@happyvertical/smrt-core 0.44.0 → 0.45.0

package/AGENTS.md

@@ -27,14 +27,14 @@ subsystem you are editing. This file keeps what holds across all of them.
 
 - `initialize()`: loads field initializers, applies option values (options override initializers), loads from DB if id/slug provided
 - `save()`: upsert with STI validation, interceptor execution, auto-embeddings. Persisted objects (`isPersisted` — set by DB hydration and successful saves) upsert on `['id']` so natural-key edits (e.g. slug renames) update in place; new objects upsert on the natural-key conflict columns for ingestion-style dedup (#1472)
-- Persisted `save()` calls use the object's loaded `updated_at` revision in the
-  database `UPDATE`; zero affected rows throws `RUNTIME_REVISION_CONFLICT`
-  without overwriting the newer row. `save({ expectedUpdatedAt })` supplies an
-  explicit revision when a caller binds the mutation to an earlier preview or
-  selection snapshot. Embedded adapters serialize every same-process model
-  save, delete, and complete `SmrtObject.withTransaction()` callback through
-  one queue; bound saves re-enter that hold. Custom write paths must use those
-  public APIs rather than bypassing the CAS ordering contract.
+- Persisted `save()` uses loaded `updated_at` in its `UPDATE`; zero rows throws
+  `RUNTIME_REVISION_CONFLICT`. Explicit `expectedUpdatedAt` binds a save or
+  delete to an earlier snapshot. Remote guarded deletes bind the same predicate
+  into the final `DELETE`; embedded adapters compare inside the shared write queue
+  before cascading. That queue serializes same-process saves, deletes, and full
+  `SmrtObject.withTransaction()` callbacks. Custom writes must preserve this
+  public CAS ordering contract. PostgreSQL predicate:
+  [agents/revision-guard.md](agents/revision-guard.md).
 - Native DuckDB UUID columns are hydrated as canonical strings before model
   initialization, natural-key lookup, and embedded revision claims. Exact
   natural-key probes retain the interceptor-authorized filter when

package/agents/change-feed.md

@@ -10,7 +10,8 @@ Adapter-agnostic change-observation spine (`src/change-feed.ts`) — the server
 
 - `_smrt_changes` system table: one append per framework save/delete via a GlobalInterceptors writer registered at framework init. Deletes are tombstones (`operation: 'delete'`). `_smrt_*` tables are skipped. Feed-append failures log and never fail the user's write. On PostgreSQL, `_smrt_append_change` catches the INSERT in an exception subtransaction and returns SQLSTATE as data, so swallowing/retrying a best-effort failure cannot leave a caller-managed transaction aborted with `25P02` (#2026); the feed row still commits or rolls back with the caller transaction. Raw-handle/read initialization checks for both the table and helper before issuing any DDL; a cold schema/helper install acquires the same transaction-scoped `('smrt', 'system-tables')` advisory lock as bootstrap before its first DDL and rechecks inside one server-side statement, while schema migration/bootstrap remains the authoritative replace path. No dirty-check: a field-unchanged `.save()` appends a spurious `update` entry (diff-aware paths like `getOrUpsert`/sync-apply short-circuit before `save()` and append nothing); subscribers must tolerate spurious entries — they are convergent.
 - Sequences: allocated as `MAX(seq)+1` inside the INSERT with conflict retry — committed rows stay contiguous, so commit order == seq order on SQLite/Postgres/DuckDB (deliberately NOT identity/serial: those allocate before commit and break the cursor guarantee under concurrent writers).
+- Staged appends (PostgreSQL, #2649): `MAX+1` costs a *wait* — the loser of a primary-key race waits for the winner's whole transaction — so an append inside a caller transaction that already wrote rows would let a long write transaction and an ordinary concurrent request form a real lock cycle (`40P01`, found downstream in willgriffin/willgriffin.dev#457). `_smrt_append_change` therefore checks `pg_current_xact_id_if_assigned()` (PostgreSQL 13+): when the caller already has a transaction id it stages the entry in `_smrt_changes_pending` (identity key, conflicts with nothing, never waits, still rolled back with the caller) and `appendChange()` returns **`null`** instead of a sequence. `_smrt_drain_changes()` moves *committed* staged rows into `_smrt_changes` with contiguous `MAX(seq)+row_number()` sequences under a **try-only** advisory lock, so the drain never waits either. Draining is driven from JavaScript, never inside the append helper: an entry sequenced invisibly server-side would get no live `_events` signal while the append's own signal carried a higher sequence, and a subscriber resuming from that `Last-Event-ID` would skip it permanently. `drainChangeFeed(db)` is called best-effort by `getChangesSince()`, by `pruneChangeFeed()`, and by the append path itself (throttled to one drain per 250 ms per database, bypassed immediately after this process staged an append). The append path issues ONE drain statement (a single bounded pass) and nothing else — the caller may own the surrounding transaction, and a second statement there could fail and abort it behind the feed's own error-swallowing (#2026); the helper's whole body, preflight included, sits inside its exception boundary for the same reason. It still settles that drain's signals in order without spending a statement: a drain that allocated anything assigns a transaction id, so an append that then takes the DIRECT path proves the drain committed, and its signals publish ahead of the append's own; a deferred append proves nothing and queues them. Signals for drained entries publish only after a follow-up probe proves the drain committed, so an uncommitted drain can never advertise a sequence a rollback releases for reuse. `getChangesSince()` additionally holds back everything the handle's own drains allocated while a transaction id is still assigned at read time (a per-handle watermark, so later reads in the same transaction keep holding back), and `bootstrapSystemTables()` refreshes the helpers before its schema-version fast return so an already-stamped database does not keep the deadlocking function. Consequences: the cursor guarantee is unchanged (one `MAX+1` writer at a time, only over committed work), but a staged entry becomes visible one drain after its transaction commits, its log position is drain order rather than statement order, and it publishes its live `_events` signal at drain time (post-commit — the old pre-commit signal could describe a rolled-back write). SQLite/DuckDB keep the direct insert unchanged. Residual: an append issued as a transaction's *first* statement still allocates inline — it holds no row locks then, so it cannot close a cycle, but it can make other direct appenders wait for that commit; issue explicit `bumpChangeFeed()` calls after the write or outside the transaction. A deployment that writes only through transactions and reads the feed from a connection that cannot write must schedule `drainChangeFeed()` on a writable one.
 - `getChangesSince(db, { since, tables?, tenantId?, limit? }) → { changes, cursor, resyncRequired?, resyncCursor? }`: strictly monotonic cursor; polling with returned cursors misses no committed change and never repeats one. A cursor that cannot be served incrementally — pruned below the retained `[floor..horizon]` run, or foreign/ahead of the horizon — gets `resyncRequired: true` with empty `changes`, an unadvanced `cursor`, and `resyncCursor` set to the current horizon so clients can full-refetch then resume incrementally; detection runs on the UNFILTERED log so `tables`/`tenantId` filters never trigger or mask it. `getTenantScopedChangesSince()` resolves tenant via the DispatchBus resolver hook (fail-closed: tenancy on + no context → global rows only; tenant `T` sees `T` + global rows, never another tenant).
-- `getTableVersion(db, table) → number`: the per-table change version (`MAX(seq)` for the table, replica-stable — no per-process divergence), the ETag source for zero-query conditional GETs (#1765). Advances on any framework write to the table (CRUD and sync-apply, which all `save()`/`delete()`). A table with no retained entry of its own falls back to the global horizon (never a resettable low value) so an all-pruned table cannot false-304 a stale client; only 0 when the feed is empty.
+- `getTableVersion(db, table) → number`: the per-table change version (`MAX(seq)` for the table **plus that table's staged-but-undrained count**, so a staged write still moves the ETag and cannot false-304 a client; the sum is monotonic because draining `n` staged rows raises the table's `MAX(seq)` by at least `n`, and both terms are read in ONE statement — separate reads let a drain be counted twice, minting a version a later write re-mints; replica-stable, with no per-process divergence), the ETag source for zero-query conditional GETs (#1765). Advances on any framework write to the table (CRUD and sync-apply, which all `save()`/`delete()`). A table with no retained entry of its own falls back to the global horizon (never a resettable low value) so an all-pruned table cannot false-304 a stale client; only 0 when the feed is empty.
 - Generated `_changes` routes: REST (`GET {basePath}/_changes`, requires `authMiddleware`, otherwise 401 — per-model `api.public` does NOT apply) and SvelteKit (`{routesDir}/_changes/+server.ts`, requires an authenticated principal on `locals`; opt out via `sveltekit.changesRoute.enabled: false`). Query params: `since`, `tables` (comma-separated), `limit`. Responses stay HTTP 200 in the resync state — `resyncRequired` is protocol state, not an error, and `resyncCursor` is the resume cursor after the client completes a full refetch.
-- Retention: `pruneChangeFeed(db, { maxAgeMs?, maxRows?, dryRun? })` — scheduled since #2375 by `runRetentionSweep()` (30-day default), so nothing needs to call it directly; `dryRun` counts the same predicate instead of deleting. Pruning deletes oldest-first and always retains the newest entry (a non-empty feed is never emptied), which is what makes pruned-cursor detection provable and keeps caught-up consumers polling normally. Raw-SQL writes are invisible to the feed (same documented gap as the #1499 cache); `bumpChangeFeed(db, { table, rowId? })` is the manual escape hatch.
+- Retention: `pruneChangeFeed(db, { maxAgeMs?, maxRows?, dryRun? })` — scheduled since #2375 by `runRetentionSweep()` (30-day default), so nothing needs to call it directly; `dryRun` counts the same predicate instead of deleting. Pruning deletes oldest-first and always retains the newest entry (a non-empty feed is never emptied), which is what makes pruned-cursor detection provable. The age bound is a **prefix** bound — everything below the oldest entry still inside the window — because `created_at` and `seq` are not co-monotonic (writer clocks skew, and a staged entry carries its stage-time stamp into a later-assigned sequence); deleting by timestamp alone could punch a hole in the middle of the retained run, where `since < floor - 1` cannot see it and keeps caught-up consumers polling normally. Raw-SQL writes are invisible to the feed (same documented gap as the #1499 cache); `bumpChangeFeed(db, { table, rowId? })` is the manual escape hatch.

package/agents/generators.md

@@ -63,6 +63,40 @@ requested path rather than a hardcoded `index.js`.
 Generated code also has to be valid in an ES module: `arguments` is not a legal
 binding name there, however convenient it reads.
 
+## Browser-plane playbook preflight route (#2590)
+
+`GET {basePath}/_preflight?key=<playbook key>` (`src/generators/preflight-route.ts`)
+is an advisory, read-effect, idempotent report of what a caller's playbook would
+be allowed to do — capability *selection*, never authorization. Resolution and
+verdict shaping live in `@happyvertical/smrt-playbooks`, which depends on this
+package, so core takes the evaluator as the `APIConfig.playbookPreflight` seam and
+the dependency stays one-way. Without a provider the route 404s.
+
+**`authMiddleware` is never invoked by preflight**, and that is enforced
+structurally rather than by discipline: `PlaybookPreflightRouteOptions` has no
+auth member of any kind, and `rest.ts` passes the boolean `appAuthConfigured`
+instead — so there is no handle in the module to invoke by mistake. A synthetic-
+`Request` dry run is explicitly not an option: the middleware is request-bound,
+returns a `Response` rather than a boolean, and may consult session stores,
+rate-limit, or audit. The app-auth layer therefore reports `unknown`, which is the
+honest answer, and a future `authPredicate` seam can fill it in without changing
+the contract.
+
+The static layers preflight predicts against are exported from the same module —
+`isApiActionEnabledForObject`, `isRestActionRoutable`, `isRestRoutePublic`,
+`restFieldReadPermissions`, `restMethodForApiAction`,
+`resolveRegisteredObjectName` — and `APIGenerator`'s own
+`isApiActionEnabled` / `isRoutePublic` now delegate to them, so the route and the
+prediction of the route cannot drift. Exposure and existence are separate
+questions: `include`/`exclude` gate a route, they do not conjure one, so
+`isRestActionRoutable` additionally requires a custom action to be declared in
+`api.routes` — the only map `dispatchCustomCollectionAction` iterates. A custom
+action is predicted against the verb its own route config declares, so a
+`public: 'read'` opt-out neither silently covers a `POST` action nor falsely
+denies a declared `GET` one. Every unresolvable key returns the provider's single uniform
+"unavailable" body with an unconditional 200: unknown and unauthorized keys are
+indistinguishable at the HTTP layer too.
+
 ## Emitted agent surface (#2591)
 
 Generated model tools have always been build-time artifacts — virtual module,

package/agents/revision-guard.md

@@ -0,0 +1,66 @@
+# Revision compare-and-swap guard (`src/revision-guard.ts`)
+
+Every persisted `save()` pins its `UPDATE` to the revision the writer loaded;
+`claimRevision()` does the same without running domain hooks, and
+`delete({ expectedUpdatedAt })` binds the same predicate into its final
+`DELETE`. Zero affected rows raises `RUNTIME_REVISION_CONFLICT` rather than
+overwriting or removing a newer row.
+
+## Why the predicate is not an equality (#2620)
+
+The guard used to compare `updated_at` to `loadedRevision.toISOString()`. On
+PostgreSQL a JavaScript `Date` is two lossy conversions away from the stored
+value, so that predicate matched no row at all in two common situations — and
+the object then conflicted on *every* later save, permanently, rather than
+losing a race:
+
+- **Precision.** `updated_at` is a microsecond column. Any row last written by
+  raw SQL — `updated_at = CURRENT_TIMESTAMP` / `now()`, including SMRT's own
+  migration backfills — carries a sub-millisecond tail a `Date` cannot hold.
+- **Process timezone.** Schemas created before the `TIMESTAMPTZ` mapping still
+  hold `updated_at` as `timestamp WITHOUT time zone`, and `pg` hydrates that
+  type in the process zone, so on a non-UTC host `toISOString()` renders a wall
+  clock the row never held. The same columns are written under three different
+  conventions — `pg` serializes a bound `Date` in the process zone,
+  `claimRevision()` writes a UTC ISO string, and raw `CURRENT_TIMESTAMP` writes
+  in the *server* zone — so no single rendering can match every row.
+
+## What the predicate does instead
+
+`postgresRevisionCondition()` builds
+`date_trunc('milliseconds', updated_at) IN (…)` over both wall-clock renderings
+of the revision, the process-zone one and the UTC one, each tagged `+00` so a
+`timestamptz` comparison honours it and a `timestamp` comparison discards it —
+the predicate therefore does not depend on the *session* TimeZone either. On a
+UTC process the two renderings coincide and the condition is single-valued.
+
+Lost-race semantics are preserved: a concurrent writer advances `updated_at` to
+roughly "now", so it must land on the loaded revision — or, on a non-UTC
+process only, on that revision shifted by the whole UTC offset — to the
+millisecond before it could slip past. Collapsing that second rendering so the
+predicate is single-valued on every process is tracked as #2623.
+
+## Rules
+
+- Never rebuild this predicate by hand; call `postgresRevisionCondition()`.
+  Every guarded write — `save()`, `claimRevision()`, and the guarded `DELETE` —
+  goes through `SmrtObject.revisionPredicate()` so no path is left on the exact
+  equality.
+- The condition is PostgreSQL-only. Embedded engines take the process-local
+  compare/upsert fallback (`usesEmbeddedRevisionFallback`), and remote LibSQL
+  stores ISO text whose exact equality round-trips losslessly.
+- Custom write paths must go through `save()`, `save({ expectedUpdatedAt })`,
+  or `claimRevision()` rather than bypassing the CAS ordering contract.
+- The driver-layer half — `pg` hydrating and serializing `timestamp` columns in
+  the process zone — is tracked as happyvertical/sdk#1223. The guard
+  deliberately assumes neither hydration convention, so a UTC-hydration fix
+  there cannot break it.
+
+## Coverage
+
+`src/__tests__/issue-2620-revision-guard-precision-postgres.optional.test.ts`
+runs the whole battery — guarded save, `save({ expectedUpdatedAt })`,
+`claimRevision()`, guarded delete, and their still-conflicts counterparts —
+against both `updated_at` column shapes in the registered PostgreSQL suite (`pnpm --filter @happyvertical/smrt-core
+test:postgres`). `src/__tests__/revision-guard.test.ts` covers the rendering
+itself in the default suite.

package/dist/browser.js

@@ -15,6 +15,7 @@ import { convertTypeToJsonSchema, generateToolFromMethod, generateToolManifest,
 import { executeToolCall, executeToolCalls, formatToolResults, validateToolCall } from "./tools/tool-executor.js";
 import { SmrtObject } from "./object.js";
 import { SMRT_COLLECTION_BASE_NAMES, isSmrtCollectionExtendsName } from "./registry/collection-resolution.js";
+import { isFrameworkBaseClass } from "./registry/framework-base-classes.js";
 import { ObjectRegistry, smrt } from "./registry.js";
 import { DEFAULT_FACET_LIMIT, MAX_FACET_FIELDS, MAX_FACET_LIMIT, MAX_STI_READ_SCOPE_TYPES, SmrtCollection } from "./collection.js";
 import { SmrtHierarchical } from "./hierarchical.js";
@@ -24,4 +25,4 @@ import "./signals/index.js";
 import { DEFAULT_RETENTION_POLICY, clearRetentionTasks, getRetentionTasks, pruneAiUsage, pruneExpiredContexts, registerRetentionTask, runRetentionSweep, unregisterRetentionTask } from "./system/retention.js";
 import "./system/index.js";
 import "./tools/index.js";
-export { AIError, AiUsageCollector, AiUsagePersistenceHandler, ConfigurationError, DEFAULT_AI_COST_RATES, DEFAULT_FACET_LIMIT, DEFAULT_RETENTION_POLICY, DatabaseError, ErrorUtils, FilesystemError, MAX_FACET_FIELDS, MAX_FACET_LIMIT, MAX_STI_READ_SCOPE_TYPES, MetricsAdapter, NetworkError, ObjectRegistry, PubSubAdapter, RuntimeError, SMRT_COLLECTION_BASE_NAMES, SignalBus, SignalSanitizer, SmrtClass, SmrtCollection, SmrtError, SmrtHierarchical, SmrtJunction, SmrtObject, SmrtPolymorphicAssociation, TenantIsolationError, ValidationError, ValidationReport, ValidationUtils, assertPostgresSystemTimestampsCurrent, classifyDatabaseError, classifyDialectMessage, clearRetentionTasks, config, convertTypeToJsonSchema, ensureBootstrapSystemTableCompatibility, ensureDeferredSystemTableCompatibility, ensureDispatchSubscriptionsSystemTableCompatibility, ensureDispatchSystemTableCompatibility, ensureJobEventsSystemTableCompatibility, ensureJobsSystemTableCompatibility, ensureLegacySystemTableCompatibility, ensureSystemTables, estimateAiUsageCost, executeToolCall, executeToolCalls, formatToolResults, generateToolFromMethod, generateToolManifest, getDatabaseEngine, getRetentionTasks, isAbortedTransactionError, isDeterministicDatabaseError, isNotNullViolationError, isSmrtCollectionExtendsName, isTransientDatabaseError, isUniqueViolationError, migratePostgresSystemTimestamps, planPostgresSystemTimestampMigrations, pruneAiUsage, pruneExpiredContexts, registerRetentionTask, runRetentionSweep, shouldIncludeMethod, smrt, smrt as smrtRegistry, tableExists, unregisterRetentionTask, validateToolCall };
+export { AIError, AiUsageCollector, AiUsagePersistenceHandler, ConfigurationError, DEFAULT_AI_COST_RATES, DEFAULT_FACET_LIMIT, DEFAULT_RETENTION_POLICY, DatabaseError, ErrorUtils, FilesystemError, MAX_FACET_FIELDS, MAX_FACET_LIMIT, MAX_STI_READ_SCOPE_TYPES, MetricsAdapter, NetworkError, ObjectRegistry, PubSubAdapter, RuntimeError, SMRT_COLLECTION_BASE_NAMES, SignalBus, SignalSanitizer, SmrtClass, SmrtCollection, SmrtError, SmrtHierarchical, SmrtJunction, SmrtObject, SmrtPolymorphicAssociation, TenantIsolationError, ValidationError, ValidationReport, ValidationUtils, assertPostgresSystemTimestampsCurrent, classifyDatabaseError, classifyDialectMessage, clearRetentionTasks, config, convertTypeToJsonSchema, ensureBootstrapSystemTableCompatibility, ensureDeferredSystemTableCompatibility, ensureDispatchSubscriptionsSystemTableCompatibility, ensureDispatchSystemTableCompatibility, ensureJobEventsSystemTableCompatibility, ensureJobsSystemTableCompatibility, ensureLegacySystemTableCompatibility, ensureSystemTables, estimateAiUsageCost, executeToolCall, executeToolCalls, formatToolResults, generateToolFromMethod, generateToolManifest, getDatabaseEngine, getRetentionTasks, isAbortedTransactionError, isDeterministicDatabaseError, isFrameworkBaseClass, isNotNullViolationError, isSmrtCollectionExtendsName, isTransientDatabaseError, isUniqueViolationError, migratePostgresSystemTimestamps, planPostgresSystemTimestampMigrations, pruneAiUsage, pruneExpiredContexts, registerRetentionTask, runRetentionSweep, shouldIncludeMethod, smrt, smrt as smrtRegistry, tableExists, unregisterRetentionTask, validateToolCall };

package/dist/cascade.d.ts

@@ -96,15 +96,11 @@ export declare function cascadeReferencesTo(db: DatabaseInterface, registry: Cas
 /**
  * Run the cascade and the target row's own deletion atomically.
  *
- * When anything references the class and the adapter exposes `transaction()`,
- * the whole sequence runs inside one — including the caller's `deleteSelf`
- * statement, so a failure part-way through cannot leave the object deleted with
- * its junction rows intact (or vice versa). Adapters without transaction
- * support run the same statements sequentially; this is the documented
- * degradation, not a silent one.
- *
- * When nothing references the class there is nothing to keep consistent, and
- * the transaction is skipped — see the comment on that branch.
+ * When the adapter exposes `transaction()`, the whole sequence runs inside one
+ * — including framework-owned row cleanup and the caller's `deleteSelf`
+ * statement, so a failure part-way through cannot leave either side orphaned.
+ * Adapters without transaction support run the same statements sequentially;
+ * this is the documented degradation, not a silent one.
  *
  * @param db - Database the object is bound to
  * @param registry - Registry view used to build cascade plans

package/dist/cascade.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cascade.d.ts","sourceRoot":"","sources":["../src/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAK5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAM1D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAsB9C,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,MAAM,EAAE,cAAc,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,mEAAmE;IACnE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3C,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,OAAO,cAAc,EACnB,oBAAoB,GACpB,WAAW,GACX,oBAAoB,GACpB,cAAc,GACd,uBAAuB,GACvB,UAAU,GACV,YAAY,GACZ,gBAAgB,CACnB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAE5E;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,SAAS,EAAE,MAAM,GAChB,WAAW,CAgIb;AAkVD,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,iBAAiB,EACrB,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9D,OAAO,CAAC,aAAa,CAAC,CAwBxB;AASD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,iBAAiB,EACrB,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC/B,EACD,UAAU,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC,aAAa,CAAC,CAgDxB"}
+{"version":3,"file":"cascade.d.ts","sourceRoot":"","sources":["../src/cascade.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiEG;AAGH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAK5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAKpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAM1D;;;;;;GAMG;AACH,MAAM,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAsB9C,gFAAgF;AAChF,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,SAAS,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,MAAM,EAAE,MAAM,CAAC;IACf,8EAA8E;IAC9E,MAAM,EAAE,cAAc,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,mEAAmE;AACnE,MAAM,WAAW,2BAA2B;IAC1C,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,4EAA4E;IAC5E,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC/B,mEAAmE;IACnE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3C,yEAAyE;IACzE,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,+EAA+E;IAC/E,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,OAAO,cAAc,EACnB,oBAAoB,GACpB,WAAW,GACX,oBAAoB,GACpB,cAAc,GACd,uBAAuB,GACvB,UAAU,GACV,YAAY,GACZ,gBAAgB,CACnB,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,GAAG,SAAS,CAE5E;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,mBAAmB,EAC7B,SAAS,EAAE,MAAM,GAChB,WAAW,CAgIb;AAkZD,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,cAAc,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B;;;;OAIG;IACH,oBAAoB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,iBAAiB,EACrB,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,EAAE,CAAA;CAAE,GAC9D,OAAO,CAAC,aAAa,CAAC,CAwBxB;AASD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,iBAAiB,EACrB,QAAQ,EAAE,mBAAmB,EAC7B,MAAM,EAAE;IACN,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,EAAE,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CAC/B,EACD,UAAU,EAAE,CAAC,EAAE,EAAE,iBAAiB,KAAK,OAAO,CAAC,IAAI,CAAC,GACnD,OAAO,CAAC,aAAa,CAAC,CAuDxB"}

package/dist/cascade.js

@@ -24,14 +24,11 @@ import { createLogger } from "@happyvertical/logger";
 *   `afterDelete` hooks and interceptors do **not** run, and no change-feed
 *   tombstone is written for them — exactly as `ON DELETE CASCADE` behaves.
 *   Only the object `delete()` was called on runs the full lifecycle.
-* - When anything needs cascading, everything runs inside a single
-*   transaction when the adapter exposes one, so a partial cascade cannot
-*   survive a failure. A class with no typed references AND no registered
-*   polymorphic association class anywhere in the process skips the
-*   transaction — see {@link runCascadeDelete}. A `metaType` column can point
+* - Every delete runs inside a single transaction when the adapter exposes
+*   one, including cleanup of framework-owned context and embedding rows, so
+*   a partial cascade cannot survive a failure. A `metaType` column can point
 *   at any class at runtime, so a polymorphic association class is always
-*   plausibly relevant; in an app with even one registered, this fast path is
-*   rare, not the common case.
+*   plausibly relevant.
 *
 * ## Which references are followed
 *
@@ -240,6 +237,43 @@ async function tolerateMissingTable(operation, fallback, context) {
 		throw error;
 	}
 }
+/**
+* System-table cleanup may ignore an absent table for databases created before
+* that subsystem existed, but never a missing column in a table that does
+* exist. The shared `undefined_object` classification intentionally combines
+* both cases, so this security boundary must retain the narrower driver signal.
+*/
+function normalizeMissingTableName(value) {
+	const unquoted = value.replace(/["'`[\]]/g, "");
+	return (unquoted.split(".").at(-1) ?? unquoted).replace(/[^A-Za-z0-9_$-]/g, "").toLowerCase();
+}
+function missingTableNames(messages) {
+	const names = [];
+	const patterns = [
+		/no such table:\s*([^\s,;]+)/giu,
+		/(?:relation|table)\s+((?:"[^"]+"(?:\."[^"]+")*)|(?:[A-Za-z0-9_.$-]+))\s+does not exist/giu,
+		/table with name\s+((?:"[^"]+")|(?:[A-Za-z0-9_.$-]+))\s+does not exist/giu
+	];
+	for (const message of messages) for (const pattern of patterns) for (const match of message.matchAll(pattern)) if (match[1]) names.push(normalizeMissingTableName(match[1]));
+	return names;
+}
+function isMissingTableError(error, expectedTable) {
+	const classification = classifyDatabaseError(error);
+	if (classification.kind !== "undefined_object") return false;
+	if (classification.sqlstate === "42703" || classification.driverCode === "42703" || classification.driverCodes.includes("42703")) return false;
+	const names = missingTableNames(classification.driverMessages);
+	const expected = normalizeMissingTableName(expectedTable);
+	return names.length > 0 && names.every((missingTableName) => missingTableName === expected);
+}
+async function tolerateMissingSystemTable(operation, fallback, context) {
+	try {
+		return await operation();
+	} catch (error) {
+		if (!isMissingTableError(error, context.table)) throw error;
+		logger.warn(`Cascade delete skipped ${context.action} on '${context.table}': table not found in this database.`, { error: error instanceof Error ? error.message : String(error) });
+		return fallback;
+	}
+}
 async function selectIds(db, tableName, column, ids) {
 	const found = [];
 	for (const batch of chunkArray(ids, 900)) {
@@ -275,7 +309,8 @@ async function deleteByIds(db, tableName, ids) {
 * enough.
 *
 * A missing system table is not an error — an application database may predate
-* the table, and losing derived rows must never fail an otherwise valid delete.
+* the table. Every other cleanup failure propagates so the surrounding delete
+* transaction rolls back rather than orphaning tenant-sensitive recall data.
 */
 async function deleteSystemRows(db, ids, classNames) {
 	const ownerIds = ids.filter((id) => typeof id === "string" && id.length > 0 && id !== COLLECTION_OWNER_SENTINEL);
@@ -288,14 +323,13 @@ async function deleteSystemRows(db, ids, classNames) {
 		EMBEDDINGS_TABLE,
 		"object_id",
 		"object_class"
-	]]) for (const batch of chunkArray(ownerIds, 900)) try {
-		await db.delete(table, {
-			...idPredicate(idColumn, batch),
-			...idPredicate(classColumn, classNames)
-		});
-	} catch (error) {
-		logger.warn(`Failed to clean ${table} rows during cascade delete: ${error instanceof Error ? error.message : String(error)}`);
-	}
+	]]) for (const batch of chunkArray(ownerIds, 900)) await tolerateMissingSystemTable(() => db.delete(table, {
+		...idPredicate(idColumn, batch),
+		...idPredicate(classColumn, classNames)
+	}), void 0, {
+		table,
+		action: "framework-owned row cleanup"
+	});
 }
 /**
 * Resolve every reference pointing at `ids` of `className`, recursively.
@@ -383,15 +417,11 @@ async function cascadeReferencesTo(db, registry, target) {
 /**
 * Run the cascade and the target row's own deletion atomically.
 *
-* When anything references the class and the adapter exposes `transaction()`,
-* the whole sequence runs inside one — including the caller's `deleteSelf`
-* statement, so a failure part-way through cannot leave the object deleted with
-* its junction rows intact (or vice versa). Adapters without transaction
-* support run the same statements sequentially; this is the documented
-* degradation, not a silent one.
-*
-* When nothing references the class there is nothing to keep consistent, and
-* the transaction is skipped — see the comment on that branch.
+* When the adapter exposes `transaction()`, the whole sequence runs inside one
+* — including framework-owned row cleanup and the caller's `deleteSelf`
+* statement, so a failure part-way through cannot leave either side orphaned.
+* Adapters without transaction support run the same statements sequentially;
+* this is the documented degradation, not a silent one.
 *
 * @param db - Database the object is bound to
 * @param registry - Registry view used to build cascade plans
@@ -402,12 +432,17 @@ async function cascadeReferencesTo(db, registry, target) {
 async function runCascadeDelete(db, registry, target, deleteSelf) {
 	const ids = target.id ? [target.id] : [];
 	if (buildCascadePlan(registry, target.className).isEmpty) {
-		await deleteSelf(db);
-		await deleteSystemRows(db, ids, ownerClassCandidates(registry, target.className));
-		return {
-			affectedTables: /* @__PURE__ */ new Set(),
-			affectedTableClasses: /* @__PURE__ */ new Map()
+		const runWithoutReferences = async (bound) => {
+			await deleteSystemRows(bound, ids, ownerClassCandidates(registry, target.className));
+			await deleteSelf(bound);
+			return {
+				affectedTables: /* @__PURE__ */ new Set(),
+				affectedTableClasses: /* @__PURE__ */ new Map()
+			};
 		};
+		const transaction = db.transaction;
+		if (typeof transaction !== "function") return runWithoutReferences(db);
+		return transaction.call(db, runWithoutReferences);
 	}
 	const run = async (bound) => {
 		const result = await cascadeReferencesTo(bound, registry, {

package/dist/cascade.js.map

@@ -1 +1 @@
-{"version":3,"file":"cascade.js","names":[],"sources":["../src/cascade.ts"],"sourcesContent":["/**\n * App-side referential integrity for `SmrtObject.delete()` (#2371).\n *\n * Same-package `@foreignKey` fields now emit database constraints where the\n * engine can enforce the declared policy. Cross-package references and older\n * schemas still rely on this application-side path. Before this module,\n * `delete()` removed the object's own row and nothing else: junction rows,\n * polymorphic association rows, `_smrt_embeddings` and `_smrt_contexts` entries\n * were all left pointing at an id that no longer resolved, and\n * `@foreignKey(..., { onDelete })` was metadata nobody read.\n *\n * This module implements those semantics in the application layer. It mirrors\n * what a DB-level constraint would do, deliberately including the parts that\n * make it *unlike* a model-layer delete:\n *\n * - Cascaded rows are removed with set-based statements. Their `beforeDelete` /\n *   `afterDelete` hooks and interceptors do **not** run, and no change-feed\n *   tombstone is written for them — exactly as `ON DELETE CASCADE` behaves.\n *   Only the object `delete()` was called on runs the full lifecycle.\n * - When anything needs cascading, everything runs inside a single\n *   transaction when the adapter exposes one, so a partial cascade cannot\n *   survive a failure. A class with no typed references AND no registered\n *   polymorphic association class anywhere in the process skips the\n *   transaction — see {@link runCascadeDelete}. A `metaType` column can point\n *   at any class at runtime, so a polymorphic association class is always\n *   plausibly relevant; in an app with even one registered, this fast path is\n *   rare, not the common case.\n *\n * ## Which references are followed\n *\n * A reference is any `@foreignKey` / `@crossPackageRef` field on a registered\n * class whose target resolves to the deleted object's class (or one of its\n * registered STI ancestors), plus the polymorphic `(metaType, metaId)` pair on\n * {@link SmrtPolymorphicAssociation} subclasses.\n *\n * The action comes from the field's declared `onDelete`. When it is not\n * declared, the default is derived from the referencing class's natural key:\n *\n * | Reference | Default when `onDelete` is absent |\n * |---|---|\n * | Column is part of the referencing class's `conflictColumns`, and is not a `@tenantId()` field | `CASCADE` |\n * | Polymorphic `(metaType, metaId)` association row | `CASCADE` |\n * | Ordinary same-package reference | `NO ACTION` (deletion is refused while references remain) |\n * | Every `@tenantId()` field | Excluded: tenant scope is not an ownership edge |\n *\n * The natural-key rule is what makes junction rows work without any\n * per-package annotation: a junction declares\n * `@smrt({ conflictColumns: ['content_id', 'asset_id', 'relationship'] })`, so\n * `content_id` identifies the row and the row cannot outlive the content it\n * links. An ordinary child (`Order.customerId`) is keyed by `(slug, context)`,\n * so it defaults to immediate `NO ACTION` unless it opts in with\n * `@foreignKey(Customer, { onDelete: 'CASCADE' })`.\n *\n * `@tenantId()` fields are excluded from the natural-key rule even though\n * `@happyvertical/smrt-tenancy` leads a tenant-scoped class's *default*\n * `conflictColumns` with the tenant column (#2360): the tenant column scopes\n * ownership, it does not identify the row the way a junction's foreign key\n * does, and it targets a class (`Tenant`) that is virtually always\n * referenced. Without this exclusion, deleting one `Tenant` row would\n * recursively CASCADE through every tenant-scoped table that has not\n * declared its own `conflictColumns` — the overwhelming majority. The field\n * is detected via the `__tenancy.isTenantIdField` marker `@tenantId()`\n * attaches to its own registration (`FieldMeta.__tenancy`, read structurally\n * so `smrt-core` never depends on `smrt-tenancy`). `@tenantId()` exposes no\n * `onDelete` option today, so this cannot currently be overridden per field.\n *\n * @see https://github.com/happyvertical/smrt/issues/2371\n * @module\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { classifyDatabaseError } from './db-errors.js';\nimport { ConfigurationError, DatabaseError } from './errors.js';\n// Type-only: erased at runtime, so it cannot re-enter the\n// `registry → object → cascade` import cycle.\nimport type { ObjectRegistry } from './registry.js';\nimport {\n  normalizeForeignKeyAction,\n  resolveForeignKeyDeleteAction,\n} from './schema/foreign-key-policy.js';\nimport type { ForeignKeyAction } from './schema/types.js';\nimport { chunkArray, IN_LIST_CHUNK_SIZE } from './utils/chunk.js';\nimport { toSnakeCase } from './utils/naming.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Referential action applied to rows pointing at a deleted object.\n *\n * Same vocabulary as SQL's `ON DELETE`, enforced by the framework before the\n * engine. `NO ACTION` is preflighted like an immediate restrictive action so\n * application-side and database-side enforcement agree.\n */\nexport type OnDeleteAction = ForeignKeyAction;\n\n/** Table holding framework-managed per-object memory entries. */\nconst CONTEXTS_TABLE = '_smrt_contexts';\n\n/** Table holding framework-managed per-object embedding vectors. */\nconst EMBEDDINGS_TABLE = '_smrt_embeddings';\n\n/**\n * Reserved `_smrt_contexts.owner_id` used by `SmrtCollection.remember()` for\n * collection-scoped memory. A real object id is a UUID and can never equal it,\n * but the guard keeps a malformed id from wiping every sibling's defaults.\n */\nconst COLLECTION_OWNER_SENTINEL = '__collection__';\n\n/**\n * Maximum number of cascade levels followed from the object `delete()` was\n * called on. A cycle between two classes that both declare `onDelete: 'CASCADE'`\n * is broken by the visited set; this bound catches unbounded *chains*.\n */\nconst MAX_CASCADE_DEPTH = 10;\n\n/** One reference that must be resolved before the target row can be removed. */\nexport interface CascadeReference {\n  /** Registered name of the class holding the referencing column. */\n  className: string;\n  /** Table holding the referencing rows. */\n  tableName: string;\n  /** Field name (camelCase) on the referencing class. */\n  fieldName: string;\n  /** Column (snake_case) holding the reference. */\n  column: string;\n  /** Resolved action. `NO ACTION` is preflighted like an immediate RESTRICT. */\n  action: OnDeleteAction;\n  /** `true` when the action was declared rather than derived from the key. */\n  declared: boolean;\n}\n\n/** A polymorphic association table that can point at any class. */\nexport interface CascadePolymorphicReference {\n  /** Registered name of the association class. */\n  className: string;\n  /** Table holding the association rows. */\n  tableName: string;\n}\n\n/** Everything that must happen before rows of one class can be deleted. */\nexport interface CascadePlan {\n  /** Typed `@foreignKey` / `@crossPackageRef` references, action-resolved. */\n  references: CascadeReference[];\n  /** Polymorphic association tables that may point at this class. */\n  polymorphic: CascadePolymorphicReference[];\n  /** `meta_type` values that identify this class in an association row. */\n  metaTypes: string[];\n  /** `true` when nothing references this class and nothing has to be visited. */\n  isEmpty: boolean;\n}\n\n/**\n * Read-only slice of `ObjectRegistry` this module needs.\n *\n * Taking it as a parameter — rather than importing the registry as a value —\n * keeps `cascade.ts` out of the `registry → object → cascade` import cycle,\n * and lets tests drive the planner from a hand-built registry.\n */\nexport type CascadeRegistryView = Pick<\n  typeof ObjectRegistry,\n  | 'getRelationshipMap'\n  | 'getFields'\n  | 'getConflictColumns'\n  | 'getTableName'\n  | 'getSelfReferableNames'\n  | 'getClass'\n  | 'getSTIBase'\n  | 'getDescendants'\n>;\n\n/**\n * Normalize a declared `onDelete` value.\n *\n * Accepts any casing and both `SET NULL` and `SET_NULL`, matching what the\n * schema generator has always carried in the manifest. Returns `undefined` for\n * an unset or unrecognized value so the caller can fall back to the default.\n */\nexport function normalizeOnDelete(value: unknown): OnDeleteAction | undefined {\n  return normalizeForeignKeyAction(value);\n}\n\nfunction isPolymorphicAssociationClass(fields: Map<string, unknown>): boolean {\n  // The three columns `SmrtPolymorphicAssociation` contributes. Requiring all\n  // of them keeps an unrelated class that happens to carry a `metaType` from\n  // being treated as an association table.\n  return fields.has('metaType') && fields.has('metaId') && fields.has('role');\n}\n\n/**\n * Build the cascade plan for one class.\n *\n * The plan is derived entirely from registry metadata, so it is valid for any\n * database the class is used against. It is rebuilt per delete rather than\n * cached: registration is incremental (manifests load lazily, tests register\n * classes between cases) and a stale plan would silently skip a table.\n *\n * @param registry - Registry view (`ObjectRegistry` satisfies it)\n * @param className - Class whose incoming references should be resolved\n */\nexport function buildCascadePlan(\n  registry: CascadeRegistryView,\n  className: string,\n): CascadePlan {\n  // `className` is normally already qualified (delete() passes\n  // getResolvedQualifiedName()), but a common same-package `@foreignKey('X')`\n  // still stores its target as the bare simple name `X`. That still matches:\n  // getSelfReferableNames() walks the full ancestor chain (self included) and\n  // adds each ancestor's *simple* name via `getClass(ancestor)?.name`, so the\n  // simple form is already in the seed set below, not just the loop's\n  // qualified-variant augmentation.\n  const targetNames = new Set(registry.getSelfReferableNames(className));\n  for (const name of [...targetNames]) {\n    const qualified = registry.getClass(name)?.qualifiedName;\n    if (qualified) targetNames.add(qualified);\n  }\n\n  const references: CascadeReference[] = [];\n  const polymorphic: CascadePolymorphicReference[] = [];\n\n  for (const [sourceClass, relationships] of registry.getRelationshipMap()) {\n    const fields = registry.getFields(sourceClass);\n\n    if (isPolymorphicAssociationClass(fields)) {\n      const tableName = registry.getTableName(sourceClass);\n      if (tableName) {\n        polymorphic.push({ className: sourceClass, tableName });\n      }\n    }\n\n    if (relationships.length === 0) continue;\n\n    let conflictColumns: Set<string> | undefined;\n\n    for (const relationship of relationships) {\n      if (\n        relationship.type !== 'foreignKey' &&\n        relationship.type !== 'crossPackageRef'\n      ) {\n        continue;\n      }\n      if (!targetNames.has(relationship.targetClass)) continue;\n\n      // An explicit app-side-only relationship is archival metadata, not a\n      // referential-integrity rule. Its identifier is deliberately allowed to\n      // outlive the parent, so delete planning must not block, null, or remove\n      // the retained row (#2413).\n      if (\n        relationship.type === 'foreignKey' &&\n        relationship.options?.constraint === false\n      ) {\n        continue;\n      }\n\n      const tableName = registry.getTableName(sourceClass);\n      if (!tableName) continue;\n\n      const column = toSnakeCase(relationship.fieldName);\n      if (!conflictColumns) {\n        conflictColumns = new Set(registry.getConflictColumns(sourceClass));\n      }\n\n      // A `@tenantId()` field is a structural scoping marker, not a\n      // junction/ownership key — it lands in `conflictColumns` only because\n      // #2360 leads every tenant-scoped class's *default* natural key with\n      // the tenant column, not because the referencing row is *identified*\n      // by its tenant the way a junction row is identified by its parent.\n      // Without this guard, deleting a `Tenant` would silently CASCADE\n      // through the tenant column of every tenant-scoped class in the\n      // schema that has not declared its own `conflictColumns` — the\n      // overwhelming majority. `@tenantId()` exposes no `onDelete` today, so\n      // an explicit declaration can never widen this back to CASCADE; that\n      // is deliberate until tenant-delete cascade is an explicit decision.\n      const isTenantIdField =\n        relationship.options?.__tenancy?.isTenantIdField === true;\n      if (isTenantIdField) continue;\n\n      const { action, declared } = resolveForeignKeyDeleteAction({\n        declared: relationship.options?.onDelete,\n        isConflictColumn: conflictColumns.has(column),\n        isTenantIdField: false,\n      });\n\n      if (\n        action === 'SET NULL' &&\n        fields.get(relationship.fieldName)?.required\n      ) {\n        // Fail on the declaration, not later on a NOT NULL violation from the\n        // engine — the message there names a column, not the decorator.\n        throw ConfigurationError.invalidConfiguration(\n          `${sourceClass}.${relationship.fieldName} onDelete: 'SET NULL'`,\n          relationship.fieldName,\n          \"a nullable field (mark it `nullable: true`, or use 'CASCADE' / 'RESTRICT')\",\n        );\n      }\n\n      references.push({\n        className: sourceClass,\n        tableName,\n        fieldName: relationship.fieldName,\n        column,\n        action,\n        declared,\n      });\n    }\n  }\n\n  // Both forms are matched deliberately: an association row written before a\n  // class was package-qualified still carries the simple `meta_type`. The\n  // qualified form alone is unambiguous; the simple-name fallback can still\n  // match a same-simple-name sibling class's row if it also shares a\n  // `meta_id` — a real, not just theoretical, risk for a class declaring\n  // `idType: 'text'` (non-UUID, not guaranteed globally unique), the same gap\n  // `deleteSystemRows()` closed for `_smrt_contexts` / `_smrt_embeddings`\n  // (review fix) by adding a class-name filter. Closing it here needs the\n  // same STI-and-legacy-name-aware filter this module already builds for\n  // `deleteSystemRows()` narrowed further to registry-unambiguous simple\n  // names; tracked under #2419 alongside the other same-simple-name\n  // collision gaps rather than reworked here.\n  const metaTypes: string[] = [];\n  const qualified = registry.getClass(className)?.qualifiedName;\n  if (qualified) metaTypes.push(qualified);\n  const simple = registry.getClass(className)?.name ?? className;\n  if (!metaTypes.includes(simple)) metaTypes.push(simple);\n\n  return {\n    references,\n    polymorphic,\n    metaTypes,\n    isEmpty: references.length === 0 && polymorphic.length === 0,\n  };\n}\n\n/** Per-delete state shared by every level of the cascade. */\ninterface CascadeContext {\n  db: DatabaseInterface;\n  registry: CascadeRegistryView;\n  /** `table:id` pairs already expanded, so a reference cycle terminates. */\n  visited: Set<string>;\n  /** Tables touched by the cascade, for read-cache invalidation. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified name of the class that owns each affected table, so the\n   * caller can resolve *that* class's own `@smrt({ cache })` config —\n   * cross-process cache invalidation is a per-class opt-in, and a table\n   * cascaded into belongs to a different class than the one `delete()` was\n   * called on.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/** Resolve a registry-recorded class name to its qualified form, when known. */\nfunction toQualifiedClassName(\n  registry: CascadeRegistryView,\n  className: string,\n): string {\n  return registry.getClass(className)?.qualifiedName ?? className;\n}\n\n/**\n * Every value `_smrt_contexts.owner_class` / `_smrt_embeddings.object_class`\n * could plausibly hold for a row belonging to an id of `className` (review\n * fix): both name forms (qualified + simple — older rows predate package\n * qualification) of `className` itself, plus every other member of its STI\n * hierarchy sharing its table. A CASCADE-collected id can belong to any\n * concrete STI subclass of the declaring reference, which stamps its own\n * (more specific) runtime class name at write time, not the reference's.\n *\n * Narrowing by this set — instead of matching by id alone — closes a\n * cross-class collision: two unrelated classes using `idType: 'text'`\n * (non-UUID, not guaranteed globally unique) could otherwise share an id\n * value and have one's `remember()`/embeddings rows deleted by the other's\n * cascade.\n */\nfunction ownerClassCandidates(\n  registry: CascadeRegistryView,\n  className: string,\n): string[] {\n  const stiBase = registry.getSTIBase(className) ?? className;\n  const members = new Set<string>([\n    className,\n    stiBase,\n    ...registry.getDescendants(stiBase),\n  ]);\n\n  const names = new Set<string>();\n  for (const member of members) {\n    names.add(member);\n    const registered = registry.getClass(member);\n    if (registered?.qualifiedName) names.add(registered.qualifiedName);\n    if (registered?.name) names.add(registered.name);\n  }\n  return [...names];\n}\n\n/**\n * Build the `where` clause matching `column` against one or more ids.\n *\n * A single id uses equality so the planner can use a plain index; multiple ids\n * use the adapter's `in` operator.\n */\nfunction idPredicate(column: string, ids: string[]): Record<string, unknown> {\n  return ids.length === 1 ? { [column]: ids[0] } : { [`${column} in`]: ids };\n}\n\n/**\n * Run a cascade statement against a *referencing* table, tolerating the\n * table (or an expected column) not existing in this database.\n *\n * The cascade plan is built from the in-process registry, which can carry a\n * class from any imported package — including one whose table this specific\n * database was never migrated to include (a partially adopted feature, a\n * package pulled in for its types, or, in a test process, a fixture some\n * other test file registered). A missing referencing table trivially has no\n * rows to act on, so the correct behaviour is identical to the table\n * existing and being empty — this must never abort an otherwise valid\n * delete. Any other failure (a real constraint violation, a lock timeout, a\n * genuine SQL error unrelated to the table's existence) still propagates.\n */\nasync function tolerateMissingTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (classifyDatabaseError(error).kind === 'undefined_object') {\n      logger.warn(\n        `Cascade delete skipped ${context.action} on '${context.table}': ` +\n          'table or column not found in this database.',\n        { error: error instanceof Error ? error.message : String(error) },\n      );\n      return fallback;\n    }\n    throw error;\n  }\n}\n\nasync function selectIds(\n  db: DatabaseInterface,\n  tableName: string,\n  column: string,\n  ids: string[],\n): Promise<string[]> {\n  const found: string[] = [];\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    const rows = await tolerateMissingTable(\n      () => db.list(tableName, idPredicate(column, batch)),\n      [] as Record<string, unknown>[],\n      { table: tableName, action: 'CASCADE select' },\n    );\n    for (const row of rows) {\n      const id = row?.id;\n      if (typeof id === 'string' && id.length > 0) found.push(id);\n    }\n  }\n  return found;\n}\n\nasync function deleteByIds(\n  db: DatabaseInterface,\n  tableName: string,\n  ids: string[],\n): Promise<void> {\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    await tolerateMissingTable(\n      () => db.delete(tableName, idPredicate('id', batch)),\n      undefined,\n      { table: tableName, action: 'CASCADE delete' },\n    );\n  }\n}\n\n/**\n * Remove the framework-managed side rows owned by the given object ids.\n *\n * `_smrt_contexts` and `_smrt_embeddings` are keyed by `(owner_class, owner_id)`\n * and `(object_class, object_id)` respectively. Matched by id *and* class\n * (review fix): id alone would let two unrelated classes using\n * `idType: 'text'` (non-UUID, not guaranteed globally unique) collide on a\n * shared id value and delete each other's memory/embeddings rows. `classNames`\n * is the STI-hierarchy-expanded candidate set from\n * {@link ownerClassCandidates} — the class column stores the *runtime*\n * constructor name, which for an STI hierarchy is a concrete subclass rather\n * than the class the cascade was planned from, so a single exact name is not\n * enough.\n *\n * A missing system table is not an error — an application database may predate\n * the table, and losing derived rows must never fail an otherwise valid delete.\n */\nasync function deleteSystemRows(\n  db: DatabaseInterface,\n  ids: string[],\n  classNames: string[],\n): Promise<void> {\n  const ownerIds = ids.filter(\n    (id) =>\n      typeof id === 'string' &&\n      id.length > 0 &&\n      id !== COLLECTION_OWNER_SENTINEL,\n  );\n  if (ownerIds.length === 0 || classNames.length === 0) return;\n\n  for (const [table, idColumn, classColumn] of [\n    [CONTEXTS_TABLE, 'owner_id', 'owner_class'],\n    [EMBEDDINGS_TABLE, 'object_id', 'object_class'],\n  ] as const) {\n    for (const batch of chunkArray(ownerIds, IN_LIST_CHUNK_SIZE)) {\n      try {\n        await db.delete(table, {\n          ...idPredicate(idColumn, batch),\n          ...idPredicate(classColumn, classNames),\n        });\n      } catch (error) {\n        logger.warn(\n          `Failed to clean ${table} rows during cascade delete: ${\n            error instanceof Error ? error.message : String(error)\n          }`,\n        );\n      }\n    }\n  }\n}\n\n/**\n * Resolve every reference pointing at `ids` of `className`, recursively.\n *\n * Does **not** delete the rows identified by `ids` — the caller owns that, so\n * `SmrtObject.delete()` keeps issuing its own final statement and its own\n * lifecycle hooks.\n */\nasync function resolveReferences(\n  ctx: CascadeContext,\n  className: string,\n  tableName: string,\n  ids: string[],\n  depth: number,\n): Promise<void> {\n  const pending = ids.filter((id) => {\n    const key = `${tableName}:${id}`;\n    if (ctx.visited.has(key)) return false;\n    ctx.visited.add(key);\n    return true;\n  });\n  if (pending.length === 0) return;\n\n  if (depth > MAX_CASCADE_DEPTH) {\n    throw DatabaseError.constraintViolation(\n      `cascade delete from ${className} exceeded the maximum depth of ` +\n        `${MAX_CASCADE_DEPTH}; check for a chain of onDelete: 'CASCADE' ` +\n        'references that never terminates',\n      className,\n    );\n  }\n\n  const plan = buildCascadePlan(ctx.registry, className);\n\n  // SQL NO ACTION is immediate on every supported SMRT migration path, so the\n  // app-side belt preflights it exactly like RESTRICT before any mutation.\n  for (const reference of plan.references) {\n    if (reference.action !== 'RESTRICT' && reference.action !== 'NO ACTION') {\n      continue;\n    }\n    let remaining = 0;\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      remaining += await tolerateMissingTable(\n        () =>\n          ctx.db.count(\n            reference.tableName,\n            idPredicate(reference.column, batch),\n          ),\n        0,\n        { table: reference.tableName, action: `${reference.action} check` },\n      );\n      if (remaining > 0) break;\n    }\n    if (remaining > 0) {\n      throw DatabaseError.constraintViolation(\n        `${reference.className}.${reference.fieldName} ` +\n          `${reference.declared ? 'declares' : 'resolves to'} onDelete: ` +\n          `'${reference.action}' and ${remaining} row(s) still reference this ` +\n          `${className}`,\n        reference.column,\n      );\n    }\n  }\n\n  for (const reference of plan.references) {\n    if (reference.action === 'SET NULL') {\n      for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n        await tolerateMissingTable(\n          () =>\n            ctx.db.update(\n              reference.tableName,\n              idPredicate(reference.column, batch),\n              { [reference.column]: null },\n            ),\n          undefined,\n          { table: reference.tableName, action: 'SET NULL' },\n        );\n      }\n      ctx.affectedTables.add(reference.tableName);\n      ctx.affectedTableClasses.set(\n        reference.tableName,\n        toQualifiedClassName(ctx.registry, reference.className),\n      );\n      continue;\n    }\n\n    if (reference.action !== 'CASCADE') continue;\n\n    const childIds = await selectIds(\n      ctx.db,\n      reference.tableName,\n      reference.column,\n      pending,\n    );\n    if (childIds.length === 0) continue;\n\n    await resolveReferences(\n      ctx,\n      reference.className,\n      reference.tableName,\n      childIds,\n      depth + 1,\n    );\n    await deleteSystemRows(\n      ctx.db,\n      childIds,\n      ownerClassCandidates(ctx.registry, reference.className),\n    );\n    await deleteByIds(ctx.db, reference.tableName, childIds);\n    ctx.affectedTables.add(reference.tableName);\n    ctx.affectedTableClasses.set(\n      reference.tableName,\n      toQualifiedClassName(ctx.registry, reference.className),\n    );\n  }\n\n  for (const association of plan.polymorphic) {\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      const where: Record<string, unknown> = {\n        ...idPredicate('meta_id', batch),\n      };\n      if (plan.metaTypes.length === 1) {\n        where.meta_type = plan.metaTypes[0];\n      } else {\n        where['meta_type in'] = plan.metaTypes;\n      }\n      const result = await tolerateMissingTable(\n        () => ctx.db.delete(association.tableName, where),\n        undefined,\n        {\n          table: association.tableName,\n          action: 'polymorphic association cleanup',\n        },\n      );\n      if ((result?.affected ?? 0) > 0) {\n        ctx.affectedTables.add(association.tableName);\n        ctx.affectedTableClasses.set(\n          association.tableName,\n          toQualifiedClassName(ctx.registry, association.className),\n        );\n      }\n    }\n  }\n}\n\n/** Outcome of a cascade run, returned so the caller can invalidate caches. */\nexport interface CascadeResult {\n  /** Tables whose rows were removed or nulled, excluding the target's own. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified class name that owns each entry in {@link affectedTables},\n   * where resolvable — lets the caller check *that* class's own\n   * cross-process cache config rather than only its own.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/**\n * Resolve every reference to `ids` of `className` and clean their framework\n * side rows, then hand control back so the caller can delete the rows.\n *\n * Callers are expected to run this on a transaction-bound `db` — see\n * {@link runCascadeDelete}, which owns that decision.\n */\nexport async function cascadeReferencesTo(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: { className: string; tableName: string; ids: string[] },\n): Promise<CascadeResult> {\n  const ctx: CascadeContext = {\n    db,\n    registry,\n    visited: new Set(),\n    affectedTables: new Set(),\n    affectedTableClasses: new Map(),\n  };\n  await resolveReferences(\n    ctx,\n    target.className,\n    target.tableName,\n    target.ids,\n    0,\n  );\n  await deleteSystemRows(\n    db,\n    target.ids,\n    ownerClassCandidates(registry, target.className),\n  );\n  return {\n    affectedTables: ctx.affectedTables,\n    affectedTableClasses: ctx.affectedTableClasses,\n  };\n}\n\ntype TransactionCapable = DatabaseInterface & {\n  transaction?: <T>(\n    this: DatabaseInterface,\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * Run the cascade and the target row's own deletion atomically.\n *\n * When anything references the class and the adapter exposes `transaction()`,\n * the whole sequence runs inside one — including the caller's `deleteSelf`\n * statement, so a failure part-way through cannot leave the object deleted with\n * its junction rows intact (or vice versa). Adapters without transaction\n * support run the same statements sequentially; this is the documented\n * degradation, not a silent one.\n *\n * When nothing references the class there is nothing to keep consistent, and\n * the transaction is skipped — see the comment on that branch.\n *\n * @param db - Database the object is bound to\n * @param registry - Registry view used to build cascade plans\n * @param target - Class, table and id of the object being deleted\n * @param deleteSelf - Issues the target row's own `DELETE`, on the tx-bound db\n * @returns Tables affected by the cascade, for read-cache invalidation\n */\nexport async function runCascadeDelete(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: {\n    className: string;\n    tableName: string;\n    /** An unsaved object has none; the cascade is then a no-op. */\n    id: string | null | undefined;\n  },\n  deleteSelf: (db: DatabaseInterface) => Promise<void>,\n): Promise<CascadeResult> {\n  const ids = target.id ? [target.id] : [];\n\n  // Nothing references this class AND no polymorphic association class is\n  // registered anywhere in the process. `plan.polymorphic` is unconditionally\n  // every registered `SmrtPolymorphicAssociation` subclass — a `metaType`\n  // column can point at any class at runtime, so there is no static metadata\n  // to scope it by, unlike a typed `@foreignKey`/`@crossPackageRef`. This\n  // branch is therefore common for a class with no incoming references in an\n  // app with no polymorphic associations at all, but rare — not \"the\n  // overwhelmingly common case\" — once even one polymorphic class exists\n  // anywhere in the process, since every delete's plan then carries it.\n  // Opening a transaction to wrap statements that cannot disagree with each\n  // other would cost two extra round trips, and on single-connection adapters\n  // it would serialize concurrent deletes behind the transaction queue. Order\n  // the two statements instead: the row goes first, so a failure leaves\n  // everything as it was, and the derived side rows follow under the\n  // best-effort contract they already carry.\n  if (buildCascadePlan(registry, target.className).isEmpty) {\n    await deleteSelf(db);\n    await deleteSystemRows(\n      db,\n      ids,\n      ownerClassCandidates(registry, target.className),\n    );\n    return { affectedTables: new Set(), affectedTableClasses: new Map() };\n  }\n\n  const run = async (bound: DatabaseInterface): Promise<CascadeResult> => {\n    const result = await cascadeReferencesTo(bound, registry, {\n      className: target.className,\n      tableName: target.tableName,\n      ids,\n    });\n    await deleteSelf(bound);\n    return result;\n  };\n\n  const transaction = (db as TransactionCapable).transaction;\n  if (typeof transaction !== 'function') {\n    return run(db);\n  }\n\n  return transaction.call<\n    DatabaseInterface,\n    [(tx: DatabaseInterface) => Promise<CascadeResult>],\n    Promise<CascadeResult>\n  >(db, run);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqFA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAY7C,IAAM,iBAAiB;;AAGvB,IAAM,mBAAmB;;;;;;AAOzB,IAAM,4BAA4B;;;;;;AAOlC,IAAM,oBAAoB;;;;;;;;AAgE1B,SAAgB,kBAAkB,OAA4C;CAC5E,OAAO,0BAA0B,KAAK;AACxC;AAEA,SAAS,8BAA8B,QAAuC;CAI5E,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM;AAC5E;;;;;;;;;;;;AAaA,SAAgB,iBACd,UACA,WACa;CAQb,MAAM,cAAc,IAAI,IAAI,SAAS,sBAAsB,SAAS,CAAC;CACrE,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG;EACnC,MAAM,YAAY,SAAS,SAAS,IAAI,CAAC,EAAE;EAC3C,IAAI,WAAW,YAAY,IAAI,SAAS;CAC1C;CAEA,MAAM,aAAiC,CAAC;CACxC,MAAM,cAA6C,CAAC;CAEpD,KAAK,MAAM,CAAC,aAAa,kBAAkB,SAAS,mBAAmB,GAAG;EACxE,MAAM,SAAS,SAAS,UAAU,WAAW;EAE7C,IAAI,8BAA8B,MAAM,GAAG;GACzC,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,WACF,YAAY,KAAK;IAAE,WAAW;IAAa;GAAU,CAAC;EAE1D;EAEA,IAAI,cAAc,WAAW,GAAG;EAEhC,IAAI;EAEJ,KAAK,MAAM,gBAAgB,eAAe;GACxC,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,mBAEtB;GAEF,IAAI,CAAC,YAAY,IAAI,aAAa,WAAW,GAAG;GAMhD,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,eAAe,OAErC;GAGF,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,CAAC,WAAW;GAEhB,MAAM,SAAS,YAAY,aAAa,SAAS;GACjD,IAAI,CAAC,iBACH,kBAAkB,IAAI,IAAI,SAAS,mBAAmB,WAAW,CAAC;GAgBpE,IADE,aAAa,SAAS,WAAW,oBAAoB,MAClC;GAErB,MAAM,EAAE,QAAQ,aAAa,8BAA8B;IACzD,UAAU,aAAa,SAAS;IAChC,kBAAkB,gBAAgB,IAAI,MAAM;IAC5C,iBAAiB;GACnB,CAAC;GAED,IACE,WAAW,cACX,OAAO,IAAI,aAAa,SAAS,CAAC,EAAE,UAIpC,MAAM,mBAAmB,qBACvB,GAAG,YAAY,GAAG,aAAa,UAAU,wBACzC,aAAa,WACb,4EACF;GAGF,WAAW,KAAK;IACd,WAAW;IACX;IACA,WAAW,aAAa;IACxB;IACA;IACA;GACF,CAAC;EACH;CACF;CAcA,MAAM,YAAsB,CAAC;CAC7B,MAAM,YAAY,SAAS,SAAS,SAAS,CAAC,EAAE;CAChD,IAAI,WAAW,UAAU,KAAK,SAAS;CACvC,MAAM,SAAS,SAAS,SAAS,SAAS,CAAC,EAAE,QAAQ;CACrD,IAAI,CAAC,UAAU,SAAS,MAAM,GAAG,UAAU,KAAK,MAAM;CAEtD,OAAO;EACL;EACA;EACA;EACA,SAAS,WAAW,WAAW,KAAK,YAAY,WAAW;CAC7D;AACF;;AAqBA,SAAS,qBACP,UACA,WACQ;CACR,OAAO,SAAS,SAAS,SAAS,CAAC,EAAE,iBAAiB;AACxD;;;;;;;;;;;;;;;;AAiBA,SAAS,qBACP,UACA,WACU;CACV,MAAM,UAAU,SAAS,WAAW,SAAS,KAAK;CAClD,MAAM,0BAAU,IAAI,IAAY;EAC9B;EACA;EACA,GAAG,SAAS,eAAe,OAAO;CACpC,CAAC;CAED,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,IAAI,MAAM;EAChB,MAAM,aAAa,SAAS,SAAS,MAAM;EAC3C,IAAI,YAAY,eAAe,MAAM,IAAI,WAAW,aAAa;EACjE,IAAI,YAAY,MAAM,MAAM,IAAI,WAAW,IAAI;CACjD;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;;;;;;AAQA,SAAS,YAAY,QAAgB,KAAwC;CAC3E,OAAO,IAAI,WAAW,IAAI,GAAG,SAAS,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,OAAO,IAAI;AAC3E;;;;;;;;;;;;;;;AAgBA,eAAe,qBACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,CAAC,CAAC,SAAS,oBAAoB;GAC5D,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,iDAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;GACA,OAAO;EACT;EACA,MAAM;CACR;AACF;AAEA,eAAe,UACb,IACA,WACA,QACA,KACmB;CACnB,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GAAG;EACvD,MAAM,OAAO,MAAM,2BACX,GAAG,KAAK,WAAW,YAAY,QAAQ,KAAK,CAAC,GACnD,CAAC,GACD;GAAE,OAAO;GAAW,QAAQ;EAAiB,CAC/C;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,KAAK,KAAK;GAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,MAAM,KAAK,EAAE;EAC5D;CACF;CACA,OAAO;AACT;AAEA,eAAe,YACb,IACA,WACA,KACe;CACf,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GACpD,MAAM,2BACE,GAAG,OAAO,WAAW,YAAY,MAAM,KAAK,CAAC,GACnD,KAAA,GACA;EAAE,OAAO;EAAW,QAAQ;CAAiB,CAC/C;AAEJ;;;;;;;;;;;;;;;;;;AAmBA,eAAe,iBACb,IACA,KACA,YACe;CACf,MAAM,WAAW,IAAI,QAClB,OACC,OAAO,OAAO,YACd,GAAG,SAAS,KACZ,OAAO,yBACX;CACA,IAAI,SAAS,WAAW,KAAK,WAAW,WAAW,GAAG;CAEtD,KAAK,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAC3C;EAAC;EAAgB;EAAY;CAAa,GAC1C;EAAC;EAAkB;EAAa;CAAc,CAChD,GACE,KAAK,MAAM,SAAS,WAAW,UAAA,GAA4B,GACzD,IAAI;EACF,MAAM,GAAG,OAAO,OAAO;GACrB,GAAG,YAAY,UAAU,KAAK;GAC9B,GAAG,YAAY,aAAa,UAAU;EACxC,CAAC;CACH,SAAS,OAAO;EACd,OAAO,KACL,mBAAmB,MAAM,+BACvB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAEzD;CACF;AAGN;;;;;;;;AASA,eAAe,kBACb,KACA,WACA,WACA,KACA,OACe;CACf,MAAM,UAAU,IAAI,QAAQ,OAAO;EACjC,MAAM,MAAM,GAAG,UAAU,GAAG;EAC5B,IAAI,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO;EACjC,IAAI,QAAQ,IAAI,GAAG;EACnB,OAAO;CACT,CAAC;CACD,IAAI,QAAQ,WAAW,GAAG;CAE1B,IAAI,QAAQ,mBACV,MAAM,cAAc,oBAClB,uBAAuB,UAAU,iCAC5B,kBAAkB,8EAEvB,SACF;CAGF,MAAM,OAAO,iBAAiB,IAAI,UAAU,SAAS;CAIrD,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,cAAc,UAAU,WAAW,aAC1D;EAEF,IAAI,YAAY;EAChB,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;GAC3D,aAAa,MAAM,2BAEf,IAAI,GAAG,MACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,CACrC,GACF,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ,GAAG,UAAU,OAAO;GAAQ,CACpE;GACA,IAAI,YAAY,GAAG;EACrB;EACA,IAAI,YAAY,GACd,MAAM,cAAc,oBAClB,GAAG,UAAU,UAAU,GAAG,UAAU,UAAU,GACzC,UAAU,WAAW,aAAa,cAAc,cAC/C,UAAU,OAAO,QAAQ,UAAU,+BACpC,aACL,UAAU,MACZ;CAEJ;CAEA,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,YAAY;GACnC,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GACxD,MAAM,2BAEF,IAAI,GAAG,OACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,GACnC,GAAG,UAAU,SAAS,KAAK,CAC7B,GACF,KAAA,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ;GAAW,CACnD;GAEF,IAAI,eAAe,IAAI,UAAU,SAAS;GAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;GACA;EACF;EAEA,IAAI,UAAU,WAAW,WAAW;EAEpC,MAAM,WAAW,MAAM,UACrB,IAAI,IACJ,UAAU,WACV,UAAU,QACV,OACF;EACA,IAAI,SAAS,WAAW,GAAG;EAE3B,MAAM,kBACJ,KACA,UAAU,WACV,UAAU,WACV,UACA,QAAQ,CACV;EACA,MAAM,iBACJ,IAAI,IACJ,UACA,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;EACA,MAAM,YAAY,IAAI,IAAI,UAAU,WAAW,QAAQ;EACvD,IAAI,eAAe,IAAI,UAAU,SAAS;EAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;CACF;CAEA,KAAK,MAAM,eAAe,KAAK,aAC7B,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;EAC3D,MAAM,QAAiC,EACrC,GAAG,YAAY,WAAW,KAAK,EACjC;EACA,IAAI,KAAK,UAAU,WAAW,GAC5B,MAAM,YAAY,KAAK,UAAU;OAEjC,MAAM,kBAAkB,KAAK;EAU/B,MAAK,MARgB,2BACb,IAAI,GAAG,OAAO,YAAY,WAAW,KAAK,GAChD,KAAA,GACA;GACE,OAAO,YAAY;GACnB,QAAQ;EACV,CACF,EAAA,EACa,YAAY,KAAK,GAAG;GAC/B,IAAI,eAAe,IAAI,YAAY,SAAS;GAC5C,IAAI,qBAAqB,IACvB,YAAY,WACZ,qBAAqB,IAAI,UAAU,YAAY,SAAS,CAC1D;EACF;CACF;AAEJ;;;;;;;;AAqBA,eAAsB,oBACpB,IACA,UACA,QACwB;CACxB,MAAM,MAAsB;EAC1B;EACA;EACA,yBAAS,IAAI,IAAI;EACjB,gCAAgB,IAAI,IAAI;EACxB,sCAAsB,IAAI,IAAI;CAChC;CACA,MAAM,kBACJ,KACA,OAAO,WACP,OAAO,WACP,OAAO,KACP,CACF;CACA,MAAM,iBACJ,IACA,OAAO,KACP,qBAAqB,UAAU,OAAO,SAAS,CACjD;CACA,OAAO;EACL,gBAAgB,IAAI;EACpB,sBAAsB,IAAI;CAC5B;AACF;;;;;;;;;;;;;;;;;;;;AA4BA,eAAsB,iBACpB,IACA,UACA,QAMA,YACwB;CACxB,MAAM,MAAM,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;CAiBvC,IAAI,iBAAiB,UAAU,OAAO,SAAS,CAAC,CAAC,SAAS;EACxD,MAAM,WAAW,EAAE;EACnB,MAAM,iBACJ,IACA,KACA,qBAAqB,UAAU,OAAO,SAAS,CACjD;EACA,OAAO;GAAE,gCAAgB,IAAI,IAAI;GAAG,sCAAsB,IAAI,IAAI;EAAE;CACtE;CAEA,MAAM,MAAM,OAAO,UAAqD;EACtE,MAAM,SAAS,MAAM,oBAAoB,OAAO,UAAU;GACxD,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB;EACF,CAAC;EACD,MAAM,WAAW,KAAK;EACtB,OAAO;CACT;CAEA,MAAM,cAAe,GAA0B;CAC/C,IAAI,OAAO,gBAAgB,YACzB,OAAO,IAAI,EAAE;CAGf,OAAO,YAAY,KAIjB,IAAI,GAAG;AACX"}
+{"version":3,"file":"cascade.js","names":[],"sources":["../src/cascade.ts"],"sourcesContent":["/**\n * App-side referential integrity for `SmrtObject.delete()` (#2371).\n *\n * Same-package `@foreignKey` fields now emit database constraints where the\n * engine can enforce the declared policy. Cross-package references and older\n * schemas still rely on this application-side path. Before this module,\n * `delete()` removed the object's own row and nothing else: junction rows,\n * polymorphic association rows, `_smrt_embeddings` and `_smrt_contexts` entries\n * were all left pointing at an id that no longer resolved, and\n * `@foreignKey(..., { onDelete })` was metadata nobody read.\n *\n * This module implements those semantics in the application layer. It mirrors\n * what a DB-level constraint would do, deliberately including the parts that\n * make it *unlike* a model-layer delete:\n *\n * - Cascaded rows are removed with set-based statements. Their `beforeDelete` /\n *   `afterDelete` hooks and interceptors do **not** run, and no change-feed\n *   tombstone is written for them — exactly as `ON DELETE CASCADE` behaves.\n *   Only the object `delete()` was called on runs the full lifecycle.\n * - Every delete runs inside a single transaction when the adapter exposes\n *   one, including cleanup of framework-owned context and embedding rows, so\n *   a partial cascade cannot survive a failure. A `metaType` column can point\n *   at any class at runtime, so a polymorphic association class is always\n *   plausibly relevant.\n *\n * ## Which references are followed\n *\n * A reference is any `@foreignKey` / `@crossPackageRef` field on a registered\n * class whose target resolves to the deleted object's class (or one of its\n * registered STI ancestors), plus the polymorphic `(metaType, metaId)` pair on\n * {@link SmrtPolymorphicAssociation} subclasses.\n *\n * The action comes from the field's declared `onDelete`. When it is not\n * declared, the default is derived from the referencing class's natural key:\n *\n * | Reference | Default when `onDelete` is absent |\n * |---|---|\n * | Column is part of the referencing class's `conflictColumns`, and is not a `@tenantId()` field | `CASCADE` |\n * | Polymorphic `(metaType, metaId)` association row | `CASCADE` |\n * | Ordinary same-package reference | `NO ACTION` (deletion is refused while references remain) |\n * | Every `@tenantId()` field | Excluded: tenant scope is not an ownership edge |\n *\n * The natural-key rule is what makes junction rows work without any\n * per-package annotation: a junction declares\n * `@smrt({ conflictColumns: ['content_id', 'asset_id', 'relationship'] })`, so\n * `content_id` identifies the row and the row cannot outlive the content it\n * links. An ordinary child (`Order.customerId`) is keyed by `(slug, context)`,\n * so it defaults to immediate `NO ACTION` unless it opts in with\n * `@foreignKey(Customer, { onDelete: 'CASCADE' })`.\n *\n * `@tenantId()` fields are excluded from the natural-key rule even though\n * `@happyvertical/smrt-tenancy` leads a tenant-scoped class's *default*\n * `conflictColumns` with the tenant column (#2360): the tenant column scopes\n * ownership, it does not identify the row the way a junction's foreign key\n * does, and it targets a class (`Tenant`) that is virtually always\n * referenced. Without this exclusion, deleting one `Tenant` row would\n * recursively CASCADE through every tenant-scoped table that has not\n * declared its own `conflictColumns` — the overwhelming majority. The field\n * is detected via the `__tenancy.isTenantIdField` marker `@tenantId()`\n * attaches to its own registration (`FieldMeta.__tenancy`, read structurally\n * so `smrt-core` never depends on `smrt-tenancy`). `@tenantId()` exposes no\n * `onDelete` option today, so this cannot currently be overridden per field.\n *\n * @see https://github.com/happyvertical/smrt/issues/2371\n * @module\n */\n\nimport { createLogger } from '@happyvertical/logger';\nimport type { DatabaseInterface } from '@happyvertical/sql';\nimport { classifyDatabaseError } from './db-errors.js';\nimport { ConfigurationError, DatabaseError } from './errors.js';\n// Type-only: erased at runtime, so it cannot re-enter the\n// `registry → object → cascade` import cycle.\nimport type { ObjectRegistry } from './registry.js';\nimport {\n  normalizeForeignKeyAction,\n  resolveForeignKeyDeleteAction,\n} from './schema/foreign-key-policy.js';\nimport type { ForeignKeyAction } from './schema/types.js';\nimport { chunkArray, IN_LIST_CHUNK_SIZE } from './utils/chunk.js';\nimport { toSnakeCase } from './utils/naming.js';\n\nconst logger = createLogger({ level: 'info' });\n\n/**\n * Referential action applied to rows pointing at a deleted object.\n *\n * Same vocabulary as SQL's `ON DELETE`, enforced by the framework before the\n * engine. `NO ACTION` is preflighted like an immediate restrictive action so\n * application-side and database-side enforcement agree.\n */\nexport type OnDeleteAction = ForeignKeyAction;\n\n/** Table holding framework-managed per-object memory entries. */\nconst CONTEXTS_TABLE = '_smrt_contexts';\n\n/** Table holding framework-managed per-object embedding vectors. */\nconst EMBEDDINGS_TABLE = '_smrt_embeddings';\n\n/**\n * Reserved `_smrt_contexts.owner_id` used by `SmrtCollection.remember()` for\n * collection-scoped memory. A real object id is a UUID and can never equal it,\n * but the guard keeps a malformed id from wiping every sibling's defaults.\n */\nconst COLLECTION_OWNER_SENTINEL = '__collection__';\n\n/**\n * Maximum number of cascade levels followed from the object `delete()` was\n * called on. A cycle between two classes that both declare `onDelete: 'CASCADE'`\n * is broken by the visited set; this bound catches unbounded *chains*.\n */\nconst MAX_CASCADE_DEPTH = 10;\n\n/** One reference that must be resolved before the target row can be removed. */\nexport interface CascadeReference {\n  /** Registered name of the class holding the referencing column. */\n  className: string;\n  /** Table holding the referencing rows. */\n  tableName: string;\n  /** Field name (camelCase) on the referencing class. */\n  fieldName: string;\n  /** Column (snake_case) holding the reference. */\n  column: string;\n  /** Resolved action. `NO ACTION` is preflighted like an immediate RESTRICT. */\n  action: OnDeleteAction;\n  /** `true` when the action was declared rather than derived from the key. */\n  declared: boolean;\n}\n\n/** A polymorphic association table that can point at any class. */\nexport interface CascadePolymorphicReference {\n  /** Registered name of the association class. */\n  className: string;\n  /** Table holding the association rows. */\n  tableName: string;\n}\n\n/** Everything that must happen before rows of one class can be deleted. */\nexport interface CascadePlan {\n  /** Typed `@foreignKey` / `@crossPackageRef` references, action-resolved. */\n  references: CascadeReference[];\n  /** Polymorphic association tables that may point at this class. */\n  polymorphic: CascadePolymorphicReference[];\n  /** `meta_type` values that identify this class in an association row. */\n  metaTypes: string[];\n  /** `true` when nothing references this class and nothing has to be visited. */\n  isEmpty: boolean;\n}\n\n/**\n * Read-only slice of `ObjectRegistry` this module needs.\n *\n * Taking it as a parameter — rather than importing the registry as a value —\n * keeps `cascade.ts` out of the `registry → object → cascade` import cycle,\n * and lets tests drive the planner from a hand-built registry.\n */\nexport type CascadeRegistryView = Pick<\n  typeof ObjectRegistry,\n  | 'getRelationshipMap'\n  | 'getFields'\n  | 'getConflictColumns'\n  | 'getTableName'\n  | 'getSelfReferableNames'\n  | 'getClass'\n  | 'getSTIBase'\n  | 'getDescendants'\n>;\n\n/**\n * Normalize a declared `onDelete` value.\n *\n * Accepts any casing and both `SET NULL` and `SET_NULL`, matching what the\n * schema generator has always carried in the manifest. Returns `undefined` for\n * an unset or unrecognized value so the caller can fall back to the default.\n */\nexport function normalizeOnDelete(value: unknown): OnDeleteAction | undefined {\n  return normalizeForeignKeyAction(value);\n}\n\nfunction isPolymorphicAssociationClass(fields: Map<string, unknown>): boolean {\n  // The three columns `SmrtPolymorphicAssociation` contributes. Requiring all\n  // of them keeps an unrelated class that happens to carry a `metaType` from\n  // being treated as an association table.\n  return fields.has('metaType') && fields.has('metaId') && fields.has('role');\n}\n\n/**\n * Build the cascade plan for one class.\n *\n * The plan is derived entirely from registry metadata, so it is valid for any\n * database the class is used against. It is rebuilt per delete rather than\n * cached: registration is incremental (manifests load lazily, tests register\n * classes between cases) and a stale plan would silently skip a table.\n *\n * @param registry - Registry view (`ObjectRegistry` satisfies it)\n * @param className - Class whose incoming references should be resolved\n */\nexport function buildCascadePlan(\n  registry: CascadeRegistryView,\n  className: string,\n): CascadePlan {\n  // `className` is normally already qualified (delete() passes\n  // getResolvedQualifiedName()), but a common same-package `@foreignKey('X')`\n  // still stores its target as the bare simple name `X`. That still matches:\n  // getSelfReferableNames() walks the full ancestor chain (self included) and\n  // adds each ancestor's *simple* name via `getClass(ancestor)?.name`, so the\n  // simple form is already in the seed set below, not just the loop's\n  // qualified-variant augmentation.\n  const targetNames = new Set(registry.getSelfReferableNames(className));\n  for (const name of [...targetNames]) {\n    const qualified = registry.getClass(name)?.qualifiedName;\n    if (qualified) targetNames.add(qualified);\n  }\n\n  const references: CascadeReference[] = [];\n  const polymorphic: CascadePolymorphicReference[] = [];\n\n  for (const [sourceClass, relationships] of registry.getRelationshipMap()) {\n    const fields = registry.getFields(sourceClass);\n\n    if (isPolymorphicAssociationClass(fields)) {\n      const tableName = registry.getTableName(sourceClass);\n      if (tableName) {\n        polymorphic.push({ className: sourceClass, tableName });\n      }\n    }\n\n    if (relationships.length === 0) continue;\n\n    let conflictColumns: Set<string> | undefined;\n\n    for (const relationship of relationships) {\n      if (\n        relationship.type !== 'foreignKey' &&\n        relationship.type !== 'crossPackageRef'\n      ) {\n        continue;\n      }\n      if (!targetNames.has(relationship.targetClass)) continue;\n\n      // An explicit app-side-only relationship is archival metadata, not a\n      // referential-integrity rule. Its identifier is deliberately allowed to\n      // outlive the parent, so delete planning must not block, null, or remove\n      // the retained row (#2413).\n      if (\n        relationship.type === 'foreignKey' &&\n        relationship.options?.constraint === false\n      ) {\n        continue;\n      }\n\n      const tableName = registry.getTableName(sourceClass);\n      if (!tableName) continue;\n\n      const column = toSnakeCase(relationship.fieldName);\n      if (!conflictColumns) {\n        conflictColumns = new Set(registry.getConflictColumns(sourceClass));\n      }\n\n      // A `@tenantId()` field is a structural scoping marker, not a\n      // junction/ownership key — it lands in `conflictColumns` only because\n      // #2360 leads every tenant-scoped class's *default* natural key with\n      // the tenant column, not because the referencing row is *identified*\n      // by its tenant the way a junction row is identified by its parent.\n      // Without this guard, deleting a `Tenant` would silently CASCADE\n      // through the tenant column of every tenant-scoped class in the\n      // schema that has not declared its own `conflictColumns` — the\n      // overwhelming majority. `@tenantId()` exposes no `onDelete` today, so\n      // an explicit declaration can never widen this back to CASCADE; that\n      // is deliberate until tenant-delete cascade is an explicit decision.\n      const isTenantIdField =\n        relationship.options?.__tenancy?.isTenantIdField === true;\n      if (isTenantIdField) continue;\n\n      const { action, declared } = resolveForeignKeyDeleteAction({\n        declared: relationship.options?.onDelete,\n        isConflictColumn: conflictColumns.has(column),\n        isTenantIdField: false,\n      });\n\n      if (\n        action === 'SET NULL' &&\n        fields.get(relationship.fieldName)?.required\n      ) {\n        // Fail on the declaration, not later on a NOT NULL violation from the\n        // engine — the message there names a column, not the decorator.\n        throw ConfigurationError.invalidConfiguration(\n          `${sourceClass}.${relationship.fieldName} onDelete: 'SET NULL'`,\n          relationship.fieldName,\n          \"a nullable field (mark it `nullable: true`, or use 'CASCADE' / 'RESTRICT')\",\n        );\n      }\n\n      references.push({\n        className: sourceClass,\n        tableName,\n        fieldName: relationship.fieldName,\n        column,\n        action,\n        declared,\n      });\n    }\n  }\n\n  // Both forms are matched deliberately: an association row written before a\n  // class was package-qualified still carries the simple `meta_type`. The\n  // qualified form alone is unambiguous; the simple-name fallback can still\n  // match a same-simple-name sibling class's row if it also shares a\n  // `meta_id` — a real, not just theoretical, risk for a class declaring\n  // `idType: 'text'` (non-UUID, not guaranteed globally unique), the same gap\n  // `deleteSystemRows()` closed for `_smrt_contexts` / `_smrt_embeddings`\n  // (review fix) by adding a class-name filter. Closing it here needs the\n  // same STI-and-legacy-name-aware filter this module already builds for\n  // `deleteSystemRows()` narrowed further to registry-unambiguous simple\n  // names; tracked under #2419 alongside the other same-simple-name\n  // collision gaps rather than reworked here.\n  const metaTypes: string[] = [];\n  const qualified = registry.getClass(className)?.qualifiedName;\n  if (qualified) metaTypes.push(qualified);\n  const simple = registry.getClass(className)?.name ?? className;\n  if (!metaTypes.includes(simple)) metaTypes.push(simple);\n\n  return {\n    references,\n    polymorphic,\n    metaTypes,\n    isEmpty: references.length === 0 && polymorphic.length === 0,\n  };\n}\n\n/** Per-delete state shared by every level of the cascade. */\ninterface CascadeContext {\n  db: DatabaseInterface;\n  registry: CascadeRegistryView;\n  /** `table:id` pairs already expanded, so a reference cycle terminates. */\n  visited: Set<string>;\n  /** Tables touched by the cascade, for read-cache invalidation. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified name of the class that owns each affected table, so the\n   * caller can resolve *that* class's own `@smrt({ cache })` config —\n   * cross-process cache invalidation is a per-class opt-in, and a table\n   * cascaded into belongs to a different class than the one `delete()` was\n   * called on.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/** Resolve a registry-recorded class name to its qualified form, when known. */\nfunction toQualifiedClassName(\n  registry: CascadeRegistryView,\n  className: string,\n): string {\n  return registry.getClass(className)?.qualifiedName ?? className;\n}\n\n/**\n * Every value `_smrt_contexts.owner_class` / `_smrt_embeddings.object_class`\n * could plausibly hold for a row belonging to an id of `className` (review\n * fix): both name forms (qualified + simple — older rows predate package\n * qualification) of `className` itself, plus every other member of its STI\n * hierarchy sharing its table. A CASCADE-collected id can belong to any\n * concrete STI subclass of the declaring reference, which stamps its own\n * (more specific) runtime class name at write time, not the reference's.\n *\n * Narrowing by this set — instead of matching by id alone — closes a\n * cross-class collision: two unrelated classes using `idType: 'text'`\n * (non-UUID, not guaranteed globally unique) could otherwise share an id\n * value and have one's `remember()`/embeddings rows deleted by the other's\n * cascade.\n */\nfunction ownerClassCandidates(\n  registry: CascadeRegistryView,\n  className: string,\n): string[] {\n  const stiBase = registry.getSTIBase(className) ?? className;\n  const members = new Set<string>([\n    className,\n    stiBase,\n    ...registry.getDescendants(stiBase),\n  ]);\n\n  const names = new Set<string>();\n  for (const member of members) {\n    names.add(member);\n    const registered = registry.getClass(member);\n    if (registered?.qualifiedName) names.add(registered.qualifiedName);\n    if (registered?.name) names.add(registered.name);\n  }\n  return [...names];\n}\n\n/**\n * Build the `where` clause matching `column` against one or more ids.\n *\n * A single id uses equality so the planner can use a plain index; multiple ids\n * use the adapter's `in` operator.\n */\nfunction idPredicate(column: string, ids: string[]): Record<string, unknown> {\n  return ids.length === 1 ? { [column]: ids[0] } : { [`${column} in`]: ids };\n}\n\n/**\n * Run a cascade statement against a *referencing* table, tolerating the\n * table (or an expected column) not existing in this database.\n *\n * The cascade plan is built from the in-process registry, which can carry a\n * class from any imported package — including one whose table this specific\n * database was never migrated to include (a partially adopted feature, a\n * package pulled in for its types, or, in a test process, a fixture some\n * other test file registered). A missing referencing table trivially has no\n * rows to act on, so the correct behaviour is identical to the table\n * existing and being empty — this must never abort an otherwise valid\n * delete. Any other failure (a real constraint violation, a lock timeout, a\n * genuine SQL error unrelated to the table's existence) still propagates.\n */\nasync function tolerateMissingTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (classifyDatabaseError(error).kind === 'undefined_object') {\n      logger.warn(\n        `Cascade delete skipped ${context.action} on '${context.table}': ` +\n          'table or column not found in this database.',\n        { error: error instanceof Error ? error.message : String(error) },\n      );\n      return fallback;\n    }\n    throw error;\n  }\n}\n\n/**\n * System-table cleanup may ignore an absent table for databases created before\n * that subsystem existed, but never a missing column in a table that does\n * exist. The shared `undefined_object` classification intentionally combines\n * both cases, so this security boundary must retain the narrower driver signal.\n */\nfunction normalizeMissingTableName(value: string): string {\n  const unquoted = value.replace(/[\"'`[\\]]/g, '');\n  return (unquoted.split('.').at(-1) ?? unquoted)\n    .replace(/[^A-Za-z0-9_$-]/g, '')\n    .toLowerCase();\n}\n\nfunction missingTableNames(messages: readonly string[]): string[] {\n  const names: string[] = [];\n  const patterns = [\n    /no such table:\\s*([^\\s,;]+)/giu,\n    /(?:relation|table)\\s+((?:\"[^\"]+\"(?:\\.\"[^\"]+\")*)|(?:[A-Za-z0-9_.$-]+))\\s+does not exist/giu,\n    /table with name\\s+((?:\"[^\"]+\")|(?:[A-Za-z0-9_.$-]+))\\s+does not exist/giu,\n  ];\n  for (const message of messages) {\n    for (const pattern of patterns) {\n      for (const match of message.matchAll(pattern)) {\n        if (match[1]) names.push(normalizeMissingTableName(match[1]));\n      }\n    }\n  }\n  return names;\n}\n\nfunction isMissingTableError(error: unknown, expectedTable: string): boolean {\n  const classification = classifyDatabaseError(error);\n  if (classification.kind !== 'undefined_object') return false;\n  if (\n    classification.sqlstate === '42703' ||\n    classification.driverCode === '42703' ||\n    classification.driverCodes.includes('42703')\n  ) {\n    return false;\n  }\n  const names = missingTableNames(classification.driverMessages);\n  const expected = normalizeMissingTableName(expectedTable);\n  return (\n    names.length > 0 &&\n    names.every((missingTableName) => missingTableName === expected)\n  );\n}\n\nasync function tolerateMissingSystemTable<T>(\n  operation: () => Promise<T>,\n  fallback: T,\n  context: { table: string; action: string },\n): Promise<T> {\n  try {\n    return await operation();\n  } catch (error) {\n    if (!isMissingTableError(error, context.table)) throw error;\n    logger.warn(\n      `Cascade delete skipped ${context.action} on '${context.table}': ` +\n        'table not found in this database.',\n      { error: error instanceof Error ? error.message : String(error) },\n    );\n    return fallback;\n  }\n}\n\nasync function selectIds(\n  db: DatabaseInterface,\n  tableName: string,\n  column: string,\n  ids: string[],\n): Promise<string[]> {\n  const found: string[] = [];\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    const rows = await tolerateMissingTable(\n      () => db.list(tableName, idPredicate(column, batch)),\n      [] as Record<string, unknown>[],\n      { table: tableName, action: 'CASCADE select' },\n    );\n    for (const row of rows) {\n      const id = row?.id;\n      if (typeof id === 'string' && id.length > 0) found.push(id);\n    }\n  }\n  return found;\n}\n\nasync function deleteByIds(\n  db: DatabaseInterface,\n  tableName: string,\n  ids: string[],\n): Promise<void> {\n  for (const batch of chunkArray(ids, IN_LIST_CHUNK_SIZE)) {\n    await tolerateMissingTable(\n      () => db.delete(tableName, idPredicate('id', batch)),\n      undefined,\n      { table: tableName, action: 'CASCADE delete' },\n    );\n  }\n}\n\n/**\n * Remove the framework-managed side rows owned by the given object ids.\n *\n * `_smrt_contexts` and `_smrt_embeddings` are keyed by `(owner_class, owner_id)`\n * and `(object_class, object_id)` respectively. Matched by id *and* class\n * (review fix): id alone would let two unrelated classes using\n * `idType: 'text'` (non-UUID, not guaranteed globally unique) collide on a\n * shared id value and delete each other's memory/embeddings rows. `classNames`\n * is the STI-hierarchy-expanded candidate set from\n * {@link ownerClassCandidates} — the class column stores the *runtime*\n * constructor name, which for an STI hierarchy is a concrete subclass rather\n * than the class the cascade was planned from, so a single exact name is not\n * enough.\n *\n * A missing system table is not an error — an application database may predate\n * the table. Every other cleanup failure propagates so the surrounding delete\n * transaction rolls back rather than orphaning tenant-sensitive recall data.\n */\nasync function deleteSystemRows(\n  db: DatabaseInterface,\n  ids: string[],\n  classNames: string[],\n): Promise<void> {\n  const ownerIds = ids.filter(\n    (id) =>\n      typeof id === 'string' &&\n      id.length > 0 &&\n      id !== COLLECTION_OWNER_SENTINEL,\n  );\n  if (ownerIds.length === 0 || classNames.length === 0) return;\n\n  for (const [table, idColumn, classColumn] of [\n    [CONTEXTS_TABLE, 'owner_id', 'owner_class'],\n    [EMBEDDINGS_TABLE, 'object_id', 'object_class'],\n  ] as const) {\n    for (const batch of chunkArray(ownerIds, IN_LIST_CHUNK_SIZE)) {\n      await tolerateMissingSystemTable(\n        () =>\n          db.delete(table, {\n            ...idPredicate(idColumn, batch),\n            ...idPredicate(classColumn, classNames),\n          }),\n        undefined,\n        { table, action: 'framework-owned row cleanup' },\n      );\n    }\n  }\n}\n\n/**\n * Resolve every reference pointing at `ids` of `className`, recursively.\n *\n * Does **not** delete the rows identified by `ids` — the caller owns that, so\n * `SmrtObject.delete()` keeps issuing its own final statement and its own\n * lifecycle hooks.\n */\nasync function resolveReferences(\n  ctx: CascadeContext,\n  className: string,\n  tableName: string,\n  ids: string[],\n  depth: number,\n): Promise<void> {\n  const pending = ids.filter((id) => {\n    const key = `${tableName}:${id}`;\n    if (ctx.visited.has(key)) return false;\n    ctx.visited.add(key);\n    return true;\n  });\n  if (pending.length === 0) return;\n\n  if (depth > MAX_CASCADE_DEPTH) {\n    throw DatabaseError.constraintViolation(\n      `cascade delete from ${className} exceeded the maximum depth of ` +\n        `${MAX_CASCADE_DEPTH}; check for a chain of onDelete: 'CASCADE' ` +\n        'references that never terminates',\n      className,\n    );\n  }\n\n  const plan = buildCascadePlan(ctx.registry, className);\n\n  // SQL NO ACTION is immediate on every supported SMRT migration path, so the\n  // app-side belt preflights it exactly like RESTRICT before any mutation.\n  for (const reference of plan.references) {\n    if (reference.action !== 'RESTRICT' && reference.action !== 'NO ACTION') {\n      continue;\n    }\n    let remaining = 0;\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      remaining += await tolerateMissingTable(\n        () =>\n          ctx.db.count(\n            reference.tableName,\n            idPredicate(reference.column, batch),\n          ),\n        0,\n        { table: reference.tableName, action: `${reference.action} check` },\n      );\n      if (remaining > 0) break;\n    }\n    if (remaining > 0) {\n      throw DatabaseError.constraintViolation(\n        `${reference.className}.${reference.fieldName} ` +\n          `${reference.declared ? 'declares' : 'resolves to'} onDelete: ` +\n          `'${reference.action}' and ${remaining} row(s) still reference this ` +\n          `${className}`,\n        reference.column,\n      );\n    }\n  }\n\n  for (const reference of plan.references) {\n    if (reference.action === 'SET NULL') {\n      for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n        await tolerateMissingTable(\n          () =>\n            ctx.db.update(\n              reference.tableName,\n              idPredicate(reference.column, batch),\n              { [reference.column]: null },\n            ),\n          undefined,\n          { table: reference.tableName, action: 'SET NULL' },\n        );\n      }\n      ctx.affectedTables.add(reference.tableName);\n      ctx.affectedTableClasses.set(\n        reference.tableName,\n        toQualifiedClassName(ctx.registry, reference.className),\n      );\n      continue;\n    }\n\n    if (reference.action !== 'CASCADE') continue;\n\n    const childIds = await selectIds(\n      ctx.db,\n      reference.tableName,\n      reference.column,\n      pending,\n    );\n    if (childIds.length === 0) continue;\n\n    await resolveReferences(\n      ctx,\n      reference.className,\n      reference.tableName,\n      childIds,\n      depth + 1,\n    );\n    await deleteSystemRows(\n      ctx.db,\n      childIds,\n      ownerClassCandidates(ctx.registry, reference.className),\n    );\n    await deleteByIds(ctx.db, reference.tableName, childIds);\n    ctx.affectedTables.add(reference.tableName);\n    ctx.affectedTableClasses.set(\n      reference.tableName,\n      toQualifiedClassName(ctx.registry, reference.className),\n    );\n  }\n\n  for (const association of plan.polymorphic) {\n    for (const batch of chunkArray(pending, IN_LIST_CHUNK_SIZE)) {\n      const where: Record<string, unknown> = {\n        ...idPredicate('meta_id', batch),\n      };\n      if (plan.metaTypes.length === 1) {\n        where.meta_type = plan.metaTypes[0];\n      } else {\n        where['meta_type in'] = plan.metaTypes;\n      }\n      const result = await tolerateMissingTable(\n        () => ctx.db.delete(association.tableName, where),\n        undefined,\n        {\n          table: association.tableName,\n          action: 'polymorphic association cleanup',\n        },\n      );\n      if ((result?.affected ?? 0) > 0) {\n        ctx.affectedTables.add(association.tableName);\n        ctx.affectedTableClasses.set(\n          association.tableName,\n          toQualifiedClassName(ctx.registry, association.className),\n        );\n      }\n    }\n  }\n}\n\n/** Outcome of a cascade run, returned so the caller can invalidate caches. */\nexport interface CascadeResult {\n  /** Tables whose rows were removed or nulled, excluding the target's own. */\n  affectedTables: Set<string>;\n  /**\n   * Qualified class name that owns each entry in {@link affectedTables},\n   * where resolvable — lets the caller check *that* class's own\n   * cross-process cache config rather than only its own.\n   */\n  affectedTableClasses: Map<string, string>;\n}\n\n/**\n * Resolve every reference to `ids` of `className` and clean their framework\n * side rows, then hand control back so the caller can delete the rows.\n *\n * Callers are expected to run this on a transaction-bound `db` — see\n * {@link runCascadeDelete}, which owns that decision.\n */\nexport async function cascadeReferencesTo(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: { className: string; tableName: string; ids: string[] },\n): Promise<CascadeResult> {\n  const ctx: CascadeContext = {\n    db,\n    registry,\n    visited: new Set(),\n    affectedTables: new Set(),\n    affectedTableClasses: new Map(),\n  };\n  await resolveReferences(\n    ctx,\n    target.className,\n    target.tableName,\n    target.ids,\n    0,\n  );\n  await deleteSystemRows(\n    db,\n    target.ids,\n    ownerClassCandidates(registry, target.className),\n  );\n  return {\n    affectedTables: ctx.affectedTables,\n    affectedTableClasses: ctx.affectedTableClasses,\n  };\n}\n\ntype TransactionCapable = DatabaseInterface & {\n  transaction?: <T>(\n    this: DatabaseInterface,\n    callback: (tx: DatabaseInterface) => Promise<T>,\n  ) => Promise<T>;\n};\n\n/**\n * Run the cascade and the target row's own deletion atomically.\n *\n * When the adapter exposes `transaction()`, the whole sequence runs inside one\n * — including framework-owned row cleanup and the caller's `deleteSelf`\n * statement, so a failure part-way through cannot leave either side orphaned.\n * Adapters without transaction support run the same statements sequentially;\n * this is the documented degradation, not a silent one.\n *\n * @param db - Database the object is bound to\n * @param registry - Registry view used to build cascade plans\n * @param target - Class, table and id of the object being deleted\n * @param deleteSelf - Issues the target row's own `DELETE`, on the tx-bound db\n * @returns Tables affected by the cascade, for read-cache invalidation\n */\nexport async function runCascadeDelete(\n  db: DatabaseInterface,\n  registry: CascadeRegistryView,\n  target: {\n    className: string;\n    tableName: string;\n    /** An unsaved object has none; the cascade is then a no-op. */\n    id: string | null | undefined;\n  },\n  deleteSelf: (db: DatabaseInterface) => Promise<void>,\n): Promise<CascadeResult> {\n  const ids = target.id ? [target.id] : [];\n\n  // Nothing references this class AND no polymorphic association class is\n  // registered anywhere in the process. `plan.polymorphic` is unconditionally\n  // every registered `SmrtPolymorphicAssociation` subclass — a `metaType`\n  // column can point at any class at runtime, so there is no static metadata\n  // to scope it by, unlike a typed `@foreignKey`/`@crossPackageRef`. This\n  // branch is therefore common for a class with no incoming references in an\n  // app with no polymorphic associations at all, but rare — not \"the\n  // overwhelmingly common case\" — once even one polymorphic class exists\n  // anywhere in the process, since every delete's plan then carries it.\n  // Framework-owned context and embedding rows still need atomic cleanup even\n  // when the registry has no typed or polymorphic references for this class.\n  if (buildCascadePlan(registry, target.className).isEmpty) {\n    const runWithoutReferences = async (\n      bound: DatabaseInterface,\n    ): Promise<CascadeResult> => {\n      await deleteSystemRows(\n        bound,\n        ids,\n        ownerClassCandidates(registry, target.className),\n      );\n      await deleteSelf(bound);\n      return { affectedTables: new Set(), affectedTableClasses: new Map() };\n    };\n    const transaction = (db as TransactionCapable).transaction;\n    if (typeof transaction !== 'function') return runWithoutReferences(db);\n    return transaction.call<\n      DatabaseInterface,\n      [(tx: DatabaseInterface) => Promise<CascadeResult>],\n      Promise<CascadeResult>\n    >(db, runWithoutReferences);\n  }\n\n  const run = async (bound: DatabaseInterface): Promise<CascadeResult> => {\n    const result = await cascadeReferencesTo(bound, registry, {\n      className: target.className,\n      tableName: target.tableName,\n      ids,\n    });\n    await deleteSelf(bound);\n    return result;\n  };\n\n  const transaction = (db as TransactionCapable).transaction;\n  if (typeof transaction !== 'function') {\n    return run(db);\n  }\n\n  return transaction.call<\n    DatabaseInterface,\n    [(tx: DatabaseInterface) => Promise<CascadeResult>],\n    Promise<CascadeResult>\n  >(db, run);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkFA,IAAM,SAAS,aAAa,EAAE,OAAO,OAAO,CAAC;;AAY7C,IAAM,iBAAiB;;AAGvB,IAAM,mBAAmB;;;;;;AAOzB,IAAM,4BAA4B;;;;;;AAOlC,IAAM,oBAAoB;;;;;;;;AAgE1B,SAAgB,kBAAkB,OAA4C;CAC5E,OAAO,0BAA0B,KAAK;AACxC;AAEA,SAAS,8BAA8B,QAAuC;CAI5E,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,OAAO,IAAI,MAAM;AAC5E;;;;;;;;;;;;AAaA,SAAgB,iBACd,UACA,WACa;CAQb,MAAM,cAAc,IAAI,IAAI,SAAS,sBAAsB,SAAS,CAAC;CACrE,KAAK,MAAM,QAAQ,CAAC,GAAG,WAAW,GAAG;EACnC,MAAM,YAAY,SAAS,SAAS,IAAI,CAAC,EAAE;EAC3C,IAAI,WAAW,YAAY,IAAI,SAAS;CAC1C;CAEA,MAAM,aAAiC,CAAC;CACxC,MAAM,cAA6C,CAAC;CAEpD,KAAK,MAAM,CAAC,aAAa,kBAAkB,SAAS,mBAAmB,GAAG;EACxE,MAAM,SAAS,SAAS,UAAU,WAAW;EAE7C,IAAI,8BAA8B,MAAM,GAAG;GACzC,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,WACF,YAAY,KAAK;IAAE,WAAW;IAAa;GAAU,CAAC;EAE1D;EAEA,IAAI,cAAc,WAAW,GAAG;EAEhC,IAAI;EAEJ,KAAK,MAAM,gBAAgB,eAAe;GACxC,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,mBAEtB;GAEF,IAAI,CAAC,YAAY,IAAI,aAAa,WAAW,GAAG;GAMhD,IACE,aAAa,SAAS,gBACtB,aAAa,SAAS,eAAe,OAErC;GAGF,MAAM,YAAY,SAAS,aAAa,WAAW;GACnD,IAAI,CAAC,WAAW;GAEhB,MAAM,SAAS,YAAY,aAAa,SAAS;GACjD,IAAI,CAAC,iBACH,kBAAkB,IAAI,IAAI,SAAS,mBAAmB,WAAW,CAAC;GAgBpE,IADE,aAAa,SAAS,WAAW,oBAAoB,MAClC;GAErB,MAAM,EAAE,QAAQ,aAAa,8BAA8B;IACzD,UAAU,aAAa,SAAS;IAChC,kBAAkB,gBAAgB,IAAI,MAAM;IAC5C,iBAAiB;GACnB,CAAC;GAED,IACE,WAAW,cACX,OAAO,IAAI,aAAa,SAAS,CAAC,EAAE,UAIpC,MAAM,mBAAmB,qBACvB,GAAG,YAAY,GAAG,aAAa,UAAU,wBACzC,aAAa,WACb,4EACF;GAGF,WAAW,KAAK;IACd,WAAW;IACX;IACA,WAAW,aAAa;IACxB;IACA;IACA;GACF,CAAC;EACH;CACF;CAcA,MAAM,YAAsB,CAAC;CAC7B,MAAM,YAAY,SAAS,SAAS,SAAS,CAAC,EAAE;CAChD,IAAI,WAAW,UAAU,KAAK,SAAS;CACvC,MAAM,SAAS,SAAS,SAAS,SAAS,CAAC,EAAE,QAAQ;CACrD,IAAI,CAAC,UAAU,SAAS,MAAM,GAAG,UAAU,KAAK,MAAM;CAEtD,OAAO;EACL;EACA;EACA;EACA,SAAS,WAAW,WAAW,KAAK,YAAY,WAAW;CAC7D;AACF;;AAqBA,SAAS,qBACP,UACA,WACQ;CACR,OAAO,SAAS,SAAS,SAAS,CAAC,EAAE,iBAAiB;AACxD;;;;;;;;;;;;;;;;AAiBA,SAAS,qBACP,UACA,WACU;CACV,MAAM,UAAU,SAAS,WAAW,SAAS,KAAK;CAClD,MAAM,0BAAU,IAAI,IAAY;EAC9B;EACA;EACA,GAAG,SAAS,eAAe,OAAO;CACpC,CAAC;CAED,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,UAAU,SAAS;EAC5B,MAAM,IAAI,MAAM;EAChB,MAAM,aAAa,SAAS,SAAS,MAAM;EAC3C,IAAI,YAAY,eAAe,MAAM,IAAI,WAAW,aAAa;EACjE,IAAI,YAAY,MAAM,MAAM,IAAI,WAAW,IAAI;CACjD;CACA,OAAO,CAAC,GAAG,KAAK;AAClB;;;;;;;AAQA,SAAS,YAAY,QAAgB,KAAwC;CAC3E,OAAO,IAAI,WAAW,IAAI,GAAG,SAAS,IAAI,GAAG,IAAI,GAAG,GAAG,OAAO,OAAO,IAAI;AAC3E;;;;;;;;;;;;;;;AAgBA,eAAe,qBACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,sBAAsB,KAAK,CAAC,CAAC,SAAS,oBAAoB;GAC5D,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,iDAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;GACA,OAAO;EACT;EACA,MAAM;CACR;AACF;;;;;;;AAQA,SAAS,0BAA0B,OAAuB;CACxD,MAAM,WAAW,MAAM,QAAQ,aAAa,EAAE;CAC9C,QAAQ,SAAS,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,KAAK,SAAA,CACnC,QAAQ,oBAAoB,EAAE,CAAC,CAC/B,YAAY;AACjB;AAEA,SAAS,kBAAkB,UAAuC;CAChE,MAAM,QAAkB,CAAC;CACzB,MAAM,WAAW;EACf;EACA;EACA;CACF;CACA,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,WAAW,UACpB,KAAK,MAAM,SAAS,QAAQ,SAAS,OAAO,GAC1C,IAAI,MAAM,IAAI,MAAM,KAAK,0BAA0B,MAAM,EAAE,CAAC;CAIlE,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAgB,eAAgC;CAC3E,MAAM,iBAAiB,sBAAsB,KAAK;CAClD,IAAI,eAAe,SAAS,oBAAoB,OAAO;CACvD,IACE,eAAe,aAAa,WAC5B,eAAe,eAAe,WAC9B,eAAe,YAAY,SAAS,OAAO,GAE3C,OAAO;CAET,MAAM,QAAQ,kBAAkB,eAAe,cAAc;CAC7D,MAAM,WAAW,0BAA0B,aAAa;CACxD,OACE,MAAM,SAAS,KACf,MAAM,OAAO,qBAAqB,qBAAqB,QAAQ;AAEnE;AAEA,eAAe,2BACb,WACA,UACA,SACY;CACZ,IAAI;EACF,OAAO,MAAM,UAAU;CACzB,SAAS,OAAO;EACd,IAAI,CAAC,oBAAoB,OAAO,QAAQ,KAAK,GAAG,MAAM;EACtD,OAAO,KACL,0BAA0B,QAAQ,OAAO,OAAO,QAAQ,MAAM,uCAE9D,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,CAClE;EACA,OAAO;CACT;AACF;AAEA,eAAe,UACb,IACA,WACA,QACA,KACmB;CACnB,MAAM,QAAkB,CAAC;CACzB,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GAAG;EACvD,MAAM,OAAO,MAAM,2BACX,GAAG,KAAK,WAAW,YAAY,QAAQ,KAAK,CAAC,GACnD,CAAC,GACD;GAAE,OAAO;GAAW,QAAQ;EAAiB,CAC/C;EACA,KAAK,MAAM,OAAO,MAAM;GACtB,MAAM,KAAK,KAAK;GAChB,IAAI,OAAO,OAAO,YAAY,GAAG,SAAS,GAAG,MAAM,KAAK,EAAE;EAC5D;CACF;CACA,OAAO;AACT;AAEA,eAAe,YACb,IACA,WACA,KACe;CACf,KAAK,MAAM,SAAS,WAAW,KAAA,GAAuB,GACpD,MAAM,2BACE,GAAG,OAAO,WAAW,YAAY,MAAM,KAAK,CAAC,GACnD,KAAA,GACA;EAAE,OAAO;EAAW,QAAQ;CAAiB,CAC/C;AAEJ;;;;;;;;;;;;;;;;;;;AAoBA,eAAe,iBACb,IACA,KACA,YACe;CACf,MAAM,WAAW,IAAI,QAClB,OACC,OAAO,OAAO,YACd,GAAG,SAAS,KACZ,OAAO,yBACX;CACA,IAAI,SAAS,WAAW,KAAK,WAAW,WAAW,GAAG;CAEtD,KAAK,MAAM,CAAC,OAAO,UAAU,gBAAgB,CAC3C;EAAC;EAAgB;EAAY;CAAa,GAC1C;EAAC;EAAkB;EAAa;CAAc,CAChD,GACE,KAAK,MAAM,SAAS,WAAW,UAAA,GAA4B,GACzD,MAAM,iCAEF,GAAG,OAAO,OAAO;EACf,GAAG,YAAY,UAAU,KAAK;EAC9B,GAAG,YAAY,aAAa,UAAU;CACxC,CAAC,GACH,KAAA,GACA;EAAE;EAAO,QAAQ;CAA8B,CACjD;AAGN;;;;;;;;AASA,eAAe,kBACb,KACA,WACA,WACA,KACA,OACe;CACf,MAAM,UAAU,IAAI,QAAQ,OAAO;EACjC,MAAM,MAAM,GAAG,UAAU,GAAG;EAC5B,IAAI,IAAI,QAAQ,IAAI,GAAG,GAAG,OAAO;EACjC,IAAI,QAAQ,IAAI,GAAG;EACnB,OAAO;CACT,CAAC;CACD,IAAI,QAAQ,WAAW,GAAG;CAE1B,IAAI,QAAQ,mBACV,MAAM,cAAc,oBAClB,uBAAuB,UAAU,iCAC5B,kBAAkB,8EAEvB,SACF;CAGF,MAAM,OAAO,iBAAiB,IAAI,UAAU,SAAS;CAIrD,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,cAAc,UAAU,WAAW,aAC1D;EAEF,IAAI,YAAY;EAChB,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;GAC3D,aAAa,MAAM,2BAEf,IAAI,GAAG,MACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,CACrC,GACF,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ,GAAG,UAAU,OAAO;GAAQ,CACpE;GACA,IAAI,YAAY,GAAG;EACrB;EACA,IAAI,YAAY,GACd,MAAM,cAAc,oBAClB,GAAG,UAAU,UAAU,GAAG,UAAU,UAAU,GACzC,UAAU,WAAW,aAAa,cAAc,cAC/C,UAAU,OAAO,QAAQ,UAAU,+BACpC,aACL,UAAU,MACZ;CAEJ;CAEA,KAAK,MAAM,aAAa,KAAK,YAAY;EACvC,IAAI,UAAU,WAAW,YAAY;GACnC,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GACxD,MAAM,2BAEF,IAAI,GAAG,OACL,UAAU,WACV,YAAY,UAAU,QAAQ,KAAK,GACnC,GAAG,UAAU,SAAS,KAAK,CAC7B,GACF,KAAA,GACA;IAAE,OAAO,UAAU;IAAW,QAAQ;GAAW,CACnD;GAEF,IAAI,eAAe,IAAI,UAAU,SAAS;GAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;GACA;EACF;EAEA,IAAI,UAAU,WAAW,WAAW;EAEpC,MAAM,WAAW,MAAM,UACrB,IAAI,IACJ,UAAU,WACV,UAAU,QACV,OACF;EACA,IAAI,SAAS,WAAW,GAAG;EAE3B,MAAM,kBACJ,KACA,UAAU,WACV,UAAU,WACV,UACA,QAAQ,CACV;EACA,MAAM,iBACJ,IAAI,IACJ,UACA,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;EACA,MAAM,YAAY,IAAI,IAAI,UAAU,WAAW,QAAQ;EACvD,IAAI,eAAe,IAAI,UAAU,SAAS;EAC1C,IAAI,qBAAqB,IACvB,UAAU,WACV,qBAAqB,IAAI,UAAU,UAAU,SAAS,CACxD;CACF;CAEA,KAAK,MAAM,eAAe,KAAK,aAC7B,KAAK,MAAM,SAAS,WAAW,SAAA,GAA2B,GAAG;EAC3D,MAAM,QAAiC,EACrC,GAAG,YAAY,WAAW,KAAK,EACjC;EACA,IAAI,KAAK,UAAU,WAAW,GAC5B,MAAM,YAAY,KAAK,UAAU;OAEjC,MAAM,kBAAkB,KAAK;EAU/B,MAAK,MARgB,2BACb,IAAI,GAAG,OAAO,YAAY,WAAW,KAAK,GAChD,KAAA,GACA;GACE,OAAO,YAAY;GACnB,QAAQ;EACV,CACF,EAAA,EACa,YAAY,KAAK,GAAG;GAC/B,IAAI,eAAe,IAAI,YAAY,SAAS;GAC5C,IAAI,qBAAqB,IACvB,YAAY,WACZ,qBAAqB,IAAI,UAAU,YAAY,SAAS,CAC1D;EACF;CACF;AAEJ;;;;;;;;AAqBA,eAAsB,oBACpB,IACA,UACA,QACwB;CACxB,MAAM,MAAsB;EAC1B;EACA;EACA,yBAAS,IAAI,IAAI;EACjB,gCAAgB,IAAI,IAAI;EACxB,sCAAsB,IAAI,IAAI;CAChC;CACA,MAAM,kBACJ,KACA,OAAO,WACP,OAAO,WACP,OAAO,KACP,CACF;CACA,MAAM,iBACJ,IACA,OAAO,KACP,qBAAqB,UAAU,OAAO,SAAS,CACjD;CACA,OAAO;EACL,gBAAgB,IAAI;EACpB,sBAAsB,IAAI;CAC5B;AACF;;;;;;;;;;;;;;;;AAwBA,eAAsB,iBACpB,IACA,UACA,QAMA,YACwB;CACxB,MAAM,MAAM,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;CAavC,IAAI,iBAAiB,UAAU,OAAO,SAAS,CAAC,CAAC,SAAS;EACxD,MAAM,uBAAuB,OAC3B,UAC2B;GAC3B,MAAM,iBACJ,OACA,KACA,qBAAqB,UAAU,OAAO,SAAS,CACjD;GACA,MAAM,WAAW,KAAK;GACtB,OAAO;IAAE,gCAAgB,IAAI,IAAI;IAAG,sCAAsB,IAAI,IAAI;GAAE;EACtE;EACA,MAAM,cAAe,GAA0B;EAC/C,IAAI,OAAO,gBAAgB,YAAY,OAAO,qBAAqB,EAAE;EACrE,OAAO,YAAY,KAIjB,IAAI,oBAAoB;CAC5B;CAEA,MAAM,MAAM,OAAO,UAAqD;EACtE,MAAM,SAAS,MAAM,oBAAoB,OAAO,UAAU;GACxD,WAAW,OAAO;GAClB,WAAW,OAAO;GAClB;EACF,CAAC;EACD,MAAM,WAAW,KAAK;EACtB,OAAO;CACT;CAEA,MAAM,cAAe,GAA0B;CAC/C,IAAI,OAAO,gBAAgB,YACzB,OAAO,IAAI,EAAE;CAGf,OAAO,YAAY,KAIjB,IAAI,GAAG;AACX"}