@rebasepro/server-postgres 0.18.0 → 0.18.1

package/dist/generate-postgres-ddl-logic-CtnpIBVv.js

@@ -0,0 +1,1312 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
+import { i as isAuthCollection, n as authUsersColumnDefinition, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
+import { a as vectorDimensionGuard, c as vectorExtensionStatement, d as vectorObjectNames, i as vectorColumnDefinition, n as buildVectorColumnSpecs, o as vectorExtensionDeclared, r as buildVectorIndexPlan, t as VECTOR_EXTENSION_OPT_IN, u as vectorIndexStatements } from "./vector-index-DkWxm2de.js";
+import { i as collectionIndexStatements, n as buildCollectionIndexSpecs } from "./collection-index-BHgT_TKd.js";
+import { DEFAULT_FUZZY_THRESHOLD, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_WEIGHT, REBASE_SCHEMA, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
+import { findRelation, getEffectiveSecurityRules, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getTableName, policyToPostgres, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, resolveStringColumnLength, securityRuleToConditions } from "@rebasepro/common";
+import { generateForeignKeyName, getPolicyNamesForRule, legacyForeignKeyName, toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "node:crypto";
+//#region src/schema/search-column.ts
+/**
+* The one place a collection's `search` block becomes SQL.
+*
+* Four things describe a Postgres table in this codebase — the DDL generator,
+* the Drizzle schema generator, the runtime table builder for BaaS mode, and
+* the boot-time schema ensure — and each of them has, at some point, described
+* a column differently from the others. The `varchar(255)` note in
+* `generate-postgres-ddl-logic` is one such scar: the same property produced a
+* capped column down one path and an uncapped one down the other, and nothing
+* failed until a user hit the cap.
+*
+* So the search column is not implemented four times. It is computed once,
+* here, and every generator renders the same {@link SearchColumnSpec}. There is
+* a test asserting exactly that (`search-column-contract.test.ts`); the point of
+* this module is that the test has something to assert *about*.
+*
+* ## Why the expressions look the way they do
+*
+* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
+* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
+*
+* | expression                              | immutable |
+* |-----------------------------------------|-----------|
+* | `to_tsvector('spanish', col)`           | yes       |
+* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
+* | `array_to_string(col, ' ')`             | **no**    |
+* | `col::text` on `text[]`                 | **no**    |
+* | `to_jsonb(col)`                         | **no**    |
+* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
+* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
+* | `setweight(...) || setweight(...)`      | yes       |
+*
+* Three of the four things a real search column needs are therefore unavailable
+* directly, which is why {@link searchHelperFunctions} exists: each wraps a
+* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
+* promise, and it is a true one for these three — array joining, JSON string
+* extraction and accent folding are all deterministic for a given input; the
+* built-ins are marked stable only because they must account for element types
+* and dictionaries in general.
+*
+* The alternative was to skip `unaccent` and text arrays entirely. That is not
+* a real option in an accented language: Postgres stems `auditoría` to
+* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
+* typed without accents misses every row that carries them.
+*/
+/** Schema-qualified so a collection outside `public` still resolves them. */
+var HELPER_SCHEMA = "public";
+/**
+* Names of the helper functions. Frozen: they are recorded in the stored
+* generation expression of every search column ever created, so renaming one
+* orphans every table that already has a search column.
+*/
+var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
+var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
+/** Raised when a `search` block names something that cannot be searched. */
+var SearchConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SearchConfigError";
+	}
+};
+/** The `search` block of a collection, or undefined when it has none. */
+var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
+/**
+* Refuse a `search` block on a collection this engine does not store.
+*
+* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
+* already stops the ordinary case. This catches the rest — a JS config, a cast,
+* a collection whose `engine` was changed after the block was written — because
+* the alternative is the exact failure the block exists to prevent: a developer
+* who declared what to index, saw no error, and got the substring fallback.
+*
+* Called with *every* collection, before the Postgres ones are filtered out.
+*/
+var assertSearchIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.search) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
+	}
+};
+var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
+/**
+* Classify a property for search purposes.
+*
+* Deliberately narrower than `getSqlColumnType`: search only cares whether a
+* value reaches text, and the mapping from property to *physical* type is
+* asserted against `getSqlColumnType` in the contract test rather than
+* duplicated here.
+*
+* Returns null for anything that is not text-bearing, which the caller turns
+* into a boot error naming the property.
+*/
+var classify = (prop) => {
+	switch (prop.type) {
+		case "string": {
+			const sp = prop;
+			if (sp.enum) return {
+				kind: "text",
+				reason: "enum"
+			};
+			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
+				kind: "text",
+				reason: "uuid"
+			};
+			return { kind: "text" };
+		}
+		case "map":
+			if (prop.columnType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			return { kind: "jsonb" };
+		case "array": {
+			const ap = prop;
+			let colType = ap.columnType;
+			if (!colType && ap.of && !Array.isArray(ap.of)) {
+				const of = ap.of;
+				if (of.type === "string") colType = "text[]";
+				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
+				else if (of.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "text[]") return { kind: "text_array" };
+			if (colType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
+				kind: "text_array",
+				reason: "non_text_array"
+			};
+			return { kind: "jsonb" };
+		}
+		default: return null;
+	}
+};
+var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
+/** SQL reading one field as plain text, before normalization. */
+var rawTextSql = (field) => {
+	const col = `"${field.column}"`;
+	if (field.kind === "text") return `coalesce(${col}, '')`;
+	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
+	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
+};
+var quote = (v) => `'${v.replace(/'/g, "''")}'`;
+/**
+* Resolve and validate one declared field path.
+*
+* A path that does not resolve throws. The whole point of an explicit block is
+* that the author knows what is indexed; a silently dropped field would make it
+* a guess again, and the failure — a search that returns nothing for content
+* that is plainly in the row — is invisible from the outside.
+*/
+var resolveField = (entry, collection, cfg) => {
+	const path = typeof entry === "string" ? entry : entry.path;
+	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? DEFAULT_SEARCH_WEIGHT;
+	const where = `${collection.slug}.search`;
+	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
+	const [head, ...rest] = path.split(".");
+	const prop = collection.properties?.[head];
+	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
+	const classified = classify(prop);
+	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
+	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
+	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
+	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
+	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
+	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
+	const column = columnNameOf(head, prop);
+	const textSql = normalize(rawTextSql({
+		column,
+		jsonPath: rest,
+		kind: classified.kind
+	}), cfg.unaccent === true);
+	const language = cfg.language ?? DEFAULT_SEARCH_LANGUAGE;
+	return {
+		path,
+		column,
+		jsonPath: rest,
+		kind: classified.kind,
+		weight,
+		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
+		textSql
+	};
+};
+/**
+* Build the full spec for a collection, or undefined when it has not opted in.
+*
+* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
+* at boot surface that as a startup failure — a search block that half-works is
+* worse than one that refuses.
+*/
+var buildSearchColumnSpec = (collection) => {
+	const cfg = getSearchConfig(collection);
+	if (!cfg) return void 0;
+	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const column = cfg.column ?? DEFAULT_SEARCH_COLUMN;
+	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
+	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
+	const seen = /* @__PURE__ */ new Set();
+	for (const f of fields) {
+		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
+		seen.add(f.path);
+	}
+	const extensions = [];
+	if (cfg.unaccent) extensions.push("unaccent");
+	if (cfg.fuzzy) extensions.push("pg_trgm");
+	const spec = {
+		schema,
+		table,
+		column,
+		language: cfg.language ?? DEFAULT_SEARCH_LANGUAGE,
+		unaccent: cfg.unaccent === true,
+		fields,
+		expression: fields.map((f) => f.sql).join(" || "),
+		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
+		extensions
+	};
+	if (cfg.fuzzy) {
+		const fuzzyColumn = `${column}_text`;
+		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
+		spec.fuzzy = {
+			column: fuzzyColumn,
+			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
+			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
+			threshold: cfg.fuzzyThreshold ?? DEFAULT_FUZZY_THRESHOLD
+		};
+	}
+	return spec;
+};
+/**
+* The IMMUTABLE wrappers the generated expressions call.
+*
+* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
+* than an error, and idempotent for the same reason every other boot-time DDL
+* statement here is.
+*
+* The bodies are stable built-ins wrapped in an immutable promise — see the
+* module comment for why that promise is sound. `STRICT` matters: it makes NULL
+* in mean NULL out without executing the body, which is what the `coalesce` at
+* each call site then absorbs.
+*/
+var searchHelperFunctions = (spec) => {
+	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
+	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
+	return statements;
+};
+/**
+* `CREATE EXTENSION` statements the spec's expressions depend on.
+*
+* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
+* `CREATE EXTENSION` installs into the first schema on `search_path`, which
+* defaults to `"$user", public` — and the scaffold's database role is named
+* `rebase`, the same as the schema the generator creates one statement earlier.
+* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
+* dictionary in `rebase`, and every reference to `public.unaccent` below fails
+* with "text search dictionary does not exist". Observed, not theorised.
+*/
+var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
+/** The column definition as it appears inside `CREATE TABLE`. */
+var searchColumnDefinition = (spec) => `"${spec.column}" tsvector GENERATED ALWAYS AS (${spec.expression}) STORED`;
+/** The fuzzy column definition, when the spec asks for one. */
+var fuzzyColumnDefinition = (spec) => spec.fuzzy ? `"${spec.fuzzy.column}" text GENERATED ALWAYS AS (${spec.fuzzy.expression}) STORED` : void 0;
+/**
+* Index statements for the spec.
+*
+* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
+* SQL file replayed as one unit — a migration, or `search.sql` — where a
+* concurrent build is not allowed. The boot-time ensure path runs statement by
+* statement against tables that are live and populated, and uses the
+* concurrent form instead; see `ensureSearchColumns`.
+*/
+var searchIndexStatements = (spec) => {
+	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
+	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
+	return statements;
+};
+/**
+* Marker on the comment of every generated search column this module creates.
+*
+* Versioned because the fingerprint below is only comparable against itself: a
+* future change to how it is computed has to read as "not stamped by this
+* version" rather than as drift on every existing column.
+*/
+var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
+/**
+* A stable fingerprint of one generated column's expression.
+*
+* Why a stamp rather than reading the expression back: Postgres stores a
+* generated column's expression *parsed*, and hands it back deparsed — casts
+* made explicit, identifiers requoted, schema qualifications added or dropped
+* according to `search_path`. Comparing that text to the text we generated
+* would report drift on wording, and this comparison decides whether a boot
+* refuses, so a false positive is an outage. The stamp is written by the same
+* code that writes the column, so equality means what it says.
+*/
+var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
+/**
+* The stamps for a spec's generated columns — one per column, never shared.
+*
+* Per column on purpose: turning `fuzzy` on adds a second column and changes
+* nothing about the first, and a spec-wide fingerprint would report the
+* untouched `tsvector` column as drifted and refuse a boot over a change that
+* is purely additive.
+*/
+var searchColumnStamps = (spec) => {
+	const stamp = (column, expression) => {
+		const fingerprint = searchExpressionFingerprint(expression);
+		return {
+			column,
+			expression,
+			fingerprint,
+			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
+		};
+	};
+	const stamps = [stamp(spec.column, spec.expression)];
+	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
+	return stamps;
+};
+/**
+* The same drift check as the boot ensure, for the SQL file.
+*
+* Needed because {@link searchColumnStamps} would otherwise *launder* drift on
+* the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
+* exists, so a re-generated `search.sql` would stamp a stale column with the
+* new block's fingerprint and the next boot would find them in agreement.
+* Guarding first means the file refuses instead — `rebase db push` is attended,
+* and the operator reading the failure is the person who changed the block.
+*/
+var searchStampGuards = (spec) => searchColumnStamps(spec).map((stamp) => {
+	const relation = quote(`"${spec.schema}"."${spec.table}"`);
+	return `DO $rebase_search$
+DECLARE recorded text;
+BEGIN
+    SELECT col_description(a.attrelid, a.attnum) INTO recorded
+    FROM pg_attribute a
+    WHERE a.attrelid = ${relation}::regclass AND a.attname = ${quote(stamp.column)} AND NOT a.attisdropped;
+    IF recorded LIKE ${quote(`${SEARCH_STAMP_PREFIX}%`)} AND recorded <> ${quote(stamp.fingerprint)} THEN
+        RAISE EXCEPTION 'Rebase: the search block for ${spec.schema}.${spec.table} changed after the generated column "${stamp.column}" was built (recorded %, expected ${stamp.fingerprint}). Postgres cannot alter a generated expression in place. Drop the column and re-apply this file — it rewrites the table and rebuilds the index: ALTER TABLE ${relation.slice(1, -1)} DROP COLUMN "${stamp.column}";', recorded;
+    END IF;
+END
+$rebase_search$;`;
+});
+/**
+* The index names the spec creates.
+*
+* Needed by name, not just by statement, so Atlas can be told to exclude them
+* from its diff — see `searchExcludePatterns`.
+*/
+var searchIndexNames = (spec) => spec.fuzzy ? [spec.indexName, spec.fuzzy.indexName] : [spec.indexName];
+/**
+* The generated column names a collection's search block adds, if any.
+*
+* These are physical columns on the table, so `SELECT *` returns them. They are
+* an index in column form — a list of lexeme positions, or a concatenation of
+* every searchable field on the row — and nothing outside the query planner has
+* any use for them. Left in, every list response carries a second, larger copy
+* of the row's text.
+*/
+var searchColumnNames = (collection) => {
+	let spec;
+	try {
+		spec = buildSearchColumnSpec(collection);
+	} catch {
+		return [];
+	}
+	if (!spec) return [];
+	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
+};
+/**
+* True for a column whose type only ever holds a search index.
+*
+* Independent of any collection config on purpose: an introspected database
+* (BaaS mode) can carry a `tsvector` column this framework never created —
+* Pagila's `film.fulltext` is the canonical one — and it should not be returned
+* to callers either. `isDerivedIndexColumn` already keeps such a column out of
+* the *properties*; this keeps it out of the *rows*.
+*/
+var isSearchIndexColumn = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return sqlType === "tsvector" || sqlType === "tsquery";
+};
+/**
+* A drizzle select projection over `table` with the search columns dropped.
+*
+* Returns undefined when nothing needs dropping, so the common case keeps using
+* a plain `select()` and this stays invisible in the generated SQL.
+*/
+var visibleColumnProjection = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (!tableColumns || excluded.length === 0) return void 0;
+	const projection = {};
+	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
+	return projection;
+};
+/** The same exclusion as a drizzle `db.query` `columns` denylist. */
+var hiddenColumnsOption = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (excluded.length === 0) return void 0;
+	return Object.fromEntries(excluded.map((name) => [name, false]));
+};
+/**
+* The columns to keep out of a response, by name.
+*
+* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
+* for anything that is not a real drizzle table — a stub in a test, a derived
+* or nested path with no table behind it. Nothing to exclude is the right
+* answer there, and it has to be an answer rather than a throw: this runs on
+* the read path of every collection, opted in or not.
+*/
+var excludedColumnNames = (tableColumns, collection) => {
+	if (!tableColumns || typeof tableColumns !== "object") return [];
+	const byName = new Set(collection ? searchColumnNames(collection) : []);
+	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
+};
+//#endregion
+//#region src/schema/generate-postgres-ddl-logic.ts
+var generate_postgres_ddl_logic_exports = /* @__PURE__ */ __exportAll({
+	defaultBelongsToOnDelete: () => defaultBelongsToOnDelete,
+	generatePolicyStatements: () => generatePolicyStatements,
+	generatePostgresDdl: () => generatePostgresDdl,
+	generatePostgresPoliciesDdl: () => generatePostgresPoliciesDdl,
+	generatePostgresSearchDdl: () => generatePostgresSearchDdl,
+	generatePostgresVectorDdl: () => generatePostgresVectorDdl,
+	getPrimaryKeyName: () => getPrimaryKeyName,
+	getPrimaryKeyProp: () => getPrimaryKeyProp,
+	getSqlColumnType: () => getSqlColumnType,
+	isIdProperty: () => isIdProperty,
+	isNumericId: () => isNumericId,
+	planCollectionPolicies: () => planCollectionPolicies,
+	planJunctionTables: () => planJunctionTables,
+	planRelationalColumns: () => planRelationalColumns,
+	quoteSqlLiteral: () => quoteSqlLiteral,
+	resolveColumnName: () => resolveColumnName,
+	searchExcludePatterns: () => searchExcludePatterns,
+	vectorExcludePatterns: () => vectorExcludePatterns
+});
+var resolveColumnName = (propName, prop) => {
+	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
+	return toSnakeCase(propName);
+};
+var getPrimaryKeyProp = (collection) => {
+	if (collection.properties) {
+		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
+		if (idPropEntry) {
+			const prop = idPropEntry[1];
+			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
+			return {
+				name: idPropEntry[0],
+				type: prop.type === "number" ? "number" : "string",
+				isUuid
+			};
+		}
+	}
+	const idProp = collection.properties?.["id"];
+	if (idProp?.type === "number") return {
+		name: "id",
+		type: "number",
+		isUuid: false
+	};
+	return {
+		name: "id",
+		type: "string",
+		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
+	};
+};
+var isNumericId = (collection) => {
+	return getPrimaryKeyProp(collection).type === "number";
+};
+var getPrimaryKeyName = (collection) => {
+	return getPrimaryKeyProp(collection).name;
+};
+/** The column type a junction holds for one endpoint's primary key. */
+var junctionKeyType = (collection) => isNumericId(collection) ? "INTEGER" : getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT";
+var isIdProperty = (propName, prop, collection) => {
+	if ("isId" in prop && Boolean(prop.isId)) return true;
+	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
+};
+/**
+* Render statements produced by {@link generatePolicyStatements} back into the
+* exact string the DDL/policies files have always carried: each statement on
+* its own line, terminated by a newline. Keeping the string form derived from
+* the statement array means the two can never drift — the boot-time applier and
+* the generated `policies.sql` emit the same SQL, from the same source.
+*/
+var statementsToDdl = (statements) => statements.map((s) => `${s}\n`).join("");
+/**
+* The `ON DELETE` a foreign key gets when the author did not say.
+*
+* One rule for every property that emits one — `belongsTo` relations and
+* `reference` properties alike. `reference` kept its own `CASCADE` default for
+* a release after this rule was written, which is exactly the split this
+* function exists to prevent: two spellings of the same link, two data-retention
+* behaviours, and only one of them documented.
+*
+* An optional link is `SET NULL`: the column can hold NULL, so dropping the
+* parent leaves the child row with an empty pointer, which is what "optional"
+* already means.
+*
+* A required link is **`RESTRICT`**, not `CASCADE`. `NOT NULL` says the child
+* cannot exist without a parent; it does not say deleting the parent should
+* take the child with it. That second claim is a data-retention decision, and
+* defaulting to it meant `onDelete` — a field nobody has to write — silently
+* turned every `DELETE FROM authors` into a cascade through posts, comments and
+* anything else that hung off them. `RESTRICT` fails the delete instead and
+* names the constraint, so the author chooses `cascade` on purpose or clears
+* the children first.
+*
+* Both DDL paths — the `CREATE TABLE` generator and {@link planRelationalColumns},
+* which boot-ensure compares the live database against — call this, so a
+* default that appears in one and not the other cannot make `db push` plan a
+* constraint rewrite on every run.
+*/
+var defaultBelongsToOnDelete = (required) => required ? "RESTRICT" : "SET NULL";
+var generatePolicyDdl = (collection, rule, resolveCollection) => statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
+/**
+* The individual SQL statements a single security rule compiles to: a
+* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+* statement (terminated by `;`, no trailing newline).
+*
+* This is the primitive the boot-time RLS applier runs one statement at a time
+* (the runtime's DB handle speaks the extended query protocol, which forbids
+* multiple commands in one execute), while `db push` writes the joined string.
+*/
+var generatePolicyStatements = (collection, rule, resolveCollection) => {
+	const tableName = getTableName(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	return ops.flatMap((op, opIdx) => {
+		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+	});
+};
+var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const tableName = getTableName(collection);
+	const mode = (rule.mode ?? "permissive").toUpperCase();
+	const operationUpper = operation.toUpperCase();
+	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
+	const needsUsing = operation !== "insert";
+	const needsWithCheck = operation !== "select" && operation !== "delete";
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
+	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
+	if (!usingClause && needsUsing) usingClause = "false";
+	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
+	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
+	if (usingClause) create += ` USING (${usingClause})`;
+	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+	create += ";";
+	return [drop, create];
+};
+/**
+* Single-quote escaping for a SQL string literal (PostgreSQL doubles the
+* quote). Enum labels come straight from user-authored collection config, so a
+* label like `it's` closes the literal early and the whole generated file stops
+* parsing at the `CREATE TYPE`. Lives here rather than next to its other caller
+* because ensure-collection-tables already imports from this module — the
+* reverse would be a cycle.
+*/
+var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
+var getSqlColumnType = (propName, prop, collection, collections) => {
+	switch (prop.type) {
+		case "string": {
+			const stringProp = prop;
+			if (stringProp.enum) {
+				const tableName = getTableName(collection);
+				const colName = resolveColumnName(propName, prop);
+				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
+			}
+			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
+			if (stringProp.columnType === "char") return `CHAR(${resolveStringColumnLength(stringProp)})`;
+			if (stringProp.columnType === "varchar") return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
+			return "TEXT";
+		}
+		case "number": {
+			const numProp = prop;
+			const isId = isIdProperty(propName, prop, collection);
+			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
+			if (numProp.columnType) {
+				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
+				return numProp.columnType.toUpperCase();
+			}
+			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
+		}
+		case "boolean": return "BOOLEAN";
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") return "DATE";
+			if (dateProp.columnType === "time") return "TIME";
+			return "TIMESTAMP WITH TIME ZONE";
+		}
+		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
+		case "geopoint": return "JSONB";
+		case "array": {
+			const arrayProp = prop;
+			let colType = arrayProp.columnType;
+			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
+				const ofProp = arrayProp.of;
+				if (ofProp.type === "string") colType = "text[]";
+				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
+				else if (ofProp.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "json") return "JSON";
+			if (colType === "text[]") return "TEXT[]";
+			if (colType === "integer[]") return "INTEGER[]";
+			if (colType === "boolean[]") return "BOOLEAN[]";
+			if (colType === "numeric[]") return "NUMERIC[]";
+			return "JSONB";
+		}
+		case "vector": return `VECTOR(${prop.dimensions})`;
+		case "binary": return "BYTEA";
+		case "relation": {
+			const refProp = prop;
+			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
+			let targetCollection;
+			try {
+				targetCollection = relation.target();
+			} catch {
+				return "TEXT";
+			}
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		case "reference": {
+			const refProp = prop;
+			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+			if (!targetCollection) return "TEXT";
+			const pkProp = getPrimaryKeyProp(targetCollection);
+			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
+		}
+		default: throw new Error(`No Postgres column type for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getSqlColumnType\` (and to \`getDrizzleColumn\`, which must agree).`);
+	}
+};
+/**
+* Everything a `search` block needs, as a file Rebase applies itself.
+*
+* Search is the one part of the schema Atlas does not own. Two independent
+* reasons, and either alone would be enough:
+*
+* 1. Its free tier refuses to *parse* a desired-state file that so much as
+*    contains a function — "functions and procedures are available to
+*    logged-in users only". A generated `tsvector` column cannot avoid one:
+*    `unaccent` is STABLE and jsonb flattening needs a set-returning function,
+*    so both have to be wrapped in an IMMUTABLE helper to be legal in a
+*    generated column at all.
+* 2. Even with the file accepted, Atlas *wipes* the dev database it diffs
+*    against, so a helper seeded there beforehand is gone by the time the plan
+*    is analysed. There is no hook to reinstate it.
+*
+* So the column, its index and its helpers are excluded from Atlas's view
+* (`searchExcludePatterns`) and applied from here — the same arrangement the
+* RLS policies already use, and for the same underlying reason.
+*
+* Ordered as it must run: extensions, then helpers, then the column whose
+* expression calls them, then the index over that column. Every statement is
+* `IF NOT EXISTS` / `OR REPLACE`, because this is replayed on every push and
+* appended to migrations that run against databases at any stage of their
+* life. Empty when nothing opted in — the caller writes no file then.
+*
+* The dev database Atlas plans against needs none of this. `searchExcludePatterns`
+* removes the search column from the *inspected* state, so the state Atlas
+* replays there never mentions the column and never calls a helper. Seeding the
+* helpers into that database was tried and removed: measured on Atlas 1.2.3, a
+* `schema apply --dry-run` produces byte-identical output seeded or not, and
+* Atlas wipes the dev database before it plans anyway — so a seed could not have
+* helped even where the excludes are missing, which is the case that really does
+* fail with `function public.rebase_search_unaccent(text) does not exist`.
+*/
+var generatePostgresSearchDdl = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const specs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
+	if (specs.length === 0) return "";
+	const extensions = Array.from(new Set(specs.flatMap(searchExtensionStatements)));
+	const helpers = Array.from(new Set(specs.flatMap(searchHelperFunctions)));
+	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n";
+	ddl += "--\n";
+	ddl += "-- Full-text search for the collections declaring a `search` block.\n";
+	ddl += "-- Applied by Rebase, not by Atlas — see generatePostgresSearchDdl.\n\n";
+	extensions.forEach((s) => {
+		ddl += `${s}\n`;
+	});
+	if (extensions.length > 0) ddl += "\n";
+	helpers.forEach((s) => {
+		ddl += `${s}\n\n`;
+	});
+	for (const collection of collections) {
+		const spec = buildSearchColumnSpec(collection);
+		if (!spec) continue;
+		const table = `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${getTableName(collection)}"`;
+		searchStampGuards(spec).forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${searchColumnDefinition(spec)};\n`;
+		const fuzzyDef = fuzzyColumnDefinition(spec);
+		if (fuzzyDef) ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${fuzzyDef};\n`;
+		searchColumnStamps(spec).forEach((s) => {
+			ddl += `${s.sql}\n`;
+		});
+		searchIndexStatements(spec).forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		ddl += "\n";
+	}
+	return ddl;
+};
+/**
+* Glob patterns telling Atlas to leave the search column and its index alone.
+*
+* Without these, a desired state that omits search reads to Atlas as an
+* instruction to drop the column — taking the index and the whole search
+* feature with it on the next push.
+*
+* Fully qualified, `schema.table.object`, matching the include list. The
+* two-part form is what Atlas wants when the connection URL scopes it to one
+* schema and is *silently ignored* otherwise: it reads `posts.search_vector`
+* as a table named `search_vector` in a schema named `posts`, matches nothing,
+* and reports no error for the pattern that never fired.
+*/
+var searchExcludePatterns = (allCollections) => {
+	const patterns = [];
+	for (const collection of relationalCollections(allCollections)) {
+		const spec = buildSearchColumnSpec(collection);
+		if (!spec) continue;
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const table = getTableName(collection);
+		for (const name of searchColumnNames(collection)) patterns.push(`${schema}.${table}.${name}`);
+		for (const index of searchIndexNames(spec)) patterns.push(`${schema}.${table}.${index}`);
+	}
+	return patterns;
+};
+/**
+* Everything a `{ type: "vector" }` property needs, as a file Rebase applies
+* itself.
+*
+* Vector is the second part of the schema Atlas does not own, and it is out for
+* a narrower reason than search: not that Atlas refuses to parse the file, but
+* that it cannot *execute* it. To compute a desired state Atlas materialises
+* `schema.sql` in a dev database, that database is created empty, and Atlas
+* empties it again at the start of every run — so `VECTOR(384)` resolves
+* against a database that structurally cannot have pgvector, and every push
+* dies with `type "vector" does not exist`. Seeding the extension beforehand
+* does not survive the clean (measured: present before the run, gone after),
+* putting `CREATE EXTENSION` in `schema.sql` is refused as an Atlas Pro
+* feature, and `--exclude` alone cannot help because Atlas still parses and
+* applies the whole file.
+*
+* So the column, its ANN indexes and the extension are excluded from Atlas's
+* view ({@link vectorExcludePatterns}) and applied from here — the same
+* arrangement search and the RLS policies already use.
+*
+* `CREATE EXTENSION` appears only when the project's database named `vector` in
+* its `extensions` — see `DatabaseOptions.extensions`. Everything else is
+* emitted either way: a database that already has pgvector installed by hand
+* needs no permission from anyone, and one that does not gets the column
+* refused by Postgres with a message this repo makes name the opt-in.
+*
+* Ordered as it must run: the extension, then the drift guard, then the column
+* whose type needs the extension, then the indexes over that column. Every
+* statement is `IF NOT EXISTS`, because this is replayed on every push and
+* appended to migrations that run against databases at any stage of their life.
+* Empty when no collection declares a vector — the caller writes no file then.
+*/
+var generatePostgresVectorDdl = (allCollections, options = {}) => {
+	const withVectors = relationalCollections(allCollections).filter((c) => buildVectorColumnSpecs(c, resolveColumnName).length > 0);
+	if (withVectors.length === 0) return "";
+	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n";
+	ddl += "--\n";
+	ddl += "-- Vector columns and their ANN indexes, for the collections declaring a\n";
+	ddl += "-- `vector` property. Applied by Rebase, not by Atlas — see\n";
+	ddl += "-- generatePostgresVectorDdl.\n\n";
+	ddl += vectorExtensionDeclared(options.extensions) ? `${vectorExtensionStatement()}\n\n` : `-- pgvector is not installed from here: no database declared it. To let Rebase\n-- install it, add ${VECTOR_EXTENSION_OPT_IN} in config/resources.ts.\n-- Otherwise install it once by hand; the column below needs the type either way.\n\n`;
+	for (const collection of withVectors) {
+		const table = `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${getTableName(collection)}"`;
+		for (const spec of buildVectorColumnSpecs(collection, resolveColumnName)) {
+			ddl += `${vectorDimensionGuard(spec)}\n`;
+			ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${vectorColumnDefinition(spec)};\n`;
+		}
+		const plan = buildVectorIndexPlan(collection, resolveColumnName);
+		vectorIndexStatements(plan).forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		for (const skip of plan.skipped) ddl += `-- No ANN index on "${skip.schema}"."${skip.table}"."${skip.column}": ${skip.reason}\n`;
+		ddl += "\n";
+	}
+	return ddl;
+};
+/**
+* Glob patterns telling Atlas to leave the vector column and its ANN indexes
+* alone.
+*
+* Without these, a desired state that omits the column reads to Atlas as an
+* instruction to drop it, taking the embeddings and the indexes with it on the
+* next push.
+*
+* Fully qualified, `schema.table.object`, for the reason spelled out on
+* {@link searchExcludePatterns}: the two-part form matches nothing and reports
+* no error, which turns a protection into a `DROP COLUMN`.
+*/
+var vectorExcludePatterns = (allCollections) => {
+	const patterns = [];
+	for (const collection of relationalCollections(allCollections)) {
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const table = getTableName(collection);
+		for (const name of vectorObjectNames(collection, resolveColumnName)) patterns.push(`${schema}.${table}.${name}`);
+	}
+	return patterns;
+};
+var generatePostgresDdl = async (allCollections, options = {
+	includePolicies: true,
+	includeSearch: true,
+	includeVector: true
+}) => {
+	const collections = relationalCollections(allCollections);
+	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n\n";
+	const uniqueSchemas = Array.from(/* @__PURE__ */ new Set([REBASE_SCHEMA, ...collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)]));
+	uniqueSchemas.forEach((schema) => {
+		if (schema) ddl += `CREATE SCHEMA IF NOT EXISTS "${schema}";\n`;
+	});
+	if (uniqueSchemas.length > 0) ddl += "\n";
+	const searchSpecs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
+	if (searchSpecs.length > 0) if (options.includeSearch === false) ddl += "-- Full-text search support lives in `search.sql`, applied separately.\n\n";
+	else {
+		const extensions = Array.from(new Set(searchSpecs.flatMap(searchExtensionStatements)));
+		const helpers = Array.from(new Set(searchSpecs.flatMap(searchHelperFunctions)));
+		ddl += "-- Full-text search support (collections declaring a `search` block)\n";
+		extensions.forEach((s) => {
+			ddl += `${s}\n`;
+		});
+		if (extensions.length > 0) ddl += "\n";
+		helpers.forEach((s) => {
+			ddl += `${s}\n\n`;
+		});
+	}
+	if (options.includeVector === false && collections.some((c) => buildVectorColumnSpecs(c, resolveColumnName).length > 0)) ddl += "-- Vector columns and their ANN indexes live in `vector.sql`, applied separately.\n\n";
+	const emittedEnums = /* @__PURE__ */ new Set();
+	collections.forEach((collection) => {
+		const collectionTable = getTableName(collection);
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
+				const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;
+				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
+				if (values.length > 0 && !emittedEnums.has(`${schema}.${enumDbName}`)) {
+					emittedEnums.add(`${schema}.${enumDbName}`);
+					ddl += `CREATE TYPE "${schema}"."${enumDbName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});\n`;
+				}
+			}
+		});
+	});
+	if (ddl.endsWith(";\n")) ddl += "\n";
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	const allTablesToGenerate = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (tableName) allTablesToGenerate.set(tableName, { collection });
+		const resolvedRelations = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
+			const junctionTableName = relation.through.table;
+			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
+				collection: {
+					table: junctionTableName,
+					properties: {}
+				},
+				isJunction: true,
+				relation,
+				sourceCollection: collection
+			});
+		}
+	}
+	const fkStatements = [];
+	const indexStatements = [];
+	const policyStatements = [];
+	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
+			const targetCollection = relation.target();
+			const sourceTable = getTableName(sourceCollection);
+			const targetTable = getTableName(targetCollection);
+			const sourceSchema = isPostgresCollectionConfig(sourceCollection) && sourceCollection.schema ? sourceCollection.schema : "public";
+			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+			const { sourceColumn, targetColumn } = relation.through;
+			const sourceColType = isNumericId(sourceCollection) ? "INTEGER" : getPrimaryKeyProp(sourceCollection).isUuid ? "UUID" : "TEXT";
+			const targetColType = isNumericId(targetCollection) ? "INTEGER" : getPrimaryKeyProp(targetCollection).isUuid ? "UUID" : "TEXT";
+			const sourceId = getPrimaryKeyName(sourceCollection);
+			const targetId = getPrimaryKeyName(targetCollection);
+			const onDelete = relation.onDelete ?? "CASCADE";
+			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
+			ddl += `  "${sourceColumn}" ${sourceColType} NOT NULL,\n`;
+			ddl += `  "${targetColumn}" ${targetColType} NOT NULL,\n`;
+			ddl += `  PRIMARY KEY ("${sourceColumn}", "${targetColumn}")\n`;
+			ddl += `);\n\n`;
+			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${sourceColumn}_fkey`)}" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
+			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${targetColumn}_fkey`)}" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+			if (options.includePolicies) {
+				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+				ddl += `\n`;
+				const spec = junctionSpecs.get(baseTableName);
+				if (spec) {
+					const junctionCollection = getJunctionCollectionConfig(spec);
+					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+					getJunctionSecurityRules(spec).forEach((rule) => {
+						policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
+					});
+				}
+			}
+		} else if (!isJunction) {
+			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
+			const columns = [];
+			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
+				if (prop.type === "vector" && options.includeVector === false) return;
+				if (prop.type === "relation") {
+					const refProp = prop;
+					const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+					if (relInfo?.kind !== "belongsTo") return;
+					if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) return;
+					let targetCollection;
+					try {
+						targetCollection = relInfo.target();
+					} catch {
+						return;
+					}
+					const targetTable = getTableName(targetCollection);
+					const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+					const targetId = getPrimaryKeyName(targetCollection);
+					const fkColType = getSqlColumnType(propName, prop, collection, collections);
+					const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : "";
+					const required = prop.validation?.required;
+					const onDeleteVal = relInfo.onDelete ?? defaultBelongsToOnDelete(required);
+					let colDef = `  "${relInfo.localKey}" ${fkColType}`;
+					if (required) colDef += " NOT NULL";
+					columns.push(colDef);
+					fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${relInfo.localKey}_fkey`)}" FOREIGN KEY ("${relInfo.localKey}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);
+				} else if (prop.type === "reference") {
+					const refProp = prop;
+					const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+					const colName = resolveColumnName(propName, prop);
+					const colType = getSqlColumnType(propName, prop, collection, collections);
+					const required = prop.validation?.required;
+					if (!targetCollection) {
+						let colDef = `  "${colName}" ${colType}`;
+						if (required) colDef += " NOT NULL";
+						columns.push(colDef);
+					} else {
+						const targetTable = getTableName(targetCollection);
+						const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+						const targetId = getPrimaryKeyName(targetCollection);
+						const onDelete = defaultBelongsToOnDelete(required);
+						let colDef = `  "${colName}" ${colType}`;
+						if (required) colDef += " NOT NULL";
+						columns.push(colDef);
+						fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${colName}_fkey`)}" FOREIGN KEY ("${colName}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+					}
+				} else {
+					const colName = resolveColumnName(propName, prop);
+					const authDefinition = isAuthCollection(collection) ? authUsersColumnDefinition(colName) : void 0;
+					if (authDefinition && !isIdProperty(propName, prop, collection)) {
+						columns.push(`  "${colName}" ${authDefinition}`);
+						return;
+					}
+					let colDef = `  "${colName}" ${getSqlColumnType(propName, prop, collection, collections)}`;
+					if (isIdProperty(propName, prop, collection)) colDef += " PRIMARY KEY";
+					if ("isId" in prop && prop.isId !== "manual" && prop.isId !== true && prop.isId !== "increment") {
+						if (prop.isId === "uuid") colDef += " DEFAULT gen_random_uuid()";
+						else if (prop.isId === "cuid") colDef += " DEFAULT cuid()";
+						else if (typeof prop.isId === "string") colDef += ` DEFAULT ${prop.isId}`;
+					}
+					if (!isIdProperty(propName, prop, collection) && prop.validation?.unique) colDef += " UNIQUE";
+					if (prop.type === "date") {
+						const dateProp = prop;
+						if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") colDef += " DEFAULT now()";
+					}
+					if (prop.validation?.required && !colDef.includes("PRIMARY KEY")) colDef += " NOT NULL";
+					columns.push(colDef);
+				}
+			});
+			if (isAuthCollection(collection)) {
+				const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
+				for (const spec of AUTH_USERS_COLUMNS) {
+					if (declared.has(spec.column)) continue;
+					columns.push(`  "${spec.column}" ${authUsersColumnSql(spec)}`);
+				}
+			}
+			const searchSpec = options.includeSearch === false ? void 0 : buildSearchColumnSpec(collection);
+			if (searchSpec) {
+				columns.push(`  ${searchColumnDefinition(searchSpec)}`);
+				const fuzzyDef = fuzzyColumnDefinition(searchSpec);
+				if (fuzzyDef) columns.push(`  ${fuzzyDef}`);
+				indexStatements.push(...searchIndexStatements(searchSpec));
+			}
+			if (options.includeVector !== false) {
+				const vectorPlan = buildVectorIndexPlan(collection, resolveColumnName);
+				indexStatements.push(...vectorIndexStatements(vectorPlan));
+				for (const skip of vectorPlan.skipped) indexStatements.push(`-- No ANN index on "${skip.schema}"."${skip.table}"."${skip.column}": ${skip.reason}`);
+			}
+			indexStatements.push(...collectionIndexStatements(buildCollectionIndexSpecs(collection, resolveColumnName)));
+			if (!columns.some((c) => c.includes("PRIMARY KEY"))) columns.unshift("  \"id\" TEXT PRIMARY KEY");
+			ddl += columns.join(",\n");
+			ddl += `\n);\n\n`;
+			if (options.includePolicies) {
+				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+				ddl += `\n`;
+				const securityRules = getEffectiveSecurityRules(collection);
+				if (securityRules.length > 0) {
+					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+					securityRules.forEach((rule) => {
+						policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
+					});
+				}
+			}
+		}
+	}
+	if (indexStatements.length > 0) {
+		ddl += "-- Indexes\n";
+		ddl += indexStatements.join("\n") + "\n\n";
+	}
+	if (fkStatements.length > 0) {
+		ddl += "-- Foreign Key Constraints\n";
+		ddl += fkStatements.join("\n") + "\n\n";
+	}
+	if (policyStatements.length > 0) {
+		ddl += "-- Row Level Security Policies\n";
+		ddl += policyStatements.join("");
+		ddl += "\n";
+	}
+	return ddl;
+};
+var schemaOfCollection = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
+/**
+* Truncate a derived identifier the way Postgres does: to 63 bytes, silently.
+*
+* This is not cosmetic, and not really a naming choice at all — it is agreeing
+* with the name the database ALREADY stored. `ADD CONSTRAINT` on a longer name
+* succeeds and records the truncated form, so the untruncated name this used to
+* derive matched nothing in the catalogue. Boot-ensure compares its planned
+* constraints against `readExistingSchema`, which reads catalogue names, so the
+* comparison could never hit: every boot re-issued `ADD CONSTRAINT` for the same
+* constraint, forever, and got "already exists" every time. Non-fatal (foreign
+* keys are the one action allowed to fail) and therefore permanent — an error in
+* the log on every restart of a project whose table and column names happened to
+* be long.
+*
+* Byte length, not string length: NAMEDATALEN is 64 bytes, and a multi-byte
+* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
+*/
+var foreignKeyPlan = (args) => {
+	const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
+	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
+	return {
+		constraintName,
+		schema: args.schema,
+		table: args.table,
+		column: args.column,
+		targetSchema: args.targetSchema,
+		targetTable: args.targetTable,
+		targetColumn: args.targetColumn,
+		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
+	};
+};
+/**
+* The FK columns the declared collections own — one entry per `relation`
+* (`belongsTo` side) or `reference` property.
+*
+* Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+* create the same columns with the same names, types and constraints. Before
+* this it skipped them outright, which was survivable only because `db push`
+* always followed; on a managed tenant nothing follows, so a table arrived
+* without the column its own collection reads and wrote 400 on every insert.
+*
+* A relation whose target is not in the bundle yields no column at all (the
+* generator returns early on an unresolvable target); a `reference` whose target
+* is unknown yields the column without a constraint. Both mirror the generator
+* exactly — a divergence here is a schema fork between boot and `db push`.
+*/
+var planRelationalColumns = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const plans = [];
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = schemaOfCollection(collection);
+		const table = bareTableName(tableName);
+		for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
+			const prop = rawProp;
+			if (prop.type === "relation") {
+				const refProp = prop;
+				const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
+				if (relInfo?.kind !== "belongsTo") continue;
+				if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
+				let targetCollection;
+				try {
+					targetCollection = relInfo.target();
+				} catch {
+					continue;
+				}
+				if (!targetCollection) continue;
+				const required = prop.validation?.required;
+				const relationName = refProp.relation?.relationName ?? propName;
+				const legacyKey = legacyForeignKeyName(relationName);
+				const derived = relInfo.localKey === generateForeignKeyName(relationName);
+				plans.push({
+					schema,
+					table,
+					column: relInfo.localKey,
+					legacyColumn: derived && legacyKey !== relInfo.localKey ? legacyKey : void 0,
+					type: getSqlColumnType(propName, prop, collection, collections),
+					foreignKey: foreignKeyPlan({
+						schema,
+						table,
+						column: relInfo.localKey,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: relInfo.onDelete ?? defaultBelongsToOnDelete(required),
+						onUpdate: relInfo.onUpdate
+					})
+				});
+			} else if (prop.type === "reference") {
+				const refProp = prop;
+				const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
+				const column = resolveColumnName(propName, prop);
+				const type = getSqlColumnType(propName, prop, collection, collections);
+				const required = prop.validation?.required;
+				plans.push({
+					schema,
+					table,
+					column,
+					type,
+					foreignKey: targetCollection ? foreignKeyPlan({
+						schema,
+						table,
+						column,
+						targetSchema: schemaOfCollection(targetCollection),
+						targetTable: bareTableName(getTableName(targetCollection)),
+						targetColumn: getPrimaryKeyName(targetCollection),
+						onDelete: defaultBelongsToOnDelete(required)
+					}) : void 0
+				});
+			}
+		}
+	}
+	return plans;
+};
+/**
+* The junction tables a bundle's many-to-many relations imply.
+*
+* Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+* comes from, so a table created here always has policies planned for it — a
+* junction with row-level security left off is readable and writable by every
+* signed-in user, which is why the two must ship together.
+*/
+var planJunctionTables = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const plans = [];
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const [source, target] = spec.endpoints;
+		const legacyFor = (endpoint) => {
+			const slug = toSnakeCase(endpoint.collection.slug ?? endpoint.collection.name ?? "");
+			const legacy = legacyForeignKeyName(slug);
+			return endpoint.junctionColumn === generateForeignKeyName(slug) && legacy !== endpoint.junctionColumn ? legacy : void 0;
+		};
+		const columns = [{
+			name: source.junctionColumn,
+			type: junctionKeyType(source.collection),
+			legacyName: legacyFor(source)
+		}, {
+			name: target.junctionColumn,
+			type: junctionKeyType(target.collection),
+			legacyName: legacyFor(target)
+		}];
+		const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			columns,
+			createTable: `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` + columns.map((c) => `"${c.name}" ${c.type} NOT NULL`).join(", ") + `, PRIMARY KEY (${columns.map((c) => `"${c.name}"`).join(", ")}));`,
+			foreignKeys: [source, target].map((endpoint, i) => foreignKeyPlan({
+				schema: spec.schema,
+				table: spec.table,
+				column: columns[i].name,
+				targetSchema: schemaOfCollection(endpoint.collection),
+				targetTable: bareTableName(getTableName(endpoint.collection)),
+				targetColumn: getPrimaryKeyName(endpoint.collection),
+				onDelete
+			}))
+		});
+	}
+	return plans;
+};
+/**
+* The per-table RLS plan for the *declared* collections, as executable
+* statements — what the managed runtime applies at boot so a freshly
+* provisioned tenant database serves data instead of 401ing every read.
+*
+* Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+* `generatePolicyStatements`, same enable-RLS, same effective rules, same
+* derived junction rules), so boot and `db push` produce identical policies from
+* identical collections.
+*
+* Junction tables are included, and have to be: boot creates them now
+* ({@link planJunctionTables}), and a junction with RLS left off is readable and
+* writable by every signed-in user. A junction whose table is still absent is
+* skipped by the applier, not planned away here.
+*/
+var planCollectionPolicies = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const plans = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (!tableName) continue;
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		const qualified = `${schema}.${baseTableName}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const policyStatements = [];
+		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+		plans.push({
+			schema,
+			table: baseTableName,
+			qualified,
+			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	for (const spec of resolveJunctionSpecs(collections).values()) {
+		const qualified = `${spec.schema}.${spec.table}`;
+		if (seen.has(qualified)) continue;
+		seen.add(qualified);
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const policyStatements = [];
+		for (const rule of getJunctionSecurityRules(spec)) policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
+		plans.push({
+			schema: spec.schema,
+			table: spec.table,
+			qualified,
+			enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
+			policyStatements
+		});
+	}
+	return plans;
+};
+var generatePostgresPoliciesDdl = (allCollections) => {
+	const collections = relationalCollections(allCollections);
+	let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
+	const allTablesToGenerate = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (tableName) allTablesToGenerate.set(tableName, { collection });
+	}
+	for (const [tableName, { collection }] of allTablesToGenerate.entries()) {
+		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
+		ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+		ddl += `\n`;
+		const securityRules = getEffectiveSecurityRules(collection);
+		if (securityRules.length > 0) {
+			const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+			const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
+			securityRules.forEach((rule) => {
+				if (rule.name && injectedNames.has(rule.name)) {
+					ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
+					ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
+				}
+				ddl += generatePolicyDdl(collection, rule, resolveCollection);
+			});
+			ddl += "\n";
+		}
+	}
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	for (const spec of junctionSpecs.values()) {
+		ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
+		ddl += `\n`;
+		const junctionRules = getJunctionSecurityRules(spec);
+		if (junctionRules.length === 0) continue;
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+		const declaringSlugs = spec.declaringSides.map((s) => s.collection.slug).join("\", \"");
+		ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
+		ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
+		ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
+		ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
+		junctionRules.forEach((rule) => {
+			ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
+		});
+		ddl += "\n";
+	}
+	return ddl;
+};
+//#endregion
+export { searchIndexStatements as C, searchHelperFunctions as S, assertSearchIsPostgresOnly as _, generatePostgresVectorDdl as a, searchColumnStamps as b, isIdProperty as c, planRelationalColumns as d, quoteSqlLiteral as f, SEARCH_UNACCENT_FN as g, SEARCH_TEXT_FN as h, generatePostgresSearchDdl as i, planCollectionPolicies as l, SEARCH_STAMP_PREFIX as m, generatePostgresDdl as n, generate_postgres_ddl_logic_exports as o, resolveColumnName as p, generatePostgresPoliciesDdl as r, getSqlColumnType as s, defaultBelongsToOnDelete as t, planJunctionTables as u, buildSearchColumnSpec as v, visibleColumnProjection as w, searchExtensionStatements as x, hiddenColumnsOption as y };
+
+//# sourceMappingURL=generate-postgres-ddl-logic-CtnpIBVv.js.map