@rebasepro/server-postgres 0.19.1 → 0.19.2-canary.g08eed46

package/dist/plan-schema-Hgl62S-w.js

@@ -0,0 +1,1531 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { a as getPrimaryKeyName, c as isIdProperty, i as enumLabelsOf, l as resolveColumnName, o as getPrimaryKeyProp, r as declaresEnumType, s as idColumnDefault, t as assertSinglePrimaryKey } from "./column-plan-helpers-CpILzHJS.js";
+import { i as isAuthCollection, n as authUsersColumnDefinition, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
+import { c as vectorExtensionStatement, n as buildVectorColumnSpecs, o as vectorExtensionDeclared, r as buildVectorIndexPlan } from "./vector-index-CMJKb3C9.js";
+import { a as deriveIndexName, t as buildCollectionIndexSpecs } from "./collection-index-DdnsxiJ_.js";
+import { DEFAULT_FUZZY_THRESHOLD, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_WEIGHT, REBASE_SCHEMA, hasForeignKeyOnTarget, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
+import { TENANT_INDEX_REASON, fieldKeyForColumn, findRelation, getEffectiveSecurityRules, getEnumVarName, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getTableName, getTableVarName, getTenantConfig, policyToPostgres, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, resolveStringColumnLength, securityRuleToConditions } from "@rebasepro/common";
+import { generateForeignKeyName, getPolicyNamesForRule, legacyForeignKeyName, toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "node:crypto";
+//#region src/schema/search-column.ts
+/**
+* The one place a collection's `search` block becomes SQL.
+*
+* Four things describe a Postgres table in this codebase — the DDL generator,
+* the Drizzle schema generator, the runtime table builder for BaaS mode, and
+* the boot-time schema ensure — and each of them has, at some point, described
+* a column differently from the others. The `varchar(255)` note in
+* `generate-postgres-ddl-logic` is one such scar: the same property produced a
+* capped column down one path and an uncapped one down the other, and nothing
+* failed until a user hit the cap.
+*
+* So the search column is not implemented four times. It is computed once,
+* here, and every generator renders the same {@link SearchColumnSpec}. There is
+* a test asserting exactly that (`search-column-contract.test.ts`); the point of
+* this module is that the test has something to assert *about*.
+*
+* ## Why the expressions look the way they do
+*
+* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
+* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
+*
+* | expression                              | immutable |
+* |-----------------------------------------|-----------|
+* | `to_tsvector('spanish', col)`           | yes       |
+* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
+* | `array_to_string(col, ' ')`             | **no**    |
+* | `col::text` on `text[]`                 | **no**    |
+* | `to_jsonb(col)`                         | **no**    |
+* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
+* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
+* | `setweight(...) || setweight(...)`      | yes       |
+*
+* Three of the four things a real search column needs are therefore unavailable
+* directly, which is why {@link searchHelperFunctions} exists: each wraps a
+* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
+* promise, and it is a true one for these three — array joining, JSON string
+* extraction and accent folding are all deterministic for a given input; the
+* built-ins are marked stable only because they must account for element types
+* and dictionaries in general.
+*
+* The alternative was to skip `unaccent` and text arrays entirely. That is not
+* a real option in an accented language: Postgres stems `auditoría` to
+* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
+* typed without accents misses every row that carries them.
+*/
+/** Schema-qualified so a collection outside `public` still resolves them. */
+var HELPER_SCHEMA = "public";
+/**
+* Names of the helper functions. Frozen: they are recorded in the stored
+* generation expression of every search column ever created, so renaming one
+* orphans every table that already has a search column.
+*/
+var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
+var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
+/** Raised when a `search` block names something that cannot be searched. */
+var SearchConfigError = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "SearchConfigError";
+	}
+};
+/** The `search` block of a collection, or undefined when it has none. */
+var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
+/**
+* Refuse a `search` block on a collection this engine does not store.
+*
+* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
+* already stops the ordinary case. This catches the rest — a JS config, a cast,
+* a collection whose `engine` was changed after the block was written — because
+* the alternative is the exact failure the block exists to prevent: a developer
+* who declared what to index, saw no error, and got the substring fallback.
+*
+* Called with *every* collection, before the Postgres ones are filtered out.
+*/
+var assertSearchIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.search) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
+	}
+};
+var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
+/**
+* Classify a property for search purposes.
+*
+* Deliberately narrower than the schema plan's `PgType`: search only cares
+* whether a value reaches text, and the mapping from property to *physical*
+* type is asserted against the plan in the contract test rather than duplicated
+* here.
+*
+* Returns null for anything that is not text-bearing, which the caller turns
+* into a boot error naming the property.
+*/
+var classify = (prop) => {
+	switch (prop.type) {
+		case "string": {
+			const sp = prop;
+			if (sp.enum) return {
+				kind: "text",
+				reason: "enum"
+			};
+			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
+				kind: "text",
+				reason: "uuid"
+			};
+			return { kind: "text" };
+		}
+		case "map":
+			if (prop.columnType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			return { kind: "jsonb" };
+		case "array": {
+			const ap = prop;
+			let colType = ap.columnType;
+			if (!colType && ap.of && !Array.isArray(ap.of)) {
+				const of = ap.of;
+				if (of.type === "string") colType = "text[]";
+				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
+				else if (of.type === "boolean") colType = "boolean[]";
+			}
+			if (colType === "text[]") return { kind: "text_array" };
+			if (colType === "json") return {
+				kind: "jsonb",
+				reason: "json"
+			};
+			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
+				kind: "text_array",
+				reason: "non_text_array"
+			};
+			return { kind: "jsonb" };
+		}
+		default: return null;
+	}
+};
+var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
+/** SQL reading one field as plain text, before normalization. */
+var rawTextSql = (field) => {
+	const col = `"${field.column}"`;
+	if (field.kind === "text") return `coalesce(${col}, '')`;
+	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
+	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
+};
+var quote = (v) => `'${v.replace(/'/g, "''")}'`;
+/**
+* Resolve and validate one declared field path.
+*
+* A path that does not resolve throws. The whole point of an explicit block is
+* that the author knows what is indexed; a silently dropped field would make it
+* a guess again, and the failure — a search that returns nothing for content
+* that is plainly in the row — is invisible from the outside.
+*/
+var resolveField = (entry, collection, cfg) => {
+	const path = typeof entry === "string" ? entry : entry.path;
+	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? DEFAULT_SEARCH_WEIGHT;
+	const where = `${collection.slug}.search`;
+	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
+	const [head, ...rest] = path.split(".");
+	const prop = collection.properties?.[head];
+	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
+	const classified = classify(prop);
+	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
+	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
+	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
+	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
+	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
+	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
+	const column = columnNameOf(head, prop);
+	const textSql = normalize(rawTextSql({
+		column,
+		jsonPath: rest,
+		kind: classified.kind
+	}), cfg.unaccent === true);
+	const language = cfg.language ?? DEFAULT_SEARCH_LANGUAGE;
+	return {
+		path,
+		column,
+		jsonPath: rest,
+		kind: classified.kind,
+		weight,
+		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
+		textSql
+	};
+};
+/**
+* Build the full spec for a collection, or undefined when it has not opted in.
+*
+* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
+* at boot surface that as a startup failure — a search block that half-works is
+* worse than one that refuses.
+*/
+var buildSearchColumnSpec = (collection) => {
+	const cfg = getSearchConfig(collection);
+	if (!cfg) return void 0;
+	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
+	const table = getTableName(collection);
+	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+	const column = cfg.column ?? DEFAULT_SEARCH_COLUMN;
+	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
+	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
+	const seen = /* @__PURE__ */ new Set();
+	for (const f of fields) {
+		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
+		seen.add(f.path);
+	}
+	const extensions = [];
+	if (cfg.unaccent) extensions.push("unaccent");
+	if (cfg.fuzzy) extensions.push("pg_trgm");
+	const spec = {
+		schema,
+		table,
+		column,
+		language: cfg.language ?? DEFAULT_SEARCH_LANGUAGE,
+		unaccent: cfg.unaccent === true,
+		fields,
+		expression: fields.map((f) => f.sql).join(" || "),
+		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
+		extensions
+	};
+	if (cfg.fuzzy) {
+		const fuzzyColumn = `${column}_text`;
+		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
+		spec.fuzzy = {
+			column: fuzzyColumn,
+			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
+			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
+			threshold: cfg.fuzzyThreshold ?? DEFAULT_FUZZY_THRESHOLD
+		};
+	}
+	return spec;
+};
+/**
+* The IMMUTABLE wrappers the generated expressions call.
+*
+* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
+* than an error, and idempotent for the same reason every other boot-time DDL
+* statement here is.
+*
+* The bodies are stable built-ins wrapped in an immutable promise — see the
+* module comment for why that promise is sound. `STRICT` matters: it makes NULL
+* in mean NULL out without executing the body, which is what the `coalesce` at
+* each call site then absorbs.
+*/
+var searchHelperFunctions = (spec) => {
+	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
+	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
+	return statements;
+};
+/**
+* `CREATE EXTENSION` statements the spec's expressions depend on.
+*
+* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
+* `CREATE EXTENSION` installs into the first schema on `search_path`, which
+* defaults to `"$user", public` — and the scaffold's database role is named
+* `rebase`, the same as the schema the generator creates one statement earlier.
+* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
+* dictionary in `rebase`, and every reference to `public.unaccent` below fails
+* with "text search dictionary does not exist". Observed, not theorised.
+*/
+var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
+/**
+* Everything after the column name — the type and the generation expression.
+*
+* Split out because four emitters need it and only two of them have a place to
+* put the name: `CREATE TABLE` and `ADD COLUMN` write `"col" <this>`, while the
+* schema plan carries it as the column's SQL definition and the boot-time
+* rebuild statement interpolates it on its own.
+*/
+var searchColumnTypeSql = (expression, kind) => `${kind} GENERATED ALWAYS AS (${expression}) STORED`;
+/** The column definition as it appears inside `CREATE TABLE`. */
+var searchColumnDefinition = (spec) => `"${spec.column}" ${searchColumnTypeSql(spec.expression, "tsvector")}`;
+/** The fuzzy column definition, when the spec asks for one. */
+var fuzzyColumnDefinition = (spec) => spec.fuzzy ? `"${spec.fuzzy.column}" ${searchColumnTypeSql(spec.fuzzy.expression, "text")}` : void 0;
+/**
+* Index statements for the spec.
+*
+* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
+* SQL file replayed as one unit — a migration, or `search.sql` — where a
+* concurrent build is not allowed. The boot-time ensure path runs statement by
+* statement against tables that are live and populated, and uses the
+* concurrent form instead; see `ensureSearchColumns`.
+*/
+var searchIndexStatements = (spec) => {
+	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
+	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
+	return statements;
+};
+/**
+* Marker on the comment of every generated search column this module creates.
+*
+* Versioned because the fingerprint below is only comparable against itself: a
+* future change to how it is computed has to read as "not stamped by this
+* version" rather than as drift on every existing column.
+*/
+var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
+/**
+* A stable fingerprint of one generated column's expression.
+*
+* Why a stamp rather than reading the expression back: Postgres stores a
+* generated column's expression *parsed*, and hands it back deparsed — casts
+* made explicit, identifiers requoted, schema qualifications added or dropped
+* according to `search_path`. Comparing that text to the text we generated
+* would report drift on wording, and this comparison decides whether a boot
+* refuses, so a false positive is an outage. The stamp is written by the same
+* code that writes the column, so equality means what it says.
+*/
+var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
+/**
+* The stamps for a spec's generated columns — one per column, never shared.
+*
+* Per column on purpose: turning `fuzzy` on adds a second column and changes
+* nothing about the first, and a spec-wide fingerprint would report the
+* untouched `tsvector` column as drifted and refuse a boot over a change that
+* is purely additive.
+*/
+var searchColumnStamps = (spec) => {
+	const stamp = (column, expression) => {
+		const fingerprint = searchExpressionFingerprint(expression);
+		return {
+			column,
+			expression,
+			fingerprint,
+			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
+		};
+	};
+	const stamps = [stamp(spec.column, spec.expression)];
+	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
+	return stamps;
+};
+/**
+* The same drift check as the boot ensure, for the SQL file.
+*
+* Needed because {@link searchColumnStamps} would otherwise *launder* drift on
+* the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
+* exists, so a re-generated `search.sql` would stamp a stale column with the
+* new block's fingerprint and the next boot would find them in agreement.
+* Guarding first means the file refuses instead — `rebase db push` is attended,
+* and the operator reading the failure is the person who changed the block.
+*/
+var searchStampGuards = (spec) => searchColumnStamps(spec).map((stamp) => {
+	const relation = quote(`"${spec.schema}"."${spec.table}"`);
+	return `DO $rebase_search$
+DECLARE recorded text;
+BEGIN
+    SELECT col_description(a.attrelid, a.attnum) INTO recorded
+    FROM pg_attribute a
+    WHERE a.attrelid = ${relation}::regclass AND a.attname = ${quote(stamp.column)} AND NOT a.attisdropped;
+    IF recorded LIKE ${quote(`${SEARCH_STAMP_PREFIX}%`)} AND recorded <> ${quote(stamp.fingerprint)} THEN
+        RAISE EXCEPTION 'Rebase: the search block for ${spec.schema}.${spec.table} changed after the generated column "${stamp.column}" was built (recorded %, expected ${stamp.fingerprint}). Postgres cannot alter a generated expression in place. Drop the column and re-apply this file — it rewrites the table and rebuilds the index: ALTER TABLE ${relation.slice(1, -1)} DROP COLUMN "${stamp.column}";', recorded;
+    END IF;
+END
+$rebase_search$;`;
+});
+/**
+* The index names the spec creates.
+*
+* Needed by name, not just by statement, so Atlas can be told to exclude them
+* from its diff — see `searchExcludePatterns`.
+*/
+var searchIndexNames = (spec) => spec.fuzzy ? [spec.indexName, spec.fuzzy.indexName] : [spec.indexName];
+/**
+* The generated column names a collection's search block adds, if any.
+*
+* These are physical columns on the table, so `SELECT *` returns them. They are
+* an index in column form — a list of lexeme positions, or a concatenation of
+* every searchable field on the row — and nothing outside the query planner has
+* any use for them. Left in, every list response carries a second, larger copy
+* of the row's text.
+*/
+var searchColumnNames = (collection) => {
+	let spec;
+	try {
+		spec = buildSearchColumnSpec(collection);
+	} catch {
+		return [];
+	}
+	if (!spec) return [];
+	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
+};
+/**
+* True for a column whose type only ever holds a search index.
+*
+* Independent of any collection config on purpose: an introspected database
+* (BaaS mode) can carry a `tsvector` column this framework never created —
+* Pagila's `film.fulltext` is the canonical one — and it should not be returned
+* to callers either. `isDerivedIndexColumn` already keeps such a column out of
+* the *properties*; this keeps it out of the *rows*.
+*/
+var isSearchIndexColumn = (column) => {
+	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
+	return sqlType === "tsvector" || sqlType === "tsquery";
+};
+/**
+* A drizzle select projection over `table` with the search columns dropped.
+*
+* Returns undefined when nothing needs dropping, so the common case keeps using
+* a plain `select()` and this stays invisible in the generated SQL.
+*/
+var visibleColumnProjection = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (!tableColumns || excluded.length === 0) return void 0;
+	const projection = {};
+	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
+	return projection;
+};
+/** The same exclusion as a drizzle `db.query` `columns` denylist. */
+var hiddenColumnsOption = (tableColumns, collection) => {
+	const excluded = excludedColumnNames(tableColumns, collection);
+	if (excluded.length === 0) return void 0;
+	return Object.fromEntries(excluded.map((name) => [name, false]));
+};
+/**
+* The columns to keep out of a response, by name.
+*
+* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
+* for anything that is not a real drizzle table — a stub in a test, a derived
+* or nested path with no table behind it. Nothing to exclude is the right
+* answer there, and it has to be an answer rather than a throw: this runs on
+* the read path of every collection, opted in or not.
+*/
+var excludedColumnNames = (tableColumns, collection) => {
+	if (!tableColumns || typeof tableColumns !== "object") return [];
+	const byName = new Set(collection ? searchColumnNames(collection) : []);
+	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
+};
+//#endregion
+//#region src/schema/relation-names.ts
+/**
+* The `relationName` both sides of a link must agree on.
+*
+* Drizzle pairs an owning `one()` with its inverse `many()` by this string and
+* by nothing else, and the two sides are computed by different callers holding
+* different collections — so the rule has to be derivable from either end. It
+* is: name the link after the table that carries the foreign key and the field
+* key that column is served under.
+*
+*   owning  (belongsTo)      → `{thisTable}_{fieldKey(localKey)}`
+*   inverse (hasMany/hasOne) → `{targetTable}_{fieldKey(foreignKeyOnTarget)}`
+*
+* Both spellings of `jobs.company` produce `jobs_companyId`. A many-to-many is
+* named through its junction wiring and a `via` chain is not a Drizzle relation
+* at all, so both keep the local name.
+*
+* The field key rather than the column: the Drizzle object is keyed by the wire
+* name (`fieldKeyForColumn` is the one definition of it), and a name built from
+* the column would differ between a collection that declares `columnName` and
+* one that does not, for the same link.
+*
+* **This is the one definition.** `generate-drizzle-schema-logic.ts` holds a
+* private copy (`computeSharedRelationName`) that this was lifted from verbatim;
+* the generator should import this instead, so the file it writes and the
+* relations the runtime builds from the live catalogue cannot drift apart.
+*/
+function sharedRelationName(relation, sourceCollection) {
+	const fallback = () => {
+		if (relation.relationName) return relation.relationName;
+		try {
+			return toSnakeCase(relation.target().slug);
+		} catch {
+			return relation.relationName;
+		}
+	};
+	if (relation.kind === "belongsTo") return `${getTableName(sourceCollection)}_${fieldKeyForColumn(sourceCollection, relation.localKey)}`;
+	if (relation.kind === "hasMany" || relation.kind === "hasOne") try {
+		const target = relation.target();
+		return `${getTableName(target)}_${fieldKeyForColumn(target, relation.foreignKeyOnTarget)}`;
+	} catch {
+		return fallback();
+	}
+	return fallback();
+}
+//#endregion
+//#region src/schema/plan/updated-at-trigger.ts
+/**
+* `autoValue: "on_update"`, as a database trigger.
+*
+* ## Why a trigger and not only the driver
+*
+* The driver stamps `updated_at` on every write it makes, and it has to keep
+* doing so: a `beforeSave` hook reads the row it is about to persist, and a
+* value that only appears once Postgres has written it is a value the hook
+* cannot see.
+*
+* But the driver is not the only writer. A seed script, a migration backfill, a
+* `psql` session, an admin fixing one row by hand — every one of those leaves
+* `updated_at` at whatever it was, and the column then says the row has not
+* changed since a date that is simply wrong. Anything reading it to decide what
+* to re-index, re-sync or re-send skips the row. The declaration says "this
+* column tracks the last write"; only the database can make that true.
+*
+* So both: the app stamps so hooks see the value, and a `BEFORE UPDATE` trigger
+* stamps so every other writer does too. They agree because they both mean
+* "now" — the trigger's `now()` is the transaction's start time, which is the
+* same instant the driver's own timestamp is written under.
+*
+* ## Why it is carved out of Atlas
+*
+* Atlas's free tier refuses to *parse* a desired-state file containing a
+* function ("functions and procedures are available to logged-in users only"),
+* and a trigger is a function plus a binding. This is the same arrangement the
+* search helpers already have: excluded from Atlas's view by pattern, written
+* to a file Rebase applies itself, applied at boot by the schema ensure, and
+* appended to migrations by the CLI so a replay is complete.
+*
+* ## Why one function for every column
+*
+* The column name arrives as a trigger argument (`TG_ARGV[0]`), so a project
+* with forty `updated_at` columns installs one function and forty bindings
+* rather than forty near-identical functions. `jsonb_populate_record(NEW, …)`
+* is the documented way to set a field of a row whose type is not known until
+* run time; it takes `NEW` as the row template, so the value is cast back to
+* whatever the column actually is — a `timestamptz`, or a `date` if that is
+* what the property declared.
+*/
+/** The one trigger function, qualified. A frozen derived name. */
+var SET_UPDATED_AT_FN = `${REBASE_SCHEMA}.set_updated_at`;
+/**
+* `CREATE OR REPLACE FUNCTION`, so replaying it against a database that already
+* has it is a no-op — this is emitted into a file that runs on every push and
+* is appended to migrations that run against databases at any stage of life.
+*/
+var setUpdatedAtFunction = () => `CREATE OR REPLACE FUNCTION ${SET_UPDATED_AT_FN}() RETURNS trigger\nLANGUAGE plpgsql AS \$\$
+BEGIN
+    NEW := jsonb_populate_record(NEW, jsonb_build_object(TG_ARGV[0], now()));
+    RETURN NEW;
+END;
+\$\$;`;
+/**
+* `DROP TRIGGER IF EXISTS` before the `CREATE`.
+*
+* `CREATE OR REPLACE TRIGGER` exists only on Postgres 14+, and this runs
+* against whatever a self-hosted project points at. Two statements rather than
+* one is also what the boot-time applier needs: it issues DDL one statement at
+* a time over the extended query protocol, which forbids multiple commands in
+* one execute.
+*/
+var dropTriggerStatement = (plan) => `DROP TRIGGER IF EXISTS "${plan.name}" ON "${plan.schema}"."${plan.table}";`;
+var createTriggerStatement = (plan) => `CREATE TRIGGER "${plan.name}" BEFORE UPDATE ON "${plan.schema}"."${plan.table}" FOR EACH ROW EXECUTE FUNCTION ${SET_UPDATED_AT_FN}('${plan.column.replace(/'/g, "''")}');`;
+/** Both statements, in the order they must run. */
+var triggerStatements = (plan) => [dropTriggerStatement(plan), createTriggerStatement(plan)];
+//#endregion
+//#region src/schema/plan/plan-schema.ts
+/**
+* The only place a `Property` is read for schema purposes.
+*
+* Everything that used to `switch (prop.type)` — the Drizzle generator, the DDL
+* generator, the boot-time ensure — now renders the {@link SchemaPlan} this
+* produces. See `./types.ts` for why.
+*
+* Pure and synchronous. It reads collections and nothing else: no database, no
+* filesystem, no process-wide registry. The one fact about the world it needs
+* (which extensions a project's databases gave Rebase leave to install) is
+* passed in, because a plan that depended on whatever module happened to be
+* imported would not be comparable with itself.
+*
+* It **throws** rather than guessing. A configuration no renderer can honour —
+* an empty enum, two `isId` properties, `isId: "cuid"`, an unknown
+* `columnType`, a relation to a collection that is not in the bundle, a
+* `search` block on a collection Postgres does not store — used to fail
+* differently in each of the three emitters, or not at all, and the failure
+* landed at `CREATE TABLE` time on a managed tenant with nobody in the loop.
+* Here it lands once, with the collection and the property named.
+*/
+/**
+* Single-quote escaping for a SQL string literal (PostgreSQL doubles the
+* quote). Enum labels and `defaultValue`s come straight from user-authored
+* collection config, so a value like `it's` closes the literal early and the
+* whole generated file stops parsing at that statement.
+*/
+var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
+var schemaOf = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
+var describe = (collection) => collection.slug ?? collection.name ?? "(unnamed)";
+/**
+* The `ON DELETE` a foreign key gets when the author did not say.
+*
+* One rule for every property that emits one — `belongsTo` relations and
+* `reference` properties alike. `reference` kept its own `CASCADE` default for
+* a release after this rule was written, which is exactly the split this
+* function exists to prevent: two spellings of the same link, two
+* data-retention behaviours, and only one of them documented.
+*
+* An optional link is `SET NULL`: the column can hold NULL, so dropping the
+* parent leaves the child row with an empty pointer, which is what "optional"
+* already means.
+*
+* A required link is **`RESTRICT`**, not `CASCADE`. `NOT NULL` says the child
+* cannot exist without a parent; it does not say deleting the parent should
+* take the child with it. That second claim is a data-retention decision, and
+* defaulting to it meant `onDelete` — a field nobody has to write — silently
+* turned every `DELETE FROM authors` into a cascade through posts, comments and
+* anything else that hung off them.
+*/
+var defaultBelongsToOnDelete = (required) => required ? "RESTRICT" : "SET NULL";
+var foreignKeyPlan = (args) => {
+	const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
+	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
+	return {
+		...args,
+		constraintName,
+		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate}`
+	};
+};
+/**
+* The type a column pointing at this collection's primary key must have — a
+* junction endpoint, a `belongsTo` foreign key, a `reference`.
+*
+* One function because it was three: the ladder was spelled inline in
+* `generatePostgresDdl`, again in `planJunctionTables` and a third time in the
+* Drizzle generator.
+*/
+var primaryKeyPgType = (collection) => {
+	const pk = getPrimaryKeyProp(collection);
+	if (pk.type === "number") return { kind: "integer" };
+	return pk.isUuid ? { kind: "uuid" } : { kind: "text" };
+};
+/** The `columnType`s a `number` property may name, and what each one is. */
+var NUMBER_COLUMN_TYPES = {
+	"integer": { kind: "integer" },
+	"smallint": { kind: "smallint" },
+	"smallserial": { kind: "smallserial" },
+	"bigint": { kind: "bigint" },
+	"serial": { kind: "serial" },
+	"bigserial": { kind: "bigserial" },
+	"real": { kind: "real" },
+	"double precision": { kind: "doublePrecision" },
+	"numeric": { kind: "numeric" }
+};
+var numberType = (propName, prop, collection, isId) => {
+	if (prop.isId === "increment") return { kind: "integer" };
+	if (prop.columnType) {
+		const mapped = NUMBER_COLUMN_TYPES[prop.columnType];
+		if (!mapped) throw new Error(`Property "${propName}" of collection "${describe(collection)}" declares \`columnType: "${prop.columnType}"\`, which is not a Postgres numeric type Rebase emits. Use one of: ${Object.keys(NUMBER_COLUMN_TYPES).join(", ")}.`);
+		if (mapped.kind === "numeric") return numericType(prop);
+		return mapped;
+	}
+	if (prop.validation?.integer || isId) return { kind: "integer" };
+	return numericType(prop);
+};
+/** `NUMERIC`, with the precision and scale the property asks for. */
+var numericType = (prop) => {
+	const { precision, scale } = prop;
+	if (precision === void 0) return { kind: "numeric" };
+	return scale === void 0 ? {
+		kind: "numeric",
+		precision
+	} : {
+		kind: "numeric",
+		precision,
+		scale
+	};
+};
+var stringType = (propName, prop, collection) => {
+	if (prop.enum) {
+		const labels = enumLabelsOf(propName, prop, collection);
+		const table = getTableName(collection);
+		const column = resolveColumnName(propName, prop);
+		return {
+			kind: "enum",
+			schema: schemaOf(collection),
+			name: `${table}_${column}`,
+			varName: getEnumVarName(table, propName),
+			labels
+		};
+	}
+	if (prop.isId === "uuid" || prop.columnType === "uuid") return { kind: "uuid" };
+	if (prop.columnType === "char") return {
+		kind: "char",
+		length: resolveStringColumnLength(prop)
+	};
+	if (prop.columnType === "varchar") return {
+		kind: "varchar",
+		length: resolveStringColumnLength(prop)
+	};
+	if (prop.columnType !== void 0 && prop.columnType !== "text") throw new Error(`Property "${propName}" of collection "${describe(collection)}" declares \`columnType: "${String(prop.columnType)}"\`, which is not a Postgres string type Rebase emits. Use one of: text, varchar, char, uuid.`);
+	return { kind: "text" };
+};
+var arrayElementType = (prop) => {
+	let colType = prop.columnType;
+	if (!colType && prop.of && !Array.isArray(prop.of)) {
+		const of = prop.of;
+		if (of.type === "string") colType = "text[]";
+		else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
+		else if (of.type === "boolean") colType = "boolean[]";
+	}
+	switch (colType) {
+		case "text[]": return { kind: "text" };
+		case "integer[]": return { kind: "integer" };
+		case "boolean[]": return { kind: "boolean" };
+		case "numeric[]": return { kind: "numeric" };
+		default: return;
+	}
+};
+/**
+* The Postgres type a property's column has.
+*
+* Every member of `DataType` has an arm. A type this does not know is a
+* generator that has not been taught it yet, and it says so — a silent `TEXT`
+* here is how `geopoint` ended up with a database column, no Drizzle key, and
+* every write to it discarded with a 201.
+*/
+var columnPgType = (propName, prop, collection, resolveCollection) => {
+	switch (prop.type) {
+		case "string": return stringType(propName, prop, collection);
+		case "number": return numberType(propName, prop, collection, isIdProperty(propName, prop, collection));
+		case "boolean": return { kind: "boolean" };
+		case "date": {
+			const dateProp = prop;
+			if (dateProp.columnType === "date") return { kind: "date" };
+			if (dateProp.columnType === "time") return { kind: "time" };
+			return { kind: "timestamptz" };
+		}
+		case "map": return prop.columnType === "json" ? { kind: "json" } : { kind: "jsonb" };
+		case "geopoint": return { kind: "jsonb" };
+		case "array": {
+			const arrayProp = prop;
+			if (arrayProp.columnType === "json") return { kind: "json" };
+			const element = arrayElementType(arrayProp);
+			return element ? {
+				kind: "array",
+				of: element
+			} : { kind: "jsonb" };
+		}
+		case "vector": return {
+			kind: "vector",
+			dimensions: prop.dimensions
+		};
+		case "binary": return { kind: "bytea" };
+		case "relation":
+		case "reference": {
+			const target = linkTarget(propName, prop, collection, resolveCollection);
+			return target ? primaryKeyPgType(target) : { kind: "text" };
+		}
+		default: throw new Error(`No Postgres column type for property "${propName}" of type "${prop.type}" in collection "${describe(collection)}". Add a case to \`columnPgType\` in schema/plan/plan-schema.ts.`);
+	}
+};
+/** The collection a `relation` or `reference` points at, when it resolves. */
+var linkTarget = (propName, prop, collection, resolveCollection) => {
+	if (prop.type === "reference") {
+		const path = prop.path;
+		return path ? resolveCollection(path) : void 0;
+	}
+	const relProp = prop;
+	const relation = findRelation(resolveCollectionRelations(collection), relProp.relation?.relationName ?? propName);
+	if (relation?.kind !== "belongsTo") return void 0;
+	try {
+		return relation.target();
+	} catch {
+		return;
+	}
+};
+/**
+* A `defaultValue` as a database DEFAULT.
+*
+* `defaultValue` reached neither the schema nor — until recently — the write
+* path, so a documented, type-checked field did nothing at all: the panel
+* pre-filled it, an insert from anywhere else (the REST API, a seed, psql) did
+* not, and the column came out NULL. A DEFAULT is the one place that binds
+* every writer.
+*
+* Only literals. A `reference`'s default is an `EntityReference` object and a
+* `vector`'s is an embedding — neither is a column literal, and inventing one
+* would be a value the write path and the database disagree about.
+* `undefined` for those, which is what "no DEFAULT" means everywhere here.
+*/
+var literalDefault = (prop, type) => {
+	const value = prop.defaultValue;
+	if (value === void 0 || value === null) return void 0;
+	switch (prop.type) {
+		case "string": return typeof value === "string" ? {
+			kind: "literal",
+			value,
+			sql: quoteSqlLiteral(value)
+		} : void 0;
+		case "number": return typeof value === "number" && Number.isFinite(value) ? {
+			kind: "literal",
+			value,
+			sql: String(value)
+		} : void 0;
+		case "boolean": return typeof value === "boolean" ? {
+			kind: "literal",
+			value,
+			sql: value ? "TRUE" : "FALSE"
+		} : void 0;
+		case "date": {
+			const iso = value instanceof Date ? Number.isNaN(value.getTime()) ? void 0 : value.toISOString() : typeof value === "string" ? value : void 0;
+			return iso === void 0 ? void 0 : {
+				kind: "literal",
+				value: iso,
+				sql: quoteSqlLiteral(iso)
+			};
+		}
+		case "map":
+		case "array":
+		case "geopoint": {
+			if (type.kind !== "jsonb" && type.kind !== "json") return void 0;
+			let json;
+			try {
+				json = JSON.stringify(value);
+			} catch {
+				return;
+			}
+			if (json === void 0) return void 0;
+			return {
+				kind: "literal",
+				value,
+				sql: `${quoteSqlLiteral(json)}::${type.kind}`
+			};
+		}
+		default: return;
+	}
+};
+/** The DEFAULT a column carries: id strategy, then `autoValue`, then `defaultValue`. */
+var columnDefault = (propName, prop, collection, type) => {
+	const idDefault = idColumnDefault(propName, prop, collection);
+	if (idDefault) {
+		if (idDefault.kind === "uuid") return {
+			kind: "sql",
+			expression: "gen_random_uuid()"
+		};
+		if (idDefault.kind === "identity") return { kind: "identity" };
+		return {
+			kind: "sql",
+			expression: idDefault.expression
+		};
+	}
+	if (prop.type === "date") {
+		const autoValue = prop.autoValue;
+		if (autoValue === "on_create" || autoValue === "on_update") return {
+			kind: "sql",
+			expression: "now()"
+		};
+	}
+	return literalDefault(prop, type);
+};
+/**
+* One security rule, compiled to the clauses a policy is made of.
+*
+* The desugaring (`access` / `ownerField` / `roles` / structured condition /
+* raw SQL → `PolicyExpression`) and the SQL compilation are `@rebasepro/common`'s,
+* which is what the client-side evaluator uses too — so the UI, the DDL and the
+* database agree about who can read a row. What lives here is only the shape:
+* which operations a rule expands to, which clauses each operation takes, and
+* the deny-all fallback for a clause that compiled to nothing.
+*/
+var compileSecurityRule = (collection, rule, resolveCollection, injected, ruleKey = rule.name ?? "(unnamed)") => {
+	const tableName = getTableName(collection);
+	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+	const policyNames = getPolicyNamesForRule(rule, tableName);
+	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+	return ops.map((operation, index) => {
+		const needsUsing = operation !== "insert";
+		const needsWithCheck = operation !== "select" && operation !== "delete";
+		let using = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
+		let withCheck = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
+		if (!using && needsUsing) using = "false";
+		if (!withCheck && needsWithCheck) withCheck = "false";
+		return {
+			name: policyNames[index],
+			ruleKey,
+			operation,
+			mode: rule.mode ?? "permissive",
+			roles: rule.pgRoles ? [...rule.pgRoles].sort() : ["public"],
+			using,
+			withCheck,
+			injected
+		};
+	});
+};
+function planSchema(allCollections, options = {}) {
+	assertSearchIsPostgresOnly(allCollections);
+	const collections = relationalCollections(allCollections);
+	collections.forEach(assertSinglePrimaryKey);
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const declaredSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
+	const schemas = Array.from(/* @__PURE__ */ new Set([REBASE_SCHEMA, ...declaredSchemas]));
+	const enums = [];
+	const seenEnums = /* @__PURE__ */ new Set();
+	/**
+	* Every enum type one table's properties declare, appended once.
+	*
+	* `declaredSchema` is passed rather than read off the config because a
+	* junction's synthetic collection carries `schema: "public"` as a resolved
+	* fact and not as a declaration — emitting it as one would make the
+	* generated file reach for a `pgSchema("public")` variable that exists for
+	* nobody.
+	*/
+	const collectEnumTypes = (collection, properties, declaredSchema) => {
+		for (const [propName, rawProp] of Object.entries(properties)) {
+			const prop = rawProp;
+			if (!("enum" in prop) || !prop.enum) continue;
+			if (prop.type !== "string" && prop.type !== "number") continue;
+			const labels = enumLabelsOf(propName, prop, collection);
+			if (!declaresEnumType(prop)) continue;
+			const schema = schemaOf(collection);
+			const name = `${getTableName(collection)}_${resolveColumnName(propName, prop)}`;
+			const qualified = `${schema}.${name}`;
+			if (seenEnums.has(qualified)) continue;
+			seenEnums.add(qualified);
+			enums.push({
+				schema,
+				name,
+				qualified,
+				declaredSchema,
+				varName: getEnumVarName(getTableName(collection), propName),
+				labels
+			});
+		}
+	};
+	for (const collection of collections) collectEnumTypes(collection, collection.properties ?? {}, isPostgresCollectionConfig(collection) ? collection.schema : void 0);
+	const tableEntries = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const tableName = getTableName(collection);
+		if (tableName) tableEntries.set(tableName, { collection });
+		for (const relation of Object.values(resolveCollectionRelations(collection))) {
+			if (!isManyToMany(relation)) continue;
+			const junctionTable = relation.through.table;
+			if (tableEntries.has(junctionTable)) continue;
+			tableEntries.set(junctionTable, {
+				collection: {
+					table: junctionTable,
+					properties: {}
+				},
+				junction: {
+					relation,
+					source: collection
+				}
+			});
+		}
+	}
+	const junctionSpecs = resolveJunctionSpecs(collections);
+	for (const spec of junctionSpecs.values()) {
+		if (Object.keys(spec.properties).length === 0) continue;
+		collectEnumTypes(getJunctionCollectionConfig(spec), spec.properties, void 0);
+	}
+	const triggerFunctionNeeded = { value: false };
+	const tables = [];
+	for (const [tableName, entry] of tableEntries) tables.push(entry.junction ? planJunctionTable(tableName, entry.junction.relation, entry.junction.source, junctionSpecs, resolveCollection, triggerFunctionNeeded) : planCollectionTable(entry.collection, resolveCollection, triggerFunctionNeeded));
+	const extensions = [];
+	const functions = [];
+	const seenStatements = /* @__PURE__ */ new Set();
+	const add = (into, statement) => {
+		if (seenStatements.has(statement)) return;
+		seenStatements.add(statement);
+		into.push(statement);
+	};
+	for (const table of tables) {
+		if (!table.search) continue;
+		for (const statement of searchExtensionStatements(table.search)) add(extensions, statement);
+	}
+	if (vectorExtensionDeclared(options.databaseExtensions) && tables.some((t) => t.vectorColumns.length > 0)) add(extensions, vectorExtensionStatement());
+	for (const table of tables) {
+		if (!table.search) continue;
+		for (const statement of searchHelperFunctions(table.search)) add(functions, statement);
+	}
+	if (triggerFunctionNeeded.value) add(functions, setUpdatedAtFunction());
+	return {
+		schemas,
+		declaredSchemas,
+		enums,
+		tables,
+		relations: planRelations(collections, tableEntries),
+		extensions,
+		functions,
+		collections,
+		options
+	};
+}
+function planCollectionTable(collection, resolveCollection, triggerFunctionNeeded) {
+	const schema = schemaOf(collection);
+	const table = bareTableName(getTableName(collection));
+	const auth = isAuthCollection(collection);
+	const columns = [];
+	const triggers = [];
+	const relations = resolveCollectionRelations(collection);
+	for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
+		const prop = rawProp;
+		if (prop.type === "relation") {
+			const column = planRelationColumn(propName, prop, collection, relations, schema, table);
+			if (column) columns.push(column);
+			continue;
+		}
+		if (prop.type === "reference") {
+			columns.push(planReferenceColumn(propName, prop, collection, resolveCollection, schema, table));
+			continue;
+		}
+		columns.push(planPropertyColumn(propName, prop, {
+			collection,
+			resolveCollection,
+			schema,
+			table,
+			auth,
+			triggers,
+			triggerFunctionNeeded
+		}));
+	}
+	if (auth) {
+		const declared = new Set(columns.map((c) => c.column));
+		for (const spec of AUTH_USERS_COLUMNS) {
+			if (declared.has(spec.column)) continue;
+			columns.push({
+				key: spec.column,
+				column: spec.column,
+				type: authColumnType(spec.type),
+				nullable: spec.notNull !== true,
+				primaryKey: false,
+				unique: false,
+				sqlDefinition: authUsersColumnSql(spec),
+				source: {
+					kind: "auth",
+					slug: collection.slug
+				}
+			});
+		}
+	}
+	const search = buildSearchColumnSpec(collection);
+	if (search) {
+		columns.push({
+			key: search.column,
+			column: search.column,
+			type: { kind: "tsvector" },
+			nullable: true,
+			primaryKey: false,
+			unique: false,
+			generated: {
+				expression: search.expression,
+				stored: true
+			},
+			sqlDefinition: searchColumnTypeSql(search.expression, "tsvector"),
+			source: {
+				kind: "search",
+				slug: collection.slug
+			}
+		});
+		if (search.fuzzy) columns.push({
+			key: search.fuzzy.column,
+			column: search.fuzzy.column,
+			type: { kind: "text" },
+			nullable: true,
+			primaryKey: false,
+			unique: false,
+			generated: {
+				expression: search.fuzzy.expression,
+				stored: true
+			},
+			sqlDefinition: searchColumnTypeSql(search.fuzzy.expression, "text"),
+			source: {
+				kind: "search",
+				slug: collection.slug
+			}
+		});
+	}
+	if (!columns.some((c) => c.primaryKey)) columns.unshift({
+		key: "id",
+		column: "id",
+		type: { kind: "text" },
+		nullable: false,
+		primaryKey: true,
+		unique: false,
+		source: {
+			kind: "implicit-id",
+			slug: collection.slug
+		}
+	});
+	const injected = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
+	const policies = getEffectiveSecurityRules(collection).flatMap((rule, index) => compileSecurityRule(collection, rule, resolveCollection, Boolean(rule.name && injected.has(rule.name)), rule.name ?? `#${index}`));
+	const tenantIndexes = applyTenantColumnEffects(collection, columns, schema, table);
+	return {
+		schema,
+		table,
+		qualified: `${schema}.${table}`,
+		declaredSchema: isPostgresCollectionConfig(collection) ? collection.schema : void 0,
+		varName: getTableVarName(getTableName(collection)),
+		kind: "collection",
+		slug: collection.slug,
+		columns,
+		primaryKey: columns.filter((c) => c.primaryKey).map((c) => c.column),
+		indexes: [...buildCollectionIndexSpecs(collection, resolveColumnName), ...tenantIndexes],
+		search,
+		vector: buildVectorIndexPlan(collection, resolveColumnName),
+		vectorColumns: buildVectorColumnSpecs(collection, resolveColumnName),
+		policies,
+		triggers,
+		auth
+	};
+}
+/**
+* One declared, non-linking property, as a column.
+*
+* Extracted from {@link planCollectionTable} the moment a second table needed
+* it: a `manyToMany`'s `through.properties` are columns on the junction, and
+* "declared exactly like a collection's properties" has to mean the same code
+* reads them, or it is a promise the next `columnType` or `defaultValue` change
+* quietly breaks. A junction payload column therefore gets the type, the
+* nullability, the default, the UNIQUE and the `on_update` trigger a collection
+* column with the same declaration gets — because it is the same function
+* answering.
+*
+* `relation` and `reference` do not come through here; they own a foreign key
+* and are planned by {@link planRelationColumn} / {@link planReferenceColumn}.
+* A junction payload may not declare either (config validation refuses it), so
+* this is the whole of a payload column.
+*/
+function planPropertyColumn(propName, prop, ctx) {
+	const { collection, resolveCollection, schema, table, auth } = ctx;
+	const isId = isIdProperty(propName, prop, collection);
+	const column = resolveColumnName(propName, prop);
+	const type = columnPgType(propName, prop, collection, resolveCollection);
+	const required = prop.validation?.required === true;
+	const defaultValue = columnDefault(propName, prop, collection, type);
+	const authDefinition = auth && !isId ? authUsersColumnDefinition(column) : void 0;
+	const plan = {
+		key: propName,
+		column,
+		type,
+		nullable: !(isId || required),
+		primaryKey: isId,
+		unique: !isId && prop.validation?.unique === true,
+		default: defaultValue,
+		sqlDefinition: authDefinition,
+		source: {
+			kind: "property",
+			propName,
+			slug: collection.slug
+		}
+	};
+	if (prop.type === "date" && prop.autoValue === "on_update") {
+		plan.touchOnUpdate = true;
+		ctx.triggerFunctionNeeded.value = true;
+		ctx.triggers.push({
+			schema,
+			table,
+			column,
+			name: toPostgresIdentifier(`${table}_${column}_touch`)
+		});
+	}
+	return plan;
+}
+/**
+* The two schema effects a `tenant` declaration has that a policy cannot state.
+*
+* The policy itself is injected as an ordinary `SecurityRule`
+* (`buildTenantSecurityRule`) and compiled above with every other rule, so
+* nothing here touches `policies`. What is left is the column:
+*
+* - **`NOT NULL`.** A row whose tenant is NULL belongs to nobody, and the
+*   restrictive policy compares the column to the caller's tenant — a
+*   comparison against NULL is never true. Such a row is therefore invisible to
+*   every caller, forever, including the one who wrote it. The write path
+*   refuses to create one (`TENANT_REQUIRED`); this is the same statement made
+*   where a raw `INSERT`, a seed and a migration can also hear it.
+* - **An index.** The tenancy predicate is ANDed into *every* statement against
+*   the table, so an unindexed tenant column turns every read into a sequential
+*   scan filtered by tenant. It is the one index a tenant-scoped table cannot
+*   be without, and the one people most reliably forget — which is the whole
+*   argument for deriving it rather than documenting it.
+*
+* The index goes through `deriveIndexName` like every other index, so it is a
+* Rebase-managed name (`_ix_<fingerprint>`), it is in the Atlas diff, and the
+* doctor recognises it. Because that name is a fingerprint of the index's
+* semantics, an author who has *already* declared a plain btree index on the
+* tenant column derives byte-for-byte the same name — so the two are the same
+* object and this adds nothing rather than colliding.
+*
+* Throws when the field names no column. `planSchema` throws rather than
+* guessing, and the alternative here is a table with a tenancy policy over a
+* column that does not exist: `CREATE POLICY` fails, RLS stays enabled, and the
+* collection denies every row.
+*/
+function applyTenantColumnEffects(collection, columns, schema, table) {
+	const tenant = getTenantConfig(collection);
+	if (!tenant) return [];
+	const column = findTenantColumn(collection, columns, tenant.field);
+	if (!column) throw new Error(`Collection "${describe(collection)}" declares \`tenant: { field: "${tenant.field}" }\`, and no property of that name reaches a column. \`tenant\` says what a column means; it does not create one. Declare the property, or name the one that holds the tenant id.`);
+	if (column.primaryKey) return [];
+	column.nullable = false;
+	const withoutName = {
+		schema,
+		table,
+		method: "btree",
+		unique: false,
+		keys: [{
+			column: column.column,
+			direction: "asc",
+			nulls: "last"
+		}],
+		include: [],
+		predicate: null,
+		reason: TENANT_INDEX_REASON
+	};
+	return [{
+		...withoutName,
+		indexName: deriveIndexName(withoutName)
+	}];
+}
+/**
+* The planned column a `tenant.field` names.
+*
+* Not simply `columns.find(c => c.key === field)`: a `belongsTo` relation
+* property emits its column under the *foreign key's* field name, so
+* `tenant: { field: "org" }` beside `org: { type: "relation", … }` has to
+* resolve through the relation to `org_id`. Matching only on `key` found
+* nothing there and the declaration would have been refused as naming no
+* column — for the shape the documentation recommends.
+*/
+function findTenantColumn(collection, columns, field) {
+	const direct = columns.find((c) => c.key === field);
+	if (direct) return direct;
+	const prop = collection.properties?.[field];
+	if (prop?.type === "relation") {
+		const relation = findRelation(resolveCollectionRelations(collection), prop.relation?.relationName ?? field);
+		if (relation?.kind === "belongsTo" && relation.localKey) return columns.find((c) => c.column === relation.localKey);
+		return;
+	}
+	if (!prop) return void 0;
+	const columnName = resolveColumnName(field, prop);
+	return columns.find((c) => c.column === columnName);
+}
+/**
+* The column a `belongsTo` relation owns, or `undefined` when the relation puts
+* no column on this table.
+*
+* Every other kind is a column on the target, a junction row, or a join chain.
+*/
+function planRelationColumn(propName, prop, collection, relations, schema, table) {
+	const relation = findRelation(relations, prop.relation?.relationName ?? propName);
+	if (relation?.kind !== "belongsTo") return void 0;
+	let target;
+	try {
+		target = relation.target();
+	} catch {
+		return;
+	}
+	if (!target) return void 0;
+	const required = prop.validation?.required === true;
+	const fkFieldKey = fieldKeyForColumn(collection, relation.localKey);
+	const columnOwnedByProperty = Boolean(collection.properties?.[fkFieldKey]) && propName !== fkFieldKey;
+	const relationName = prop.relation?.relationName ?? propName;
+	const legacyKey = legacyForeignKeyName(relationName);
+	const derived = relation.localKey === generateForeignKeyName(relationName);
+	return {
+		key: fkFieldKey,
+		column: relation.localKey,
+		type: primaryKeyPgType(target),
+		nullable: !required,
+		primaryKey: false,
+		unique: prop.validation?.unique === true,
+		columnOwnedByProperty: columnOwnedByProperty || void 0,
+		legacyColumn: derived && legacyKey !== relation.localKey ? legacyKey : void 0,
+		foreignKey: foreignKeyPlan({
+			schema,
+			table,
+			column: relation.localKey,
+			targetSchema: schemaOf(target),
+			targetTable: bareTableName(getTableName(target)),
+			targetColumn: getPrimaryKeyName(target),
+			onDelete: relation.onDelete ?? defaultBelongsToOnDelete(required),
+			onUpdate: relation.onUpdate
+		}),
+		source: {
+			kind: "relation",
+			propName,
+			slug: collection.slug
+		}
+	};
+}
+/** The column a `reference` property owns — a foreign key like any other. */
+function planReferenceColumn(propName, prop, collection, resolveCollection, schema, table) {
+	const target = prop.path ? resolveCollection(prop.path) : void 0;
+	const column = resolveColumnName(propName, prop);
+	const required = prop.validation?.required === true;
+	return {
+		key: propName,
+		column,
+		type: target ? primaryKeyPgType(target) : { kind: "text" },
+		nullable: !required,
+		primaryKey: false,
+		unique: prop.validation?.unique === true,
+		foreignKey: target ? foreignKeyPlan({
+			schema,
+			table,
+			column,
+			targetSchema: schemaOf(target),
+			targetTable: bareTableName(getTableName(target)),
+			targetColumn: getPrimaryKeyName(target),
+			onDelete: defaultBelongsToOnDelete(required)
+		}) : void 0,
+		source: {
+			kind: "reference",
+			propName,
+			slug: collection.slug
+		}
+	};
+}
+/**
+* An auth-owned column's declared SQL type, as a tag.
+*
+* `auth-users-columns` states these as SQL because that is the grammar its three
+* creators write in; the plan needs the tag so nothing downstream has to parse a
+* type back apart. Deliberately exhaustive rather than a fallback: a column auth
+* adds with a type nobody mapped should say so here, not turn into `TEXT` in a
+* table the login flow reads.
+*/
+var AUTH_COLUMN_TYPES = {
+	"TEXT": { kind: "text" },
+	"TEXT[]": {
+		kind: "array",
+		of: { kind: "text" }
+	},
+	"BOOLEAN": { kind: "boolean" },
+	"JSONB": { kind: "jsonb" },
+	"TIMESTAMP WITH TIME ZONE": { kind: "timestamptz" }
+};
+var authColumnType = (sqlType) => {
+	const mapped = AUTH_COLUMN_TYPES[sqlType];
+	if (!mapped) throw new Error(`\`auth-users-columns\` declares a column of type "${sqlType}", which the schema plan has no tag for. Add it to \`AUTH_COLUMN_TYPES\` in schema/plan/plan-schema.ts.`);
+	return mapped;
+};
+function planJunctionTable(tableName, relation, source, junctionSpecs, resolveCollection, triggerFunctionNeeded) {
+	if (!isManyToMany(relation)) throw new Error(`Internal: junction table "${tableName}" was reached from a ${relation.kind} relation.`);
+	const table = bareTableName(tableName);
+	const schema = "public";
+	const target = relation.target();
+	const { sourceColumn, targetColumn } = relation.through;
+	const onDelete = relation.onDelete ?? "CASCADE";
+	const spec = junctionSpecs.get(table);
+	const legacyFor = (collection, column) => {
+		const slug = toSnakeCase(collection.slug ?? collection.name ?? "");
+		const legacy = legacyForeignKeyName(slug);
+		return column === generateForeignKeyName(slug) && legacy !== column ? legacy : void 0;
+	};
+	const endpoint = (collection, column) => ({
+		key: column,
+		column,
+		type: primaryKeyPgType(collection),
+		nullable: false,
+		primaryKey: false,
+		unique: false,
+		legacyColumn: legacyFor(collection, column),
+		foreignKey: foreignKeyPlan({
+			schema,
+			table,
+			column,
+			targetSchema: schemaOf(collection),
+			targetTable: bareTableName(getTableName(collection)),
+			targetColumn: getPrimaryKeyName(collection),
+			onDelete
+		}),
+		source: { kind: "junction-key" }
+	});
+	const columns = [endpoint(source, sourceColumn), endpoint(target, targetColumn)];
+	const triggers = [];
+	if (spec && Object.keys(spec.properties).length > 0) {
+		const junctionCollection = getJunctionCollectionConfig(spec);
+		const keyColumns = /* @__PURE__ */ new Set([sourceColumn, targetColumn]);
+		for (const [propName, rawProp] of Object.entries(spec.properties)) {
+			const plan = planPropertyColumn(propName, rawProp, {
+				collection: junctionCollection,
+				resolveCollection,
+				schema,
+				table,
+				auth: false,
+				triggers,
+				triggerFunctionNeeded
+			});
+			if (keyColumns.has(plan.column)) continue;
+			columns.push(plan);
+		}
+	}
+	const policies = spec ? getJunctionSecurityRules(spec).flatMap((rule, index) => compileSecurityRule(getJunctionCollectionConfig(spec), rule, resolveCollection, false, rule.name ?? `#${index}`)) : [];
+	return {
+		schema,
+		table,
+		qualified: `${schema}.${table}`,
+		varName: getTableVarName(tableName),
+		kind: "junction",
+		declaringSlugs: spec?.declaringSides.map((side) => side.collection.slug) ?? [],
+		columns,
+		primaryKey: [sourceColumn, targetColumn],
+		indexes: [],
+		vectorColumns: [],
+		policies,
+		triggers,
+		auth: false
+	};
+}
+/**
+* The `relations(...)` entries the generated file carries.
+*
+* Both sides of a link must share a `relationName` or Drizzle cannot pair them;
+* `sharedRelationName` is the rule, and each side derives it independently.
+*/
+function planRelations(collections, tableEntries) {
+	const plans = [];
+	for (const [tableName, entry] of tableEntries) {
+		const tableVar = getTableVarName(tableName);
+		if (entry.junction) {
+			const { relation, source } = entry.junction;
+			if (!isManyToMany(relation)) continue;
+			const target = relation.target();
+			const owningRelationName = relation.relationName ?? toSnakeCase(getTableName(target));
+			let inverseRelationName;
+			try {
+				for (const targetRel of Object.values(resolveCollectionRelations(target))) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
+					inverseRelationName = targetRel.relationName;
+					break;
+				}
+			} catch {}
+			plans.push({
+				tableVar,
+				key: relation.through.sourceColumn,
+				kind: "one",
+				targetVar: getTableVarName(getTableName(source)),
+				relationName: owningRelationName,
+				fields: [relation.through.sourceColumn],
+				references: [getPrimaryKeyName(source)]
+			});
+			plans.push({
+				tableVar,
+				key: relation.through.targetColumn,
+				kind: "one",
+				targetVar: getTableVarName(getTableName(target)),
+				relationName: inverseRelationName ?? `${tableName}_${relation.through.targetColumn}`,
+				fields: [relation.through.targetColumn],
+				references: [getPrimaryKeyName(target)]
+			});
+			continue;
+		}
+		const collection = entry.collection;
+		const emitted = /* @__PURE__ */ new Set();
+		for (const [key, relation] of Object.entries(resolveCollectionRelations(collection))) {
+			let target;
+			try {
+				target = relation.target();
+			} catch {
+				continue;
+			}
+			const targetVar = getTableVarName(getTableName(target));
+			const relationName = sharedRelationName(relation, collection);
+			const dedupe = `${relationName}::${relation.kind}`;
+			if (emitted.has(dedupe)) continue;
+			emitted.add(dedupe);
+			switch (relation.kind) {
+				case "belongsTo":
+					plans.push({
+						tableVar,
+						key,
+						kind: "one",
+						targetVar,
+						relationName,
+						fields: [fieldKeyForColumn(collection, relation.localKey)],
+						references: [getPrimaryKeyName(target)]
+					});
+					break;
+				case "hasOne":
+					plans.push({
+						tableVar,
+						key,
+						kind: "one",
+						targetVar
+					});
+					break;
+				case "hasMany":
+					plans.push({
+						tableVar,
+						key,
+						kind: "many",
+						targetVar,
+						relationName
+					});
+					break;
+				case "manyToMany":
+					plans.push({
+						tableVar,
+						key,
+						kind: "many",
+						targetVar: getTableVarName(relation.through.table),
+						relationName
+					});
+					break;
+				case "via": break;
+			}
+		}
+		for (const other of collections) {
+			if (other.slug === collection.slug) continue;
+			for (const otherRel of Object.values(resolveCollectionRelations(other))) {
+				if (!hasForeignKeyOnTarget(otherRel)) continue;
+				let otherTarget;
+				try {
+					otherTarget = otherRel.target();
+				} catch {
+					continue;
+				}
+				if (otherTarget.slug !== collection.slug) continue;
+				const relationName = sharedRelationName(otherRel, other);
+				const dedupe = `${relationName}::belongsTo`;
+				if (emitted.has(dedupe)) continue;
+				emitted.add(dedupe);
+				const otherVar = getTableVarName(getTableName(other));
+				const fieldKey = fieldKeyForColumn(collection, otherRel.foreignKeyOnTarget);
+				plans.push({
+					tableVar,
+					key: `_synth_${otherVar}_${fieldKey}`,
+					kind: "one",
+					targetVar: otherVar,
+					relationName,
+					fields: [fieldKey],
+					references: [otherRel.sourceKey ? fieldKeyForColumn(other, otherRel.sourceKey) : getPrimaryKeyName(other)]
+				});
+			}
+		}
+	}
+	return plans;
+}
+//#endregion
+export { searchHelperFunctions as _, triggerStatements as a, searchStampGuards as b, SEARCH_TEXT_FN as c, fuzzyColumnDefinition as d, hiddenColumnsOption as f, searchExtensionStatements as g, searchColumnStamps as h, SET_UPDATED_AT_FN as i, SEARCH_UNACCENT_FN as l, searchColumnNames as m, planSchema as n, sharedRelationName as o, searchColumnDefinition as p, quoteSqlLiteral as r, SEARCH_STAMP_PREFIX as s, columnPgType as t, buildSearchColumnSpec as u, searchIndexNames as v, visibleColumnProjection as x, searchIndexStatements as y };
+
+//# sourceMappingURL=plan-schema-Hgl62S-w.js.map