@atscript/db 0.1.103 → 0.1.105

package/dist/plugin.cjs

@@ -302,6 +302,35 @@ const dbColumnAnnotations = {
 			});
 			return errors;
 		}
+	}),
+	encrypted: new _atscript_core.AnnotationSpec({
+		description: "Encrypts this field at rest. Values are AES-256-GCM encrypted by the core layer before reaching the database and decrypted on read — transparent to application code.\n\nConstraints: the field cannot be filtered, sorted, indexed, used as PK/FK, patched with arithmetic ops, or referenced by search/vector/geo features.\n\n**Example:**\n```atscript\n@db.encrypted\napiToken?: string\n```\n",
+		nodeType: ["prop"],
+		multiple: false,
+		validate(token, _args, _doc) {
+			const errors = [];
+			const field = token.parentNode;
+			for (const [name, why] of [
+				["meta.id", "the primary key must be addressable"],
+				["db.rel.FK", "joins are impossible over ciphertext"],
+				["db.index.plain", "indexes over ciphertext are meaningless"],
+				["db.index.unique", "indexes over ciphertext are meaningless"],
+				["db.index.fulltext", "indexes over ciphertext are meaningless"],
+				["db.index.geo", "geo indexes over ciphertext are meaningless"],
+				["db.search.vector", "vector search over ciphertext is impossible"],
+				["db.search.filter", "search filters need cleartext equality"],
+				["db.column.version", "the OCC filter needs cleartext equality"],
+				["db.default.increment", "engine-side defaults bypass the encryption transform"],
+				["db.default.now", "engine-side defaults bypass the encryption transform"],
+				["db.mongo.search.text", "Atlas Search over ciphertext is impossible"],
+				["db.mongo.search.autocomplete", "Atlas Search over ciphertext is impossible"]
+			]) if (field.countAnnotations(name) > 0) errors.push({
+				message: `@db.encrypted cannot coexist with @${name} — ${why}`,
+				severity: 1,
+				range: token.range
+			});
+			return errors;
+		}
 	})
 };
 function columnCapability(capability, verb) {
@@ -377,6 +406,17 @@ const dbIndexAnnotations = { index: {
 			type: "number",
 			description: "Field importance in search results (higher = more relevant). Defaults to `1`. Supported by databases with weighted fulltext (e.g., MongoDB, PostgreSQL)."
 		}]
+	}),
+	geo: new _atscript_core.AnnotationSpec({
+		description: "Geospatial index on a `db.geoPoint` field. Enables `geoSearch()` (distance-ranked) and accelerates `$geoWithin` filters.\n\n**Example:**\n```atscript\n@db.index.geo\ngeo: db.geoPoint\n```\n",
+		nodeType: ["prop"],
+		multiple: false,
+		argument: {
+			optional: true,
+			name: "name",
+			type: "string",
+			description: "Index name. Defaults to the field name."
+		}
 	})
 } };
 //#endregion
@@ -1244,6 +1284,7 @@ const dbPlugin = () => ({
 				default: dbColumnAnnotations.default,
 				json: dbColumnAnnotations.json,
 				ignore: dbColumnAnnotations.ignore,
+				encrypted: dbColumnAnnotations.encrypted,
 				http: dbTableAnnotations.http,
 				sync: dbTableAnnotations.sync,
 				depth: dbTableAnnotations.depth,
@@ -1262,6 +1303,13 @@ const dbPlugin = () => ({
 					},
 					documentation: "Represents a **vector embedding** (array of numbers) for **similarity search**.\n\n- Equivalent to `number[]` but explicitly marks the field as a vector embedding.\n- Each adapter maps this to its native vector type:\n  - **MongoDB** → BSON array\n  - **MySQL 9+** → `VECTOR(N)`\n  - **PostgreSQL** → pgvector `vector(N)`\n  - **SQLite** → JSON\n\n**Example:**\n```atscript\n@db.search.vector 1536, \"cosine\"\nembedding: db.vector\n```\n"
 				},
+				geoPoint: {
+					type: {
+						kind: "array",
+						of: "number"
+					},
+					documentation: "Represents a **geographic point** as a `[longitude, latitude]` tuple (GeoJSON coordinate order).\n\n- Equivalent to `number[]` of length 2, but explicitly marks the field as a geo point.\n- **Coordinate order is GeoJSON order: longitude first.**\n- Each adapter maps this to its native storage:\n  - **MongoDB** → GeoJSON `{ type: 'Point', coordinates: [lng, lat] }`\n  - **PostgreSQL** → PostGIS `geography(Point,4326)` (Phase 2)\n  - **MySQL** → `POINT` SRID 4326 (Phase 2)\n  - **SQLite** → JSON `TEXT` (Phase 2)\n\n**Example:**\n```atscript\n@db.index.geo\ngeo: db.geoPoint\n```\n"
+				},
 				currencyCode: {
 					type: "string",
 					documentation: "Represents a **currency code** — typically ISO 4217 (`'USD'`, `'EUR'`, `'JPY'`) but accepts any uppercase alphanumeric code 2–10 chars long, so crypto and custom codes (`'BTC'`, `'USDC'`, `'POINTS'`) fit too.\n\nPair with `@db.amount.currency.ref 'fieldName'` on a `decimal` field to bind the amount to its row-level currency. The validator checks that the ref target resolves to this type (or a plain `string`).\n\n**Example:**\n```atscript\ncurrency: db.currencyCode\n@db.amount.currency.ref 'currency'\namount: decimal\n```\n",

package/dist/plugin.mjs

@@ -298,6 +298,35 @@ const dbColumnAnnotations = {
 			});
 			return errors;
 		}
+	}),
+	encrypted: new AnnotationSpec({
+		description: "Encrypts this field at rest. Values are AES-256-GCM encrypted by the core layer before reaching the database and decrypted on read — transparent to application code.\n\nConstraints: the field cannot be filtered, sorted, indexed, used as PK/FK, patched with arithmetic ops, or referenced by search/vector/geo features.\n\n**Example:**\n```atscript\n@db.encrypted\napiToken?: string\n```\n",
+		nodeType: ["prop"],
+		multiple: false,
+		validate(token, _args, _doc) {
+			const errors = [];
+			const field = token.parentNode;
+			for (const [name, why] of [
+				["meta.id", "the primary key must be addressable"],
+				["db.rel.FK", "joins are impossible over ciphertext"],
+				["db.index.plain", "indexes over ciphertext are meaningless"],
+				["db.index.unique", "indexes over ciphertext are meaningless"],
+				["db.index.fulltext", "indexes over ciphertext are meaningless"],
+				["db.index.geo", "geo indexes over ciphertext are meaningless"],
+				["db.search.vector", "vector search over ciphertext is impossible"],
+				["db.search.filter", "search filters need cleartext equality"],
+				["db.column.version", "the OCC filter needs cleartext equality"],
+				["db.default.increment", "engine-side defaults bypass the encryption transform"],
+				["db.default.now", "engine-side defaults bypass the encryption transform"],
+				["db.mongo.search.text", "Atlas Search over ciphertext is impossible"],
+				["db.mongo.search.autocomplete", "Atlas Search over ciphertext is impossible"]
+			]) if (field.countAnnotations(name) > 0) errors.push({
+				message: `@db.encrypted cannot coexist with @${name} — ${why}`,
+				severity: 1,
+				range: token.range
+			});
+			return errors;
+		}
 	})
 };
 function columnCapability(capability, verb) {
@@ -373,6 +402,17 @@ const dbIndexAnnotations = { index: {
 			type: "number",
 			description: "Field importance in search results (higher = more relevant). Defaults to `1`. Supported by databases with weighted fulltext (e.g., MongoDB, PostgreSQL)."
 		}]
+	}),
+	geo: new AnnotationSpec({
+		description: "Geospatial index on a `db.geoPoint` field. Enables `geoSearch()` (distance-ranked) and accelerates `$geoWithin` filters.\n\n**Example:**\n```atscript\n@db.index.geo\ngeo: db.geoPoint\n```\n",
+		nodeType: ["prop"],
+		multiple: false,
+		argument: {
+			optional: true,
+			name: "name",
+			type: "string",
+			description: "Index name. Defaults to the field name."
+		}
 	})
 } };
 //#endregion
@@ -1240,6 +1280,7 @@ const dbPlugin = () => ({
 				default: dbColumnAnnotations.default,
 				json: dbColumnAnnotations.json,
 				ignore: dbColumnAnnotations.ignore,
+				encrypted: dbColumnAnnotations.encrypted,
 				http: dbTableAnnotations.http,
 				sync: dbTableAnnotations.sync,
 				depth: dbTableAnnotations.depth,
@@ -1258,6 +1299,13 @@ const dbPlugin = () => ({
 					},
 					documentation: "Represents a **vector embedding** (array of numbers) for **similarity search**.\n\n- Equivalent to `number[]` but explicitly marks the field as a vector embedding.\n- Each adapter maps this to its native vector type:\n  - **MongoDB** → BSON array\n  - **MySQL 9+** → `VECTOR(N)`\n  - **PostgreSQL** → pgvector `vector(N)`\n  - **SQLite** → JSON\n\n**Example:**\n```atscript\n@db.search.vector 1536, \"cosine\"\nembedding: db.vector\n```\n"
 				},
+				geoPoint: {
+					type: {
+						kind: "array",
+						of: "number"
+					},
+					documentation: "Represents a **geographic point** as a `[longitude, latitude]` tuple (GeoJSON coordinate order).\n\n- Equivalent to `number[]` of length 2, but explicitly marks the field as a geo point.\n- **Coordinate order is GeoJSON order: longitude first.**\n- Each adapter maps this to its native storage:\n  - **MongoDB** → GeoJSON `{ type: 'Point', coordinates: [lng, lat] }`\n  - **PostgreSQL** → PostGIS `geography(Point,4326)` (Phase 2)\n  - **MySQL** → `POINT` SRID 4326 (Phase 2)\n  - **SQLite** → JSON `TEXT` (Phase 2)\n\n**Example:**\n```atscript\n@db.index.geo\ngeo: db.geoPoint\n```\n"
+				},
 				currencyCode: {
 					type: "string",
 					documentation: "Represents a **currency code** — typically ISO 4217 (`'USD'`, `'EUR'`, `'JPY'`) but accepts any uppercase alphanumeric code 2–10 chars long, so crypto and custom codes (`'BTC'`, `'USDC'`, `'POINTS'`) fit too.\n\nPair with `@db.amount.currency.ref 'fieldName'` on a `decimal` field to bind the amount to its row-level currency. The validator checks that the ref target resolves to this type (or a plain `string`).\n\n**Example:**\n```atscript\ncurrency: db.currencyCode\n@db.amount.currency.ref 'currency'\namount: decimal\n```\n",

package/dist/rel.d.cts

@@ -1,4 +1,4 @@
-import { F as TDbForeignKey, H as TDbRelation, dt as TableMetadata, it as TTableResolver, o as BaseDbAdapter, ot as TWriteTableResolver, pt as TGenericLogger } from "./db-readable-mhPp-MPv.cjs";
+import { L as TDbForeignKey, W as TDbRelation, _t as TGenericLogger, c as BaseDbAdapter, ct as TWriteTableResolver, ot as TTableResolver, pt as TableMetadata } from "./db-readable-BepVc21V.cjs";
 import { t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.cjs";
 import { FilterExpr, WithRelation } from "@uniqu/core";
 import { Validator } from "@atscript/typescript/utils";

package/dist/rel.d.mts

@@ -1,4 +1,4 @@
-import { F as TDbForeignKey, H as TDbRelation, dt as TableMetadata, it as TTableResolver, o as BaseDbAdapter, ot as TWriteTableResolver, pt as TGenericLogger } from "./db-readable-CXdHBtF6.mjs";
+import { L as TDbForeignKey, W as TDbRelation, _t as TGenericLogger, c as BaseDbAdapter, ct as TWriteTableResolver, ot as TTableResolver, pt as TableMetadata } from "./db-readable-Ds01ezjj.mjs";
 import { t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.mjs";
 import { Validator } from "@atscript/typescript/utils";
 import { FilterExpr, WithRelation } from "@uniqu/core";

package/dist/sync.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_db_view = require("./db-view-GcbegVBD.cjs");
+const require_db_view = require("./db-view-Bw_hlrWw.cjs");
 //#region src/schema/schema-hash.ts
 /** Extracts sorted field snapshots from a readable's field descriptors. */
 function extractFieldSnapshots(fields, typeMapper) {
@@ -13,6 +13,7 @@ function extractFieldSnapshots(fields, typeMapper) {
 		};
 		if (f.defaultValue) snap.defaultValue = f.defaultValue;
 		if (typeMapper) snap.mappedType = typeMapper(f);
+		if (f.encrypted) snap.encrypted = true;
 		return snap;
 	}).toSorted((a, b) => a.physicalName.localeCompare(b.physicalName));
 }

package/dist/sync.d.cts

@@ -1,5 +1,5 @@
-import { C as TColumnDiff, F as TDbForeignKey, G as TExistingColumn, K as TExistingTableOption, M as TDbDefaultValue, P as TDbFieldMeta, U as TDbStorageType, pt as TGenericLogger, rt as TTableOptionDiff, t as AtscriptDbReadable } from "./db-readable-mhPp-MPv.cjs";
-import { r as AtscriptDbView, t as DbSpace } from "./db-space-BhOc9_OO.cjs";
+import { G as TDbStorageType, I as TDbFieldMeta, J as TExistingTableOption, L as TDbForeignKey, P as TDbDefaultValue, T as TColumnDiff, _t as TGenericLogger, at as TTableOptionDiff, q as TExistingColumn, t as AtscriptDbReadable } from "./db-readable-BepVc21V.cjs";
+import { i as AtscriptDbView, t as DbSpace } from "./db-space-CWhIEC7E.cjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/schema/sync-entry.d.ts
@@ -132,6 +132,8 @@ interface TFieldSnapshot {
   defaultValue?: TDbDefaultValue;
   /** Adapter-specific mapped type (e.g., "VARCHAR(255)", "INTEGER"). */
   mappedType?: string;
+  /** `@db.encrypted` — toggling encryption changes the snapshot hash on every adapter. */
+  encrypted?: boolean;
 }
 interface TIndexSnapshot {
   key: string;

package/dist/sync.d.mts

@@ -1,5 +1,5 @@
-import { C as TColumnDiff, F as TDbForeignKey, G as TExistingColumn, K as TExistingTableOption, M as TDbDefaultValue, P as TDbFieldMeta, U as TDbStorageType, pt as TGenericLogger, rt as TTableOptionDiff, t as AtscriptDbReadable } from "./db-readable-CXdHBtF6.mjs";
-import { r as AtscriptDbView, t as DbSpace } from "./db-space-BYyVZnL1.mjs";
+import { G as TDbStorageType, I as TDbFieldMeta, J as TExistingTableOption, L as TDbForeignKey, P as TDbDefaultValue, T as TColumnDiff, _t as TGenericLogger, at as TTableOptionDiff, q as TExistingColumn, t as AtscriptDbReadable } from "./db-readable-Ds01ezjj.mjs";
+import { i as AtscriptDbView, t as DbSpace } from "./db-space-0U_4PiNS.mjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/schema/sync-entry.d.ts
@@ -132,6 +132,8 @@ interface TFieldSnapshot {
   defaultValue?: TDbDefaultValue;
   /** Adapter-specific mapped type (e.g., "VARCHAR(255)", "INTEGER"). */
   mappedType?: string;
+  /** `@db.encrypted` — toggling encryption changes the snapshot hash on every adapter. */
+  encrypted?: boolean;
 }
 interface TIndexSnapshot {
   key: string;

package/dist/sync.mjs

@@ -1,4 +1,4 @@
-import { g as NoopLogger } from "./db-view-Sq4wCceR.mjs";
+import { S as NoopLogger } from "./db-view-TyzB5VFb.mjs";
 //#region src/schema/schema-hash.ts
 /** Extracts sorted field snapshots from a readable's field descriptors. */
 function extractFieldSnapshots(fields, typeMapper) {
@@ -12,6 +12,7 @@ function extractFieldSnapshots(fields, typeMapper) {
 		};
 		if (f.defaultValue) snap.defaultValue = f.defaultValue;
 		if (typeMapper) snap.mappedType = typeMapper(f);
+		if (f.encrypted) snap.encrypted = true;
 		return snap;
 	}).toSorted((a, b) => a.physicalName.localeCompare(b.physicalName));
 }

package/dist/{validator-f43UcYiY.cjs → validator-BSk8lPH1.cjs}

@@ -54,6 +54,21 @@ function createDbValidatorPlugin() {
 	return (ctx, def, value) => {
 		const dbCtx = ctx.context;
 		if (!dbCtx) return;
+		if (def.type.tags?.has("geoPoint") && value !== void 0 && value !== null) {
+			if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== "number" || typeof value[1] !== "number" || !Number.isFinite(value[0]) || !Number.isFinite(value[1])) {
+				ctx.error("Expected a [lng, lat] tuple of two finite numbers (GeoJSON order)");
+				return false;
+			}
+			if (value[0] < -180 || value[0] > 180) {
+				ctx.error(`Longitude ${value[0]} out of range [-180, 180] (geo points are [lng, lat])`);
+				return false;
+			}
+			if (value[1] < -90 || value[1] > 90) {
+				ctx.error(`Latitude ${value[1]} out of range [-90, 90] (geo points are [lng, lat])`);
+				return false;
+			}
+			return true;
+		}
 		const isTo = def.metadata.has("db.rel.to");
 		const isFrom = def.metadata.has("db.rel.from");
 		const isVia = def.metadata.has("db.rel.via");

package/dist/{validator-bLsSgi0N.mjs → validator-C7plt6Kf.mjs}

@@ -54,6 +54,21 @@ function createDbValidatorPlugin() {
 	return (ctx, def, value) => {
 		const dbCtx = ctx.context;
 		if (!dbCtx) return;
+		if (def.type.tags?.has("geoPoint") && value !== void 0 && value !== null) {
+			if (!Array.isArray(value) || value.length !== 2 || typeof value[0] !== "number" || typeof value[1] !== "number" || !Number.isFinite(value[0]) || !Number.isFinite(value[1])) {
+				ctx.error("Expected a [lng, lat] tuple of two finite numbers (GeoJSON order)");
+				return false;
+			}
+			if (value[0] < -180 || value[0] > 180) {
+				ctx.error(`Longitude ${value[0]} out of range [-180, 180] (geo points are [lng, lat])`);
+				return false;
+			}
+			if (value[1] < -90 || value[1] > 90) {
+				ctx.error(`Latitude ${value[1]} out of range [-90, 90] (geo points are [lng, lat])`);
+				return false;
+			}
+			return true;
+		}
 		const isTo = def.metadata.has("db.rel.to");
 		const isFrom = def.metadata.has("db.rel.from");
 		const isVia = def.metadata.has("db.rel.via");

package/dist/validator.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_ops = require("./ops.cjs");
-const require_validator = require("./validator-f43UcYiY.cjs");
+const require_validator = require("./validator-BSk8lPH1.cjs");
 exports.$cas = require_ops.$cas;
 exports.$dec = require_ops.$dec;
 exports.$inc = require_ops.$inc;

package/dist/validator.mjs

@@ -1,3 +1,3 @@
 import { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, isDbFieldOp } from "./ops.mjs";
-import { a as isNavRelation, i as forceNavNonOptional, n as buildValidationContext, o as createDbValidatorPlugin, r as dbPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-bLsSgi0N.mjs";
+import { a as isNavRelation, i as forceNavNonOptional, n as buildValidationContext, o as createDbValidatorPlugin, r as dbPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-C7plt6Kf.mjs";
 export { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, buildDbValidator, buildValidationContext, createDbValidatorPlugin, dbPlugin, forceNavNonOptional, getKeyProps, isDbFieldOp, isNavRelation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atscript/db",
-  "version": "0.1.103",
+  "version": "0.1.105",
   "description": "Database adapter utilities for atscript.",
   "keywords": [
     "atscript",
@@ -71,14 +71,14 @@
     "access": "public"
   },
   "devDependencies": {
-    "@atscript/core": "^0.1.75",
-    "@atscript/typescript": "^0.1.75",
+    "@atscript/core": "^0.1.76",
+    "@atscript/typescript": "^0.1.76",
     "@uniqu/core": "^0.1.6",
-    "unplugin-atscript": "^0.1.75"
+    "unplugin-atscript": "^0.1.76"
   },
   "peerDependencies": {
-    "@atscript/core": "^0.1.75",
-    "@atscript/typescript": "^0.1.75",
+    "@atscript/core": "^0.1.76",
+    "@atscript/typescript": "^0.1.76",
     "@uniqu/core": "^0.1.6"
   },
   "scripts": {