* recursively walks the chain until it finds an object with a PG
+* error code (5-char alphanumeric, e.g. `42P01`).
+*/
+function extractPgError(error) {
+	if (!error || typeof error !== "object") return null;
+	if (!(error instanceof Error)) {
+		if ("cause" in error && error.cause && typeof error.cause === "object") return extractPgError(error.cause);
+		return null;
+	}
+	if ("code" in error && typeof error.code === "string" && /^[0-9A-Z]{5}$/.test(error.code)) return error;
+	if (error.cause && typeof error.cause === "object") return extractPgError(error.cause);
+	return null;
+}
+/**
+* Whether the failure came back from Postgres rather than from building the
+* query — which decides whether a fallback query is worth issuing.
+*
+* Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
+* RLS). Once a statement raises, that transaction is aborted, and every later
+* statement on it returns `25P02` — "current transaction is aborted, commands
+* ignored until end of transaction block". So a retry after a database error
+* cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
+* for type uuid") with a generic one. Rethrow instead.
+*
+* A query the driver could not even build — a missing reciprocal relation, say
+* — never reached Postgres, leaves the transaction usable, and is exactly what
+* the fallback paths exist for.
+*/
+function reachedDatabase(error) {
+	return extractPgError(error) !== null;
+}
+/**
+* Walk the error cause chain and return the deepest meaningful message.
+*/
+function extractCauseMessage(error) {
+	if (!error || typeof error !== "object") return null;
+	if (!(error instanceof Error)) return null;
+	if (error.cause && typeof error.cause === "object") {
+		const deeper = extractCauseMessage(error.cause);
+		if (deeper) return deeper;
+		if (error.cause instanceof Error && error.cause.message) return error.cause.message;
+	}
+	return null;
+}
+/**
+* Codes that mean "this connection will never work as configured".
+*
+* A wrong password or a database that does not exist is a settled fact about
+* the connection string, not a transient fault — retrying produces the same
+* answer forever.
+*/
+var UNRECOVERABLE_CONNECT_CODES = /* @__PURE__ */ new Set([
+	"28P01",
+	"28000",
+	"3D000",
+	"42501"
+]);
+/**
+* Describe a failed connection attempt in terms a developer can act on.
+*
+* The error a caller catches is Drizzle's wrapper: its message is
+* `Failed query: SELECT 1` and its stack runs through drizzle internals, while
+* the sentence that says what is actually wrong — "password authentication
+* failed for user …", "database … does not exist" — sits in `.cause`. Logging
+* the wrapper, as the bootstrapper used to, tells a developer with a typo in
+* their `DATABASE_URL` nothing at all.
+*/
+function classifyConnectFailure(error) {
+	const pgError = extractPgError(error);
+	const reason = pgError?.message ?? extractCauseMessage(error) ?? (error instanceof Error ? error.message : String(error));
+	return {
+		fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),
+		reason,
+		code: pgError?.code
+	};
+}
+/**
+* Detect whether an error is specifically a role-switching permission failure
+* (e.g. "permission denied to set role" or "must be member of role"),
+* as opposed to a table-level permission denial.
+*
+* This is used by the backend driver to auto-disable role switching when the
+* connection user lacks SET ROLE privileges, rather than surfacing a confusing
+* error to the Studio SQL Editor user.
+*/
+function isRoleSwitchingPermissionError(error) {
+	const pgError = extractPgError(error);
+	if (!pgError || pgError.code !== "42501") return false;
+	const msg = pgError.message.toLowerCase();
+	return msg.includes("set role") || msg.includes("member of role");
+}
+/**
+* Was this `42501` the *caller* being refused by a policy, rather than the
+* server lacking a privilege?
+*
+* Both arrive as `insufficient_privilege`, and they are opposite kinds of
+* problem. A row-level-security refusal is a working access-control system
+* doing its job: the caller asked for something their policies do not permit,
+* which is a 403 and nobody's bug. A missing `GRANT` is the deployment being
+* wrong — the connection role cannot touch the table at all, no policy is
+* involved, and nothing the caller changes about the request will help.
+*
+* Postgres distinguishes them in the message, so this does too:
+*
+*     new row violates row-level security policy for table "notes"  → the caller
+*     permission denied for table notes                             → the server
+*
+* Only writes reach this. A read that RLS excludes is not an error — the rows
+* are filtered and the caller gets an empty page — so the erroring case is
+* specifically an `INSERT`/`UPDATE` whose row fails a policy's `WITH CHECK`.
+*
+* Matched on the message because that is the only thing carrying the
+* distinction; the SQLSTATE is identical either way. Narrow by design: anything
+* not naming row-level security stays the server's problem, since reporting a
+* genuine privilege misconfiguration as "forbidden" would send an operator
+* hunting for a policy bug that does not exist.
+*/
+function isRowLevelSecurityDenial(error) {
+	const pgError = extractPgError(error);
+	if (!pgError || pgError.code !== "42501") return false;
+	return pgError.message.toLowerCase().includes("row-level security policy");
+}
+/**
+* Translate a raw PostgreSQL error into a user-friendly message.
+*
+* @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})
+* @param context  - A human-readable context string (e.g. collection slug or path)
+* @returns An object with a `message` safe for the client and the PG `code`.
+*/
+function pgErrorToFriendlyMessage(pgError, context, options = {}) {
+	const verbose = options.verbose ?? process.env.NODE_ENV !== "production";
+	const detail = verbose ? pgError.detail : void 0;
+	const hint = verbose ? pgError.hint : void 0;
+	const constraint = pgError.constraint;
+	const column = pgError.column;
+	const table = pgError.table;
+	const dataType = verbose ? pgError.dataType : void 0;
+	const rawMessage = pgError.message || "Unknown database error";
+	const pgMessage = verbose ? rawMessage : "";
+	const code = pgError.code || "UNKNOWN";
+	const suffix = hint ? ` Hint: ${hint}` : "";
+	const tableRef = table ?? context;
+	/** `": <postgres said>"`, or nothing when the details are withheld. */
+	const said = pgMessage ? `: ${pgMessage}` : "";
+	switch (pgError.code) {
+		case "23503": return {
+			message: detail ? `Foreign key constraint violated: ${detail}${suffix}` : `Cannot complete operation: a foreign key constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
+			code
+		};
+		case "23505": return {
+			message: detail ? `Duplicate value: ${detail}${suffix}` : `Cannot complete operation: a unique constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
+			code
+		};
+		case "23502": return {
+			message: `Missing required field: "${column ?? "unknown"}" in "${tableRef}" cannot be empty.${suffix}`,
+			code
+		};
+		case "23514": return {
+			message: `Validation failed: a check constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
+			code
+		};
+		case "22P02": return {
+			message: `Invalid data format in "${context}"${said}.${suffix}`,
+			code
+		};
+		case "22001": return {
+			message: `Value too long for column "${column ?? "unknown"}" in "${tableRef}"${said}.${suffix}`,
+			code
+		};
+		case "22003": return {
+			message: `Numeric value out of range for column "${column ?? "unknown"}" in "${tableRef}"${said}.${suffix}`,
+			code
+		};
+		case "42703": return {
+			message: `Unknown column in "${tableRef}"${said}. Check if your schema is up to date (run migrations).${suffix}`,
+			code
+		};
+		case "42P01": return {
+			message: `Table not found for "${context}"${said}. Check if your schema is up to date (run migrations).${suffix}`,
+			code
+		};
+		case "42501": return rawMessage.toLowerCase().includes("row-level security policy") ? {
+			message: `Not permitted to write this row in "${tableRef}": it does not satisfy the row-level security policy.${suffix}`,
+			code
+		} : {
+			message: `Permission denied on "${tableRef}": the database role this server connects as lacks privileges on it.${suffix}`,
+			code
+		};
+		case "28000": return {
+			message: `Authorization failed for "${context}". Check your database credentials.${suffix}`,
+			code
+		};
+		default: {
+			const parts = [`Database error in "${context}" [${code}]${said}`];
+			if (detail) parts.push(`Detail: ${detail}`);
+			if (column) parts.push(`Column: ${column}`);
+			if (dataType) parts.push(`Data type: ${dataType}`);
+			if (constraint) parts.push(`Constraint: ${constraint}`);
+			if (hint) parts.push(`Hint: ${hint}`);
+			return {
+				message: parts.join(". "),
+				code
+			};
+		}
+	}
+}
+/**
+* Sanitize any error into a message safe and helpful for the client.
+*
+* A deliberate 4xx (`ApiError`) passes through untouched — the server already
+* decided what the client should read. Otherwise the PG error is extracted
+* from the Drizzle cause chain, falling back to a generic message that
+* doesn't leak SQL.
+*
+* @param error   - The raw caught error
+* @param context - A human-readable context string (e.g. collection path)
+* @returns An object with `message` (user-friendly) and optional `code`
+*          (the `ApiError` code, or the PG SQLSTATE).
+*/
+function sanitizeErrorForClient(error, context) {
+	const clientError = asClientFacingError(error);
+	if (clientError) {
+		const line = `[API ${clientError.statusCode} ${clientError.code ?? "BAD_REQUEST"}] in "${context}": ${clientError.message}`;
+		if (clientError.expected) logger.debug(line);
+		else logger.warn(`⚠️ ${line}`);
+		return {
+			message: clientError.message,
+			...clientError.code && { code: clientError.code }
+		};
+	}
+	const pgError = extractPgError(error);
+	if (pgError) {
+		logger.error(`[PG ${pgError.code}] Error in "${context}"`, {
+			code: pgError.code,
+			message: pgError.message,
+			detail: pgError.detail,
+			hint: pgError.hint,
+			column: pgError.column,
+			table: pgError.table,
+			constraint: pgError.constraint,
+			dataType: pgError.dataType
+		});
+		return pgErrorToFriendlyMessage(pgError, context);
+	}
+	logger.error(`Database error in "${context}" (no PG error extracted)`, {
+		error: error instanceof Error ? error.message : String(error),
+		stack: error instanceof Error ? error.stack : void 0,
+		cause: error instanceof Error && error.cause ? error.cause instanceof Error ? error.cause.message : String(error.cause) : void 0
+	});
+	const causeMessage = extractCauseMessage(error);
+	if (causeMessage) return { message: `Database error in "${context}": ${causeMessage}` };
+	return { message: `Could not load data for "${context}". Check server logs for details.` };
+}
+//#endregion
 //#region src/schema/auth-users-columns.ts
 /**
 * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
@@ -864,6 +1158,34 @@ var isIdProperty = (propName, prop, collection) => {
 * the generated `policies.sql` emit the same SQL, from the same source.
 */
 var statementsToDdl = (statements) => statements.map((s) => `${s}\n`).join("");
+/**
+* The `ON DELETE` a foreign key gets when the author did not say.
+*
+* One rule for every property that emits one — `belongsTo` relations and
+* `reference` properties alike. `reference` kept its own `CASCADE` default for
+* a release after this rule was written, which is exactly the split this
+* function exists to prevent: two spellings of the same link, two data-retention
+* behaviours, and only one of them documented.
+*
+* An optional link is `SET NULL`: the column can hold NULL, so dropping the
+* parent leaves the child row with an empty pointer, which is what "optional"
+* already means.
+*
+* A required link is **`RESTRICT`**, not `CASCADE`. `NOT NULL` says the child
+* cannot exist without a parent; it does not say deleting the parent should
+* take the child with it. That second claim is a data-retention decision, and
+* defaulting to it meant `onDelete` — a field nobody has to write — silently
+* turned every `DELETE FROM authors` into a cascade through posts, comments and
+* anything else that hung off them. `RESTRICT` fails the delete instead and
+* names the constraint, so the author chooses `cascade` on purpose or clears
+* the children first.
+*
+* Both DDL paths — the `CREATE TABLE` generator and {@link planRelationalColumns},
+* which boot-ensure compares the live database against — call this, so a
+* default that appears in one and not the other cannot make `db push` plan a
+* constraint rewrite on every run.
+*/
+var defaultBelongsToOnDelete = (required) => required ? "RESTRICT" : "SET NULL";
 var generatePolicyDdl = (collection, rule, resolveCollection) => statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
 /**
 * The individual SQL statements a single security rule compiles to: a
@@ -1234,7 +1556,7 @@ var generatePostgresDdl = async (allCollections, options = {
 					const fkColType = getSqlColumnType(propName, prop, collection, collections);
 					const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : "";
 					const required = prop.validation?.required;
-					const onDeleteVal = relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL");
+					const onDeleteVal = relInfo.onDelete ?? defaultBelongsToOnDelete(required);
 					let colDef = `  "${relInfo.localKey}" ${fkColType}`;
 					if (required) colDef += " NOT NULL";
 					columns.push(colDef);
@@ -1253,7 +1575,7 @@ var generatePostgresDdl = async (allCollections, options = {
 						const targetTable = getTableName(targetCollection);
 						const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
 						const targetId = getPrimaryKeyName(targetCollection);
-						const onDelete = required ? "CASCADE" : "SET NULL";
+						const onDelete = defaultBelongsToOnDelete(required);
 						let colDef = `  "${colName}" ${colType}`;
 						if (required) colDef += " NOT NULL";
 						columns.push(colDef);
@@ -1420,7 +1742,7 @@ var planRelationalColumns = (allCollections) => {
 						targetSchema: schemaOfCollection(targetCollection),
 						targetTable: bareTableName(getTableName(targetCollection)),
 						targetColumn: getPrimaryKeyName(targetCollection),
-						onDelete: relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL"),
+						onDelete: relInfo.onDelete ?? defaultBelongsToOnDelete(required),
 						onUpdate: relInfo.onUpdate
 					})
 				});
@@ -1442,7 +1764,7 @@ var planRelationalColumns = (allCollections) => {
 						targetSchema: schemaOfCollection(targetCollection),
 						targetTable: bareTableName(getTableName(targetCollection)),
 						targetColumn: getPrimaryKeyName(targetCollection),
-						onDelete: required ? "CASCADE" : "SET NULL"
+						onDelete: defaultBelongsToOnDelete(required)
 					}) : void 0
 				});
 			}
@@ -1599,6 +1921,111 @@ var generatePostgresPoliciesDdl = (allCollections) => {
 	return ddl;
 };
 //#endregion
+//#region src/schema/column-type-drift.ts
+/**
+* Types that mean the same thing to everything above the driver.
+*
+* Keyed by every spelling either side can produce: `information_schema` reports
+* `udt_name` (`int4`, `_numeric`, `bpchar`), while the generators emit SQL
+* (`INTEGER`, `NUMERIC[]`, `CHAR(3)`). Both are normalised through here.
+*/
+var FAMILIES = {
+	int2: "number",
+	smallint: "number",
+	int4: "number",
+	int: "number",
+	integer: "number",
+	int8: "number",
+	bigint: "number",
+	numeric: "number",
+	decimal: "number",
+	float4: "number",
+	real: "number",
+	float8: "number",
+	"double precision": "number",
+	money: "number",
+	text: "text",
+	varchar: "text",
+	"character varying": "text",
+	bpchar: "text",
+	char: "text",
+	character: "text",
+	citext: "text",
+	bool: "boolean",
+	boolean: "boolean",
+	json: "json",
+	jsonb: "jsonb",
+	uuid: "uuid",
+	bytea: "bytea",
+	date: "date",
+	time: "time",
+	"time without time zone": "time",
+	timetz: "time",
+	"time with time zone": "time",
+	timestamp: "timestamp",
+	"timestamp without time zone": "timestamp",
+	timestamptz: "timestamptz",
+	"timestamp with time zone": "timestamptz",
+	interval: "interval",
+	tsvector: "tsvector",
+	vector: "vector",
+	halfvec: "halfvec",
+	sparsevec: "sparsevec"
+};
+/**
+* One SQL or `udt_name` spelling reduced to its family, or `null` when this
+* module has no opinion about it.
+*
+* `null` is not a failure. It is the answer for an enum type, a domain, a
+* PostGIS column, a quoted qualified name — everything whose identity is a
+* *name* rather than a shape, where two spellings being different says nothing
+* about whether the values are compatible.
+*/
+function typeFamily(raw) {
+	if (!raw) return null;
+	let type = raw.trim().toLowerCase();
+	if (!type) return null;
+	if (type.startsWith("\"")) return null;
+	const generated = type.indexOf(" generated ");
+	if (generated > 0) type = type.slice(0, generated).trim();
+	if (type.endsWith("[]")) {
+		const element = typeFamily(type.slice(0, -2));
+		return element && `array:${element}`;
+	}
+	if (type.startsWith("_")) {
+		const element = typeFamily(type.slice(1));
+		return element && `array:${element}`;
+	}
+	const paren = type.indexOf("(");
+	if (paren > 0) type = type.slice(0, paren).trim();
+	return FAMILIES[type] ?? null;
+}
+/**
+* Do these two spellings describe columns that hold the same kind of value?
+*
+* `true` whenever the answer is not confidently "no" — an unrecognised type on
+* either side agrees with everything, because a report needs evidence and an
+* unknown type is the absence of it.
+*/
+function typesAgree(declared, actual) {
+	const a = typeFamily(declared);
+	const b = typeFamily(actual);
+	if (a === null || b === null) return true;
+	return a === b;
+}
+/**
+* The sentence a boot log says about one drifted column.
+*
+* Written to be actionable in the place it is read, which is a runtime log with
+* no way to run a migration from it: it names both types, says which surface
+* will break first, and gives the statement that resolves it.
+*/
+function columnTypeDriftMessage(drift) {
+	const [schema, table] = drift.table.split(".");
+	return `Column "${drift.table}"."${drift.column}" is ${drift.actual} in the database, but this collection declares ${drift.declared}. Boot does not change an existing column's type, so the database keeps what it has and writes that match the declaration will be rejected by Postgres. Change it deliberately, when you can watch it:
+    ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${drift.column}" TYPE ${drift.declared} USING "${drift.column}"::${drift.declared};`;
+}
+//#endregion
 //#region src/schema/ensure-collection-tables.ts
 /**
 * Bringing a database up to date with a bundle's collections, additively.
@@ -1628,6 +2055,7 @@ var generatePostgresPoliciesDdl = (allCollections) => {
 * no-op.
 */
 var ensure_collection_tables_exports = /* @__PURE__ */ __exportAll({
+	describeDriverError: () => describeDriverError,
 	ensureCollectionTables: () => ensureCollectionTables,
 	planCollectionSchemaEnsure: () => planCollectionSchemaEnsure,
 	readExistingSchema: () => readExistingSchema,
@@ -1639,11 +2067,33 @@ function assertSafeIdentifier(value, what) {
 	if (!SAFE_IDENTIFIER.test(value)) throw new Error(`Refusing to build SQL with an unsafe ${what}: ${JSON.stringify(value)}`);
 	return value;
 }
+/**
+* The schema a collection lives in — validated, because it is about to be
+* interpolated into DDL.
+*
+* Validation used to run only on the names read back OUT of the catalogue,
+* which is the direction that cannot hurt anyone: those came from Postgres. The
+* names going IN — the schema and table a collection declares — were quoted and
+* concatenated on trust, and quoting is not escaping. A table named
+* `x" (id int); DROP TABLE users; --` closes the quote and the statement, and
+* the whole thing runs on the owner connection, which is the one connection in
+* the system that is exempt from every RLS policy.
+*
+* That is only a config file on a self-hosted project, where the person writing
+* it could run the SQL directly anyway. It is not only a config file where a
+* collection can be defined over the wire — the live-schema and source editors
+* both do that — and there the caller is an admin on the app, not an operator
+* of the database.
+*/
 function schemaOf(collection) {
-	return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	return assertSafeIdentifier(isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public", "schema name");
+}
+/** A collection's table name, validated for the same reason as {@link schemaOf}. */
+function tableOf(collection) {
+	return assertSafeIdentifier(getTableName(collection), "table name");
 }
 function qualified(collection) {
-	return `${schemaOf(collection)}.${getTableName(collection)}`;
+	return `${schemaOf(collection)}.${tableOf(collection)}`;
 }
 /**
 * Enum types a collection's properties require, as `schema.typename`.
@@ -1654,7 +2104,7 @@ function qualified(collection) {
 * silent schema fork.
 */
 function requiredEnums(collection) {
-	const table = getTableName(collection);
+	const table = tableOf(collection);
 	const schema = schemaOf(collection);
 	const out = [];
 	for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
@@ -1680,6 +2130,7 @@ function requiredEnums(collection) {
 function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 	const constraintPolicy = options.constraints ?? "additive";
 	const withheldConstraints = [];
+	const columnTypeDrift = [];
 	assertSearchIsPostgresOnly(allCollections);
 	const collections = relationalCollections(allCollections);
 	const actions = [];
@@ -1736,11 +2187,12 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 		if (existing.tables.has(key) || created.has(key)) continue;
 		created.add(key);
 		const schema = schemaOf(collection);
-		const table = getTableName(collection);
+		const table = tableOf(collection);
 		const idEntry = Object.entries(collection.properties ?? {}).find(([n, p]) => isIdProperty(n, p, collection));
 		const idName = idEntry ? resolveColumnName(idEntry[0], idEntry[1]) : "id";
 		const idProp = idEntry?.[1];
-		let idDef = `"${idName}" ${idProp ? getSqlColumnType(idEntry[0], idProp, collection, collections) : "TEXT"} PRIMARY KEY`;
+		const idType = idProp ? getSqlColumnType(idEntry[0], idProp, collection, collections) : "TEXT";
+		let idDef = `"${assertSafeIdentifier(idName, "column name")}" ${idType} PRIMARY KEY`;
 		if (idProp?.type === "string" && idProp.isId === "uuid") idDef += " DEFAULT gen_random_uuid()";
 		actions.push({
 			kind: "create-table",
@@ -1791,6 +2243,7 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 	};
 	const addColumn = (key, schema, table, column, definition) => {
 		if (existing.tables.get(key)?.has(column)) return;
+		assertSafeIdentifier(column, "column name");
 		actions.push({
 			kind: "add-column",
 			target: `${key}.${column}`,
@@ -1800,7 +2253,7 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 	for (const collection of collections) {
 		const key = qualified(collection);
 		const schema = schemaOf(collection);
-		const table = getTableName(collection);
+		const table = tableOf(collection);
 		const fresh = created.has(key);
 		const auth = isAuthCollection(collection);
 		for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
@@ -1813,7 +2266,8 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 				addColumn(key, schema, table, column, authDefinition);
 				continue;
 			}
-			let definition = getSqlColumnType(propName, p, collection, collections);
+			const declaredType = getSqlColumnType(propName, p, collection, collections);
+			let definition = declaredType;
 			if (fresh && p.validation?.unique) definition += " UNIQUE";
 			const autoValue = p.autoValue;
 			const hasDefault = p.type === "date" && (autoValue === "on_create" || autoValue === "on_update");
@@ -1821,6 +2275,13 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 			const required = p.validation?.required === true;
 			const columnKey = `${key}.${column}`;
 			const columnExists = existing.tables.get(key)?.has(column) === true;
+			const actualType = existing.columnTypes?.get(columnKey);
+			if (columnExists && actualType && !typesAgree(declaredType, actualType)) columnTypeDrift.push({
+				table: key,
+				column,
+				declared: declaredType,
+				actual: actualType
+			});
 			const tableIsEmpty = existing.populatedTables !== void 0 && existing.tables.has(key) && !existing.populatedTables.has(key);
 			const notNullIsSafe = fresh || tableIsEmpty || hasDefault;
 			if (required && !columnExists) if (notNullIsSafe) definition += " NOT NULL";
@@ -1903,8 +2364,12 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 			addColumn(key, junction.schema, junction.table, column.name, column.type);
 		}
 	}
+	const plannedRelationColumns = /* @__PURE__ */ new Map();
 	for (const relational of planRelationalColumns(collections)) {
 		const relKey = `${relational.schema}.${relational.table}`;
+		if (!plannedRelationColumns.has(relKey)) plannedRelationColumns.set(relKey, /* @__PURE__ */ new Set());
+		plannedRelationColumns.get(relKey).add(relational.column);
+		if (relational.legacyColumn) plannedRelationColumns.get(relKey).add(relational.legacyColumn);
 		if (renameLegacyColumn(relKey, relational.schema, relational.table, relational.column, relational.legacyColumn)) continue;
 		addColumn(relKey, relational.schema, relational.table, relational.column, relational.type);
 	}
@@ -1922,10 +2387,11 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 			sql: fk.sql
 		});
 	}
+	const concurrentIndexing = (schema, table) => !created.has(`${schema}.${table}`);
 	for (const spec of searchSpecs) for (const statement of searchIndexStatements(spec)) actions.push({
 		kind: "create-index",
 		target: `${spec.schema}.${spec.table}`,
-		sql: statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS")
+		sql: concurrentIndexing(spec.schema, spec.table) ? statement.replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : statement
 	});
 	const vectorIndexSkipped = [];
 	for (const collection of collections) {
@@ -1933,7 +2399,7 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 		for (const spec of plan.specs) actions.push({
 			kind: "create-index",
 			target: `${spec.schema}.${spec.table}`,
-			sql: vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS")
+			sql: concurrentIndexing(spec.schema, spec.table) ? vectorIndexStatement(spec).replace("CREATE INDEX IF NOT EXISTS", "CREATE INDEX CONCURRENTLY IF NOT EXISTS") : vectorIndexStatement(spec)
 		});
 		vectorIndexSkipped.push(...plan.skipped);
 	}
@@ -1941,10 +2407,30 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 		kind: "create-index",
 		target: `${spec.schema}.${spec.table}`,
 		sql: collectionIndexStatement(spec, {
-			concurrently: true,
+			concurrently: concurrentIndexing(spec.schema, spec.table),
 			ifNotExists: true
 		})
 	});
+	const orphanedRequiredColumns = [];
+	if (existing.notNullColumns && existing.columnDefaults) for (const collection of collections) {
+		const key = qualified(collection);
+		const live = existing.tables.get(key);
+		if (!live || created.has(key)) continue;
+		const declared = /* @__PURE__ */ new Set();
+		for (const [propName, prop] of Object.entries(collection.properties ?? {})) declared.add(resolveColumnName(propName, prop));
+		for (const column of plannedRelationColumns.get(key) ?? []) declared.add(column);
+		for (const column of live) {
+			const columnKey = `${key}.${column}`;
+			if (declared.has(column)) continue;
+			if (!existing.notNullColumns.has(columnKey)) continue;
+			if (existing.columnDefaults.has(columnKey)) continue;
+			orphanedRequiredColumns.push({
+				table: key,
+				column,
+				slug: collection.slug
+			});
+		}
+	}
 	return {
 		actions,
 		statements: actions.map((a) => a.sql),
@@ -1952,7 +2438,9 @@ function planCollectionSchemaEnsure(allCollections, existing, options = {}) {
 		searchDrift,
 		searchAdopted,
 		vectorIndexSkipped,
-		withheldConstraints
+		withheldConstraints,
+		columnTypeDrift,
+		orphanedRequiredColumns
 	};
 }
 /** Read what the database has, for the schemas the collections live in. */
@@ -1965,7 +2453,9 @@ async function readExistingSchema(client, schemas) {
 	};
 	const inList = schemas.map((schema) => `'${assertSafeIdentifier(schema, "schema name")}'`).join(", ");
 	const notNullColumns = /* @__PURE__ */ new Set();
-	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name, is_nullable
+	const columnTypes = /* @__PURE__ */ new Map();
+	const columnDefaults = /* @__PURE__ */ new Set();
+	const { rows: columns } = await client.query(`SELECT table_schema, table_name, column_name, is_nullable, udt_name, column_default
          FROM information_schema.columns
          WHERE table_schema IN (${inList})`);
 	for (const row of columns) {
@@ -1973,6 +2463,8 @@ async function readExistingSchema(client, schemas) {
 		if (!tables.has(key)) tables.set(key, /* @__PURE__ */ new Set());
 		tables.get(key).add(row.column_name);
 		if (row.is_nullable === "NO") notNullColumns.add(`${key}.${row.column_name}`);
+		if (row.udt_name) columnTypes.set(`${key}.${row.column_name}`, row.udt_name);
+		if (row.column_default !== null) columnDefaults.add(`${key}.${row.column_name}`);
 	}
 	const populatedTables = /* @__PURE__ */ new Set();
 	const { rows: realTables } = await client.query(`SELECT n.nspname AS schema, c.relname AS name
@@ -2030,7 +2522,9 @@ async function readExistingSchema(client, schemas) {
 		columnComments,
 		enumValues,
 		notNullColumns,
-		populatedTables
+		populatedTables,
+		columnTypes,
+		columnDefaults
 	};
 }
 /**
@@ -2097,6 +2591,18 @@ async function ensureCollectionTables(client, collections, log, options = {}) {
 		logger.warn(`[schema] ${message}`);
 		log?.(message);
 	}
+	for (const drift of plan.columnTypeDrift) {
+		const message = columnTypeDriftMessage(drift);
+		logger.warn(`[schema] ${message}`);
+		log?.(message);
+	}
+	for (const orphan of plan.orphanedRequiredColumns) {
+		const [schema, table] = orphan.table.split(".");
+		const message = `"${orphan.table}"."${orphan.column}" is NOT NULL with no default, and the "${orphan.slug}" collection no longer declares it. Every insert will be rejected for a field you cannot set (PG_23502, naming "${orphan.column}"). This is what a renamed property looks like: the new column was added, and the old one cannot be dropped unattended. Fix it with ONE of:
+      ALTER TABLE "${schema}"."${table}" DROP COLUMN "${orphan.column}";               -- the rename is complete\n      ALTER TABLE "${schema}"."${table}" ALTER COLUMN "${orphan.column}" DROP NOT NULL; -- keep the data, stop requiring it\n      ...or declare the property again, if the column is still wanted.`;
+		logger.warn(`[schema] ${message}`);
+		log?.(message);
+	}
 	if (plan.actions.length === 0) {
 		log?.("Schema is up to date; nothing to create.");
 		return {
@@ -2108,8 +2614,8 @@ async function ensureCollectionTables(client, collections, log, options = {}) {
 		if (await applyAction(client, action)) log?.(`${action.kind}: ${action.target}`);
 		else log?.(`${action.kind}: ${action.target} (already created by a peer)`);
 	} catch (err) {
-		const message = err instanceof Error ? err.message : String(err);
-		if (action.kind === "add-constraint" || action.kind === "comment-column") {
+		const message = describeDriverError(err);
+		if (action.kind === "add-constraint" || action.kind === "comment-column" || action.kind === "create-index" && !/CREATE\s+UNIQUE\s+INDEX/i.test(action.sql)) {
 			failures.push({
 				kind: action.kind,
 				target: action.target,
@@ -2124,6 +2630,56 @@ async function ensureCollectionTables(client, collections, log, options = {}) {
 		failures
 	};
 }
+/**
+* What actually went wrong, rather than what the ORM said about it.
+*
+* Drizzle wraps every driver error, and its `message` is literally
+* ``Failed query: ${sql}\nparams: ${params}`` — the statement we already know,
+* and not one word of Postgres's answer. Reporting `err.message` therefore
+* produced a failure that named the statement twice and the *reason* zero
+* times, so four unrelated boot failures — a missing extension, a wrong
+* privilege, a bad index method, a constraint the rows violate — all read
+* identically to whoever had to fix them.
+*
+* Two consequences, both observed in the field before this existed:
+*
+*  1. On a managed deployment the reason never reaches anybody. Boot dies, the
+*     pod never goes ready, and the deploy reports a readiness timeout — so the
+*     one line that says why is the one line that was thrown away here.
+*  2. {@link vectorExtensionHint} matches on the error text. Against the
+*     wrapper it matched nothing, so the hint written specifically to explain a
+*     missing pgvector never fired on the path that raises it.
+*
+* `detail` and `hint` come along because they are the fields Postgres uses to
+* say which object it meant and what to do about it — `CREATE EXTENSION` names
+* the missing library there, and a rejected constraint names the row. This
+* writes into the tenant's own boot log, about the tenant's own database.
+*/
+function describeDriverError(err) {
+	const pg = extractPgError(err);
+	if (pg) {
+		const parts = [pg.code ? `${pg.message} [${pg.code}]` : pg.message];
+		if (pg.detail) parts.push(`  detail: ${pg.detail}`);
+		if (pg.hint) parts.push(`  hint: ${pg.hint}`);
+		return parts.join("\n");
+	}
+	const cause = extractCauseMessage(err);
+	if (cause) return cause;
+	return err instanceof Error ? err.message : String(err);
+}
+/** ` CONCURRENTLY ` as it appears in a rendered `CREATE [UNIQUE] INDEX`. */
+var CONCURRENTLY_RE = /\sCONCURRENTLY\s/i;
+/**
+* `25001 active_sql_transaction` — "cannot run inside a transaction block".
+*
+* Only ever raised here by `CREATE INDEX CONCURRENTLY`, and only when the
+* connection we were handed is inside a transaction. Deliberately narrow: it
+* decides to retry a *different* statement, so it must not fire on anything it
+* has not been reasoned about.
+*/
+function isTransactionBlockRefusal(err) {
+	return extractPgError(err)?.code === "25001";
+}
 /** Attempts per action, including the first. Matches the server's bootstraps. */
 var DDL_ATTEMPTS = 4;
 /**
@@ -2148,10 +2704,16 @@ var DDL_ATTEMPTS = 4;
 *   permission failure, a unique constraint the customer's own rows violate.
 */
 async function applyAction(client, action) {
+	let sqlText = action.sql;
 	for (let attempt = 1;; attempt++) try {
-		await client.query(action.sql);
+		await client.query(sqlText);
 		return true;
 	} catch (err) {
+		if (isTransactionBlockRefusal(err) && CONCURRENTLY_RE.test(sqlText)) {
+			sqlText = sqlText.replace(CONCURRENTLY_RE, " ");
+			logger.warn(`[schema] ${action.kind} ${action.target}: this connection is inside a transaction, so the index is being built with a write lock rather than concurrently. Writes to this table block until it finishes.`);
+			continue;
+		}
 		if (isDuplicateObjectRace(err)) {
 			logger.debug(`[schema] ${action.kind} ${action.target}: already created by another instance`);
 			return false;
@@ -2165,6 +2727,6 @@ async function applyAction(client, action) {
 	}
 }
 //#endregion
-export { resolveStringColumnLength as _, generatePostgresDdl as a, generatePostgresVectorDdl as c, AUTH_USERS_COLUMNS as d, authUsersColumnSql as f, visibleColumnProjection as g, hiddenColumnsOption as h, readSchemaFactsFor as i, planCollectionPolicies as l, buildSearchColumnSpec as m, planCollectionSchemaEnsure as n, generatePostgresPoliciesDdl as o, SEARCH_UNACCENT_FN as p, readExistingSchema as r, generatePostgresSearchDdl as s, ensure_collection_tables_exports as t, resolveColumnName as u };
+export { __toESM as A, SEARCH_UNACCENT_FN as C, __commonJSMin as D, visibleColumnProjection as E, __exportAll as O, sanitizeErrorForClient as S, hiddenColumnsOption as T, extractPgError as _, readSchemaFactsFor as a, pgErrorToFriendlyMessage as b, generatePostgresPoliciesDdl as c, planCollectionPolicies as d, resolveColumnName as f, extractCauseMessage as g, classifyConnectFailure as h, readExistingSchema as i, __require as k, generatePostgresSearchDdl as l, authUsersColumnSql as m, ensure_collection_tables_exports as n, defaultBelongsToOnDelete as o, AUTH_USERS_COLUMNS as p, planCollectionSchemaEnsure as r, generatePostgresDdl as s, describeDriverError as t, generatePostgresVectorDdl as u, isRoleSwitchingPermissionError as v, buildSearchColumnSpec as w, reachedDatabase as x, isRowLevelSecurityDenial as y };
 
-//# sourceMappingURL=ensure-collection-tables-DgVixhX3.js.map
+//# sourceMappingURL=ensure-collection-tables-DbAhrjnG.js.map