@atscript/db 0.1.122 → 0.1.123

package/dist/{db-readable-wyKeE8ut.d.mts → db-readable-BkAGccv9.d.mts}

@@ -238,6 +238,12 @@ interface TFieldMeta {
   encrypted?: boolean;
   /** Present (true) when the field carries a `@db.index.geo` geospatial index. */
   geo?: boolean;
+  /**
+   * Present (true) when the field is write-only over HTTP (`@db.writeOnly` or
+   * stamped by a permission overlay): settable in write payloads, never
+   * present in read responses. UIs render it as a set-only input.
+   */
+  writeOnly?: boolean;
 }
 /** Built-in CRUD operation names; map 1:1 to public method names. */
 type TCrudOp = "query" | "pages" | "one" | "geo" | "insert" | "update" | "replace" | "remove";

package/dist/{db-readable-DoJqR5pb.d.cts → db-readable-C0nDKX8A.d.cts}

@@ -238,6 +238,12 @@ interface TFieldMeta {
   encrypted?: boolean;
   /** Present (true) when the field carries a `@db.index.geo` geospatial index. */
   geo?: boolean;
+  /**
+   * Present (true) when the field is write-only over HTTP (`@db.writeOnly` or
+   * stamped by a permission overlay): settable in write payloads, never
+   * present in read responses. UIs render it as a set-only input.
+   */
+  writeOnly?: boolean;
 }
 /** Built-in CRUD operation names; map 1:1 to public method names. */
 type TCrudOp = "query" | "pages" | "one" | "geo" | "insert" | "update" | "replace" | "remove";

package/dist/{db-space-B3kgrWvc.d.mts → db-space-B_ASuDaR.d.mts}

@@ -1,4 +1,4 @@
-import { C as TCascadeResolver, F as TDbDeleteResult, H as TDbInsertResult, K as TDbUpdateResult, V as TDbInsertManyResult, X as TFkLookupResolver, _t as TGenericLogger, a as TDbEncryptionOptions, c as BaseDbAdapter, ct as TWriteTableResolver, i as DbEncryption, ot as TTableResolver, pt as TableMetadata, t as AtscriptDbReadable } from "./db-readable-wyKeE8ut.mjs";
+import { C as TCascadeResolver, F as TDbDeleteResult, H as TDbInsertResult, K as TDbUpdateResult, V as TDbInsertManyResult, X as TFkLookupResolver, _t as TGenericLogger, a as TDbEncryptionOptions, c as BaseDbAdapter, ct as TWriteTableResolver, i as DbEncryption, ot as TTableResolver, pt as TableMetadata, t as AtscriptDbReadable } from "./db-readable-BkAGccv9.mjs";
 import { AtscriptQueryComparison, AtscriptQueryFieldRef, AtscriptQueryFieldRef as AtscriptQueryFieldRef$1, AtscriptQueryNode, AtscriptQueryNode as AtscriptQueryNode$1, AtscriptRef, FlatOf, NavPropsOf, OwnPropsOf, PrimaryKeyOf, TAtscriptAnnotatedType, TAtscriptDataType, Validator } from "@atscript/typescript/utils";
 import { FilterExpr } from "@uniqu/core";
 

package/dist/{db-space-Bglferws.d.cts → db-space-CSntT6yS.d.cts}

@@ -1,4 +1,4 @@
-import { C as TCascadeResolver, F as TDbDeleteResult, H as TDbInsertResult, K as TDbUpdateResult, V as TDbInsertManyResult, X as TFkLookupResolver, _t as TGenericLogger, a as TDbEncryptionOptions, c as BaseDbAdapter, ct as TWriteTableResolver, i as DbEncryption, ot as TTableResolver, pt as TableMetadata, t as AtscriptDbReadable } from "./db-readable-DoJqR5pb.cjs";
+import { C as TCascadeResolver, F as TDbDeleteResult, H as TDbInsertResult, K as TDbUpdateResult, V as TDbInsertManyResult, X as TFkLookupResolver, _t as TGenericLogger, a as TDbEncryptionOptions, c as BaseDbAdapter, ct as TWriteTableResolver, i as DbEncryption, ot as TTableResolver, pt as TableMetadata, t as AtscriptDbReadable } from "./db-readable-C0nDKX8A.cjs";
 import { FilterExpr } from "@uniqu/core";
 import { AtscriptQueryComparison, AtscriptQueryFieldRef, AtscriptQueryFieldRef as AtscriptQueryFieldRef$1, AtscriptQueryNode, AtscriptQueryNode as AtscriptQueryNode$1, AtscriptRef, FlatOf, NavPropsOf, OwnPropsOf, PrimaryKeyOf, TAtscriptAnnotatedType, TAtscriptDataType, Validator } from "@atscript/typescript/utils";
 

package/dist/{db-view-DuJYYz77.mjs → db-view-3yWBRiCf.mjs}

@@ -2,7 +2,7 @@ import { n as DbError } from "./db-error-BHPXOKzc.mjs";
 import { resolveAlias } from "./agg.mjs";
 import { a as batchPatchNestedTo, c as batchReplaceNestedTo, d as preValidateNestedFrom, f as validateBatch, g as findRemoteFK, h as findFKForRelation, i as batchPatchNestedFrom, l as batchReplaceNestedVia, m as remapDeleteFkViolation, n as batchInsertNestedTo, o as batchPatchNestedVia, p as enrichFkViolation, r as batchInsertNestedVia, s as batchReplaceNestedFrom, t as batchInsertNestedFrom, u as checkDepthOverflow } from "./nested-writer-DI-HeTky.mjs";
 import { separateCas, separateFieldOps } from "./ops.mjs";
-import { i as forceNavNonOptional, r as dbPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-C7plt6Kf.mjs";
+import { i as forceNavNonOptional, r as dbPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-76GCYs80.mjs";
 import { flattenAnnotatedType, isAnnotatedType } from "@atscript/typescript/utils";
 import { AsyncLocalStorage } from "node:async_hooks";
 //#region src/logger.ts

package/dist/{db-view-BEZuIbsz.cjs → db-view-CHAu4N3N.cjs}

@@ -2,7 +2,7 @@ const require_db_error = require("./db-error-DXwEzmYJ.cjs");
 const require_agg = require("./agg.cjs");
 const require_nested_writer = require("./nested-writer-DoDhl3X3.cjs");
 const require_ops = require("./ops.cjs");
-const require_validator = require("./validator-BSk8lPH1.cjs");
+const require_validator = require("./validator-Cf9V8vP9.cjs");
 let _atscript_typescript_utils = require("@atscript/typescript/utils");
 let node_async_hooks = require("node:async_hooks");
 //#region src/logger.ts

package/dist/index.cjs

@@ -1,9 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_db_error = require("./db-error-DXwEzmYJ.cjs");
-const require_db_view = require("./db-view-BEZuIbsz.cjs");
+const require_db_view = require("./db-view-CHAu4N3N.cjs");
 const require_consts = require("./consts-BzRfCcH2.cjs");
 const require_ops = require("./ops.cjs");
-const require_validator = require("./validator-BSk8lPH1.cjs");
+const require_validator = require("./validator-Cf9V8vP9.cjs");
 let node_crypto = require("node:crypto");
 let _uniqu_core = require("@uniqu/core");
 //#region src/encryption.ts

package/dist/index.d.cts

@@ -1,8 +1,8 @@
-import { $ as TIdentification, A as TDbActionLevel, B as TDbIndexType, C as TCascadeResolver, D as TCrudPermissions, E as TCrudOp, F as TDbDeleteResult, G as TDbStorageType, H as TDbInsertResult, I as TDbFieldMeta, J as TExistingTableOption, K as TDbUpdateResult, L as TDbForeignKey, M as TDbCollation, N as TDbDefaultFn, O as TDbActionInfo, P as TDbDefaultValue, Q as TIdDescriptor, R as TDbIndex, S as PrimaryKeyOf, T as TColumnDiff, U as TDbReferentialAction, V as TDbInsertManyResult, W as TDbRelation, X as TFkLookupResolver, Y as TFieldMeta, Z as TFkLookupTarget, _ as FieldOpsFor, _t as TGenericLogger, a as TDbEncryptionOptions, at as TTableOptionDiff, b as NavPropsOf, c as BaseDbAdapter, ct as TWriteTableResolver, d as AggregateFn, dt as UniqueryControls, et as TMetaResponse, f as AggregateQuery, ft as WithRelation, g as DbQuery, gt as NoopLogger, h as DbControls, ht as isGeoPointType, i as DbEncryption, it as TSyncColumnResult, j as TDbActionProcessor, k as TDbActionIntent, l as AggregateControls, lt as TypedWithRelation, m as AtscriptDbWritable, mt as isGeoIndexableType, n as DbResponse, nt as TRelationInfo, o as DocumentFieldMapper, ot as TTableResolver, p as AggregateResult, pt as TableMetadata, q as TExistingColumn, r as resolveDesignType, rt as TSearchIndexInfo, s as FieldMappingStrategy, st as TValueFormatterPair, t as AtscriptDbReadable, tt as TMetadataOverrides, u as AggregateExpr, ut as Uniquery, v as FilterExpr, vt as UniquSelect, w as TCascadeTarget, x as OwnPropsOf, y as FlatOf, z as TDbIndexField } from "./db-readable-DoJqR5pb.cjs";
+import { $ as TIdentification, A as TDbActionLevel, B as TDbIndexType, C as TCascadeResolver, D as TCrudPermissions, E as TCrudOp, F as TDbDeleteResult, G as TDbStorageType, H as TDbInsertResult, I as TDbFieldMeta, J as TExistingTableOption, K as TDbUpdateResult, L as TDbForeignKey, M as TDbCollation, N as TDbDefaultFn, O as TDbActionInfo, P as TDbDefaultValue, Q as TIdDescriptor, R as TDbIndex, S as PrimaryKeyOf, T as TColumnDiff, U as TDbReferentialAction, V as TDbInsertManyResult, W as TDbRelation, X as TFkLookupResolver, Y as TFieldMeta, Z as TFkLookupTarget, _ as FieldOpsFor, _t as TGenericLogger, a as TDbEncryptionOptions, at as TTableOptionDiff, b as NavPropsOf, c as BaseDbAdapter, ct as TWriteTableResolver, d as AggregateFn, dt as UniqueryControls, et as TMetaResponse, f as AggregateQuery, ft as WithRelation, g as DbQuery, gt as NoopLogger, h as DbControls, ht as isGeoPointType, i as DbEncryption, it as TSyncColumnResult, j as TDbActionProcessor, k as TDbActionIntent, l as AggregateControls, lt as TypedWithRelation, m as AtscriptDbWritable, mt as isGeoIndexableType, n as DbResponse, nt as TRelationInfo, o as DocumentFieldMapper, ot as TTableResolver, p as AggregateResult, pt as TableMetadata, q as TExistingColumn, r as resolveDesignType, rt as TSearchIndexInfo, s as FieldMappingStrategy, st as TValueFormatterPair, t as AtscriptDbReadable, tt as TMetadataOverrides, u as AggregateExpr, ut as Uniquery, v as FilterExpr, vt as UniquSelect, w as TCascadeTarget, x as OwnPropsOf, y as FlatOf, z as TDbIndexField } from "./db-readable-C0nDKX8A.cjs";
 import { a as $mul, c as $update, d as TDbFieldOp, f as TFieldOps, g as separateFieldOps, h as separateCas, i as $insert, l as $upsert, m as isDbFieldOp, n as $dec, o as $remove, p as getDbFieldOp, r as $inc, s as $replace, t as $cas, u as TDbCas } from "./ops-DJRnNTVo.cjs";
-import { a as TViewColumnMapping, c as AtscriptQueryNode, d as TViewPlan, f as translateQueryTree, h as NativeIntegrity, i as AtscriptDbView, l as AtscriptRef, m as IntegrityStrategy, n as TAdapterFactory, o as AtscriptQueryComparison, p as AtscriptDbTable, r as TDbSpaceOptions, s as AtscriptQueryFieldRef, t as DbSpace, u as TViewJoin } from "./db-space-Bglferws.cjs";
+import { a as TViewColumnMapping, c as AtscriptQueryNode, d as TViewPlan, f as translateQueryTree, h as NativeIntegrity, i as AtscriptDbView, l as AtscriptRef, m as IntegrityStrategy, n as TAdapterFactory, o as AtscriptQueryComparison, p as AtscriptDbTable, r as TDbSpaceOptions, s as AtscriptQueryFieldRef, t as DbSpace, u as TViewJoin } from "./db-space-CSntT6yS.cjs";
 import { n as createDbValidatorPlugin, t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.cjs";
-import { c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-Crqe6vRW.cjs";
+import { c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-DbV4wTIJ.cjs";
 import { AggregateQuery as AggregateQuery$1, FilterExpr as FilterExpr$1, FilterVisitor, Uniquery as Uniquery$1, computeInsights, isPrimitive, walkFilter } from "@uniqu/core";
 
 //#region src/shared/consts.d.ts

package/dist/index.d.mts

@@ -1,8 +1,8 @@
-import { $ as TIdentification, A as TDbActionLevel, B as TDbIndexType, C as TCascadeResolver, D as TCrudPermissions, E as TCrudOp, F as TDbDeleteResult, G as TDbStorageType, H as TDbInsertResult, I as TDbFieldMeta, J as TExistingTableOption, K as TDbUpdateResult, L as TDbForeignKey, M as TDbCollation, N as TDbDefaultFn, O as TDbActionInfo, P as TDbDefaultValue, Q as TIdDescriptor, R as TDbIndex, S as PrimaryKeyOf, T as TColumnDiff, U as TDbReferentialAction, V as TDbInsertManyResult, W as TDbRelation, X as TFkLookupResolver, Y as TFieldMeta, Z as TFkLookupTarget, _ as FieldOpsFor, _t as TGenericLogger, a as TDbEncryptionOptions, at as TTableOptionDiff, b as NavPropsOf, c as BaseDbAdapter, ct as TWriteTableResolver, d as AggregateFn, dt as UniqueryControls, et as TMetaResponse, f as AggregateQuery, ft as WithRelation, g as DbQuery, gt as NoopLogger, h as DbControls, ht as isGeoPointType, i as DbEncryption, it as TSyncColumnResult, j as TDbActionProcessor, k as TDbActionIntent, l as AggregateControls, lt as TypedWithRelation, m as AtscriptDbWritable, mt as isGeoIndexableType, n as DbResponse, nt as TRelationInfo, o as DocumentFieldMapper, ot as TTableResolver, p as AggregateResult, pt as TableMetadata, q as TExistingColumn, r as resolveDesignType, rt as TSearchIndexInfo, s as FieldMappingStrategy, st as TValueFormatterPair, t as AtscriptDbReadable, tt as TMetadataOverrides, u as AggregateExpr, ut as Uniquery, v as FilterExpr, vt as UniquSelect, w as TCascadeTarget, x as OwnPropsOf, y as FlatOf, z as TDbIndexField } from "./db-readable-wyKeE8ut.mjs";
+import { $ as TIdentification, A as TDbActionLevel, B as TDbIndexType, C as TCascadeResolver, D as TCrudPermissions, E as TCrudOp, F as TDbDeleteResult, G as TDbStorageType, H as TDbInsertResult, I as TDbFieldMeta, J as TExistingTableOption, K as TDbUpdateResult, L as TDbForeignKey, M as TDbCollation, N as TDbDefaultFn, O as TDbActionInfo, P as TDbDefaultValue, Q as TIdDescriptor, R as TDbIndex, S as PrimaryKeyOf, T as TColumnDiff, U as TDbReferentialAction, V as TDbInsertManyResult, W as TDbRelation, X as TFkLookupResolver, Y as TFieldMeta, Z as TFkLookupTarget, _ as FieldOpsFor, _t as TGenericLogger, a as TDbEncryptionOptions, at as TTableOptionDiff, b as NavPropsOf, c as BaseDbAdapter, ct as TWriteTableResolver, d as AggregateFn, dt as UniqueryControls, et as TMetaResponse, f as AggregateQuery, ft as WithRelation, g as DbQuery, gt as NoopLogger, h as DbControls, ht as isGeoPointType, i as DbEncryption, it as TSyncColumnResult, j as TDbActionProcessor, k as TDbActionIntent, l as AggregateControls, lt as TypedWithRelation, m as AtscriptDbWritable, mt as isGeoIndexableType, n as DbResponse, nt as TRelationInfo, o as DocumentFieldMapper, ot as TTableResolver, p as AggregateResult, pt as TableMetadata, q as TExistingColumn, r as resolveDesignType, rt as TSearchIndexInfo, s as FieldMappingStrategy, st as TValueFormatterPair, t as AtscriptDbReadable, tt as TMetadataOverrides, u as AggregateExpr, ut as Uniquery, v as FilterExpr, vt as UniquSelect, w as TCascadeTarget, x as OwnPropsOf, y as FlatOf, z as TDbIndexField } from "./db-readable-BkAGccv9.mjs";
 import { a as $mul, c as $update, d as TDbFieldOp, f as TFieldOps, g as separateFieldOps, h as separateCas, i as $insert, l as $upsert, m as isDbFieldOp, n as $dec, o as $remove, p as getDbFieldOp, r as $inc, s as $replace, t as $cas, u as TDbCas } from "./ops-DJRnNTVo.mjs";
-import { a as TViewColumnMapping, c as AtscriptQueryNode, d as TViewPlan, f as translateQueryTree, h as NativeIntegrity, i as AtscriptDbView, l as AtscriptRef, m as IntegrityStrategy, n as TAdapterFactory, o as AtscriptQueryComparison, p as AtscriptDbTable, r as TDbSpaceOptions, s as AtscriptQueryFieldRef, t as DbSpace, u as TViewJoin } from "./db-space-B3kgrWvc.mjs";
+import { a as TViewColumnMapping, c as AtscriptQueryNode, d as TViewPlan, f as translateQueryTree, h as NativeIntegrity, i as AtscriptDbView, l as AtscriptRef, m as IntegrityStrategy, n as TAdapterFactory, o as AtscriptQueryComparison, p as AtscriptDbTable, r as TDbSpaceOptions, s as AtscriptQueryFieldRef, t as DbSpace, u as TViewJoin } from "./db-space-B_ASuDaR.mjs";
 import { n as createDbValidatorPlugin, t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.mjs";
-import { c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-Crqe6vRW.mjs";
+import { c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-DbV4wTIJ.mjs";
 import { AggregateQuery as AggregateQuery$1, FilterExpr as FilterExpr$1, FilterVisitor, Uniquery as Uniquery$1, computeInsights, isPrimitive, walkFilter } from "@uniqu/core";
 
 //#region src/shared/consts.d.ts

package/dist/index.mjs

@@ -1,8 +1,8 @@
 import { n as DbError, t as CasExhaustedError } from "./db-error-BHPXOKzc.mjs";
-import { C as NoopLogger, S as isGeoPointType, _ as DocumentFieldMapper, a as ApplicationIntegrity, b as TableMetadata, c as IntegrityStrategy, d as resolveDesignType, f as assertGeoPoint, g as RelationalFieldMapper, h as guardQuery, i as decomposePatch, l as NativeIntegrity, m as guardFilter, n as AtscriptDbTable, o as BaseDbAdapter, p as guardAggregate, r as assertNoVersionWrites, s as createFailureCollector, t as AtscriptDbView, u as AtscriptDbReadable, v as FieldMappingStrategy, x as isGeoIndexableType, y as UniquSelect } from "./db-view-DuJYYz77.mjs";
+import { C as NoopLogger, S as isGeoPointType, _ as DocumentFieldMapper, a as ApplicationIntegrity, b as TableMetadata, c as IntegrityStrategy, d as resolveDesignType, f as assertGeoPoint, g as RelationalFieldMapper, h as guardQuery, i as decomposePatch, l as NativeIntegrity, m as guardFilter, n as AtscriptDbTable, o as BaseDbAdapter, p as guardAggregate, r as assertNoVersionWrites, s as createFailureCollector, t as AtscriptDbView, u as AtscriptDbReadable, v as FieldMappingStrategy, x as isGeoIndexableType, y as UniquSelect } from "./db-view-3yWBRiCf.mjs";
 import { t as DEFAULT_DB_SPACE } from "./consts-C_-5_pFq.mjs";
 import { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, getDbFieldOp, isDbFieldOp, separateCas, separateFieldOps } from "./ops.mjs";
-import { a as isNavRelation, i as forceNavNonOptional, n as buildValidationContext, o as createDbValidatorPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-C7plt6Kf.mjs";
+import { a as isNavRelation, i as forceNavNonOptional, n as buildValidationContext, o as createDbValidatorPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-76GCYs80.mjs";
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { computeInsights, isPrimitive, walkFilter } from "@uniqu/core";
 //#region src/encryption.ts

package/dist/plugin.cjs

@@ -349,6 +349,15 @@ const dbColumnAnnotations = {
 		}),
 		filterable: columnCapability("filterable", "filtering"),
 		sortable: columnCapability("sortable", "sorting"),
+		searchable: new _atscript_core.AnnotationSpec({
+			description: "Includes this column in the generic `$search` fallback: when the adapter reports no native search capability (no FTS / Atlas index configured), the readable controller matches the `$search` term as a case-insensitive substring across all `@db.column.searchable` fields (`$or`). Where adapter-native search IS available it wins and this annotation is not consulted. The term is escaped literally — no user-supplied regex. String-typed columns only.\n\n**Example:**\n```atscript\n@db.table \"jobs\"\nexport interface Job {\n  @db.column.searchable\n  jobName: string\n  @db.column.searchable\n  description: string\n}\n```\n",
+			nodeType: ["prop"],
+			passedWhenReferred: false,
+			multiple: false,
+			validate(token, _args, doc) {
+				return require_validation_utils.validateFieldBaseType(token, doc, "@db.column.searchable", ["string"]);
+			}
+		}),
 		version: new _atscript_core.AnnotationSpec({
 			description: "Marks a numeric column as the row's version for optimistic concurrency control (OCC). The adapter auto-increments this column on every UPDATE, and callers may pass `$cas: { <col>: N }` in a write payload to make the update conditional on the current version. Direct writes to the version column (as plain SET, `$inc`, or `$mul`) are rejected.\n\n**Constraints:**\n- At most one version column per table.\n- Must resolve to an integer type (`int`, `int32`, `int64`, etc.).\n- Default value on insert is `0`.\n\n**Example:**\n```atscript\n@db.column.version\nversion: int\n```\n",
 			nodeType: ["prop"],
@@ -477,6 +486,21 @@ const dbColumnAnnotations = {
 			});
 			return errors;
 		}
+	}),
+	writeOnly: new _atscript_core.AnnotationSpec({
+		description: "Marks a field as write-only over HTTP: it may be set through insert/update/replace payloads but NEVER appears in read responses — the readable controller excludes it from every projection, rejects filtering/sorting/grouping on it, and `/meta` serves its TYPE (flagged `writeOnly`) so client preflight validation and generated forms still know its shape. The classic case is a sealed secret (pair with `@db.encrypted`): writable via generic forms, unreadable by anyone.\n\nServer-side code reading through `AtscriptDbTable` still sees the value — the seal is an HTTP-layer contract, not a storage one.\n\n**Example:**\n```atscript\n@db.writeOnly\n@db.encrypted\ncredentials?: string\n```\n",
+		nodeType: ["prop"],
+		passedWhenReferred: false,
+		multiple: false,
+		validate(token, _args, _doc) {
+			const errors = [];
+			if (token.parentNode.countAnnotations("meta.id") > 0) errors.push({
+				message: `@db.writeOnly cannot coexist with @meta.id — the primary key must be readable`,
+				severity: 1,
+				range: token.range
+			});
+			return errors;
+		}
 	})
 };
 function columnCapability(capability, verb) {
@@ -1459,6 +1483,7 @@ const dbPlugin = (options) => ({
 				json: dbColumnAnnotations.json,
 				ignore: dbColumnAnnotations.ignore,
 				encrypted: dbColumnAnnotations.encrypted,
+				writeOnly: dbColumnAnnotations.writeOnly,
 				http: dbTableAnnotations.http,
 				sync: dbTableAnnotations.sync,
 				depth: dbTableAnnotations.depth,

package/dist/plugin.mjs

@@ -314,6 +314,15 @@ const dbColumnAnnotations = {
 		}),
 		filterable: columnCapability("filterable", "filtering"),
 		sortable: columnCapability("sortable", "sorting"),
+		searchable: new AnnotationSpec({
+			description: "Includes this column in the generic `$search` fallback: when the adapter reports no native search capability (no FTS / Atlas index configured), the readable controller matches the `$search` term as a case-insensitive substring across all `@db.column.searchable` fields (`$or`). Where adapter-native search IS available it wins and this annotation is not consulted. The term is escaped literally — no user-supplied regex. String-typed columns only.\n\n**Example:**\n```atscript\n@db.table \"jobs\"\nexport interface Job {\n  @db.column.searchable\n  jobName: string\n  @db.column.searchable\n  description: string\n}\n```\n",
+			nodeType: ["prop"],
+			passedWhenReferred: false,
+			multiple: false,
+			validate(token, _args, doc) {
+				return validateFieldBaseType(token, doc, "@db.column.searchable", ["string"]);
+			}
+		}),
 		version: new AnnotationSpec({
 			description: "Marks a numeric column as the row's version for optimistic concurrency control (OCC). The adapter auto-increments this column on every UPDATE, and callers may pass `$cas: { <col>: N }` in a write payload to make the update conditional on the current version. Direct writes to the version column (as plain SET, `$inc`, or `$mul`) are rejected.\n\n**Constraints:**\n- At most one version column per table.\n- Must resolve to an integer type (`int`, `int32`, `int64`, etc.).\n- Default value on insert is `0`.\n\n**Example:**\n```atscript\n@db.column.version\nversion: int\n```\n",
 			nodeType: ["prop"],
@@ -442,6 +451,21 @@ const dbColumnAnnotations = {
 			});
 			return errors;
 		}
+	}),
+	writeOnly: new AnnotationSpec({
+		description: "Marks a field as write-only over HTTP: it may be set through insert/update/replace payloads but NEVER appears in read responses — the readable controller excludes it from every projection, rejects filtering/sorting/grouping on it, and `/meta` serves its TYPE (flagged `writeOnly`) so client preflight validation and generated forms still know its shape. The classic case is a sealed secret (pair with `@db.encrypted`): writable via generic forms, unreadable by anyone.\n\nServer-side code reading through `AtscriptDbTable` still sees the value — the seal is an HTTP-layer contract, not a storage one.\n\n**Example:**\n```atscript\n@db.writeOnly\n@db.encrypted\ncredentials?: string\n```\n",
+		nodeType: ["prop"],
+		passedWhenReferred: false,
+		multiple: false,
+		validate(token, _args, _doc) {
+			const errors = [];
+			if (token.parentNode.countAnnotations("meta.id") > 0) errors.push({
+				message: `@db.writeOnly cannot coexist with @meta.id — the primary key must be readable`,
+				severity: 1,
+				range: token.range
+			});
+			return errors;
+		}
 	})
 };
 function columnCapability(capability, verb) {
@@ -1424,6 +1448,7 @@ const dbPlugin = (options) => ({
 				json: dbColumnAnnotations.json,
 				ignore: dbColumnAnnotations.ignore,
 				encrypted: dbColumnAnnotations.encrypted,
+				writeOnly: dbColumnAnnotations.writeOnly,
 				http: dbTableAnnotations.http,
 				sync: dbTableAnnotations.sync,
 				depth: dbTableAnnotations.depth,

package/dist/rel.d.cts

@@ -1,4 +1,4 @@
-import { L as TDbForeignKey, W as TDbRelation, _t as TGenericLogger, c as BaseDbAdapter, ct as TWriteTableResolver, ot as TTableResolver, pt as TableMetadata } from "./db-readable-DoJqR5pb.cjs";
+import { L as TDbForeignKey, W as TDbRelation, _t as TGenericLogger, c as BaseDbAdapter, ct as TWriteTableResolver, ot as TTableResolver, pt as TableMetadata } from "./db-readable-C0nDKX8A.cjs";
 import { t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.cjs";
 import { FilterExpr, WithRelation } from "@uniqu/core";
 import { Validator } from "@atscript/typescript/utils";

package/dist/rel.d.mts

@@ -1,4 +1,4 @@
-import { L as TDbForeignKey, W as TDbRelation, _t as TGenericLogger, c as BaseDbAdapter, ct as TWriteTableResolver, ot as TTableResolver, pt as TableMetadata } from "./db-readable-wyKeE8ut.mjs";
+import { L as TDbForeignKey, W as TDbRelation, _t as TGenericLogger, c as BaseDbAdapter, ct as TWriteTableResolver, ot as TTableResolver, pt as TableMetadata } from "./db-readable-BkAGccv9.mjs";
 import { t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.mjs";
 import { Validator } from "@atscript/typescript/utils";
 import { FilterExpr, WithRelation } from "@uniqu/core";

package/dist/sync.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_db_view = require("./db-view-BEZuIbsz.cjs");
+const require_db_view = require("./db-view-CHAu4N3N.cjs");
 //#region src/schema/schema-hash.ts
 /** Extracts sorted field snapshots from a readable's field descriptors. */
 function extractFieldSnapshots(fields, typeMapper) {

package/dist/sync.d.cts

@@ -1,5 +1,5 @@
-import { G as TDbStorageType, I as TDbFieldMeta, J as TExistingTableOption, L as TDbForeignKey, P as TDbDefaultValue, T as TColumnDiff, _t as TGenericLogger, at as TTableOptionDiff, q as TExistingColumn, t as AtscriptDbReadable } from "./db-readable-DoJqR5pb.cjs";
-import { i as AtscriptDbView, t as DbSpace } from "./db-space-Bglferws.cjs";
+import { G as TDbStorageType, I as TDbFieldMeta, J as TExistingTableOption, L as TDbForeignKey, P as TDbDefaultValue, T as TColumnDiff, _t as TGenericLogger, at as TTableOptionDiff, q as TExistingColumn, t as AtscriptDbReadable } from "./db-readable-C0nDKX8A.cjs";
+import { i as AtscriptDbView, t as DbSpace } from "./db-space-CSntT6yS.cjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/schema/sync-entry.d.ts

package/dist/sync.d.mts

@@ -1,5 +1,5 @@
-import { G as TDbStorageType, I as TDbFieldMeta, J as TExistingTableOption, L as TDbForeignKey, P as TDbDefaultValue, T as TColumnDiff, _t as TGenericLogger, at as TTableOptionDiff, q as TExistingColumn, t as AtscriptDbReadable } from "./db-readable-wyKeE8ut.mjs";
-import { i as AtscriptDbView, t as DbSpace } from "./db-space-B3kgrWvc.mjs";
+import { G as TDbStorageType, I as TDbFieldMeta, J as TExistingTableOption, L as TDbForeignKey, P as TDbDefaultValue, T as TColumnDiff, _t as TGenericLogger, at as TTableOptionDiff, q as TExistingColumn, t as AtscriptDbReadable } from "./db-readable-BkAGccv9.mjs";
+import { i as AtscriptDbView, t as DbSpace } from "./db-space-B_ASuDaR.mjs";
 import { TAtscriptAnnotatedType } from "@atscript/typescript/utils";
 
 //#region src/schema/sync-entry.d.ts

package/dist/sync.mjs

@@ -1,4 +1,4 @@
-import { C as NoopLogger } from "./db-view-DuJYYz77.mjs";
+import { C as NoopLogger } from "./db-view-3yWBRiCf.mjs";
 //#region src/schema/schema-hash.ts
 /** Extracts sorted field snapshots from a readable's field descriptors. */
 function extractFieldSnapshots(fields, typeMapper) {

package/dist/{validator-C7plt6Kf.mjs → validator-76GCYs80.mjs}

@@ -303,13 +303,17 @@ const dbPlugin = createDbValidatorPlugin();
 * @param type - The annotated type to validate against.
 * @param mode - The write operation mode.
 * @param extraPlugins - Additional adapter-specific plugins (prepended before the db plugin).
+* @param opts - `unknownProps` overrides the validator's unknown-property policy
+*   (used by db-client's `lenientWrites`, where the served type may be a
+*   projection of the full server-side type).
 */
-function buildDbValidator(type, mode, extraPlugins) {
+function buildDbValidator(type, mode, extraPlugins, opts) {
 	const plugins = extraPlugins ? [...extraPlugins, dbPlugin] : [dbPlugin];
 	return type.validator({
 		plugins,
 		partial: mode === "patch",
-		replace: forceNavNonOptional
+		replace: forceNavNonOptional,
+		...opts?.unknownProps ? { unknownProps: opts.unknownProps } : {}
 	});
 }
 /** Returns true if the annotated type is a navigation relation (TO/FROM/VIA). */

package/dist/{validator-BSk8lPH1.cjs → validator-Cf9V8vP9.cjs}

@@ -303,13 +303,17 @@ const dbPlugin = createDbValidatorPlugin();
 * @param type - The annotated type to validate against.
 * @param mode - The write operation mode.
 * @param extraPlugins - Additional adapter-specific plugins (prepended before the db plugin).
+* @param opts - `unknownProps` overrides the validator's unknown-property policy
+*   (used by db-client's `lenientWrites`, where the served type may be a
+*   projection of the full server-side type).
 */
-function buildDbValidator(type, mode, extraPlugins) {
+function buildDbValidator(type, mode, extraPlugins, opts) {
 	const plugins = extraPlugins ? [...extraPlugins, dbPlugin] : [dbPlugin];
 	return type.validator({
 		plugins,
 		partial: mode === "patch",
-		replace: forceNavNonOptional
+		replace: forceNavNonOptional,
+		...opts?.unknownProps ? { unknownProps: opts.unknownProps } : {}
 	});
 }
 /** Returns true if the annotated type is a navigation relation (TO/FROM/VIA). */

package/dist/{validator-Crqe6vRW.d.cts → validator-DbV4wTIJ.d.cts}

@@ -39,8 +39,13 @@ declare const dbPlugin: TValidatorPlugin;
  * @param type - The annotated type to validate against.
  * @param mode - The write operation mode.
  * @param extraPlugins - Additional adapter-specific plugins (prepended before the db plugin).
+ * @param opts - `unknownProps` overrides the validator's unknown-property policy
+ *   (used by db-client's `lenientWrites`, where the served type may be a
+ *   projection of the full server-side type).
  */
-declare function buildDbValidator(type: TAtscriptAnnotatedType, mode: ValidatorMode, extraPlugins?: TValidatorPlugin[]): Validator<any>;
+declare function buildDbValidator(type: TAtscriptAnnotatedType, mode: ValidatorMode, extraPlugins?: TValidatorPlugin[], opts?: {
+  unknownProps?: "strip" | "ignore" | "error";
+}): Validator<any>;
 /** Returns true if the annotated type is a navigation relation (TO/FROM/VIA). */
 declare function isNavRelation(type: TAtscriptAnnotatedType): boolean;
 /**

package/dist/{validator-Crqe6vRW.d.mts → validator-DbV4wTIJ.d.mts}

@@ -39,8 +39,13 @@ declare const dbPlugin: TValidatorPlugin;
  * @param type - The annotated type to validate against.
  * @param mode - The write operation mode.
  * @param extraPlugins - Additional adapter-specific plugins (prepended before the db plugin).
+ * @param opts - `unknownProps` overrides the validator's unknown-property policy
+ *   (used by db-client's `lenientWrites`, where the served type may be a
+ *   projection of the full server-side type).
  */
-declare function buildDbValidator(type: TAtscriptAnnotatedType, mode: ValidatorMode, extraPlugins?: TValidatorPlugin[]): Validator<any>;
+declare function buildDbValidator(type: TAtscriptAnnotatedType, mode: ValidatorMode, extraPlugins?: TValidatorPlugin[], opts?: {
+  unknownProps?: "strip" | "ignore" | "error";
+}): Validator<any>;
 /** Returns true if the annotated type is a navigation relation (TO/FROM/VIA). */
 declare function isNavRelation(type: TAtscriptAnnotatedType): boolean;
 /**

package/dist/validator.cjs

@@ -1,6 +1,6 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_ops = require("./ops.cjs");
-const require_validator = require("./validator-BSk8lPH1.cjs");
+const require_validator = require("./validator-Cf9V8vP9.cjs");
 exports.$cas = require_ops.$cas;
 exports.$dec = require_ops.$dec;
 exports.$inc = require_ops.$inc;

package/dist/validator.d.cts

@@ -1,4 +1,4 @@
 import { a as $mul, c as $update, d as TDbFieldOp, i as $insert, l as $upsert, m as isDbFieldOp, n as $dec, o as $remove, r as $inc, s as $replace, t as $cas, u as TDbCas } from "./ops-DJRnNTVo.cjs";
 import { n as createDbValidatorPlugin, t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.cjs";
-import { a as dbPlugin, c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-Crqe6vRW.cjs";
+import { a as dbPlugin, c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-DbV4wTIJ.cjs";
 export { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, type DbValidationContext, type TArrayPatch, type TDbCas, type TDbFieldOp, type TDbPatch, ValidationContext, ValidatorMode, buildDbValidator, buildValidationContext, createDbValidatorPlugin, dbPlugin, forceNavNonOptional, getKeyProps, isDbFieldOp, isNavRelation };

package/dist/validator.d.mts

@@ -1,4 +1,4 @@
 import { a as $mul, c as $update, d as TDbFieldOp, i as $insert, l as $upsert, m as isDbFieldOp, n as $dec, o as $remove, r as $inc, s as $replace, t as $cas, u as TDbCas } from "./ops-DJRnNTVo.mjs";
 import { n as createDbValidatorPlugin, t as DbValidationContext } from "./db-validator-plugin-BWy60OvG.mjs";
-import { a as dbPlugin, c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-Crqe6vRW.mjs";
+import { a as dbPlugin, c as TArrayPatch, i as buildValidationContext, l as TDbPatch, n as ValidatorMode, o as forceNavNonOptional, r as buildDbValidator, s as isNavRelation, t as ValidationContext, u as getKeyProps } from "./validator-DbV4wTIJ.mjs";
 export { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, type DbValidationContext, type TArrayPatch, type TDbCas, type TDbFieldOp, type TDbPatch, ValidationContext, ValidatorMode, buildDbValidator, buildValidationContext, createDbValidatorPlugin, dbPlugin, forceNavNonOptional, getKeyProps, isDbFieldOp, isNavRelation };

package/dist/validator.mjs

@@ -1,3 +1,3 @@
 import { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, isDbFieldOp } from "./ops.mjs";
-import { a as isNavRelation, i as forceNavNonOptional, n as buildValidationContext, o as createDbValidatorPlugin, r as dbPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-C7plt6Kf.mjs";
+import { a as isNavRelation, i as forceNavNonOptional, n as buildValidationContext, o as createDbValidatorPlugin, r as dbPlugin, s as getKeyProps, t as buildDbValidator } from "./validator-76GCYs80.mjs";
 export { $cas, $dec, $inc, $insert, $mul, $remove, $replace, $update, $upsert, buildDbValidator, buildValidationContext, createDbValidatorPlugin, dbPlugin, forceNavNonOptional, getKeyProps, isDbFieldOp, isNavRelation };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atscript/db",
-  "version": "0.1.122",
+  "version": "0.1.123",
   "description": "Database adapter utilities for atscript.",
   "keywords": [
     "atscript",