@palbase/backend 22.0.1 → 22.1.0

package/dist/engine/index.d.cts

@@ -1,7 +1,7 @@
-export { A as App, l as AuthVerifier, B as BootRefused, m as CreateAppOptions, E as EgressPolicy, n as EngineConfig, M as ModuleClients, o as RateLimiter, p as RequestDatabase, q as RouteEntry, r as RuntimeHooks, s as ScrubResult, t as SqlDriver, u as SqlTx, v as buildRouteTable, w as createApp, x as createLazyTransaction, y as createOps, z as createRequestDatabase, G as effectiveAuth, H as hostAllowed, I as installEgressFence, J as loadConfig, K as makeMemoryCache, O as matchRoute, Q as quoteIdent, T as scrubSecrets, U as withTables } from '../index-B4W6d2VJ.cjs';
-import '../endpoint-B0LpZixz.cjs';
+export { A as App, l as AuthVerifier, B as BootRefused, m as CreateAppOptions, E as EgressPolicy, n as EngineConfig, M as ModuleClients, o as RateLimiter, p as RequestDatabase, q as RouteEntry, r as RuntimeHooks, s as ScrubResult, t as SqlDriver, u as SqlTx, v as buildRouteTable, w as createApp, x as createLazyTransaction, y as createOps, z as createRequestDatabase, G as effectiveAuth, H as hostAllowed, I as installEgressFence, J as loadConfig, K as makeMemoryCache, O as matchRoute, Q as quoteIdent, T as scrubSecrets, U as withTables } from '../index-BS1gW4nV.cjs';
+import '../endpoint-BVT6jcVW.cjs';
 import '../db/env.cjs';
 import 'node:async_hooks';
-import '../index-BGSCWlUa.cjs';
-import '../registry-Cw0YEYCg.cjs';
+import '../index-BqCiHao8.cjs';
+import '../registry-BWttGlaT.cjs';
 import 'zod';

package/dist/engine/index.d.ts

@@ -1,7 +1,7 @@
-export { A as App, l as AuthVerifier, B as BootRefused, m as CreateAppOptions, E as EgressPolicy, n as EngineConfig, M as ModuleClients, o as RateLimiter, p as RequestDatabase, q as RouteEntry, r as RuntimeHooks, s as ScrubResult, t as SqlDriver, u as SqlTx, v as buildRouteTable, w as createApp, x as createLazyTransaction, y as createOps, z as createRequestDatabase, G as effectiveAuth, H as hostAllowed, I as installEgressFence, J as loadConfig, K as makeMemoryCache, O as matchRoute, Q as quoteIdent, T as scrubSecrets, U as withTables } from '../index-BCNtlG1w.js';
-import '../endpoint-B0LpZixz.js';
+export { A as App, l as AuthVerifier, B as BootRefused, m as CreateAppOptions, E as EgressPolicy, n as EngineConfig, M as ModuleClients, o as RateLimiter, p as RequestDatabase, q as RouteEntry, r as RuntimeHooks, s as ScrubResult, t as SqlDriver, u as SqlTx, v as buildRouteTable, w as createApp, x as createLazyTransaction, y as createOps, z as createRequestDatabase, G as effectiveAuth, H as hostAllowed, I as installEgressFence, J as loadConfig, K as makeMemoryCache, O as matchRoute, Q as quoteIdent, T as scrubSecrets, U as withTables } from '../index-CCZqzych.js';
+import '../endpoint-BVT6jcVW.js';
 import '../db/env.js';
 import 'node:async_hooks';
-import '../index-g-EzitI-.js';
-import '../registry-3BLYv4si.js';
+import '../index-vwHoS0l2.js';
+import '../registry-Bsuf-orT.js';
 import 'zod';

package/dist/engine/index.js

@@ -16,8 +16,8 @@ import {
   quoteIdent,
   scrubSecrets,
   withTables
-} from "../chunk-QYOHMVUW.js";
-import "../chunk-POYAFBLF.js";
+} from "../chunk-74XDEF5J.js";
+import "../chunk-SQC5EIWY.js";
 import "../chunk-W5ODXPY3.js";
 import "../chunk-QMVK4X3V.js";
 import "../chunk-7D4SUZUM.js";

package/dist/{index-B4W6d2VJ.d.cts → index-BS1gW4nV.d.cts}

@@ -1,8 +1,8 @@
 import { Buckets, BucketTypes } from './db/env.cjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { C as CacheClient, P as PalbaseDocsClient, a as PalbaseFlagsClient, L as Logger, b as PalbaseNotificationsClient, c as PalbaseRealtimeClient, D as DBClient, S as SecretsService, d as PalbaseStorageClient, e as PalbaseBucketClient, T as TxPlanBody, f as TxPlanResponse } from './endpoint-B0LpZixz.cjs';
-import { E as EnvTypedDatabase } from './index-BGSCWlUa.cjs';
-import { R as RouteMeta } from './registry-Cw0YEYCg.cjs';
+import { C as CacheClient, P as PalbaseDocsClient, a as PalbaseFlagsClient, L as Logger, b as PalbaseNotificationsClient, c as PalbaseRealtimeClient, D as DBClient, S as SecretsService, d as PalbaseStorageClient, e as PalbaseBucketClient, T as TxPlanBody, f as TxPlanResponse } from './endpoint-BVT6jcVW.cjs';
+import { E as EnvTypedDatabase } from './index-BqCiHao8.cjs';
+import { R as RouteMeta } from './registry-BWttGlaT.cjs';
 
 /**
  * The purchases surface the decorators need, declared as a NARROW STRUCTURAL
@@ -434,6 +434,21 @@ declare function createOps(tx: TxLike): {
     delete(table: string, id: string): Promise<void>;
     findById(table: string, id: string): Promise<Row | null>;
     findMany(table: string, query?: Row): Promise<Row[]>;
+    /**
+     * Tek-SQL hibrit arama (FR-014): iki kol CTE + FULL OUTER JOIN + RRF
+     * (1/(50+rank), CLAIM-N4). Operatör şema-nitelikli (C-10, M-1); GUC
+     * hnsw.iterative_scan=relaxed_order aynı tx'te set_config ile (CLAIM-N3 —
+     * RLS/filtre altında LIMIT-altı dönüş açığını kapatır). Sorgu-anı embed
+     * T024'te gelir; o zamana dek vector kolu yalnız params.vector ile koşar.
+     */
+    search(table: string, params?: {
+        query?: string;
+        vector?: number[];
+        where?: Record<string, unknown>;
+        limit?: number;
+        using?: string;
+        mode?: "hybrid" | "text" | "vector";
+    }): Promise<Row[]>;
     /** A real SAVEPOINT inside the request's transaction. */
     transaction<T>(cb: (t: unknown) => Promise<T>): Promise<T>;
     /**
@@ -779,28 +794,6 @@ declare function hostAllowed(host: string, allow: readonly string[]): boolean;
  */
 declare function installEgressFence(policy: EgressPolicy): typeof fetch;
 
-/**
- * engine/index.ts — the engine: a backend that boots itself.
- *
- * `createApp` turns a set of `@Controller` classes into a `fetch(Request)`
- * handler. No V8 isolate, no capability hop: this process owns its database
- * pool, verifies its own tokens, applies its own rate limits, and calls the
- * modules directly.
- *
- *   import { createApp, loadConfig } from "@palbase/backend/engine";
- *
- *   const app = await createApp({
- *     config: loadConfig(process.env),
- *     controllers: [TodosController],
- *     schema,
- *   });
- *   Bun.serve({ port: app.config.port, fetch: app.handle });
- *
- * The Web-standard `fetch` signature is the point: the same handler runs under
- * Bun, Deno and any host that speaks Request/Response, so "works locally" and
- * "works in the cloud" are the same code path rather than two.
- */
-
 /** The `__`-prefixed request-scope seam, as re-exported by a deployed bundle. */
 interface RuntimeHooks {
     __runWithRuntime: typeof __runWithRuntime;
@@ -809,6 +802,12 @@ interface RuntimeHooks {
 /** The module singletons the engine injects, minus the two it owns itself. */
 type ModuleClients = Partial<Pick<RuntimeServices, "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Purchases" | "Secrets">>;
 interface CreateAppOptions {
+    /**
+     * Vault'tan TEK secret okuma (FR-025): sorgu-anı embedding'in anahtarı
+     * buradan akar. Verilmezse auto-embed'li search({query}) adlandırılmış
+     * hatayla düşer — sessiz boş sonuç asla (FR-015).
+     */
+    secretReader?: (name: string) => Promise<string | null>;
     config: EngineConfig;
     /** `@Controller` classes. A class that collected zero routes is fatal. */
     controllers: readonly unknown[];

package/dist/{index-BGSCWlUa.d.cts → index-BqCiHao8.d.cts}

@@ -1,5 +1,5 @@
 import { Tables, TableTypes } from './db/env.cjs';
-import { D as DBClient, b8 as TxPlanHandle, bh as TxTable, M as Materialized } from './endpoint-B0LpZixz.cjs';
+import { D as DBClient, b8 as TxPlanHandle, bh as TxTable, M as Materialized } from './endpoint-BVT6jcVW.cjs';
 
 /** On delete action for foreign key references. */
 type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
@@ -13,7 +13,7 @@ type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
  */
 type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
 /** Column type identifiers. */
-type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum';
+type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum' | 'vector';
 /** Base column definition shared by all column types. */
 interface ColumnDef {
     type: ColumnType;
@@ -36,6 +36,9 @@ interface ColumnDef {
     enumName?: string;
     enumValues?: string[];
     unique?: boolean;
+    /** vector(n): the declared dimension count — part of the TYPE (typmod), read
+     * by the wire serializer and the deploy's auto-index (FR-001). */
+    dimensions?: number;
 }
 declare const __colKind: unique symbol;
 declare const __colNullable: unique symbol;
@@ -147,7 +150,7 @@ declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean
  * - "jsonb" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)
  * - "enum" → E (the union of literal values)
  */
-type ColValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
+type ColValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'vector', infer N, infer _D, infer _E, infer _P> ? N extends true ? number[] | null : number[] : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
 /**
  * True when a column is optional on INSERT:
  *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted
@@ -198,6 +201,10 @@ declare function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, neve
  *               union `V[number]` is as narrow as possible.
  */
 declare function enumType<const V extends readonly string[]>(name: string, values: V): ColumnBuilder<'enum', false, false, V[number]>;
+/** vector(n) — pgvector kolonu. n TİPİN parçasıdır (typmod) ve [1, 2000] —
+ * 2000 = pgvector'ün HNSW-indekslenebilir tavanı; auto-index bu beyanla bağlı
+ * (spec FR-001, D-3). */
+declare function vector(dimensions: number): ColumnBuilder<'vector', false, false, unknown, number[]>;
 
 /**
  * policy.ts — the RLS policy authoring DSL.
@@ -301,7 +308,7 @@ declare function policy(name: string): PolicyBuilder;
  * supported names and a typo fails typecheck. It is intentionally extensible:
  * add a name here (+ confirm the base image ships it) to support more.
  */
-declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "postgis", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pg_cron", "pgcrypto", "uuid-ossp"];
+declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pgcrypto", "uuid-ossp"];
 /** A Postgres extension supported by Palbase (allowlist union). */
 type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];
 /**
@@ -329,6 +336,25 @@ declare function raw(name: string, up: string, opts?: {
     down?: string;
 }): RawConstraintDef;
 
+/** Embedding sağlayıcı DESKRIPTORU — canlı istemci değil, düz veri: şemayla
+ * birlikte serileşir, çağrıyı Go worker (yazma) ve engine (sorgu) yapar.
+ * Adlandırma Vercel AI SDK'nın aynasıdır (openai.embedding("...")) ama paket
+ * bağımlılığı bilinçli olarak YOKTUR (spec C-3, UD-016). v1 sağlayıcı: openai (D-10). */
+interface EmbeddingModelRef {
+    provider: "openai";
+    model: string;
+    dimensions?: number;
+    apiKeyName?: string;
+    baseURL?: string;
+}
+declare const openai: {
+    embedding(model: string, opts?: {
+        dimensions?: number;
+        apiKeyName?: string;
+        baseURL?: string;
+    }): EmbeddingModelRef;
+};
+
 /**
  * A map of column builders keyed by column name — the value you write under
  * the `columns` key of `defineSchema({ tables: { <name>: { columns } } })`.
@@ -355,6 +381,32 @@ type ColumnMap = Record<string, ColumnBuilder>;
  * The `C` type parameter preserves the precise per-column phantom types so the
  * typed `Database.tables.*` surface keeps inferring insert/row shapes.
  */
+/** Arama metriği — tek kelime; opclass ve operatör bundan türetilir, asla yüzeye çıkmaz (D-5/D-6). */
+type SearchMetric = "cosine" | "euclidean" | "inner_product";
+/** Bir vektör arama kolu. `model` varsa auto-embed: platform yazma+sorgu embedding'ini üstlenir (D-9). */
+interface VectorSearchDecl {
+    /** Hedef vector kolonu; tabloda TEK vector kolonu varsa atlanabilir (Go apply çözer, FR-010). */
+    column?: string;
+    /** Varsa auto-embed. Deskriptor düz veridir — şemayla serileşir (C-3). */
+    model?: EmbeddingModelRef;
+    /** model varsa ZORUNLU: embed kaynak kolonları = trigger'ın UPDATE OF listesi (C-2). */
+    from?: string[];
+    metric?: SearchMetric;
+    /** Kaynak metin değişince ara-dönem davranışı (yalnız auto-embed'de):
+     * "null" (vars.) — embedding anında NULL'lanır; satır yeni vektör yazılana
+     *   dek anlamsal aramada aday değildir. Bayat eşleşme asla servis edilmez.
+     * "keep" — eski vektör aramada kalır, platform yenisini yazınca sessizce
+     *   değişir. Görünürlük penceresi sıfır; bedeli saniyeler süren bayat
+     *   eşleşme riski (Confluence-tipi sync yükleri için). */
+    staleness?: "null" | "keep";
+}
+/** Tablonun arama beyanı. `text`: FTS kolonları (sabit 'simple' sözlük, D-4 — palbase_fts + GIN türetilir).
+ * `vector`: bir ya da birden çok ANN kolu. İkisi de opsiyonel; blok yoksa tablo yine
+ * vector kolonu varlığıyla aranabilir (D-3/FR-013). */
+interface SearchDecl {
+    text?: string[];
+    vector?: VectorSearchDecl | VectorSearchDecl[];
+}
 interface TableInput<C extends ColumnMap = ColumnMap> {
     columns: C;
     rls?: boolean;
@@ -394,6 +446,8 @@ interface TableInput<C extends ColumnMap = ColumnMap> {
         name: string;
         columns: string[];
     }[];
+    /** Arama beyanı — bkz. SearchDecl. */
+    search?: SearchDecl;
 }
 /**
  * A table definition — the runtime value the Go runtime's `schema_extract.js`
@@ -429,6 +483,8 @@ interface TableDef<C extends ColumnMap = ColumnMap> {
         name: string;
         columns: string[];
     }[];
+    /** Arama beyanı, doğrulanmış ve taşınmış hali. */
+    search?: SearchDecl;
 }
 /**
  * A schema definition containing multiple tables, keyed by table name.
@@ -583,8 +639,32 @@ type TypedTx<S extends SchemaDef> = TxPlanHandle<{
  * through `Object.keys` iteration) — see the module-level doc comment.
  */
 declare function makeTypedDB<S extends SchemaDef>(schema: S, raw: DBClient): TypedDB<S>;
-/** A typed table accessor derived from one env `Tables` entry's flat shapes. */
-interface EnvTypedTable<T extends TableTypes> {
+/** Bir where değeri: düz eşitlik YA DA operatör nesnesi (FR-016). */
+type WhereOp<V> = V | {
+    gt?: V;
+    gte?: V;
+    lt?: V;
+    lte?: V;
+    neq?: V;
+    in?: V[];
+};
+/** search() parametreleri, satır tipiyle koşullanmış (FR-013). `offset` BİLEREK yok (UD-013). */
+interface SearchParamsTyped<T extends TableTypes> {
+    /** Metin sorgusu: FTS kolunu besler; embed beyanlıysa sorgu vektörü de bundan üretilir. */
+    query?: string;
+    /** Hazır sorgu vektörü — verilirse embed çağrısı olmaz (FR-025). */
+    vector?: number[];
+    where?: {
+        [K in keyof T["row"]]?: WhereOp<T["row"][K]>;
+    };
+    /** default 20, tavan 100 (engine uygular). */
+    limit?: number;
+    /** Birden çok vektör kolonunda hedef seçimi (model geçişi, FR-013/using). */
+    using?: string;
+    mode?: "hybrid" | "text" | "vector";
+}
+/** Temel tablo erişimcisi — search'süz beş op. */
+interface EnvTypedTableBase<T extends TableTypes> {
     insert(data: T["insert"]): Promise<T["row"]>;
     /** Update the row by id; resolves to the updated row, or `null` if no row
      * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
@@ -594,6 +674,16 @@ interface EnvTypedTable<T extends TableTypes> {
     findById(id: string): Promise<T["row"] | null>;
     findMany(query?: Partial<T["row"]>): Promise<T["row"][]>;
 }
+/** Tablo erişimcisi: env girdisi `searchable: true` taşıyorsa (vector kolonu ya da
+ * search beyanı — env-gen üretir) `search()` üyesi VARDIR; yoksa üye hiç yoktur ve
+ * çağrı derleme hatasıdır (FR-013). Yapısal koşul TableTypes'ı genişletmeden çalışır. */
+type EnvTypedTable<T extends TableTypes> = EnvTypedTableBase<T> & (T extends {
+    searchable: true;
+} ? {
+    search(params: SearchParamsTyped<T>): Promise<Array<T["row"] & {
+        _score: number;
+    }>>;
+} : Record<never, never>);
 /** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`
  * interface. When no schema is declared `Tables` is empty, so `tables` is an
  * empty object — accessing `.tables.foo` is then a compile error (no member). */
@@ -671,4 +761,4 @@ interface EnvTypedDatabase extends Omit<DBClient, "txPlan" | "asService"> {
     asService(): EnvServiceDatabase;
 }
 
-export { jsonb as A, makeTypedDB as B, ColumnBuilder as C, numeric as D, type EnvTypedDatabase as E, policy as F, raw as G, text as H, type InsertShape as I, timestamp as J, uuid as K, type OnDeleteAction as O, PALBASE_EXTENSIONS as P, type RawConstraintDef as R, type SchemaDef as S, type TableDef as T, type ColumnDef as a, type ColumnMap as b, type ColumnType as c, EXTENSION_DEPENDENCIES as d, type EnvServiceDatabase as e, type EnvTables as f, type EnvTypedTable as g, type PalbaseExtension as h, PolicyBuilder as i, type PolicyCommand as j, type PolicyDef as k, type PolicyMode as l, type RowShape as m, type SchemaInput as n, type TableInput as o, type TxPlan as p, type TxTables as q, type TypedDB as r, type TypedTable as s, type TypedTx as t, bigint as u, boolean as v, defineSchema as w, enumType as x, integer as y, isPalbaseExtension as z };
+export { isPalbaseExtension as A, jsonb as B, ColumnBuilder as C, makeTypedDB as D, type EnvTypedDatabase as E, numeric as F, openai as G, policy as H, type InsertShape as I, raw as J, text as K, timestamp as L, uuid as M, vector as N, type OnDeleteAction as O, PALBASE_EXTENSIONS as P, type RawConstraintDef as R, type SchemaDef as S, type TableDef as T, type ColumnDef as a, type ColumnMap as b, type ColumnType as c, EXTENSION_DEPENDENCIES as d, type EmbeddingModelRef as e, type EnvServiceDatabase as f, type EnvTables as g, type EnvTypedTable as h, type PalbaseExtension as i, PolicyBuilder as j, type PolicyCommand as k, type PolicyDef as l, type PolicyMode as m, type RowShape as n, type SchemaInput as o, type TableInput as p, type TxPlan as q, type TxTables as r, type TypedDB as s, type TypedTable as t, type TypedTx as u, bigint as v, boolean as w, defineSchema as x, enumType as y, integer as z };

package/dist/{index-BCNtlG1w.d.ts → index-CCZqzych.d.ts}

@@ -1,8 +1,8 @@
 import { Buckets, BucketTypes } from './db/env.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { C as CacheClient, P as PalbaseDocsClient, a as PalbaseFlagsClient, L as Logger, b as PalbaseNotificationsClient, c as PalbaseRealtimeClient, D as DBClient, S as SecretsService, d as PalbaseStorageClient, e as PalbaseBucketClient, T as TxPlanBody, f as TxPlanResponse } from './endpoint-B0LpZixz.js';
-import { E as EnvTypedDatabase } from './index-g-EzitI-.js';
-import { R as RouteMeta } from './registry-3BLYv4si.js';
+import { C as CacheClient, P as PalbaseDocsClient, a as PalbaseFlagsClient, L as Logger, b as PalbaseNotificationsClient, c as PalbaseRealtimeClient, D as DBClient, S as SecretsService, d as PalbaseStorageClient, e as PalbaseBucketClient, T as TxPlanBody, f as TxPlanResponse } from './endpoint-BVT6jcVW.js';
+import { E as EnvTypedDatabase } from './index-vwHoS0l2.js';
+import { R as RouteMeta } from './registry-Bsuf-orT.js';
 
 /**
  * The purchases surface the decorators need, declared as a NARROW STRUCTURAL
@@ -434,6 +434,21 @@ declare function createOps(tx: TxLike): {
     delete(table: string, id: string): Promise<void>;
     findById(table: string, id: string): Promise<Row | null>;
     findMany(table: string, query?: Row): Promise<Row[]>;
+    /**
+     * Tek-SQL hibrit arama (FR-014): iki kol CTE + FULL OUTER JOIN + RRF
+     * (1/(50+rank), CLAIM-N4). Operatör şema-nitelikli (C-10, M-1); GUC
+     * hnsw.iterative_scan=relaxed_order aynı tx'te set_config ile (CLAIM-N3 —
+     * RLS/filtre altında LIMIT-altı dönüş açığını kapatır). Sorgu-anı embed
+     * T024'te gelir; o zamana dek vector kolu yalnız params.vector ile koşar.
+     */
+    search(table: string, params?: {
+        query?: string;
+        vector?: number[];
+        where?: Record<string, unknown>;
+        limit?: number;
+        using?: string;
+        mode?: "hybrid" | "text" | "vector";
+    }): Promise<Row[]>;
     /** A real SAVEPOINT inside the request's transaction. */
     transaction<T>(cb: (t: unknown) => Promise<T>): Promise<T>;
     /**
@@ -779,28 +794,6 @@ declare function hostAllowed(host: string, allow: readonly string[]): boolean;
  */
 declare function installEgressFence(policy: EgressPolicy): typeof fetch;
 
-/**
- * engine/index.ts — the engine: a backend that boots itself.
- *
- * `createApp` turns a set of `@Controller` classes into a `fetch(Request)`
- * handler. No V8 isolate, no capability hop: this process owns its database
- * pool, verifies its own tokens, applies its own rate limits, and calls the
- * modules directly.
- *
- *   import { createApp, loadConfig } from "@palbase/backend/engine";
- *
- *   const app = await createApp({
- *     config: loadConfig(process.env),
- *     controllers: [TodosController],
- *     schema,
- *   });
- *   Bun.serve({ port: app.config.port, fetch: app.handle });
- *
- * The Web-standard `fetch` signature is the point: the same handler runs under
- * Bun, Deno and any host that speaks Request/Response, so "works locally" and
- * "works in the cloud" are the same code path rather than two.
- */
-
 /** The `__`-prefixed request-scope seam, as re-exported by a deployed bundle. */
 interface RuntimeHooks {
     __runWithRuntime: typeof __runWithRuntime;
@@ -809,6 +802,12 @@ interface RuntimeHooks {
 /** The module singletons the engine injects, minus the two it owns itself. */
 type ModuleClients = Partial<Pick<RuntimeServices, "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Purchases" | "Secrets">>;
 interface CreateAppOptions {
+    /**
+     * Vault'tan TEK secret okuma (FR-025): sorgu-anı embedding'in anahtarı
+     * buradan akar. Verilmezse auto-embed'li search({query}) adlandırılmış
+     * hatayla düşer — sessiz boş sonuç asla (FR-015).
+     */
+    secretReader?: (name: string) => Promise<string | null>;
     config: EngineConfig;
     /** `@Controller` classes. A class that collected zero routes is fatal. */
     controllers: readonly unknown[];

package/dist/{index-g-EzitI-.d.ts → index-vwHoS0l2.d.ts}

@@ -1,5 +1,5 @@
 import { Tables, TableTypes } from './db/env.js';
-import { D as DBClient, b8 as TxPlanHandle, bh as TxTable, M as Materialized } from './endpoint-B0LpZixz.js';
+import { D as DBClient, b8 as TxPlanHandle, bh as TxTable, M as Materialized } from './endpoint-BVT6jcVW.js';
 
 /** On delete action for foreign key references. */
 type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
@@ -13,7 +13,7 @@ type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
  */
 type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
 /** Column type identifiers. */
-type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum';
+type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum' | 'vector';
 /** Base column definition shared by all column types. */
 interface ColumnDef {
     type: ColumnType;
@@ -36,6 +36,9 @@ interface ColumnDef {
     enumName?: string;
     enumValues?: string[];
     unique?: boolean;
+    /** vector(n): the declared dimension count — part of the TYPE (typmod), read
+     * by the wire serializer and the deploy's auto-index (FR-001). */
+    dimensions?: number;
 }
 declare const __colKind: unique symbol;
 declare const __colNullable: unique symbol;
@@ -147,7 +150,7 @@ declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean
  * - "jsonb" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)
  * - "enum" → E (the union of literal values)
  */
-type ColValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
+type ColValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'vector', infer N, infer _D, infer _E, infer _P> ? N extends true ? number[] | null : number[] : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
 /**
  * True when a column is optional on INSERT:
  *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted
@@ -198,6 +201,10 @@ declare function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, neve
  *               union `V[number]` is as narrow as possible.
  */
 declare function enumType<const V extends readonly string[]>(name: string, values: V): ColumnBuilder<'enum', false, false, V[number]>;
+/** vector(n) — pgvector kolonu. n TİPİN parçasıdır (typmod) ve [1, 2000] —
+ * 2000 = pgvector'ün HNSW-indekslenebilir tavanı; auto-index bu beyanla bağlı
+ * (spec FR-001, D-3). */
+declare function vector(dimensions: number): ColumnBuilder<'vector', false, false, unknown, number[]>;
 
 /**
  * policy.ts — the RLS policy authoring DSL.
@@ -301,7 +308,7 @@ declare function policy(name: string): PolicyBuilder;
  * supported names and a typo fails typecheck. It is intentionally extensible:
  * add a name here (+ confirm the base image ships it) to support more.
  */
-declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "postgis", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pg_cron", "pgcrypto", "uuid-ossp"];
+declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pgcrypto", "uuid-ossp"];
 /** A Postgres extension supported by Palbase (allowlist union). */
 type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];
 /**
@@ -329,6 +336,25 @@ declare function raw(name: string, up: string, opts?: {
     down?: string;
 }): RawConstraintDef;
 
+/** Embedding sağlayıcı DESKRIPTORU — canlı istemci değil, düz veri: şemayla
+ * birlikte serileşir, çağrıyı Go worker (yazma) ve engine (sorgu) yapar.
+ * Adlandırma Vercel AI SDK'nın aynasıdır (openai.embedding("...")) ama paket
+ * bağımlılığı bilinçli olarak YOKTUR (spec C-3, UD-016). v1 sağlayıcı: openai (D-10). */
+interface EmbeddingModelRef {
+    provider: "openai";
+    model: string;
+    dimensions?: number;
+    apiKeyName?: string;
+    baseURL?: string;
+}
+declare const openai: {
+    embedding(model: string, opts?: {
+        dimensions?: number;
+        apiKeyName?: string;
+        baseURL?: string;
+    }): EmbeddingModelRef;
+};
+
 /**
  * A map of column builders keyed by column name — the value you write under
  * the `columns` key of `defineSchema({ tables: { <name>: { columns } } })`.
@@ -355,6 +381,32 @@ type ColumnMap = Record<string, ColumnBuilder>;
  * The `C` type parameter preserves the precise per-column phantom types so the
  * typed `Database.tables.*` surface keeps inferring insert/row shapes.
  */
+/** Arama metriği — tek kelime; opclass ve operatör bundan türetilir, asla yüzeye çıkmaz (D-5/D-6). */
+type SearchMetric = "cosine" | "euclidean" | "inner_product";
+/** Bir vektör arama kolu. `model` varsa auto-embed: platform yazma+sorgu embedding'ini üstlenir (D-9). */
+interface VectorSearchDecl {
+    /** Hedef vector kolonu; tabloda TEK vector kolonu varsa atlanabilir (Go apply çözer, FR-010). */
+    column?: string;
+    /** Varsa auto-embed. Deskriptor düz veridir — şemayla serileşir (C-3). */
+    model?: EmbeddingModelRef;
+    /** model varsa ZORUNLU: embed kaynak kolonları = trigger'ın UPDATE OF listesi (C-2). */
+    from?: string[];
+    metric?: SearchMetric;
+    /** Kaynak metin değişince ara-dönem davranışı (yalnız auto-embed'de):
+     * "null" (vars.) — embedding anında NULL'lanır; satır yeni vektör yazılana
+     *   dek anlamsal aramada aday değildir. Bayat eşleşme asla servis edilmez.
+     * "keep" — eski vektör aramada kalır, platform yenisini yazınca sessizce
+     *   değişir. Görünürlük penceresi sıfır; bedeli saniyeler süren bayat
+     *   eşleşme riski (Confluence-tipi sync yükleri için). */
+    staleness?: "null" | "keep";
+}
+/** Tablonun arama beyanı. `text`: FTS kolonları (sabit 'simple' sözlük, D-4 — palbase_fts + GIN türetilir).
+ * `vector`: bir ya da birden çok ANN kolu. İkisi de opsiyonel; blok yoksa tablo yine
+ * vector kolonu varlığıyla aranabilir (D-3/FR-013). */
+interface SearchDecl {
+    text?: string[];
+    vector?: VectorSearchDecl | VectorSearchDecl[];
+}
 interface TableInput<C extends ColumnMap = ColumnMap> {
     columns: C;
     rls?: boolean;
@@ -394,6 +446,8 @@ interface TableInput<C extends ColumnMap = ColumnMap> {
         name: string;
         columns: string[];
     }[];
+    /** Arama beyanı — bkz. SearchDecl. */
+    search?: SearchDecl;
 }
 /**
  * A table definition — the runtime value the Go runtime's `schema_extract.js`
@@ -429,6 +483,8 @@ interface TableDef<C extends ColumnMap = ColumnMap> {
         name: string;
         columns: string[];
     }[];
+    /** Arama beyanı, doğrulanmış ve taşınmış hali. */
+    search?: SearchDecl;
 }
 /**
  * A schema definition containing multiple tables, keyed by table name.
@@ -583,8 +639,32 @@ type TypedTx<S extends SchemaDef> = TxPlanHandle<{
  * through `Object.keys` iteration) — see the module-level doc comment.
  */
 declare function makeTypedDB<S extends SchemaDef>(schema: S, raw: DBClient): TypedDB<S>;
-/** A typed table accessor derived from one env `Tables` entry's flat shapes. */
-interface EnvTypedTable<T extends TableTypes> {
+/** Bir where değeri: düz eşitlik YA DA operatör nesnesi (FR-016). */
+type WhereOp<V> = V | {
+    gt?: V;
+    gte?: V;
+    lt?: V;
+    lte?: V;
+    neq?: V;
+    in?: V[];
+};
+/** search() parametreleri, satır tipiyle koşullanmış (FR-013). `offset` BİLEREK yok (UD-013). */
+interface SearchParamsTyped<T extends TableTypes> {
+    /** Metin sorgusu: FTS kolunu besler; embed beyanlıysa sorgu vektörü de bundan üretilir. */
+    query?: string;
+    /** Hazır sorgu vektörü — verilirse embed çağrısı olmaz (FR-025). */
+    vector?: number[];
+    where?: {
+        [K in keyof T["row"]]?: WhereOp<T["row"][K]>;
+    };
+    /** default 20, tavan 100 (engine uygular). */
+    limit?: number;
+    /** Birden çok vektör kolonunda hedef seçimi (model geçişi, FR-013/using). */
+    using?: string;
+    mode?: "hybrid" | "text" | "vector";
+}
+/** Temel tablo erişimcisi — search'süz beş op. */
+interface EnvTypedTableBase<T extends TableTypes> {
     insert(data: T["insert"]): Promise<T["row"]>;
     /** Update the row by id; resolves to the updated row, or `null` if no row
      * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
@@ -594,6 +674,16 @@ interface EnvTypedTable<T extends TableTypes> {
     findById(id: string): Promise<T["row"] | null>;
     findMany(query?: Partial<T["row"]>): Promise<T["row"][]>;
 }
+/** Tablo erişimcisi: env girdisi `searchable: true` taşıyorsa (vector kolonu ya da
+ * search beyanı — env-gen üretir) `search()` üyesi VARDIR; yoksa üye hiç yoktur ve
+ * çağrı derleme hatasıdır (FR-013). Yapısal koşul TableTypes'ı genişletmeden çalışır. */
+type EnvTypedTable<T extends TableTypes> = EnvTypedTableBase<T> & (T extends {
+    searchable: true;
+} ? {
+    search(params: SearchParamsTyped<T>): Promise<Array<T["row"] & {
+        _score: number;
+    }>>;
+} : Record<never, never>);
 /** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`
  * interface. When no schema is declared `Tables` is empty, so `tables` is an
  * empty object — accessing `.tables.foo` is then a compile error (no member). */
@@ -671,4 +761,4 @@ interface EnvTypedDatabase extends Omit<DBClient, "txPlan" | "asService"> {
     asService(): EnvServiceDatabase;
 }
 
-export { jsonb as A, makeTypedDB as B, ColumnBuilder as C, numeric as D, type EnvTypedDatabase as E, policy as F, raw as G, text as H, type InsertShape as I, timestamp as J, uuid as K, type OnDeleteAction as O, PALBASE_EXTENSIONS as P, type RawConstraintDef as R, type SchemaDef as S, type TableDef as T, type ColumnDef as a, type ColumnMap as b, type ColumnType as c, EXTENSION_DEPENDENCIES as d, type EnvServiceDatabase as e, type EnvTables as f, type EnvTypedTable as g, type PalbaseExtension as h, PolicyBuilder as i, type PolicyCommand as j, type PolicyDef as k, type PolicyMode as l, type RowShape as m, type SchemaInput as n, type TableInput as o, type TxPlan as p, type TxTables as q, type TypedDB as r, type TypedTable as s, type TypedTx as t, bigint as u, boolean as v, defineSchema as w, enumType as x, integer as y, isPalbaseExtension as z };
+export { isPalbaseExtension as A, jsonb as B, ColumnBuilder as C, makeTypedDB as D, type EnvTypedDatabase as E, numeric as F, openai as G, policy as H, type InsertShape as I, raw as J, text as K, timestamp as L, uuid as M, vector as N, type OnDeleteAction as O, PALBASE_EXTENSIONS as P, type RawConstraintDef as R, type SchemaDef as S, type TableDef as T, type ColumnDef as a, type ColumnMap as b, type ColumnType as c, EXTENSION_DEPENDENCIES as d, type EmbeddingModelRef as e, type EnvServiceDatabase as f, type EnvTables as g, type EnvTypedTable as h, type PalbaseExtension as i, PolicyBuilder as j, type PolicyCommand as k, type PolicyDef as l, type PolicyMode as m, type RowShape as n, type SchemaInput as o, type TableInput as p, type TxPlan as q, type TxTables as r, type TypedDB as s, type TypedTable as t, type TypedTx as u, bigint as v, boolean as w, defineSchema as x, enumType as y, integer as z };