@rebasepro/server-postgres 0.19.1 → 0.19.2-canary.g09316f6

package/dist/generate-postgres-ddl-logic-CtnpIBVv.js

@@ -1,1312 +0,0 @@
-import { createRequire as __createRequire } from "module";
-__createRequire(import.meta.url);
-import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
-import { i as isAuthCollection, n as authUsersColumnDefinition, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
-import { a as vectorDimensionGuard, c as vectorExtensionStatement, d as vectorObjectNames, i as vectorColumnDefinition, n as buildVectorColumnSpecs, o as vectorExtensionDeclared, r as buildVectorIndexPlan, t as VECTOR_EXTENSION_OPT_IN, u as vectorIndexStatements } from "./vector-index-DkWxm2de.js";
-import { i as collectionIndexStatements, n as buildCollectionIndexSpecs } from "./collection-index-BHgT_TKd.js";
-import { DEFAULT_FUZZY_THRESHOLD, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_WEIGHT, REBASE_SCHEMA, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
-import { findRelation, getEffectiveSecurityRules, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getTableName, policyToPostgres, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, resolveStringColumnLength, securityRuleToConditions } from "@rebasepro/common";
-import { generateForeignKeyName, getPolicyNamesForRule, legacyForeignKeyName, toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "node:crypto";
-//#region src/schema/search-column.ts
-/**
-* The one place a collection's `search` block becomes SQL.
-*
-* Four things describe a Postgres table in this codebase — the DDL generator,
-* the Drizzle schema generator, the runtime table builder for BaaS mode, and
-* the boot-time schema ensure — and each of them has, at some point, described
-* a column differently from the others. The `varchar(255)` note in
-* `generate-postgres-ddl-logic` is one such scar: the same property produced a
-* capped column down one path and an uncapped one down the other, and nothing
-* failed until a user hit the cap.
-*
-* So the search column is not implemented four times. It is computed once,
-* here, and every generator renders the same {@link SearchColumnSpec}. There is
-* a test asserting exactly that (`search-column-contract.test.ts`); the point of
-* this module is that the test has something to assert *about*.
-*
-* ## Why the expressions look the way they do
-*
-* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
-* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
-*
-* | expression                              | immutable |
-* |-----------------------------------------|-----------|
-* | `to_tsvector('spanish', col)`           | yes       |
-* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
-* | `array_to_string(col, ' ')`             | **no**    |
-* | `col::text` on `text[]`                 | **no**    |
-* | `to_jsonb(col)`                         | **no**    |
-* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
-* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
-* | `setweight(...) || setweight(...)`      | yes       |
-*
-* Three of the four things a real search column needs are therefore unavailable
-* directly, which is why {@link searchHelperFunctions} exists: each wraps a
-* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
-* promise, and it is a true one for these three — array joining, JSON string
-* extraction and accent folding are all deterministic for a given input; the
-* built-ins are marked stable only because they must account for element types
-* and dictionaries in general.
-*
-* The alternative was to skip `unaccent` and text arrays entirely. That is not
-* a real option in an accented language: Postgres stems `auditoría` to
-* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
-* typed without accents misses every row that carries them.
-*/
-/** Schema-qualified so a collection outside `public` still resolves them. */
-var HELPER_SCHEMA = "public";
-/**
-* Names of the helper functions. Frozen: they are recorded in the stored
-* generation expression of every search column ever created, so renaming one
-* orphans every table that already has a search column.
-*/
-var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
-var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
-/** Raised when a `search` block names something that cannot be searched. */
-var SearchConfigError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SearchConfigError";
-	}
-};
-/** The `search` block of a collection, or undefined when it has none. */
-var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
-/**
-* Refuse a `search` block on a collection this engine does not store.
-*
-* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
-* already stops the ordinary case. This catches the rest — a JS config, a cast,
-* a collection whose `engine` was changed after the block was written — because
-* the alternative is the exact failure the block exists to prevent: a developer
-* who declared what to index, saw no error, and got the substring fallback.
-*
-* Called with *every* collection, before the Postgres ones are filtered out.
-*/
-var assertSearchIsPostgresOnly = (collections) => {
-	for (const collection of collections) {
-		if (isPostgresCollectionConfig(collection)) continue;
-		if (!collection.search) continue;
-		const engine = collection.engine ?? "non-postgres";
-		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
-	}
-};
-var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
-/**
-* Classify a property for search purposes.
-*
-* Deliberately narrower than `getSqlColumnType`: search only cares whether a
-* value reaches text, and the mapping from property to *physical* type is
-* asserted against `getSqlColumnType` in the contract test rather than
-* duplicated here.
-*
-* Returns null for anything that is not text-bearing, which the caller turns
-* into a boot error naming the property.
-*/
-var classify = (prop) => {
-	switch (prop.type) {
-		case "string": {
-			const sp = prop;
-			if (sp.enum) return {
-				kind: "text",
-				reason: "enum"
-			};
-			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
-				kind: "text",
-				reason: "uuid"
-			};
-			return { kind: "text" };
-		}
-		case "map":
-			if (prop.columnType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			return { kind: "jsonb" };
-		case "array": {
-			const ap = prop;
-			let colType = ap.columnType;
-			if (!colType && ap.of && !Array.isArray(ap.of)) {
-				const of = ap.of;
-				if (of.type === "string") colType = "text[]";
-				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
-				else if (of.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "text[]") return { kind: "text_array" };
-			if (colType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
-				kind: "text_array",
-				reason: "non_text_array"
-			};
-			return { kind: "jsonb" };
-		}
-		default: return null;
-	}
-};
-var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
-/** SQL reading one field as plain text, before normalization. */
-var rawTextSql = (field) => {
-	const col = `"${field.column}"`;
-	if (field.kind === "text") return `coalesce(${col}, '')`;
-	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
-	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
-};
-var quote = (v) => `'${v.replace(/'/g, "''")}'`;
-/**
-* Resolve and validate one declared field path.
-*
-* A path that does not resolve throws. The whole point of an explicit block is
-* that the author knows what is indexed; a silently dropped field would make it
-* a guess again, and the failure — a search that returns nothing for content
-* that is plainly in the row — is invisible from the outside.
-*/
-var resolveField = (entry, collection, cfg) => {
-	const path = typeof entry === "string" ? entry : entry.path;
-	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? DEFAULT_SEARCH_WEIGHT;
-	const where = `${collection.slug}.search`;
-	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
-	const [head, ...rest] = path.split(".");
-	const prop = collection.properties?.[head];
-	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
-	const classified = classify(prop);
-	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
-	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
-	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
-	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
-	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
-	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
-	const column = columnNameOf(head, prop);
-	const textSql = normalize(rawTextSql({
-		column,
-		jsonPath: rest,
-		kind: classified.kind
-	}), cfg.unaccent === true);
-	const language = cfg.language ?? DEFAULT_SEARCH_LANGUAGE;
-	return {
-		path,
-		column,
-		jsonPath: rest,
-		kind: classified.kind,
-		weight,
-		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
-		textSql
-	};
-};
-/**
-* Build the full spec for a collection, or undefined when it has not opted in.
-*
-* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
-* at boot surface that as a startup failure — a search block that half-works is
-* worse than one that refuses.
-*/
-var buildSearchColumnSpec = (collection) => {
-	const cfg = getSearchConfig(collection);
-	if (!cfg) return void 0;
-	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
-	const table = getTableName(collection);
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const column = cfg.column ?? DEFAULT_SEARCH_COLUMN;
-	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
-	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
-	const seen = /* @__PURE__ */ new Set();
-	for (const f of fields) {
-		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
-		seen.add(f.path);
-	}
-	const extensions = [];
-	if (cfg.unaccent) extensions.push("unaccent");
-	if (cfg.fuzzy) extensions.push("pg_trgm");
-	const spec = {
-		schema,
-		table,
-		column,
-		language: cfg.language ?? DEFAULT_SEARCH_LANGUAGE,
-		unaccent: cfg.unaccent === true,
-		fields,
-		expression: fields.map((f) => f.sql).join(" || "),
-		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
-		extensions
-	};
-	if (cfg.fuzzy) {
-		const fuzzyColumn = `${column}_text`;
-		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
-		spec.fuzzy = {
-			column: fuzzyColumn,
-			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
-			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
-			threshold: cfg.fuzzyThreshold ?? DEFAULT_FUZZY_THRESHOLD
-		};
-	}
-	return spec;
-};
-/**
-* The IMMUTABLE wrappers the generated expressions call.
-*
-* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
-* than an error, and idempotent for the same reason every other boot-time DDL
-* statement here is.
-*
-* The bodies are stable built-ins wrapped in an immutable promise — see the
-* module comment for why that promise is sound. `STRICT` matters: it makes NULL
-* in mean NULL out without executing the body, which is what the `coalesce` at
-* each call site then absorbs.
-*/
-var searchHelperFunctions = (spec) => {
-	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
-	if (spec.unaccent) statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
-	return statements;
-};
-/**
-* `CREATE EXTENSION` statements the spec's expressions depend on.
-*
-* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
-* `CREATE EXTENSION` installs into the first schema on `search_path`, which
-* defaults to `"$user", public` — and the scaffold's database role is named
-* `rebase`, the same as the schema the generator creates one statement earlier.
-* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
-* dictionary in `rebase`, and every reference to `public.unaccent` below fails
-* with "text search dictionary does not exist". Observed, not theorised.
-*/
-var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
-/** The column definition as it appears inside `CREATE TABLE`. */
-var searchColumnDefinition = (spec) => `"${spec.column}" tsvector GENERATED ALWAYS AS (${spec.expression}) STORED`;
-/** The fuzzy column definition, when the spec asks for one. */
-var fuzzyColumnDefinition = (spec) => spec.fuzzy ? `"${spec.fuzzy.column}" text GENERATED ALWAYS AS (${spec.fuzzy.expression}) STORED` : void 0;
-/**
-* Index statements for the spec.
-*
-* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
-* SQL file replayed as one unit — a migration, or `search.sql` — where a
-* concurrent build is not allowed. The boot-time ensure path runs statement by
-* statement against tables that are live and populated, and uses the
-* concurrent form instead; see `ensureSearchColumns`.
-*/
-var searchIndexStatements = (spec) => {
-	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
-	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
-	return statements;
-};
-/**
-* Marker on the comment of every generated search column this module creates.
-*
-* Versioned because the fingerprint below is only comparable against itself: a
-* future change to how it is computed has to read as "not stamped by this
-* version" rather than as drift on every existing column.
-*/
-var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
-/**
-* A stable fingerprint of one generated column's expression.
-*
-* Why a stamp rather than reading the expression back: Postgres stores a
-* generated column's expression *parsed*, and hands it back deparsed — casts
-* made explicit, identifiers requoted, schema qualifications added or dropped
-* according to `search_path`. Comparing that text to the text we generated
-* would report drift on wording, and this comparison decides whether a boot
-* refuses, so a false positive is an outage. The stamp is written by the same
-* code that writes the column, so equality means what it says.
-*/
-var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
-/**
-* The stamps for a spec's generated columns — one per column, never shared.
-*
-* Per column on purpose: turning `fuzzy` on adds a second column and changes
-* nothing about the first, and a spec-wide fingerprint would report the
-* untouched `tsvector` column as drifted and refuse a boot over a change that
-* is purely additive.
-*/
-var searchColumnStamps = (spec) => {
-	const stamp = (column, expression) => {
-		const fingerprint = searchExpressionFingerprint(expression);
-		return {
-			column,
-			expression,
-			fingerprint,
-			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
-		};
-	};
-	const stamps = [stamp(spec.column, spec.expression)];
-	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
-	return stamps;
-};
-/**
-* The same drift check as the boot ensure, for the SQL file.
-*
-* Needed because {@link searchColumnStamps} would otherwise *launder* drift on
-* the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
-* exists, so a re-generated `search.sql` would stamp a stale column with the
-* new block's fingerprint and the next boot would find them in agreement.
-* Guarding first means the file refuses instead — `rebase db push` is attended,
-* and the operator reading the failure is the person who changed the block.
-*/
-var searchStampGuards = (spec) => searchColumnStamps(spec).map((stamp) => {
-	const relation = quote(`"${spec.schema}"."${spec.table}"`);
-	return `DO $rebase_search$
-DECLARE recorded text;
-BEGIN
-    SELECT col_description(a.attrelid, a.attnum) INTO recorded
-    FROM pg_attribute a
-    WHERE a.attrelid = ${relation}::regclass AND a.attname = ${quote(stamp.column)} AND NOT a.attisdropped;
-    IF recorded LIKE ${quote(`${SEARCH_STAMP_PREFIX}%`)} AND recorded <> ${quote(stamp.fingerprint)} THEN
-        RAISE EXCEPTION 'Rebase: the search block for ${spec.schema}.${spec.table} changed after the generated column "${stamp.column}" was built (recorded %, expected ${stamp.fingerprint}). Postgres cannot alter a generated expression in place. Drop the column and re-apply this file — it rewrites the table and rebuilds the index: ALTER TABLE ${relation.slice(1, -1)} DROP COLUMN "${stamp.column}";', recorded;
-    END IF;
-END
-$rebase_search$;`;
-});
-/**
-* The index names the spec creates.
-*
-* Needed by name, not just by statement, so Atlas can be told to exclude them
-* from its diff — see `searchExcludePatterns`.
-*/
-var searchIndexNames = (spec) => spec.fuzzy ? [spec.indexName, spec.fuzzy.indexName] : [spec.indexName];
-/**
-* The generated column names a collection's search block adds, if any.
-*
-* These are physical columns on the table, so `SELECT *` returns them. They are
-* an index in column form — a list of lexeme positions, or a concatenation of
-* every searchable field on the row — and nothing outside the query planner has
-* any use for them. Left in, every list response carries a second, larger copy
-* of the row's text.
-*/
-var searchColumnNames = (collection) => {
-	let spec;
-	try {
-		spec = buildSearchColumnSpec(collection);
-	} catch {
-		return [];
-	}
-	if (!spec) return [];
-	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
-};
-/**
-* True for a column whose type only ever holds a search index.
-*
-* Independent of any collection config on purpose: an introspected database
-* (BaaS mode) can carry a `tsvector` column this framework never created —
-* Pagila's `film.fulltext` is the canonical one — and it should not be returned
-* to callers either. `isDerivedIndexColumn` already keeps such a column out of
-* the *properties*; this keeps it out of the *rows*.
-*/
-var isSearchIndexColumn = (column) => {
-	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
-	return sqlType === "tsvector" || sqlType === "tsquery";
-};
-/**
-* A drizzle select projection over `table` with the search columns dropped.
-*
-* Returns undefined when nothing needs dropping, so the common case keeps using
-* a plain `select()` and this stays invisible in the generated SQL.
-*/
-var visibleColumnProjection = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (!tableColumns || excluded.length === 0) return void 0;
-	const projection = {};
-	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
-	return projection;
-};
-/** The same exclusion as a drizzle `db.query` `columns` denylist. */
-var hiddenColumnsOption = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (excluded.length === 0) return void 0;
-	return Object.fromEntries(excluded.map((name) => [name, false]));
-};
-/**
-* The columns to keep out of a response, by name.
-*
-* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
-* for anything that is not a real drizzle table — a stub in a test, a derived
-* or nested path with no table behind it. Nothing to exclude is the right
-* answer there, and it has to be an answer rather than a throw: this runs on
-* the read path of every collection, opted in or not.
-*/
-var excludedColumnNames = (tableColumns, collection) => {
-	if (!tableColumns || typeof tableColumns !== "object") return [];
-	const byName = new Set(collection ? searchColumnNames(collection) : []);
-	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
-};
-//#endregion
-//#region src/schema/generate-postgres-ddl-logic.ts
-var generate_postgres_ddl_logic_exports = /* @__PURE__ */ __exportAll({
-	defaultBelongsToOnDelete: () => defaultBelongsToOnDelete,
-	generatePolicyStatements: () => generatePolicyStatements,
-	generatePostgresDdl: () => generatePostgresDdl,
-	generatePostgresPoliciesDdl: () => generatePostgresPoliciesDdl,
-	generatePostgresSearchDdl: () => generatePostgresSearchDdl,
-	generatePostgresVectorDdl: () => generatePostgresVectorDdl,
-	getPrimaryKeyName: () => getPrimaryKeyName,
-	getPrimaryKeyProp: () => getPrimaryKeyProp,
-	getSqlColumnType: () => getSqlColumnType,
-	isIdProperty: () => isIdProperty,
-	isNumericId: () => isNumericId,
-	planCollectionPolicies: () => planCollectionPolicies,
-	planJunctionTables: () => planJunctionTables,
-	planRelationalColumns: () => planRelationalColumns,
-	quoteSqlLiteral: () => quoteSqlLiteral,
-	resolveColumnName: () => resolveColumnName,
-	searchExcludePatterns: () => searchExcludePatterns,
-	vectorExcludePatterns: () => vectorExcludePatterns
-});
-var resolveColumnName = (propName, prop) => {
-	if (prop && "columnName" in prop && typeof prop.columnName === "string") return prop.columnName;
-	return toSnakeCase(propName);
-};
-var getPrimaryKeyProp = (collection) => {
-	if (collection.properties) {
-		const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in prop && Boolean(prop.isId));
-		if (idPropEntry) {
-			const prop = idPropEntry[1];
-			const isUuid = prop.type === "string" && "isId" in prop && prop.isId === "uuid";
-			return {
-				name: idPropEntry[0],
-				type: prop.type === "number" ? "number" : "string",
-				isUuid
-			};
-		}
-	}
-	const idProp = collection.properties?.["id"];
-	if (idProp?.type === "number") return {
-		name: "id",
-		type: "number",
-		isUuid: false
-	};
-	return {
-		name: "id",
-		type: "string",
-		isUuid: idProp?.type === "string" && "isId" in idProp && idProp.isId === "uuid"
-	};
-};
-var isNumericId = (collection) => {
-	return getPrimaryKeyProp(collection).type === "number";
-};
-var getPrimaryKeyName = (collection) => {
-	return getPrimaryKeyProp(collection).name;
-};
-/** The column type a junction holds for one endpoint's primary key. */
-var junctionKeyType = (collection) => isNumericId(collection) ? "INTEGER" : getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT";
-var isIdProperty = (propName, prop, collection) => {
-	if ("isId" in prop && Boolean(prop.isId)) return true;
-	return !Object.values(collection.properties ?? {}).some((p) => "isId" in p && Boolean(p.isId)) && propName === "id";
-};
-/**
-* Render statements produced by {@link generatePolicyStatements} back into the
-* exact string the DDL/policies files have always carried: each statement on
-* its own line, terminated by a newline. Keeping the string form derived from
-* the statement array means the two can never drift — the boot-time applier and
-* the generated `policies.sql` emit the same SQL, from the same source.
-*/
-var statementsToDdl = (statements) => statements.map((s) => `${s}\n`).join("");
-/**
-* The `ON DELETE` a foreign key gets when the author did not say.
-*
-* One rule for every property that emits one — `belongsTo` relations and
-* `reference` properties alike. `reference` kept its own `CASCADE` default for
-* a release after this rule was written, which is exactly the split this
-* function exists to prevent: two spellings of the same link, two data-retention
-* behaviours, and only one of them documented.
-*
-* An optional link is `SET NULL`: the column can hold NULL, so dropping the
-* parent leaves the child row with an empty pointer, which is what "optional"
-* already means.
-*
-* A required link is **`RESTRICT`**, not `CASCADE`. `NOT NULL` says the child
-* cannot exist without a parent; it does not say deleting the parent should
-* take the child with it. That second claim is a data-retention decision, and
-* defaulting to it meant `onDelete` — a field nobody has to write — silently
-* turned every `DELETE FROM authors` into a cascade through posts, comments and
-* anything else that hung off them. `RESTRICT` fails the delete instead and
-* names the constraint, so the author chooses `cascade` on purpose or clears
-* the children first.
-*
-* Both DDL paths — the `CREATE TABLE` generator and {@link planRelationalColumns},
-* which boot-ensure compares the live database against — call this, so a
-* default that appears in one and not the other cannot make `db push` plan a
-* constraint rewrite on every run.
-*/
-var defaultBelongsToOnDelete = (required) => required ? "RESTRICT" : "SET NULL";
-var generatePolicyDdl = (collection, rule, resolveCollection) => statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
-/**
-* The individual SQL statements a single security rule compiles to: a
-* `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
-* statement (terminated by `;`, no trailing newline).
-*
-* This is the primitive the boot-time RLS applier runs one statement at a time
-* (the runtime's DB handle speaks the extended query protocol, which forbids
-* multiple commands in one execute), while `db push` writes the joined string.
-*/
-var generatePolicyStatements = (collection, rule, resolveCollection) => {
-	const tableName = getTableName(collection);
-	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const policyNames = getPolicyNamesForRule(rule, tableName);
-	return ops.flatMap((op, opIdx) => {
-		return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
-	});
-};
-var generateSinglePolicyStatements = (collection, rule, operation, policyName, resolveCollection) => {
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const tableName = getTableName(collection);
-	const mode = (rule.mode ?? "permissive").toUpperCase();
-	const operationUpper = operation.toUpperCase();
-	const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
-	const needsUsing = operation !== "insert";
-	const needsWithCheck = operation !== "select" && operation !== "delete";
-	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-	let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
-	let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
-	if (!usingClause && needsUsing) usingClause = "false";
-	if (!withCheckClause && needsWithCheck) withCheckClause = "false";
-	const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
-	let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map((r) => `"${r}"`).join(", ")}`;
-	if (usingClause) create += ` USING (${usingClause})`;
-	if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
-	create += ";";
-	return [drop, create];
-};
-/**
-* Single-quote escaping for a SQL string literal (PostgreSQL doubles the
-* quote). Enum labels come straight from user-authored collection config, so a
-* label like `it's` closes the literal early and the whole generated file stops
-* parsing at the `CREATE TYPE`. Lives here rather than next to its other caller
-* because ensure-collection-tables already imports from this module — the
-* reverse would be a cycle.
-*/
-var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
-var getSqlColumnType = (propName, prop, collection, collections) => {
-	switch (prop.type) {
-		case "string": {
-			const stringProp = prop;
-			if (stringProp.enum) {
-				const tableName = getTableName(collection);
-				const colName = resolveColumnName(propName, prop);
-				return `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${tableName}_${colName}"`;
-			}
-			if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") return "UUID";
-			if (stringProp.columnType === "char") return `CHAR(${resolveStringColumnLength(stringProp)})`;
-			if (stringProp.columnType === "varchar") return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
-			return "TEXT";
-		}
-		case "number": {
-			const numProp = prop;
-			const isId = isIdProperty(propName, prop, collection);
-			if ("isId" in numProp && numProp.isId === "increment") return "INTEGER GENERATED BY DEFAULT AS IDENTITY";
-			if (numProp.columnType) {
-				if (numProp.columnType === "double precision") return "DOUBLE PRECISION";
-				return numProp.columnType.toUpperCase();
-			}
-			return numProp.validation?.integer || isId ? "INTEGER" : "NUMERIC";
-		}
-		case "boolean": return "BOOLEAN";
-		case "date": {
-			const dateProp = prop;
-			if (dateProp.columnType === "date") return "DATE";
-			if (dateProp.columnType === "time") return "TIME";
-			return "TIMESTAMP WITH TIME ZONE";
-		}
-		case "map": return prop.columnType === "json" ? "JSON" : "JSONB";
-		case "geopoint": return "JSONB";
-		case "array": {
-			const arrayProp = prop;
-			let colType = arrayProp.columnType;
-			if (!colType && arrayProp.of && !Array.isArray(arrayProp.of)) {
-				const ofProp = arrayProp.of;
-				if (ofProp.type === "string") colType = "text[]";
-				else if (ofProp.type === "number") colType = ofProp.validation?.integer ? "integer[]" : "numeric[]";
-				else if (ofProp.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "json") return "JSON";
-			if (colType === "text[]") return "TEXT[]";
-			if (colType === "integer[]") return "INTEGER[]";
-			if (colType === "boolean[]") return "BOOLEAN[]";
-			if (colType === "numeric[]") return "NUMERIC[]";
-			return "JSONB";
-		}
-		case "vector": return `VECTOR(${prop.dimensions})`;
-		case "binary": return "BYTEA";
-		case "relation": {
-			const refProp = prop;
-			const relation = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-			if (relation?.kind !== "belongsTo") throw new Error(`Relation ${propName} does not put a column on this table (only \`belongsTo\` does)`);
-			let targetCollection;
-			try {
-				targetCollection = relation.target();
-			} catch {
-				return "TEXT";
-			}
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
-		}
-		case "reference": {
-			const refProp = prop;
-			const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-			if (!targetCollection) return "TEXT";
-			const pkProp = getPrimaryKeyProp(targetCollection);
-			return pkProp.type === "number" ? "INTEGER" : pkProp.isUuid ? "UUID" : "TEXT";
-		}
-		default: throw new Error(`No Postgres column type for property '${propName}' of type '${prop.type}' in collection '${collection.slug}'. Add a case to \`getSqlColumnType\` (and to \`getDrizzleColumn\`, which must agree).`);
-	}
-};
-/**
-* Everything a `search` block needs, as a file Rebase applies itself.
-*
-* Search is the one part of the schema Atlas does not own. Two independent
-* reasons, and either alone would be enough:
-*
-* 1. Its free tier refuses to *parse* a desired-state file that so much as
-*    contains a function — "functions and procedures are available to
-*    logged-in users only". A generated `tsvector` column cannot avoid one:
-*    `unaccent` is STABLE and jsonb flattening needs a set-returning function,
-*    so both have to be wrapped in an IMMUTABLE helper to be legal in a
-*    generated column at all.
-* 2. Even with the file accepted, Atlas *wipes* the dev database it diffs
-*    against, so a helper seeded there beforehand is gone by the time the plan
-*    is analysed. There is no hook to reinstate it.
-*
-* So the column, its index and its helpers are excluded from Atlas's view
-* (`searchExcludePatterns`) and applied from here — the same arrangement the
-* RLS policies already use, and for the same underlying reason.
-*
-* Ordered as it must run: extensions, then helpers, then the column whose
-* expression calls them, then the index over that column. Every statement is
-* `IF NOT EXISTS` / `OR REPLACE`, because this is replayed on every push and
-* appended to migrations that run against databases at any stage of their
-* life. Empty when nothing opted in — the caller writes no file then.
-*
-* The dev database Atlas plans against needs none of this. `searchExcludePatterns`
-* removes the search column from the *inspected* state, so the state Atlas
-* replays there never mentions the column and never calls a helper. Seeding the
-* helpers into that database was tried and removed: measured on Atlas 1.2.3, a
-* `schema apply --dry-run` produces byte-identical output seeded or not, and
-* Atlas wipes the dev database before it plans anyway — so a seed could not have
-* helped even where the excludes are missing, which is the case that really does
-* fail with `function public.rebase_search_unaccent(text) does not exist`.
-*/
-var generatePostgresSearchDdl = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const specs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
-	if (specs.length === 0) return "";
-	const extensions = Array.from(new Set(specs.flatMap(searchExtensionStatements)));
-	const helpers = Array.from(new Set(specs.flatMap(searchHelperFunctions)));
-	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n";
-	ddl += "--\n";
-	ddl += "-- Full-text search for the collections declaring a `search` block.\n";
-	ddl += "-- Applied by Rebase, not by Atlas — see generatePostgresSearchDdl.\n\n";
-	extensions.forEach((s) => {
-		ddl += `${s}\n`;
-	});
-	if (extensions.length > 0) ddl += "\n";
-	helpers.forEach((s) => {
-		ddl += `${s}\n\n`;
-	});
-	for (const collection of collections) {
-		const spec = buildSearchColumnSpec(collection);
-		if (!spec) continue;
-		const table = `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${getTableName(collection)}"`;
-		searchStampGuards(spec).forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${searchColumnDefinition(spec)};\n`;
-		const fuzzyDef = fuzzyColumnDefinition(spec);
-		if (fuzzyDef) ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${fuzzyDef};\n`;
-		searchColumnStamps(spec).forEach((s) => {
-			ddl += `${s.sql}\n`;
-		});
-		searchIndexStatements(spec).forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		ddl += "\n";
-	}
-	return ddl;
-};
-/**
-* Glob patterns telling Atlas to leave the search column and its index alone.
-*
-* Without these, a desired state that omits search reads to Atlas as an
-* instruction to drop the column — taking the index and the whole search
-* feature with it on the next push.
-*
-* Fully qualified, `schema.table.object`, matching the include list. The
-* two-part form is what Atlas wants when the connection URL scopes it to one
-* schema and is *silently ignored* otherwise: it reads `posts.search_vector`
-* as a table named `search_vector` in a schema named `posts`, matches nothing,
-* and reports no error for the pattern that never fired.
-*/
-var searchExcludePatterns = (allCollections) => {
-	const patterns = [];
-	for (const collection of relationalCollections(allCollections)) {
-		const spec = buildSearchColumnSpec(collection);
-		if (!spec) continue;
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const table = getTableName(collection);
-		for (const name of searchColumnNames(collection)) patterns.push(`${schema}.${table}.${name}`);
-		for (const index of searchIndexNames(spec)) patterns.push(`${schema}.${table}.${index}`);
-	}
-	return patterns;
-};
-/**
-* Everything a `{ type: "vector" }` property needs, as a file Rebase applies
-* itself.
-*
-* Vector is the second part of the schema Atlas does not own, and it is out for
-* a narrower reason than search: not that Atlas refuses to parse the file, but
-* that it cannot *execute* it. To compute a desired state Atlas materialises
-* `schema.sql` in a dev database, that database is created empty, and Atlas
-* empties it again at the start of every run — so `VECTOR(384)` resolves
-* against a database that structurally cannot have pgvector, and every push
-* dies with `type "vector" does not exist`. Seeding the extension beforehand
-* does not survive the clean (measured: present before the run, gone after),
-* putting `CREATE EXTENSION` in `schema.sql` is refused as an Atlas Pro
-* feature, and `--exclude` alone cannot help because Atlas still parses and
-* applies the whole file.
-*
-* So the column, its ANN indexes and the extension are excluded from Atlas's
-* view ({@link vectorExcludePatterns}) and applied from here — the same
-* arrangement search and the RLS policies already use.
-*
-* `CREATE EXTENSION` appears only when the project's database named `vector` in
-* its `extensions` — see `DatabaseOptions.extensions`. Everything else is
-* emitted either way: a database that already has pgvector installed by hand
-* needs no permission from anyone, and one that does not gets the column
-* refused by Postgres with a message this repo makes name the opt-in.
-*
-* Ordered as it must run: the extension, then the drift guard, then the column
-* whose type needs the extension, then the indexes over that column. Every
-* statement is `IF NOT EXISTS`, because this is replayed on every push and
-* appended to migrations that run against databases at any stage of their life.
-* Empty when no collection declares a vector — the caller writes no file then.
-*/
-var generatePostgresVectorDdl = (allCollections, options = {}) => {
-	const withVectors = relationalCollections(allCollections).filter((c) => buildVectorColumnSpecs(c, resolveColumnName).length > 0);
-	if (withVectors.length === 0) return "";
-	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n";
-	ddl += "--\n";
-	ddl += "-- Vector columns and their ANN indexes, for the collections declaring a\n";
-	ddl += "-- `vector` property. Applied by Rebase, not by Atlas — see\n";
-	ddl += "-- generatePostgresVectorDdl.\n\n";
-	ddl += vectorExtensionDeclared(options.extensions) ? `${vectorExtensionStatement()}\n\n` : `-- pgvector is not installed from here: no database declared it. To let Rebase\n-- install it, add ${VECTOR_EXTENSION_OPT_IN} in config/resources.ts.\n-- Otherwise install it once by hand; the column below needs the type either way.\n\n`;
-	for (const collection of withVectors) {
-		const table = `"${isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public"}"."${getTableName(collection)}"`;
-		for (const spec of buildVectorColumnSpecs(collection, resolveColumnName)) {
-			ddl += `${vectorDimensionGuard(spec)}\n`;
-			ddl += `ALTER TABLE ${table} ADD COLUMN IF NOT EXISTS ${vectorColumnDefinition(spec)};\n`;
-		}
-		const plan = buildVectorIndexPlan(collection, resolveColumnName);
-		vectorIndexStatements(plan).forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		for (const skip of plan.skipped) ddl += `-- No ANN index on "${skip.schema}"."${skip.table}"."${skip.column}": ${skip.reason}\n`;
-		ddl += "\n";
-	}
-	return ddl;
-};
-/**
-* Glob patterns telling Atlas to leave the vector column and its ANN indexes
-* alone.
-*
-* Without these, a desired state that omits the column reads to Atlas as an
-* instruction to drop it, taking the embeddings and the indexes with it on the
-* next push.
-*
-* Fully qualified, `schema.table.object`, for the reason spelled out on
-* {@link searchExcludePatterns}: the two-part form matches nothing and reports
-* no error, which turns a protection into a `DROP COLUMN`.
-*/
-var vectorExcludePatterns = (allCollections) => {
-	const patterns = [];
-	for (const collection of relationalCollections(allCollections)) {
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const table = getTableName(collection);
-		for (const name of vectorObjectNames(collection, resolveColumnName)) patterns.push(`${schema}.${table}.${name}`);
-	}
-	return patterns;
-};
-var generatePostgresDdl = async (allCollections, options = {
-	includePolicies: true,
-	includeSearch: true,
-	includeVector: true
-}) => {
-	const collections = relationalCollections(allCollections);
-	let ddl = "-- This file is auto-generated by the Rebase DDL generator. Do not edit manually.\n\n";
-	const uniqueSchemas = Array.from(/* @__PURE__ */ new Set([REBASE_SCHEMA, ...collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)]));
-	uniqueSchemas.forEach((schema) => {
-		if (schema) ddl += `CREATE SCHEMA IF NOT EXISTS "${schema}";\n`;
-	});
-	if (uniqueSchemas.length > 0) ddl += "\n";
-	const searchSpecs = collections.map((c) => buildSearchColumnSpec(c)).filter((s) => s !== void 0);
-	if (searchSpecs.length > 0) if (options.includeSearch === false) ddl += "-- Full-text search support lives in `search.sql`, applied separately.\n\n";
-	else {
-		const extensions = Array.from(new Set(searchSpecs.flatMap(searchExtensionStatements)));
-		const helpers = Array.from(new Set(searchSpecs.flatMap(searchHelperFunctions)));
-		ddl += "-- Full-text search support (collections declaring a `search` block)\n";
-		extensions.forEach((s) => {
-			ddl += `${s}\n`;
-		});
-		if (extensions.length > 0) ddl += "\n";
-		helpers.forEach((s) => {
-			ddl += `${s}\n\n`;
-		});
-	}
-	if (options.includeVector === false && collections.some((c) => buildVectorColumnSpecs(c, resolveColumnName).length > 0)) ddl += "-- Vector columns and their ANN indexes live in `vector.sql`, applied separately.\n\n";
-	const emittedEnums = /* @__PURE__ */ new Set();
-	collections.forEach((collection) => {
-		const collectionTable = getTableName(collection);
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-			if ("enum" in prop && (prop.type === "string" || prop.type === "number") && prop.enum) {
-				const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;
-				const values = Array.isArray(prop.enum) ? prop.enum.map((v) => String(typeof v === "object" && v !== null && "id" in v ? v.id : v)) : Object.keys(prop.enum);
-				if (values.length > 0 && !emittedEnums.has(`${schema}.${enumDbName}`)) {
-					emittedEnums.add(`${schema}.${enumDbName}`);
-					ddl += `CREATE TYPE "${schema}"."${enumDbName}" AS ENUM (${values.map(quoteSqlLiteral).join(", ")});\n`;
-				}
-			}
-		});
-	});
-	if (ddl.endsWith(";\n")) ddl += "\n";
-	const junctionSpecs = resolveJunctionSpecs(collections);
-	const allTablesToGenerate = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (tableName) allTablesToGenerate.set(tableName, { collection });
-		const resolvedRelations = resolveCollectionRelations(collection);
-		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
-			const junctionTableName = relation.through.table;
-			if (!allTablesToGenerate.has(junctionTableName)) allTablesToGenerate.set(junctionTableName, {
-				collection: {
-					table: junctionTableName,
-					properties: {}
-				},
-				isJunction: true,
-				relation,
-				sourceCollection: collection
-			});
-		}
-	}
-	const fkStatements = [];
-	const indexStatements = [];
-	const policyStatements = [];
-	for (const [tableName, { collection, isJunction, relation, sourceCollection }] of allTablesToGenerate.entries()) {
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-		if (isJunction && relation && sourceCollection && isManyToMany(relation)) {
-			const targetCollection = relation.target();
-			const sourceTable = getTableName(sourceCollection);
-			const targetTable = getTableName(targetCollection);
-			const sourceSchema = isPostgresCollectionConfig(sourceCollection) && sourceCollection.schema ? sourceCollection.schema : "public";
-			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-			const { sourceColumn, targetColumn } = relation.through;
-			const sourceColType = isNumericId(sourceCollection) ? "INTEGER" : getPrimaryKeyProp(sourceCollection).isUuid ? "UUID" : "TEXT";
-			const targetColType = isNumericId(targetCollection) ? "INTEGER" : getPrimaryKeyProp(targetCollection).isUuid ? "UUID" : "TEXT";
-			const sourceId = getPrimaryKeyName(sourceCollection);
-			const targetId = getPrimaryKeyName(targetCollection);
-			const onDelete = relation.onDelete ?? "CASCADE";
-			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
-			ddl += `  "${sourceColumn}" ${sourceColType} NOT NULL,\n`;
-			ddl += `  "${targetColumn}" ${targetColType} NOT NULL,\n`;
-			ddl += `  PRIMARY KEY ("${sourceColumn}", "${targetColumn}")\n`;
-			ddl += `);\n\n`;
-			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${sourceColumn}_fkey`)}" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
-			fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${targetColumn}_fkey`)}" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-			if (options.includePolicies) {
-				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-				ddl += `\n`;
-				const spec = junctionSpecs.get(baseTableName);
-				if (spec) {
-					const junctionCollection = getJunctionCollectionConfig(spec);
-					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-					getJunctionSecurityRules(spec).forEach((rule) => {
-						policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
-					});
-				}
-			}
-		} else if (!isJunction) {
-			ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
-			const columns = [];
-			Object.entries(collection.properties ?? {}).forEach(([propName, prop]) => {
-				if (prop.type === "vector" && options.includeVector === false) return;
-				if (prop.type === "relation") {
-					const refProp = prop;
-					const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-					if (relInfo?.kind !== "belongsTo") return;
-					if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) return;
-					let targetCollection;
-					try {
-						targetCollection = relInfo.target();
-					} catch {
-						return;
-					}
-					const targetTable = getTableName(targetCollection);
-					const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-					const targetId = getPrimaryKeyName(targetCollection);
-					const fkColType = getSqlColumnType(propName, prop, collection, collections);
-					const onUpdate = relInfo.onUpdate ? ` ON UPDATE ${relInfo.onUpdate.toUpperCase()}` : "";
-					const required = prop.validation?.required;
-					const onDeleteVal = relInfo.onDelete ?? defaultBelongsToOnDelete(required);
-					let colDef = `  "${relInfo.localKey}" ${fkColType}`;
-					if (required) colDef += " NOT NULL";
-					columns.push(colDef);
-					fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${relInfo.localKey}_fkey`)}" FOREIGN KEY ("${relInfo.localKey}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDeleteVal.toUpperCase()}${onUpdate};`);
-				} else if (prop.type === "reference") {
-					const refProp = prop;
-					const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-					const colName = resolveColumnName(propName, prop);
-					const colType = getSqlColumnType(propName, prop, collection, collections);
-					const required = prop.validation?.required;
-					if (!targetCollection) {
-						let colDef = `  "${colName}" ${colType}`;
-						if (required) colDef += " NOT NULL";
-						columns.push(colDef);
-					} else {
-						const targetTable = getTableName(targetCollection);
-						const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
-						const targetId = getPrimaryKeyName(targetCollection);
-						const onDelete = defaultBelongsToOnDelete(required);
-						let colDef = `  "${colName}" ${colType}`;
-						if (required) colDef += " NOT NULL";
-						columns.push(colDef);
-						fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${toPostgresIdentifier(`${baseTableName}_${colName}_fkey`)}" FOREIGN KEY ("${colName}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-					}
-				} else {
-					const colName = resolveColumnName(propName, prop);
-					const authDefinition = isAuthCollection(collection) ? authUsersColumnDefinition(colName) : void 0;
-					if (authDefinition && !isIdProperty(propName, prop, collection)) {
-						columns.push(`  "${colName}" ${authDefinition}`);
-						return;
-					}
-					let colDef = `  "${colName}" ${getSqlColumnType(propName, prop, collection, collections)}`;
-					if (isIdProperty(propName, prop, collection)) colDef += " PRIMARY KEY";
-					if ("isId" in prop && prop.isId !== "manual" && prop.isId !== true && prop.isId !== "increment") {
-						if (prop.isId === "uuid") colDef += " DEFAULT gen_random_uuid()";
-						else if (prop.isId === "cuid") colDef += " DEFAULT cuid()";
-						else if (typeof prop.isId === "string") colDef += ` DEFAULT ${prop.isId}`;
-					}
-					if (!isIdProperty(propName, prop, collection) && prop.validation?.unique) colDef += " UNIQUE";
-					if (prop.type === "date") {
-						const dateProp = prop;
-						if (dateProp.autoValue === "on_create" || dateProp.autoValue === "on_update") colDef += " DEFAULT now()";
-					}
-					if (prop.validation?.required && !colDef.includes("PRIMARY KEY")) colDef += " NOT NULL";
-					columns.push(colDef);
-				}
-			});
-			if (isAuthCollection(collection)) {
-				const declared = new Set(Object.entries(collection.properties ?? {}).map(([name, prop]) => resolveColumnName(name, prop)));
-				for (const spec of AUTH_USERS_COLUMNS) {
-					if (declared.has(spec.column)) continue;
-					columns.push(`  "${spec.column}" ${authUsersColumnSql(spec)}`);
-				}
-			}
-			const searchSpec = options.includeSearch === false ? void 0 : buildSearchColumnSpec(collection);
-			if (searchSpec) {
-				columns.push(`  ${searchColumnDefinition(searchSpec)}`);
-				const fuzzyDef = fuzzyColumnDefinition(searchSpec);
-				if (fuzzyDef) columns.push(`  ${fuzzyDef}`);
-				indexStatements.push(...searchIndexStatements(searchSpec));
-			}
-			if (options.includeVector !== false) {
-				const vectorPlan = buildVectorIndexPlan(collection, resolveColumnName);
-				indexStatements.push(...vectorIndexStatements(vectorPlan));
-				for (const skip of vectorPlan.skipped) indexStatements.push(`-- No ANN index on "${skip.schema}"."${skip.table}"."${skip.column}": ${skip.reason}`);
-			}
-			indexStatements.push(...collectionIndexStatements(buildCollectionIndexSpecs(collection, resolveColumnName)));
-			if (!columns.some((c) => c.includes("PRIMARY KEY"))) columns.unshift("  \"id\" TEXT PRIMARY KEY");
-			ddl += columns.join(",\n");
-			ddl += `\n);\n\n`;
-			if (options.includePolicies) {
-				ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-				ddl += `\n`;
-				const securityRules = getEffectiveSecurityRules(collection);
-				if (securityRules.length > 0) {
-					const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-					securityRules.forEach((rule) => {
-						policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
-					});
-				}
-			}
-		}
-	}
-	if (indexStatements.length > 0) {
-		ddl += "-- Indexes\n";
-		ddl += indexStatements.join("\n") + "\n\n";
-	}
-	if (fkStatements.length > 0) {
-		ddl += "-- Foreign Key Constraints\n";
-		ddl += fkStatements.join("\n") + "\n\n";
-	}
-	if (policyStatements.length > 0) {
-		ddl += "-- Row Level Security Policies\n";
-		ddl += policyStatements.join("");
-		ddl += "\n";
-	}
-	return ddl;
-};
-var schemaOfCollection = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
-/**
-* Truncate a derived identifier the way Postgres does: to 63 bytes, silently.
-*
-* This is not cosmetic, and not really a naming choice at all — it is agreeing
-* with the name the database ALREADY stored. `ADD CONSTRAINT` on a longer name
-* succeeds and records the truncated form, so the untruncated name this used to
-* derive matched nothing in the catalogue. Boot-ensure compares its planned
-* constraints against `readExistingSchema`, which reads catalogue names, so the
-* comparison could never hit: every boot re-issued `ADD CONSTRAINT` for the same
-* constraint, forever, and got "already exists" every time. Non-fatal (foreign
-* keys are the one action allowed to fail) and therefore permanent — an error in
-* the log on every restart of a project whose table and column names happened to
-* be long.
-*
-* Byte length, not string length: NAMEDATALEN is 64 bytes, and a multi-byte
-* character straddling the boundary would be cut mid-sequence by `slice(0, 63)`.
-*/
-var foreignKeyPlan = (args) => {
-	const constraintName = toPostgresIdentifier(`${args.table}_${args.column}_fkey`);
-	const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
-	return {
-		constraintName,
-		schema: args.schema,
-		table: args.table,
-		column: args.column,
-		targetSchema: args.targetSchema,
-		targetTable: args.targetTable,
-		targetColumn: args.targetColumn,
-		sql: `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
-	};
-};
-/**
-* The FK columns the declared collections own — one entry per `relation`
-* (`belongsTo` side) or `reference` property.
-*
-* Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
-* create the same columns with the same names, types and constraints. Before
-* this it skipped them outright, which was survivable only because `db push`
-* always followed; on a managed tenant nothing follows, so a table arrived
-* without the column its own collection reads and wrote 400 on every insert.
-*
-* A relation whose target is not in the bundle yields no column at all (the
-* generator returns early on an unresolvable target); a `reference` whose target
-* is unknown yields the column without a constraint. Both mirror the generator
-* exactly — a divergence here is a schema fork between boot and `db push`.
-*/
-var planRelationalColumns = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const plans = [];
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (!tableName) continue;
-		const schema = schemaOfCollection(collection);
-		const table = bareTableName(tableName);
-		for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
-			const prop = rawProp;
-			if (prop.type === "relation") {
-				const refProp = prop;
-				const relInfo = findRelation(resolveCollectionRelations(collection), refProp.relation?.relationName ?? propName);
-				if (relInfo?.kind !== "belongsTo") continue;
-				if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
-				let targetCollection;
-				try {
-					targetCollection = relInfo.target();
-				} catch {
-					continue;
-				}
-				if (!targetCollection) continue;
-				const required = prop.validation?.required;
-				const relationName = refProp.relation?.relationName ?? propName;
-				const legacyKey = legacyForeignKeyName(relationName);
-				const derived = relInfo.localKey === generateForeignKeyName(relationName);
-				plans.push({
-					schema,
-					table,
-					column: relInfo.localKey,
-					legacyColumn: derived && legacyKey !== relInfo.localKey ? legacyKey : void 0,
-					type: getSqlColumnType(propName, prop, collection, collections),
-					foreignKey: foreignKeyPlan({
-						schema,
-						table,
-						column: relInfo.localKey,
-						targetSchema: schemaOfCollection(targetCollection),
-						targetTable: bareTableName(getTableName(targetCollection)),
-						targetColumn: getPrimaryKeyName(targetCollection),
-						onDelete: relInfo.onDelete ?? defaultBelongsToOnDelete(required),
-						onUpdate: relInfo.onUpdate
-					})
-				});
-			} else if (prop.type === "reference") {
-				const refProp = prop;
-				const targetCollection = collections.find((c) => c.slug === refProp.path || getTableName(c) === refProp.path);
-				const column = resolveColumnName(propName, prop);
-				const type = getSqlColumnType(propName, prop, collection, collections);
-				const required = prop.validation?.required;
-				plans.push({
-					schema,
-					table,
-					column,
-					type,
-					foreignKey: targetCollection ? foreignKeyPlan({
-						schema,
-						table,
-						column,
-						targetSchema: schemaOfCollection(targetCollection),
-						targetTable: bareTableName(getTableName(targetCollection)),
-						targetColumn: getPrimaryKeyName(targetCollection),
-						onDelete: defaultBelongsToOnDelete(required)
-					}) : void 0
-				});
-			}
-		}
-	}
-	return plans;
-};
-/**
-* The junction tables a bundle's many-to-many relations imply.
-*
-* Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
-* comes from, so a table created here always has policies planned for it — a
-* junction with row-level security left off is readable and writable by every
-* signed-in user, which is why the two must ship together.
-*/
-var planJunctionTables = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const plans = [];
-	for (const spec of resolveJunctionSpecs(collections).values()) {
-		const [source, target] = spec.endpoints;
-		const legacyFor = (endpoint) => {
-			const slug = toSnakeCase(endpoint.collection.slug ?? endpoint.collection.name ?? "");
-			const legacy = legacyForeignKeyName(slug);
-			return endpoint.junctionColumn === generateForeignKeyName(slug) && legacy !== endpoint.junctionColumn ? legacy : void 0;
-		};
-		const columns = [{
-			name: source.junctionColumn,
-			type: junctionKeyType(source.collection),
-			legacyName: legacyFor(source)
-		}, {
-			name: target.junctionColumn,
-			type: junctionKeyType(target.collection),
-			legacyName: legacyFor(target)
-		}];
-		const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
-		plans.push({
-			schema: spec.schema,
-			table: spec.table,
-			columns,
-			createTable: `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` + columns.map((c) => `"${c.name}" ${c.type} NOT NULL`).join(", ") + `, PRIMARY KEY (${columns.map((c) => `"${c.name}"`).join(", ")}));`,
-			foreignKeys: [source, target].map((endpoint, i) => foreignKeyPlan({
-				schema: spec.schema,
-				table: spec.table,
-				column: columns[i].name,
-				targetSchema: schemaOfCollection(endpoint.collection),
-				targetTable: bareTableName(getTableName(endpoint.collection)),
-				targetColumn: getPrimaryKeyName(endpoint.collection),
-				onDelete
-			}))
-		});
-	}
-	return plans;
-};
-/**
-* The per-table RLS plan for the *declared* collections, as executable
-* statements — what the managed runtime applies at boot so a freshly
-* provisioned tenant database serves data instead of 401ing every read.
-*
-* Mirrors {@link generatePostgresPoliciesDdl} exactly (same
-* `generatePolicyStatements`, same enable-RLS, same effective rules, same
-* derived junction rules), so boot and `db push` produce identical policies from
-* identical collections.
-*
-* Junction tables are included, and have to be: boot creates them now
-* ({@link planJunctionTables}), and a junction with RLS left off is readable and
-* writable by every signed-in user. A junction whose table is still absent is
-* skipped by the applier, not planned away here.
-*/
-var planCollectionPolicies = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-	const plans = [];
-	const seen = /* @__PURE__ */ new Set();
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (!tableName) continue;
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-		const qualified = `${schema}.${baseTableName}`;
-		if (seen.has(qualified)) continue;
-		seen.add(qualified);
-		const policyStatements = [];
-		for (const rule of getEffectiveSecurityRules(collection)) policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
-		plans.push({
-			schema,
-			table: baseTableName,
-			qualified,
-			enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
-			policyStatements
-		});
-	}
-	for (const spec of resolveJunctionSpecs(collections).values()) {
-		const qualified = `${spec.schema}.${spec.table}`;
-		if (seen.has(qualified)) continue;
-		seen.add(qualified);
-		const junctionCollection = getJunctionCollectionConfig(spec);
-		const policyStatements = [];
-		for (const rule of getJunctionSecurityRules(spec)) policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
-		plans.push({
-			schema: spec.schema,
-			table: spec.table,
-			qualified,
-			enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
-			policyStatements
-		});
-	}
-	return plans;
-};
-var generatePostgresPoliciesDdl = (allCollections) => {
-	const collections = relationalCollections(allCollections);
-	let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
-	const allTablesToGenerate = /* @__PURE__ */ new Map();
-	for (const collection of collections) {
-		const tableName = getTableName(collection);
-		if (tableName) allTablesToGenerate.set(tableName, { collection });
-	}
-	for (const [tableName, { collection }] of allTablesToGenerate.entries()) {
-		const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-		const baseTableName = tableName.includes(".") ? tableName.split(".").pop() : tableName;
-		ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-		ddl += `\n`;
-		const securityRules = getEffectiveSecurityRules(collection);
-		if (securityRules.length > 0) {
-			const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-			const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
-			securityRules.forEach((rule) => {
-				if (rule.name && injectedNames.has(rule.name)) {
-					ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
-					ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
-				}
-				ddl += generatePolicyDdl(collection, rule, resolveCollection);
-			});
-			ddl += "\n";
-		}
-	}
-	const junctionSpecs = resolveJunctionSpecs(collections);
-	for (const spec of junctionSpecs.values()) {
-		ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
-		ddl += `\n`;
-		const junctionRules = getJunctionSecurityRules(spec);
-		if (junctionRules.length === 0) continue;
-		const junctionCollection = getJunctionCollectionConfig(spec);
-		const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
-		const declaringSlugs = spec.declaringSides.map((s) => s.collection.slug).join("\", \"");
-		ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
-		ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
-		ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
-		ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
-		junctionRules.forEach((rule) => {
-			ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
-		});
-		ddl += "\n";
-	}
-	return ddl;
-};
-//#endregion
-export { searchIndexStatements as C, searchHelperFunctions as S, assertSearchIsPostgresOnly as _, generatePostgresVectorDdl as a, searchColumnStamps as b, isIdProperty as c, planRelationalColumns as d, quoteSqlLiteral as f, SEARCH_UNACCENT_FN as g, SEARCH_TEXT_FN as h, generatePostgresSearchDdl as i, planCollectionPolicies as l, SEARCH_STAMP_PREFIX as m, generatePostgresDdl as n, generate_postgres_ddl_logic_exports as o, resolveColumnName as p, generatePostgresPoliciesDdl as r, getSqlColumnType as s, defaultBelongsToOnDelete as t, planJunctionTables as u, buildSearchColumnSpec as v, visibleColumnProjection as w, searchExtensionStatements as x, hiddenColumnsOption as y };
-
-//# sourceMappingURL=generate-postgres-ddl-logic-CtnpIBVv.js.map