@palbase/backend 22.1.0 → 23.1.0

package/dist/chunk-PY7YJDCT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/db/policy.ts","../src/db/schema.ts","../src/db/extensions.ts","../src/db/columns.ts","../src/db/raw.ts","../src/db/embedding.ts","../src/db/typed-db.ts"],"sourcesContent":["/**\n * policy.ts — the RLS policy authoring DSL.\n *\n * `policy(name)` returns a fluent builder that mirrors the `ColumnBuilder`\n * style in columns.ts: each chainable method mutates the underlying\n * definition and returns the builder so calls compose. The terminal value is\n * a plain {@link PolicyDef} — the exact JSON shape the runtime's\n * `schema_extract.js` reads off the bundled module and the Go side parses into\n * `PolicyJSON` (CONTRACT-POLICY).\n *\n * @example\n * import { policy } from \"@palbase/backend\";\n *\n * policy(\"owner_select\")\n *   .for(\"select\")\n *   .to(\"authenticated\")\n *   .using(\"owner = (select auth.uid())\");\n */\n\n/** The SQL command a policy applies to. `\"all\"` covers SELECT/INSERT/UPDATE/DELETE. */\nexport type PolicyCommand = \"all\" | \"select\" | \"insert\" | \"update\" | \"delete\";\n\n/** Whether a policy is permissive (OR-combined, the default) or restrictive\n * (AND-combined). Mirrors Postgres `CREATE POLICY ... AS PERMISSIVE|RESTRICTIVE`. */\nexport type PolicyMode = \"permissive\" | \"restrictive\";\n\n/**\n * The compiled, serializable policy definition — the EXACT shape consumed by\n * `schema_extract.js` → Go `PolicyJSON` (CONTRACT-POLICY).\n *\n * - `roles`: the DB roles this policy applies to (`TO` clause). An empty array\n *   means the policy applies to PUBLIC (all roles) — the Postgres default.\n * - `using`: the `USING (...)` row-visibility expression, or `null` when none.\n * - `withCheck`: the `WITH CHECK (...)` write-validation expression, or `null`.\n * - `permissive`: `true` for `AS PERMISSIVE` (default), `false` for restrictive.\n */\nexport interface PolicyDef {\n  name: string;\n  command: PolicyCommand;\n  roles: string[];\n  using: string | null;\n  withCheck: string | null;\n  permissive: boolean;\n}\n\n/**\n * Fluent RLS policy builder.\n *\n * Defaults (documented, applied at construction):\n *  - `command`: `\"all\"` — applies to every SQL command unless `.for(...)` narrows it.\n *  - `roles`: `[\"authenticated\"]` — the common case is \"rule applies to signed-in\n *    users\". Call `.to(...)` to override; pass `.to()` with no roles (or never\n *    call it after a reset) to target PUBLIC.\n *  - `using` / `withCheck`: `null` — no row filter / write check until set.\n *  - `permissive`: `true` — `AS PERMISSIVE` (policies OR together).\n *\n * Each method mutates `_def` in place and returns `this`, so the chain is a\n * single builder instance (no per-call allocation, like a tagged-template\n * compile target). The terminal `PolicyDef` is read directly off `_def` by\n * `schema_extract.js`.\n */\n/** Quote an identifier for the policy expression. Table and column names reach\n * here from the schema author; neither is allowed to become syntax. */\nfunction quote(name: string): string {\n  return `\"${name.replace(/\"/g, '\"\"')}\"`;\n}\n\nexport class PolicyBuilder {\n  readonly _def: PolicyDef;\n\n  constructor(name: string) {\n    this._def = {\n      name,\n      command: \"all\",\n      roles: [\"authenticated\"],\n      using: null,\n      withCheck: null,\n      permissive: true,\n    };\n  }\n\n  /** Restrict the policy to a single SQL command (default `\"all\"`). */\n  for(command: PolicyCommand): this {\n    this._def.command = command;\n    return this;\n  }\n\n  /**\n   * Set the DB roles the policy applies to (the `TO` clause), replacing any\n   * previously-set roles. Call with no arguments to target PUBLIC (all roles).\n   *\n   * @example\n   * policy(\"p\").to(\"authenticated\")\n   * policy(\"p\").to(\"authenticated\", \"service_role\")\n   * policy(\"p\").to() // PUBLIC\n   */\n  to(...roles: string[]): this {\n    this._def.roles = roles;\n    return this;\n  }\n\n  /** Set the `USING (...)` row-visibility expression (raw SQL). */\n  using(sqlExpr: string): this {\n    this._def.using = sqlExpr;\n    return this;\n  }\n\n  /**\n   * \"Rows of THIS table whose owner the caller is a member of\" — the membership\n   * pattern, written so it cannot recurse.\n   *\n   * THE TRAP IT EXISTS FOR. Written by hand, membership policies point at each\n   * other: `channels` is visible to members, so its policy reads\n   * `channel_members`; `channel_members` is visible to members, so its policy\n   * reads `channels`. Postgres refuses the pair at query time with `infinite\n   * recursion detected in policy for relation ...`, and the error names the\n   * relation but not the cycle. The way out is asymmetry — the MEMBERSHIP table\n   * is protected by `user_id = auth.uid()` and nothing else, and every other\n   * table subqueries INTO it. That shape was in the platform's own schema and\n   * written down nowhere; a customer recovered it by reading that schema.\n   *\n   * `(select auth.uid())` rather than a bare call: the scalar subquery is\n   * evaluated ONCE per statement instead of per row.\n   *\n   * @example\n   * // channels: visible to members. The membership table gets the simple one.\n   * policy(\"member_read\").for(\"select\").to(\"authenticated\")\n   *   .memberOf(\"channel_members\", \"channel_id\")\n   * // → id IN (SELECT \"channel_id\" FROM \"channel_members\"\n   * //          WHERE \"user_id\" = (select auth.uid()))\n   */\n  memberOf(\n    membershipTable: string,\n    foreignKey: string,\n    options: { column?: string; userColumn?: string } = {},\n  ): this {\n    if (this._def.using !== null) {\n      // Silently AND-ing the two would hide whichever the author meant; silently\n      // replacing would hide the one they wrote. Neither is a thing to guess.\n      throw new Error(\n        `policy(${this._def.name}).memberOf(): this policy already has a using() expression. ` +\n          \"Write one or the other — memberOf IS the using expression.\",\n      );\n    }\n    const column = options.column ?? \"id\";\n    const userColumn = options.userColumn ?? \"user_id\";\n    this._def.using =\n      `${quote(column)} IN (SELECT ${quote(foreignKey)} FROM ${quote(membershipTable)} ` +\n      `WHERE ${quote(userColumn)} = (select auth.uid()))`;\n    return this;\n  }\n\n  /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */\n  withCheck(sqlExpr: string): this {\n    this._def.withCheck = sqlExpr;\n    return this;\n  }\n\n  /** Set the policy mode: `\"permissive\"` (default, OR-combined) or\n   * `\"restrictive\"` (AND-combined). */\n  as(mode: PolicyMode): this {\n    this._def.permissive = mode === \"permissive\";\n    return this;\n  }\n}\n\n/**\n * Start authoring an RLS policy. Returns a {@link PolicyBuilder}; the resulting\n * `PolicyBuilder` is accepted directly in a table's `policies: [...]` array\n * (its `_def` is read at schema-extract time).\n *\n * @param name The policy name. Palbase reconciliation keys policies by\n *             `(table, name)`, so names must be unique per table.\n */\nexport function policy(name: string): PolicyBuilder {\n  return new PolicyBuilder(name);\n}\n","import type { ColumnBuilder } from \"./columns.js\";\nimport { PolicyBuilder } from \"./policy.js\";\nimport type { PolicyDef } from \"./policy.js\";\nimport type { PalbaseExtension } from \"./extensions.js\";\nimport type { RawConstraintDef } from \"./raw.js\";\nimport type { ChatModelRef, EmbeddingModelRef } from \"./embedding.js\";\n\n/**\n * A map of column builders keyed by column name — the value you write under\n * the `columns` key of `defineSchema({ tables: { <name>: { columns } } })`.\n *\n * The default `Record<string, ColumnBuilder>` keeps bare references compiling\n * without a type argument.\n */\nexport type ColumnMap = Record<string, ColumnBuilder>;\n\n/**\n * The author-facing value written under each table key:\n * `{ columns, rls?, policies? }`.\n *\n * - `columns`: the column map (required).\n * - `rls`: enable + FORCE row-level security on this table. **Defaults to\n *   `true`**, and is forced on when `policies` is non-empty. A table with RLS\n *   and no policies is deny-all, which is the starting state: nothing reads it\n *   until a policy says who may. Set `rls: false` only for a genuinely public\n *   table — it is an explicit opt-out that a reviewer can grep for, not\n *   something you get by forgetting.\n * - `policies`: the RLS policies for this table, authored with `policy(name)`.\n *   Each entry may be a {@link PolicyBuilder} (the normal `policy(...)` chain)\n *   or a raw {@link PolicyDef} object.\n *\n * The `C` type parameter preserves the precise per-column phantom types so the\n * typed `Database.tables.*` surface keeps inferring insert/row shapes.\n */\n/** Arama metriği — tek kelime; opclass ve operatör bundan türetilir, asla yüzeye çıkmaz (D-5/D-6). */\nexport type SearchMetric = \"cosine\" | \"euclidean\" | \"inner_product\";\n\n/** Bir vektör arama kolu. `model` varsa auto-embed: platform yazma+sorgu embedding'ini üstlenir (D-9). */\nexport interface VectorSearchDecl {\n  /** Hedef vector kolonu; tabloda TEK vector kolonu varsa atlanabilir (Go apply çözer, FR-010). */\n  column?: string;\n  /** Varsa auto-embed. Deskriptor düz veridir — şemayla serileşir (C-3). */\n  model?: EmbeddingModelRef;\n  /** model varsa ZORUNLU: embed kaynak kolonları = trigger'ın UPDATE OF listesi (C-2). */\n  from?: string[];\n  metric?: SearchMetric;\n  /** Kaynak metin değişince ara-dönem davranışı (yalnız auto-embed'de):\n   * \"null\" (vars.) — embedding anında NULL'lanır; satır yeni vektör yazılana\n   *   dek anlamsal aramada aday değildir. Bayat eşleşme asla servis edilmez.\n   * \"keep\" — eski vektör aramada kalır, platform yenisini yazınca sessizce\n   *   değişir. Görünürlük penceresi sıfır; bedeli saniyeler süren bayat\n   *   eşleşme riski (Confluence-tipi sync yükleri için). */\n  staleness?: \"null\" | \"keep\";\n}\n\n/** Tablonun arama beyanı — İKİ biçim (D-007, tek yüzey):\n *\n * YENİ (önerilen): `{ from, model, ... }` — `from` kolonları hem FTS'e hem\n * embed'e girer. Tabloda vector kolonu declare edilmişse SATIR-modu; yoksa\n * CHUNK-modu otomatiktir (D-010): vektörler türev `__palbase_chunks`\n * tablosunda yaşar, içerik otomatik bölünür. `text: false` FTS'i kapatır,\n * `text: [..]` FTS kolonlarını from'dan ayırır. `chunks` yalnız ince ayar.\n *\n * ESKİ: `text: string[]` + `vector: {...}` — aynen çalışır, wire çıktısı\n * bayt-aynı kalır (NFR-B1). İki biçim KARIŞTIRILAMAZ. */\nexport interface SearchDecl {\n  text?: string[] | boolean;\n  vector?: VectorSearchDecl | VectorSearchDecl[];\n  /** Yeni biçim: arama kaynağı kolonlar (FTS + embed). Varlığı yeni biçimi seçer. */\n  from?: string[];\n  /** Yeni biçim: auto-embed modeli (zorunlu — BYO için eski biçimi kullanın). */\n  model?: EmbeddingModelRef;\n  metric?: SearchMetric;\n  staleness?: \"null\" | \"keep\";\n  /** Chunk-modu ince ayarı (yalnız vector kolonsuz tabloda anlamlı). */\n  chunks?: { size?: number; overlap?: number };\n  /** Sorgu-yeniden-yazımı: tek yönlü eş anlamlı haritası (FR-026). */\n  synonyms?: Record<string, string[]>;\n  /** Geçerlilik kolonları türetilir; arama varsayılan yalnız günceli tarar (FR-029). */\n  validity?: boolean;\n}\n\n/** Hafıza beyanı (FR-032, D-019): kaynak tablonun yazımlarından platform\n * fact damıtır ve `into` tablosuna yazar. Hedef NORMAL declared tablodur —\n * kendi search/unique/validity beyanlarıyla. Okuma = Database.search(into).\n * subject default \"owner\": fact'in kime ait olduğu kolonu (iki tabloda da). */\nexport interface MemoryDecl {\n  from: string[];\n  into: string;\n  extract: ChatModelRef;\n  subject?: string;\n}\n\nexport interface TableInput<C extends ColumnMap = ColumnMap> {\n  columns: C;\n  rls?: boolean;\n  policies?: (PolicyBuilder | PolicyDef)[];\n  /** Composite/named primary key (ordered column names). Omit for single-column inline .primaryKey(). */\n  primaryKey?: string[];\n  /** Named multi-column UNIQUE constraints. */\n  unique?: { name: string; columns: string[] }[];\n  /** Named raw-SQL DDL objects (EXCLUDE, triggers, views) that the typed DSL cannot express. */\n  raw?: RawConstraintDef[];\n  /**\n   * Named first-class CHECK constraints. Diffed by NAME with a BODY compare:\n   * a changed `expr` (after pg normalization) recreates the constraint\n   * (DROP + ADD). `expr` is trusted SQL emitted verbatim (like policy USING),\n   * `name` is identifier-validated.\n   */\n  checks?: { name: string; expr: string }[];\n  /**\n   * Plain (non-unique) btree indexes over an ordered column list, emitted as\n   * standalone `CREATE INDEX [IF NOT EXISTS] name ON table (col1, col2)`\n   * statements (NOT a table clause — a separate migration statement category).\n   * Structural compare by NAME (no expression normalization). `name` and each\n   * column are identifier-validated by the Go differ.\n   *\n   * Scope: columns-only plain btree. Partial (`where`) and expression indexes\n   * are a deliberate follow-up — modelling them needs the same raw-SQL\n   * normalization round-trip CHECK uses (Task 10), so they are NOT in this\n   * type yet to avoid a half-working partial-index path.\n   */\n  indexes?: { name: string; columns: string[] }[];\n  /** Arama beyanı — bkz. SearchDecl. */\n  search?: SearchDecl;\n  /** Hafıza beyanı — bkz. MemoryDecl (FR-032). */\n  memory?: MemoryDecl;\n}\n\n/**\n * A table definition — the runtime value the Go runtime's `schema_extract.js`\n * reads. It keys tables by `tableDef.name`, reads `tableDef.columns` for the\n * column DDL, and `tableDef.rls` + `tableDef.policies` for RLS.\n *\n * `defineSchema` derives `name` from the object key, so authors never repeat\n * the table name. `rls`/`policies` are always present after normalization\n * (defaulted to `true`/`[]`).\n *\n * The `C` type parameter preserves the precise per-column phantom types so that\n * downstream mapped types (InsertShape, RowShape) can discriminate on them.\n */\nexport interface TableDef<C extends ColumnMap = ColumnMap> {\n  name: string;\n  columns: C;\n  rls: boolean;\n  policies: PolicyDef[];\n  primaryKey?: string[];\n  unique?: { name: string; columns: string[] }[];\n  /** Named raw-SQL DDL objects emitted verbatim on deploy. Tracked by name. */\n  raw?: RawConstraintDef[];\n  /** Named first-class CHECK constraints. Diffed by name + (normalized) body. */\n  checks?: { name: string; expr: string }[];\n  /** Plain btree indexes (columns-only), emitted as standalone CREATE INDEX. Diffed by name. */\n  indexes?: { name: string; columns: string[] }[];\n  /** Arama beyanı, doğrulanmış ve taşınmış hali. */\n  search?: SearchDecl;\n  /** Hafıza beyanı, doğrulanmış ve taşınmış hali (FR-032). */\n  memory?: MemoryDecl;\n}\n\n/**\n * A schema definition containing multiple tables, keyed by table name.\n *\n * The `T` type parameter preserves the exact `TableDef<...>` type for each\n * table so that `SchemaDef[\"tables\"][\"rooms\"]` resolves to the precise\n * `TableDef<{ id: ColumnBuilder<'uuid', false, true, never>; ... }>`.\n */\nexport interface SchemaDef<\n  T extends Record<string, TableDef> = Record<string, TableDef>,\n> {\n  tables: T;\n  /** Postgres extensions to install on deploy. Normalized to `[]` when absent. */\n  extensions: PalbaseExtension[];\n}\n\n/** The author-facing input to `defineSchema` — a `tables` map whose keys are\n * the table names and whose values are `{ columns, rls?, policies? }`, plus an\n * optional `extensions` allowlist. */\nexport interface SchemaInput<\n  T extends Record<string, TableInput> = Record<string, TableInput>,\n> {\n  tables: T;\n  /**\n   * Postgres extensions to enable for this project, e.g. `[\"vector\"]`.\n   * Config-as-code: installed by the deploy (CREATE EXTENSION … SCHEMA\n   * extensions) with the privileged deploy connection. The type is an\n   * allowlist union, so unsupported names fail typecheck.\n   */\n  extensions?: PalbaseExtension[];\n}\n\n/** Map the author's `{ tables: { <name>: { columns } } }` input to the\n * `{ tables: { <name>: TableDef<columns> } }` runtime/type shape, threading the\n * per-table column map `T[K][\"columns\"]` so column-level inference survives. */\ntype TablesFromInput<T extends Record<string, TableInput>> = {\n  [K in keyof T]: TableDef<T[K][\"columns\"]>;\n};\n\n/** Normalize a single `policies` entry into a plain `PolicyDef` (read off a\n * `PolicyBuilder._def`, or passed through when already a `PolicyDef`). */\nfunction toPolicyDef(p: PolicyBuilder | PolicyDef): PolicyDef {\n  return p instanceof PolicyBuilder ? p._def : p;\n}\n\n/**\n * Define a schema. The table NAME comes from the object key. Each table value\n * is `{ columns, rls?, policies? }`:\n *\n *   export default defineSchema({\n *     tables: {\n *       todos: {\n *         columns: {\n *           id:    uuid().primaryKey().defaultRandom(),\n *           owner: text().notNull(),\n *           title: text().notNull(),\n *         },\n *         rls: true,\n *         policies: [\n *           policy(\"owner_all\").for(\"all\").to(\"authenticated\")\n *             .using(\"owner = (select auth.uid())\")\n *             .withCheck(\"owner = (select auth.uid())\"),\n *         ],\n *       },\n *     },\n *   });\n *\n * The returned value is\n * `{ tables: { todos: { name, columns, rls, policies } } }` — the exact shape\n * the runtime schema extractor parses. Per-column phantom types are preserved\n * so `Database.tables.todos.insert({...})` stays typed.\n *\n * RLS normalization: `rls` defaults to **`true`**, `policies` to `[]`. A table\n * that declares neither is therefore deny-all — nothing reads it until a policy\n * says who may, which is the safe starting point rather than a bug. Declare\n * `rls: false` for a genuinely public table; that is an explicit, greppable\n * statement of intent instead of an omission. When `policies` is non-empty,\n * `rls` is forced on (ENABLE + FORCE) regardless of the declared flag — a table\n * with policies must have RLS enabled or the policies would be inert.\n */\nexport function defineSchema<T extends Record<string, TableInput>>(\n  input: SchemaInput<T>,\n): SchemaDef<TablesFromInput<T>> {\n  const tables = {} as TablesFromInput<T>;\n  for (const name of Object.keys(input.tables) as (keyof T)[]) {\n    const table = input.tables[name];\n    // `noUncheckedIndexedAccess` widens the index access to `… | undefined`,\n    // but `name` comes straight from `Object.keys(input.tables)`, so the entry\n    // always exists. Guard to narrow without a cast.\n    if (table === undefined) continue;\n    const policies = (table.policies ?? []).map(toPolicyDef);\n    // Fail closed. RLS is on unless the schema explicitly says `rls: false`, and\n    // policies force it on regardless — a policy on a table without RLS enabled\n    // is inert, so declaring both is a contradiction that resolves towards the\n    // safe reading.\n    //\n    // This defaulted to `false` until 2026-08-07, which meant a table nobody\n    // thought about had no row-level security while `typed-db.ts` documented the\n    // default `Database.*` path as RLS-enforced. Both cannot be true, and the\n    // live proof settled which one was not: user B read user A's row in full\n    // through the typed client, while the same request against a table declaring\n    // `rls: true` returned 0 of 165 rows\n    // (docs/superpowers/uat/2026-08-07-rls-fail-open-proof.md). With no policies\n    // this is deny-all, so an unconsidered table now returns nothing instead of\n    // returning everything to everyone.\n    const rls = policies.length > 0 || table.rls !== false;\n    const tableDef: TableDef<T[typeof name][\"columns\"]> = {\n      name: name as string,\n      columns: table.columns,\n      rls,\n      policies,\n    };\n    if (table.primaryKey !== undefined) tableDef.primaryKey = table.primaryKey;\n    if (table.unique !== undefined) tableDef.unique = table.unique;\n    if (table.raw !== undefined && table.raw.length > 0) tableDef.raw = table.raw.slice();\n    if (table.checks !== undefined && table.checks.length > 0) tableDef.checks = table.checks.slice();\n    if (table.indexes !== undefined && table.indexes.length > 0) tableDef.indexes = table.indexes.slice();\n    if (table.search !== undefined) {\n      const s = table.search;\n      // Erken, beyan-anı doğrulama (apply doğrulamasını İKAME ETMEZ — yazım\n      // hatası deploy'a gitmeden yazarın yüzüne söylenir).\n      if (s.from !== undefined) {\n        // YENİ biçim (D-007). Eski alanlarla karışım tek biçime zorlanır:\n        // iki yarım beyanın hangisinin kazandığını okuyucu bilemez.\n        if (s.vector !== undefined) {\n          throw new Error(\n            `table ${String(name)}: search beyanında tek biçim kullanın — 'from' (yeni) ile 'vector' (eski) birlikte olamaz`,\n          );\n        }\n        if (s.from.length === 0) {\n          throw new Error(`table ${String(name)}: search.from boş olamaz`);\n        }\n        if (s.model === undefined) {\n          throw new Error(\n            `table ${String(name)}: search.from model'siz anlamsız — auto-embed için model verin (BYO için eski 'vector' biçimini kullanın)`,\n          );\n        }\n        if (Array.isArray(s.text) && s.text.length === 0) {\n          throw new Error(`table ${String(name)}: search.text boş dizi olamaz — FTS istemiyorsan text: false yazın`);\n        }\n      } else {\n        // ESKİ biçim — davranış ve hata metinleri aynen (NFR-B1'in DX yarısı).\n        if (typeof s.text === \"boolean\") {\n          throw new Error(`table ${String(name)}: text:${String(s.text)} yalnız yeni biçimde ('from' ile) geçerli`);\n        }\n        if (s.text === undefined && s.vector === undefined) {\n          throw new Error(\n            `table ${String(name)}: search beyanı boş — en az bir kol (text ya da vector) verin, yoksa alanı hiç yazmayın`,\n          );\n        }\n        if (s.text !== undefined && s.text.length === 0) {\n          throw new Error(`table ${String(name)}: search.text boş olamaz — FTS kolu istemiyorsan alanı hiç yazma`);\n        }\n        const legs = s.vector === undefined ? [] : Array.isArray(s.vector) ? s.vector : [s.vector];\n        for (const leg of legs) {\n          if (leg.model !== undefined && (leg.from === undefined || leg.from.length === 0)) {\n            throw new Error(`table ${String(name)}: search.vector.model beyan edildi ama 'from' yok — embed kaynağı kolonlar zorunlu (C-2)`);\n          }\n          if (leg.model === undefined && leg.from !== undefined) {\n            throw new Error(`table ${String(name)}: search.vector.from model'siz anlamsız — auto-embed için model verin`);\n          }\n        }\n      }\n      tableDef.search = s;\n    }\n    if (table.memory !== undefined) {\n      if (table.memory.from.length === 0) {\n        throw new Error(`table ${String(name)}: memory.from boş olamaz`);\n      }\n      tableDef.memory = table.memory;\n    }\n    tables[name] = tableDef;\n  }\n  // memory beyanları TABLOLAR-ARASI doğrulanır (into/subject/fact) — tüm\n  // tablolar kurulduktan sonra: beyan sırasına bağımlılık olmasın (FR-032).\n  for (const [name, def] of Object.entries(tables)) {\n    const m = (def as TableDef).memory;\n    if (m === undefined) continue;\n    const target = Object.values(tables).find((t) => (t as TableDef).name === m.into) as TableDef | undefined;\n    if (target === undefined) {\n      throw new Error(`table ${name}: memory.into \"${m.into}\" şemada declared değil`);\n    }\n    const subject = m.subject ?? \"owner\";\n    if (!(subject in (def as TableDef).columns)) {\n      throw new Error(`table ${name}: memory.subject \"${subject}\" kolonu kaynak tabloda yok`);\n    }\n    if (!(subject in target.columns)) {\n      throw new Error(`table ${name}: memory.subject \"${subject}\" kolonu hedef \"${m.into}\" tablosunda yok`);\n    }\n    const factCol = target.columns[\"fact\"];\n    const factDef = factCol !== undefined && \"_def\" in (factCol as object)\n      ? (factCol as { _def: { type?: string } })._def\n      : (factCol as { type?: string } | undefined);\n    if (factDef === undefined || factDef.type !== \"text\") {\n      throw new Error(`table ${name}: memory.into \"${m.into}\" tablosunda \"fact\" (text) kolonu zorunlu`);\n    }\n    for (const c of m.from) {\n      if (!(c in (def as TableDef).columns)) {\n        throw new Error(`table ${name}: memory.from kolonu \"${c}\" kaynak tabloda yok`);\n      }\n    }\n  }\n  // Dedupe + normalize extensions (order-independent; deploy resolves deps).\n  const extensions = [...new Set(input.extensions ?? [])];\n  return { tables, extensions };\n}\n","/**\n * Postgres extensions a Palbase project can enable from its schema.\n *\n * Extensions are config-as-code: declare them in `defineSchema({ extensions })`\n * and the deploy installs them (CREATE EXTENSION … SCHEMA extensions) using the\n * deploy path's privileged connection. They are NOT toggled live from Studio —\n * CREATE EXTENSION requires a superuser role that only the deploy path holds.\n *\n * The list is an allowlist (a string-literal union) so editors autocomplete the\n * supported names and a typo fails typecheck. It is intentionally extensible:\n * add a name here (+ confirm the base image ships it) to support more.\n */\nexport const PALBASE_EXTENSIONS = [\n  // Search & text\n  \"vector\", // pgvector: AI embeddings + vector similarity search (semantic search / RAG).\n  // NB: the Postgres extension is named \"vector\", not \"pgvector\" — declare \"vector\".\n  \"pg_trgm\", // trigram fuzzy / typo-tolerant text search\n  \"unaccent\", // accent-insensitive text search\n  \"citext\", // case-insensitive text type\n  // Geospatial / location\n  \"cube\", // multi-dimensional cubes (dependency of earthdistance)\n  \"earthdistance\", // great-circle distance (needs cube)\n  // Data types & structures\n  \"hstore\", // key/value pairs in a single column\n  \"ltree\", // hierarchical tree-structured labels\n  // Indexing & constraints\n  \"btree_gist\", // GiST operator classes for scalar types — needed for EXCLUDE\n  // constraints that mix \"=\" with a range/&& overlap (e.g. no-double-booking).\n  // Scheduling\n  // Crypto / ids (also installed by default; listable for explicitness)\n  \"pgcrypto\", // cryptographic functions (hashing, encryption)\n  \"uuid-ossp\", // UUID generation functions\n] as const;\n\n/** A Postgres extension supported by Palbase (allowlist union). */\nexport type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];\n\n/**\n * Extensions that depend on another extension. The deploy installs\n * dependencies first; declaring `earthdistance` without `cube` still works\n * because the deploy resolves the order, but listing both is clearer.\n */\nexport const EXTENSION_DEPENDENCIES: Partial<Record<PalbaseExtension, PalbaseExtension[]>> = {\n  earthdistance: [\"cube\"],\n};\n\n/** Runtime guard: is `name` a supported Palbase extension? */\nexport function isPalbaseExtension(name: string): name is PalbaseExtension {\n  return (PALBASE_EXTENSIONS as readonly string[]).includes(name);\n}\n","/** On delete action for foreign key references. */\nexport type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';\n\n/**\n * The ON DELETE actions permitted on a foreign key to the built-in auth users\n * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached\n * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK\n * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the\n * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real\n * boundary, this narrows the type so the common mistake is caught at compile time.\n */\nexport type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;\n\n/** Column type identifiers. */\nexport type ColumnType =\n  | 'uuid'\n  | 'text'\n  | 'integer'\n  | 'bigint'\n  | 'numeric'\n  | 'boolean'\n  | 'timestamp'\n  | 'jsonb'\n  | 'enum'\n  | 'vector';\n\n/** Base column definition shared by all column types. */\nexport interface ColumnDef {\n  type: ColumnType;\n  nullable: boolean;\n  primaryKey: boolean;\n  defaultValue?: unknown;\n  defaultRandom?: boolean;\n  defaultNow?: boolean;\n  references?: { table: string; column: string };\n  /**\n   * The name this column used to have. A diff cannot tell a rename from a drop and\n   * an add — both leave one name gone and another present — so the intent has to be\n   * declared. Without it, renaming a column loses its data.\n   */\n  renamedFrom?: string;\n  onDeleteAction?: OnDeleteAction;\n  enumName?: string;\n  enumValues?: string[];\n  unique?: boolean;\n  /**\n   * The value is written by the DATABASE — a trigger, a rule, an identity — not by\n   * the author and not by a DEFAULT this schema declares. It makes the column\n   * optional on INSERT without putting a DEFAULT in the DDL.\n   *\n   * Before this existed the only way to keep a trigger-filled column off the\n   * INSERT type was to give it a fake `default()`: a value the schema claimed to\n   * write and the trigger immediately overwrote. That made the schema lie about\n   * its own data.\n   */\n  dbAssigned?: boolean;\n  /** vector(n): the declared dimension count — part of the TYPE (typmod), read\n   * by the wire serializer and the deploy's auto-index (FR-001). */\n  dimensions?: number;\n}\n\n/** FR-002: a vector column cannot carry keys/defaults/references — the modifier\n * is named in the error so the author fixes the right line. */\nfunction refuseOnVector(def: ColumnDef, modifier: string): void {\n  if (def.type === 'vector') {\n    throw new Error(`vector column: .${modifier}() is not supported (FR-002 — allowed: nullable()/notNull())`);\n  }\n}\n\n// Phantom brand symbols — never have runtime values; exist only to force\n// TypeScript's structural type system to distinguish ColumnBuilder instances\n// with different type-param combinations. Without these, TS sees all\n// ColumnBuilder<K,...> as structurally identical and the first branch of\n// ColValue matches everything.\ndeclare const __colKind: unique symbol;\ndeclare const __colNullable: unique symbol;\ndeclare const __colHasDefault: unique symbol;\ndeclare const __colEnumValues: unique symbol;\ndeclare const __colPayload: unique symbol;\n\n/**\n * Fluent column builder with phantom type params:\n *  K — ColumnType literal (e.g. \"text\", \"integer\")\n *  N — boolean: true when nullable() has been called last (false = NOT NULL)\n *  D — boolean: true when a default has been set\n *  E — enum value union (never for non-enum columns)\n *  P — jsonb payload shape (unknown unless jsonb<T>() supplied one)\n *\n * All five params have defaults so bare `ColumnBuilder` (no args) still\n * satisfies `Record<string, ColumnBuilder>` in schema.ts without modification.\n *\n * The five `declare readonly` brand fields carry the phantom types into the\n * structural shape so that conditional types like ColValue<C> can discriminate\n * on K without requiring runtime values on those fields.\n */\nexport class ColumnBuilder<\n  K extends ColumnType = ColumnType,\n  N extends boolean = boolean,\n  D extends boolean = boolean,\n  E = unknown,\n  P = unknown,\n> {\n  // These fields exist only in the type layer (declared, never initialised at\n  // runtime — TypeScript allows declared class members without an initializer\n  // in strict mode as long as they're never read at runtime).\n  declare readonly [__colKind]: K;\n  declare readonly [__colNullable]: N;\n  declare readonly [__colHasDefault]: D;\n  declare readonly [__colEnumValues]: E;\n  declare readonly [__colPayload]: P;\n\n  readonly _def: ColumnDef;\n\n  constructor(type: K, existingDef?: ColumnDef) {\n    this._def = existingDef ?? {\n      type,\n      nullable: false,\n      primaryKey: false,\n    };\n  }\n\n  /** Mark this column as the primary key. */\n  primaryKey(): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, 'primaryKey');\n    this._def.primaryKey = true;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Mark this column as NOT NULL (default). */\n  notNull(): ColumnBuilder<K, false, D, E, P> {\n    this._def.nullable = false;\n    return new ColumnBuilder<K, false, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Allow NULL values. */\n  nullable(): ColumnBuilder<K, true, D, E, P> {\n    this._def.nullable = true;\n    return new ColumnBuilder<K, true, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Set a default value. */\n  default(value: unknown): ColumnBuilder<K, N, true, E, P> {\n    refuseOnVector(this._def, 'default');\n    this._def.defaultValue = value;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /** UUID: generate a random default (gen_random_uuid()). */\n  defaultRandom(): ColumnBuilder<K, N, true, E, P> {\n    refuseOnVector(this._def, 'defaultRandom');\n    this._def.defaultRandom = true;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Timestamp: default to now(). */\n  defaultNow(): ColumnBuilder<K, N, true, E, P> {\n    refuseOnVector(this._def, 'defaultNow');\n    this._def.defaultNow = true;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /**\n   * The DATABASE assigns this column's value — a trigger, a rule, an identity.\n   *\n   * The column becomes optional on INSERT (the author has nothing to send) while\n   * the DDL stays free of a DEFAULT this schema would not honour. It is NOT\n   * `default()`: that declares a value the schema promises to write.\n   *\n   * Naming: deliberately not `generated()`. Postgres has GENERATED columns and\n   * they are a different thing; borrowing the word would send a reader — or a\n   * model writing a schema — to the wrong feature.\n   */\n  dbAssigned(): ColumnBuilder<K, N, true, E, P> {\n    this._def.dbAssigned = true;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Add a foreign key reference. */\n  /**\n   * Declares that this column used to be called `previous`.\n   *\n   * A schema diff sees one name gone and another present; it cannot know whether\n   * you renamed a column or dropped one and added another, and the two are very\n   * different — the second loses every value. Saying so here turns the plan into\n   * `ALTER TABLE … RENAME COLUMN` instead.\n   *\n   * Once the rename has been applied the annotation is inert (the old name is no\n   * longer there to rename), so it can be deleted at your leisure.\n   */\n  renamedFrom(previous: string): ColumnBuilder<K, N, D, E, P> {\n    this._def.renamedFrom = previous;\n    return this as unknown as ColumnBuilder<K, N, D, E, P>;\n  }\n\n  references(table: string, column: string): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, 'references');\n    this._def.references = { table, column };\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /**\n   * Add a real DB-level foreign key to the built-in auth users\n   * (`REFERENCES auth.users(id)`), so a column like `user_id` gets true\n   * database cascade/integrity instead of app-layer-only. Sugar for\n   * `.references(\"auth.users\", \"id\")`.\n   *\n   * `auth.users` lives in the SAME tenant database (palauth-owned), so this is\n   * a genuine cross-schema integrity constraint scoped to THIS tenant's users.\n   * The referenced `auth.users.id` is `text` (palauth ids are `usr_<uuid>`), so\n   * the referencing column must be `text()` too.\n   *\n   * ON DELETE is REQUIRED here and may only be `cascade` or `set null`: an\n   * account-erasure request must never be blocked by a lingering FK, so\n   * `restrict` / `no action` are not accepted (they don't type-check). Example:\n   * `text().notNull().referencesAuthUser(\"cascade\")`, or\n   * `text().nullable().referencesAuthUser(\"set null\")`. The server\n   * (validateAuthUserFK) enforces this — and the remaining rules the type can't\n   * express (referencing column is text, `set null` needs a nullable column) —\n   * as the real boundary; this signature is the compile-time DX mirror.\n   */\n  referencesAuthUser(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, \"referencesAuthUser\");\n    this._def.references = { table: 'auth.users', column: 'id' };\n    this._def.onDeleteAction = onDelete;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /**\n   * Add a real DB-level foreign key to the canonical, server-minted installation\n   * anchor (`REFERENCES auth.installations(id)`) — the app-scoped verified-device\n   * root (`ins_...`). Sugar for `.references(\"auth.installations\", \"id\")`.\n   *\n   * An installation is an APP INSTALL, not a user: this FK is NOT user ownership.\n   * A user-owned row STILL needs its own `.referencesAuthUser(...)` FK so account\n   * erasure removes it — an installation reference alone does not tie a row to a\n   * user's deletion. Use this only for install-scoped state (device prefs, push\n   * routing, …), alongside a separate auth-user FK where the row is user-owned.\n   *\n   * `auth.installations` lives in the SAME tenant DB (palauth-owned); its `id` is\n   * `text` (`ins_<uuid>`), so the referencing column must be `text()` too. ON\n   * DELETE is REQUIRED and may only be `cascade` or `set null` (same allowed set\n   * as an auth-user FK): an installation revoke / orphan cleanup must never be\n   * blocked by a lingering FK. The server (validateAuthAnchorFK) is the real\n   * boundary; this signature is the compile-time DX mirror.\n   */\n  referencesInstallation(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, \"referencesInstallation\");\n    this._def.references = { table: 'auth.installations', column: 'id' };\n    this._def.onDeleteAction = onDelete;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Set the ON DELETE action for a foreign key reference. */\n  onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P> {\n    this._def.onDeleteAction = action;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Add a single-column UNIQUE constraint. */\n  unique(): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, 'unique');\n    this._def.unique = true;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Type extractors — imported by Task 2 to derive insert/row shapes.\n// ---------------------------------------------------------------------------\n\n/**\n * Extracts the TypeScript value type for a column, respecting nullability.\n * - \"uuid\" | \"text\" | \"timestamp\" | \"bigint\" | \"numeric\" → string (or string | null when N = true)\n *   Note: bigint/numeric surface as string — JS number loses precision past 2^53,\n *   and pgx/PostgREST serialize int8/numeric as strings. App code uses\n *   BigInt(row.amount) for bigint, or a decimal lib for numeric.\n * - \"integer\" → number\n * - \"boolean\" → boolean\n * - \"jsonb\" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)\n * - \"enum\" → E (the union of literal values)\n */\nexport type ColValue<C> =\n  C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P>\n    ? N extends true\n      ? string | null\n      : string\n    : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P>\n      ? N extends true\n        ? number | null\n        : number\n      : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P>\n        ? N extends true\n          ? boolean | null\n          : boolean\n        : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P>\n          ? N extends true\n            ? P | null\n            : P\n          : C extends ColumnBuilder<'vector', infer N, infer _D, infer _E, infer _P>\n            ? N extends true\n              ? number[] | null\n              : number[]\n            : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P>\n              ? N extends true\n                ? E | null\n                : E\n              : never;\n\n/**\n * True when a column is optional on INSERT:\n *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted\n *  - columns with a default (D = true) — the DB fills in the value when absent\n */\nexport type ColIsOptionalOnInsert<C> =\n  C extends ColumnBuilder<infer _K, true, infer _D, infer _E>\n    ? true\n    : C extends ColumnBuilder<infer _K, infer _N, true, infer _E>\n      ? true\n      : false;\n\n// ---------------------------------------------------------------------------\n// Factory functions\n// ---------------------------------------------------------------------------\n\n/** Create a UUID column. */\nexport function uuid(): ColumnBuilder<'uuid', false, false, never> {\n  return new ColumnBuilder('uuid');\n}\n\n/** Create a TEXT column. */\nexport function text(): ColumnBuilder<'text', false, false, never> {\n  return new ColumnBuilder('text');\n}\n\n/** Create an INTEGER column. Emits int4 (max ~2.1B). */\nexport function integer(): ColumnBuilder<'integer', false, false, never> {\n  return new ColumnBuilder('integer');\n}\n\n/**\n * Create a BIGINT column (Postgres int8, max ~9.2×10^18).\n * Surfaces as `string` in row/insert types — JS number loses precision past 2^53\n * and pgx/PostgREST serialize int8 as a JSON string. Use BigInt(row.column) in app code.\n */\nexport function bigint(): ColumnBuilder<'bigint', false, false, never> {\n  return new ColumnBuilder('bigint');\n}\n\n/**\n * Create a NUMERIC column (Postgres `numeric`/`decimal`, arbitrary precision).\n * For exact fractional values (money with cents as a decimal, rates, weights)\n * where int4/int8 don't fit. Surfaces as `string` in row/insert types — JS\n * number can't hold arbitrary-precision decimals without rounding, and\n * pgx/PostgREST serialize numeric as a JSON string. Parse with a decimal lib\n * (or BigInt for scaled integers) in app code.\n */\nexport function numeric(): ColumnBuilder<'numeric', false, false, never> {\n  return new ColumnBuilder('numeric');\n}\n\n/** Create a BOOLEAN column. */\nexport function boolean(): ColumnBuilder<'boolean', false, false, never> {\n  return new ColumnBuilder('boolean');\n}\n\n/** Create a TIMESTAMP column. */\nexport function timestamp(): ColumnBuilder<'timestamp', false, false, never> {\n  return new ColumnBuilder('timestamp');\n}\n\n/**\n * Create a JSONB column. Pass a payload type to make the generated row/insert\n * type concrete instead of `unknown`:\n *\n *   tags: jsonb<string[]>()           // row.tags: string[]\n *   meta: jsonb<{ tier: string }>()   // row.meta: { tier: string }\n *   raw:  jsonb()                      // row.raw: unknown (back-compat)\n *\n * The runtime accepts a plain JS object/array directly (no JSON.stringify); the\n * generic only refines the TYPE the env codegen emits.\n */\nexport function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, never, T> {\n  return new ColumnBuilder('jsonb');\n}\n\n/**\n * Create an ENUM column.\n * @param name   The PostgreSQL enum type name (used in DDL).\n * @param values A readonly tuple of valid string values — kept `const` so the\n *               union `V[number]` is as narrow as possible.\n */\nexport function enumType<const V extends readonly string[]>(\n  name: string,\n  values: V,\n): ColumnBuilder<'enum', false, false, V[number]> {\n  const builder = new ColumnBuilder<'enum', false, false, V[number]>('enum');\n  builder._def.enumName = name;\n  builder._def.enumValues = [...values];\n  return builder;\n}\n\n/** vector(n) — pgvector kolonu. n TİPİN parçasıdır (typmod) ve [1, 2000] —\n * 2000 = pgvector'ün HNSW-indekslenebilir tavanı; auto-index bu beyanla bağlı\n * (spec FR-001, D-3). */\nexport function vector(dimensions: number): ColumnBuilder<'vector', false, false, unknown, number[]> {\n  if (!Number.isInteger(dimensions) || dimensions < 1 || dimensions > 2000) {\n    throw new Error(`vector(): dimensions must be an integer in [1, 2000], got ${String(dimensions)}`);\n  }\n  const b = new ColumnBuilder('vector') as ColumnBuilder<'vector', false, false, unknown, number[]>;\n  (b._def as { dimensions?: number }).dimensions = dimensions;\n  return b;\n}\n","/**\n * A named raw-SQL DDL object declared in db/schema.ts for anything the typed DSL\n * cannot express (EXCLUDE, CHECK, partial/expression indexes, triggers, views).\n * The deploy emits `up` verbatim on the privileged DDL connection — same trust\n * posture as policy().using(). Tracked by NAME (not by diffing the body), so a\n * changed body needs a new name or an explicit drop+add.\n */\nexport interface RawConstraintDef {\n  name: string;\n  up: string;\n  down?: string;\n}\n\nexport function raw(name: string, up: string, opts?: { down?: string }): RawConstraintDef {\n  return { name, up, ...(opts?.down != null ? { down: opts.down } : {}) };\n}\n","/** Embedding sağlayıcı DESKRIPTORU — canlı istemci değil, düz veri: şemayla\n * birlikte serileşir, çağrıyı Go worker (yazma) ve engine (sorgu) yapar.\n * Adlandırma Vercel AI SDK'nın aynasıdır (openai.embedding(\"...\")) ama paket\n * bağımlılığı bilinçli olarak YOKTUR (spec C-3, UD-016). v1 sağlayıcı: openai (D-10). */\nexport interface EmbeddingModelRef {\n  provider: \"openai\";\n  model: string;\n  dimensions?: number;\n  apiKeyName?: string;\n  baseURL?: string;\n}\n/** Chat/damıtma modeli DESKRIPTORU (C-11, D-019) — memory beyanının extract'i.\n * Embedding gibi düz veridir; çağrıyı worker yapar, anahtar vault'taki\n * OPENAI_API_KEY'dir (D-017: aynı sağlayıcı, yeni dış sistem yok). */\nexport interface ChatModelRef {\n  provider: \"openai\";\n  model: string;\n}\nexport const openai = {\n  embedding(\n    model: string,\n    opts?: { dimensions?: number; apiKeyName?: string; baseURL?: string },\n  ): EmbeddingModelRef {\n    return { provider: \"openai\", model, apiKeyName: opts?.apiKeyName ?? \"OPENAI_API_KEY\",\n      ...(opts?.dimensions !== undefined ? { dimensions: opts.dimensions } : {}),\n      ...(opts?.baseURL !== undefined ? { baseURL: opts.baseURL } : {}) };\n  },\n  chat(model: string): ChatModelRef {\n    return { provider: \"openai\", model };\n  },\n};\n","/**\n * typed-db.ts — Task 2: TypedDB schema-derived insert/row shapes.\n *\n * Derives INSERT and full-row TypeScript types from a `defineSchema()` result\n * and wraps the untyped runtime `DBClient` with a typed facade.\n *\n * No value-any. No `as unknown as X`. The two narrow `as` casts in\n * `makeTypedTable` are safe because:\n *  - `data as Record<string, unknown>`: InsertShape<T> maps string keys to\n *    typed values; all value types are subsets of `unknown`, so the cast is\n *    structurally sound.\n *  - `result as RowShape<T>`: The runtime DBClient returns `Record<string,\n *    unknown>` which is the erased form of the typed row; we're narrowing back\n *    to the precise shape that the schema declared.\n * Both casts are narrowing only (not widening) and correctness is guaranteed\n * by the schema the caller provides.\n */\n\nimport type { ColValue, ColIsOptionalOnInsert, ColumnBuilder } from \"./columns.js\";\nimport type { TableDef, SchemaDef } from \"./schema.js\";\nimport type { Tables, TableTypes } from \"./env.js\";\nimport type { DBClient, DBOps } from \"../endpoint.js\";\nimport type { Materialized, TxPlanHandle, TxTable } from \"./tx-plan.js\";\nimport { TxPlanBuilder, runTxPlan } from \"./tx-plan.js\";\n\n// ---------------------------------------------------------------------------\n// Key discriminators — split a column map into required vs optional keys.\n// ---------------------------------------------------------------------------\n\n/** Keys of C whose columns are required on INSERT (not nullable, no default). */\ntype RequiredKeys<C> = {\n  [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? never : K;\n}[keyof C];\n\n/** Keys of C whose columns are optional on INSERT (nullable or has a default). */\ntype OptionalKeys<C> = {\n  [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? K : never;\n}[keyof C];\n\n// ---------------------------------------------------------------------------\n// Public shape types — exported so callers can reference them directly.\n// ---------------------------------------------------------------------------\n\n/**\n * The TypeScript type for an INSERT payload for table `T`.\n * - Required: columns that are NOT NULL and have no DB-level default.\n * - Optional: columns that are nullable or carry a default.\n *\n * When all columns are optional, `RequiredKeys<C>` resolves to `never` and\n * the first part becomes `{}`, which is a neutral element for `&`.\n */\nexport type InsertShape<T extends TableDef> = {\n  [K in RequiredKeys<T[\"columns\"]>]: ColValue<T[\"columns\"][K]>;\n} & {\n  [K in OptionalKeys<T[\"columns\"]>]?: ColValue<T[\"columns\"][K]>;\n};\n\n/**\n * The TypeScript type for a full row returned by the DB for table `T`.\n * Every column is present; nullable columns resolve to `T | null`.\n */\nexport type RowShape<T extends TableDef> = {\n  [K in keyof T[\"columns\"]]: ColValue<T[\"columns\"][K]>;\n};\n\n// ---------------------------------------------------------------------------\n// TypedTable + TypedDB interfaces.\n// ---------------------------------------------------------------------------\n\n/** A typed table accessor that mirrors the runtime DBClient surface. */\nexport interface TypedTable<T extends TableDef> {\n  insert(data: InsertShape<T>): Promise<RowShape<T>>;\n  upsert(data: InsertShape<T>, opts: { onConflict: readonly string[] }): Promise<RowShape<T>>;\n  /** Update the row by id; resolves to the updated row, or `null` if no row\n   * matched (absent or RLS-hidden) — an idempotent outcome, mirroring\n   * `findById`. The runtime returns a null row rather than throwing. */\n  update(id: string, data: Partial<InsertShape<T>>): Promise<RowShape<T> | null>;\n  delete(id: string): Promise<void>;\n  findById(id: string): Promise<RowShape<T> | null>;\n  findMany(query?: Partial<RowShape<T>>): Promise<RowShape<T>[]>;\n}\n\n/** A typed DB facade covering all tables declared in schema `S`. */\nexport interface TypedDB<S extends SchemaDef> {\n  tables: {\n    [K in keyof S[\"tables\"]]: TypedTable<S[\"tables\"][K]>;\n  };\n  /** Run a transaction plan. See {@link EnvTypedDatabase.transaction}. */\n  transaction<T>(\n    fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T,\n  ): Promise<Materialized<T>>;\n}\n\n/** The plan-building handle a `TypedDB<S>` transaction callback receives: the\n * schema's tables, expressed as plan operations rather than awaited calls. */\nexport type TypedTx<S extends SchemaDef> = TxPlanHandle<{\n  [K in keyof S[\"tables\"]]: TxTable<RowShape<S[\"tables\"][K]>, InsertShape<S[\"tables\"][K]>>;\n}>;\n\n// ---------------------------------------------------------------------------\n// Runtime factory.\n// ---------------------------------------------------------------------------\n\n/**\n * Builds a typed table accessor that delegates every call to `raw` using the\n * runtime table name string. Two narrow `as` casts bridge the mapped-type\n * shapes to/from `Record<string, unknown>` — see module-level doc comment.\n *\n * The `raw` param is typed `DBOps` (the six string-keyed ops) because this only\n * ever calls those — never `txPlan`, which builds its own operations rather than\n * delegating to these.\n */\nfunction makeTypedTable<T extends TableDef<Record<string, ColumnBuilder>>>(\n  name: string,\n  raw: DBOps,\n): TypedTable<T> {\n  return {\n    insert: (data: InsertShape<T>) =>\n      raw.insert(name, data as Record<string, unknown>) as Promise<RowShape<T>>,\n\n    upsert: (data: InsertShape<T>, opts: { onConflict: readonly string[] }) =>\n      raw.upsert(name, data as Record<string, unknown>, opts) as Promise<RowShape<T>>,\n\n    update: (id: string, data: Partial<InsertShape<T>>) =>\n      raw.update(name, id, data as Record<string, unknown>) as Promise<RowShape<T> | null>,\n\n    delete: (id: string) => raw.delete(name, id),\n\n    findById: (id: string) =>\n      raw.findById(name, id) as Promise<RowShape<T> | null>,\n\n    findMany: (query?: Partial<RowShape<T>>, opts?: Parameters<DBOps[\"findMany\"]>[2]) =>\n      raw.findMany(name, query as Record<string, unknown> | undefined, opts) as Promise<RowShape<T>[]>,\n  };\n}\n\n/**\n * Wraps a raw `DBClient` with the type-safe `TypedDB<S>` facade derived from\n * the provided schema. No behavior change for the direct ops — all calls\n * delegate to `raw` with the table name as a plain string.\n *\n * `transaction` does NOT delegate to a per-op client: the callback describes a\n * plan against a fresh {@link TxPlanBuilder}, and the whole plan travels in one\n * `raw.txPlan` call. The schema is used only for its table NAMES; the values\n * are typed by `S` at compile time and are plain strings at run time.\n *\n * The `as` casts are single structural narrowings from a dynamically-built\n * object to the precise mapped type (TS cannot infer the mapped-type result\n * through `Object.keys` iteration) — see the module-level doc comment.\n */\nexport function makeTypedDB<S extends SchemaDef>(\n  schema: S,\n  raw: DBClient,\n): TypedDB<S> {\n  const tables = {} as Record<string, TypedTable<TableDef>>;\n  for (const key of Object.keys(schema.tables)) {\n    const tableDef = schema.tables[key];\n    if (tableDef !== undefined) {\n      tables[key] = makeTypedTable(tableDef.name, raw);\n    }\n  }\n\n  const result = {\n    tables,\n    transaction<T>(\n      fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T,\n    ): Promise<Materialized<T>> {\n      const builder = new TxPlanBuilder();\n      const planTables: Record<string, unknown> = {};\n      for (const key of Object.keys(schema.tables)) {\n        const tableDef = schema.tables[key];\n        if (tableDef !== undefined) planTables[key] = builder.table(tableDef.name);\n      }\n      // Two narrowings at the same seam: the plan tables are built by NAME, so\n      // TS cannot see the mapped type through the loop, and the driver erases\n      // the callback's return type (see runTxPlan's doc). Both are the erasure\n      // this facade exists to undo.\n      return runTxPlan(\n        raw,\n        planTables as TypedTx<S>[\"tables\"],\n        builder,\n        fn,\n      ) as Promise<Materialized<T>>;\n    },\n  };\n\n  // Narrow cast: `result.tables` is structurally identical to\n  // TypedDB<S>[\"tables\"] — each key maps to a TypedTable for the matching\n  // TableDef. TS cannot infer the mapped-type result through Object.keys\n  // iteration, so a single `as` bridges the gap.\n  return result as TypedDB<S>;\n}\n\n// ---------------------------------------------------------------------------\n// Env-augmentation-driven typed surface — the typed-by-default `Database`.\n//\n// These types read the globally-augmented `Tables` interface from\n// `@palbase/backend/env` (filled by the generated `palbase-env.d.ts`). They\n// back `Database.tables.<name>` so handler code is typed with no import and no\n// generic (C5). They DELIBERATELY do not reference `ColumnBuilder` — the env\n// `Tables` interface carries flat `row`/`insert` object types.\n// ---------------------------------------------------------------------------\n\n/** Bir where değeri: düz eşitlik YA DA operatör nesnesi (FR-016). */\nexport type WhereOp<V> = V | { gt?: V; gte?: V; lt?: V; lte?: V; neq?: V; in?: V[] };\n\n/** search() parametreleri, satır tipiyle koşullanmış (FR-013). `offset` BİLEREK yok (UD-013). */\nexport interface SearchParamsTyped<T extends TableTypes> {\n  /** Metin sorgusu: FTS kolunu besler; embed beyanlıysa sorgu vektörü de bundan üretilir. */\n  query?: string;\n  /** Hazır sorgu vektörü — verilirse embed çağrısı olmaz (FR-025). */\n  vector?: number[];\n  where?: { [K in keyof T[\"row\"]]?: WhereOp<T[\"row\"][K]> };\n  /** default 20, tavan 100 (engine uygular). */\n  limit?: number;\n  /** Birden çok vektör kolonunda hedef seçimi (model geçişi, FR-013/using). */\n  using?: string;\n  mode?: \"hybrid\" | \"text\" | \"vector\";\n  /** Nihai (RRF-sonrası) skor alt eşiği — süzme LIMIT'ten önce uygulanır (FR-001). */\n  minScore?: number;\n  /** Chunk-modunda satır başına en iyi blok sayısı (1..10, vars. 3; FR-015). */\n  blocksPerRow?: number;\n  /** Tazelik çürümesi: nihai skor RRF-sonrası exp(-ln(2)*yaş/halfLife) ile çarpılır;\n   * field bir timestamp kolonu, halfLife \"90s\" | \"15m\" | \"12h\" | \"30d\" biçiminde (FR-004). */\n  recency?: { field: Extract<keyof T[\"row\"], string>; halfLife: string };\n  /** Filtrelenmiş küme üzerinde kolon başına top-20 değer sayacı — dönüş\n   * dizisinin `_facets` özelliği (FR-027). */\n  facets?: Extract<keyof T[\"row\"], string>[];\n  /** Satır-modunda FTS eşleşme vurgusu: sonuç satırına `_highlight` ekler;\n   * chunk-modda no-op — bloklar zaten eşleşen kesittir (FR-025). */\n  highlight?: boolean;\n  /** Validity'li tabloda zaman penceresi: varsayılan yalnız güncel versiyon;\n   * \"all\" tüm versiyonlar; {asOf} o anda geçerli olan (FR-029). */\n  validity?: \"all\" | { asOf: string };\n  /** Alan-boost (FR-030): skor * (1 + w·x/(1+x)) — sayısal kolonla sınırlı\n   * çarpan, dış servissiz; bileşim RRF → boost → recency → minScore. */\n  boost?: { field: Extract<keyof T[\"row\"], string>; weight: number };\n}\n\n/** search() dönüş dizisinin sorgu-düzeyi ekleri (FR-027): `_facets` dizinin\n * ÖZELLİĞİDİR, satırlara kopyalanmaz (JSON'a satır başına şişme olmasın). */\nexport type SearchFacets = Record<string, { value: string | null; count: number }[]>;\n\n/** similar()/recommend() taşıyıcı opsiyonları (T018, FR-022): search'ün\n * paramlarından query/vector/mode düşer — hedef vektörü metodun kendisi\n * DB'den kurar; facets/highlight de düşer (T020) — engine bu ikisini\n * similar/recommend'e geçirmez, tip vaadi gerçekle aynı kalır. */\nexport type SimilarParamsTyped<T extends TableTypes> = Omit<\n  SearchParamsTyped<T>,\n  \"query\" | \"vector\" | \"mode\" | \"facets\" | \"highlight\"\n>;\n\n/** recommend() parametreleri (T018, FR-023). */\nexport type RecommendParamsTyped<T extends TableTypes> = SimilarParamsTyped<T> & {\n  /** Kaynak beğeniler — hedef vektör bunların DB-içi avg'ı; boş olamaz. */\n  positive: string[];\n  /** İtilen örnekler — hedef pos.v + (pos.v - neg.v) ile yönlenir. */\n  negative?: string[];\n};\n\n/** Temel tablo erişimcisi — search'süz beş op. */\nexport interface EnvTypedTableBase<T extends TableTypes> {\n  insert(data: T[\"insert\"]): Promise<T[\"row\"]>;\n  /**\n   * Insert the row, or update it when it collides on `onConflict`.\n   *\n   * The conflict columns must carry a unique constraint or index — that is what\n   * Postgres matches on — and they are excluded from the update, since they are\n   * what matched.\n   */\n  upsert(data: T[\"insert\"], opts: { onConflict: readonly Extract<keyof T[\"row\"], string>[] }): Promise<T[\"row\"]>;\n  /** Update the row by id; resolves to the updated row, or `null` if no row\n   * matched (absent or RLS-hidden) — an idempotent outcome, mirroring\n   * `findById`. The runtime returns a null row rather than throwing. */\n  update(id: string, data: Partial<T[\"insert\"]>): Promise<T[\"row\"] | null>;\n  delete(id: string): Promise<void>;\n  findById(id: string): Promise<T[\"row\"] | null>;\n  findMany(query?: Partial<T[\"row\"]>): Promise<T[\"row\"][]>;\n  /** Validity'li tabloda satırın yeni versiyonu (FR-029, C-9): eski satır\n   * kapanır (valid_to/superseded_by), yenisi TEK savepoint'te eklenir; dönüş\n   * yeni satır. Validity beyanı olmayan tabloda adlandırılmış çalışma-zamanı\n   * hatası — tip düzeyinde ayrım env `Tables` bayrağı taşımadığından yapılamaz. */\n  supersede(id: string, row: T[\"insert\"]): Promise<T[\"row\"]>;\n}\n\n/** Tablo erişimcisi: env girdisi `searchable: true` taşıyorsa (vector kolonu ya da\n * search beyanı — env-gen üretir) `search()` üyesi VARDIR; yoksa üye hiç yoktur ve\n * çağrı derleme hatasıdır (FR-013). Yapısal koşul TableTypes'ı genişletmeden çalışır. */\nexport type EnvTypedTable<T extends TableTypes> = EnvTypedTableBase<T> &\n  (T extends { searchable: true }\n    ? {\n        search(\n          params: SearchParamsTyped<T>,\n        ): Promise<Array<T[\"row\"] & { _score: number }> & { _facets?: SearchFacets }>;\n        /** \"Bu satıra benzeyenler\" (FR-022): hedef vektör DB'den okunur,\n         * kaynak satır sonuçta yoktur; id yoksa adlandırılmış hata. */\n        similar(id: string, params?: SimilarParamsTyped<T>): Promise<Array<T[\"row\"] & { _score: number }>>;\n        /** positive/negative beğenilerden öneri (FR-023): hedef vektör DB-içi\n         * avg CTE'leriyle; kaynak id'ler sonuçta yoktur. */\n        recommend(params: RecommendParamsTyped<T>): Promise<Array<T[\"row\"] & { _score: number }>>;\n      }\n    : Record<never, never>);\n\n/** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`\n * interface. When no schema is declared `Tables` is empty, so `tables` is an\n * empty object — accessing `.tables.foo` is then a compile error (no member). */\nexport type EnvTables = {\n  [K in keyof Tables]: EnvTypedTable<Tables[K]>;\n};\n\n/** The project's tables as PLAN operations, keyed by the env `Tables`\n * interface. The transaction twin of {@link EnvTables}. */\nexport type TxTables = {\n  [K in keyof Tables]: TxTable<Tables[K][\"row\"], Tables[K][\"insert\"]>;\n};\n\n/**\n * The handle a `Database.transaction(…)` callback receives.\n *\n * Tables only — no `query`, no `findById`, no `asService`. A read whose value\n * the plan does not write belongs outside the transaction, where it costs one\n * round trip and is an ordinary value you can branch on.\n */\nexport type TxPlan = TxPlanHandle<TxTables>;\n\n/**\n * The RLS-bypass sibling returned by `Database.asService()`. Same typed surface\n * as {@link EnvTypedDatabase} — `tables`, the raw string ops, and a typed\n * `transaction` — but it does NOT re-expose `asService` (no double-bypass).\n * Every op it performs runs as the `service_role` (BYPASSRLS).\n */\nexport interface EnvServiceDatabase extends Omit<DBClient, \"txPlan\" | \"asService\"> {\n  tables: EnvTables;\n  transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;\n}\n\n/**\n * The typed-by-default Database surface: the raw string-keyed `DBClient` ops\n * PLUS a `tables` map typed against the project's generated `palbase-env.d.ts`,\n * a `transaction` that runs a whole plan in one request, and `asService()` for\n * the explicit RLS-bypass sibling.\n *\n * The low-level `txPlan` op is deliberately NOT re-exposed here: `transaction`\n * is the surface, and a hand-built plan would bypass the ref/guard machinery\n * that makes one safe to write.\n */\nexport interface EnvTypedDatabase extends Omit<DBClient, \"txPlan\" | \"asService\"> {\n  tables: EnvTables;\n  /**\n   * Run a transaction. The callback DESCRIBES the operations; the whole\n   * description travels in one request and the broker runs it inside a single\n   * transaction — committing when it finishes, rolling back on any failure.\n   *\n   * The callback is SYNCHRONOUS: nothing has run when it returns, so there is\n   * nothing to await. `async` on it and `await` inside it are compile errors.\n   * Values a later operation needs are {@link Ref}s, written straight into the\n   * next operation; values the CALLER needs are returned and substituted before\n   * this promise resolves.\n   *\n   * @example\n   * const { statementId } = await Database.transaction((tx) => {\n   *   const st = tx.tables.statements\n   *     .insert({ household_id: hid, file_sha256: sha, status: \"reviewing\" })\n   *     .expectOne(new Internal(\"statement insert failed\"));\n   *\n   *   tx.tables.statement_lines.insertMany(\n   *     lines.map((l) => ({ statement_id: st.id, category: resolveCategory(l) })),\n   *   );\n   *\n   *   return { statementId: st.id };\n   * });\n   */\n  transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;\n  /**\n   * Run `fn` inside a SAVEPOINT, so a write that fails in it does not poison the\n   * rest of the request.\n   *\n   * A request is ONE Postgres transaction: a failed statement aborts it and\n   * every later one answers `current transaction is aborted`. That is why\n   * \"insert, catch the unique violation, update instead\" cannot be written\n   * directly — and why {@link EnvTypedTableBase.upsert} exists for the common\n   * case. Reach for `attempt` when the recovery is not an upsert.\n   *\n   * The handle is a parameter, not the ambient `Database`: only what `tx` writes\n   * is inside the boundary, so a concurrent branch of the same request cannot be\n   * rolled back by someone else's failure.\n   *\n   * @example\n   * const claimed = await Database.attempt(async (tx) => {\n   *   await tx.insert(\"seats\", { row: 4, seat: 12, user_id: user.id });\n   *   return true;\n   * }).catch(() => false);\n   */\n  attempt<T>(fn: (tx: Omit<DBClient, \"attempt\" | \"txPlan\" | \"asService\">) => Promise<T>): Promise<T>;\n  /**\n   * Return a sibling that bypasses RLS by running as the `service_role`. Use\n   * sparingly and explicitly — the default `Database.*` path is RLS-enforced.\n   *\n   * @example\n   * const all = await Database.asService().tables.todos.findMany({});\n   * const rows = await Database.asService().query(\"SELECT * FROM todos\");\n   */\n  asService(): EnvServiceDatabase;\n}\n"],"mappings":";;;;;;AA+DA,SAAS,MAAM,MAAsB;AACnC,SAAO,IAAI,KAAK,QAAQ,MAAM,IAAI,CAAC;AACrC;AAEO,IAAM,gBAAN,MAAoB;AAAA,EAChB;AAAA,EAET,YAAY,MAAc;AACxB,SAAK,OAAO;AAAA,MACV;AAAA,MACA,SAAS;AAAA,MACT,OAAO,CAAC,eAAe;AAAA,MACvB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,SAA8B;AAChC,SAAK,KAAK,UAAU;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAuB;AAC3B,SAAK,KAAK,QAAQ;AAClB,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAuB;AAC3B,SAAK,KAAK,QAAQ;AAClB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EA0BA,SACE,iBACA,YACA,UAAoD,CAAC,GAC/C;AACN,QAAI,KAAK,KAAK,UAAU,MAAM;AAG5B,YAAM,IAAI;AAAA,QACR,UAAU,KAAK,KAAK,IAAI;AAAA,MAE1B;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,aAAa,QAAQ,cAAc;AACzC,SAAK,KAAK,QACR,GAAG,MAAM,MAAM,CAAC,eAAe,MAAM,UAAU,CAAC,SAAS,MAAM,eAAe,CAAC,UACtE,MAAM,UAAU,CAAC;AAC5B,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,UAAU,SAAuB;AAC/B,SAAK,KAAK,YAAY;AACtB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,GAAG,MAAwB;AACzB,SAAK,KAAK,aAAa,SAAS;AAChC,WAAO;AAAA,EACT;AACF;AAUO,SAAS,OAAO,MAA6B;AAClD,SAAO,IAAI,cAAc,IAAI;AAC/B;;;ACwBA,SAAS,YAAY,GAAyC;AAC5D,SAAO,aAAa,gBAAgB,EAAE,OAAO;AAC/C;AAqCO,SAAS,aACd,OAC+B;AAC/B,QAAM,SAAS,CAAC;AAChB,aAAW,QAAQ,OAAO,KAAK,MAAM,MAAM,GAAkB;AAC3D,UAAM,QAAQ,MAAM,OAAO,IAAI;AAI/B,QAAI,UAAU,OAAW;AACzB,UAAM,YAAY,MAAM,YAAY,CAAC,GAAG,IAAI,WAAW;AAevD,UAAM,MAAM,SAAS,SAAS,KAAK,MAAM,QAAQ;AACjD,UAAM,WAAgD;AAAA,MACpD;AAAA,MACA,SAAS,MAAM;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,QAAI,MAAM,eAAe,OAAW,UAAS,aAAa,MAAM;AAChE,QAAI,MAAM,WAAW,OAAW,UAAS,SAAS,MAAM;AACxD,QAAI,MAAM,QAAQ,UAAa,MAAM,IAAI,SAAS,EAAG,UAAS,MAAM,MAAM,IAAI,MAAM;AACpF,QAAI,MAAM,WAAW,UAAa,MAAM,OAAO,SAAS,EAAG,UAAS,SAAS,MAAM,OAAO,MAAM;AAChG,QAAI,MAAM,YAAY,UAAa,MAAM,QAAQ,SAAS,EAAG,UAAS,UAAU,MAAM,QAAQ,MAAM;AACpG,QAAI,MAAM,WAAW,QAAW;AAC9B,YAAM,IAAI,MAAM;AAGhB,UAAI,EAAE,SAAS,QAAW;AAGxB,YAAI,EAAE,WAAW,QAAW;AAC1B,gBAAM,IAAI;AAAA,YACR,SAAS,OAAO,IAAI,CAAC;AAAA,UACvB;AAAA,QACF;AACA,YAAI,EAAE,KAAK,WAAW,GAAG;AACvB,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,+BAA0B;AAAA,QACjE;AACA,YAAI,EAAE,UAAU,QAAW;AACzB,gBAAM,IAAI;AAAA,YACR,SAAS,OAAO,IAAI,CAAC;AAAA,UACvB;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,KAAK,WAAW,GAAG;AAChD,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,mFAAoE;AAAA,QAC3G;AAAA,MACF,OAAO;AAEL,YAAI,OAAO,EAAE,SAAS,WAAW;AAC/B,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC,sDAA2C;AAAA,QAC1G;AACA,YAAI,EAAE,SAAS,UAAa,EAAE,WAAW,QAAW;AAClD,gBAAM,IAAI;AAAA,YACR,SAAS,OAAO,IAAI,CAAC;AAAA,UACvB;AAAA,QACF;AACA,YAAI,EAAE,SAAS,UAAa,EAAE,KAAK,WAAW,GAAG;AAC/C,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,oFAAkE;AAAA,QACzG;AACA,cAAM,OAAO,EAAE,WAAW,SAAY,CAAC,IAAI,MAAM,QAAQ,EAAE,MAAM,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;AACzF,mBAAW,OAAO,MAAM;AACtB,cAAI,IAAI,UAAU,WAAc,IAAI,SAAS,UAAa,IAAI,KAAK,WAAW,IAAI;AAChF,kBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,yGAA0F;AAAA,UACjI;AACA,cAAI,IAAI,UAAU,UAAa,IAAI,SAAS,QAAW;AACrD,kBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,oFAAuE;AAAA,UAC9G;AAAA,QACF;AAAA,MACF;AACA,eAAS,SAAS;AAAA,IACpB;AACA,QAAI,MAAM,WAAW,QAAW;AAC9B,UAAI,MAAM,OAAO,KAAK,WAAW,GAAG;AAClC,cAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,+BAA0B;AAAA,MACjE;AACA,eAAS,SAAS,MAAM;AAAA,IAC1B;AACA,WAAO,IAAI,IAAI;AAAA,EACjB;AAGA,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,UAAM,IAAK,IAAiB;AAC5B,QAAI,MAAM,OAAW;AACrB,UAAM,SAAS,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC,MAAO,EAAe,SAAS,EAAE,IAAI;AAChF,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,SAAS,IAAI,kBAAkB,EAAE,IAAI,mCAAyB;AAAA,IAChF;AACA,UAAM,UAAU,EAAE,WAAW;AAC7B,QAAI,EAAE,WAAY,IAAiB,UAAU;AAC3C,YAAM,IAAI,MAAM,SAAS,IAAI,qBAAqB,OAAO,6BAA6B;AAAA,IACxF;AACA,QAAI,EAAE,WAAW,OAAO,UAAU;AAChC,YAAM,IAAI,MAAM,SAAS,IAAI,qBAAqB,OAAO,mBAAmB,EAAE,IAAI,kBAAkB;AAAA,IACtG;AACA,UAAM,UAAU,OAAO,QAAQ,MAAM;AACrC,UAAM,UAAU,YAAY,UAAa,UAAW,UAC/C,QAAwC,OACxC;AACL,QAAI,YAAY,UAAa,QAAQ,SAAS,QAAQ;AACpD,YAAM,IAAI,MAAM,SAAS,IAAI,kBAAkB,EAAE,IAAI,2CAA2C;AAAA,IAClG;AACA,eAAW,KAAK,EAAE,MAAM;AACtB,UAAI,EAAE,KAAM,IAAiB,UAAU;AACrC,cAAM,IAAI,MAAM,SAAS,IAAI,yBAAyB,CAAC,sBAAsB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,CAAC,GAAG,IAAI,IAAI,MAAM,cAAc,CAAC,CAAC,CAAC;AACtD,SAAO,EAAE,QAAQ,WAAW;AAC9B;;;AChWO,IAAM,qBAAqB;AAAA;AAAA,EAEhC;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EACA;AAAA;AACF;AAUO,IAAM,yBAAgF;AAAA,EAC3F,eAAe,CAAC,MAAM;AACxB;AAGO,SAAS,mBAAmB,MAAwC;AACzE,SAAQ,mBAAyC,SAAS,IAAI;AAChE;;;ACcA,SAAS,eAAe,KAAgB,UAAwB;AAC9D,MAAI,IAAI,SAAS,UAAU;AACzB,UAAM,IAAI,MAAM,mBAAmB,QAAQ,mEAA8D;AAAA,EAC3G;AACF;AA4BO,IAAM,gBAAN,MAAM,eAMX;AAAA,EAUS;AAAA,EAET,YAAY,MAAS,aAAyB;AAC5C,SAAK,OAAO,eAAe;AAAA,MACzB;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AAAA,EACF;AAAA;AAAA,EAGA,aAA2C;AACzC,mBAAe,KAAK,MAAM,YAAY;AACtC,SAAK,KAAK,aAAa;AACvB,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA,EAGA,UAA4C;AAC1C,SAAK,KAAK,WAAW;AACrB,WAAO,IAAI,eAAiC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC5E;AAAA;AAAA,EAGA,WAA4C;AAC1C,SAAK,KAAK,WAAW;AACrB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA,EAGA,QAAQ,OAAiD;AACvD,mBAAe,KAAK,MAAM,SAAS;AACnC,SAAK,KAAK,eAAe;AACzB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA,EAGA,gBAAiD;AAC/C,mBAAe,KAAK,MAAM,eAAe;AACzC,SAAK,KAAK,gBAAgB;AAC1B,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA,EAGA,aAA8C;AAC5C,mBAAe,KAAK,MAAM,YAAY;AACtC,SAAK,KAAK,aAAa;AACvB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,aAA8C;AAC5C,SAAK,KAAK,aAAa;AACvB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,YAAY,UAAgD;AAC1D,SAAK,KAAK,cAAc;AACxB,WAAO;AAAA,EACT;AAAA,EAEA,WAAW,OAAe,QAA8C;AACtE,mBAAe,KAAK,MAAM,YAAY;AACtC,SAAK,KAAK,aAAa,EAAE,OAAO,OAAO;AACvC,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,mBAAmB,UAA0D;AAC3E,mBAAe,KAAK,MAAM,oBAAoB;AAC9C,SAAK,KAAK,aAAa,EAAE,OAAO,cAAc,QAAQ,KAAK;AAC3D,SAAK,KAAK,iBAAiB;AAC3B,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,uBAAuB,UAA0D;AAC/E,mBAAe,KAAK,MAAM,wBAAwB;AAClD,SAAK,KAAK,aAAa,EAAE,OAAO,sBAAsB,QAAQ,KAAK;AACnE,SAAK,KAAK,iBAAiB;AAC3B,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA,EAGA,SAAS,QAAsD;AAC7D,SAAK,KAAK,iBAAiB;AAC3B,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA,EAGA,SAAuC;AACrC,mBAAe,KAAK,MAAM,QAAQ;AAClC,SAAK,KAAK,SAAS;AACnB,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AACF;AA6DO,SAAS,OAAmD;AACjE,SAAO,IAAI,cAAc,MAAM;AACjC;AAGO,SAAS,OAAmD;AACjE,SAAO,IAAI,cAAc,MAAM;AACjC;AAGO,SAAS,UAAyD;AACvE,SAAO,IAAI,cAAc,SAAS;AACpC;AAOO,SAAS,SAAuD;AACrE,SAAO,IAAI,cAAc,QAAQ;AACnC;AAUO,SAAS,UAAyD;AACvE,SAAO,IAAI,cAAc,SAAS;AACpC;AAGO,SAAS,UAAyD;AACvE,SAAO,IAAI,cAAc,SAAS;AACpC;AAGO,SAAS,YAA6D;AAC3E,SAAO,IAAI,cAAc,WAAW;AACtC;AAaO,SAAS,QAAqE;AACnF,SAAO,IAAI,cAAc,OAAO;AAClC;AAQO,SAAS,SACd,MACA,QACgD;AAChD,QAAM,UAAU,IAAI,cAA+C,MAAM;AACzE,UAAQ,KAAK,WAAW;AACxB,UAAQ,KAAK,aAAa,CAAC,GAAG,MAAM;AACpC,SAAO;AACT;AAKO,SAAS,OAAO,YAA8E;AACnG,MAAI,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,KAAK,aAAa,KAAM;AACxE,UAAM,IAAI,MAAM,6DAA6D,OAAO,UAAU,CAAC,EAAE;AAAA,EACnG;AACA,QAAM,IAAI,IAAI,cAAc,QAAQ;AACpC,EAAC,EAAE,KAAiC,aAAa;AACjD,SAAO;AACT;;;AC9YO,SAAS,IAAI,MAAc,IAAY,MAA4C;AACxF,SAAO,EAAE,MAAM,IAAI,GAAI,MAAM,QAAQ,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC,EAAG;AACxE;;;ACGO,IAAM,SAAS;AAAA,EACpB,UACE,OACA,MACmB;AACnB,WAAO;AAAA,MAAE,UAAU;AAAA,MAAU;AAAA,MAAO,YAAY,MAAM,cAAc;AAAA,MAClE,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACxE,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAAG;AAAA,EACtE;AAAA,EACA,KAAK,OAA6B;AAChC,WAAO,EAAE,UAAU,UAAU,MAAM;AAAA,EACrC;AACF;;;ACkFA,SAAS,eACP,MACAA,MACe;AACf,SAAO;AAAA,IACL,QAAQ,CAAC,SACPA,KAAI,OAAO,MAAM,IAA+B;AAAA,IAElD,QAAQ,CAAC,MAAsB,SAC7BA,KAAI,OAAO,MAAM,MAAiC,IAAI;AAAA,IAExD,QAAQ,CAAC,IAAY,SACnBA,KAAI,OAAO,MAAM,IAAI,IAA+B;AAAA,IAEtD,QAAQ,CAAC,OAAeA,KAAI,OAAO,MAAM,EAAE;AAAA,IAE3C,UAAU,CAAC,OACTA,KAAI,SAAS,MAAM,EAAE;AAAA,IAEvB,UAAU,CAAC,OAA8B,SACvCA,KAAI,SAAS,MAAM,OAA8C,IAAI;AAAA,EACzE;AACF;AAgBO,SAAS,YACd,QACAA,MACY;AACZ,QAAM,SAAS,CAAC;AAChB,aAAW,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG;AAC5C,UAAM,WAAW,OAAO,OAAO,GAAG;AAClC,QAAI,aAAa,QAAW;AAC1B,aAAO,GAAG,IAAI,eAAe,SAAS,MAAMA,IAAG;AAAA,IACjD;AAAA,EACF;AAEA,QAAM,SAAS;AAAA,IACb;AAAA,IACA,YACE,IAC0B;AAC1B,YAAM,UAAU,IAAI,cAAc;AAClC,YAAM,aAAsC,CAAC;AAC7C,iBAAW,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG;AAC5C,cAAM,WAAW,OAAO,OAAO,GAAG;AAClC,YAAI,aAAa,OAAW,YAAW,GAAG,IAAI,QAAQ,MAAM,SAAS,IAAI;AAAA,MAC3E;AAKA,aAAO;AAAA,QACLA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,SAAO;AACT;","names":["raw"]}

package/dist/{chunk-N32VDWKH.js → chunk-R3KN6RHD.js}

@@ -1,31 +1,6 @@
 import {
   HttpError
-} from "./chunk-QMVK4X3V.js";
-
-// src/purchases/registry.ts
-var ENTITLEMENTS = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.entitlements");
-var SPENDS = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.spends");
-function carrierOf(target) {
-  return typeof target === "function" ? target : target.constructor ?? target;
-}
-function own(carrier, slot) {
-  if (!Object.prototype.hasOwnProperty.call(carrier, slot)) {
-    carrier[slot] = {};
-  }
-  return carrier[slot];
-}
-function recordEntitlement(target, fnName, key) {
-  own(carrierOf(target), ENTITLEMENTS)[fnName] = key;
-}
-function recordSpend(target, fnName, meta) {
-  own(carrierOf(target), SPENDS)[fnName] = meta;
-}
-function entitlementFor(ctor, fnName) {
-  return carrierOf(ctor)[ENTITLEMENTS]?.[fnName];
-}
-function spendFor(ctor, fnName) {
-  return carrierOf(ctor)[SPENDS]?.[fnName];
-}
+} from "./chunk-RCLNBJCM.js";
 
 // src/error-registry.ts
 import {
@@ -40,27 +15,7 @@ var BUILTIN_DATA_SCHEMAS = {
   bad_request: z.object({
     fields: z.array(z.object({ field: z.string(), message: z.string() }))
   }),
-  too_many_requests: z.object({ retryAfter: z.number().int() }),
-  // Purchases (@RequireEntitlement / @Spend). Their payloads are what make a
-  // paywall renderable on the client: WHICH entitlement was missing, and for a
-  // spend the real ceiling and reset time rather than a guessed retry delay.
-  entitlement_required: z.object({ entitlement: z.string().nullable() }),
-  quota_exceeded: z.object({
-    key: z.string(),
-    scope: z.string(),
-    window: z.string(),
-    used: z.number().int(),
-    reserved: z.number().int(),
-    max: z.number().int(),
-    remaining: z.number().int(),
-    resetAt: z.string()
-  }),
-  credit_insufficient: z.object({
-    key: z.string(),
-    balance: z.number().int(),
-    reserved: z.number().int(),
-    remaining: z.number().int()
-  })
+  too_many_requests: z.object({ retryAfter: z.number().int() })
 };
 function getErrorRegistry() {
   const g = globalThis;
@@ -72,13 +27,7 @@ function getErrorRegistry() {
       ["forbidden", 403, "Forbidden"],
       ["not_found", 404, "NotFound"],
       ["conflict", 409, "Conflict"],
-      ["too_many_requests", 429, "TooManyRequests"],
-      // Thrown by the purchases decorators, so they are pre-seeded like the
-      // other built-ins: a project never declares them, but every gated or
-      // metered route must surface them as TYPED errors on the client.
-      ["entitlement_required", 403, "EntitlementRequired"],
-      ["quota_exceeded", 429, "QuotaExceeded"],
-      ["credit_insufficient", 429, "CreditInsufficient"]
+      ["too_many_requests", 429, "TooManyRequests"]
     ]) {
       const dataSchema = BUILTIN_DATA_SCHEMAS[code];
       m.set(code, {
@@ -162,11 +111,7 @@ function humanize(code) {
 }
 
 export {
-  recordEntitlement,
-  recordSpend,
-  entitlementFor,
-  spendFor,
   getErrorRegistry,
   defineError
 };
-//# sourceMappingURL=chunk-N32VDWKH.js.map
+//# sourceMappingURL=chunk-R3KN6RHD.js.map

package/dist/chunk-R3KN6RHD.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/error-registry.ts"],"sourcesContent":["// defineError — project-defined typed error classes + the module-global error\n// registry the OpenAPI spec twins join against.\n//\n// `defineError(code, status, dataSchema?)` returns an `HttpError` subclass whose\n// constructor is typed by the zod schema (`new TodoLocked({ retryAfter: 30 })`).\n// Each call self-registers `{ code, status, className, dataSchema }` in a\n// registry anchored on `globalThis` under `Symbol.for(...)` — mirroring the\n// ROUTES pattern — so the deploy bundle's registrations land on the single SDK\n// instance the extractor `require()`s. The registry is pre-seeded with the named\n// built-in classes (`NotFound`, `Conflict`, …) so throw inference can resolve\n// ad-hoc `throw new NotFound(...)` sites by their canonical wire codes.\n//\n// Duplicate code with a DIFFERENT shape (status OR converted data schema) is a\n// hard error at registration time (deploy fails loudly — error codes are\n// project-unique); structurally-identical re-registration is idempotent (each\n// controller BUNDLE carries its own copy of a shared models/errors.ts, so the\n// same defineError line legitimately runs once per bundle in one process).\nimport {\n  OpenAPIRegistry,\n  OpenApiGeneratorV31,\n  extendZodWithOpenApi,\n} from \"@asteasolutions/zod-to-openapi\";\nimport { z, type ZodTypeAny } from \"zod\";\nimport { HttpError } from \"./errors.js\";\n\nextendZodWithOpenApi(z);\n\n/** One registered error: the wire code, HTTP status, the class name the\n * analyzer sees, the optional data payload schema, and whether it is one of the\n * pre-seeded built-in named classes. */\nexport interface RegisteredError {\n  code: string;\n  status: number;\n  className: string;\n  dataSchema?: ZodTypeAny;\n  /** JSON.stringify of the converted JSON schema — equal digest ⇔ the spec\n   * twins would emit an identical `data` schema for this error. */\n  dataDigest?: string;\n  builtin: boolean;\n}\n\n/** The cross-module-instance registry anchor (the pinned contract symbol). */\nconst ERROR_REGISTRY: unique symbol = Symbol.for(\"palbase.backend.errorRegistry\");\n\ninterface RegistryCarrier {\n  [ERROR_REGISTRY]?: Map<string, RegisteredError>;\n}\n\n/** Get (creating + pre-seeding if absent) the project-global error registry,\n * keyed by wire code. Anchored on `globalThis` so every copy of the SDK in a\n * process shares the one registry. */\n/** The fixed data schemas the built-in named errors ship. Declared HERE (not in\n * errors.ts, which stays zod-free) because this is where the registry converts\n * them to JSON-schema for the spec — keying codegen's typed `error.data`. Only\n * the errors that semantically carry a payload have a schema; the rest are\n * data-less. `.int()` is preserved so the wire/codegen sees an integer. */\nconst BUILTIN_DATA_SCHEMAS: Record<string, ZodTypeAny> = {\n  bad_request: z.object({\n    fields: z.array(z.object({ field: z.string(), message: z.string() })),\n  }),\n  too_many_requests: z.object({ retryAfter: z.number().int() }),\n};\n\nexport function getErrorRegistry(): Map<string, RegisteredError> {\n  const g = globalThis as RegistryCarrier;\n  if (!g[ERROR_REGISTRY]) {\n    const m = new Map<string, RegisteredError>();\n    for (const [code, status, className] of [\n      [\"bad_request\", 400, \"BadRequest\"],\n      [\"unauthorized\", 401, \"Unauthorized\"],\n      [\"forbidden\", 403, \"Forbidden\"],\n      [\"not_found\", 404, \"NotFound\"],\n      [\"conflict\", 409, \"Conflict\"],\n      [\"too_many_requests\", 429, \"TooManyRequests\"],\n    ] as const) {\n      const dataSchema = BUILTIN_DATA_SCHEMAS[code];\n      m.set(code, {\n        code,\n        status,\n        className,\n        builtin: true,\n        ...(dataSchema ? { dataSchema, dataDigest: digestOf(code, dataSchema) } : {}),\n      });\n    }\n    g[ERROR_REGISTRY] = m;\n  }\n  return g[ERROR_REGISTRY];\n}\n\n/** Class returned for schema-bearing errors: ctor(data, message?). */\nexport interface DefinedErrorWithData<S extends ZodTypeAny> {\n  new (data: z.input<S>, message?: string): HttpError;\n  readonly code: string;\n  readonly status: number;\n}\n\n/** Class returned for schema-less errors: ctor(message?). */\nexport interface DefinedError {\n  new (message?: string): HttpError;\n  readonly code: string;\n  readonly status: number;\n}\n\n/**\n * Define a project error class. MUST be called with literal args (string\n * literal `code`, numeric literal `status`) at module top level — the deploy\n * stager's static analyzer reads those literals to resolve throw sites.\n *\n * @example\n * // models/todos/errors.ts\n * export const TodoLocked = defineError(\"todo_locked\", 409, z.object({ retryAfter: z.number() }));\n * // services/todo.service.ts\n * throw new TodoLocked({ retryAfter: 30 });\n */\nexport function defineError<S extends ZodTypeAny>(\n  code: string,\n  status: number,\n  dataSchema: S,\n): DefinedErrorWithData<S>;\nexport function defineError(code: string, status: number): DefinedError;\nexport function defineError(code: string, status: number, dataSchema?: ZodTypeAny): unknown {\n  if (!Number.isInteger(status) || status < 400 || status > 599) {\n    throw new Error(\n      `defineError: status for \"${code}\" must be a 4xx/5xx integer, got ${status} — ` +\n        `error responses must not clobber success responses in the project spec.`,\n    );\n  }\n  const registry = getErrorRegistry();\n  const existing = registry.get(code);\n  const className = defaultClassName(code);\n  const dataDigest = dataSchema ? digestOf(code, dataSchema) : undefined;\n  if (existing) {\n    const sameShape =\n      existing.status === status && !existing.builtin && existing.dataDigest === dataDigest;\n    if (!sameShape) {\n      throw new Error(\n        `defineError: duplicate error code \"${code}\" with a different shape ` +\n          `(existing: status ${existing.status}${existing.builtin ? \", built-in\" : \"\"}` +\n          `${existing.status === status && !existing.builtin ? \", different data schema\" : \"\"}). ` +\n          `Error codes are project-unique.`,\n      );\n    }\n  }\n  // Local factories so the class-constructor closures capture a NON-optional\n  // schema binding (narrowing does not flow into closures created in a branch).\n  const makeWithData = (schema: ZodTypeAny) =>\n    class extends HttpError {\n      static readonly code = code;\n      static readonly status = status;\n      constructor(data: unknown, message?: string) {\n        super(status, code, message ?? humanize(code), schema.parse(data));\n        this.name = className;\n      }\n    };\n  const makeWithoutData = () =>\n    class extends HttpError {\n      static readonly code = code;\n      static readonly status = status;\n      constructor(message?: string) {\n        super(status, code, message ?? humanize(code));\n        this.name = className;\n      }\n    };\n  const cls = dataSchema ? makeWithData(dataSchema) : makeWithoutData();\n  Object.defineProperty(cls, \"name\", { value: className });\n  registry.set(code, {\n    code,\n    status,\n    className,\n    builtin: false,\n    ...(dataSchema ? { dataSchema } : {}),\n    ...(dataDigest !== undefined ? { dataDigest } : {}),\n  });\n  return cls;\n}\n\n/** Convert a data schema through the SAME library the spec twins use and\n * return its JSON-schema digest (the duplicate-shape comparison key). Doubles\n * as the self-containment guard: a schema carrying `.openapi(refId)` metadata\n * (top-level or nested) converts to `$ref` pointers into components the\n * project spec never emits — a dangling ref every spec consumer would choke\n * on — so it is rejected here, at the definition site, with a fixable message. */\nfunction digestOf(code: string, dataSchema: ZodTypeAny): string {\n  const TMP_REF = \"__PalbaseErrorDataDigest\";\n  const tmpRegistry = new OpenAPIRegistry();\n  // Wrap the schema as a property — exactly how the envelope embeds it — so a\n  // TOP-LEVEL .openapi(refId) is not masked by the registration refId and\n  // surfaces as the same $ref the real emission would produce.\n  tmpRegistry.register(TMP_REF, z.object({ data: dataSchema }).openapi(TMP_REF));\n  const generated = new OpenApiGeneratorV31(tmpRegistry.definitions).generateComponents();\n  const out = generated.components?.schemas?.[TMP_REF];\n  const digest = JSON.stringify(out ?? null);\n  if (digest.includes('\"$ref\"')) {\n    throw new Error(\n      `defineError: dataSchema for \"${code}\" carries .openapi(refId) metadata — ` +\n        `it would emit dangling $ref pointers in the project spec. ` +\n        `Use a plain zod schema (z.object({...})) without .openapi(...).`,\n    );\n  }\n  return digest;\n}\n\n/** \"todo_locked\" → \"TodoLocked\" (used as Error.name; the source class NAME the\n * analyzer sees is whatever the user assigned the const to — they should match\n * by convention, and the descriptor carries the analyzed const name anyway). */\nfunction defaultClassName(code: string): string {\n  return code\n    .split(\"_\")\n    .map((p) => p.charAt(0).toUpperCase() + p.slice(1))\n    .join(\"\");\n}\n\n/** \"todo_locked\" → \"Todo locked\" — the default human-readable message. */\nfunction humanize(code: string): string {\n  const s = code.replace(/_/g, \" \");\n  return s.charAt(0).toUpperCase() + s.slice(1);\n}\n"],"mappings":";;;;;AAiBA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAA0B;AAGnC,qBAAqB,CAAC;AAiBtB,IAAM,iBAAgC,uBAAO,IAAI,+BAA+B;AAchF,IAAM,uBAAmD;AAAA,EACvD,aAAa,EAAE,OAAO;AAAA,IACpB,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;AAAA,EACtE,CAAC;AAAA,EACD,mBAAmB,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC9D;AAEO,SAAS,mBAAiD;AAC/D,QAAM,IAAI;AACV,MAAI,CAAC,EAAE,cAAc,GAAG;AACtB,UAAM,IAAI,oBAAI,IAA6B;AAC3C,eAAW,CAAC,MAAM,QAAQ,SAAS,KAAK;AAAA,MACtC,CAAC,eAAe,KAAK,YAAY;AAAA,MACjC,CAAC,gBAAgB,KAAK,cAAc;AAAA,MACpC,CAAC,aAAa,KAAK,WAAW;AAAA,MAC9B,CAAC,aAAa,KAAK,UAAU;AAAA,MAC7B,CAAC,YAAY,KAAK,UAAU;AAAA,MAC5B,CAAC,qBAAqB,KAAK,iBAAiB;AAAA,IAC9C,GAAY;AACV,YAAM,aAAa,qBAAqB,IAAI;AAC5C,QAAE,IAAI,MAAM;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,GAAI,aAAa,EAAE,YAAY,YAAY,SAAS,MAAM,UAAU,EAAE,IAAI,CAAC;AAAA,MAC7E,CAAC;AAAA,IACH;AACA,MAAE,cAAc,IAAI;AAAA,EACtB;AACA,SAAO,EAAE,cAAc;AACzB;AAiCO,SAAS,YAAY,MAAc,QAAgB,YAAkC;AAC1F,MAAI,CAAC,OAAO,UAAU,MAAM,KAAK,SAAS,OAAO,SAAS,KAAK;AAC7D,UAAM,IAAI;AAAA,MACR,4BAA4B,IAAI,oCAAoC,MAAM;AAAA,IAE5E;AAAA,EACF;AACA,QAAM,WAAW,iBAAiB;AAClC,QAAM,WAAW,SAAS,IAAI,IAAI;AAClC,QAAM,YAAY,iBAAiB,IAAI;AACvC,QAAM,aAAa,aAAa,SAAS,MAAM,UAAU,IAAI;AAC7D,MAAI,UAAU;AACZ,UAAM,YACJ,SAAS,WAAW,UAAU,CAAC,SAAS,WAAW,SAAS,eAAe;AAC7E,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR,sCAAsC,IAAI,8CACnB,SAAS,MAAM,GAAG,SAAS,UAAU,eAAe,EAAE,GACxE,SAAS,WAAW,UAAU,CAAC,SAAS,UAAU,4BAA4B,EAAE;AAAA,MAEvF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,eAAe,CAAC,WACpB,cAAc,UAAU;AAAA,IACtB,OAAgB,OAAO;AAAA,IACvB,OAAgB,SAAS;AAAA,IACzB,YAAY,MAAe,SAAkB;AAC3C,YAAM,QAAQ,MAAM,WAAW,SAAS,IAAI,GAAG,OAAO,MAAM,IAAI,CAAC;AACjE,WAAK,OAAO;AAAA,IACd;AAAA,EACF;AACF,QAAM,kBAAkB,MACtB,cAAc,UAAU;AAAA,IACtB,OAAgB,OAAO;AAAA,IACvB,OAAgB,SAAS;AAAA,IACzB,YAAY,SAAkB;AAC5B,YAAM,QAAQ,MAAM,WAAW,SAAS,IAAI,CAAC;AAC7C,WAAK,OAAO;AAAA,IACd;AAAA,EACF;AACF,QAAM,MAAM,aAAa,aAAa,UAAU,IAAI,gBAAgB;AACpE,SAAO,eAAe,KAAK,QAAQ,EAAE,OAAO,UAAU,CAAC;AACvD,WAAS,IAAI,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IACnC,GAAI,eAAe,SAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnD,CAAC;AACD,SAAO;AACT;AAQA,SAAS,SAAS,MAAc,YAAgC;AAC9D,QAAM,UAAU;AAChB,QAAM,cAAc,IAAI,gBAAgB;AAIxC,cAAY,SAAS,SAAS,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC,EAAE,QAAQ,OAAO,CAAC;AAC7E,QAAM,YAAY,IAAI,oBAAoB,YAAY,WAAW,EAAE,mBAAmB;AACtF,QAAM,MAAM,UAAU,YAAY,UAAU,OAAO;AACnD,QAAM,SAAS,KAAK,UAAU,OAAO,IAAI;AACzC,MAAI,OAAO,SAAS,QAAQ,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR,gCAAgC,IAAI;AAAA,IAGtC;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,iBAAiB,MAAsB;AAC9C,SAAO,KACJ,MAAM,GAAG,EACT,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC,CAAC,EACjD,KAAK,EAAE;AACZ;AAGA,SAAS,SAAS,MAAsB;AACtC,QAAM,IAAI,KAAK,QAAQ,MAAM,GAAG;AAChC,SAAO,EAAE,OAAO,CAAC,EAAE,YAAY,IAAI,EAAE,MAAM,CAAC;AAC9C;","names":[]}

package/dist/{chunk-QMVK4X3V.js → chunk-RCLNBJCM.js}

@@ -1,95 +1,3 @@
-// src/errors.ts
-var HTTP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("palbase.backend.httpError");
-function isHttpError(err) {
-  if (typeof err !== "object" || err === null) return false;
-  const e = err;
-  return e[HTTP_ERROR_BRAND] === true && typeof e.status === "number" && typeof e.error === "string" && typeof e.errorDescription === "string";
-}
-var HttpError = class extends Error {
-  status;
-  error;
-  errorDescription;
-  data;
-  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */
-  [HTTP_ERROR_BRAND] = true;
-  constructor(status, error, errorDescription, data) {
-    super(errorDescription);
-    this.name = "HttpError";
-    this.status = status;
-    this.error = error;
-    this.errorDescription = errorDescription;
-    if (data !== void 0) {
-      this.data = data;
-    }
-  }
-  /**
-   * Serialize to the standard Palbase error response format.
-   * The `requestId` is injected by the runtime layer from the request context.
-   * When called without arguments (e.g. JSON.stringify), request_id is omitted.
-   * When `data` is set, it is appended as a strict-superset field.
-   */
-  toJSON(requestId) {
-    const result = {
-      error: this.error,
-      error_description: this.errorDescription,
-      status: this.status
-    };
-    if (requestId) {
-      result.request_id = requestId;
-    }
-    if (this.data !== void 0) {
-      result.data = this.data;
-    }
-    return result;
-  }
-};
-var PalError = class extends HttpError {
-  constructor(status, code, description, data) {
-    super(status, code, description, data);
-    this.name = "PalError";
-  }
-};
-var NamedHttpError = class extends HttpError {
-  constructor(status, defaultCode, name, message, code, data) {
-    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);
-    this.name = name;
-  }
-};
-function defaultMessage(name) {
-  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
-  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
-}
-var BadRequest = class extends NamedHttpError {
-  constructor(data, message) {
-    super(400, "bad_request", "BadRequest", message, void 0, data);
-  }
-};
-var Unauthorized = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(401, "unauthorized", "Unauthorized", message, code, data);
-  }
-};
-var Forbidden = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(403, "forbidden", "Forbidden", message, code, data);
-  }
-};
-var NotFound = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(404, "not_found", "NotFound", message, code, data);
-  }
-};
-var Conflict = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(409, "conflict", "Conflict", message, code, data);
-  }
-};
-var TooManyRequests = class extends NamedHttpError {
-  constructor(data, message) {
-    super(429, "too_many_requests", "TooManyRequests", message, void 0, data);
-  }
-};
-
 // src/decorators/registry.ts
 var ROUTES = /* @__PURE__ */ Symbol.for("palbase.backend.routes");
 var PARAM_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.paramBuffer");
@@ -182,7 +90,103 @@ function getRoutes(ctor) {
   }));
 }
 
+// src/errors.ts
+var HTTP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("palbase.backend.httpError");
+function isHttpError(err) {
+  if (typeof err !== "object" || err === null) return false;
+  const e = err;
+  return e[HTTP_ERROR_BRAND] === true && typeof e.status === "number" && typeof e.error === "string" && typeof e.errorDescription === "string";
+}
+var HttpError = class extends Error {
+  status;
+  error;
+  errorDescription;
+  data;
+  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */
+  [HTTP_ERROR_BRAND] = true;
+  constructor(status, error, errorDescription, data) {
+    super(errorDescription);
+    this.name = "HttpError";
+    this.status = status;
+    this.error = error;
+    this.errorDescription = errorDescription;
+    if (data !== void 0) {
+      this.data = data;
+    }
+  }
+  /**
+   * Serialize to the standard Palbase error response format.
+   * The `requestId` is injected by the runtime layer from the request context.
+   * When called without arguments (e.g. JSON.stringify), request_id is omitted.
+   * When `data` is set, it is appended as a strict-superset field.
+   */
+  toJSON(requestId) {
+    const result = {
+      error: this.error,
+      error_description: this.errorDescription,
+      status: this.status
+    };
+    if (requestId) {
+      result.request_id = requestId;
+    }
+    if (this.data !== void 0) {
+      result.data = this.data;
+    }
+    return result;
+  }
+};
+var PalError = class extends HttpError {
+  constructor(status, code, description, data) {
+    super(status, code, description, data);
+    this.name = "PalError";
+  }
+};
+var NamedHttpError = class extends HttpError {
+  constructor(status, defaultCode, name, message, code, data) {
+    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);
+    this.name = name;
+  }
+};
+function defaultMessage(name) {
+  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
+  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+}
+var BadRequest = class extends NamedHttpError {
+  constructor(data, message) {
+    super(400, "bad_request", "BadRequest", message, void 0, data);
+  }
+};
+var Unauthorized = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(401, "unauthorized", "Unauthorized", message, code, data);
+  }
+};
+var Forbidden = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(403, "forbidden", "Forbidden", message, code, data);
+  }
+};
+var NotFound = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(404, "not_found", "NotFound", message, code, data);
+  }
+};
+var Conflict = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(409, "conflict", "Conflict", message, code, data);
+  }
+};
+var TooManyRequests = class extends NamedHttpError {
+  constructor(data, message) {
+    super(429, "too_many_requests", "TooManyRequests", message, void 0, data);
+  }
+};
+
 export {
+  recordRoute,
+  recordParam,
+  recordThrows,
+  getRoutes,
   isHttpError,
   HttpError,
   PalError,
@@ -191,10 +195,6 @@ export {
   Forbidden,
   NotFound,
   Conflict,
-  TooManyRequests,
-  recordRoute,
-  recordParam,
-  recordThrows,
-  getRoutes
+  TooManyRequests
 };
-//# sourceMappingURL=chunk-QMVK4X3V.js.map
+//# sourceMappingURL=chunk-RCLNBJCM.js.map

package/dist/chunk-RCLNBJCM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/decorators/registry.ts","../src/errors.ts"],"sourcesContent":["// The decorator registry — the single plain-data store the method + parameter\n// decorators write into, and the deploy/dispatch pipeline reads back. No\n// `reflect-metadata`, no `emitDecoratorMetadata`: the registry is built from the\n// decorator arguments + the parameter INDEX that esbuild/tsc preserve for legacy\n// parameter decorators (verified — see the design spec §0/§4.1).\n//\n// A controller class carries its route metadata on a symbol-keyed static\n// property (`ROUTES`). `@Get`/`@Post`/… append a {@link RouteMeta} entry;\n// `@Body`/`@User`/… append a {@link ParamMeta} entry onto the route for the\n// method they decorate. Because parameter decorators run BEFORE the method\n// decorator for the same member (TS evaluates innermost-first, params before the\n// method), the route entry may not exist yet when a param decorator fires — so\n// param metadata is buffered per method name and merged when the method\n// decorator creates the route entry.\nimport type { AuthSpec, RateLimitConfig } from \"../endpoint.js\";\nimport type { UploadConfig } from \"./upload.js\";\nimport type { SseConfig } from \"./sse.js\";\nimport type { ZodTypeAny } from \"zod\";\n\n/** The HTTP verbs a route may declare, upper-cased (the runtime router +\n * OpenAPI lower-case on their own). */\nexport type HttpMethodUpper = \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\" | \"QUERY\";\n\n/** Route-level options accepted by the method decorators (`@Get`/`@Post`/…). */\nexport interface RouteOptions {\n  /** OVERRIDES the controller-level default auth for this one route. */\n  auth?: AuthSpec;\n  /** Per-route rate limit. */\n  rateLimit?: RateLimitConfig;\n  /** Direct-storage upload config — present ONLY on `@Upload` routes (the\n   * `@Get`/`@Post`/… decorators never set it). Its presence is what MARKS a\n   * route as an upload route through the whole pipeline (registry → flatten →\n   * openapi → codegen). The bytes go client→storage directly; the method body\n   * runs as the completion handler. See {@link UploadConfig} (decorators/upload.ts). */\n  uploadConfig?: UploadConfig;\n  /** Streaming config — present ONLY on `@Sse` routes (the `@Get`/`@Post`/…\n   * decorators never set it). Its presence is what MARKS a route as a streaming\n   * route through the whole pipeline (registry → flatten → openapi → codegen),\n   * exactly as `uploadConfig` does for uploads — never a special HTTP verb. An\n   * `@Sse` route registers POST like any input-bearing route, so the verb cannot\n   * carry the distinction. See {@link SseConfig} (decorators/sse.ts). */\n  sseConfig?: SseConfig;\n}\n\n/** The kind of value a parameter decorator injects. Drives both dispatch\n * (which request slice to inject) and codegen (which OpenAPI parameter source a\n * schema-bearing kind maps to). */\nexport type ParamKind =\n  | \"body\"\n  | \"query\"\n  | \"param\"\n  | \"headers\"\n  | \"user\"\n  | \"optionalUser\"\n  | \"client\"\n  | \"requestId\"\n  | \"traceId\"\n  | \"req\"\n  // `@UploadedObject()` — injects the uploaded object (completion input) on an\n  // `@Upload` route. No schema (the shape is the fixed UploadedObject type).\n  | \"uploadedObject\"\n  // `@SseOut()` — injects the frame writer on an `@Sse` route. No schema (the\n  // shape is the fixed SseWriter type).\n  | \"sseOut\"\n  // `@Signal()` — injects the request's AbortSignal, which aborts when the\n  // client disconnects. No schema. NOT derivable from `@Req()`: PBRequest\n  // carries only request-scoped data and has no signal (endpoint.ts:358-363).\n  | \"signal\";\n\n/** One parameter decorator's recorded metadata. `index` is the parameter\n * position esbuild/tsc preserve; `schema` is present for the schema-bearing\n * kinds (`body`/`query`/`headers`); `name` is the path-param name for `param`. */\nexport interface ParamMeta {\n  index: number;\n  kind: ParamKind;\n  /** Zod schema for `body`/`query`/`headers` (validation + codegen source). */\n  schema?: ZodTypeAny;\n  /** Path-param name for `@Param(\"id\")`. */\n  name?: string;\n}\n\n/** One inferred throw site: the error CLASS name (e.g. \"TodoLocked\") and its\n * wire code (e.g. \"todo_locked\"). `status`, `hasData`, and the data JSON schema\n * are NOT carried here — they resolve from the error registry by `code` at\n * extract/openapi time (single source of truth). */\nexport interface ThrowDescriptor {\n  name: string;\n  code: string;\n}\n\n/** One route's recorded metadata: the verb + subpath + method name + options,\n * the ordered parameter metas, and the resolved return schema (injected by the\n * codegen step — see `returnSchema`). */\nexport interface RouteMeta {\n  method: HttpMethodUpper;\n  subpath: string;\n  fnName: string;\n  options: RouteOptions;\n  params: ParamMeta[];\n  /** Response schema for the route, if any. Derived from the method's RETURN\n   * TYPE by codegen and written here via `recordReturn` (a generated top-level\n   * IIFE injected per controller), not by an author-written decorator. */\n  returnSchema?: ZodTypeAny;\n  /** Error classes this route can throw, if inferred. Derived from the method\n   * body + service call graph by the deploy stager's throw analysis and written\n   * here via `recordThrows` (a generated top-level IIFE injected per controller,\n   * the `recordReturn` twin), not by an author-written decorator. */\n  throws?: ThrowDescriptor[];\n}\n\n/** Symbol the route metadata list is stored under on a controller class. Using\n * a symbol (not a string key) keeps it off the public structural surface and\n * avoids any chance of an authored property collision. */\nexport const ROUTES: unique symbol = Symbol.for(\"palbase.backend.routes\");\n\n/** Symbol the per-method buffered parameter metas are stored under while a class\n * is being decorated. Parameter decorators fire before the method decorator, so\n * they buffer here keyed by method name; the method decorator drains the buffer\n * into the route entry it creates. */\nconst PARAM_BUFFER: unique symbol = Symbol.for(\"palbase.backend.paramBuffer\");\n\n/** Symbol the per-method buffered return-type schemas are stored under while a\n * class's registry is being populated. The codegen-injected `recordReturn` call\n * can fire before OR after the method decorator; it buffers here keyed by method\n * name and `recordRoute` drains it into the route entry (and `recordReturn`\n * writes through if the route already exists). Buffering on BOTH sides means a\n * fully-formed route entry always carries its return schema — a raw-symbol\n * reader (the runtime) never has to re-merge. */\nconst RETURN_BUFFER: unique symbol = Symbol.for(\"palbase.backend.returnBuffer\");\n\n/** Symbol the per-method buffered throw descriptors are stored under while a\n * class's registry is being populated. The stager-injected `recordThrows` call\n * can fire before OR after the method decorator; it buffers here keyed by method\n * name and `recordRoute` drains it into the route entry (and `recordThrows`\n * writes through if the route already exists). Buffering on BOTH sides means a\n * fully-formed route entry always carries its throw descriptors — a raw-symbol\n * reader (the runtime) never has to re-merge. */\nconst THROWS_BUFFER: unique symbol = Symbol.for(\"palbase.backend.throwsBuffer\");\n\n/** A class constructor carrying the symbol-keyed registry slots. We type the\n * registry-bearing class as this so the decorators can read/write the slots\n * without `any` — a plain `Function` does not carry index signatures. */\ninterface RegistryCarrier {\n  [ROUTES]?: RouteMeta[];\n  [PARAM_BUFFER]?: Record<string, ParamMeta[]>;\n  [RETURN_BUFFER]?: Record<string, ZodTypeAny>;\n  [THROWS_BUFFER]?: Record<string, ThrowDescriptor[]>;\n}\n\n/** Coerce a decorated target (class constructor or its prototype) into the\n * registry carrier that owns the slots. Method/param decorators receive the\n * PROTOTYPE as their target; the class decorator receives the constructor. We\n * always anchor the registry on the CONSTRUCTOR so `getRoutes(ctor)` finds it. */\nfunction carrierOf(target: object): RegistryCarrier {\n  // For instance-member decorators, `target` is the prototype; its `.constructor`\n  // is the class. For a static member or the class decorator, `target` is the\n  // constructor already. Resolve to the constructor either way.\n  const ctor =\n    typeof target === \"function\"\n      ? (target as unknown as RegistryCarrier)\n      : (((target as { constructor?: unknown }).constructor ??\n          target) as unknown as RegistryCarrier);\n  return ctor;\n}\n\n/** Get (creating if absent) the own route list for a class constructor. Own —\n * not inherited — so a subclass does not mutate its base's routes. */\nfunction ownRoutes(carrier: RegistryCarrier): RouteMeta[] {\n  if (!Object.prototype.hasOwnProperty.call(carrier, ROUTES)) {\n    carrier[ROUTES] = [];\n  }\n  return carrier[ROUTES] as RouteMeta[];\n}\n\n/** Get (creating if absent) the own per-method param buffer for a class. */\nfunction ownParamBuffer(carrier: RegistryCarrier): Record<string, ParamMeta[]> {\n  if (!Object.prototype.hasOwnProperty.call(carrier, PARAM_BUFFER)) {\n    carrier[PARAM_BUFFER] = {};\n  }\n  return carrier[PARAM_BUFFER] as Record<string, ParamMeta[]>;\n}\n\n/** Record a route (called by the method decorators). Drains any parameter\n * metas already buffered for `fnName` into the new route entry, then sorts them\n * by parameter index so dispatch can inject positionally. */\nexport function recordRoute(\n  target: object,\n  fnName: string,\n  method: HttpMethodUpper,\n  subpath: string,\n  options: RouteOptions,\n): void {\n  const carrier = carrierOf(target);\n  const routes = ownRoutes(carrier);\n  const buffer = ownParamBuffer(carrier);\n  const params = (buffer[fnName] ?? []).slice().sort((a, b) => a.index - b.index);\n  const route: RouteMeta = { method, subpath, fnName, options, params };\n  // Drain a buffered return schema (the recordReturn-ran-first ordering) so the\n  // route entry is complete the moment it's created — a raw-symbol consumer\n  // (the runtime extractor/worker) sees the return schema without re-merging.\n  const returnBuffer = carrier[RETURN_BUFFER];\n  if (returnBuffer && returnBuffer[fnName] !== undefined) {\n    route.returnSchema = returnBuffer[fnName];\n  }\n  // Same drain for buffered throw descriptors (the recordThrows-ran-first\n  // ordering) — the route entry is complete the moment it's created.\n  const throwsBuffer = carrier[THROWS_BUFFER];\n  if (throwsBuffer && throwsBuffer[fnName] !== undefined) {\n    route.throws = throwsBuffer[fnName];\n  }\n  routes.push(route);\n}\n\n/** Record one parameter decorator (called by `@Body`/`@User`/…). Buffers per\n * method name; the method decorator merges the buffer into the route entry. If\n * the route already exists (method decorator ran first — TS does evaluate the\n * method decorator AFTER its parameter decorators, but we stay order-robust),\n * the meta is also appended directly so neither ordering loses it. */\nexport function recordParam(target: object, fnName: string, meta: ParamMeta): void {\n  const carrier = carrierOf(target);\n  const buffer = ownParamBuffer(carrier);\n  (buffer[fnName] ??= []).push(meta);\n\n  // Order-robust: if the route already exists, merge in place + keep sorted.\n  const routes = carrier[ROUTES];\n  if (routes) {\n    const route = routes.find((r) => r.fnName === fnName);\n    if (route) {\n      route.params.push(meta);\n      route.params.sort((a, b) => a.index - b.index);\n    }\n  }\n}\n\n/** Attach a return schema to the route for `fnName` (called by the codegen\n * injection that reads the method's return type). If the route does not exist\n * yet, the schema is buffered (RETURN_BUFFER) and drained into the route by\n * `recordRoute` when the method decorator runs. */\nexport function recordReturn(target: object, fnName: string, schema: ZodTypeAny): void {\n  const carrier = carrierOf(target);\n  const routes = carrier[ROUTES];\n  const route = routes?.find((r) => r.fnName === fnName);\n  if (route) {\n    route.returnSchema = schema;\n    return;\n  }\n  if (!Object.prototype.hasOwnProperty.call(carrier, RETURN_BUFFER)) {\n    carrier[RETURN_BUFFER] = {};\n  }\n  const returnBuffer = carrier[RETURN_BUFFER];\n  if (returnBuffer) returnBuffer[fnName] = schema;\n}\n\n/** Attach the inferred throw descriptors to the route for `fnName` (called by\n * the stager-injected IIFE that carries the throw analysis result — the\n * `recordReturn` twin). If the route does not exist yet, the descriptors are\n * buffered (THROWS_BUFFER) and drained into the route by `recordRoute` when the\n * method decorator runs. */\nexport function recordThrows(target: object, fnName: string, throws: ThrowDescriptor[]): void {\n  const carrier = carrierOf(target);\n  const routes = carrier[ROUTES];\n  const route = routes?.find((r) => r.fnName === fnName);\n  if (route) {\n    route.throws = throws;\n    return;\n  }\n  if (!Object.prototype.hasOwnProperty.call(carrier, THROWS_BUFFER)) {\n    carrier[THROWS_BUFFER] = {};\n  }\n  const throwsBuffer = carrier[THROWS_BUFFER];\n  if (throwsBuffer) throwsBuffer[fnName] = throws;\n}\n\n/** Read the route metadata for a controller class (the deploy/dispatch entry\n * point). Applies any buffered return schemas + throw descriptors (for the\n * recordReturn/recordThrows-runs-before orderings) and returns a defensive copy\n * so callers cannot mutate the registry.\n */\nexport function getRoutes(ctor: object): RouteMeta[] {\n  const carrier = carrierOf(ctor);\n  const routes = carrier[ROUTES] ?? [];\n  const returnBuffer = carrier[RETURN_BUFFER];\n  if (returnBuffer) {\n    for (const route of routes) {\n      const buffered = returnBuffer[route.fnName];\n      if (buffered && route.returnSchema === undefined) {\n        route.returnSchema = buffered;\n      }\n    }\n  }\n  const throwsBuffer = carrier[THROWS_BUFFER];\n  if (throwsBuffer) {\n    for (const route of routes) {\n      const buffered = throwsBuffer[route.fnName];\n      if (buffered && route.throws === undefined) {\n        route.throws = buffered;\n      }\n    }\n  }\n  return routes.map((r) => ({\n    ...r,\n    params: r.params.slice(),\n    ...(r.throws !== undefined ? { throws: r.throws.slice() } : {}),\n  }));\n}\n","/** HTTP error with structured error response format.\n *\n * The base class for the throwable error classes (`PalError`, `Conflict`,\n * `NotFound`, …). Construct one directly with `throw new HttpError(404,\n * \"todo_not_found\", \"No such todo\")`, or throw a named subclass\n * (`throw new NotFound(\"todo not found\")`). The runtime catches any `HttpError`\n * and emits the standard envelope; on the wire (and to iOS) it surfaces as\n * `BackendError.server(code, status, message, requestId)`.\n *\n * The optional `data` field carries a structured payload alongside the\n * standard envelope — for errors that need to ship extra context\n * (e.g. `new Conflict(\"locked\", \"title_locked\", { retryAfter: 30 })`). It rides\n * through to the iOS typed enum's associated value.\n */\n/**\n * The brand that identifies an HttpError ACROSS SDK instances.\n *\n * A process legitimately holds more than one copy of this SDK — the runtime\n * loads the engine from its own node_modules while the tenant's bundle carries\n * an inlined copy, which is why the controller registry and the error registry\n * are both anchored on `Symbol.for`. The one place that did not follow the\n * pattern was the engine's catch: `err instanceof HttpError` compares CLASS\n * IDENTITY, so a `throw new NotFound()` from the bundle's copy did not match\n * the engine's copy and every typed error in every deployed backend degraded to\n * `500 internal_error`. Measured through the edge on a real deploy: a route\n * throwing `NotFound` answered 500 while the runtime's own log printed the\n * error object with `status: 404` right beside it.\n *\n * `Symbol.for` puts this in the cross-realm registry, so every copy of the SDK\n * agrees on it by VALUE rather than by identity.\n */\nexport const HTTP_ERROR_BRAND: unique symbol = Symbol.for(\"palbase.backend.httpError\");\n\n/**\n * Whether a thrown value is an HttpError from ANY copy of this SDK.\n *\n * The shape is checked as well as the brand: the brand says \"this claims to be\n * one of ours\", the fields say the envelope can actually be built from it, and\n * a half-formed object must fall through to the 500 path rather than produce a\n * malformed response.\n */\nexport function isHttpError(err: unknown): err is HttpError {\n  if (typeof err !== \"object\" || err === null) return false;\n  const e = err as Record<PropertyKey, unknown>;\n  return (\n    e[HTTP_ERROR_BRAND] === true &&\n    typeof e.status === \"number\" &&\n    typeof e.error === \"string\" &&\n    typeof e.errorDescription === \"string\"\n  );\n}\n\nexport class HttpError extends Error {\n  public readonly status: number;\n  public readonly error: string;\n  public readonly errorDescription: string;\n  public readonly data?: unknown;\n  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */\n  public readonly [HTTP_ERROR_BRAND] = true;\n\n  constructor(status: number, error: string, errorDescription: string, data?: unknown) {\n    super(errorDescription);\n    this.name = \"HttpError\";\n    this.status = status;\n    this.error = error;\n    this.errorDescription = errorDescription;\n    if (data !== undefined) {\n      this.data = data;\n    }\n  }\n\n  /**\n   * Serialize to the standard Palbase error response format.\n   * The `requestId` is injected by the runtime layer from the request context.\n   * When called without arguments (e.g. JSON.stringify), request_id is omitted.\n   * When `data` is set, it is appended as a strict-superset field.\n   */\n  toJSON(requestId?: string): {\n    error: string;\n    error_description: string;\n    status: number;\n    request_id?: string;\n    data?: unknown;\n  } {\n    const result: {\n      error: string;\n      error_description: string;\n      status: number;\n      request_id?: string;\n      data?: unknown;\n    } = {\n      error: this.error,\n      error_description: this.errorDescription,\n      status: this.status,\n    };\n    if (requestId) {\n      result.request_id = requestId;\n    }\n    if (this.data !== undefined) {\n      result.data = this.data;\n    }\n    return result;\n  }\n}\n\n/**\n * Throw with a custom HTTP status + wire code. The general-purpose escape hatch\n * when none of the named classes (`Conflict`/`NotFound`/…) fits.\n *\n * @example\n * throw new PalError(418, \"teapot\", \"I'm a teapot\");\n */\nexport class PalError extends HttpError {\n  constructor(status: number, code: string, description: string, data?: unknown) {\n    super(status, code, description, data);\n    this.name = \"PalError\";\n  }\n}\n\n/** Base for the named status classes. Each subclass fixes its HTTP status; the\n * `code` defaults to the class's canonical wire code (overridable), and the\n * `message` defaults to a human-readable label (overridable). */\nabstract class NamedHttpError extends HttpError {\n  protected constructor(\n    status: number,\n    defaultCode: string,\n    name: string,\n    message?: string,\n    code?: string,\n    data?: unknown,\n  ) {\n    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);\n    this.name = name;\n  }\n}\n\n/** Derive a default human-readable message from a class name\n * (\"NotFound\" → \"Not found\", \"TooManyRequests\" → \"Too many requests\"). */\nfunction defaultMessage(name: string): string {\n  const spaced = name.replace(/([a-z0-9])([A-Z])/g, \"$1 $2\");\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();\n}\n\n/**\n * 400 — the request was malformed or failed validation. Carries a fixed typed\n * payload: `new BadRequest({ fields: [{ field: \"email\", message: \"invalid\" }] })`.\n * The shape is declared once in the SDK so codegen surfaces `error.data.fields`\n * typed on the client.\n */\nexport class BadRequest extends NamedHttpError {\n  public declare readonly data: BadRequestData;\n  constructor(data: BadRequestData, message?: string) {\n    super(400, \"bad_request\", \"BadRequest\", message, undefined, data);\n  }\n}\n\n/** 401 — the caller is not authenticated. */\nexport class Unauthorized extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(401, \"unauthorized\", \"Unauthorized\", message, code, data);\n  }\n}\n\n/** 403 — the caller is authenticated but not allowed. */\nexport class Forbidden extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(403, \"forbidden\", \"Forbidden\", message, code, data);\n  }\n}\n\n/** 404 — the requested resource does not exist. */\nexport class NotFound extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(404, \"not_found\", \"NotFound\", message, code, data);\n  }\n}\n\n/** 409 — the request conflicts with the current state. */\nexport class Conflict extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(409, \"conflict\", \"Conflict\", message, code, data);\n  }\n}\n\n/** A single field-level validation failure carried by {@link BadRequest}. */\nexport interface FieldError {\n  /** The offending field's name (dotted path for nested fields). */\n  field: string;\n  /** Human-readable reason the field failed. */\n  message: string;\n}\n\n/** The fixed, typed payload {@link BadRequest} ships. */\nexport interface BadRequestData {\n  /** The fields that failed validation. */\n  fields: FieldError[];\n}\n\n/** The fixed, typed payload {@link TooManyRequests} ships. */\nexport interface TooManyRequestsData {\n  /** Seconds the caller should wait before retrying. */\n  retryAfter: number;\n}\n\n/**\n * 429 — the caller has exceeded the rate limit. Carries a fixed typed payload:\n * `new TooManyRequests({ retryAfter: 30 })`. The shape is declared once in the\n * SDK (error-registry pre-seed) so codegen surfaces `error.data.retryAfter`\n * typed on the client — no per-project definition needed.\n */\nexport class TooManyRequests extends NamedHttpError {\n  public declare readonly data: TooManyRequestsData;\n  constructor(data: TooManyRequestsData, message?: string) {\n    super(429, \"too_many_requests\", \"TooManyRequests\", message, undefined, data);\n  }\n}\n"],"mappings":";AAiHO,IAAM,SAAwB,uBAAO,IAAI,wBAAwB;AAMxE,IAAM,eAA8B,uBAAO,IAAI,6BAA6B;AAS5E,IAAM,gBAA+B,uBAAO,IAAI,8BAA8B;AAS9E,IAAM,gBAA+B,uBAAO,IAAI,8BAA8B;AAgB9E,SAAS,UAAU,QAAiC;AAIlD,QAAM,OACJ,OAAO,WAAW,aACb,SACE,OAAqC,eACtC;AACR,SAAO;AACT;AAIA,SAAS,UAAU,SAAuC;AACxD,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,MAAM,GAAG;AAC1D,YAAQ,MAAM,IAAI,CAAC;AAAA,EACrB;AACA,SAAO,QAAQ,MAAM;AACvB;AAGA,SAAS,eAAe,SAAuD;AAC7E,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,YAAY,GAAG;AAChE,YAAQ,YAAY,IAAI,CAAC;AAAA,EAC3B;AACA,SAAO,QAAQ,YAAY;AAC7B;AAKO,SAAS,YACd,QACA,QACA,QACA,SACA,SACM;AACN,QAAM,UAAU,UAAU,MAAM;AAChC,QAAM,SAAS,UAAU,OAAO;AAChC,QAAM,SAAS,eAAe,OAAO;AACrC,QAAM,UAAU,OAAO,MAAM,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAC9E,QAAM,QAAmB,EAAE,QAAQ,SAAS,QAAQ,SAAS,OAAO;AAIpE,QAAM,eAAe,QAAQ,aAAa;AAC1C,MAAI,gBAAgB,aAAa,MAAM,MAAM,QAAW;AACtD,UAAM,eAAe,aAAa,MAAM;AAAA,EAC1C;AAGA,QAAM,eAAe,QAAQ,aAAa;AAC1C,MAAI,gBAAgB,aAAa,MAAM,MAAM,QAAW;AACtD,UAAM,SAAS,aAAa,MAAM;AAAA,EACpC;AACA,SAAO,KAAK,KAAK;AACnB;AAOO,SAAS,YAAY,QAAgB,QAAgB,MAAuB;AACjF,QAAM,UAAU,UAAU,MAAM;AAChC,QAAM,SAAS,eAAe,OAAO;AACrC,GAAC,OAAO,MAAM,MAAM,CAAC,GAAG,KAAK,IAAI;AAGjC,QAAM,SAAS,QAAQ,MAAM;AAC7B,MAAI,QAAQ;AACV,UAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM;AACpD,QAAI,OAAO;AACT,YAAM,OAAO,KAAK,IAAI;AACtB,YAAM,OAAO,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAAA,IAC/C;AAAA,EACF;AACF;AA0BO,SAAS,aAAa,QAAgB,QAAgB,QAAiC;AAC5F,QAAM,UAAU,UAAU,MAAM;AAChC,QAAM,SAAS,QAAQ,MAAM;AAC7B,QAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM;AACrD,MAAI,OAAO;AACT,UAAM,SAAS;AACf;AAAA,EACF;AACA,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,aAAa,GAAG;AACjE,YAAQ,aAAa,IAAI,CAAC;AAAA,EAC5B;AACA,QAAM,eAAe,QAAQ,aAAa;AAC1C,MAAI,aAAc,cAAa,MAAM,IAAI;AAC3C;AAOO,SAAS,UAAU,MAA2B;AACnD,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnC,QAAM,eAAe,QAAQ,aAAa;AAC1C,MAAI,cAAc;AAChB,eAAW,SAAS,QAAQ;AAC1B,YAAM,WAAW,aAAa,MAAM,MAAM;AAC1C,UAAI,YAAY,MAAM,iBAAiB,QAAW;AAChD,cAAM,eAAe;AAAA,MACvB;AAAA,IACF;AAAA,EACF;AACA,QAAM,eAAe,QAAQ,aAAa;AAC1C,MAAI,cAAc;AAChB,eAAW,SAAS,QAAQ;AAC1B,YAAM,WAAW,aAAa,MAAM,MAAM;AAC1C,UAAI,YAAY,MAAM,WAAW,QAAW;AAC1C,cAAM,SAAS;AAAA,MACjB;AAAA,IACF;AAAA,EACF;AACA,SAAO,OAAO,IAAI,CAAC,OAAO;AAAA,IACxB,GAAG;AAAA,IACH,QAAQ,EAAE,OAAO,MAAM;AAAA,IACvB,GAAI,EAAE,WAAW,SAAY,EAAE,QAAQ,EAAE,OAAO,MAAM,EAAE,IAAI,CAAC;AAAA,EAC/D,EAAE;AACJ;;;ACjRO,IAAM,mBAAkC,uBAAO,IAAI,2BAA2B;AAU9E,SAAS,YAAY,KAAgC;AAC1D,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,IAAI;AACV,SACE,EAAE,gBAAgB,MAAM,QACxB,OAAO,EAAE,WAAW,YACpB,OAAO,EAAE,UAAU,YACnB,OAAO,EAAE,qBAAqB;AAElC;AAEO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAEhB,CAAiB,gBAAgB,IAAI;AAAA,EAErC,YAAY,QAAgB,OAAe,kBAA0B,MAAgB;AACnF,UAAM,gBAAgB;AACtB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,mBAAmB;AACxB,QAAI,SAAS,QAAW;AACtB,WAAK,OAAO;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,WAML;AACA,UAAM,SAMF;AAAA,MACF,OAAO,KAAK;AAAA,MACZ,mBAAmB,KAAK;AAAA,MACxB,QAAQ,KAAK;AAAA,IACf;AACA,QAAI,WAAW;AACb,aAAO,aAAa;AAAA,IACtB;AACA,QAAI,KAAK,SAAS,QAAW;AAC3B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;AASO,IAAM,WAAN,cAAuB,UAAU;AAAA,EACtC,YAAY,QAAgB,MAAc,aAAqB,MAAgB;AAC7E,UAAM,QAAQ,MAAM,aAAa,IAAI;AACrC,SAAK,OAAO;AAAA,EACd;AACF;AAKA,IAAe,iBAAf,cAAsC,UAAU;AAAA,EACpC,YACR,QACA,aACA,MACA,SACA,MACA,MACA;AACA,UAAM,QAAQ,QAAQ,aAAa,WAAW,eAAe,IAAI,GAAG,IAAI;AACxE,SAAK,OAAO;AAAA,EACd;AACF;AAIA,SAAS,eAAe,MAAsB;AAC5C,QAAM,SAAS,KAAK,QAAQ,sBAAsB,OAAO;AACzD,SAAO,OAAO,OAAO,CAAC,EAAE,YAAY,IAAI,OAAO,MAAM,CAAC,EAAE,YAAY;AACtE;AAQO,IAAM,aAAN,cAAyB,eAAe;AAAA,EAE7C,YAAY,MAAsB,SAAkB;AAClD,UAAM,KAAK,eAAe,cAAc,SAAS,QAAW,IAAI;AAAA,EAClE;AACF;AAGO,IAAM,eAAN,cAA2B,eAAe;AAAA,EAC/C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,gBAAgB,gBAAgB,SAAS,MAAM,IAAI;AAAA,EAChE;AACF;AAGO,IAAM,YAAN,cAAwB,eAAe;AAAA,EAC5C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,aAAa,aAAa,SAAS,MAAM,IAAI;AAAA,EAC1D;AACF;AAGO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAC3C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,aAAa,YAAY,SAAS,MAAM,IAAI;AAAA,EACzD;AACF;AAGO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAC3C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,YAAY,YAAY,SAAS,MAAM,IAAI;AAAA,EACxD;AACF;AA4BO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAElD,YAAY,MAA2B,SAAkB;AACvD,UAAM,KAAK,qBAAqB,mBAAmB,SAAS,QAAW,IAAI;AAAA,EAC7E;AACF;","names":[]}

package/dist/db/env.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/env.ts"],"sourcesContent":["/**\n * `@palbase/backend/env` — the controlled global augmentation target for the\n * project's schema.\n *\n * `Database.tables.<name>` is typed against the `Tables` interface declared\n * here. By default `Tables` is EMPTY; the generated `palbase-env.d.ts`\n * (emitted from `db/schema.ts` by {@link makeEnvDts}) augments it with one\n * member per table:\n *\n *   // palbase-env.d.ts (generated — do not edit)\n *   declare module \"@palbase/backend/env\" {\n *     interface Tables {\n *       todos: { row: {...}; insert: {...} };\n *     }\n *   }\n *\n * Because a `br-<ref>` pod is single-project, augmenting one global `Tables`\n * interface is safe — there is no cross-project \"leak\" to worry about (a pod\n * only ever compiles one project's schema). This is the C5 decision: typed\n * `Database.tables.*` with NO import and NO generic in handler code.\n *\n * Authors who want the row type explicitly can import it:\n *\n *   import type { Tables } from \"@palbase/backend/env\";\n *   type Todo = Tables[\"todos\"][\"row\"];\n */\n\n/**\n * One typed table's shapes and its position in the user-rooted graph:\n *\n * - `row` — the full row, every column present.\n * - `insert` — the write payload, required vs optional columns.\n * - `owner` — the column that foreign-keys `auth.users` (declared in\n *   `db/schema.ts` with `.referencesAuthUser(...)`), or `null` when the table\n *   is not user-rooted. This is what makes a seed/fixture DSL able to OMIT the\n *   owner column from the author-facing type: the apply step fills it.\n * - `children` — tables that foreign-key THIS table, mapped to the FK column on\n *   the child (`{ todos: \"list_id\" }`). Lets a nested seed attach children\n *   without the author ever writing the FK. Self-FKs and cycle back-edges are\n *   omitted by the generator so recursive types over `children` terminate.\n *\n * The generated `palbase-env.d.ts` fills `row`/`insert` with flat object types —\n * no `ColumnBuilder` phantom types ever appear in the generated output — and\n * `owner`/`children` with string literals.\n */\nexport interface TableTypes {\n  row: Record<string, unknown>;\n  insert: Record<string, unknown>;\n  owner: string | null;\n  children: Record<string, string>;\n}\n\n/**\n * The project's tables, keyed by table name. EMPTY by default; the generated\n * `palbase-env.d.ts` augments this interface (module augmentation), so\n * `Database.tables` is typed everywhere with no per-file import.\n */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-env.d.ts.\nexport interface Tables {}\n\n/**\n * One typed bucket: which renditions `config/storage.ts` declared for it.\n *\n * `variants` is a UNION of the declared names, so asking for one the bucket\n * does not have is a compile error rather than a 404 somebody finds in\n * production. The generated `palbase-env.d.ts` fills it; the default `never`\n * means a bucket declared without variants accepts no variant name at all,\n * which is exactly right.\n */\nexport interface BucketTypes {\n  variants: string;\n}\n\n/**\n * The project's storage buckets, keyed by bucket name. EMPTY by default; the\n * generated `palbase-env.d.ts` augments it, so `Storage.buckets` is typed\n * everywhere with no per-file import — the same mechanism `Tables` uses, and\n * deliberately so: an author learns one pattern.\n */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-env.d.ts.\nexport interface Buckets {}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}
+{"version":3,"sources":["../../src/db/env.ts"],"sourcesContent":["/**\n * `@palbase/backend/env` — the controlled global augmentation target for the\n * project's schema.\n *\n * `Database.tables.<name>` is typed against the `Tables` interface declared\n * here. By default `Tables` is EMPTY; the generated `palbase-env.d.ts`\n * (emitted from `db/schema.ts` by {@link makeEnvDts}) augments it with one\n * member per table:\n *\n *   // palbase-env.d.ts (generated — do not edit)\n *   declare module \"@palbase/backend/env\" {\n *     interface Tables {\n *       todos: { row: {...}; insert: {...} };\n *     }\n *   }\n *\n * Because a `br-<ref>` pod is single-project, augmenting one global `Tables`\n * interface is safe — there is no cross-project \"leak\" to worry about (a pod\n * only ever compiles one project's schema). This is the C5 decision: typed\n * `Database.tables.*` with NO import and NO generic in handler code.\n *\n * Authors who want the row type explicitly can import it:\n *\n *   import type { Tables } from \"@palbase/backend/env\";\n *   type Todo = Tables[\"todos\"][\"row\"];\n */\n\n/**\n * One typed table's shapes and its position in the user-rooted graph:\n *\n * - `row` — the full row, every column present.\n * - `insert` — the write payload, required vs optional columns.\n * - `owner` — the column that foreign-keys `auth.users` (declared in\n *   `db/schema.ts` with `.referencesAuthUser(...)`), or `null` when the table\n *   is not user-rooted. This is what makes a seed/fixture DSL able to OMIT the\n *   owner column from the author-facing type: the apply step fills it.\n * - `children` — tables that foreign-key THIS table, mapped to the FK column on\n *   the child (`{ todos: \"list_id\" }`). Lets a nested seed attach children\n *   without the author ever writing the FK. Self-FKs and cycle back-edges are\n *   omitted by the generator so recursive types over `children` terminate.\n *\n * The generated `palbase-env.d.ts` fills `row`/`insert` with flat object types —\n * no `ColumnBuilder` phantom types ever appear in the generated output — and\n * `owner`/`children` with string literals.\n */\nexport interface TableTypes {\n  row: Record<string, unknown>;\n  insert: Record<string, unknown>;\n  owner: string | null;\n  children: Record<string, string>;\n}\n\n/**\n * The project's tables, keyed by table name. EMPTY by default; the generated\n * `palbase-env.d.ts` augments this interface (module augmentation), so\n * `Database.tables` is typed everywhere with no per-file import.\n */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-env.d.ts.\nexport interface Tables {}\n\n// BUCKETS MOVED TO `@palbase/backend/stack` (2026-08-29).\n//\n// `BucketTypes` and `Buckets` lived here because `config/storage.ts` declared\n// buckets and the deploy folded them into `palbase-env.d.ts` beside the schema's\n// tables. Buckets never came from the schema, and they do not come from a\n// declaration any more: the STACK holds them, so their types are generated into\n// `palbase-stack.d.ts` with the secrets and flags.\n//\n// Re-exported here so `Storage.buckets` keeps its one import site and no caller\n// has to learn that the source moved.\nexport type { BucketTypes, Buckets } from \"../stack.js\";\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}