@rebasepro/server-postgres 0.22.0 → 0.24.0

package/dist/{plan-schema-CboAIwLN.js → plan-schema-DU9exq6C.js}

@@ -1,446 +1,13 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
-import { a as getPrimaryKeyName, c as isIdProperty, i as enumLabelsOf, l as resolveColumnName, o as getPrimaryKeyProp, r as declaresEnumType, s as idColumnDefault, t as assertSinglePrimaryKey } from "./column-plan-helpers-CpILzHJS.js";
-import { i as isAuthCollection, n as authUsersColumnDefinition, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-D2LBFrMH.js";
+import { a as buildSearchColumnSpec, d as searchColumnTypeSql, f as searchExtensionStatements, i as assertSearchIsPostgresOnly, p as searchHelperFunctions } from "./search-column-BM-GV6vH.js";
+import { a as getPrimaryKeyName, c as isIdProperty, i as getPrimaryKeyColumn, l as primaryKeyPropertyNames, n as declaresEnumType, o as getPrimaryKeyProp, r as enumLabelsOf, s as idColumnDefault, u as resolveColumnName } from "./column-plan-helpers-1-LQD0yI.js";
+import { i as isAuthCollection, n as authUsersColumnDefinition, r as authUsersColumnSql, t as AUTH_USERS_COLUMNS } from "./auth-users-columns-C72EMoDJ.js";
 import { c as vectorExtensionStatement, n as buildVectorColumnSpecs, o as vectorExtensionDeclared, r as buildVectorIndexPlan } from "./vector-index-CMJKb3C9.js";
 import { a as deriveIndexName, t as buildCollectionIndexSpecs } from "./collection-index-DdnsxiJ_.js";
-import { DEFAULT_FUZZY_THRESHOLD, DEFAULT_SEARCH_COLUMN, DEFAULT_SEARCH_LANGUAGE, DEFAULT_SEARCH_MODE, DEFAULT_SEARCH_WEIGHT, REBASE_SCHEMA, hasForeignKeyOnTarget, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
-import { TENANT_INDEX_REASON, assertBeforeQueryIsPostgresOnly, fieldKeyForColumn, findRelation, getEffectiveSecurityRules, getEnumVarName, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getTableName, getTableVarName, getTenantConfig, policyToPostgres, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, resolveStringColumnLength, securityRuleToConditions } from "@rebasepro/common";
-import { generateForeignKeyName, getPolicyNamesForRule, legacyForeignKeyName, toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "node:crypto";
-//#region src/schema/search-column.ts
-/**
-* The one place a collection's `search` block becomes SQL.
-*
-* Four things describe a Postgres table in this codebase — the DDL generator,
-* the Drizzle schema generator, the runtime table builder for BaaS mode, and
-* the boot-time schema ensure — and each of them has, at some point, described
-* a column differently from the others. The `varchar(255)` note in
-* `generate-postgres-ddl-logic` is one such scar: the same property produced a
-* capped column down one path and an uncapped one down the other, and nothing
-* failed until a user hit the cap.
-*
-* So the search column is not implemented four times. It is computed once,
-* here, and every generator renders the same {@link SearchColumnSpec}. There is
-* a test asserting exactly that (`search-column-contract.test.ts`); the point of
-* this module is that the test has something to assert *about*.
-*
-* ## Why the expressions look the way they do
-*
-* A `GENERATED ALWAYS AS … STORED` expression must be strictly IMMUTABLE, and
-* Postgres is stricter here than intuition. Verified against PostgreSQL 18:
-*
-* | expression                              | immutable |
-* |-----------------------------------------|-----------|
-* | `to_tsvector('spanish', col)`           | yes       |
-* | `to_tsvector(col)` (1-arg)              | **no** — depends on `default_text_search_config` |
-* | `array_to_string(col, ' ')`             | **no**    |
-* | `col::text` on `text[]`                 | **no**    |
-* | `to_jsonb(col)`                         | **no**    |
-* | `unaccent(col)`                         | **no** — dictionary lookup is STABLE |
-* | `jsonb_to_tsvector('spanish', j, '["string"]')` | yes |
-* | `setweight(...) || setweight(...)`      | yes       |
-*
-* Three of the four things a real search column needs are therefore unavailable
-* directly, which is why {@link searchHelperFunctions} exists: each wraps a
-* stable built-in in an SQL function declared IMMUTABLE. That declaration is a
-* promise, and it is a true one for these three — array joining, JSON string
-* extraction and accent folding are all deterministic for a given input; the
-* built-ins are marked stable only because they must account for element types
-* and dictionaries in general.
-*
-* The alternative was to skip `unaccent` and text arrays entirely. That is not
-* a real option in an accented language: Postgres stems `auditoría` to
-* `auditor` and `auditoria` to `auditori` — *different lexemes* — so a query
-* typed without accents misses every row that carries them.
-*/
-/** Schema-qualified so a collection outside `public` still resolves them. */
-var HELPER_SCHEMA = "public";
-/**
-* Names of the helper functions. Frozen: they are recorded in the stored
-* generation expression of every search column ever created, so renaming one
-* orphans every table that already has a search column.
-*/
-var SEARCH_TEXT_FN = `${HELPER_SCHEMA}.rebase_search_text`;
-var SEARCH_UNACCENT_FN = `${HELPER_SCHEMA}.rebase_search_unaccent`;
-/** Raised when a `search` block names something that cannot be searched. */
-var SearchConfigError = class extends Error {
-	constructor(message) {
-		super(message);
-		this.name = "SearchConfigError";
-	}
-};
-/** The `search` block of a collection, or undefined when it has none. */
-var getSearchConfig = (collection) => isPostgresCollectionConfig(collection) ? collection.search : void 0;
-/**
-* Refuse a `search` block on a collection this engine does not store.
-*
-* The type only permits one on a `PostgresCollectionConfig`, so TypeScript
-* already stops the ordinary case. This catches the rest — a JS config, a cast,
-* a collection whose `engine` was changed after the block was written — because
-* the alternative is the exact failure the block exists to prevent: a developer
-* who declared what to index, saw no error, and got the substring fallback.
-*
-* Called with *every* collection, before the Postgres ones are filtered out.
-*/
-var assertSearchIsPostgresOnly = (collections) => {
-	for (const collection of collections) {
-		if (isPostgresCollectionConfig(collection)) continue;
-		if (!collection.search) continue;
-		const engine = collection.engine ?? "non-postgres";
-		throw new SearchConfigError(`${collection.slug}.search: full-text search is a Postgres feature, and this collection is served by \`${engine}\`. Remove the block — it would otherwise look configured while \`.search()\` kept using the default substring match.`);
-	}
-};
-var columnNameOf = (propName, prop) => prop && "columnName" in prop && typeof prop.columnName === "string" ? prop.columnName : toSnakeCase(propName);
-/**
-* Classify a property for search purposes.
-*
-* Deliberately narrower than the schema plan's `PgType`: search only cares
-* whether a value reaches text, and the mapping from property to *physical*
-* type is asserted against the plan in the contract test rather than duplicated
-* here.
-*
-* Returns null for anything that is not text-bearing, which the caller turns
-* into a boot error naming the property.
-*/
-var classify = (prop) => {
-	switch (prop.type) {
-		case "string": {
-			const sp = prop;
-			if (sp.enum) return {
-				kind: "text",
-				reason: "enum"
-			};
-			if (sp.isId === "uuid" || sp.columnType === "uuid") return {
-				kind: "text",
-				reason: "uuid"
-			};
-			return { kind: "text" };
-		}
-		case "map":
-			if (prop.columnType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			return { kind: "jsonb" };
-		case "array": {
-			const ap = prop;
-			let colType = ap.columnType;
-			if (!colType && ap.of && !Array.isArray(ap.of)) {
-				const of = ap.of;
-				if (of.type === "string") colType = "text[]";
-				else if (of.type === "number") colType = of.validation?.integer ? "integer[]" : "numeric[]";
-				else if (of.type === "boolean") colType = "boolean[]";
-			}
-			if (colType === "text[]") return { kind: "text_array" };
-			if (colType === "json") return {
-				kind: "jsonb",
-				reason: "json"
-			};
-			if (colType === "integer[]" || colType === "boolean[]" || colType === "numeric[]") return {
-				kind: "text_array",
-				reason: "non_text_array"
-			};
-			return { kind: "jsonb" };
-		}
-		default: return null;
-	}
-};
-var normalize = (inner, unaccent) => unaccent ? `${SEARCH_UNACCENT_FN}(${inner})` : inner;
-/** SQL reading one field as plain text, before normalization. */
-var rawTextSql = (field) => {
-	const col = `"${field.column}"`;
-	if (field.kind === "text") return `coalesce(${col}, '')`;
-	if (field.kind === "text_array") return `${SEARCH_TEXT_FN}(coalesce(${col}, '{}'::text[]))`;
-	return `${SEARCH_TEXT_FN}(coalesce(${field.jsonPath.length === 0 ? col : field.jsonPath.length === 1 ? `${col} -> ${quote(field.jsonPath[0])}` : `${col} #> ${quote(`{${field.jsonPath.join(",")}}`)}`}, '{}'::jsonb))`;
-};
-var quote = (v) => `'${v.replace(/'/g, "''")}'`;
-/**
-* Resolve and validate one declared field path.
-*
-* A path that does not resolve throws. The whole point of an explicit block is
-* that the author knows what is indexed; a silently dropped field would make it
-* a guess again, and the failure — a search that returns nothing for content
-* that is plainly in the row — is invisible from the outside.
-*/
-var resolveField = (entry, collection, cfg) => {
-	const path = typeof entry === "string" ? entry : entry.path;
-	const weight = (typeof entry === "string" ? void 0 : entry.weight) ?? DEFAULT_SEARCH_WEIGHT;
-	const where = `${collection.slug}.search`;
-	if (!path || typeof path !== "string") throw new SearchConfigError(`${where}: every entry in \`fields\` needs a property path.`);
-	const [head, ...rest] = path.split(".");
-	const prop = collection.properties?.[head];
-	if (!prop) throw new SearchConfigError(`${where}: "${path}" starts at property "${head}", which this collection does not declare. Known properties: ${Object.keys(collection.properties ?? {}).join(", ")}.`);
-	const classified = classify(prop);
-	if (!classified) throw new SearchConfigError(`${where}: "${path}" is a \`${prop.type}\` property, which holds no text to search. Searchable kinds are \`string\`, \`string[]\` and \`map\` (or a path inside one).`);
-	if (classified.reason === "enum") throw new SearchConfigError(`${where}: "${path}" is an enum. Enums are a fixed vocabulary — filter on them with \`where\` instead, which is exact and uses an index.`);
-	if (classified.reason === "uuid") throw new SearchConfigError(`${where}: "${path}" is a UUID column. Look it up by id rather than searching it.`);
-	if (classified.reason === "json") throw new SearchConfigError(`${where}: "${path}" is a \`json\` column, and the cast from \`json\` to \`jsonb\` is not immutable, so it cannot feed a generated column. Declare the property as \`jsonb\` (the default) to search it.`);
-	if (classified.reason === "non_text_array") throw new SearchConfigError(`${where}: "${path}" is an array of numbers or booleans. Only \`string[]\` carries text to search.`);
-	if (rest.length > 0 && classified.kind !== "jsonb") throw new SearchConfigError(`${where}: "${path}" addresses a path inside "${head}", but "${head}" is a \`${prop.type}\` property, not a \`map\`. Only map properties have paths inside them.`);
-	const column = columnNameOf(head, prop);
-	const raw = rawTextSql({
-		column,
-		jsonPath: rest,
-		kind: classified.kind
-	});
-	const textSql = normalize(raw, cfg.unaccent === true);
-	const language = cfg.language ?? DEFAULT_SEARCH_LANGUAGE;
-	return {
-		path,
-		column,
-		jsonPath: rest,
-		kind: classified.kind,
-		weight,
-		sql: `setweight(to_tsvector(${quote(language)}, ${textSql}), ${quote(weight)})`,
-		textSql,
-		foldedTextSql: normalize(raw, true)
-	};
-};
-/**
-* Build the full spec for a collection, or undefined when it has not opted in.
-*
-* Throws {@link SearchConfigError} on a config that cannot be honoured. Callers
-* at boot surface that as a startup failure — a search block that half-works is
-* worse than one that refuses.
-*/
-var buildSearchColumnSpec = (collection) => {
-	const cfg = getSearchConfig(collection);
-	if (!cfg) return void 0;
-	if (!Array.isArray(cfg.fields) || cfg.fields.length === 0) throw new SearchConfigError(`${collection.slug}.search: \`fields\` is empty. Name the properties to index, or remove the \`search\` block to keep the default ILIKE behaviour.`);
-	const table = getTableName(collection);
-	const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
-	const column = cfg.column ?? DEFAULT_SEARCH_COLUMN;
-	if (collection.properties?.[column]) throw new SearchConfigError(`${collection.slug}.search: the generated column "${column}" collides with a declared property of the same name. Set \`search.column\` to something else.`);
-	const fields = cfg.fields.map((entry) => resolveField(entry, collection, cfg));
-	const seen = /* @__PURE__ */ new Set();
-	for (const f of fields) {
-		if (seen.has(f.path)) throw new SearchConfigError(`${collection.slug}.search: "${f.path}" is listed twice.`);
-		seen.add(f.path);
-	}
-	const mode = cfg.mode ?? DEFAULT_SEARCH_MODE;
-	const extensions = [];
-	if (cfg.unaccent || mode === "hybrid") extensions.push("unaccent");
-	if (cfg.fuzzy) extensions.push("pg_trgm");
-	const spec = {
-		schema,
-		table,
-		column,
-		language: cfg.language ?? DEFAULT_SEARCH_LANGUAGE,
-		unaccent: cfg.unaccent === true,
-		mode,
-		fields,
-		expression: fields.map((f) => f.sql).join(" || "),
-		indexName: toPostgresIdentifier(`${table}_${column}_gin`),
-		extensions
-	};
-	if (cfg.fuzzy) {
-		const fuzzyColumn = `${column}_text`;
-		if (collection.properties?.[fuzzyColumn]) throw new SearchConfigError(`${collection.slug}.search: \`fuzzy\` needs the column "${fuzzyColumn}", which collides with a declared property. Set \`search.column\` to something else.`);
-		spec.fuzzy = {
-			column: fuzzyColumn,
-			expression: fields.map((f) => f.textSql).join(" || ' ' || "),
-			indexName: toPostgresIdentifier(`${table}_${fuzzyColumn}_trgm`),
-			threshold: cfg.fuzzyThreshold ?? DEFAULT_FUZZY_THRESHOLD
-		};
-	}
-	return spec;
-};
-/**
-* The IMMUTABLE wrappers the generated expressions call.
-*
-* `CREATE OR REPLACE` so a boot against an existing database is a no-op rather
-* than an error, and idempotent for the same reason every other boot-time DDL
-* statement here is.
-*
-* The bodies are stable built-ins wrapped in an immutable promise — see the
-* module comment for why that promise is sound. `STRICT` matters: it makes NULL
-* in mean NULL out without executing the body, which is what the `coalesce` at
-* each call site then absorbs.
-*/
-var searchHelperFunctions = (spec) => {
-	const statements = [`CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(text[]) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT array_to_string($1, ' ') $$;`, `CREATE OR REPLACE FUNCTION ${SEARCH_TEXT_FN}(jsonb) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT coalesce(string_agg(v, ' '), '')\n       FROM jsonb_array_elements_text(jsonb_path_query_array($1, 'strict $.**?(@.type() == "string")')) AS v $$;`];
-	if (spec.unaccent || spec.mode === "hybrid") statements.push(`CREATE OR REPLACE FUNCTION ${SEARCH_UNACCENT_FN}(text) RETURNS text\n    LANGUAGE sql IMMUTABLE STRICT PARALLEL SAFE AS\n    $$ SELECT ${HELPER_SCHEMA}.unaccent('${HELPER_SCHEMA}.unaccent'::regdictionary, $1) $$;`);
-	return statements;
-};
-/**
-* `CREATE EXTENSION` statements the spec's expressions depend on.
-*
-* `WITH SCHEMA public` is load-bearing, not tidiness. An unqualified
-* `CREATE EXTENSION` installs into the first schema on `search_path`, which
-* defaults to `"$user", public` — and the scaffold's database role is named
-* `rebase`, the same as the schema the generator creates one statement earlier.
-* So the moment that schema exists, `CREATE EXTENSION unaccent` puts the
-* dictionary in `rebase`, and every reference to `public.unaccent` below fails
-* with "text search dictionary does not exist". Observed, not theorised.
-*/
-var searchExtensionStatements = (spec) => spec.extensions.map((e) => `CREATE EXTENSION IF NOT EXISTS ${e} WITH SCHEMA ${HELPER_SCHEMA};`);
-/**
-* Everything after the column name — the type and the generation expression.
-*
-* Split out because four emitters need it and only two of them have a place to
-* put the name: `CREATE TABLE` and `ADD COLUMN` write `"col" <this>`, while the
-* schema plan carries it as the column's SQL definition and the boot-time
-* rebuild statement interpolates it on its own.
-*/
-var searchColumnTypeSql = (expression, kind) => `${kind} GENERATED ALWAYS AS (${expression}) STORED`;
-/** The column definition as it appears inside `CREATE TABLE`. */
-var searchColumnDefinition = (spec) => `"${spec.column}" ${searchColumnTypeSql(spec.expression, "tsvector")}`;
-/** The fuzzy column definition, when the spec asks for one. */
-var fuzzyColumnDefinition = (spec) => spec.fuzzy ? `"${spec.fuzzy.column}" ${searchColumnTypeSql(spec.fuzzy.expression, "text")}` : void 0;
-/**
-* Index statements for the spec.
-*
-* `CONCURRENTLY` is deliberately *not* used here. This form is emitted into a
-* SQL file replayed as one unit — a migration, or `search.sql` — where a
-* concurrent build is not allowed. The boot-time ensure path runs statement by
-* statement against tables that are live and populated, and uses the
-* concurrent form instead; see `ensureSearchColumns`.
-*/
-var searchIndexStatements = (spec) => {
-	const statements = [`CREATE INDEX IF NOT EXISTS "${spec.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.column}");`];
-	if (spec.fuzzy) statements.push(`CREATE INDEX IF NOT EXISTS "${spec.fuzzy.indexName}" ON "${spec.schema}"."${spec.table}" USING GIN ("${spec.fuzzy.column}" ${HELPER_SCHEMA}.gin_trgm_ops);`);
-	return statements;
-};
-/**
-* Marker on the comment of every generated search column this module creates.
-*
-* Versioned because the fingerprint below is only comparable against itself: a
-* future change to how it is computed has to read as "not stamped by this
-* version" rather than as drift on every existing column.
-*/
-var SEARCH_STAMP_PREFIX = "rebase:search:v1:";
-/**
-* A stable fingerprint of one generated column's expression.
-*
-* Why a stamp rather than reading the expression back: Postgres stores a
-* generated column's expression *parsed*, and hands it back deparsed — casts
-* made explicit, identifiers requoted, schema qualifications added or dropped
-* according to `search_path`. Comparing that text to the text we generated
-* would report drift on wording, and this comparison decides whether a boot
-* refuses, so a false positive is an outage. The stamp is written by the same
-* code that writes the column, so equality means what it says.
-*/
-var searchExpressionFingerprint = (expression) => `${SEARCH_STAMP_PREFIX}${createHash("sha256").update(expression).digest("hex").slice(0, 16)}`;
-/**
-* The stamps for a spec's generated columns — one per column, never shared.
-*
-* Per column on purpose: turning `fuzzy` on adds a second column and changes
-* nothing about the first, and a spec-wide fingerprint would report the
-* untouched `tsvector` column as drifted and refuse a boot over a change that
-* is purely additive.
-*/
-var searchColumnStamps = (spec) => {
-	const stamp = (column, expression) => {
-		const fingerprint = searchExpressionFingerprint(expression);
-		return {
-			column,
-			expression,
-			fingerprint,
-			sql: `COMMENT ON COLUMN "${spec.schema}"."${spec.table}"."${column}" IS ${quote(fingerprint)};`
-		};
-	};
-	const stamps = [stamp(spec.column, spec.expression)];
-	if (spec.fuzzy) stamps.push(stamp(spec.fuzzy.column, spec.fuzzy.expression));
-	return stamps;
-};
-/**
-* The same drift check as the boot ensure, for the SQL file.
-*
-* Needed because {@link searchColumnStamps} would otherwise *launder* drift on
-* the migration path: `ADD COLUMN IF NOT EXISTS` does nothing to a column that
-* exists, so a re-generated `search.sql` would stamp a stale column with the
-* new block's fingerprint and the next boot would find them in agreement.
-* Guarding first means the file refuses instead — `rebase db push` is attended,
-* and the operator reading the failure is the person who changed the block.
-*/
-var searchStampGuards = (spec) => searchColumnStamps(spec).map((stamp) => {
-	const relation = quote(`"${spec.schema}"."${spec.table}"`);
-	return `DO $rebase_search$
-DECLARE recorded text;
-BEGIN
-    SELECT col_description(a.attrelid, a.attnum) INTO recorded
-    FROM pg_attribute a
-    WHERE a.attrelid = ${relation}::regclass AND a.attname = ${quote(stamp.column)} AND NOT a.attisdropped;
-    IF recorded LIKE ${quote(`${SEARCH_STAMP_PREFIX}%`)} AND recorded <> ${quote(stamp.fingerprint)} THEN
-        RAISE EXCEPTION 'Rebase: the search block for ${spec.schema}.${spec.table} changed after the generated column "${stamp.column}" was built (recorded %, expected ${stamp.fingerprint}). Postgres cannot alter a generated expression in place. Drop the column and re-apply this file — it rewrites the table and rebuilds the index: ALTER TABLE ${relation.slice(1, -1)} DROP COLUMN "${stamp.column}";', recorded;
-    END IF;
-END
-$rebase_search$;`;
-});
-/**
-* The index names the spec creates.
-*
-* Needed by name, not just by statement, so Atlas can be told to exclude them
-* from its diff — see `searchExcludePatterns`.
-*/
-var searchIndexNames = (spec) => spec.fuzzy ? [spec.indexName, spec.fuzzy.indexName] : [spec.indexName];
-/**
-* The generated column names a collection's search block adds, if any.
-*
-* These are physical columns on the table, so `SELECT *` returns them. They are
-* an index in column form — a list of lexeme positions, or a concatenation of
-* every searchable field on the row — and nothing outside the query planner has
-* any use for them. Left in, every list response carries a second, larger copy
-* of the row's text.
-*/
-var searchColumnNames = (collection) => {
-	let spec;
-	try {
-		spec = buildSearchColumnSpec(collection);
-	} catch {
-		return [];
-	}
-	if (!spec) return [];
-	return spec.fuzzy ? [spec.column, spec.fuzzy.column] : [spec.column];
-};
-/**
-* True for a column whose type only ever holds a search index.
-*
-* Independent of any collection config on purpose: an introspected database
-* (BaaS mode) can carry a `tsvector` column this framework never created —
-* Pagila's `film.fulltext` is the canonical one — and it should not be returned
-* to callers either. `isDerivedIndexColumn` already keeps such a column out of
-* the *properties*; this keeps it out of the *rows*.
-*/
-var isSearchIndexColumn = (column) => {
-	const sqlType = typeof column?.getSQLType === "function" ? column.getSQLType().toLowerCase() : "";
-	return sqlType === "tsvector" || sqlType === "tsquery";
-};
-/**
-* A drizzle select projection over `table` with the search columns dropped.
-*
-* Returns undefined when nothing needs dropping, so the common case keeps using
-* a plain `select()` and this stays invisible in the generated SQL.
-*/
-var visibleColumnProjection = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (!tableColumns || excluded.length === 0) return void 0;
-	const projection = {};
-	for (const [name, column] of Object.entries(tableColumns)) if (!excluded.includes(name)) projection[name] = column;
-	return projection;
-};
-/** The same exclusion as a drizzle `db.query` `columns` denylist. */
-var hiddenColumnsOption = (tableColumns, collection) => {
-	const excluded = excludedColumnNames(tableColumns, collection);
-	if (excluded.length === 0) return void 0;
-	return Object.fromEntries(excluded.map((name) => [name, false]));
-};
-/**
-* The columns to keep out of a response, by name.
-*
-* `tableColumns` is whatever `getTableColumns` returned, which is `undefined`
-* for anything that is not a real drizzle table — a stub in a test, a derived
-* or nested path with no table behind it. Nothing to exclude is the right
-* answer there, and it has to be an answer rather than a throw: this runs on
-* the read path of every collection, opted in or not.
-*/
-var excludedColumnNames = (tableColumns, collection) => {
-	if (!tableColumns || typeof tableColumns !== "object") return [];
-	const byName = new Set(collection ? searchColumnNames(collection) : []);
-	return Object.keys(tableColumns).filter((name) => byName.has(name) || isSearchIndexColumn(tableColumns[name]));
-};
-//#endregion
+import { REBASE_SCHEMA, hasForeignKeyOnTarget, isManyToMany, isPostgresCollectionConfig } from "@rebasepro/types";
+import { TENANT_INDEX_REASON, assertBeforeQueryIsPostgresOnly, compileRulePolicies, fieldKeyForColumn, findRelation, getEffectiveSecurityRules, getEnumVarName, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getTableName, getTableVarName, getTenantConfig, relationalCollections, resolveCollectionRelations, resolveJunctionSpecs, resolveStringColumnLength } from "@rebasepro/common";
+import { generateForeignKeyName, legacyForeignKeyName, toPostgresIdentifier, toSnakeCase } from "@rebasepro/utils";
 //#region src/schema/relation-names.ts
 /**
 * The `relationName` both sides of a link must agree on.
@@ -571,7 +138,7 @@ var triggerStatements = (plan) => [dropTriggerStatement(plan), createTriggerStat
 * imported would not be comparable with itself.
 *
 * It **throws** rather than guessing. A configuration no renderer can honour —
-* an empty enum, two `isId` properties, `isId: "cuid"`, an unknown
+* an empty enum, `isId: "cuid"`, a foreign key into a composite key, an unknown
 * `columnType`, a relation to a collection that is not in the bundle, a
 * `search` block on a collection Postgres does not store — used to fail
 * differently in each of the three emitters, or not at all, and the failure
@@ -588,6 +155,8 @@ var quoteSqlLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
 var schemaOf = (collection) => isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
 var bareTableName = (name) => name.includes(".") ? name.split(".").pop() : name;
 var describe = (collection) => collection.slug ?? collection.name ?? "(unnamed)";
+/** A link, as a refusal names it: `relation "posts.author"`. */
+var linkLabel = (kind, collection, key) => `${kind} "${describe(collection)}.${key}"`;
 /**
 * The `ON DELETE` a foreign key gets when the author did not say.
 *
@@ -622,14 +191,39 @@ var foreignKeyPlan = (args) => {
 * The type a column pointing at this collection's primary key must have — a
 * junction endpoint, a `belongsTo` foreign key, a `reference`.
 *
-* One function because it was three: the ladder was spelled inline in
-* `generatePostgresDdl`, again in `planJunctionTables` and a third time in the
-* Drizzle generator.
+* The key's own column type, from the same functions that typed the key: a
+* foreign key only holds between compatible types, so any second reading of
+* the key is a constraint waiting to fail. This used to look at the id
+* strategy alone, so `id: { isId: true, columnType: "uuid" }` was referenced by
+* TEXT columns (42804 — the constraint was never created) and a `bigint` key by
+* INTEGER ones, which overflow at 2^31.
+*
+* One exception: a `serial` key owns a sequence, and a column pointing at it is
+* the plain integer of the same width — `SERIAL` there would give every
+* referencing column a sequence of its own.
+*
+* @param via the link asking, named if the collection's key is composite and so
+*   cannot be pointed at — see `getPrimaryKeyProp`.
 */
-var primaryKeyPgType = (collection) => {
-	const pk = getPrimaryKeyProp(collection);
-	if (pk.type === "number") return { kind: "integer" };
-	return pk.isUuid ? { kind: "uuid" } : { kind: "text" };
+var primaryKeyPgType = (collection, via) => {
+	const { name, prop } = getPrimaryKeyProp(collection, via);
+	if (prop?.type === "number") return withoutSequence(numberType(name, prop, collection, true));
+	if (prop?.type === "string") return stringType(name, prop, collection);
+	return { kind: "text" };
+};
+/**
+* The DEFAULT of the implicit `id TEXT PRIMARY KEY` a collection that declares
+* no key gets: a uuid, as text. The same generator `isId: "uuid"` uses, cast to
+* the column the key has always been.
+*/
+var IMPLICIT_ID_DEFAULT = "gen_random_uuid()::text";
+var withoutSequence = (type) => {
+	switch (type.kind) {
+		case "smallserial": return { kind: "smallint" };
+		case "serial": return { kind: "integer" };
+		case "bigserial": return { kind: "bigint" };
+		default: return type;
+	}
 };
 /** The `columnType`s a `number` property may name, and what each one is. */
 var NUMBER_COLUMN_TYPES = {
@@ -746,7 +340,7 @@ var columnPgType = (propName, prop, collection, resolveCollection) => {
 		case "relation":
 		case "reference": {
 			const target = linkTarget(propName, prop, collection, resolveCollection);
-			return target ? primaryKeyPgType(target) : { kind: "text" };
+			return target ? primaryKeyPgType(target, linkLabel(prop.type, collection, propName)) : { kind: "text" };
 		}
 		default: throw new Error(`No Postgres column type for property "${propName}" of type "${prop.type}" in collection "${describe(collection)}". Add a case to \`columnPgType\` in schema/plan/plan-schema.ts.`);
 	}
@@ -766,6 +360,33 @@ var linkTarget = (propName, prop, collection, resolveCollection) => {
 		return;
 	}
 };
+/** A value already written as a day, or as a time of day. */
+var BARE_DATE = /^\d{4}-\d{2}-\d{2}$/;
+var BARE_TIME = /^\d{2}:\d{2}(:\d{2}(\.\d+)?)?$/;
+/**
+* A date default in the shape its column's type accepts: a day for `date`, a
+* time of day for `time`, an instant for a timestamp.
+*
+* Rendered as a full ISO timestamp whatever the column, a `time` column's
+* DEFAULT was `'2024-03-01T15:30:00.000Z'`, which Postgres refuses — "invalid
+* input syntax for type time" — so the schema would not apply. A value already
+* written in the column's shape (`"2024-12-25"`, `"09:00"`) is kept as written;
+* anything else is read as an instant and its UTC day or time of day taken, the
+* same zone the timestamp rendering has always used. A string that is no date
+* at all is no DEFAULT, rather than a schema that cannot be applied.
+*/
+var dateDefaultLiteral = (value, type) => {
+	if (typeof value === "string") {
+		if (type.kind === "date" && BARE_DATE.test(value)) return value;
+		if (type.kind === "time" && BARE_TIME.test(value)) return value;
+	}
+	const instant = value instanceof Date ? value : typeof value === "string" ? new Date(value) : void 0;
+	if (!instant || Number.isNaN(instant.getTime())) return void 0;
+	const iso = instant.toISOString();
+	if (type.kind === "date") return iso.slice(0, 10);
+	if (type.kind === "time") return iso.slice(11, 23);
+	return typeof value === "string" ? value : iso;
+};
 /**
 * A `defaultValue` as a database DEFAULT.
 *
@@ -800,11 +421,11 @@ var literalDefault = (prop, type) => {
 			sql: value ? "TRUE" : "FALSE"
 		} : void 0;
 		case "date": {
-			const iso = value instanceof Date ? Number.isNaN(value.getTime()) ? void 0 : value.toISOString() : typeof value === "string" ? value : void 0;
-			return iso === void 0 ? void 0 : {
+			const literal = dateDefaultLiteral(value, type);
+			return literal === void 0 ? void 0 : {
 				kind: "literal",
-				value: iso,
-				sql: quoteSqlLiteral(iso)
+				value: literal,
+				sql: quoteSqlLiteral(literal)
 			};
 		}
 		case "map":
@@ -853,47 +474,26 @@ var columnDefault = (propName, prop, collection, type) => {
 /**
 * One security rule, compiled to the clauses a policy is made of.
 *
-* The desugaring (`access` / `ownerField` / `roles` / structured condition /
-* raw SQL → `PolicyExpression`) and the SQL compilation are `@rebasepro/common`'s,
-* which is what the client-side evaluator uses too — so the UI, the DDL and the
-* database agree about who can read a row. What lives here is only the shape:
-* which operations a rule expands to, which clauses each operation takes, and
-* the deny-all fallback for a clause that compiled to nothing.
+* The compilation is `compileRulePolicies` in `@rebasepro/common`, which the
+* Studio's RLS editor also compares the live database against — so the UI, the
+* DDL and the database agree about who can read a row. What this adds is only
+* the planner's bookkeeping: which rule a policy came from, and whether Rebase
+* injected it.
 */
-var compileSecurityRule = (collection, rule, resolveCollection, injected, ruleKey = rule.name ?? "(unnamed)") => {
-	const tableName = getTableName(collection);
-	const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
-	const policyNames = getPolicyNamesForRule(rule, tableName);
-	const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-	return ops.map((operation, index) => {
-		const needsUsing = operation !== "insert";
-		const needsWithCheck = operation !== "select" && operation !== "delete";
-		let using = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection, { resolveCollection }) : null;
-		let withCheck = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection, { resolveCollection }) : null;
-		if (!using && needsUsing) using = "false";
-		if (!withCheck && needsWithCheck) withCheck = "false";
-		return {
-			name: policyNames[index],
-			ruleKey,
-			operation,
-			mode: rule.mode ?? "permissive",
-			roles: rule.pgRoles ? [...rule.pgRoles].sort() : ["public"],
-			using,
-			withCheck,
-			injected
-		};
-	});
-};
+var compileSecurityRule = (collection, rule, resolveCollection, injected, ruleKey = rule.name ?? "(unnamed)") => compileRulePolicies(collection, rule, { resolveCollection }).map((policy) => ({
+	...policy,
+	ruleKey,
+	injected
+}));
 function planSchema(allCollections, options = {}) {
 	assertSearchIsPostgresOnly(allCollections);
 	assertBeforeQueryIsPostgresOnly(allCollections);
 	const collections = relationalCollections(allCollections);
-	collections.forEach(assertSinglePrimaryKey);
 	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
 	const declaredSchemas = Array.from(new Set(collections.map((c) => isPostgresCollectionConfig(c) ? c.schema : void 0).filter(Boolean)));
 	const schemas = Array.from(/* @__PURE__ */ new Set([REBASE_SCHEMA, ...declaredSchemas]));
 	const enums = [];
-	const seenEnums = /* @__PURE__ */ new Set();
+	const enumOwners = /* @__PURE__ */ new Map();
 	/**
 	* Every enum type one table's properties declare, appended once.
 	*
@@ -911,10 +511,21 @@ function planSchema(allCollections, options = {}) {
 			const labels = enumLabelsOf(propName, prop, collection);
 			if (!declaresEnumType(prop)) continue;
 			const schema = schemaOf(collection);
-			const name = `${getTableName(collection)}_${resolveColumnName(propName, prop)}`;
-			const qualified = `${schema}.${name}`;
-			if (seenEnums.has(qualified)) continue;
-			seenEnums.add(qualified);
+			const table = getTableName(collection);
+			const column = resolveColumnName(propName, prop);
+			const name = `${table}_${column}`;
+			const qualified = `${schema}.${toPostgresIdentifier(name)}`;
+			const owner = `property "${propName}" of collection "${describe(collection)}"`;
+			const claimed = enumOwners.get(qualified);
+			if (claimed) {
+				if (claimed.table === table && claimed.column === column) continue;
+				throw new Error(`The enum ${owner} and the enum ${claimed.owner} both derive the Postgres type "${schema}"."${toPostgresIdentifier(name)}" (an enum type is named <table>_<column>, and Postgres keeps the first 63 bytes). One type cannot hold both columns' values, and a type's name cannot change once a database holds it. Give one of the two columns another name with \`columnName\`, or its collection another \`table\` or \`schema\`.`);
+			}
+			enumOwners.set(qualified, {
+				table,
+				column,
+				owner
+			});
 			enums.push({
 				schema,
 				name,
@@ -927,12 +538,14 @@ function planSchema(allCollections, options = {}) {
 	};
 	for (const collection of collections) collectEnumTypes(collection, collection.properties ?? {}, isPostgresCollectionConfig(collection) ? collection.schema : void 0);
 	const tableEntries = /* @__PURE__ */ new Map();
+	const junctionShapes = /* @__PURE__ */ new Map();
 	for (const collection of collections) {
 		const tableName = getTableName(collection);
 		if (tableName) tableEntries.set(tableName, { collection });
-		for (const relation of Object.values(resolveCollectionRelations(collection))) {
+		for (const [relationKey, relation] of Object.entries(resolveCollectionRelations(collection))) {
 			if (!isManyToMany(relation)) continue;
 			const junctionTable = relation.through.table;
+			assertOneJunctionShape(junctionShapes, junctionTable, collection, relation.relationName ?? relationKey, relation);
 			if (tableEntries.has(junctionTable)) continue;
 			tableEntries.set(junctionTable, {
 				collection: {
@@ -984,6 +597,38 @@ function planSchema(allCollections, options = {}) {
 		options
 	};
 }
+/**
+* Refuse two many-to-many relations that resolve to one junction table with
+* different key columns.
+*
+* A default `through` is named after the two tables, so `posts.tags` and
+* `posts.featuredTags` both resolve to `posts_tags` — one keyed by `tag_id`,
+* the other by `featured_tag_id`. One table is created, from whichever came
+* first, so the other relation read and wrote a column that was never there.
+* The two sides of one link (`posts.tags` and `tags.posts`) share a junction
+* legitimately, and they name the same two columns — so the comparison is of
+* the (column, endpoint) pairs, in either order.
+*/
+function assertOneJunctionShape(seen, junctionTable, collection, relationName, relation) {
+	if (!isManyToMany(relation)) return;
+	const target = relation.target();
+	if (!target) return;
+	const sourceTable = getTableName(collection);
+	const targetTable = getTableName(target);
+	const { sourceColumn, targetColumn } = relation.through;
+	const keys = JSON.stringify([[sourceColumn, sourceTable], [targetColumn, targetTable]].sort());
+	const claim = `the relation "${relationName}" of collection "${describe(collection)}" ("${sourceColumn}" → ${sourceTable}, "${targetColumn}" → ${targetTable})`;
+	const first = seen.get(junctionTable);
+	if (!first) {
+		seen.set(junctionTable, {
+			keys,
+			claim
+		});
+		return;
+	}
+	if (first.keys === keys) return;
+	throw new Error(`Two many-to-many relations resolve to the junction table "${junctionTable}" with different key columns: ${first.claim} and ${claim}. Only one table is created, so one of them would read and write columns that do not exist. Give the second its own junction — \`through: { table: "${sourceTable}_${toSnakeCase(relationName)}" }\` — or, if both are meant to be one link, declare it once.`);
+}
 function planCollectionTable(collection, resolveCollection, triggerFunctionNeeded) {
 	const schema = schemaOf(collection);
 	const table = bareTableName(getTableName(collection));
@@ -1068,21 +713,11 @@ function planCollectionTable(collection, resolveCollection, triggerFunctionNeede
 			}
 		});
 	}
-	if (!columns.some((c) => c.primaryKey)) columns.unshift({
-		key: "id",
-		column: "id",
-		type: { kind: "text" },
-		nullable: false,
-		primaryKey: true,
-		unique: false,
-		source: {
-			kind: "implicit-id",
-			slug: collection.slug
-		}
-	});
+	const primaryKey = planPrimaryKey(collection, columns);
 	const injected = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
 	const policies = getEffectiveSecurityRules(collection).flatMap((rule, index) => compileSecurityRule(collection, rule, resolveCollection, Boolean(rule.name && injected.has(rule.name)), rule.name ?? `#${index}`));
-	const tenantIndexes = applyTenantColumnEffects(collection, columns, schema, table);
+	const tenantIndexes = applyTenantColumnEffects(collection, columns, primaryKey, schema, table);
+	settleDefaultOnDelete(collection, columns, relations);
 	return {
 		schema,
 		table,
@@ -1092,7 +727,7 @@ function planCollectionTable(collection, resolveCollection, triggerFunctionNeede
 		kind: "collection",
 		slug: collection.slug,
 		columns,
-		primaryKey: columns.filter((c) => c.primaryKey).map((c) => c.column),
+		primaryKey,
 		indexes: [...buildCollectionIndexSpecs(collection, resolveColumnName), ...tenantIndexes],
 		search,
 		vector: buildVectorIndexPlan(collection, resolveColumnName),
@@ -1103,6 +738,50 @@ function planCollectionTable(collection, resolveCollection, triggerFunctionNeede
 	};
 }
 /**
+* The table's primary key, as the column names {@link TablePlan.primaryKey}
+* lists — and the columns adjusted to state it one way only.
+*
+* One `isId` property is a key column of its own, declared inline
+* (`"id" INTEGER PRIMARY KEY`, `.primaryKey()`), which is how
+* {@link planPropertyColumn} planned it. Several are one composite key, and a
+* composite key cannot be said column by column: two inline `PRIMARY KEY`
+* clauses are two primary keys, which Postgres refuses. So each member stops
+* being a key of its own, keeps NOT NULL (the constraint implies it, and every
+* emitter spells it on the column so the three read the same), and the table
+* gets one `PRIMARY KEY (a, b)` over the list returned here — the shape a
+* junction's key has always had.
+*
+* A collection that declares no key gets an implicit `id TEXT PRIMARY KEY`,
+* which is what `getPrimaryKeys` reads back.
+*/
+function planPrimaryKey(collection, columns) {
+	const keyNames = primaryKeyPropertyNames(collection);
+	if (keyNames.length > 1) return keyNames.map((name) => {
+		const column = columns.find((c) => c.source.propName === name && !c.columnOwnedByProperty);
+		if (!column) throw new Error(`Property "${name}" of collection "${describe(collection)}" is marked \`isId\`, and it puts no column on this table, so it cannot be part of the table's primary key. Mark the property that holds the column instead.`);
+		column.primaryKey = false;
+		column.nullable = false;
+		return column.column;
+	});
+	if (!columns.some((c) => c.primaryKey)) columns.unshift({
+		key: "id",
+		column: "id",
+		type: { kind: "text" },
+		nullable: false,
+		primaryKey: true,
+		unique: false,
+		default: {
+			kind: "sql",
+			expression: IMPLICIT_ID_DEFAULT
+		},
+		source: {
+			kind: "implicit-id",
+			slug: collection.slug
+		}
+	});
+	return columns.filter((c) => c.primaryKey).map((c) => c.column);
+}
+/**
 * One declared, non-linking property, as a column.
 *
 * Extracted from {@link planCollectionTable} the moment a second table needed
@@ -1185,12 +864,12 @@ function planPropertyColumn(propName, prop, ctx) {
 * column that does not exist: `CREATE POLICY` fails, RLS stays enabled, and the
 * collection denies every row.
 */
-function applyTenantColumnEffects(collection, columns, schema, table) {
+function applyTenantColumnEffects(collection, columns, primaryKey, schema, table) {
 	const tenant = getTenantConfig(collection);
 	if (!tenant) return [];
 	const column = findTenantColumn(collection, columns, tenant.field);
 	if (!column) throw new Error(`Collection "${describe(collection)}" declares \`tenant: { field: "${tenant.field}" }\`, and no property of that name reaches a column. \`tenant\` says what a column means; it does not create one. Declare the property, or name the one that holds the tenant id.`);
-	if (column.primaryKey) return [];
+	if (primaryKey[0] === column.column) return [];
 	column.nullable = false;
 	const withoutName = {
 		schema,
@@ -1222,18 +901,57 @@ function applyTenantColumnEffects(collection, columns, schema, table) {
 * column — for the shape the documentation recommends.
 */
 function findTenantColumn(collection, columns, field) {
-	const direct = columns.find((c) => c.key === field);
+	const created = columns.filter((c) => !c.columnOwnedByProperty);
+	const direct = created.find((c) => c.key === field);
 	if (direct) return direct;
 	const prop = collection.properties?.[field];
 	if (prop?.type === "relation") {
 		const relation = findRelation(resolveCollectionRelations(collection), prop.relation?.relationName ?? field);
-		if (relation?.kind === "belongsTo" && relation.localKey) return columns.find((c) => c.column === relation.localKey);
+		if (relation?.kind === "belongsTo" && relation.localKey) return created.find((c) => c.column === relation.localKey);
 		return;
 	}
 	if (!prop) return void 0;
 	const columnName = resolveColumnName(field, prop);
-	return columns.find((c) => c.column === columnName);
+	return created.find((c) => c.column === columnName);
+}
+/**
+* The `ON DELETE` a link gets when the author did not say, decided from the
+* column as it will be created.
+*
+* {@link planRelationColumn} and {@link planReferenceColumn} see only their own
+* property's `required`, and two later facts change the premise: `tenant` makes
+* its column NOT NULL, and a declared property that owns a relation's column
+* decides that column's nullability itself. Defaulting before either produced
+* `NOT NULL … ON DELETE SET NULL` — a parent's delete that can only fail, and
+* fails with 23502 naming the child's column rather than as the foreign-key
+* refusal it is. An `onDelete` the author wrote is theirs and is kept.
+*/
+function settleDefaultOnDelete(collection, columns, relations) {
+	for (const column of columns) {
+		const fk = column.foreignKey;
+		if (!fk || declaresOnDelete(collection, relations, column)) continue;
+		const onDelete = defaultBelongsToOnDelete(!(columns.find((c) => c.column === column.column && !c.columnOwnedByProperty) ?? column).nullable);
+		if (onDelete === fk.onDelete) continue;
+		column.foreignKey = foreignKeyPlan({
+			schema: fk.schema,
+			table: fk.table,
+			column: fk.column,
+			targetSchema: fk.targetSchema,
+			targetTable: fk.targetTable,
+			targetColumn: fk.targetColumn,
+			onDelete,
+			onUpdate: fk.onUpdate
+		});
+	}
 }
+/** Whether the author wrote this link's `onDelete`. A `reference` has none to write. */
+var declaresOnDelete = (collection, relations, column) => {
+	const propName = column.source.propName;
+	if (column.source.kind !== "relation" || !propName) return false;
+	const prop = collection.properties?.[propName];
+	const relation = findRelation(relations, prop?.relation?.relationName ?? propName);
+	return relation?.kind === "belongsTo" && relation.onDelete !== void 0;
+};
 /**
 * The column a `belongsTo` relation owns, or `undefined` when the relation puts
 * no column on this table.
@@ -1256,10 +974,11 @@ function planRelationColumn(propName, prop, collection, relations, schema, table
 	const relationName = prop.relation?.relationName ?? propName;
 	const legacyKey = legacyForeignKeyName(relationName);
 	const derived = relation.localKey === generateForeignKeyName(relationName);
+	const via = linkLabel("relation", collection, propName);
 	return {
 		key: fkFieldKey,
 		column: relation.localKey,
-		type: primaryKeyPgType(target),
+		type: primaryKeyPgType(target, via),
 		nullable: !required,
 		primaryKey: false,
 		unique: prop.validation?.unique === true,
@@ -1271,7 +990,7 @@ function planRelationColumn(propName, prop, collection, relations, schema, table
 			column: relation.localKey,
 			targetSchema: schemaOf(target),
 			targetTable: bareTableName(getTableName(target)),
-			targetColumn: getPrimaryKeyName(target),
+			targetColumn: getPrimaryKeyColumn(target, via),
 			onDelete: relation.onDelete ?? defaultBelongsToOnDelete(required),
 			onUpdate: relation.onUpdate
 		}),
@@ -1287,10 +1006,11 @@ function planReferenceColumn(propName, prop, collection, resolveCollection, sche
 	const target = prop.path ? resolveCollection(prop.path) : void 0;
 	const column = resolveColumnName(propName, prop);
 	const required = prop.validation?.required === true;
+	const via = linkLabel("reference", collection, propName);
 	return {
 		key: propName,
 		column,
-		type: target ? primaryKeyPgType(target) : { kind: "text" },
+		type: target ? primaryKeyPgType(target, via) : { kind: "text" },
 		nullable: !required,
 		primaryKey: false,
 		unique: prop.validation?.unique === true,
@@ -1300,7 +1020,7 @@ function planReferenceColumn(propName, prop, collection, resolveCollection, sche
 			column,
 			targetSchema: schemaOf(target),
 			targetTable: bareTableName(getTableName(target)),
-			targetColumn: getPrimaryKeyName(target),
+			targetColumn: getPrimaryKeyColumn(target, via),
 			onDelete: defaultBelongsToOnDelete(required)
 		}) : void 0,
 		source: {
@@ -1334,7 +1054,44 @@ var authColumnType = (sqlType) => {
 	if (!mapped) throw new Error(`\`auth-users-columns\` declares a column of type "${sqlType}", which the schema plan has no tag for. Add it to \`AUTH_COLUMN_TYPES\` in schema/plan/plan-schema.ts.`);
 	return mapped;
 };
-function planJunctionTable(tableName, relation, source, junctionSpecs, resolveCollection, triggerFunctionNeeded) {
+/**
+* Which declaring side a junction is planned from.
+*
+* With one side, that side — as it always was, so a junction only one end
+* declares keeps the key every database already has. With both ends declaring
+* it, the planner used to take whichever it reached first, and the two doors
+* reach them in different orders: `db push` loads files by name, boot walks the
+* bundle's array. The same junction was keyed `(a_id, b_id)` by one and
+* `(b_id, a_id)` by the other, and a push against a boot-built database rebuilt
+* the key. Now the side whose table sorts first, which is the order `db push`
+* already used wherever a file is named after its table.
+*/
+function canonicalJunctionSide(table, relation, source, spec) {
+	if (!spec || spec.declaringSides.length < 2) return {
+		relation,
+		source
+	};
+	const chosen = [...spec.declaringSides].sort((a, b) => {
+		const left = bareTableName(getTableName(a.collection));
+		const right = bareTableName(getTableName(b.collection));
+		if (left !== right) return left < right ? -1 : 1;
+		return a.junctionColumn < b.junctionColumn ? -1 : a.junctionColumn > b.junctionColumn ? 1 : 0;
+	})[0].collection;
+	if (chosen === source) return {
+		relation,
+		source
+	};
+	const resolved = Object.values(resolveCollectionRelations(chosen)).find((r) => isManyToMany(r) && bareTableName(r.through.table) === table);
+	return resolved ? {
+		relation: resolved,
+		source: chosen
+	} : {
+		relation,
+		source
+	};
+}
+function planJunctionTable(tableName, reachedRelation, reachedSource, junctionSpecs, resolveCollection, triggerFunctionNeeded) {
+	const { relation, source } = canonicalJunctionSide(bareTableName(tableName), reachedRelation, reachedSource, junctionSpecs.get(bareTableName(tableName)));
 	if (!isManyToMany(relation)) throw new Error(`Internal: junction table "${tableName}" was reached from a ${relation.kind} relation.`);
 	const table = bareTableName(tableName);
 	const schema = "public";
@@ -1347,10 +1104,11 @@ function planJunctionTable(tableName, relation, source, junctionSpecs, resolveCo
 		const legacy = legacyForeignKeyName(slug);
 		return column === generateForeignKeyName(slug) && legacy !== column ? legacy : void 0;
 	};
+	const via = linkLabel("relation", source, relation.relationName);
 	const endpoint = (collection, column) => ({
 		key: column,
 		column,
-		type: primaryKeyPgType(collection),
+		type: primaryKeyPgType(collection, via),
 		nullable: false,
 		primaryKey: false,
 		unique: false,
@@ -1361,7 +1119,7 @@ function planJunctionTable(tableName, relation, source, junctionSpecs, resolveCo
 			column,
 			targetSchema: schemaOf(collection),
 			targetTable: bareTableName(getTableName(collection)),
-			targetColumn: getPrimaryKeyName(collection),
+			targetColumn: getPrimaryKeyColumn(collection, via),
 			onDelete
 		}),
 		source: { kind: "junction-key" }
@@ -1416,14 +1174,13 @@ function planRelations(collections, tableEntries) {
 			const { relation, source } = entry.junction;
 			if (!isManyToMany(relation)) continue;
 			const target = relation.target();
-			const owningRelationName = relation.relationName ?? toSnakeCase(getTableName(target));
-			let inverseRelationName;
+			const via = linkLabel("relation", source, relation.relationName);
+			const owningRelationName = sharedRelationName(relation, source);
+			let inverse;
 			try {
-				for (const targetRel of Object.values(resolveCollectionRelations(target))) if (targetRel.kind !== "belongsTo" && targetRel.cardinality === "many" && targetRel.relationName === owningRelationName) {
-					inverseRelationName = targetRel.relationName;
-					break;
-				}
+				inverse = Object.values(resolveCollectionRelations(target)).find((r) => r.kind === "manyToMany" && bareTableName(r.through.table) === bareTableName(tableName));
 			} catch {}
+			const inverseRelationName = inverse ? sharedRelationName(inverse, target) : `${tableName}_${relation.through.targetColumn}`;
 			plans.push({
 				tableVar,
 				key: relation.through.sourceColumn,
@@ -1431,16 +1188,17 @@ function planRelations(collections, tableEntries) {
 				targetVar: getTableVarName(getTableName(source)),
 				relationName: owningRelationName,
 				fields: [relation.through.sourceColumn],
-				references: [getPrimaryKeyName(source)]
+				references: [getPrimaryKeyName(source, via)]
 			});
+			if (inverseRelationName === owningRelationName) continue;
 			plans.push({
 				tableVar,
 				key: relation.through.targetColumn,
 				kind: "one",
 				targetVar: getTableVarName(getTableName(target)),
-				relationName: inverseRelationName ?? `${tableName}_${relation.through.targetColumn}`,
+				relationName: inverseRelationName,
 				fields: [relation.through.targetColumn],
-				references: [getPrimaryKeyName(target)]
+				references: [getPrimaryKeyName(target, via)]
 			});
 			continue;
 		}
@@ -1467,7 +1225,7 @@ function planRelations(collections, tableEntries) {
 						targetVar,
 						relationName,
 						fields: [fieldKeyForColumn(collection, relation.localKey)],
-						references: [getPrimaryKeyName(target)]
+						references: [getPrimaryKeyName(target, linkLabel("relation", collection, key))]
 					});
 					break;
 				case "hasOne":
@@ -1475,7 +1233,11 @@ function planRelations(collections, tableEntries) {
 						tableVar,
 						key,
 						kind: "one",
-						targetVar
+						targetVar,
+						relationName,
+						fields: [relation.sourceKey ? fieldKeyForColumn(collection, relation.sourceKey) : getPrimaryKeyName(collection, linkLabel("relation", collection, key))],
+						references: [fieldKeyForColumn(target, relation.foreignKeyOnTarget)],
+						nullable: true
 					});
 					break;
 				case "hasMany":
@@ -1523,7 +1285,7 @@ function planRelations(collections, tableEntries) {
 					targetVar: otherVar,
 					relationName,
 					fields: [fieldKey],
-					references: [otherRel.sourceKey ? fieldKeyForColumn(other, otherRel.sourceKey) : getPrimaryKeyName(other)]
+					references: [otherRel.sourceKey ? fieldKeyForColumn(other, otherRel.sourceKey) : getPrimaryKeyName(other, linkLabel("relation", other, otherRel.relationName))]
 				});
 			}
 		}
@@ -1531,6 +1293,6 @@ function planRelations(collections, tableEntries) {
 	return plans;
 }
 //#endregion
-export { searchHelperFunctions as _, triggerStatements as a, searchStampGuards as b, SEARCH_TEXT_FN as c, fuzzyColumnDefinition as d, hiddenColumnsOption as f, searchExtensionStatements as g, searchColumnStamps as h, SET_UPDATED_AT_FN as i, SEARCH_UNACCENT_FN as l, searchColumnNames as m, planSchema as n, sharedRelationName as o, searchColumnDefinition as p, quoteSqlLiteral as r, SEARCH_STAMP_PREFIX as s, columnPgType as t, buildSearchColumnSpec as u, searchIndexNames as v, visibleColumnProjection as x, searchIndexStatements as y };
+export { triggerStatements as a, SET_UPDATED_AT_FN as i, planSchema as n, sharedRelationName as o, quoteSqlLiteral as r, columnPgType as t };
 
-//# sourceMappingURL=plan-schema-CboAIwLN.js.map
+//# sourceMappingURL=plan-schema-DU9exq6C.js.map