@happyvertical/smrt-core 0.43.10 → 0.44.1

package/dist/cascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"cascade.js","names":[],"sources":["../src/cascade.ts"],"sourcesContent":["/**\n * App-side referential integrity for `SmrtObject.delete()` (#2371).\n *\n * Same-package `@foreignKey` fields now emit database constraints where the\n * engine can enforce the declared policy. Cross-package references and older\n * schemas still rely on this application-side path. Before this module,\n * `delete()` removed the object's own row and nothing else: junction rows,\n * polymorphic association rows, `_smrt_embeddings` and `_smrt_contexts` entries\n * were all left pointing at an id that no longer resolved, and\n * `@foreignKey(..., { onDelete })` was metadata nobody read.\n *\n * This module implements those semantics in the application layer. It mirrors\n * what a DB-level constraint would do, deliberately including the parts that\n * make it *unlike* a model-layer delete:\n *\n * - Cascaded rows are removed with set-based statements. Their `beforeDelete` /\n *   `afterDelete` hooks and interceptors do **not** run, and no change-feed\n *   tombstone is written for them — exactly as `ON DELETE CASCADE` behaves.\n *   Only the object `delete()` was called on runs the full lifecycle.\n * - When anything needs cascading, everything runs inside a single\n *   transaction when the adapter exposes one, so a partial cascade cannot\n *   survive a failure. A class with no typed references AND no registered\n *   polymorphic association class anywhere in the process skips the\n *   transaction — see {@link runCascadeDelete}. A `metaType` column can point\n *   at any class at runtime, so a polymorphic association class is always\n *   plausibly relevant; in an app with even one registered, this fast path is\n *   rare, not the common case.\n *\n * ## Which references are followed\n *\n * A reference is any `@foreignKey` / `@crossPackageRef` field on a registered\n * class whose target resolves to the deleted object's class (or one of its\n * registered STI ancestors), plus the polymorphic `(metaType, metaId)` pair on\n * {@link SmrtPolymorphicAssociation} subclasses.\n *\n * The action comes from the field's declared `onDelete`. When it is not\n * declared, the default is derived from the referencing class's natural key:\n *\n * | Reference | Default when `onDelete` is absent |\n * |---|---|\n * | Column is part of the referencing class's `conflictColumns`, and is not a `@tenantId()` field | `CASCADE` |\n * | Polymorphic `(metaType, metaId)` association row | `CASCADE` |\n * | Ordinary same-package reference | `NO ACTION` (deletion is refused while references remain) |\n * | Every `@tenantId()` field | Excluded: tenant scope is not an ownership edge |\n *\n * The natural-key rule is what makes junction rows work without any\n * per-package annotation: a junction declares\n * `@smrt({ conflictColumns: ['content_id', 'asset_id', 'relationship'] })`, so\n * `content_id` identifies the row and the row cannot outlive the content it\n * links. An ordinary child (`Order.customerId`) is keyed by `(slug, context)`,\n * so it defaults to immediate `NO ACTION` unless it opts in with\n * `@foreignKey(Customer, { onDelete: 'CASCADE' })`.\n *\n * `@tenantId()` fields are excluded from the natural-key rule even though\n * `@happyvertical/smrt-tenancy` leads a tenant-scoped class's *default*\n * `conflictColumns` with the tenant column (#2360): the tenant column scopes\n * ownership, it does not identify the row the way a junction's foreign key\n * does, and it targets a class (`Tenant`) that is virtually always\n * referenced. Without this exclusion, deleting one `Tenant` row would\n * recursively CASCADE through every tenant-scoped table that has not\n * declared its own `conflictColumns` — the overwhelming majority. The field\n * is detected via the `__tenancy.isTenantIdField` marker `@tenantId()`\n * attaches to its own registration (`FieldMeta.__tenancy`, read structurally\n * so `smrt-core` never depends on `smrt-tenancy`). `@tenantId()` exposes no\n * `onDelete` option today, so this cannot currently be overridden per field.\n *\n * @see https://github.com/happyvertical/smrt/issues/2371\n * @module\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { classifyDatabaseError } from './db-errors.js';\nimport { ConfigurationError, DatabaseError } from './errors.js';\n// Type-only: erased at runtime, so it cannot re-enter the\n// `registry → object → cascade` import cycle.\nimport type { ObjectRegistry } from './registry.js';\nimport {\n  normalizeForeignKeyAction,\n  resolveForeignKeyDeleteAction,\n} from './schema/foreign-key-policy.js';\nimport type { ForeignKeyAction } from './schema/types.js';\nimport { chunkArray, IN_LIST_CHUNK_SIZE } from './utils/chunk.js';\nimport { toSnakeCase } from './utils/naming.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Referential action applied to rows pointing at a deleted object.\n *\n * Same vocabulary as SQL's `ON DELETE`, enforced by the framework before the\n * engine. `NO ACTION` is preflighted like an immediate restrictive action so\n * application-side and database-side enforcement agree.\n */\nexport type OnDeleteAction = ForeignKeyAction;\n\n/** Table holding framework-managed per-object memory entries. */\nconst CONTEXTS_TABLE = '_smrt_contexts';\n\n/** Table holding framework-managed per-object embedding vectors. */\nconst EMBEDDINGS_TABLE = '_smrt_embeddings';\n\n/**\n * Reserved `_smrt_contexts.owner_id` used by `SmrtCollection.remember()` for\n * collection-scoped memory. A real object id is a UUID and can never equal it,\n * but the guard keeps a malformed id from wiping every sibling's defaults.\n */\nconst COLLECTION_OWNER_SENTINEL = '__collection__';\n\n/**\n * Maximum number of cascade levels followed from the object `delete()` was\n * called on. A cycle between two classes that both declare `onDelete: 'CASCADE'`\n * is broken by the visited set; this bound catches unbounded *chains*.\n */\nconst MAX_CASCADE_DEPTH = 10;\n\n/** One reference that must be resolved before the target row can be removed. */\nexport interface CascadeReference {\n  /** Registered name of the class holding the referencing column. */\n  className: string;\n  /** Table holding the referencing rows. */\n  tableName: string;\n  /** Field name (camelCase) on the referencing class. */\n  fieldName: string;\n  /** Column (snake_case) holding the reference. */\n  column: string;\n  /** Resolved action. `NO ACTION` is preflighted like an immediate RESTRICT. */\n  action: OnDeleteAction;\n  /** `true` when the action was declared rather than derived from the key. */\n  declared: boolean;\n}\n\n/** A polymorphic association table that can point at any class. */\nexport interface CascadePolymorphicReference {\n  /** Registered name of the association class. */\n  className: string;\n  /** Table holding the association rows. */\n  tableName: string;\n}\n\n/** Everything that must happen before rows of one class can be deleted. */\nexport interface CascadePlan {\n  /** Typed `@foreignKey` / `@crossPackageRef` references, action-resolved. */\n  references: CascadeReference[];\n  /** Polymorphic association tables that may point at this class. */\n  polymorphic: CascadePolymorphicReference[];\n  /** `meta_type` values that identify this class in an association row. */\n  metaTypes: string[];\n  /** `true` when nothing references this class and nothing has to be visited. */\n  isEmpty: boolean;\n}\n\n/**\n * Read-only slice of `ObjectRegistry` this module needs.\n *\n * Taking it as a parameter — rather than importing the registry as a value —\n * keeps `cascade.ts` out of the `registry → object → cascade` import cycle,\n * and lets tests drive the planner from a hand-built registry.\n */\nexport type CascadeRegistryView = Pick<\n  typeof ObjectRegistry,\n  | 'getRelationshipMap'\n  | 'getFields'\n  | 'getConflictColumns'\n  | 'getTableName'\n  | 'getSelfReferableNames'\n  | 'getClass'\n  | 'getSTIBase'\n  | 'getDescendants'\n>;\n\n/**\n * Normalize a declared `onDelete` value.\n *\n * Accepts any casing and both `SET NULL` and `SET_NULL`, matching what the\n * schema generator has always carried in the manifest. Returns `undefined` for\n * an unset or unrecognized value so the caller can fall back to the default.\n */\nexport function normalizeOnDelete(value: unknown): OnDeleteAction | undefined {\n  return normalizeForeignKeyAction(value);\n}\n\nfunction isPolymorphicAssociationClass(fields: Map<string, unknown>): boolean {\n  // The three columns `SmrtPolymorphicAssociation` contributes. Requiring all\n  // of them keeps an unrelated class that happens to carry a `metaType` from\n  // being treated as an association table.\n  return fields.has('metaType') && fields.has('metaId') && fields.has('role');\n}\n\n/**\n * Build the cascade plan for one class.\n *\n * The plan is derived entirely from registry metadata, so it is valid for any\n * database the class is used against. It is rebuilt per delete rather than\n * cached: registration is incremental (manifests load lazily, tests register\n * classes between cases) and a stale plan would silently skip a table.\n *\n * @param registry - Registry view (`ObjectRegistry` satisfies it)\n * @param className - Class whose incoming references should be resolved\n */\nexport function buildCascadePlan(\n  registry: CascadeRegistryView,\n  className: string,\n): CascadePlan {\n  // `className` is normally already qualified (delete() passes\n  // getResolvedQualifiedName()), but a common same-package `@foreignKey('X')`\n  // still stores its target as the bare simple name `X`. That still matches:\n  // getSelfReferableNames() walks the full ancestor chain (self included) and\n  // adds each ancestor's *simple* name via `getClass(ancestor)?.name`, so the\n  // simple form is already in the seed set below, not just the loop's\n  // qualified-variant augmentation.\n  const targetNames = new Set(registry.getSelfReferableNames(className));\n  for (const name of [...targetNames]) {\n    const qualified = registry.getClass(name)?.qualifiedName;\n    if (qualified) targetNames.add(qualified);\n  }\n\n  const references: CascadeReference[] = [];\n  const polymorphic: CascadePolymorphicReference[] = [];\n\n  for (const [sourceClass, relationships] of registry.getRelationshipMap()) {\n    const fields = registry.getFields(sourceClass);\n\n    if (isPolymorphicAssociationClass(fields)) {\n      const tableName = registry.getTableName(sourceClass);\n      if (tableName) {\n        polymorphic.push({ className: sourceClass, tableName });\n      }\n    }\n\n    if (relationships.length === 0) continue;\n\n    let conflictColumns: Set<string> | undefined;\n\n    for (const relationship of relationships) {\n      if (\n        relationship.type !== 'foreignKey' &&\n        relationship.type !== 'crossPackageRef'\n      ) {\n        continue;\n      }\n      if (!targetNames.has(relationship.targetClass)) continue;\n\n      // An explicit app-side-only relationship is archival metadata, not a\n      // referential-integrity rule. Its identifier is deliberately allowed to\n      // outlive the parent, so delete planning must not block, null, or remove\n      // the retained row (#2413).\n      if (\n        relationship.type === 'foreignKey' &&\n        relationship.options?.constraint === false\n      ) {\n        continue;\n      }\n\n      const tableName = registry.getTableName(sourceClass);\n      if (!tableName) continue;\n\n      const column = toSnakeCase(relationship.fieldName);\n      if (!conflictColumns) {\n        conflictColumns = new Set(registry.getConflictColumns(sourceClass));\n      }\n\n      // A `@tenantId()` field is a structural scoping marker, not a\n      // junction/ownership key — it lands in `conflictColumns` only because\n      // #2360 leads every tenant-scoped class's *default* natural key with\n      // the tenant column, not because the referencing row is *identified*\n      // by its tenant the way a junction row is identified by its parent.\n      // Without this guard, deleting a `Tenant` would silently CASCADE\n      // through the tenant column of every tenant-scoped class in the\n      // schema that has not declared its own `conflictColumns` — the\n      // overwhelming majority. `@tenantId()` exposes no `onDelete` today, so\n      // an explicit declaration can never widen this back to CASCADE; that\n      // is deliberate until tenant-delete cascade is an explicit decision.\n      const isTenantIdField =\n        relationship.options?.__tenancy?.isTenantIdField === true;\n      if (isTenantIdField) continue;\n\n      const { action, declared } = resolveForeignKeyDeleteAction({\n        declared: relationship.options?.onDelete,\n        isConflictColumn: conflictColumns.has(column),\n        isTenantIdField: false,\n      });\n\n      if (\n        action === 'SET NULL' &&\n        fields.get(relationship.fieldName)?.required\n      ) {\n        // Fail on the declaration, not later on a NOT NULL violation from the\n        // engine — the message there names a column, not the decorator.\n        throw ConfigurationError.invalidConfiguration(\n          `${sourceClass}.${relationship.fieldName} onDelete: 'SET NULL'`,\n          relationship.fieldName,\n          \"a nullable field (mark it `nullable: true`, or use 'CASCADE' / 'RESTRICT')\",\n        );\n      }\n\n      references.push({\n        className: sourceClass,\n        tableName,\n        fieldName: relationship.fieldName,\n        column,\n        action,\n        declared,\n      });\n    }\n  }\n\n  // Both forms are matched deliberately: an association row written before a\n  // class was package-qualified still carries the simple `meta_type`. The\n  // qualified form alone is unambiguous; the simple-name fallback can still\n  // match a same-simple-name sibling class's row if it also shares a\n  // `meta_id` — a real, not just theoretical, risk for a class declaring\n  // `idType: 'text'` (non-UUID, not guaranteed globally unique), the same gap\n  // `deleteSystemRows()` closed for `_smrt_contexts` / `_smrt_embeddings`\n  // (review fix) by adding a class-name filter. Closing it here needs the\n  // same STI-and-legacy-name-aware filter this module already builds for\n  // `deleteSystemRows()` narrowed further to registry-unambiguous simple\n  // names; tracked under #2419 alongside the other same-simple-name\n  // collision gaps rather than reworked here.\n  const metaTypes: string[] = [];\n  const qualified = registry.getClass(className)?.qualifiedName;\n  if (qualified) metaTypes.push(qualified);\n  const simple = registry.getClass(className)?.name ?? className;\n  if (!metaTypes.includes(simple)) metaTypes.push(simple);\n\n  return {\n    references,\n    polymorphic,\n    metaTypes,\n    isEmpty: references.length === 0 && polymorphic.length === 0,\n  };\n}\n\n/** Per-delete state shared by every level of the cascade. */\ninterface CascadeContext {\n  db: DatabaseInterface;\n  registry: CascadeRegistryView;\n  /** `table:id` pairs already expanded, so a reference cycle terminates. */\n  visited: Set<string>;\n  /** Tables touched by the cascade, for read-cache invalidation. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified name of the class that owns each affected table, so the\n   * caller can resolve *that* class's own `@smrt({ cache })` config —\n   * cross-process cache invalidation is a per-class opt-in, and a table\n   * cascaded into belongs to a different class than the one `delete()` was\n   * called on.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/** Resolve a registry-recorded class name to its qualified form, when known. */\nfunction toQualifiedClassName(\n  registry: CascadeRegistryView,\n  className: string,\n): string {\n  return registry.getClass(className)?.qualifiedName ?? className;\n}\n\n/**\n * Every value `_smrt_contexts.owner_class` / `_smrt_embeddings.object_class`\n * could plausibly hold for a row belonging to an id of `className` (review\n * fix): both name forms (qualified + simple — older rows predate package\n * qualification) of `className` itself, plus every other member of its STI\n * hierarchy sharing its table. A CASCADE-collected id can belong to any\n * concrete STI subclass of the declaring reference, which stamps its own\n * (more specific) runtime class name at write time, not the reference's.\n *\n * Narrowing by this set — instead of matching by id alone — closes a\n * cross-class collision: two unrelated classes using `idType: 'text'`\n * (non-UUID, not guaranteed globally unique) could otherwise share an id\n * value and have one's `remember()`/embeddings rows deleted by the other's\n * cascade.\n */\nfunction ownerClassCandidates(\n  registry: CascadeRegistryView,\n  className: string,\n): string[] {\n  const stiBase = registry.getSTIBase(className) ?? className;\n  const members = new Set<string>([\n    className,\n    stiBase,\n    ...registry.getDescendants(stiBase),\n  ]);\n\n  const names = new Set<string>();\n  for (const member of members) {\n    names.add(member);\n    const registered = registry.getClass(member);\n    if (registered?.qualifiedName) names.add(registered.qualifiedName);\n    if (registered?.name) names.add(registered.name);\n  }\n  return [...names];\n}\n\n/**\n * Build the `where` clause matching `column` against one or more ids.\n *\n * A single id uses equality so the planner can use a plain index; multiple ids\n * use the adapter's `in` operator.\n */\nfunction idPredicate(column: string, ids: string[]): Record<string, unknown> {\n  return ids.length === 1 ? { [column]: ids[0] } : { [`${column} in`]: ids };\n}\n\n/**\n * Run a cascade statement against a *referencing* table, tolerating the\n * table (or an expected column) not existing in this database.\n *\n * The cascade plan is built from the in-process registry, which can carry a\n * class from any imported package — including one whose table this specific\n * database was never migrated to include (a partially adopted feature, a\n * package pulled in for its types, or, in a test process, a fixture some\n * other test file registered). A missing referencing table trivially has no\n * rows to act on, so the correct behaviour is identical to the table\n * existing and being empty — this must never abort an otherwise valid\n * delete. Any other failure (a real constraint violation, a lock timeout, a\n * genuine SQL error unrelated to the table's existence) still propagates.\n */\nasync function tolerateMissingTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (classifyDatabaseError(error).kind === 'undefined_object') {\n      logger.warn(\n        `Cascade delete skipped ${context.action} on '${context.table}': ` +\n          'table or column not found in this database.',\n        { error: error instanceof Error ? error.message : String(error) },\n      );\n      return fallback;\n    }\n    throw error;\n  }\n}\n\nasync function selectIds(\n  db: DatabaseInterface,\n  tableName: string,\n  column: string,\n  ids: string[],\n): Promise<string[]> {\n  const found: string[] = [];\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    const rows = await tolerateMissingTable(\n      () => db.list(tableName, idPredicate(column, batch)),\n      [] as Record<string, unknown>[],\n      { table: tableName, action: 'CASCADE select' },\n    );\n    for (const row of rows) {\n      const id = row?.id;\n      if (typeof id === 'string' && id.length > 0) found.push(id);\n    }\n  }\n  return found;\n}\n\nasync function deleteByIds(\n  db: DatabaseInterface,\n  tableName: string,\n  ids: string[],\n): Promise<void> {\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    await tolerateMissingTable(\n      () => db.delete(tableName, idPredicate('id', batch)),\n      undefined,\n      { table: tableName, action: 'CASCADE delete' },\n    );\n  }\n}\n\n/**\n * Remove the framework-managed side rows owned by the given object ids.\n *\n * `_smrt_contexts` and `_smrt_embeddings` are keyed by `(owner_class, owner_id)`\n * and `(object_class, object_id)` respectively. Matched by id *and* class\n * (review fix): id alone would let two unrelated classes using\n * `idType: 'text'` (non-UUID, not guaranteed globally unique) collide on a\n * shared id value and delete each other's memory/embeddings rows. `classNames`\n * is the STI-hierarchy-expanded candidate set from\n * {@link ownerClassCandidates} — the class column stores the *runtime*\n * constructor name, which for an STI hierarchy is a concrete subclass rather\n * than the class the cascade was planned from, so a single exact name is not\n * enough.\n *\n * A missing system table is not an error — an application database may predate\n * the table, and losing derived rows must never fail an otherwise valid delete.\n */\nasync function deleteSystemRows(\n  db: DatabaseInterface,\n  ids: string[],\n  classNames: string[],\n): Promise<void> {\n  const ownerIds = ids.filter(\n    (id) =>\n      typeof id === 'string' &&\n      id.length > 0 &&\n      id !== COLLECTION_OWNER_SENTINEL,\n  );\n  if (ownerIds.length === 0 || classNames.length === 0) return;\n\n  for (const [table, idColumn, classColumn] of [\n    [CONTEXTS_TABLE, 'owner_id', 'owner_class'],\n    [EMBEDDINGS_TABLE, 'object_id', 'object_class'],\n  ] as const) {\n    for (const batch of chunkArray(ownerIds, IN_LIST_CHUNK_SIZE)) {\n      try {\n        await db.delete(table, {\n          ...idPredicate(idColumn, batch),\n          ...idPredicate(classColumn, classNames),\n        });\n      } catch (error) {\n        logger.warn(\n          `Failed to clean ${table} rows during cascade delete: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n      }\n    }\n  }\n}\n\n/**\n * Resolve every reference pointing at `ids` of `className`, recursively.\n *\n * Does **not** delete the rows identified by `ids` — the caller owns that, so\n * `SmrtObject.delete()` keeps issuing its own final statement and its own\n * lifecycle hooks.\n */\nasync function resolveReferences(\n  ctx: CascadeContext,\n  className: string,\n  tableName: string,\n  ids: string[],\n  depth: number,\n): Promise<void> {\n  const pending = ids.filter((id) => {\n    const key = `${tableName}:${id}`;\n    if (ctx.visited.has(key)) return false;\n    ctx.visited.add(key);\n    return true;\n  });\n  if (pending.length === 0) return;\n\n  if (depth > MAX_CASCADE_DEPTH) {\n    throw DatabaseError.constraintViolation(\n      `cascade delete from ${className} exceeded the maximum depth of ` +\n        `${MAX_CASCADE_DEPTH}; check for a chain of onDelete: 'CASCADE' ` +\n        'references that never terminates',\n      className,\n    );\n  }\n\n  const plan = buildCascadePlan(ctx.registry, className);\n\n  // SQL NO ACTION is immediate on every supported SMRT migration path, so the\n  // app-side belt preflights it exactly like RESTRICT before any mutation.\n  for (const reference of plan.references) {\n    if (reference.action !== 'RESTRICT' && reference.action !== 'NO ACTION') {\n      continue;\n    }\n    let remaining = 0;\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      remaining += await tolerateMissingTable(\n        () =>\n          ctx.db.count(\n            reference.tableName,\n            idPredicate(reference.column, batch),\n          ),\n        0,\n        { table: reference.tableName, action: `${reference.action} check` },\n      );\n      if (remaining > 0) break;\n    }\n    if (remaining > 0) {\n      throw DatabaseError.constraintViolation(\n        `${reference.className}.${reference.fieldName} ` +\n          `${reference.declared ? 'declares' : 'resolves to'} onDelete: ` +\n          `'${reference.action}' and ${remaining} row(s) still reference this ` +\n          `${className}`,\n        reference.column,\n      );\n    }\n  }\n\n  for (const reference of plan.references) {\n    if (reference.action === 'SET NULL') {\n      for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n        await tolerateMissingTable(\n          () =>\n            ctx.db.update(\n              reference.tableName,\n              idPredicate(reference.column, batch),\n              { [reference.column]: null },\n            ),\n          undefined,\n          { table: reference.tableName, action: 'SET NULL' },\n        );\n      }\n      ctx.affectedTables.add(reference.tableName);\n      ctx.affectedTableClasses.set(\n        reference.tableName,\n        toQualifiedClassName(ctx.registry, reference.className),\n      );\n      continue;\n    }\n\n    if (reference.action !== 'CASCADE') continue;\n\n    const childIds = await selectIds(\n      ctx.db,\n      reference.tableName,\n      reference.column,\n      pending,\n    );\n    if (childIds.length === 0) continue;\n\n    await resolveReferences(\n      ctx,\n      reference.className,\n      reference.tableName,\n      childIds,\n      depth + 1,\n    );\n    await deleteSystemRows(\n      ctx.db,\n      childIds,\n      ownerClassCandidates(ctx.registry, reference.className),\n    );\n    await deleteByIds(ctx.db, reference.tableName, childIds);\n    ctx.affectedTables.add(reference.tableName);\n    ctx.affectedTableClasses.set(\n      reference.tableName,\n      toQualifiedClassName(ctx.registry, reference.className),\n    );\n  }\n\n  for (const association of plan.polymorphic) {\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      const where: Record<string, unknown> = {\n        ...idPredicate('meta_id', batch),\n      };\n      if (plan.metaTypes.length === 1) {\n        where.meta_type = plan.metaTypes[0];\n      } else {\n        where['meta_type in'] = plan.metaTypes;\n      }\n      const result = await tolerateMissingTable(\n        () => ctx.db.delete(association.tableName, where),\n        undefined,\n        {\n          table: association.tableName,\n          action: 'polymorphic association cleanup',\n        },\n      );\n      if ((result?.affected ?? 0) > 0) {\n        ctx.affectedTables.add(association.tableName);\n        ctx.affectedTableClasses.set(\n          association.tableName,\n          toQualifiedClassName(ctx.registry, association.className),\n        );\n      }\n    }\n  }\n}\n\n/** Outcome of a cascade run, returned so the caller can invalidate caches. */\nexport interface CascadeResult {\n  /** Tables whose rows were removed or nulled, excluding the target's own. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified class name that owns each entry in {@link affectedTables},\n   * where resolvable — lets the caller check *that* class's own\n   * cross-process cache config rather than only its own.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/**\n * Resolve every reference to `ids` of `className` and clean their framework\n * side rows, then hand control back so the caller can delete the rows.\n *\n * Callers are expected to run this on a transaction-bound `db` — see\n * {@link runCascadeDelete}, which owns that decision.\n */\nexport async function cascadeReferencesTo(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: { className: string; tableName: string; ids: string[] },\n): Promise<CascadeResult> {\n  const ctx: CascadeContext = {\n    db,\n    registry,\n    visited: new Set(),\n    affectedTables: new Set(),\n    affectedTableClasses: new Map(),\n  };\n  await resolveReferences(\n    ctx,\n    target.className,\n    target.tableName,\n    target.ids,\n    0,\n  );\n  await deleteSystemRows(\n    db,\n    target.ids,\n    ownerClassCandidates(registry, target.className),\n  );\n  return {\n    affectedTables: ctx.affectedTables,\n    affectedTableClasses: ctx.affectedTableClasses,\n  };\n}\n\ntype TransactionCapable = DatabaseInterface & {\n  transaction?: <T>(\n    this: DatabaseInterface,\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * Run the cascade and the target row's own deletion atomically.\n *\n * When anything references the class and the adapter exposes `transaction()`,\n * the whole sequence runs inside one — including the caller's `deleteSelf`\n * statement, so a failure part-way through cannot leave the object deleted with\n * its junction rows intact (or vice versa). Adapters without transaction\n * support run the same statements sequentially; this is the documented\n * degradation, not a silent one.\n *\n * When nothing references the class there is nothing to keep consistent, and\n * the transaction is skipped — see the comment on that branch.\n *\n * @param db - Database the object is bound to\n * @param registry - Registry view used to build cascade plans\n * @param target - Class, table and id of the object being deleted\n * @param deleteSelf - Issues the target row's own `DELETE`, on the tx-bound db\n * @returns Tables affected by the cascade, for read-cache invalidation\n */\nexport async function runCascadeDelete(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: {\n    className: string;\n    tableName: string;\n    /** An unsaved object has none; the cascade is then a no-op. */\n    id: string | null | undefined;\n  },\n  deleteSelf: (db: DatabaseInterface) => Promise<void>,\n): Promise<CascadeResult> {\n  const ids = target.id ? [target.id] : [];\n\n  // Nothing references this class AND no polymorphic association class is\n  // registered anywhere in the process. `plan.polymorphic` is unconditionally\n  // every registered `SmrtPolymorphicAssociation` subclass — a `metaType`\n  // column can point at any class at runtime, so there is no static metadata\n  // to scope it by, unlike a typed `@foreignKey`/`@crossPackageRef`. This\n  // branch is therefore common for a class with no incoming references in an\n  // app with no polymorphic associations at all, but rare — not \"the\n  // overwhelmingly common case\" — once even one polymorphic class exists\n  // anywhere in the process, since every delete's plan then carries it.\n  // Opening a transaction to wrap statements that cannot disagree with each\n  // other would cost two extra round trips, and on single-connection adapters\n  // it would serialize concurrent deletes behind the transaction queue. Order\n  // the two statements instead: the row goes first, so a failure leaves\n  // everything as it was, and the derived side rows follow under the\n  // best-effort contract they already carry.\n  if (buildCascadePlan(registry, target.className).isEmpty) {\n    await deleteSelf(db);\n    await deleteSystemRows(\n      db,\n      ids,\n      ownerClassCandidates(registry, target.className),\n    );\n    return { affectedTables: new Set(), affectedTableClasses: new Map() };\n  }\n\n  const run = async (bound: DatabaseInterface): Promise<CascadeResult> => {\n    const result = await cascadeReferencesTo(bound, registry, {\n      className: target.className,\n      tableName: target.tableName,\n      ids,\n    });\n    await deleteSelf(bound);\n    return result;\n  };\n\n  const transaction = (db as TransactionCapable).transaction;\n  if (typeof transaction !== 'function') {\n    return run(db);\n  }\n\n  return transaction.call<\n    DatabaseInterface,\n    [(tx: DatabaseInterface) => Promise<CascadeResult>],\n    Promise<CascadeResult>\n  >(db, run);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqFA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAY7C,IAAM,iBAAiB;;AAGvB,IAAM,mBAAmB;;;;;;AAOzB,IAAM,4BAA4B;;;;;;AAOlC,IAAM,oBAAoB;;;;;;;;AAgE1B,SAAgB,kBAAkB,OAA4C;CAC5E,OAAO,0BAA0B,KAAK;AACxC;AAEA,SAAS,8BAA8B,QAAuC;CAI5E,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM;AAC5E;;;;;;;;;;;;AAaA,SAAgB,iBACd,UACA,WACa;CAQb,MAAM,cAAc,IAAI,IAAI,SAAS,sBAAsB,SAAS,CAAC;CACrE,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG;EACnC,MAAM,YAAY,SAAS,SAAS,IAAI,CAAC,EAAE;EAC3C,IAAI,WAAW,YAAY,IAAI,SAAS;CAC1C;CAEA,MAAM,aAAiC,CAAC;CACxC,MAAM,cAA6C,CAAC;CAEpD,KAAK,MAAM,CAAC,aAAa,kBAAkB,SAAS,mBAAmB,GAAG;EACxE,MAAM,SAAS,SAAS,UAAU,WAAW;EAE7C,IAAI,8BAA8B,MAAM,GAAG;GACzC,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,WACF,YAAY,KAAK;IAAE,WAAW;IAAa;GAAU,CAAC;EAE1D;EAEA,IAAI,cAAc,WAAW,GAAG;EAEhC,IAAI;EAEJ,KAAK,MAAM,gBAAgB,eAAe;GACxC,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,mBAEtB;GAEF,IAAI,CAAC,YAAY,IAAI,aAAa,WAAW,GAAG;GAMhD,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,eAAe,OAErC;GAGF,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,CAAC,WAAW;GAEhB,MAAM,SAAS,YAAY,aAAa,SAAS;GACjD,IAAI,CAAC,iBACH,kBAAkB,IAAI,IAAI,SAAS,mBAAmB,WAAW,CAAC;GAgBpE,IADE,aAAa,SAAS,WAAW,oBAAoB,MAClC;GAErB,MAAM,EAAE,QAAQ,aAAa,8BAA8B;IACzD,UAAU,aAAa,SAAS;IAChC,kBAAkB,gBAAgB,IAAI,MAAM;IAC5C,iBAAiB;GACnB,CAAC;GAED,IACE,WAAW,cACX,OAAO,IAAI,aAAa,SAAS,CAAC,EAAE,UAIpC,MAAM,mBAAmB,qBACvB,GAAG,YAAY,GAAG,aAAa,UAAU,wBACzC,aAAa,WACb,4EACF;GAGF,WAAW,KAAK;IACd,WAAW;IACX;IACA,WAAW,aAAa;IACxB;IACA;IACA;GACF,CAAC;EACH;CACF;CAcA,MAAM,YAAsB,CAAC;CAC7B,MAAM,YAAY,SAAS,SAAS,SAAS,CAAC,EAAE;CAChD,IAAI,WAAW,UAAU,KAAK,SAAS;CACvC,MAAM,SAAS,SAAS,SAAS,SAAS,CAAC,EAAE,QAAQ;CACrD,IAAI,CAAC,UAAU,SAAS,MAAM,GAAG,UAAU,KAAK,MAAM;CAEtD,OAAO;EACL;EACA;EACA;EACA,SAAS,WAAW,WAAW,KAAK,YAAY,WAAW;CAC7D;AACF;;AAqBA,SAAS,qBACP,UACA,WACQ;CACR,OAAO,SAAS,SAAS,SAAS,CAAC,EAAE,iBAAiB;AACxD;;;;;;;;;;;;;;;;AAiBA,SAAS,qBACP,UACA,WACU;CACV,MAAM,UAAU,SAAS,WAAW,SAAS,KAAK;CAClD,MAAM,0BAAU,IAAI,IAAY;EAC9B;EACA;EACA,GAAG,SAAS,eAAe,OAAO;CACpC,CAAC;CAED,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,IAAI,MAAM;EAChB,MAAM,aAAa,SAAS,SAAS,MAAM;EAC3C,IAAI,YAAY,eAAe,MAAM,IAAI,WAAW,aAAa;EACjE,IAAI,YAAY,MAAM,MAAM,IAAI,WAAW,IAAI;CACjD;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;;;;;;AAQA,SAAS,YAAY,QAAgB,KAAwC;CAC3E,OAAO,IAAI,WAAW,IAAI,GAAG,SAAS,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,OAAO,IAAI;AAC3E;;;;;;;;;;;;;;;AAgBA,eAAe,qBACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,CAAC,CAAC,SAAS,oBAAoB;GAC5D,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,iDAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;GACA,OAAO;EACT;EACA,MAAM;CACR;AACF;AAEA,eAAe,UACb,IACA,WACA,QACA,KACmB;CACnB,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GAAG;EACvD,MAAM,OAAO,MAAM,2BACX,GAAG,KAAK,WAAW,YAAY,QAAQ,KAAK,CAAC,GACnD,CAAC,GACD;GAAE,OAAO;GAAW,QAAQ;EAAiB,CAC/C;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,KAAK,KAAK;GAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,MAAM,KAAK,EAAE;EAC5D;CACF;CACA,OAAO;AACT;AAEA,eAAe,YACb,IACA,WACA,KACe;CACf,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GACpD,MAAM,2BACE,GAAG,OAAO,WAAW,YAAY,MAAM,KAAK,CAAC,GACnD,KAAA,GACA;EAAE,OAAO;EAAW,QAAQ;CAAiB,CAC/C;AAEJ;;;;;;;;;;;;;;;;;;AAmBA,eAAe,iBACb,IACA,KACA,YACe;CACf,MAAM,WAAW,IAAI,QAClB,OACC,OAAO,OAAO,YACd,GAAG,SAAS,KACZ,OAAO,yBACX;CACA,IAAI,SAAS,WAAW,KAAK,WAAW,WAAW,GAAG;CAEtD,KAAK,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAC3C;EAAC;EAAgB;EAAY;CAAa,GAC1C;EAAC;EAAkB;EAAa;CAAc,CAChD,GACE,KAAK,MAAM,SAAS,WAAW,UAAA,GAA4B,GACzD,IAAI;EACF,MAAM,GAAG,OAAO,OAAO;GACrB,GAAG,YAAY,UAAU,KAAK;GAC9B,GAAG,YAAY,aAAa,UAAU;EACxC,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KACL,mBAAmB,MAAM,+BACvB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;CACF;AAGN;;;;;;;;AASA,eAAe,kBACb,KACA,WACA,WACA,KACA,OACe;CACf,MAAM,UAAU,IAAI,QAAQ,OAAO;EACjC,MAAM,MAAM,GAAG,UAAU,GAAG;EAC5B,IAAI,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO;EACjC,IAAI,QAAQ,IAAI,GAAG;EACnB,OAAO;CACT,CAAC;CACD,IAAI,QAAQ,WAAW,GAAG;CAE1B,IAAI,QAAQ,mBACV,MAAM,cAAc,oBAClB,uBAAuB,UAAU,iCAC5B,kBAAkB,8EAEvB,SACF;CAGF,MAAM,OAAO,iBAAiB,IAAI,UAAU,SAAS;CAIrD,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,cAAc,UAAU,WAAW,aAC1D;EAEF,IAAI,YAAY;EAChB,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;GAC3D,aAAa,MAAM,2BAEf,IAAI,GAAG,MACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,CACrC,GACF,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ,GAAG,UAAU,OAAO;GAAQ,CACpE;GACA,IAAI,YAAY,GAAG;EACrB;EACA,IAAI,YAAY,GACd,MAAM,cAAc,oBAClB,GAAG,UAAU,UAAU,GAAG,UAAU,UAAU,GACzC,UAAU,WAAW,aAAa,cAAc,cAC/C,UAAU,OAAO,QAAQ,UAAU,+BACpC,aACL,UAAU,MACZ;CAEJ;CAEA,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,YAAY;GACnC,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GACxD,MAAM,2BAEF,IAAI,GAAG,OACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,GACnC,GAAG,UAAU,SAAS,KAAK,CAC7B,GACF,KAAA,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ;GAAW,CACnD;GAEF,IAAI,eAAe,IAAI,UAAU,SAAS;GAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;GACA;EACF;EAEA,IAAI,UAAU,WAAW,WAAW;EAEpC,MAAM,WAAW,MAAM,UACrB,IAAI,IACJ,UAAU,WACV,UAAU,QACV,OACF;EACA,IAAI,SAAS,WAAW,GAAG;EAE3B,MAAM,kBACJ,KACA,UAAU,WACV,UAAU,WACV,UACA,QAAQ,CACV;EACA,MAAM,iBACJ,IAAI,IACJ,UACA,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;EACA,MAAM,YAAY,IAAI,IAAI,UAAU,WAAW,QAAQ;EACvD,IAAI,eAAe,IAAI,UAAU,SAAS;EAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;CACF;CAEA,KAAK,MAAM,eAAe,KAAK,aAC7B,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;EAC3D,MAAM,QAAiC,EACrC,GAAG,YAAY,WAAW,KAAK,EACjC;EACA,IAAI,KAAK,UAAU,WAAW,GAC5B,MAAM,YAAY,KAAK,UAAU;OAEjC,MAAM,kBAAkB,KAAK;EAU/B,MAAK,MARgB,2BACb,IAAI,GAAG,OAAO,YAAY,WAAW,KAAK,GAChD,KAAA,GACA;GACE,OAAO,YAAY;GACnB,QAAQ;EACV,CACF,EAAA,EACa,YAAY,KAAK,GAAG;GAC/B,IAAI,eAAe,IAAI,YAAY,SAAS;GAC5C,IAAI,qBAAqB,IACvB,YAAY,WACZ,qBAAqB,IAAI,UAAU,YAAY,SAAS,CAC1D;EACF;CACF;AAEJ;;;;;;;;AAqBA,eAAsB,oBACpB,IACA,UACA,QACwB;CACxB,MAAM,MAAsB;EAC1B;EACA;EACA,yBAAS,IAAI,IAAI;EACjB,gCAAgB,IAAI,IAAI;EACxB,sCAAsB,IAAI,IAAI;CAChC;CACA,MAAM,kBACJ,KACA,OAAO,WACP,OAAO,WACP,OAAO,KACP,CACF;CACA,MAAM,iBACJ,IACA,OAAO,KACP,qBAAqB,UAAU,OAAO,SAAS,CACjD;CACA,OAAO;EACL,gBAAgB,IAAI;EACpB,sBAAsB,IAAI;CAC5B;AACF;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,iBACpB,IACA,UACA,QAMA,YACwB;CACxB,MAAM,MAAM,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;CAiBvC,IAAI,iBAAiB,UAAU,OAAO,SAAS,CAAC,CAAC,SAAS;EACxD,MAAM,WAAW,EAAE;EACnB,MAAM,iBACJ,IACA,KACA,qBAAqB,UAAU,OAAO,SAAS,CACjD;EACA,OAAO;GAAE,gCAAgB,IAAI,IAAI;GAAG,sCAAsB,IAAI,IAAI;EAAE;CACtE;CAEA,MAAM,MAAM,OAAO,UAAqD;EACtE,MAAM,SAAS,MAAM,oBAAoB,OAAO,UAAU;GACxD,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB;EACF,CAAC;EACD,MAAM,WAAW,KAAK;EACtB,OAAO;CACT;CAEA,MAAM,cAAe,GAA0B;CAC/C,IAAI,OAAO,gBAAgB,YACzB,OAAO,IAAI,EAAE;CAGf,OAAO,YAAY,KAIjB,IAAI,GAAG;AACX"}
+{"version":3,"file":"cascade.js","names":[],"sources":["../src/cascade.ts"],"sourcesContent":["/**\n * App-side referential integrity for `SmrtObject.delete()` (#2371).\n *\n * Same-package `@foreignKey` fields now emit database constraints where the\n * engine can enforce the declared policy. Cross-package references and older\n * schemas still rely on this application-side path. Before this module,\n * `delete()` removed the object's own row and nothing else: junction rows,\n * polymorphic association rows, `_smrt_embeddings` and `_smrt_contexts` entries\n * were all left pointing at an id that no longer resolved, and\n * `@foreignKey(..., { onDelete })` was metadata nobody read.\n *\n * This module implements those semantics in the application layer. It mirrors\n * what a DB-level constraint would do, deliberately including the parts that\n * make it *unlike* a model-layer delete:\n *\n * - Cascaded rows are removed with set-based statements. Their `beforeDelete` /\n *   `afterDelete` hooks and interceptors do **not** run, and no change-feed\n *   tombstone is written for them — exactly as `ON DELETE CASCADE` behaves.\n *   Only the object `delete()` was called on runs the full lifecycle.\n * - Every delete runs inside a single transaction when the adapter exposes\n *   one, including cleanup of framework-owned context and embedding rows, so\n *   a partial cascade cannot survive a failure. A `metaType` column can point\n *   at any class at runtime, so a polymorphic association class is always\n *   plausibly relevant.\n *\n * ## Which references are followed\n *\n * A reference is any `@foreignKey` / `@crossPackageRef` field on a registered\n * class whose target resolves to the deleted object's class (or one of its\n * registered STI ancestors), plus the polymorphic `(metaType, metaId)` pair on\n * {@link SmrtPolymorphicAssociation} subclasses.\n *\n * The action comes from the field's declared `onDelete`. When it is not\n * declared, the default is derived from the referencing class's natural key:\n *\n * | Reference | Default when `onDelete` is absent |\n * |---|---|\n * | Column is part of the referencing class's `conflictColumns`, and is not a `@tenantId()` field | `CASCADE` |\n * | Polymorphic `(metaType, metaId)` association row | `CASCADE` |\n * | Ordinary same-package reference | `NO ACTION` (deletion is refused while references remain) |\n * | Every `@tenantId()` field | Excluded: tenant scope is not an ownership edge |\n *\n * The natural-key rule is what makes junction rows work without any\n * per-package annotation: a junction declares\n * `@smrt({ conflictColumns: ['content_id', 'asset_id', 'relationship'] })`, so\n * `content_id` identifies the row and the row cannot outlive the content it\n * links. An ordinary child (`Order.customerId`) is keyed by `(slug, context)`,\n * so it defaults to immediate `NO ACTION` unless it opts in with\n * `@foreignKey(Customer, { onDelete: 'CASCADE' })`.\n *\n * `@tenantId()` fields are excluded from the natural-key rule even though\n * `@happyvertical/smrt-tenancy` leads a tenant-scoped class's *default*\n * `conflictColumns` with the tenant column (#2360): the tenant column scopes\n * ownership, it does not identify the row the way a junction's foreign key\n * does, and it targets a class (`Tenant`) that is virtually always\n * referenced. Without this exclusion, deleting one `Tenant` row would\n * recursively CASCADE through every tenant-scoped table that has not\n * declared its own `conflictColumns` — the overwhelming majority. The field\n * is detected via the `__tenancy.isTenantIdField` marker `@tenantId()`\n * attaches to its own registration (`FieldMeta.__tenancy`, read structurally\n * so `smrt-core` never depends on `smrt-tenancy`). `@tenantId()` exposes no\n * `onDelete` option today, so this cannot currently be overridden per field.\n *\n * @see https://github.com/happyvertical/smrt/issues/2371\n * @module\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { classifyDatabaseError } from './db-errors.js';\nimport { ConfigurationError, DatabaseError } from './errors.js';\n// Type-only: erased at runtime, so it cannot re-enter the\n// `registry → object → cascade` import cycle.\nimport type { ObjectRegistry } from './registry.js';\nimport {\n  normalizeForeignKeyAction,\n  resolveForeignKeyDeleteAction,\n} from './schema/foreign-key-policy.js';\nimport type { ForeignKeyAction } from './schema/types.js';\nimport { chunkArray, IN_LIST_CHUNK_SIZE } from './utils/chunk.js';\nimport { toSnakeCase } from './utils/naming.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Referential action applied to rows pointing at a deleted object.\n *\n * Same vocabulary as SQL's `ON DELETE`, enforced by the framework before the\n * engine. `NO ACTION` is preflighted like an immediate restrictive action so\n * application-side and database-side enforcement agree.\n */\nexport type OnDeleteAction = ForeignKeyAction;\n\n/** Table holding framework-managed per-object memory entries. */\nconst CONTEXTS_TABLE = '_smrt_contexts';\n\n/** Table holding framework-managed per-object embedding vectors. */\nconst EMBEDDINGS_TABLE = '_smrt_embeddings';\n\n/**\n * Reserved `_smrt_contexts.owner_id` used by `SmrtCollection.remember()` for\n * collection-scoped memory. A real object id is a UUID and can never equal it,\n * but the guard keeps a malformed id from wiping every sibling's defaults.\n */\nconst COLLECTION_OWNER_SENTINEL = '__collection__';\n\n/**\n * Maximum number of cascade levels followed from the object `delete()` was\n * called on. A cycle between two classes that both declare `onDelete: 'CASCADE'`\n * is broken by the visited set; this bound catches unbounded *chains*.\n */\nconst MAX_CASCADE_DEPTH = 10;\n\n/** One reference that must be resolved before the target row can be removed. */\nexport interface CascadeReference {\n  /** Registered name of the class holding the referencing column. */\n  className: string;\n  /** Table holding the referencing rows. */\n  tableName: string;\n  /** Field name (camelCase) on the referencing class. */\n  fieldName: string;\n  /** Column (snake_case) holding the reference. */\n  column: string;\n  /** Resolved action. `NO ACTION` is preflighted like an immediate RESTRICT. */\n  action: OnDeleteAction;\n  /** `true` when the action was declared rather than derived from the key. */\n  declared: boolean;\n}\n\n/** A polymorphic association table that can point at any class. */\nexport interface CascadePolymorphicReference {\n  /** Registered name of the association class. */\n  className: string;\n  /** Table holding the association rows. */\n  tableName: string;\n}\n\n/** Everything that must happen before rows of one class can be deleted. */\nexport interface CascadePlan {\n  /** Typed `@foreignKey` / `@crossPackageRef` references, action-resolved. */\n  references: CascadeReference[];\n  /** Polymorphic association tables that may point at this class. */\n  polymorphic: CascadePolymorphicReference[];\n  /** `meta_type` values that identify this class in an association row. */\n  metaTypes: string[];\n  /** `true` when nothing references this class and nothing has to be visited. */\n  isEmpty: boolean;\n}\n\n/**\n * Read-only slice of `ObjectRegistry` this module needs.\n *\n * Taking it as a parameter — rather than importing the registry as a value —\n * keeps `cascade.ts` out of the `registry → object → cascade` import cycle,\n * and lets tests drive the planner from a hand-built registry.\n */\nexport type CascadeRegistryView = Pick<\n  typeof ObjectRegistry,\n  | 'getRelationshipMap'\n  | 'getFields'\n  | 'getConflictColumns'\n  | 'getTableName'\n  | 'getSelfReferableNames'\n  | 'getClass'\n  | 'getSTIBase'\n  | 'getDescendants'\n>;\n\n/**\n * Normalize a declared `onDelete` value.\n *\n * Accepts any casing and both `SET NULL` and `SET_NULL`, matching what the\n * schema generator has always carried in the manifest. Returns `undefined` for\n * an unset or unrecognized value so the caller can fall back to the default.\n */\nexport function normalizeOnDelete(value: unknown): OnDeleteAction | undefined {\n  return normalizeForeignKeyAction(value);\n}\n\nfunction isPolymorphicAssociationClass(fields: Map<string, unknown>): boolean {\n  // The three columns `SmrtPolymorphicAssociation` contributes. Requiring all\n  // of them keeps an unrelated class that happens to carry a `metaType` from\n  // being treated as an association table.\n  return fields.has('metaType') && fields.has('metaId') && fields.has('role');\n}\n\n/**\n * Build the cascade plan for one class.\n *\n * The plan is derived entirely from registry metadata, so it is valid for any\n * database the class is used against. It is rebuilt per delete rather than\n * cached: registration is incremental (manifests load lazily, tests register\n * classes between cases) and a stale plan would silently skip a table.\n *\n * @param registry - Registry view (`ObjectRegistry` satisfies it)\n * @param className - Class whose incoming references should be resolved\n */\nexport function buildCascadePlan(\n  registry: CascadeRegistryView,\n  className: string,\n): CascadePlan {\n  // `className` is normally already qualified (delete() passes\n  // getResolvedQualifiedName()), but a common same-package `@foreignKey('X')`\n  // still stores its target as the bare simple name `X`. That still matches:\n  // getSelfReferableNames() walks the full ancestor chain (self included) and\n  // adds each ancestor's *simple* name via `getClass(ancestor)?.name`, so the\n  // simple form is already in the seed set below, not just the loop's\n  // qualified-variant augmentation.\n  const targetNames = new Set(registry.getSelfReferableNames(className));\n  for (const name of [...targetNames]) {\n    const qualified = registry.getClass(name)?.qualifiedName;\n    if (qualified) targetNames.add(qualified);\n  }\n\n  const references: CascadeReference[] = [];\n  const polymorphic: CascadePolymorphicReference[] = [];\n\n  for (const [sourceClass, relationships] of registry.getRelationshipMap()) {\n    const fields = registry.getFields(sourceClass);\n\n    if (isPolymorphicAssociationClass(fields)) {\n      const tableName = registry.getTableName(sourceClass);\n      if (tableName) {\n        polymorphic.push({ className: sourceClass, tableName });\n      }\n    }\n\n    if (relationships.length === 0) continue;\n\n    let conflictColumns: Set<string> | undefined;\n\n    for (const relationship of relationships) {\n      if (\n        relationship.type !== 'foreignKey' &&\n        relationship.type !== 'crossPackageRef'\n      ) {\n        continue;\n      }\n      if (!targetNames.has(relationship.targetClass)) continue;\n\n      // An explicit app-side-only relationship is archival metadata, not a\n      // referential-integrity rule. Its identifier is deliberately allowed to\n      // outlive the parent, so delete planning must not block, null, or remove\n      // the retained row (#2413).\n      if (\n        relationship.type === 'foreignKey' &&\n        relationship.options?.constraint === false\n      ) {\n        continue;\n      }\n\n      const tableName = registry.getTableName(sourceClass);\n      if (!tableName) continue;\n\n      const column = toSnakeCase(relationship.fieldName);\n      if (!conflictColumns) {\n        conflictColumns = new Set(registry.getConflictColumns(sourceClass));\n      }\n\n      // A `@tenantId()` field is a structural scoping marker, not a\n      // junction/ownership key — it lands in `conflictColumns` only because\n      // #2360 leads every tenant-scoped class's *default* natural key with\n      // the tenant column, not because the referencing row is *identified*\n      // by its tenant the way a junction row is identified by its parent.\n      // Without this guard, deleting a `Tenant` would silently CASCADE\n      // through the tenant column of every tenant-scoped class in the\n      // schema that has not declared its own `conflictColumns` — the\n      // overwhelming majority. `@tenantId()` exposes no `onDelete` today, so\n      // an explicit declaration can never widen this back to CASCADE; that\n      // is deliberate until tenant-delete cascade is an explicit decision.\n      const isTenantIdField =\n        relationship.options?.__tenancy?.isTenantIdField === true;\n      if (isTenantIdField) continue;\n\n      const { action, declared } = resolveForeignKeyDeleteAction({\n        declared: relationship.options?.onDelete,\n        isConflictColumn: conflictColumns.has(column),\n        isTenantIdField: false,\n      });\n\n      if (\n        action === 'SET NULL' &&\n        fields.get(relationship.fieldName)?.required\n      ) {\n        // Fail on the declaration, not later on a NOT NULL violation from the\n        // engine — the message there names a column, not the decorator.\n        throw ConfigurationError.invalidConfiguration(\n          `${sourceClass}.${relationship.fieldName} onDelete: 'SET NULL'`,\n          relationship.fieldName,\n          \"a nullable field (mark it `nullable: true`, or use 'CASCADE' / 'RESTRICT')\",\n        );\n      }\n\n      references.push({\n        className: sourceClass,\n        tableName,\n        fieldName: relationship.fieldName,\n        column,\n        action,\n        declared,\n      });\n    }\n  }\n\n  // Both forms are matched deliberately: an association row written before a\n  // class was package-qualified still carries the simple `meta_type`. The\n  // qualified form alone is unambiguous; the simple-name fallback can still\n  // match a same-simple-name sibling class's row if it also shares a\n  // `meta_id` — a real, not just theoretical, risk for a class declaring\n  // `idType: 'text'` (non-UUID, not guaranteed globally unique), the same gap\n  // `deleteSystemRows()` closed for `_smrt_contexts` / `_smrt_embeddings`\n  // (review fix) by adding a class-name filter. Closing it here needs the\n  // same STI-and-legacy-name-aware filter this module already builds for\n  // `deleteSystemRows()` narrowed further to registry-unambiguous simple\n  // names; tracked under #2419 alongside the other same-simple-name\n  // collision gaps rather than reworked here.\n  const metaTypes: string[] = [];\n  const qualified = registry.getClass(className)?.qualifiedName;\n  if (qualified) metaTypes.push(qualified);\n  const simple = registry.getClass(className)?.name ?? className;\n  if (!metaTypes.includes(simple)) metaTypes.push(simple);\n\n  return {\n    references,\n    polymorphic,\n    metaTypes,\n    isEmpty: references.length === 0 && polymorphic.length === 0,\n  };\n}\n\n/** Per-delete state shared by every level of the cascade. */\ninterface CascadeContext {\n  db: DatabaseInterface;\n  registry: CascadeRegistryView;\n  /** `table:id` pairs already expanded, so a reference cycle terminates. */\n  visited: Set<string>;\n  /** Tables touched by the cascade, for read-cache invalidation. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified name of the class that owns each affected table, so the\n   * caller can resolve *that* class's own `@smrt({ cache })` config —\n   * cross-process cache invalidation is a per-class opt-in, and a table\n   * cascaded into belongs to a different class than the one `delete()` was\n   * called on.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/** Resolve a registry-recorded class name to its qualified form, when known. */\nfunction toQualifiedClassName(\n  registry: CascadeRegistryView,\n  className: string,\n): string {\n  return registry.getClass(className)?.qualifiedName ?? className;\n}\n\n/**\n * Every value `_smrt_contexts.owner_class` / `_smrt_embeddings.object_class`\n * could plausibly hold for a row belonging to an id of `className` (review\n * fix): both name forms (qualified + simple — older rows predate package\n * qualification) of `className` itself, plus every other member of its STI\n * hierarchy sharing its table. A CASCADE-collected id can belong to any\n * concrete STI subclass of the declaring reference, which stamps its own\n * (more specific) runtime class name at write time, not the reference's.\n *\n * Narrowing by this set — instead of matching by id alone — closes a\n * cross-class collision: two unrelated classes using `idType: 'text'`\n * (non-UUID, not guaranteed globally unique) could otherwise share an id\n * value and have one's `remember()`/embeddings rows deleted by the other's\n * cascade.\n */\nfunction ownerClassCandidates(\n  registry: CascadeRegistryView,\n  className: string,\n): string[] {\n  const stiBase = registry.getSTIBase(className) ?? className;\n  const members = new Set<string>([\n    className,\n    stiBase,\n    ...registry.getDescendants(stiBase),\n  ]);\n\n  const names = new Set<string>();\n  for (const member of members) {\n    names.add(member);\n    const registered = registry.getClass(member);\n    if (registered?.qualifiedName) names.add(registered.qualifiedName);\n    if (registered?.name) names.add(registered.name);\n  }\n  return [...names];\n}\n\n/**\n * Build the `where` clause matching `column` against one or more ids.\n *\n * A single id uses equality so the planner can use a plain index; multiple ids\n * use the adapter's `in` operator.\n */\nfunction idPredicate(column: string, ids: string[]): Record<string, unknown> {\n  return ids.length === 1 ? { [column]: ids[0] } : { [`${column} in`]: ids };\n}\n\n/**\n * Run a cascade statement against a *referencing* table, tolerating the\n * table (or an expected column) not existing in this database.\n *\n * The cascade plan is built from the in-process registry, which can carry a\n * class from any imported package — including one whose table this specific\n * database was never migrated to include (a partially adopted feature, a\n * package pulled in for its types, or, in a test process, a fixture some\n * other test file registered). A missing referencing table trivially has no\n * rows to act on, so the correct behaviour is identical to the table\n * existing and being empty — this must never abort an otherwise valid\n * delete. Any other failure (a real constraint violation, a lock timeout, a\n * genuine SQL error unrelated to the table's existence) still propagates.\n */\nasync function tolerateMissingTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (classifyDatabaseError(error).kind === 'undefined_object') {\n      logger.warn(\n        `Cascade delete skipped ${context.action} on '${context.table}': ` +\n          'table or column not found in this database.',\n        { error: error instanceof Error ? error.message : String(error) },\n      );\n      return fallback;\n    }\n    throw error;\n  }\n}\n\n/**\n * System-table cleanup may ignore an absent table for databases created before\n * that subsystem existed, but never a missing column in a table that does\n * exist. The shared `undefined_object` classification intentionally combines\n * both cases, so this security boundary must retain the narrower driver signal.\n */\nfunction normalizeMissingTableName(value: string): string {\n  const unquoted = value.replace(/[\"'`[\\]]/g, '');\n  return (unquoted.split('.').at(-1) ?? unquoted)\n    .replace(/[^A-Za-z0-9_$-]/g, '')\n    .toLowerCase();\n}\n\nfunction missingTableNames(messages: readonly string[]): string[] {\n  const names: string[] = [];\n  const patterns = [\n    /no such table:\\s*([^\\s,;]+)/giu,\n    /(?:relation|table)\\s+((?:\"[^\"]+\"(?:\\.\"[^\"]+\")*)|(?:[A-Za-z0-9_.$-]+))\\s+does not exist/giu,\n    /table with name\\s+((?:\"[^\"]+\")|(?:[A-Za-z0-9_.$-]+))\\s+does not exist/giu,\n  ];\n  for (const message of messages) {\n    for (const pattern of patterns) {\n      for (const match of message.matchAll(pattern)) {\n        if (match[1]) names.push(normalizeMissingTableName(match[1]));\n      }\n    }\n  }\n  return names;\n}\n\nfunction isMissingTableError(error: unknown, expectedTable: string): boolean {\n  const classification = classifyDatabaseError(error);\n  if (classification.kind !== 'undefined_object') return false;\n  if (\n    classification.sqlstate === '42703' ||\n    classification.driverCode === '42703' ||\n    classification.driverCodes.includes('42703')\n  ) {\n    return false;\n  }\n  const names = missingTableNames(classification.driverMessages);\n  const expected = normalizeMissingTableName(expectedTable);\n  return (\n    names.length > 0 &&\n    names.every((missingTableName) => missingTableName === expected)\n  );\n}\n\nasync function tolerateMissingSystemTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (!isMissingTableError(error, context.table)) throw error;\n    logger.warn(\n      `Cascade delete skipped ${context.action} on '${context.table}': ` +\n        'table not found in this database.',\n      { error: error instanceof Error ? error.message : String(error) },\n    );\n    return fallback;\n  }\n}\n\nasync function selectIds(\n  db: DatabaseInterface,\n  tableName: string,\n  column: string,\n  ids: string[],\n): Promise<string[]> {\n  const found: string[] = [];\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    const rows = await tolerateMissingTable(\n      () => db.list(tableName, idPredicate(column, batch)),\n      [] as Record<string, unknown>[],\n      { table: tableName, action: 'CASCADE select' },\n    );\n    for (const row of rows) {\n      const id = row?.id;\n      if (typeof id === 'string' && id.length > 0) found.push(id);\n    }\n  }\n  return found;\n}\n\nasync function deleteByIds(\n  db: DatabaseInterface,\n  tableName: string,\n  ids: string[],\n): Promise<void> {\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    await tolerateMissingTable(\n      () => db.delete(tableName, idPredicate('id', batch)),\n      undefined,\n      { table: tableName, action: 'CASCADE delete' },\n    );\n  }\n}\n\n/**\n * Remove the framework-managed side rows owned by the given object ids.\n *\n * `_smrt_contexts` and `_smrt_embeddings` are keyed by `(owner_class, owner_id)`\n * and `(object_class, object_id)` respectively. Matched by id *and* class\n * (review fix): id alone would let two unrelated classes using\n * `idType: 'text'` (non-UUID, not guaranteed globally unique) collide on a\n * shared id value and delete each other's memory/embeddings rows. `classNames`\n * is the STI-hierarchy-expanded candidate set from\n * {@link ownerClassCandidates} — the class column stores the *runtime*\n * constructor name, which for an STI hierarchy is a concrete subclass rather\n * than the class the cascade was planned from, so a single exact name is not\n * enough.\n *\n * A missing system table is not an error — an application database may predate\n * the table. Every other cleanup failure propagates so the surrounding delete\n * transaction rolls back rather than orphaning tenant-sensitive recall data.\n */\nasync function deleteSystemRows(\n  db: DatabaseInterface,\n  ids: string[],\n  classNames: string[],\n): Promise<void> {\n  const ownerIds = ids.filter(\n    (id) =>\n      typeof id === 'string' &&\n      id.length > 0 &&\n      id !== COLLECTION_OWNER_SENTINEL,\n  );\n  if (ownerIds.length === 0 || classNames.length === 0) return;\n\n  for (const [table, idColumn, classColumn] of [\n    [CONTEXTS_TABLE, 'owner_id', 'owner_class'],\n    [EMBEDDINGS_TABLE, 'object_id', 'object_class'],\n  ] as const) {\n    for (const batch of chunkArray(ownerIds, IN_LIST_CHUNK_SIZE)) {\n      await tolerateMissingSystemTable(\n        () =>\n          db.delete(table, {\n            ...idPredicate(idColumn, batch),\n            ...idPredicate(classColumn, classNames),\n          }),\n        undefined,\n        { table, action: 'framework-owned row cleanup' },\n      );\n    }\n  }\n}\n\n/**\n * Resolve every reference pointing at `ids` of `className`, recursively.\n *\n * Does **not** delete the rows identified by `ids` — the caller owns that, so\n * `SmrtObject.delete()` keeps issuing its own final statement and its own\n * lifecycle hooks.\n */\nasync function resolveReferences(\n  ctx: CascadeContext,\n  className: string,\n  tableName: string,\n  ids: string[],\n  depth: number,\n): Promise<void> {\n  const pending = ids.filter((id) => {\n    const key = `${tableName}:${id}`;\n    if (ctx.visited.has(key)) return false;\n    ctx.visited.add(key);\n    return true;\n  });\n  if (pending.length === 0) return;\n\n  if (depth > MAX_CASCADE_DEPTH) {\n    throw DatabaseError.constraintViolation(\n      `cascade delete from ${className} exceeded the maximum depth of ` +\n        `${MAX_CASCADE_DEPTH}; check for a chain of onDelete: 'CASCADE' ` +\n        'references that never terminates',\n      className,\n    );\n  }\n\n  const plan = buildCascadePlan(ctx.registry, className);\n\n  // SQL NO ACTION is immediate on every supported SMRT migration path, so the\n  // app-side belt preflights it exactly like RESTRICT before any mutation.\n  for (const reference of plan.references) {\n    if (reference.action !== 'RESTRICT' && reference.action !== 'NO ACTION') {\n      continue;\n    }\n    let remaining = 0;\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      remaining += await tolerateMissingTable(\n        () =>\n          ctx.db.count(\n            reference.tableName,\n            idPredicate(reference.column, batch),\n          ),\n        0,\n        { table: reference.tableName, action: `${reference.action} check` },\n      );\n      if (remaining > 0) break;\n    }\n    if (remaining > 0) {\n      throw DatabaseError.constraintViolation(\n        `${reference.className}.${reference.fieldName} ` +\n          `${reference.declared ? 'declares' : 'resolves to'} onDelete: ` +\n          `'${reference.action}' and ${remaining} row(s) still reference this ` +\n          `${className}`,\n        reference.column,\n      );\n    }\n  }\n\n  for (const reference of plan.references) {\n    if (reference.action === 'SET NULL') {\n      for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n        await tolerateMissingTable(\n          () =>\n            ctx.db.update(\n              reference.tableName,\n              idPredicate(reference.column, batch),\n              { [reference.column]: null },\n            ),\n          undefined,\n          { table: reference.tableName, action: 'SET NULL' },\n        );\n      }\n      ctx.affectedTables.add(reference.tableName);\n      ctx.affectedTableClasses.set(\n        reference.tableName,\n        toQualifiedClassName(ctx.registry, reference.className),\n      );\n      continue;\n    }\n\n    if (reference.action !== 'CASCADE') continue;\n\n    const childIds = await selectIds(\n      ctx.db,\n      reference.tableName,\n      reference.column,\n      pending,\n    );\n    if (childIds.length === 0) continue;\n\n    await resolveReferences(\n      ctx,\n      reference.className,\n      reference.tableName,\n      childIds,\n      depth + 1,\n    );\n    await deleteSystemRows(\n      ctx.db,\n      childIds,\n      ownerClassCandidates(ctx.registry, reference.className),\n    );\n    await deleteByIds(ctx.db, reference.tableName, childIds);\n    ctx.affectedTables.add(reference.tableName);\n    ctx.affectedTableClasses.set(\n      reference.tableName,\n      toQualifiedClassName(ctx.registry, reference.className),\n    );\n  }\n\n  for (const association of plan.polymorphic) {\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      const where: Record<string, unknown> = {\n        ...idPredicate('meta_id', batch),\n      };\n      if (plan.metaTypes.length === 1) {\n        where.meta_type = plan.metaTypes[0];\n      } else {\n        where['meta_type in'] = plan.metaTypes;\n      }\n      const result = await tolerateMissingTable(\n        () => ctx.db.delete(association.tableName, where),\n        undefined,\n        {\n          table: association.tableName,\n          action: 'polymorphic association cleanup',\n        },\n      );\n      if ((result?.affected ?? 0) > 0) {\n        ctx.affectedTables.add(association.tableName);\n        ctx.affectedTableClasses.set(\n          association.tableName,\n          toQualifiedClassName(ctx.registry, association.className),\n        );\n      }\n    }\n  }\n}\n\n/** Outcome of a cascade run, returned so the caller can invalidate caches. */\nexport interface CascadeResult {\n  /** Tables whose rows were removed or nulled, excluding the target's own. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified class name that owns each entry in {@link affectedTables},\n   * where resolvable — lets the caller check *that* class's own\n   * cross-process cache config rather than only its own.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/**\n * Resolve every reference to `ids` of `className` and clean their framework\n * side rows, then hand control back so the caller can delete the rows.\n *\n * Callers are expected to run this on a transaction-bound `db` — see\n * {@link runCascadeDelete}, which owns that decision.\n */\nexport async function cascadeReferencesTo(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: { className: string; tableName: string; ids: string[] },\n): Promise<CascadeResult> {\n  const ctx: CascadeContext = {\n    db,\n    registry,\n    visited: new Set(),\n    affectedTables: new Set(),\n    affectedTableClasses: new Map(),\n  };\n  await resolveReferences(\n    ctx,\n    target.className,\n    target.tableName,\n    target.ids,\n    0,\n  );\n  await deleteSystemRows(\n    db,\n    target.ids,\n    ownerClassCandidates(registry, target.className),\n  );\n  return {\n    affectedTables: ctx.affectedTables,\n    affectedTableClasses: ctx.affectedTableClasses,\n  };\n}\n\ntype TransactionCapable = DatabaseInterface & {\n  transaction?: <T>(\n    this: DatabaseInterface,\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * Run the cascade and the target row's own deletion atomically.\n *\n * When the adapter exposes `transaction()`, the whole sequence runs inside one\n * — including framework-owned row cleanup and the caller's `deleteSelf`\n * statement, so a failure part-way through cannot leave either side orphaned.\n * Adapters without transaction support run the same statements sequentially;\n * this is the documented degradation, not a silent one.\n *\n * @param db - Database the object is bound to\n * @param registry - Registry view used to build cascade plans\n * @param target - Class, table and id of the object being deleted\n * @param deleteSelf - Issues the target row's own `DELETE`, on the tx-bound db\n * @returns Tables affected by the cascade, for read-cache invalidation\n */\nexport async function runCascadeDelete(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: {\n    className: string;\n    tableName: string;\n    /** An unsaved object has none; the cascade is then a no-op. */\n    id: string | null | undefined;\n  },\n  deleteSelf: (db: DatabaseInterface) => Promise<void>,\n): Promise<CascadeResult> {\n  const ids = target.id ? [target.id] : [];\n\n  // Nothing references this class AND no polymorphic association class is\n  // registered anywhere in the process. `plan.polymorphic` is unconditionally\n  // every registered `SmrtPolymorphicAssociation` subclass — a `metaType`\n  // column can point at any class at runtime, so there is no static metadata\n  // to scope it by, unlike a typed `@foreignKey`/`@crossPackageRef`. This\n  // branch is therefore common for a class with no incoming references in an\n  // app with no polymorphic associations at all, but rare — not \"the\n  // overwhelmingly common case\" — once even one polymorphic class exists\n  // anywhere in the process, since every delete's plan then carries it.\n  // Framework-owned context and embedding rows still need atomic cleanup even\n  // when the registry has no typed or polymorphic references for this class.\n  if (buildCascadePlan(registry, target.className).isEmpty) {\n    const runWithoutReferences = async (\n      bound: DatabaseInterface,\n    ): Promise<CascadeResult> => {\n      await deleteSystemRows(\n        bound,\n        ids,\n        ownerClassCandidates(registry, target.className),\n      );\n      await deleteSelf(bound);\n      return { affectedTables: new Set(), affectedTableClasses: new Map() };\n    };\n    const transaction = (db as TransactionCapable).transaction;\n    if (typeof transaction !== 'function') return runWithoutReferences(db);\n    return transaction.call<\n      DatabaseInterface,\n      [(tx: DatabaseInterface) => Promise<CascadeResult>],\n      Promise<CascadeResult>\n    >(db, runWithoutReferences);\n  }\n\n  const run = async (bound: DatabaseInterface): Promise<CascadeResult> => {\n    const result = await cascadeReferencesTo(bound, registry, {\n      className: target.className,\n      tableName: target.tableName,\n      ids,\n    });\n    await deleteSelf(bound);\n    return result;\n  };\n\n  const transaction = (db as TransactionCapable).transaction;\n  if (typeof transaction !== 'function') {\n    return run(db);\n  }\n\n  return transaction.call<\n    DatabaseInterface,\n    [(tx: DatabaseInterface) => Promise<CascadeResult>],\n    Promise<CascadeResult>\n  >(db, run);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAY7C,IAAM,iBAAiB;;AAGvB,IAAM,mBAAmB;;;;;;AAOzB,IAAM,4BAA4B;;;;;;AAOlC,IAAM,oBAAoB;;;;;;;;AAgE1B,SAAgB,kBAAkB,OAA4C;CAC5E,OAAO,0BAA0B,KAAK;AACxC;AAEA,SAAS,8BAA8B,QAAuC;CAI5E,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM;AAC5E;;;;;;;;;;;;AAaA,SAAgB,iBACd,UACA,WACa;CAQb,MAAM,cAAc,IAAI,IAAI,SAAS,sBAAsB,SAAS,CAAC;CACrE,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG;EACnC,MAAM,YAAY,SAAS,SAAS,IAAI,CAAC,EAAE;EAC3C,IAAI,WAAW,YAAY,IAAI,SAAS;CAC1C;CAEA,MAAM,aAAiC,CAAC;CACxC,MAAM,cAA6C,CAAC;CAEpD,KAAK,MAAM,CAAC,aAAa,kBAAkB,SAAS,mBAAmB,GAAG;EACxE,MAAM,SAAS,SAAS,UAAU,WAAW;EAE7C,IAAI,8BAA8B,MAAM,GAAG;GACzC,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,WACF,YAAY,KAAK;IAAE,WAAW;IAAa;GAAU,CAAC;EAE1D;EAEA,IAAI,cAAc,WAAW,GAAG;EAEhC,IAAI;EAEJ,KAAK,MAAM,gBAAgB,eAAe;GACxC,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,mBAEtB;GAEF,IAAI,CAAC,YAAY,IAAI,aAAa,WAAW,GAAG;GAMhD,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,eAAe,OAErC;GAGF,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,CAAC,WAAW;GAEhB,MAAM,SAAS,YAAY,aAAa,SAAS;GACjD,IAAI,CAAC,iBACH,kBAAkB,IAAI,IAAI,SAAS,mBAAmB,WAAW,CAAC;GAgBpE,IADE,aAAa,SAAS,WAAW,oBAAoB,MAClC;GAErB,MAAM,EAAE,QAAQ,aAAa,8BAA8B;IACzD,UAAU,aAAa,SAAS;IAChC,kBAAkB,gBAAgB,IAAI,MAAM;IAC5C,iBAAiB;GACnB,CAAC;GAED,IACE,WAAW,cACX,OAAO,IAAI,aAAa,SAAS,CAAC,EAAE,UAIpC,MAAM,mBAAmB,qBACvB,GAAG,YAAY,GAAG,aAAa,UAAU,wBACzC,aAAa,WACb,4EACF;GAGF,WAAW,KAAK;IACd,WAAW;IACX;IACA,WAAW,aAAa;IACxB;IACA;IACA;GACF,CAAC;EACH;CACF;CAcA,MAAM,YAAsB,CAAC;CAC7B,MAAM,YAAY,SAAS,SAAS,SAAS,CAAC,EAAE;CAChD,IAAI,WAAW,UAAU,KAAK,SAAS;CACvC,MAAM,SAAS,SAAS,SAAS,SAAS,CAAC,EAAE,QAAQ;CACrD,IAAI,CAAC,UAAU,SAAS,MAAM,GAAG,UAAU,KAAK,MAAM;CAEtD,OAAO;EACL;EACA;EACA;EACA,SAAS,WAAW,WAAW,KAAK,YAAY,WAAW;CAC7D;AACF;;AAqBA,SAAS,qBACP,UACA,WACQ;CACR,OAAO,SAAS,SAAS,SAAS,CAAC,EAAE,iBAAiB;AACxD;;;;;;;;;;;;;;;;AAiBA,SAAS,qBACP,UACA,WACU;CACV,MAAM,UAAU,SAAS,WAAW,SAAS,KAAK;CAClD,MAAM,0BAAU,IAAI,IAAY;EAC9B;EACA;EACA,GAAG,SAAS,eAAe,OAAO;CACpC,CAAC;CAED,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,IAAI,MAAM;EAChB,MAAM,aAAa,SAAS,SAAS,MAAM;EAC3C,IAAI,YAAY,eAAe,MAAM,IAAI,WAAW,aAAa;EACjE,IAAI,YAAY,MAAM,MAAM,IAAI,WAAW,IAAI;CACjD;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;;;;;;AAQA,SAAS,YAAY,QAAgB,KAAwC;CAC3E,OAAO,IAAI,WAAW,IAAI,GAAG,SAAS,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,OAAO,IAAI;AAC3E;;;;;;;;;;;;;;;AAgBA,eAAe,qBACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,CAAC,CAAC,SAAS,oBAAoB;GAC5D,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,iDAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;GACA,OAAO;EACT;EACA,MAAM;CACR;AACF;;;;;;;AAQA,SAAS,0BAA0B,OAAuB;CACxD,MAAM,WAAW,MAAM,QAAQ,aAAa,EAAE;CAC9C,QAAQ,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,SAAA,CACnC,QAAQ,oBAAoB,EAAE,CAAC,CAC/B,YAAY;AACjB;AAEA,SAAS,kBAAkB,UAAuC;CAChE,MAAM,QAAkB,CAAC;CACzB,MAAM,WAAW;EACf;EACA;EACA;CACF;CACA,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,SAAS,QAAQ,SAAS,OAAO,GAC1C,IAAI,MAAM,IAAI,MAAM,KAAK,0BAA0B,MAAM,EAAE,CAAC;CAIlE,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,eAAgC;CAC3E,MAAM,iBAAiB,sBAAsB,KAAK;CAClD,IAAI,eAAe,SAAS,oBAAoB,OAAO;CACvD,IACE,eAAe,aAAa,WAC5B,eAAe,eAAe,WAC9B,eAAe,YAAY,SAAS,OAAO,GAE3C,OAAO;CAET,MAAM,QAAQ,kBAAkB,eAAe,cAAc;CAC7D,MAAM,WAAW,0BAA0B,aAAa;CACxD,OACE,MAAM,SAAS,KACf,MAAM,OAAO,qBAAqB,qBAAqB,QAAQ;AAEnE;AAEA,eAAe,2BACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,CAAC,oBAAoB,OAAO,QAAQ,KAAK,GAAG,MAAM;EACtD,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,uCAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;EACA,OAAO;CACT;AACF;AAEA,eAAe,UACb,IACA,WACA,QACA,KACmB;CACnB,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GAAG;EACvD,MAAM,OAAO,MAAM,2BACX,GAAG,KAAK,WAAW,YAAY,QAAQ,KAAK,CAAC,GACnD,CAAC,GACD;GAAE,OAAO;GAAW,QAAQ;EAAiB,CAC/C;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,KAAK,KAAK;GAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,MAAM,KAAK,EAAE;EAC5D;CACF;CACA,OAAO;AACT;AAEA,eAAe,YACb,IACA,WACA,KACe;CACf,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GACpD,MAAM,2BACE,GAAG,OAAO,WAAW,YAAY,MAAM,KAAK,CAAC,GACnD,KAAA,GACA;EAAE,OAAO;EAAW,QAAQ;CAAiB,CAC/C;AAEJ;;;;;;;;;;;;;;;;;;;AAoBA,eAAe,iBACb,IACA,KACA,YACe;CACf,MAAM,WAAW,IAAI,QAClB,OACC,OAAO,OAAO,YACd,GAAG,SAAS,KACZ,OAAO,yBACX;CACA,IAAI,SAAS,WAAW,KAAK,WAAW,WAAW,GAAG;CAEtD,KAAK,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAC3C;EAAC;EAAgB;EAAY;CAAa,GAC1C;EAAC;EAAkB;EAAa;CAAc,CAChD,GACE,KAAK,MAAM,SAAS,WAAW,UAAA,GAA4B,GACzD,MAAM,iCAEF,GAAG,OAAO,OAAO;EACf,GAAG,YAAY,UAAU,KAAK;EAC9B,GAAG,YAAY,aAAa,UAAU;CACxC,CAAC,GACH,KAAA,GACA;EAAE;EAAO,QAAQ;CAA8B,CACjD;AAGN;;;;;;;;AASA,eAAe,kBACb,KACA,WACA,WACA,KACA,OACe;CACf,MAAM,UAAU,IAAI,QAAQ,OAAO;EACjC,MAAM,MAAM,GAAG,UAAU,GAAG;EAC5B,IAAI,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO;EACjC,IAAI,QAAQ,IAAI,GAAG;EACnB,OAAO;CACT,CAAC;CACD,IAAI,QAAQ,WAAW,GAAG;CAE1B,IAAI,QAAQ,mBACV,MAAM,cAAc,oBAClB,uBAAuB,UAAU,iCAC5B,kBAAkB,8EAEvB,SACF;CAGF,MAAM,OAAO,iBAAiB,IAAI,UAAU,SAAS;CAIrD,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,cAAc,UAAU,WAAW,aAC1D;EAEF,IAAI,YAAY;EAChB,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;GAC3D,aAAa,MAAM,2BAEf,IAAI,GAAG,MACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,CACrC,GACF,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ,GAAG,UAAU,OAAO;GAAQ,CACpE;GACA,IAAI,YAAY,GAAG;EACrB;EACA,IAAI,YAAY,GACd,MAAM,cAAc,oBAClB,GAAG,UAAU,UAAU,GAAG,UAAU,UAAU,GACzC,UAAU,WAAW,aAAa,cAAc,cAC/C,UAAU,OAAO,QAAQ,UAAU,+BACpC,aACL,UAAU,MACZ;CAEJ;CAEA,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,YAAY;GACnC,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GACxD,MAAM,2BAEF,IAAI,GAAG,OACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,GACnC,GAAG,UAAU,SAAS,KAAK,CAC7B,GACF,KAAA,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ;GAAW,CACnD;GAEF,IAAI,eAAe,IAAI,UAAU,SAAS;GAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;GACA;EACF;EAEA,IAAI,UAAU,WAAW,WAAW;EAEpC,MAAM,WAAW,MAAM,UACrB,IAAI,IACJ,UAAU,WACV,UAAU,QACV,OACF;EACA,IAAI,SAAS,WAAW,GAAG;EAE3B,MAAM,kBACJ,KACA,UAAU,WACV,UAAU,WACV,UACA,QAAQ,CACV;EACA,MAAM,iBACJ,IAAI,IACJ,UACA,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;EACA,MAAM,YAAY,IAAI,IAAI,UAAU,WAAW,QAAQ;EACvD,IAAI,eAAe,IAAI,UAAU,SAAS;EAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;CACF;CAEA,KAAK,MAAM,eAAe,KAAK,aAC7B,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;EAC3D,MAAM,QAAiC,EACrC,GAAG,YAAY,WAAW,KAAK,EACjC;EACA,IAAI,KAAK,UAAU,WAAW,GAC5B,MAAM,YAAY,KAAK,UAAU;OAEjC,MAAM,kBAAkB,KAAK;EAU/B,MAAK,MARgB,2BACb,IAAI,GAAG,OAAO,YAAY,WAAW,KAAK,GAChD,KAAA,GACA;GACE,OAAO,YAAY;GACnB,QAAQ;EACV,CACF,EAAA,EACa,YAAY,KAAK,GAAG;GAC/B,IAAI,eAAe,IAAI,YAAY,SAAS;GAC5C,IAAI,qBAAqB,IACvB,YAAY,WACZ,qBAAqB,IAAI,UAAU,YAAY,SAAS,CAC1D;EACF;CACF;AAEJ;;;;;;;;AAqBA,eAAsB,oBACpB,IACA,UACA,QACwB;CACxB,MAAM,MAAsB;EAC1B;EACA;EACA,yBAAS,IAAI,IAAI;EACjB,gCAAgB,IAAI,IAAI;EACxB,sCAAsB,IAAI,IAAI;CAChC;CACA,MAAM,kBACJ,KACA,OAAO,WACP,OAAO,WACP,OAAO,KACP,CACF;CACA,MAAM,iBACJ,IACA,OAAO,KACP,qBAAqB,UAAU,OAAO,SAAS,CACjD;CACA,OAAO;EACL,gBAAgB,IAAI;EACpB,sBAAsB,IAAI;CAC5B;AACF;;;;;;;;;;;;;;;;AAwBA,eAAsB,iBACpB,IACA,UACA,QAMA,YACwB;CACxB,MAAM,MAAM,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;CAavC,IAAI,iBAAiB,UAAU,OAAO,SAAS,CAAC,CAAC,SAAS;EACxD,MAAM,uBAAuB,OAC3B,UAC2B;GAC3B,MAAM,iBACJ,OACA,KACA,qBAAqB,UAAU,OAAO,SAAS,CACjD;GACA,MAAM,WAAW,KAAK;GACtB,OAAO;IAAE,gCAAgB,IAAI,IAAI;IAAG,sCAAsB,IAAI,IAAI;GAAE;EACtE;EACA,MAAM,cAAe,GAA0B;EAC/C,IAAI,OAAO,gBAAgB,YAAY,OAAO,qBAAqB,EAAE;EACrE,OAAO,YAAY,KAIjB,IAAI,oBAAoB;CAC5B;CAEA,MAAM,MAAM,OAAO,UAAqD;EACtE,MAAM,SAAS,MAAM,oBAAoB,OAAO,UAAU;GACxD,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB;EACF,CAAC;EACD,MAAM,WAAW,KAAK;EACtB,OAAO;CACT;CAEA,MAAM,cAAe,GAA0B;CAC/C,IAAI,OAAO,gBAAgB,YACzB,OAAO,IAAI,EAAE;CAGf,OAAO,YAAY,KAIjB,IAAI,GAAG;AACX"}

package/dist/embedded-write-queue.d.ts

@@ -9,6 +9,14 @@ interface QueueableDatabase {
  * handle reintroduces the livelock.
  */
 export declare function isEmbeddedDatabase(db: QueueableDatabase): boolean;
+/**
+ * Whether `db` is a PostgreSQL handle.
+ *
+ * The revision compare-and-swap predicate is dialect-specific (#2620): only
+ * PostgreSQL needs the millisecond-truncating, timezone-tolerant guard, and
+ * only PostgreSQL can evaluate `date_trunc`.
+ */
+export declare function isPostgresDatabase(db: QueueableDatabase): boolean;
 /**
  * Whether revision compare-and-swap needs the process-local read/upsert path.
  *

package/dist/embedded-write-queue.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"embedded-write-queue.d.ts","sourceRoot":"","sources":["../src/embedded-write-queue.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA0C5D,UAAU,iBAAiB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAG3E;AAMD;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GACxD,OAAO,CAAC,CAAC,CAAC,CAeZ"}
+{"version":3,"file":"embedded-write-queue.d.ts","sourceRoot":"","sources":["../src/embedded-write-queue.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AA0C5D,UAAU,iBAAiB;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAEjE;AAED;;;;;;;GAOG;AACH,wBAAgB,4BAA4B,CAAC,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAG3E;AAMD;;;GAGG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAwBZ;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAAC,CAAC,EAClD,EAAE,EAAE,iBAAiB,EACrB,SAAS,EAAE,OAAO,EAClB,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC,CAAC,GACxD,OAAO,CAAC,CAAC,CAAC,CAeZ"}

package/dist/embedded-write-queue.js

@@ -45,7 +45,17 @@ var activeQueueKeys = new AsyncLocalStorage();
 * handle reintroduces the livelock.
 */
 function isEmbeddedDatabase(db) {
-	return !/^postgres(?:ql)?:/iu.test(db?.url ?? "");
+	return !isPostgresDatabase(db);
+}
+/**
+* Whether `db` is a PostgreSQL handle.
+*
+* The revision compare-and-swap predicate is dialect-specific (#2620): only
+* PostgreSQL needs the millisecond-truncating, timezone-tolerant guard, and
+* only PostgreSQL can evaluate `date_trunc`.
+*/
+function isPostgresDatabase(db) {
+	return /^postgres(?:ql)?:/iu.test(db?.url ?? "");
 }
 /**
 * Whether revision compare-and-swap needs the process-local read/upsert path.
@@ -99,6 +109,6 @@ async function withEmbeddedWriteTransaction(db, serialize, operation) {
 	}));
 }
 //#endregion
-export { isEmbeddedDatabase, usesEmbeddedRevisionFallback, withEmbeddedWriteQueue, withEmbeddedWriteTransaction };
+export { isEmbeddedDatabase, isPostgresDatabase, usesEmbeddedRevisionFallback, withEmbeddedWriteQueue, withEmbeddedWriteTransaction };
 
 //# sourceMappingURL=embedded-write-queue.js.map

package/dist/embedded-write-queue.js.map

@@ -1 +1 @@
-{"version":3,"file":"embedded-write-queue.js","names":[],"sources":["../src/embedded-write-queue.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks';\nimport type { DatabaseInterface } from '@happyvertical/sql';\n\n/**\n * In-process write serialization for embedded database engines (#2360).\n *\n * File-backed SQLite (libsql) allows one writer at a time and the SDK opens a\n * NEW connection for every null-aware upsert attempt (`transaction(\"write\")`),\n * with no busy timeout on either connection. Any other write on the root\n * connection while such a transaction is open — most commonly the change-feed\n * append that follows every model save — collides as `SQLITE_BUSY`, and under\n * sustained concurrency (a `Promise.all` of creates) the two sides livelock\n * through every retry tier. Before the tenant-led conflict target (#2360) the\n * null-aware path was rare (custom conflict keys with NULL values, #1246);\n * with `tenant_id` leading every tenant-scoped default key, EVERY NULL-tenant\n * (global) create takes it, so the collision became the steady state.\n *\n * The queue makes the process a single writer per embedded database for:\n *\n * - a `save()` whose upsert conflict values contain NULL (the only shape the\n *   SDK routes through a second-connection transaction), and\n * - the change-feed append (a root-connection write that follows every save).\n * - every model save and delete, so the embedded revision-CAS compare/upsert\n *   fallback cannot race an ordinary save, natural-key create, or delete.\n * - a complete root `SmrtObject.withTransaction()` callback, with writes on\n *   its bound handle re-entering the same hold instead of self-deadlocking.\n *\n * Ordinary save/delete holds contain database calls only — never an\n * interceptor or hook. Explicit transaction callbacks are caller-controlled,\n * so their bound model writes re-enter the existing hold. PostgreSQL is never\n * serialized here:\n * its null-aware upsert already arbitrates through advisory locks\n * server-side, and cross-process writers exist that an in-process queue could\n * not order anyway (which is also why this queue is a mitigation for embedded\n * engines' in-process writers, not a cross-process guarantee — embedded\n * engines have no cross-process writers in supported deployments).\n */\n\n/** Queue tail per database identity (URL string, or the handle itself). */\nconst urlQueues = new Map<string, Promise<unknown>>();\nconst handleQueues = new WeakMap<object, Promise<unknown>>();\nconst activeQueueKeys = new AsyncLocalStorage<ReadonlySet<string | object>>();\n\ninterface QueueableDatabase {\n  url?: string;\n}\n\n/**\n * Whether `db` is an embedded engine (SQLite/DuckDB/JSON — anything that is\n * not PostgreSQL). Handles without a URL are treated as embedded: serializing\n * them is at worst a throughput cost, while not serializing an embedded\n * handle reintroduces the livelock.\n */\nexport function isEmbeddedDatabase(db: QueueableDatabase): boolean {\n  return !/^postgres(?:ql)?:/iu.test(db?.url ?? '');\n}\n\n/**\n * Whether revision compare-and-swap needs the process-local read/upsert path.\n *\n * DuckDB/JSON cannot express the timestamp predicate through the generic\n * update API, and local SQLite has only the process's writers in supported\n * deployments. Remote LibSQL/Turso is different: other processes may write\n * the same database, so it must use one conditional UPDATE at the server.\n */\nexport function usesEmbeddedRevisionFallback(db: QueueableDatabase): boolean {\n  const url = db?.url ?? '';\n  return isEmbeddedDatabase(db) && !/^(?:https?|libsql):\\/\\//iu.test(url);\n}\n\nfunction queueKey(db: QueueableDatabase): string | object {\n  return typeof db?.url === 'string' && db.url.length > 0 ? db.url : db;\n}\n\n/**\n * Run `operation` after every previously queued write on the same database\n * has settled. When `serialize` is false the operation runs immediately.\n */\nexport async function withEmbeddedWriteQueue<T>(\n  db: QueueableDatabase,\n  serialize: boolean,\n  operation: () => Promise<T>,\n): Promise<T> {\n  if (!serialize) return operation();\n\n  const key = queueKey(db);\n  const active = activeQueueKeys.getStore();\n  if (active?.has(key)) return operation();\n  const previous =\n    (typeof key === 'string' ? urlQueues.get(key) : handleQueues.get(key)) ??\n    Promise.resolve();\n  const run = () =>\n    activeQueueKeys.run(new Set([...(active ?? []), key]), operation);\n  const next = previous.then(run, run);\n  // The stored tail must never reject, or one failed write would poison the\n  // queue for every later writer.\n  const tail = next.catch(() => undefined);\n  if (typeof key === 'string') {\n    urlQueues.set(key, tail);\n    void tail.finally(() => {\n      if (urlQueues.get(key) === tail) urlQueues.delete(key);\n    });\n  } else {\n    handleQueues.set(key, tail);\n  }\n  return next;\n}\n\n/**\n * Serialize a complete embedded root transaction with ordinary model writes.\n * The transaction handle is registered as a reentrant alias so saves and\n * change-feed appends inside the callback do not queue behind their own root\n * transaction.\n */\nexport async function withEmbeddedWriteTransaction<T>(\n  db: DatabaseInterface,\n  serialize: boolean,\n  operation: (transaction: DatabaseInterface) => Promise<T>,\n): Promise<T> {\n  const transaction = db.transaction?.bind(db);\n  if (!transaction) {\n    throw new Error('Database transaction support is required');\n  }\n  return withEmbeddedWriteQueue(db, serialize, () =>\n    transaction((bound) => {\n      if (!serialize) return operation(bound);\n      const active = activeQueueKeys.getStore();\n      return activeQueueKeys.run(\n        new Set([...(active ?? []), queueKey(bound)]),\n        () => operation(bound),\n      );\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAM,4BAAY,IAAI,IAA8B;AACpD,IAAM,+BAAe,IAAI,QAAkC;AAC3D,IAAM,kBAAkB,IAAI,kBAAgD;;;;;;;AAY5E,SAAgB,mBAAmB,IAAgC;CACjE,OAAO,CAAC,sBAAsB,KAAK,IAAI,OAAO,EAAE;AAClD;;;;;;;;;AAUA,SAAgB,6BAA6B,IAAgC;CAC3E,MAAM,MAAM,IAAI,OAAO;CACvB,OAAO,mBAAmB,EAAE,KAAK,CAAC,4BAA4B,KAAK,GAAG;AACxE;AAEA,SAAS,SAAS,IAAwC;CACxD,OAAO,OAAO,IAAI,QAAQ,YAAY,GAAG,IAAI,SAAS,IAAI,GAAG,MAAM;AACrE;;;;;AAMA,eAAsB,uBACpB,IACA,WACA,WACY;CACZ,IAAI,CAAC,WAAW,OAAO,UAAU;CAEjC,MAAM,MAAM,SAAS,EAAE;CACvB,MAAM,SAAS,gBAAgB,SAAS;CACxC,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO,UAAU;CACvC,MAAM,YACH,OAAO,QAAQ,WAAW,UAAU,IAAI,GAAG,IAAI,aAAa,IAAI,GAAG,MACpE,QAAQ,QAAQ;CAClB,MAAM,YACJ,gBAAgB,oBAAI,IAAI,IAAI,CAAC,GAAI,UAAU,CAAC,GAAI,GAAG,CAAC,GAAG,SAAS;CAClE,MAAM,OAAO,SAAS,KAAK,KAAK,GAAG;CAGnC,MAAM,OAAO,KAAK,YAAY,KAAA,CAAS;CACvC,IAAI,OAAO,QAAQ,UAAU;EAC3B,UAAU,IAAI,KAAK,IAAI;EACvB,KAAU,cAAc;GACtB,IAAI,UAAU,IAAI,GAAG,MAAM,MAAM,UAAU,OAAO,GAAG;EACvD,CAAC;CACH,OACE,aAAa,IAAI,KAAK,IAAI;CAE5B,OAAO;AACT;;;;;;;AAQA,eAAsB,6BACpB,IACA,WACA,WACY;CACZ,MAAM,cAAc,GAAG,aAAa,KAAK,EAAE;CAC3C,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0CAA0C;CAE5D,OAAO,uBAAuB,IAAI,iBAChC,aAAa,UAAU;EACrB,IAAI,CAAC,WAAW,OAAO,UAAU,KAAK;EACtC,MAAM,SAAS,gBAAgB,SAAS;EACxC,OAAO,gBAAgB,oBACrB,IAAI,IAAI,CAAC,GAAI,UAAU,CAAC,GAAI,SAAS,KAAK,CAAC,CAAC,SACtC,UAAU,KAAK,CACvB;CACF,CAAC,CACH;AACF"}
+{"version":3,"file":"embedded-write-queue.js","names":[],"sources":["../src/embedded-write-queue.ts"],"sourcesContent":["import { AsyncLocalStorage } from 'node:async_hooks';\nimport type { DatabaseInterface } from '@happyvertical/sql';\n\n/**\n * In-process write serialization for embedded database engines (#2360).\n *\n * File-backed SQLite (libsql) allows one writer at a time and the SDK opens a\n * NEW connection for every null-aware upsert attempt (`transaction(\"write\")`),\n * with no busy timeout on either connection. Any other write on the root\n * connection while such a transaction is open — most commonly the change-feed\n * append that follows every model save — collides as `SQLITE_BUSY`, and under\n * sustained concurrency (a `Promise.all` of creates) the two sides livelock\n * through every retry tier. Before the tenant-led conflict target (#2360) the\n * null-aware path was rare (custom conflict keys with NULL values, #1246);\n * with `tenant_id` leading every tenant-scoped default key, EVERY NULL-tenant\n * (global) create takes it, so the collision became the steady state.\n *\n * The queue makes the process a single writer per embedded database for:\n *\n * - a `save()` whose upsert conflict values contain NULL (the only shape the\n *   SDK routes through a second-connection transaction), and\n * - the change-feed append (a root-connection write that follows every save).\n * - every model save and delete, so the embedded revision-CAS compare/upsert\n *   fallback cannot race an ordinary save, natural-key create, or delete.\n * - a complete root `SmrtObject.withTransaction()` callback, with writes on\n *   its bound handle re-entering the same hold instead of self-deadlocking.\n *\n * Ordinary save/delete holds contain database calls only — never an\n * interceptor or hook. Explicit transaction callbacks are caller-controlled,\n * so their bound model writes re-enter the existing hold. PostgreSQL is never\n * serialized here:\n * its null-aware upsert already arbitrates through advisory locks\n * server-side, and cross-process writers exist that an in-process queue could\n * not order anyway (which is also why this queue is a mitigation for embedded\n * engines' in-process writers, not a cross-process guarantee — embedded\n * engines have no cross-process writers in supported deployments).\n */\n\n/** Queue tail per database identity (URL string, or the handle itself). */\nconst urlQueues = new Map<string, Promise<unknown>>();\nconst handleQueues = new WeakMap<object, Promise<unknown>>();\nconst activeQueueKeys = new AsyncLocalStorage<ReadonlySet<string | object>>();\n\ninterface QueueableDatabase {\n  url?: string;\n}\n\n/**\n * Whether `db` is an embedded engine (SQLite/DuckDB/JSON — anything that is\n * not PostgreSQL). Handles without a URL are treated as embedded: serializing\n * them is at worst a throughput cost, while not serializing an embedded\n * handle reintroduces the livelock.\n */\nexport function isEmbeddedDatabase(db: QueueableDatabase): boolean {\n  return !isPostgresDatabase(db);\n}\n\n/**\n * Whether `db` is a PostgreSQL handle.\n *\n * The revision compare-and-swap predicate is dialect-specific (#2620): only\n * PostgreSQL needs the millisecond-truncating, timezone-tolerant guard, and\n * only PostgreSQL can evaluate `date_trunc`.\n */\nexport function isPostgresDatabase(db: QueueableDatabase): boolean {\n  return /^postgres(?:ql)?:/iu.test(db?.url ?? '');\n}\n\n/**\n * Whether revision compare-and-swap needs the process-local read/upsert path.\n *\n * DuckDB/JSON cannot express the timestamp predicate through the generic\n * update API, and local SQLite has only the process's writers in supported\n * deployments. Remote LibSQL/Turso is different: other processes may write\n * the same database, so it must use one conditional UPDATE at the server.\n */\nexport function usesEmbeddedRevisionFallback(db: QueueableDatabase): boolean {\n  const url = db?.url ?? '';\n  return isEmbeddedDatabase(db) && !/^(?:https?|libsql):\\/\\//iu.test(url);\n}\n\nfunction queueKey(db: QueueableDatabase): string | object {\n  return typeof db?.url === 'string' && db.url.length > 0 ? db.url : db;\n}\n\n/**\n * Run `operation` after every previously queued write on the same database\n * has settled. When `serialize` is false the operation runs immediately.\n */\nexport async function withEmbeddedWriteQueue<T>(\n  db: QueueableDatabase,\n  serialize: boolean,\n  operation: () => Promise<T>,\n): Promise<T> {\n  if (!serialize) return operation();\n\n  const key = queueKey(db);\n  const active = activeQueueKeys.getStore();\n  if (active?.has(key)) return operation();\n  const previous =\n    (typeof key === 'string' ? urlQueues.get(key) : handleQueues.get(key)) ??\n    Promise.resolve();\n  const run = () =>\n    activeQueueKeys.run(new Set([...(active ?? []), key]), operation);\n  const next = previous.then(run, run);\n  // The stored tail must never reject, or one failed write would poison the\n  // queue for every later writer.\n  const tail = next.catch(() => undefined);\n  if (typeof key === 'string') {\n    urlQueues.set(key, tail);\n    void tail.finally(() => {\n      if (urlQueues.get(key) === tail) urlQueues.delete(key);\n    });\n  } else {\n    handleQueues.set(key, tail);\n  }\n  return next;\n}\n\n/**\n * Serialize a complete embedded root transaction with ordinary model writes.\n * The transaction handle is registered as a reentrant alias so saves and\n * change-feed appends inside the callback do not queue behind their own root\n * transaction.\n */\nexport async function withEmbeddedWriteTransaction<T>(\n  db: DatabaseInterface,\n  serialize: boolean,\n  operation: (transaction: DatabaseInterface) => Promise<T>,\n): Promise<T> {\n  const transaction = db.transaction?.bind(db);\n  if (!transaction) {\n    throw new Error('Database transaction support is required');\n  }\n  return withEmbeddedWriteQueue(db, serialize, () =>\n    transaction((bound) => {\n      if (!serialize) return operation(bound);\n      const active = activeQueueKeys.getStore();\n      return activeQueueKeys.run(\n        new Set([...(active ?? []), queueKey(bound)]),\n        () => operation(bound),\n      );\n    }),\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,IAAM,4BAAY,IAAI,IAA8B;AACpD,IAAM,+BAAe,IAAI,QAAkC;AAC3D,IAAM,kBAAkB,IAAI,kBAAgD;;;;;;;AAY5E,SAAgB,mBAAmB,IAAgC;CACjE,OAAO,CAAC,mBAAmB,EAAE;AAC/B;;;;;;;;AASA,SAAgB,mBAAmB,IAAgC;CACjE,OAAO,sBAAsB,KAAK,IAAI,OAAO,EAAE;AACjD;;;;;;;;;AAUA,SAAgB,6BAA6B,IAAgC;CAC3E,MAAM,MAAM,IAAI,OAAO;CACvB,OAAO,mBAAmB,EAAE,KAAK,CAAC,4BAA4B,KAAK,GAAG;AACxE;AAEA,SAAS,SAAS,IAAwC;CACxD,OAAO,OAAO,IAAI,QAAQ,YAAY,GAAG,IAAI,SAAS,IAAI,GAAG,MAAM;AACrE;;;;;AAMA,eAAsB,uBACpB,IACA,WACA,WACY;CACZ,IAAI,CAAC,WAAW,OAAO,UAAU;CAEjC,MAAM,MAAM,SAAS,EAAE;CACvB,MAAM,SAAS,gBAAgB,SAAS;CACxC,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO,UAAU;CACvC,MAAM,YACH,OAAO,QAAQ,WAAW,UAAU,IAAI,GAAG,IAAI,aAAa,IAAI,GAAG,MACpE,QAAQ,QAAQ;CAClB,MAAM,YACJ,gBAAgB,oBAAI,IAAI,IAAI,CAAC,GAAI,UAAU,CAAC,GAAI,GAAG,CAAC,GAAG,SAAS;CAClE,MAAM,OAAO,SAAS,KAAK,KAAK,GAAG;CAGnC,MAAM,OAAO,KAAK,YAAY,KAAA,CAAS;CACvC,IAAI,OAAO,QAAQ,UAAU;EAC3B,UAAU,IAAI,KAAK,IAAI;EACvB,KAAU,cAAc;GACtB,IAAI,UAAU,IAAI,GAAG,MAAM,MAAM,UAAU,OAAO,GAAG;EACvD,CAAC;CACH,OACE,aAAa,IAAI,KAAK,IAAI;CAE5B,OAAO;AACT;;;;;;;AAQA,eAAsB,6BACpB,IACA,WACA,WACY;CACZ,MAAM,cAAc,GAAG,aAAa,KAAK,EAAE;CAC3C,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0CAA0C;CAE5D,OAAO,uBAAuB,IAAI,iBAChC,aAAa,UAAU;EACrB,IAAI,CAAC,WAAW,OAAO,UAAU,KAAK;EACtC,MAAM,SAAS,gBAAgB,SAAS;EACxC,OAAO,gBAAgB,oBACrB,IAAI,IAAI,CAAC,GAAI,UAAU,CAAC,GAAI,SAAS,KAAK,CAAC,CAAC,SACtC,UAAU,KAAK,CACvB;CACF,CAAC,CACH;AACF"}

package/dist/generators/custom-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"custom-action.d.ts","sourceRoot":"","sources":["../../src/generators/custom-action.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,YAAY,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,iBAAiB,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,MAAM,4BAA4B,GAAG,oBAAoB,GAC7D,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,EACnD,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;KAC7C,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1C,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,4BAA4B,CA6B9B;AAED,oEAAoE;AACpE,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAC7B,UAAU,CAuDZ;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,QAAQ,GACb,OAAO,EAAE,CAwBX;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,0BAA0B,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,GACb,mBAAmB,GAAG,SAAS,CA6BjC"}
+{"version":3,"file":"custom-action.d.ts","sourceRoot":"","sources":["../../src/generators/custom-action.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAG5D,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,YAAY,CAAC;AACtD,YAAY,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,iBAAiB,CAAC;IACzB,8DAA8D;IAC9D,UAAU,EAAE,OAAO,CAAC;IACpB,gEAAgE;IAChE,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;IAC5C,oEAAoE;IACpE,QAAQ,EAAE,OAAO,CAAC;IAClB,sEAAsE;IACtE,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,oEAAoE;IACpE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,2EAA2E;IAC3E,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,+EAA+E;AAC/E,MAAM,MAAM,4BAA4B,GAAG,oBAAoB,GAC7D,QAAQ,CAAC,IAAI,CAAC,oBAAoB,EAAE,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC,CAAC,CAAC;AAE9E;;;;;GAKG;AACH,wBAAgB,8BAA8B,CAC5C,SAAS,EAAE,IAAI,CAAC,oBAAoB,EAAE,YAAY,CAAC,EACnD,aAAa,EAAE,MAAM,GACpB,MAAM,CAER;AAED,MAAM,WAAW,kCAAkC;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE;QACP,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,UAAU,CAAC,EAAE,gBAAgB,CAAC,YAAY,CAAC,CAAC;KAC7C,CAAC;IACF,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gFAAgF;IAChF,YAAY,CAAC,EAAE,iBAAiB,CAAC;CAClC;AAED,KAAK,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAC1C,KAAK,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,OAAO,EAAE,kCAAkC,GAC1C,4BAA4B,CAmC9B;AAED,oEAAoE;AACpE,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,oBAAoB,GAC7B,UAAU,CAuDZ;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAC7C,QAAQ,EAAE,oBAAoB,EAC9B,IAAI,EAAE,QAAQ,GACb,OAAO,EAAE,CAwBX;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,gFAAgF;AAChF,eAAO,MAAM,qCAAqC,0BAA0B,CAAC;AAE7E;;;;GAIG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,GACb,mBAAmB,GAAG,SAAS,CA6BjC"}

package/dist/generators/custom-action.js

@@ -26,7 +26,7 @@ function resolveCustomActionMetadata(options) {
 		...options.method?.parameters ? { parameters: options.method.parameters } : {},
 		isStatic: options.method?.isStatic === true,
 		effect,
-		idempotent: configured.idempotent ?? effect === "read",
+		idempotent: configured.idempotent ?? false,
 		openWorld: configured.openWorld ?? true
 	};
 }

package/dist/generators/custom-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-action.js","names":[],"sources":["../../src/generators/custom-action.ts"],"sourcesContent":["/**\n * Canonical custom-action metadata and transport-safe result helpers.\n *\n * Custom actions are intentionally distinct from generated CRUD. Their target\n * is derived from method metadata: instance methods target an item and static\n * methods target the collection. API route configuration may shape an HTTP\n * route, but it cannot change a method's receiver.\n */\n\nimport type { ToolEffect } from '../registry/types.js';\nimport type { MethodDefinition } from '../scanner/types.js';\nimport { convertTypeToJsonSchema } from '../tools/tool-generator.js';\n\nexport type CustomActionScope = 'item' | 'collection';\nexport type { ToolEffect } from '../registry/types.js';\n\nexport interface CustomActionMetadata {\n  scope: CustomActionScope;\n  /** An item-targeted action requires its target identifier. */\n  idRequired: boolean;\n  /** Present only when scanner/manifest metadata is available. */\n  parameters?: MethodDefinition['parameters'];\n  /** Collection actions on a model class invoke its static method. */\n  isStatic: boolean;\n  /** Browser/agent-visible effect. Omitted declarations fail closed. */\n  effect?: ToolEffect;\n  /** Whether repeating the action with the same arguments is safe. */\n  idempotent?: boolean;\n  /** Whether the opaque action may interact outside the SMRT application. */\n  openWorld?: boolean;\n}\n\n/** Fully resolved metadata returned by {@link resolveCustomActionMetadata}. */\nexport type ResolvedCustomActionMetadata = CustomActionMetadata &\n  Required<Pick<CustomActionMetadata, 'effect' | 'idempotent' | 'openWorld'>>;\n\n/**\n * Return the transport field for a method parameter. Flat tool and CLI\n * transports reserve `id` for receiver parsing even when a collection action\n * rejects it, so every action parameter named `id` is exposed as `actionId`.\n * REST already has separate path/body namespaces.\n */\nexport function customActionParameterInputName(\n  _metadata: Pick<CustomActionMetadata, 'idRequired'>,\n  parameterName: string,\n): string {\n  return parameterName === 'id' ? 'actionId' : parameterName;\n}\n\nexport interface ResolveCustomActionMetadataOptions {\n  actionName: string;\n  method?: {\n    isStatic?: boolean;\n    parameters?: MethodDefinition['parameters'];\n  };\n  apiConfig?: unknown;\n  /** Collection-class actions have a collection receiver even when non-static. */\n  defaultScope?: CustomActionScope;\n}\n\ntype JsonSchema = Record<string, unknown>;\ntype ToolArgs = Record<string, unknown>;\n\n/**\n * Resolve the target contract shared by MCP, generated REST, CLI discovery,\n * and WebMCP. A missing manifest method retains the historical item-shaped\n * schema; runtime callers may still provide their legacy collection fallback.\n */\nexport function resolveCustomActionMetadata(\n  options: ResolveCustomActionMetadataOptions,\n): ResolvedCustomActionMetadata {\n  const defaultScope =\n    options.defaultScope ?? (options.method?.isStatic ? 'collection' : 'item');\n  const requestedScope = readConfiguredScope(\n    options.apiConfig,\n    options.actionName,\n  );\n  // A route-only scope override cannot manufacture a receiver. A normal\n  // instance method is always item-targeted; a static model method and a\n  // recognized collection-class method are always collection-targeted. Keep\n  // a matching explicit value for diagnostics/config round-tripping only.\n  const scope = requestedScope === defaultScope ? requestedScope : defaultScope;\n  const configured = readConfiguredToolMetadata(\n    options.apiConfig,\n    options.actionName,\n  );\n  const effect = configured.effect ?? 'destructive';\n\n  return {\n    scope,\n    idRequired: scope === 'item',\n    ...(options.method?.parameters\n      ? { parameters: options.method.parameters }\n      : {}),\n    isStatic: options.method?.isStatic === true,\n    effect,\n    idempotent: configured.idempotent ?? effect === 'read',\n    openWorld: configured.openWorld ?? true,\n  };\n}\n\n/** Build the custom-action portion of an MCP/WebMCP JSON Schema. */\nexport function buildCustomActionInputSchema(\n  metadata: CustomActionMetadata,\n): JsonSchema {\n  const properties: Record<string, JsonSchema> = {};\n  const required: string[] = [];\n\n  if (metadata.idRequired) {\n    properties.id = {\n      type: 'string',\n      description: 'ID of the object to execute action on',\n    };\n    required.push('id');\n  }\n\n  // Absent metadata is the legacy options-bag contract. Do not infer direct\n  // positional arguments from runtime function arity: it is lossy after\n  // transpilation and would make discovery non-deterministic.\n  if (!metadata.parameters) {\n    properties.options = {\n      type: 'object',\n      description: 'Additional options for the custom action',\n      additionalProperties: true,\n    };\n  } else if (\n    metadata.parameters.length === 1 &&\n    metadata.parameters[0]?.name === 'options'\n  ) {\n    const parameter = metadata.parameters[0];\n    properties.options = {\n      ...convertTypeToJsonSchema(parameter.type),\n      description: 'Options for the custom action',\n      ...(parameter.default !== undefined\n        ? { default: parameter.default }\n        : {}),\n    };\n    if (!parameter.optional) required.push('options');\n  } else {\n    for (const parameter of metadata.parameters) {\n      const inputName = customActionParameterInputName(\n        metadata,\n        parameter.name,\n      );\n      properties[inputName] = {\n        ...convertTypeToJsonSchema(parameter.type),\n        ...(parameter.default !== undefined\n          ? { default: parameter.default }\n          : {}),\n      };\n      if (!parameter.optional) required.push(inputName);\n    }\n  }\n\n  return {\n    type: 'object',\n    properties,\n    ...(required.length > 0 ? { required } : {}),\n  };\n}\n\n/**\n * Translate a transport object into the method's call arguments. Legacy\n * actions retain their single options-bag invocation; scanner metadata enables\n * an exact positional projection without changing legacy action behavior.\n */\nexport function buildCustomActionInvocationArgs(\n  metadata: CustomActionMetadata,\n  args: ToolArgs,\n): unknown[] {\n  const { id: _id, options, ...directArgs } = args;\n\n  if (!metadata.parameters) {\n    return [\n      isRecord(options) && Object.keys(options).length > 0\n        ? options\n        : directArgs,\n    ];\n  }\n  if (metadata.parameters.length === 0) return [];\n  if (\n    metadata.parameters.length === 1 &&\n    metadata.parameters[0]?.name === 'options'\n  ) {\n    // Preserve `undefined` (and an explicit `null`) so JavaScript default\n    // parameter initializers and intentional null handling retain their native\n    // semantics. Legacy options bags still receive an empty object below.\n    return [options];\n  }\n  return metadata.parameters.map(\n    (parameter) =>\n      args[customActionParameterInputName(metadata, parameter.name)],\n  );\n}\n\n/**\n * Domain-neutral returned-failure convention for custom actions. The explicit\n * `ok: false` marker prevents successful opaque values such as `{ code,\n * message }` from being reclassified as failures by a transport.\n */\nexport interface CustomActionFailure {\n  ok: false;\n  code: string;\n  message: string;\n  status: number;\n  details?: unknown;\n  retryable?: boolean;\n  correlationId?: string;\n}\n\n/** Stable MCP `_meta` member shared with the app discovery contract (#2181). */\nexport const SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY = 'io.happyvertical/smrt';\n\n/**\n * Detect, validate, and redact an explicitly returned custom-action failure.\n * Unknown return values remain opaque successes. `status` defaults to 400 so\n * REST callers receive non-2xx semantics even when an adapter omits it.\n */\nexport function normalizeCustomActionFailure(\n  value: unknown,\n): CustomActionFailure | undefined {\n  if (!isRecord(value) || value.ok !== false) return undefined;\n  if (typeof value.code !== 'string' || typeof value.message !== 'string') {\n    return undefined;\n  }\n\n  const status =\n    typeof value.status === 'number' &&\n    Number.isInteger(value.status) &&\n    value.status >= 400 &&\n    value.status <= 599\n      ? value.status\n      : 400;\n\n  return {\n    ok: false,\n    code: value.code,\n    message: redactText(value.message),\n    status,\n    ...(Object.hasOwn(value, 'details')\n      ? { details: redactValue(value.details) }\n      : {}),\n    ...(typeof value.retryable === 'boolean'\n      ? { retryable: value.retryable }\n      : {}),\n    ...(typeof value.correlationId === 'string'\n      ? { correlationId: value.correlationId }\n      : {}),\n  };\n}\n\nfunction readConfiguredScope(\n  apiConfig: unknown,\n  actionName: string,\n): CustomActionScope | undefined {\n  if (!isRecord(apiConfig) || !isRecord(apiConfig.routes)) return undefined;\n  const route = apiConfig.routes[actionName];\n  return isRecord(route) &&\n    (route.scope === 'item' || route.scope === 'collection')\n    ? route.scope\n    : undefined;\n}\n\nfunction readConfiguredToolMetadata(\n  apiConfig: unknown,\n  actionName: string,\n): {\n  effect?: ToolEffect;\n  idempotent?: boolean;\n  openWorld?: boolean;\n} {\n  if (!isRecord(apiConfig) || !isRecord(apiConfig.routes)) return {};\n  const route = apiConfig.routes[actionName];\n  if (!isRecord(route)) return {};\n  const effect =\n    route.effect === 'read' ||\n    route.effect === 'write' ||\n    route.effect === 'destructive'\n      ? route.effect\n      : undefined;\n  if (\n    effect === 'read' &&\n    (route.method === 'PUT' ||\n      route.method === 'PATCH' ||\n      route.method === 'DELETE')\n  ) {\n    throw new Error(\n      `Custom action ${actionName} cannot declare a read effect for a ${route.method} route`,\n    );\n  }\n  return {\n    ...(effect ? { effect } : {}),\n    ...(typeof route.idempotent === 'boolean'\n      ? { idempotent: route.idempotent }\n      : {}),\n    ...(typeof route.openWorld === 'boolean'\n      ? { openWorld: route.openWorld }\n      : {}),\n  };\n}\n\nfunction redactValue(value: unknown, seen = new WeakSet<object>()): unknown {\n  if (typeof value === 'string') return redactText(value);\n  if (value === null || typeof value !== 'object') return value;\n  if (seen.has(value)) return '[REDACTED]';\n  seen.add(value);\n  if (Array.isArray(value))\n    return value.map((entry) => redactValue(entry, seen));\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) return '[REDACTED]';\n  const result: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value)) {\n    result[key] = isSensitiveKey(key)\n      ? '[REDACTED]'\n      : redactValue(nested, seen);\n  }\n  return result;\n}\n\nfunction redactText(value: string): string {\n  return value\n    .replace(/\\bBearer\\s+[^\\s,;]+/giu, 'Bearer [REDACTED]')\n    .replace(\n      /\\b(token|secret|password|api[_-]?key)=([^\\s&]+)/giu,\n      '$1=[REDACTED]',\n    );\n}\n\nfunction isSensitiveKey(key: string): boolean {\n  return /(?:token|secret|password|authorization|cookie|credential|api[_-]?key)/iu.test(\n    key,\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n"],"mappings":";;;;;;;;AA0CA,SAAgB,+BACd,WACA,eACQ;CACR,OAAO,kBAAkB,OAAO,aAAa;AAC/C;;;;;;AAqBA,SAAgB,4BACd,SAC8B;CAC9B,MAAM,eACJ,QAAQ,iBAAiB,QAAQ,QAAQ,WAAW,eAAe;CACrE,MAAM,iBAAiB,oBACrB,QAAQ,WACR,QAAQ,UACV;CAKA,MAAM,QAAQ,mBAAmB,eAAe,iBAAiB;CACjE,MAAM,aAAa,2BACjB,QAAQ,WACR,QAAQ,UACV;CACA,MAAM,SAAS,WAAW,UAAU;CAEpC,OAAO;EACL;EACA,YAAY,UAAU;EACtB,GAAI,QAAQ,QAAQ,aAChB,EAAE,YAAY,QAAQ,OAAO,WAAW,IACxC,CAAC;EACL,UAAU,QAAQ,QAAQ,aAAa;EACvC;EACA,YAAY,WAAW,cAAc,WAAW;EAChD,WAAW,WAAW,aAAa;CACrC;AACF;;AAGA,SAAgB,6BACd,UACY;CACZ,MAAM,aAAyC,CAAC;CAChD,MAAM,WAAqB,CAAC;CAE5B,IAAI,SAAS,YAAY;EACvB,WAAW,KAAK;GACd,MAAM;GACN,aAAa;EACf;EACA,SAAS,KAAK,IAAI;CACpB;CAKA,IAAI,CAAC,SAAS,YACZ,WAAW,UAAU;EACnB,MAAM;EACN,aAAa;EACb,sBAAsB;CACxB;MACK,IACL,SAAS,WAAW,WAAW,KAC/B,SAAS,WAAW,EAAE,EAAE,SAAS,WACjC;EACA,MAAM,YAAY,SAAS,WAAW;EACtC,WAAW,UAAU;GACnB,GAAG,wBAAwB,UAAU,IAAI;GACzC,aAAa;GACb,GAAI,UAAU,YAAY,KAAA,IACtB,EAAE,SAAS,UAAU,QAAQ,IAC7B,CAAC;EACP;EACA,IAAI,CAAC,UAAU,UAAU,SAAS,KAAK,SAAS;CAClD,OACE,KAAK,MAAM,aAAa,SAAS,YAAY;EAC3C,MAAM,YAAY,+BAChB,UACA,UAAU,IACZ;EACA,WAAW,aAAa;GACtB,GAAG,wBAAwB,UAAU,IAAI;GACzC,GAAI,UAAU,YAAY,KAAA,IACtB,EAAE,SAAS,UAAU,QAAQ,IAC7B,CAAC;EACP;EACA,IAAI,CAAC,UAAU,UAAU,SAAS,KAAK,SAAS;CAClD;CAGF,OAAO;EACL,MAAM;EACN;EACA,GAAI,SAAS,SAAS,IAAI,EAAE,SAAS,IAAI,CAAC;CAC5C;AACF;;;;;;AAOA,SAAgB,gCACd,UACA,MACW;CACX,MAAM,EAAE,IAAI,KAAK,SAAS,GAAG,eAAe;CAE5C,IAAI,CAAC,SAAS,YACZ,OAAO,CACL,SAAS,OAAO,KAAK,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAC/C,UACA,UACN;CAEF,IAAI,SAAS,WAAW,WAAW,GAAG,OAAO,CAAC;CAC9C,IACE,SAAS,WAAW,WAAW,KAC/B,SAAS,WAAW,EAAE,EAAE,SAAS,WAKjC,OAAO,CAAC,OAAO;CAEjB,OAAO,SAAS,WAAW,KACxB,cACC,KAAK,+BAA+B,UAAU,UAAU,IAAI,EAChE;AACF;;AAkBA,IAAa,wCAAwC;;;;;;AAOrD,SAAgB,6BACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,OAAO,OAAO,OAAO,KAAA;CACnD,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY,UAC7D;CAGF,MAAM,SACJ,OAAO,MAAM,WAAW,YACxB,OAAO,UAAU,MAAM,MAAM,KAC7B,MAAM,UAAU,OAChB,MAAM,UAAU,MACZ,MAAM,SACN;CAEN,OAAO;EACL,IAAI;EACJ,MAAM,MAAM;EACZ,SAAS,WAAW,MAAM,OAAO;EACjC;EACA,GAAI,OAAO,OAAO,OAAO,SAAS,IAC9B,EAAE,SAAS,YAAY,MAAM,OAAO,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,MAAM,cAAc,YAC3B,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;EACL,GAAI,OAAO,MAAM,kBAAkB,WAC/B,EAAE,eAAe,MAAM,cAAc,IACrC,CAAC;CACP;AACF;AAEA,SAAS,oBACP,WACA,YAC+B;CAC/B,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,UAAU,MAAM,GAAG,OAAO,KAAA;CAChE,MAAM,QAAQ,UAAU,OAAO;CAC/B,OAAO,SAAS,KAAK,MAClB,MAAM,UAAU,UAAU,MAAM,UAAU,gBACzC,MAAM,QACN,KAAA;AACN;AAEA,SAAS,2BACP,WACA,YAKA;CACA,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,UAAU,MAAM,GAAG,OAAO,CAAC;CACjE,MAAM,QAAQ,UAAU,OAAO;CAC/B,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,CAAC;CAC9B,MAAM,SACJ,MAAM,WAAW,UACjB,MAAM,WAAW,WACjB,MAAM,WAAW,gBACb,MAAM,SACN,KAAA;CACN,IACE,WAAW,WACV,MAAM,WAAW,SAChB,MAAM,WAAW,WACjB,MAAM,WAAW,WAEnB,MAAM,IAAI,MACR,iBAAiB,WAAW,sCAAsC,MAAM,OAAO,OACjF;CAEF,OAAO;EACL,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,OAAO,MAAM,eAAe,YAC5B,EAAE,YAAY,MAAM,WAAW,IAC/B,CAAC;EACL,GAAI,OAAO,MAAM,cAAc,YAC3B,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;CACP;AACF;AAEA,SAAS,YAAY,OAAgB,uBAAO,IAAI,QAAgB,GAAY;CAC1E,IAAI,OAAO,UAAU,UAAU,OAAO,WAAW,KAAK;CACtD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CACd,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAAU,YAAY,OAAO,IAAI,CAAC;CACtD,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAAM,OAAO;CACjE,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,KAAK,GAC9C,OAAO,OAAO,eAAe,GAAG,IAC5B,eACA,YAAY,QAAQ,IAAI;CAE9B,OAAO;AACT;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,0BAA0B,mBAAmB,CAAC,CACtD,QACC,sDACA,eACF;AACJ;AAEA,SAAS,eAAe,KAAsB;CAC5C,OAAO,0EAA0E,KAC/E,GACF;AACF;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E"}
+{"version":3,"file":"custom-action.js","names":[],"sources":["../../src/generators/custom-action.ts"],"sourcesContent":["/**\n * Canonical custom-action metadata and transport-safe result helpers.\n *\n * Custom actions are intentionally distinct from generated CRUD. Their target\n * is derived from method metadata: instance methods target an item and static\n * methods target the collection. API route configuration may shape an HTTP\n * route, but it cannot change a method's receiver.\n */\n\nimport type { ToolEffect } from '../registry/types.js';\nimport type { MethodDefinition } from '../scanner/types.js';\nimport { convertTypeToJsonSchema } from '../tools/tool-generator.js';\n\nexport type CustomActionScope = 'item' | 'collection';\nexport type { ToolEffect } from '../registry/types.js';\n\nexport interface CustomActionMetadata {\n  scope: CustomActionScope;\n  /** An item-targeted action requires its target identifier. */\n  idRequired: boolean;\n  /** Present only when scanner/manifest metadata is available. */\n  parameters?: MethodDefinition['parameters'];\n  /** Collection actions on a model class invoke its static method. */\n  isStatic: boolean;\n  /** Browser/agent-visible effect. Omitted declarations fail closed. */\n  effect?: ToolEffect;\n  /** Whether repeating the action with the same arguments is safe. */\n  idempotent?: boolean;\n  /** Whether the opaque action may interact outside the SMRT application. */\n  openWorld?: boolean;\n}\n\n/** Fully resolved metadata returned by {@link resolveCustomActionMetadata}. */\nexport type ResolvedCustomActionMetadata = CustomActionMetadata &\n  Required<Pick<CustomActionMetadata, 'effect' | 'idempotent' | 'openWorld'>>;\n\n/**\n * Return the transport field for a method parameter. Flat tool and CLI\n * transports reserve `id` for receiver parsing even when a collection action\n * rejects it, so every action parameter named `id` is exposed as `actionId`.\n * REST already has separate path/body namespaces.\n */\nexport function customActionParameterInputName(\n  _metadata: Pick<CustomActionMetadata, 'idRequired'>,\n  parameterName: string,\n): string {\n  return parameterName === 'id' ? 'actionId' : parameterName;\n}\n\nexport interface ResolveCustomActionMetadataOptions {\n  actionName: string;\n  method?: {\n    isStatic?: boolean;\n    parameters?: MethodDefinition['parameters'];\n  };\n  apiConfig?: unknown;\n  /** Collection-class actions have a collection receiver even when non-static. */\n  defaultScope?: CustomActionScope;\n}\n\ntype JsonSchema = Record<string, unknown>;\ntype ToolArgs = Record<string, unknown>;\n\n/**\n * Resolve the target contract shared by MCP, generated REST, CLI discovery,\n * and WebMCP. A missing manifest method retains the historical item-shaped\n * schema; runtime callers may still provide their legacy collection fallback.\n */\nexport function resolveCustomActionMetadata(\n  options: ResolveCustomActionMetadataOptions,\n): ResolvedCustomActionMetadata {\n  const defaultScope =\n    options.defaultScope ?? (options.method?.isStatic ? 'collection' : 'item');\n  const requestedScope = readConfiguredScope(\n    options.apiConfig,\n    options.actionName,\n  );\n  // A route-only scope override cannot manufacture a receiver. A normal\n  // instance method is always item-targeted; a static model method and a\n  // recognized collection-class method are always collection-targeted. Keep\n  // a matching explicit value for diagnostics/config round-tripping only.\n  const scope = requestedScope === defaultScope ? requestedScope : defaultScope;\n  const configured = readConfiguredToolMetadata(\n    options.apiConfig,\n    options.actionName,\n  );\n  const effect = configured.effect ?? 'destructive';\n\n  return {\n    scope,\n    idRequired: scope === 'item',\n    ...(options.method?.parameters\n      ? { parameters: options.method.parameters }\n      : {}),\n    isStatic: options.method?.isStatic === true,\n    effect,\n    // Per-field fail-closed default (#2587, CapabilityDeclaration in\n    // @happyvertical/smrt-types): an omitted `idempotent` resolves to\n    // `false` regardless of the declared `effect` — a declared 'read'\n    // action is not guaranteed idempotent (e.g. a dequeue-shaped read that\n    // advances state), so a caller who wants the idempotent hint must\n    // declare it explicitly.\n    idempotent: configured.idempotent ?? false,\n    openWorld: configured.openWorld ?? true,\n  };\n}\n\n/** Build the custom-action portion of an MCP/WebMCP JSON Schema. */\nexport function buildCustomActionInputSchema(\n  metadata: CustomActionMetadata,\n): JsonSchema {\n  const properties: Record<string, JsonSchema> = {};\n  const required: string[] = [];\n\n  if (metadata.idRequired) {\n    properties.id = {\n      type: 'string',\n      description: 'ID of the object to execute action on',\n    };\n    required.push('id');\n  }\n\n  // Absent metadata is the legacy options-bag contract. Do not infer direct\n  // positional arguments from runtime function arity: it is lossy after\n  // transpilation and would make discovery non-deterministic.\n  if (!metadata.parameters) {\n    properties.options = {\n      type: 'object',\n      description: 'Additional options for the custom action',\n      additionalProperties: true,\n    };\n  } else if (\n    metadata.parameters.length === 1 &&\n    metadata.parameters[0]?.name === 'options'\n  ) {\n    const parameter = metadata.parameters[0];\n    properties.options = {\n      ...convertTypeToJsonSchema(parameter.type),\n      description: 'Options for the custom action',\n      ...(parameter.default !== undefined\n        ? { default: parameter.default }\n        : {}),\n    };\n    if (!parameter.optional) required.push('options');\n  } else {\n    for (const parameter of metadata.parameters) {\n      const inputName = customActionParameterInputName(\n        metadata,\n        parameter.name,\n      );\n      properties[inputName] = {\n        ...convertTypeToJsonSchema(parameter.type),\n        ...(parameter.default !== undefined\n          ? { default: parameter.default }\n          : {}),\n      };\n      if (!parameter.optional) required.push(inputName);\n    }\n  }\n\n  return {\n    type: 'object',\n    properties,\n    ...(required.length > 0 ? { required } : {}),\n  };\n}\n\n/**\n * Translate a transport object into the method's call arguments. Legacy\n * actions retain their single options-bag invocation; scanner metadata enables\n * an exact positional projection without changing legacy action behavior.\n */\nexport function buildCustomActionInvocationArgs(\n  metadata: CustomActionMetadata,\n  args: ToolArgs,\n): unknown[] {\n  const { id: _id, options, ...directArgs } = args;\n\n  if (!metadata.parameters) {\n    return [\n      isRecord(options) && Object.keys(options).length > 0\n        ? options\n        : directArgs,\n    ];\n  }\n  if (metadata.parameters.length === 0) return [];\n  if (\n    metadata.parameters.length === 1 &&\n    metadata.parameters[0]?.name === 'options'\n  ) {\n    // Preserve `undefined` (and an explicit `null`) so JavaScript default\n    // parameter initializers and intentional null handling retain their native\n    // semantics. Legacy options bags still receive an empty object below.\n    return [options];\n  }\n  return metadata.parameters.map(\n    (parameter) =>\n      args[customActionParameterInputName(metadata, parameter.name)],\n  );\n}\n\n/**\n * Domain-neutral returned-failure convention for custom actions. The explicit\n * `ok: false` marker prevents successful opaque values such as `{ code,\n * message }` from being reclassified as failures by a transport.\n */\nexport interface CustomActionFailure {\n  ok: false;\n  code: string;\n  message: string;\n  status: number;\n  details?: unknown;\n  retryable?: boolean;\n  correlationId?: string;\n}\n\n/** Stable MCP `_meta` member shared with the app discovery contract (#2181). */\nexport const SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY = 'io.happyvertical/smrt';\n\n/**\n * Detect, validate, and redact an explicitly returned custom-action failure.\n * Unknown return values remain opaque successes. `status` defaults to 400 so\n * REST callers receive non-2xx semantics even when an adapter omits it.\n */\nexport function normalizeCustomActionFailure(\n  value: unknown,\n): CustomActionFailure | undefined {\n  if (!isRecord(value) || value.ok !== false) return undefined;\n  if (typeof value.code !== 'string' || typeof value.message !== 'string') {\n    return undefined;\n  }\n\n  const status =\n    typeof value.status === 'number' &&\n    Number.isInteger(value.status) &&\n    value.status >= 400 &&\n    value.status <= 599\n      ? value.status\n      : 400;\n\n  return {\n    ok: false,\n    code: value.code,\n    message: redactText(value.message),\n    status,\n    ...(Object.hasOwn(value, 'details')\n      ? { details: redactValue(value.details) }\n      : {}),\n    ...(typeof value.retryable === 'boolean'\n      ? { retryable: value.retryable }\n      : {}),\n    ...(typeof value.correlationId === 'string'\n      ? { correlationId: value.correlationId }\n      : {}),\n  };\n}\n\nfunction readConfiguredScope(\n  apiConfig: unknown,\n  actionName: string,\n): CustomActionScope | undefined {\n  if (!isRecord(apiConfig) || !isRecord(apiConfig.routes)) return undefined;\n  const route = apiConfig.routes[actionName];\n  return isRecord(route) &&\n    (route.scope === 'item' || route.scope === 'collection')\n    ? route.scope\n    : undefined;\n}\n\nfunction readConfiguredToolMetadata(\n  apiConfig: unknown,\n  actionName: string,\n): {\n  effect?: ToolEffect;\n  idempotent?: boolean;\n  openWorld?: boolean;\n} {\n  if (!isRecord(apiConfig) || !isRecord(apiConfig.routes)) return {};\n  const route = apiConfig.routes[actionName];\n  if (!isRecord(route)) return {};\n  const effect =\n    route.effect === 'read' ||\n    route.effect === 'write' ||\n    route.effect === 'destructive'\n      ? route.effect\n      : undefined;\n  if (\n    effect === 'read' &&\n    (route.method === 'PUT' ||\n      route.method === 'PATCH' ||\n      route.method === 'DELETE')\n  ) {\n    throw new Error(\n      `Custom action ${actionName} cannot declare a read effect for a ${route.method} route`,\n    );\n  }\n  return {\n    ...(effect ? { effect } : {}),\n    ...(typeof route.idempotent === 'boolean'\n      ? { idempotent: route.idempotent }\n      : {}),\n    ...(typeof route.openWorld === 'boolean'\n      ? { openWorld: route.openWorld }\n      : {}),\n  };\n}\n\nfunction redactValue(value: unknown, seen = new WeakSet<object>()): unknown {\n  if (typeof value === 'string') return redactText(value);\n  if (value === null || typeof value !== 'object') return value;\n  if (seen.has(value)) return '[REDACTED]';\n  seen.add(value);\n  if (Array.isArray(value))\n    return value.map((entry) => redactValue(entry, seen));\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) return '[REDACTED]';\n  const result: Record<string, unknown> = {};\n  for (const [key, nested] of Object.entries(value)) {\n    result[key] = isSensitiveKey(key)\n      ? '[REDACTED]'\n      : redactValue(nested, seen);\n  }\n  return result;\n}\n\nfunction redactText(value: string): string {\n  return value\n    .replace(/\\bBearer\\s+[^\\s,;]+/giu, 'Bearer [REDACTED]')\n    .replace(\n      /\\b(token|secret|password|api[_-]?key)=([^\\s&]+)/giu,\n      '$1=[REDACTED]',\n    );\n}\n\nfunction isSensitiveKey(key: string): boolean {\n  return /(?:token|secret|password|authorization|cookie|credential|api[_-]?key)/iu.test(\n    key,\n  );\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n"],"mappings":";;;;;;;;AA0CA,SAAgB,+BACd,WACA,eACQ;CACR,OAAO,kBAAkB,OAAO,aAAa;AAC/C;;;;;;AAqBA,SAAgB,4BACd,SAC8B;CAC9B,MAAM,eACJ,QAAQ,iBAAiB,QAAQ,QAAQ,WAAW,eAAe;CACrE,MAAM,iBAAiB,oBACrB,QAAQ,WACR,QAAQ,UACV;CAKA,MAAM,QAAQ,mBAAmB,eAAe,iBAAiB;CACjE,MAAM,aAAa,2BACjB,QAAQ,WACR,QAAQ,UACV;CACA,MAAM,SAAS,WAAW,UAAU;CAEpC,OAAO;EACL;EACA,YAAY,UAAU;EACtB,GAAI,QAAQ,QAAQ,aAChB,EAAE,YAAY,QAAQ,OAAO,WAAW,IACxC,CAAC;EACL,UAAU,QAAQ,QAAQ,aAAa;EACvC;EAOA,YAAY,WAAW,cAAc;EACrC,WAAW,WAAW,aAAa;CACrC;AACF;;AAGA,SAAgB,6BACd,UACY;CACZ,MAAM,aAAyC,CAAC;CAChD,MAAM,WAAqB,CAAC;CAE5B,IAAI,SAAS,YAAY;EACvB,WAAW,KAAK;GACd,MAAM;GACN,aAAa;EACf;EACA,SAAS,KAAK,IAAI;CACpB;CAKA,IAAI,CAAC,SAAS,YACZ,WAAW,UAAU;EACnB,MAAM;EACN,aAAa;EACb,sBAAsB;CACxB;MACK,IACL,SAAS,WAAW,WAAW,KAC/B,SAAS,WAAW,EAAE,EAAE,SAAS,WACjC;EACA,MAAM,YAAY,SAAS,WAAW;EACtC,WAAW,UAAU;GACnB,GAAG,wBAAwB,UAAU,IAAI;GACzC,aAAa;GACb,GAAI,UAAU,YAAY,KAAA,IACtB,EAAE,SAAS,UAAU,QAAQ,IAC7B,CAAC;EACP;EACA,IAAI,CAAC,UAAU,UAAU,SAAS,KAAK,SAAS;CAClD,OACE,KAAK,MAAM,aAAa,SAAS,YAAY;EAC3C,MAAM,YAAY,+BAChB,UACA,UAAU,IACZ;EACA,WAAW,aAAa;GACtB,GAAG,wBAAwB,UAAU,IAAI;GACzC,GAAI,UAAU,YAAY,KAAA,IACtB,EAAE,SAAS,UAAU,QAAQ,IAC7B,CAAC;EACP;EACA,IAAI,CAAC,UAAU,UAAU,SAAS,KAAK,SAAS;CAClD;CAGF,OAAO;EACL,MAAM;EACN;EACA,GAAI,SAAS,SAAS,IAAI,EAAE,SAAS,IAAI,CAAC;CAC5C;AACF;;;;;;AAOA,SAAgB,gCACd,UACA,MACW;CACX,MAAM,EAAE,IAAI,KAAK,SAAS,GAAG,eAAe;CAE5C,IAAI,CAAC,SAAS,YACZ,OAAO,CACL,SAAS,OAAO,KAAK,OAAO,KAAK,OAAO,CAAC,CAAC,SAAS,IAC/C,UACA,UACN;CAEF,IAAI,SAAS,WAAW,WAAW,GAAG,OAAO,CAAC;CAC9C,IACE,SAAS,WAAW,WAAW,KAC/B,SAAS,WAAW,EAAE,EAAE,SAAS,WAKjC,OAAO,CAAC,OAAO;CAEjB,OAAO,SAAS,WAAW,KACxB,cACC,KAAK,+BAA+B,UAAU,UAAU,IAAI,EAChE;AACF;;AAkBA,IAAa,wCAAwC;;;;;;AAOrD,SAAgB,6BACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,OAAO,OAAO,OAAO,KAAA;CACnD,IAAI,OAAO,MAAM,SAAS,YAAY,OAAO,MAAM,YAAY,UAC7D;CAGF,MAAM,SACJ,OAAO,MAAM,WAAW,YACxB,OAAO,UAAU,MAAM,MAAM,KAC7B,MAAM,UAAU,OAChB,MAAM,UAAU,MACZ,MAAM,SACN;CAEN,OAAO;EACL,IAAI;EACJ,MAAM,MAAM;EACZ,SAAS,WAAW,MAAM,OAAO;EACjC;EACA,GAAI,OAAO,OAAO,OAAO,SAAS,IAC9B,EAAE,SAAS,YAAY,MAAM,OAAO,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,MAAM,cAAc,YAC3B,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;EACL,GAAI,OAAO,MAAM,kBAAkB,WAC/B,EAAE,eAAe,MAAM,cAAc,IACrC,CAAC;CACP;AACF;AAEA,SAAS,oBACP,WACA,YAC+B;CAC/B,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,UAAU,MAAM,GAAG,OAAO,KAAA;CAChE,MAAM,QAAQ,UAAU,OAAO;CAC/B,OAAO,SAAS,KAAK,MAClB,MAAM,UAAU,UAAU,MAAM,UAAU,gBACzC,MAAM,QACN,KAAA;AACN;AAEA,SAAS,2BACP,WACA,YAKA;CACA,IAAI,CAAC,SAAS,SAAS,KAAK,CAAC,SAAS,UAAU,MAAM,GAAG,OAAO,CAAC;CACjE,MAAM,QAAQ,UAAU,OAAO;CAC/B,IAAI,CAAC,SAAS,KAAK,GAAG,OAAO,CAAC;CAC9B,MAAM,SACJ,MAAM,WAAW,UACjB,MAAM,WAAW,WACjB,MAAM,WAAW,gBACb,MAAM,SACN,KAAA;CACN,IACE,WAAW,WACV,MAAM,WAAW,SAChB,MAAM,WAAW,WACjB,MAAM,WAAW,WAEnB,MAAM,IAAI,MACR,iBAAiB,WAAW,sCAAsC,MAAM,OAAO,OACjF;CAEF,OAAO;EACL,GAAI,SAAS,EAAE,OAAO,IAAI,CAAC;EAC3B,GAAI,OAAO,MAAM,eAAe,YAC5B,EAAE,YAAY,MAAM,WAAW,IAC/B,CAAC;EACL,GAAI,OAAO,MAAM,cAAc,YAC3B,EAAE,WAAW,MAAM,UAAU,IAC7B,CAAC;CACP;AACF;AAEA,SAAS,YAAY,OAAgB,uBAAO,IAAI,QAAgB,GAAY;CAC1E,IAAI,OAAO,UAAU,UAAU,OAAO,WAAW,KAAK;CACtD,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU,OAAO;CACxD,IAAI,KAAK,IAAI,KAAK,GAAG,OAAO;CAC5B,KAAK,IAAI,KAAK;CACd,IAAI,MAAM,QAAQ,KAAK,GACrB,OAAO,MAAM,KAAK,UAAU,YAAY,OAAO,IAAI,CAAC;CACtD,MAAM,YAAY,OAAO,eAAe,KAAK;CAC7C,IAAI,cAAc,OAAO,aAAa,cAAc,MAAM,OAAO;CACjE,MAAM,SAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,KAAK,WAAW,OAAO,QAAQ,KAAK,GAC9C,OAAO,OAAO,eAAe,GAAG,IAC5B,eACA,YAAY,QAAQ,IAAI;CAE9B,OAAO;AACT;AAEA,SAAS,WAAW,OAAuB;CACzC,OAAO,MACJ,QAAQ,0BAA0B,mBAAmB,CAAC,CACtD,QACC,sDACA,eACF;AACJ;AAEA,SAAS,eAAe,KAAsB;CAC5C,OAAO,0EAA0E,KAC/E,GACF;AACF;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E"}

package/dist/generators/index.d.ts

@@ -8,6 +8,7 @@ export { buildCustomActionInputSchema, buildCustomActionInvocationArgs, type Cus
 export { buildChangeEventStream, type ChangeEventStreamOptions, changeEventSubscribersAtCapacity, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, eventStreamCapacityExceededResponse, normalizeEventsMaxSubscribers, signalVisibleToTenant, tryReserveChangeEventSubscriberSlot, } from './events-route';
 export type { MCPConfig, MCPContext, MCPRequest, MCPResponse, MCPTool, MCPToolListCacheHint, MCPToolListCacheOptions, } from './mcp';
 export { MCP_STABLE_CATALOG_TTL_MS, MCPGenerator, resolveMCPToolListCacheHint, sortMCPTools, } from './mcp';
+export { handlePlaybookPreflightRoute, isApiActionEnabledForObject, isRestActionRoutable, isRestRoutePublic, PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, type PlaybookPreflightProvider, type PlaybookPreflightRouteOptions, type PlaybookPreflightRouteRequest, resolveRegisteredObjectName, restFieldReadPermissions, restMethodForApiAction, } from './preflight-route';
 export type { APIConfig, APIContext, RestServerConfig } from './rest';
 export { APIGenerator, computeRuntimeWebManifestHash, createRestServer, startRestServer, } from './rest';
 export type { OpenAPIConfig } from './swagger';

package/dist/generators/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generators/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9D,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,qCAAqC,EACrC,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,2BAA2B,EAC3B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,OAAO,EACP,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,OAAO,CAAC;AAEf,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,2BAA2B,EAC3B,YAAY,GACb,MAAM,OAAO,CAAC;AACf,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEtE,OAAO,EACL,YAAY,EACZ,6BAA6B,EAC7B,gBAAgB,EAChB,eAAe,GAChB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EACL,mBAAmB,EACnB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/generators/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAEnD,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAG9D,OAAO,EACL,2BAA2B,EAC3B,eAAe,EACf,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,KAAK,uBAAuB,EAC5B,uBAAuB,EACvB,8BAA8B,EAC9B,0BAA0B,EAC1B,4BAA4B,GAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,8BAA8B,EAC9B,4BAA4B,EAC5B,KAAK,kCAAkC,EACvC,KAAK,4BAA4B,EACjC,2BAA2B,EAC3B,qCAAqC,EACrC,KAAK,UAAU,GAChB,MAAM,iBAAiB,CAAC;AAKzB,OAAO,EACL,sBAAsB,EACtB,KAAK,wBAAwB,EAC7B,gCAAgC,EAChC,2BAA2B,EAC3B,8BAA8B,EAC9B,kCAAkC,EAClC,mCAAmC,EACnC,6BAA6B,EAC7B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,gBAAgB,CAAC;AACxB,YAAY,EACV,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,OAAO,EACP,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,OAAO,CAAC;AAEf,OAAO,EACL,yBAAyB,EACzB,YAAY,EACZ,2BAA2B,EAC3B,YAAY,GACb,MAAM,OAAO,CAAC;AAIf,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,oBAAoB,EACpB,iBAAiB,EACjB,6BAA6B,EAC7B,gCAAgC,EAChC,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,6BAA6B,EAClC,2BAA2B,EAC3B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,QAAQ,CAAC;AAEtE,OAAO,EACL,YAAY,EACZ,6BAA6B,EAC7B,gBAAgB,EAChB,eAAe,GAChB,MAAM,QAAQ,CAAC;AAChB,YAAY,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,OAAO,EACL,mBAAmB,EACnB,cAAc,GACf,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,uBAAuB,EACvB,KAAK,gBAAgB,GACtB,MAAM,oBAAoB,CAAC"}

package/dist/generators/index.js

@@ -4,7 +4,8 @@ import { CLIGenerator, getCLIHandler, setupCLI } from "./cli.js";
 import { PRIVATE_READ_CACHE_CONTROL, canonicalReadRepresentation, computeBodyEtag, computeTableVersionEtag, conditionalJsonResponse, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, resolveReadCacheControl, resolveTenantEtagDiscriminator, versionConditionalResponse, warnIfSharedCacheNeutralized } from "./conditional-get.js";
 import { DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, buildChangeEventStream, changeEventSubscribersAtCapacity, eventStreamCapacityExceededResponse, normalizeEventsMaxSubscribers, signalVisibleToTenant, tryReserveChangeEventSubscriberSlot } from "./events-route.js";
 import { MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, resolveMCPToolListCacheHint, sortMCPTools } from "./mcp.js";
+import { PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, handlePlaybookPreflightRoute, isApiActionEnabledForObject, isRestActionRoutable, isRestRoutePublic, resolveRegisteredObjectName, restFieldReadPermissions, restMethodForApiAction } from "./preflight-route.js";
 import { normalizeTypedHttpError } from "./typed-http-error.js";
 import { APIGenerator, computeRuntimeWebManifestHash, createRestServer, startRestServer } from "./rest.js";
 import { generateOpenAPISpec, setupSwaggerUI } from "./swagger.js";
-export { APIGenerator, CLIGenerator, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, normalizeTypedHttpError, resolveCustomActionMetadata, resolveMCPToolListCacheHint, resolveReadCacheControl, resolveTenantEtagDiscriminator, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, sortMCPTools, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };
+export { APIGenerator, CLIGenerator, DEFAULT_EVENTS_HEARTBEAT_MS, DEFAULT_EVENTS_MAX_SUBSCRIBERS, DEFAULT_EVENTS_RETRY_AFTER_SECONDS, MCPGenerator, MCP_STABLE_CATALOG_TTL_MS, PLAYBOOK_PREFLIGHT_CAPABILITY, PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT, PRIVATE_READ_CACHE_CONTROL, SMRT_CUSTOM_ACTION_ERROR_METADATA_KEY, buildChangeEventStream, buildCustomActionInputSchema, buildCustomActionInvocationArgs, canonicalReadRepresentation, changeEventSubscribersAtCapacity, computeBodyEtag, computeRuntimeWebManifestHash, computeTableVersionEtag, conditionalJsonResponse, createRestServer, customActionParameterInputName, eventStreamCapacityExceededResponse, generateOpenAPISpec, getCLIHandler, handlePlaybookPreflightRoute, ifNoneMatchHasConcreteMatch, ifNoneMatchSatisfied, isApiActionEnabledForObject, isRestActionRoutable, isRestRoutePublic, normalizeCustomActionFailure, normalizeEventsMaxSubscribers, normalizeTypedHttpError, resolveCustomActionMetadata, resolveMCPToolListCacheHint, resolveReadCacheControl, resolveRegisteredObjectName, resolveTenantEtagDiscriminator, restFieldReadPermissions, restMethodForApiAction, runWithTenantGate, setTenantEntryPointRunner, setupCLI, setupSwaggerUI, signalVisibleToTenant, sortMCPTools, startRestServer, tryReserveChangeEventSubscriberSlot, versionConditionalResponse, warnIfSharedCacheNeutralized };

package/dist/generators/preflight-route.d.ts

@@ -0,0 +1,151 @@
+/**
+ * Generated `_preflight` HTTP route for browser-plane playbook preflight
+ * (issue #2590).
+ *
+ * Handles `GET {basePath}/_preflight?key=<playbook key>` in the REST generator:
+ * an advisory, read-effect, idempotent report of what a caller's playbook would
+ * be allowed to do — *predicted*, never granted. Every step is authorized again
+ * where it executes; this route is capability **selection**, never
+ * authorization (epic #2585 invariant 2).
+ *
+ * ## `authMiddleware` is never invoked here
+ *
+ * Generated REST authorization is
+ * `authMiddleware?: (objectName, action) => (req) => Promise<Request | Response>`
+ * — request-bound, `Response`-returning rather than boolean, and free to consult
+ * session stores, rate-limit, or audit. It is not a dry-run predicate, and a
+ * synthetic-`Request` dry run of it would be a side effect the caller never
+ * asked for.
+ *
+ * That is enforced **structurally**, not by discipline:
+ * {@link PlaybookPreflightRouteOptions} has no `authMiddleware` member and no
+ * function-valued auth member of any kind. `rest.ts` passes the boolean
+ * `appAuthConfigured` and nothing else, so there is no handle in this module to
+ * invoke even by mistake. The app-auth layer is consequently reported as
+ * `unknown`, which is the honest answer.
+ *
+ * ## Why the provider is injected
+ *
+ * Resolution and verdict shaping live in `@happyvertical/smrt-playbooks`, which
+ * depends on this package. Core therefore owns the route and the static-layer
+ * facts (`ObjectRegistry` is core's), and takes the evaluator as a seam — the
+ * dependency stays one-way.
+ */
+/** Path segment the preflight route is served at, under the API base path. */
+export declare const PLAYBOOK_PREFLIGHT_ROUTE_SEGMENT = "_preflight";
+/**
+ * Capability classification of the preflight route: a read, safely repeatable,
+ * and closed-world. It is admitted by a default read-only browser exposure
+ * policy without an opt-in, because it reports on the system rather than
+ * changing it.
+ */
+export declare const PLAYBOOK_PREFLIGHT_CAPABILITY: Readonly<{
+    readonly effect: "read";
+    readonly idempotent: true;
+    readonly openWorld: false;
+}>;
+/**
+ * The request handed to a preflight provider. Deliberately carries no request,
+ * no headers, and no auth handle — only the caller-scoped facts the static
+ * layers need.
+ */
+export interface PlaybookPreflightRouteRequest {
+    /** The requested playbook key. */
+    key: string;
+    /** Always `'browser'` from this route. */
+    plane: 'browser';
+    /** The caller's published permission slugs, when the API context has them. */
+    permissions?: Iterable<string>;
+    /** Whether an app auth middleware is wired. A boolean; never the function. */
+    appAuthConfigured: boolean;
+    /** The generator's `APIContext.db`. */
+    db?: unknown;
+}
+/**
+ * Host-supplied browser-plane preflight evaluator, wired from
+ * `@happyvertical/smrt-playbooks`. Returns a JSON-serializable report.
+ */
+export type PlaybookPreflightProvider = (request: PlaybookPreflightRouteRequest) => Promise<unknown>;
+/**
+ * Options for {@link handlePlaybookPreflightRoute}.
+ *
+ * There is intentionally no `authMiddleware` member — see the module docs.
+ */
+export interface PlaybookPreflightRouteOptions {
+    provider?: PlaybookPreflightProvider;
+    permissions?: Iterable<string>;
+    appAuthConfigured: boolean;
+    db?: unknown;
+}
+/**
+ * Serves `GET {basePath}/_preflight?key=<key>`.
+ *
+ * Unresolvable keys are the provider's concern: it returns the same uniform
+ * "unavailable" body for an unknown key as for an unauthorized one, and this
+ * route serves whatever it returns with an unconditional 200, so the HTTP layer
+ * adds no way to tell them apart either.
+ */
+export declare function handlePlaybookPreflightRoute(req: Request, options: PlaybookPreflightRouteOptions): Promise<Response>;
+/**
+ * Resolves a qualified model reference (`@happyvertical/smrt-commerce:Order`)
+ * to the name the registry and the REST generator key configuration by.
+ *
+ * Returns `undefined` for anything this build does not register, so the caller
+ * fails closed rather than reporting on a model that has no route.
+ */
+export declare function resolveRegisteredObjectName(model: string): string | undefined;
+/**
+ * The HTTP method a REST action is served by.
+ *
+ * CRUD actions map to their fixed verbs. A custom action is served under the
+ * method its own route config declares (`api.routes[action].method`, defaulting
+ * to `POST` exactly as `dispatchCustomCollectionAction` does), because guessing
+ * `POST` for a declared `GET` action would make preflight report a false `deny`
+ * on a `public: 'read'` model — hiding a playbook the caller can actually run,
+ * which is the tool-listing case this exists to serve. Without an `objectName`
+ * to read the declaration from, the fail-closed `POST` remains.
+ */
+export declare function restMethodForApiAction(action: string, objectName?: string): string;
+/**
+ * Whether `@smrt({ api })` exposes `action` on `objectName`.
+ *
+ * The generator's own action gate, lifted to a module function so preflight and
+ * the live route read the same rule from one place. Accepts any action name so
+ * a custom action is gated by the same `include`/`exclude` lists.
+ *
+ * @remarks An absent `objectName` returns `true` — fail-**open**, because the
+ * live route reaches this only after it has already resolved a model, and an
+ * unnamed object there means "not gated by this rule". A caller *predicting*
+ * rather than serving has no such guarantee and must reject an unresolvable
+ * model before asking (see `createRestPreflightLayerSource`).
+ */
+export declare function isApiActionEnabledForObject(objectName: string | undefined, action: string): boolean;
+/**
+ * Whether `action` names a route the generated REST surface can actually
+ * dispatch on `objectName`.
+ *
+ * CRUD actions always have a route. A custom action exists only when the
+ * decorator declares it in `api.routes` — `dispatchCustomCollectionAction`
+ * iterates exactly that map, so an action absent from it can never execute no
+ * matter what `include`/`exclude` say. Exposure alone would report a typo'd or
+ * removed custom action as `allow`, and an agent would then start the earlier
+ * steps of a non-atomic playbook before dying on it — the failure preflight
+ * exists to prevent.
+ */
+export declare function isRestActionRoutable(objectName: string | undefined, action: string): boolean;
+/**
+ * Fail-closed authorization posture (#1540): true only when the object opts out
+ * of auth via `@smrt({ api: { public } })` — `true` for every method, `'read'`
+ * for safe (GET) methods only.
+ */
+export declare function isRestRoutePublic(objectName: string | undefined, method: string): boolean;
+/**
+ * Field-level read-permission slugs declared by `objectName`.
+ *
+ * Reads the model's own and inherited fields only — deliberately **not** the
+ * STI base-plus-descendants union used for cache policy. That union answers
+ * "does any variant carry a read-permission field?"; used here it would report
+ * a sibling variant's slugs as required for a step naming this concrete model.
+ */
+export declare function restFieldReadPermissions(objectName: string | undefined): string[];
+//# sourceMappingURL=preflight-route.d.ts.map

package/dist/generators/preflight-route.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight-route.d.ts","sourceRoot":"","sources":["../../src/generators/preflight-route.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAKH,8EAA8E;AAC9E,eAAO,MAAM,gCAAgC,eAAe,CAAC;AAE7D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B;;;;EAI/B,CAAC;AAEZ;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,kCAAkC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,0CAA0C;IAC1C,KAAK,EAAE,SAAS,CAAC;IACjB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,8EAA8E;IAC9E,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uCAAuC;IACvC,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,CACtC,OAAO,EAAE,6BAA6B,KACnC,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,EAAE,yBAAyB,CAAC;IACrC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,EAAE,CAAC,EAAE,OAAO,CAAC;CACd;AAYD;;;;;;;GAOG;AACH,wBAAsB,4BAA4B,CAChD,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE,6BAA6B,GACrC,OAAO,CAAC,QAAQ,CAAC,CAwBnB;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAK7E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,EACd,UAAU,CAAC,EAAE,MAAM,GAClB,MAAM,CA4BR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,2BAA2B,CACzC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAsBT;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAkBT;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,MAAM,EAAE,MAAM,GACb,OAAO,CAQT;AAED;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,MAAM,GAAG,SAAS,GAC7B,MAAM,EAAE,CAiBV"}