@palbase/backend 23.0.0 → 23.1.0

package/dist/index.cjs

@@ -57,6 +57,9 @@ __export(src_exports, {
   Req: () => Req,
   RequestId: () => RequestId,
   Secrets: () => Secrets,
+  Signal: () => Signal,
+  Sse: () => Sse,
+  SseOut: () => SseOut,
   Storage: () => Storage,
   TooManyRequests: () => TooManyRequests,
   TraceId: () => TraceId,
@@ -354,6 +357,19 @@ var TxPlanBuilder = class {
         }
         return this.push({ op: "insert", table: name, values: encoded }, `${name}.insert()`);
       },
+      upsert: (values, options) => {
+        const encoded = encodeMap(values, false);
+        if (Object.keys(encoded).length === 0) {
+          throw new TxPlanError(`${name}.upsert() needs at least one column`);
+        }
+        if (options.onConflict.length === 0) {
+          throw new TxPlanError(`${name}.upsert() needs at least one onConflict column`);
+        }
+        return this.push(
+          { op: "upsert", table: name, values: encoded, onConflict: options.onConflict },
+          `${name}.upsert()`
+        );
+      },
       insertMany: (rows) => {
         if (rows.length === 0) {
           return new TxRowsImpl(this, SKIPPED_OP, `${name}.insertMany()`);
@@ -564,7 +580,8 @@ function makeTablesAccessor(ops) {
           update: (id, data) => ops().update(name, id, data),
           delete: (id) => ops().delete(name, id),
           findById: (id) => ops().findById(name, id),
-          findMany: (query) => ops().findMany(name, query),
+          findMany: (query, opts) => ops().findMany(name, query, opts),
+          upsert: (data, opts) => ops().upsert(name, data, opts),
           search: (params) => ops().search(name, params),
           similar: (id, params) => ops().similar(name, id, params),
           recommend: (params) => ops().recommend(name, params),
@@ -584,13 +601,17 @@ function makeTypedSurface(raw2) {
     update: (table, id, data) => raw2.update(table, id, data),
     delete: (table, id) => raw2.delete(table, id),
     findById: (table, id) => raw2.findById(table, id),
-    findMany: (table, query) => raw2.findMany(table, query),
+    findMany: (table, query, opts) => raw2.findMany(table, query, opts),
+    upsert: (table, data, opts) => raw2.upsert(table, data, opts),
     search: (table, params) => raw2.search(table, params),
     similar: (table, id, params) => reco.similar(table, id, params),
     recommend: (table, params) => reco.recommend(table, params),
     supersede: (table, id, row) => raw2.supersede(table, id, row)
   };
   return Object.assign(ops, {
+    // Both surfaces get it: a savepoint on the service transaction is as useful
+    // as one on the request's, and each is bound to its own connection.
+    attempt: (fn) => raw2.attempt(fn),
     tables: makeTablesAccessor(() => reco),
     transaction(fn) {
       const builder = new TxPlanBuilder();
@@ -1573,6 +1594,9 @@ function buildModuleClients(cfg) {
 }
 
 // src/db/policy.ts
+function quote(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
 var PolicyBuilder = class {
   _def;
   constructor(name) {
@@ -1608,6 +1632,41 @@ var PolicyBuilder = class {
     this._def.using = sqlExpr;
     return this;
   }
+  /**
+   * "Rows of THIS table whose owner the caller is a member of" — the membership
+   * pattern, written so it cannot recurse.
+   *
+   * THE TRAP IT EXISTS FOR. Written by hand, membership policies point at each
+   * other: `channels` is visible to members, so its policy reads
+   * `channel_members`; `channel_members` is visible to members, so its policy
+   * reads `channels`. Postgres refuses the pair at query time with `infinite
+   * recursion detected in policy for relation ...`, and the error names the
+   * relation but not the cycle. The way out is asymmetry — the MEMBERSHIP table
+   * is protected by `user_id = auth.uid()` and nothing else, and every other
+   * table subqueries INTO it. That shape was in the platform's own schema and
+   * written down nowhere; a customer recovered it by reading that schema.
+   *
+   * `(select auth.uid())` rather than a bare call: the scalar subquery is
+   * evaluated ONCE per statement instead of per row.
+   *
+   * @example
+   * // channels: visible to members. The membership table gets the simple one.
+   * policy("member_read").for("select").to("authenticated")
+   *   .memberOf("channel_members", "channel_id")
+   * // → id IN (SELECT "channel_id" FROM "channel_members"
+   * //          WHERE "user_id" = (select auth.uid()))
+   */
+  memberOf(membershipTable, foreignKey, options = {}) {
+    if (this._def.using !== null) {
+      throw new Error(
+        `policy(${this._def.name}).memberOf(): this policy already has a using() expression. Write one or the other \u2014 memberOf IS the using expression.`
+      );
+    }
+    const column = options.column ?? "id";
+    const userColumn = options.userColumn ?? "user_id";
+    this._def.using = `${quote(column)} IN (SELECT ${quote(foreignKey)} FROM ${quote(membershipTable)} WHERE ${quote(userColumn)} = (select auth.uid()))`;
+    return this;
+  }
   /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */
   withCheck(sqlExpr) {
     this._def.withCheck = sqlExpr;
@@ -2033,6 +2092,21 @@ var ColumnBuilder = class _ColumnBuilder {
     this._def.defaultNow = true;
     return new _ColumnBuilder(this._def.type, this._def);
   }
+  /**
+   * The DATABASE assigns this column's value — a trigger, a rule, an identity.
+   *
+   * The column becomes optional on INSERT (the author has nothing to send) while
+   * the DDL stays free of a DEFAULT this schema would not honour. It is NOT
+   * `default()`: that declares a value the schema promises to write.
+   *
+   * Naming: deliberately not `generated()`. Postgres has GENERATED columns and
+   * they are a different thing; borrowing the word would send a reader — or a
+   * model writing a schema — to the wrong feature.
+   */
+  dbAssigned() {
+    this._def.dbAssigned = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
   /** Add a foreign key reference. */
   /**
    * Declares that this column used to be called `previous`.
@@ -2180,10 +2254,11 @@ var openai = {
 function makeTypedTable(name, raw2) {
   return {
     insert: (data) => raw2.insert(name, data),
+    upsert: (data, opts) => raw2.upsert(name, data, opts),
     update: (id, data) => raw2.update(name, id, data),
     delete: (id) => raw2.delete(name, id),
     findById: (id) => raw2.findById(name, id),
-    findMany: (query) => raw2.findMany(name, query)
+    findMany: (query, opts) => raw2.findMany(name, query, opts)
   };
 }
 function makeTypedDB(schema, raw2) {
@@ -2750,6 +2825,29 @@ function validateUploadConfigShape(c) {
   }
 }
 
+// src/decorators/sse.ts
+function Sse(subpath = "", config) {
+  const { auth, rateLimit, ...sseConfig } = config;
+  const options = {
+    sseConfig,
+    ...auth !== void 0 ? { auth } : {},
+    ...rateLimit !== void 0 ? { rateLimit } : {}
+  };
+  return function(target, propertyKey) {
+    recordRoute(target, String(propertyKey), "POST", subpath, options);
+  };
+}
+function SseOut() {
+  return function(target, propertyKey, parameterIndex) {
+    recordParam(target, String(propertyKey), { index: parameterIndex, kind: "sseOut" });
+  };
+}
+function Signal() {
+  return function(target, propertyKey, parameterIndex) {
+    recordParam(target, String(propertyKey), { index: parameterIndex, kind: "signal" });
+  };
+}
+
 // src/decorators/params.ts
 function makeParamDecorator(kind, extra) {
   return function(target, propertyKey, parameterIndex) {
@@ -3156,6 +3254,9 @@ var import_zod2 = require("zod");
   Req,
   RequestId,
   Secrets,
+  Signal,
+  Sse,
+  SseOut,
   Storage,
   TooManyRequests,
   TraceId,