@palbase/backend 23.0.0 → 23.1.0

package/dist/test/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/test/api.ts"],"sourcesContent":["/** The client a tenant's tests use to call their own backend.\n *\n * These tests run against a REAL deployment — the release the deploy just built,\n * serving from the same Environment as production, with the same database, the\n * same secrets and the same gateway in front of it. So this client is a plain\n * HTTP client, not a simulation: every call crosses the gateway, the API key\n * check, the auth rail, the zod validation at the boundary, and row-level\n * security, exactly as a shipped app's call does.\n *\n * There is deliberately no schema knowledge here. The tenant already wrote their\n * types — `import type { TodoSchema } from \"../models/todos/shared.js\"` — so a\n * test types its own call (`api.get<TodoSchema[]>(\"/todos\")`) and can validate it\n * with the same zod schema the endpoint declares. A second generated client would\n * be a second thing to keep in step.\n */\n\n/** How to reach the release under test. Supplied by the deploy, never guessed. */\nexport interface TestApiConfig {\n  baseUrl: string;\n  apiKey: string;\n  /** This deploy's secret. Without it the request is served the LIVE release. */\n  candidateToken: string;\n  /** The run's minted logins, keyed by the name declared in config/test-users.ts. */\n  identities?: Record<string, TestIdentity>;\n}\n\n/** One login the deploy minted for this run.\n *\n * `accessToken` is the session issued when the identity was created, and is what\n * `signInAs` uses. The credentials come along for a test that wants to exercise\n * the login rail itself — but a suite that switches users repeatedly must not be\n * signing in each time: those calls come from one address and trip the login rate\n * limiter, failing tests for a reason that has nothing to do with the code\n * under test.\n */\nexport interface TestIdentity {\n  id?: string;\n  email: string;\n  password: string;\n  accessToken?: string;\n}\n\n/** One call the suite made, in the order it was made. */\nexport interface RecordedRequest {\n  method: string;\n  path: string;\n  status: number;\n  ms: number;\n}\n\n/** A non-2xx answer, carrying the platform's error envelope.\n *\n * The envelope is the contract every Palbase endpoint answers with, so a test\n * asserts on `status`/`error`/`data` rather than parsing a message. The message\n * exists for the human reading a failed deploy.\n */\nexport class TestApiError extends Error {\n  readonly status: number;\n  readonly error: string;\n  /** Payload of an error your code threw — `new BadRequest({ fields })` arrives here. */\n  readonly data: unknown;\n  /** The whole envelope, exactly as the server sent it. */\n  readonly body: ErrorEnvelope;\n\n  constructor(method: string, path: string, status: number, body: unknown) {\n    const envelope = (body ?? {}) as ErrorEnvelope;\n    const code = envelope.error ?? String(status);\n    super(`${method} ${path} → ${status} ${code}${envelope.error_description ? `: ${envelope.error_description}` : \"\"}`);\n    this.name = \"TestApiError\";\n    this.status = status;\n    this.error = code;\n    this.data = envelope.data;\n    this.body = envelope;\n  }\n}\n\n/** A Palbase error response.\n *\n * `data` carries the payload of an error your code threw. Validation refused at\n * the boundary — before your handler runs — answers with `details` instead, one\n * entry per field. The index signature is deliberate: whatever the server sends\n * is readable from a test, so no assertion is ever blocked on this type being\n * exhaustive.\n */\nexport interface ErrorEnvelope {\n  error?: string;\n  error_description?: string;\n  status?: number;\n  request_id?: string;\n  data?: unknown;\n  details?: Array<{ field: string; message: string }>;\n  [key: string]: unknown;\n}\n\nexport interface CallOptions {\n  headers?: Record<string, string>;\n}\n\nexport interface TestApi {\n  get<T = unknown>(path: string, opts?: CallOptions): Promise<T>;\n  post<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  patch<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  put<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  delete<T = unknown>(path: string, opts?: CallOptions): Promise<T>;\n  /** HTTP QUERY (RFC 10008): a safe, idempotent read whose filter travels in the body. */\n  query<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  /** Sign in with credentials you supply. */\n  signIn(credentials: { email: string; password: string }): Promise<{ id: string; email?: string }>;\n  /**\n   * Sign in as one of the identities this run was given, by the name you\n   * declared it under in `config/test-users.ts`.\n   *\n   * Each is minted by the platform for the length of ONE deploy, seeded with the\n   * data that declaration describes, and retired after — which is why this works\n   * on every Environment including production, where a committed fixture password\n   * is refused on purpose.\n   */\n  signInAs(name: string): Promise<{ id: string; email?: string }>;\n  signOut(): Promise<void>;\n  /** Drop the bearer without calling the server — the anonymous caller. */\n  asAnonymous(): void;\n  /** Every call made, in order. Printed for the failing test in a red deploy. */\n  readonly requests: readonly RecordedRequest[];\n}\n\nfunction required(value: string, envName: string): string {\n  if (!value) {\n    throw new Error(\n      `${envName} is not set — the test client has nowhere to send requests. ` +\n        `This is set by the deploy that runs your tests; if you are running them by hand, set it yourself.`,\n    );\n  }\n  return value;\n}\n\nexport function createTestApi(config: TestApiConfig): TestApi {\n  const baseUrl = required(config.baseUrl, \"PALBASE_TEST_BASE_URL\").replace(/\\/$/, \"\");\n  const apiKey = required(config.apiKey, \"PALBASE_TEST_API_KEY\");\n  const candidateToken = required(config.candidateToken, \"PALBASE_TEST_CANDIDATE\");\n\n  const requests: RecordedRequest[] = [];\n  let bearer: string | null = null;\n\n  async function call<T>(method: string, path: string, body: unknown, opts: CallOptions = {}): Promise<T> {\n    const headers: Record<string, string> = {\n      apikey: apiKey,\n      // Selects the release under test. Omit it and the gateway serves the LIVE\n      // one, which would make the whole suite grade the wrong code.\n      \"x-palbase-candidate\": candidateToken,\n      ...opts.headers,\n    };\n    if (bearer) headers.authorization = `Bearer ${bearer}`;\n    if (body !== undefined) headers[\"content-type\"] = \"application/json\";\n\n    const startedAt = Date.now();\n    const res = await fetch(`${baseUrl}${path}`, {\n      method,\n      headers,\n      body: body === undefined ? undefined : JSON.stringify(body),\n    });\n    const text = await res.text();\n    const parsed: unknown = text ? safeParse(text) : undefined;\n\n    requests.push({ method, path, status: res.status, ms: Date.now() - startedAt });\n\n    if (!res.ok) throw new TestApiError(method, path, res.status, parsed);\n    return parsed as T;\n  }\n\n  return {\n    requests,\n    get: (path, opts) => call(\"GET\", path, undefined, opts),\n    post: (path, body, opts) => call(\"POST\", path, body, opts),\n    patch: (path, body, opts) => call(\"PATCH\", path, body, opts),\n    put: (path, body, opts) => call(\"PUT\", path, body, opts),\n    delete: (path, opts) => call(\"DELETE\", path, undefined, opts),\n    query: (path, body, opts) => call(\"QUERY\", path, body, opts),\n\n    async signInAs(name) {\n      const identity = (config.identities ?? {})[name];\n      if (!identity) {\n        const declared = Object.keys(config.identities ?? {});\n        throw new Error(\n          `no test identity named ${JSON.stringify(name)} — the deploy mints one per user declared in ` +\n            `config/test-users.ts` +\n            (declared.length\n              ? `; this run has: ${declared.join(\", \")}`\n              : // Not \"you declared none\": from here the two causes are\n                // indistinguishable, and blaming the customer's config for a\n                // platform failure sends them to look in the wrong file. The\n                // deploy log names which one it was.\n                \", and this run has none — either your config declares no users \" +\n                \"or the deploy could not mint them; the deploy log says which\"),\n        );\n      }\n      // The session the mint already issued — no network call, so switching\n      // users is free and the login rail never sees this run.\n      if (identity.accessToken) {\n        bearer = identity.accessToken;\n        return { id: identity.id ?? \"\", email: identity.email };\n      }\n      return this.signIn(identity);\n    },\n\n    async signIn(credentials) {\n      const result = await call<{ access_token: string; user?: { id: string; email?: string } }>(\n        \"POST\",\n        \"/auth/login\",\n        credentials,\n      );\n      bearer = result.access_token;\n      return result.user ?? { id: \"\" };\n    },\n    async signOut() {\n      await call(\"POST\", \"/auth/logout\", undefined);\n      bearer = null;\n    },\n    asAnonymous() {\n      bearer = null;\n    },\n  };\n}\n\n/** The run's identities, as the deploy passed them. Absent is not an error: a\n * project that declares none still runs every test that needs no login. */\nfunction parseIdentities(raw: string | undefined): Record<string, TestIdentity> {\n  if (!raw) return {};\n  try {\n    return JSON.parse(raw) as Record<string, TestIdentity>;\n  } catch {\n    return {};\n  }\n}\n\nfunction safeParse(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\n/** The client the deploy configured, from the environment it set.\n *\n * Constructed lazily so importing this module outside a test run — a typecheck,\n * an editor — does not fail on absent configuration.\n */\nlet configured: TestApi | null = null;\n\nexport const api: TestApi = new Proxy({} as TestApi, {\n  get(_target, prop) {\n    configured ??= createTestApi({\n      baseUrl: process.env.PALBASE_TEST_BASE_URL ?? \"\",\n      apiKey: process.env.PALBASE_TEST_API_KEY ?? \"\",\n      candidateToken: process.env.PALBASE_TEST_CANDIDATE ?? \"\",\n      identities: parseIdentities(process.env.PALBASE_TEST_IDENTITIES),\n    });\n    return Reflect.get(configured, prop, configured);\n  },\n});\n"],"mappings":";;;AAwDO,IAAM,eAAN,cAA2B,MAAM;AAAA,EAC7B;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,QAAgB,MAAc,QAAgB,MAAe;AACvE,UAAM,WAAY,QAAQ,CAAC;AAC3B,UAAM,OAAO,SAAS,SAAS,OAAO,MAAM;AAC5C,UAAM,GAAG,MAAM,IAAI,IAAI,WAAM,MAAM,IAAI,IAAI,GAAG,SAAS,oBAAoB,KAAK,SAAS,iBAAiB,KAAK,EAAE,EAAE;AACnH,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,OAAO,SAAS;AACrB,SAAK,OAAO;AAAA,EACd;AACF;AAmDA,SAAS,SAAS,OAAe,SAAyB;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,GAAG,OAAO;AAAA,IAEZ;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,cAAc,QAAgC;AAC5D,QAAM,UAAU,SAAS,OAAO,SAAS,uBAAuB,EAAE,QAAQ,OAAO,EAAE;AACnF,QAAM,SAAS,SAAS,OAAO,QAAQ,sBAAsB;AAC7D,QAAM,iBAAiB,SAAS,OAAO,gBAAgB,wBAAwB;AAE/E,QAAM,WAA8B,CAAC;AACrC,MAAI,SAAwB;AAE5B,iBAAe,KAAQ,QAAgB,MAAc,MAAe,OAAoB,CAAC,GAAe;AACtG,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA;AAAA;AAAA,MAGR,uBAAuB;AAAA,MACvB,GAAG,KAAK;AAAA,IACV;AACA,QAAI,OAAQ,SAAQ,gBAAgB,UAAU,MAAM;AACpD,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAElD,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAkB,OAAO,UAAU,IAAI,IAAI;AAEjD,aAAS,KAAK,EAAE,QAAQ,MAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC;AAE9E,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,aAAa,QAAQ,MAAM,IAAI,QAAQ,MAAM;AACpE,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,KAAK,CAAC,MAAM,SAAS,KAAK,OAAO,MAAM,QAAW,IAAI;AAAA,IACtD,MAAM,CAAC,MAAM,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,IAAI;AAAA,IACzD,OAAO,CAAC,MAAM,MAAM,SAAS,KAAK,SAAS,MAAM,MAAM,IAAI;AAAA,IAC3D,KAAK,CAAC,MAAM,MAAM,SAAS,KAAK,OAAO,MAAM,MAAM,IAAI;AAAA,IACvD,QAAQ,CAAC,MAAM,SAAS,KAAK,UAAU,MAAM,QAAW,IAAI;AAAA,IAC5D,OAAO,CAAC,MAAM,MAAM,SAAS,KAAK,SAAS,MAAM,MAAM,IAAI;AAAA,IAE3D,MAAM,SAAS,MAAM;AACnB,YAAM,YAAY,OAAO,cAAc,CAAC,GAAG,IAAI;AAC/C,UAAI,CAAC,UAAU;AACb,cAAM,WAAW,OAAO,KAAK,OAAO,cAAc,CAAC,CAAC;AACpD,cAAM,IAAI;AAAA,UACR,0BAA0B,KAAK,UAAU,IAAI,CAAC,4EAE3C,SAAS,SACN,mBAAmB,SAAS,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,YAKtC;AAAA;AAAA,QAER;AAAA,MACF;AAGA,UAAI,SAAS,aAAa;AACxB,iBAAS,SAAS;AAClB,eAAO,EAAE,IAAI,SAAS,MAAM,IAAI,OAAO,SAAS,MAAM;AAAA,MACxD;AACA,aAAO,KAAK,OAAO,QAAQ;AAAA,IAC7B;AAAA,IAEA,MAAM,OAAO,aAAa;AACxB,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,eAAS,OAAO;AAChB,aAAO,OAAO,QAAQ,EAAE,IAAI,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,UAAU;AACd,YAAM,KAAK,QAAQ,gBAAgB,MAAS;AAC5C,eAAS;AAAA,IACX;AAAA,IACA,cAAc;AACZ,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAIA,SAAS,gBAAgB,KAAuD;AAC9E,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,UAAU,MAAuB;AACxC,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,IAAI,aAA6B;AAE1B,IAAM,MAAe,IAAI,MAAM,CAAC,GAAc;AAAA,EACnD,IAAI,SAAS,MAAM;AACjB,mBAAe,cAAc;AAAA,MAC3B,SAAS,QAAQ,IAAI,yBAAyB;AAAA,MAC9C,QAAQ,QAAQ,IAAI,wBAAwB;AAAA,MAC5C,gBAAgB,QAAQ,IAAI,0BAA0B;AAAA,MACtD,YAAY,gBAAgB,QAAQ,IAAI,uBAAuB;AAAA,IACjE,CAAC;AACD,WAAO,QAAQ,IAAI,YAAY,MAAM,UAAU;AAAA,EACjD;AACF,CAAC;","names":[]}
+{"version":3,"sources":["../../../core/src/config.ts","../../../core/src/errors.ts","../../../core/src/pow.ts","../../../core/src/platform.ts","../../../core/src/http.ts","../../../core/src/token.ts","../../src/test/api.ts","../../src/__tests__/helpers/mock-db.ts","../../src/test/fake-db.ts"],"sourcesContent":["import type { HttpClient } from './http.js';\nimport type { ProjectConfig } from './types.js';\n\nconst CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes\n\nexport class ConfigFetcher {\n  protected readonly httpClient: HttpClient;\n  private cachedConfig: ProjectConfig | null = null;\n  private cacheTimestamp = 0;\n\n  constructor(httpClient: HttpClient) {\n    this.httpClient = httpClient;\n  }\n\n  async getConfig(): Promise<ProjectConfig | null> {\n    const now = Date.now();\n\n    if (this.cachedConfig && now - this.cacheTimestamp < CACHE_TTL_MS) {\n      return this.cachedConfig;\n    }\n\n    try {\n      const response = await this.httpClient.request<ProjectConfig>('GET', '/v1/config');\n\n      if (response.error || !response.data) {\n        return null;\n      }\n\n      this.cachedConfig = response.data;\n      this.cacheTimestamp = now;\n\n      return this.cachedConfig;\n    } catch {\n      return null;\n    }\n  }\n}\n","export class PalbaseError extends Error {\n  readonly code: string;\n  readonly status: number;\n  readonly details?: unknown;\n\n  constructor(code: string, message: string, status: number, details?: unknown) {\n    super(message);\n    this.name = 'PalbaseError';\n    this.code = code;\n    this.status = status;\n    this.details = details;\n  }\n}\n","// Proof-of-work: the bot gate in front of /auth/signup and /auth/login.\n//\n// The server answers an unsolved request with 403 and a challenge in the body:\n//\n//   { \"error\": \"pow_required\", \"challenge\": { \"id\", \"prefix\", \"difficulty\" } }\n//\n// A client finds any nonce whose SHA-256(prefix + nonce) begins with\n// `difficulty` zero bits, then repeats the request carrying the id and nonce as\n// headers. The work is the point: a person signing up pays it once and does not\n// notice, a script signing up ten thousand times pays it ten thousand times.\n//\n// # Why this lives in core, and not one layer up\n//\n// Until 2026-08-14 nothing shipped could solve it: the gate was written with the\n// server and its own integration harness, and every real client sent requests\n// without the headers and got 403. It was then solved in @palbase/web's own\n// request path — which covers `pb.call` and the module facades and NOT\n// `pb.auth.*`, because those go through @palbase/auth's client and from there\n// into core's HttpClient. So the fix landed everywhere except the two endpoints\n// the gate actually guards, and `npm i @palbase/web` still could not sign a\n// person in. Measured 2026-08-18 against a real stack, on the published 7.3.0.\n//\n// The lesson is where a retry belongs: at the layer that ISSUES the request.\n// Core owns fetch for every client in this repo, so core owns the challenge.\n//\n// WebCrypto rather than a hashing dependency: `crypto.subtle` is present in\n// browsers and in Node 18+, which is the same floor the rest of the SDK sets.\n// Measured at the server's default difficulty of 16: ~330ms, ~65k digests.\n\n/** The challenge a `pow_required` response carries. */\nexport interface PowChallenge {\n  id: string;\n  prefix: string;\n  difficulty: number;\n}\n\n/** Header names the retry must carry. Mirrors the server's constants. */\nexport const POW_CHALLENGE_ID_HEADER = 'X-PoW-Challenge-ID';\nexport const POW_NONCE_HEADER = 'X-PoW-Nonce';\n\n/**\n * Reads a challenge out of an error envelope, or returns null when the envelope\n * is not a `pow_required` one.\n *\n * The whole wire envelope is stored on the error, so the challenge arrives\n * without the HTTP layer having to know about proof-of-work at all.\n */\nexport function asPowChallenge(details: unknown): PowChallenge | null {\n  if (typeof details !== 'object' || details === null) return null;\n  const env = details as Record<string, unknown>;\n  if (env.error !== 'pow_required') return null;\n  const c = env.challenge;\n  if (typeof c !== 'object' || c === null) return null;\n  const { id, prefix, difficulty } = c as Record<string, unknown>;\n  if (typeof id !== 'string' || typeof prefix !== 'string') return null;\n  if (typeof difficulty !== 'number' || !Number.isInteger(difficulty) || difficulty < 0) return null;\n  return { id, prefix, difficulty };\n}\n\nconst encoder = new TextEncoder();\n\n/**\n * One SHA-256, by the fastest route this runtime offers.\n *\n * Awaiting `crypto.subtle.digest` once per nonce is what made this expensive,\n * and the cost is the await rather than the hashing. Measured on one machine,\n * 200k digests of a 40-byte input:\n *\n *\tawaited crypto.subtle.digest     105,597 digests/s\n *\tsync node:crypto createHash    1,324,503 digests/s   — 12.5x\n *\n * That is the difference between difficulty 24 taking 159 seconds and taking\n * 13. Node, Bun and Deno all have the sync one; a browser has only WebCrypto,\n * and there it stays async.\n *\n * The specifier is assembled at runtime so a browser bundler does not try to\n * resolve `node:crypto` and fail the build over a branch that never runs there.\n */\ntype Hasher = (input: string) => Uint8Array | Promise<Uint8Array>;\n\nlet hasher: Hasher | null = null;\n\nasync function digester(): Promise<Hasher> {\n  if (hasher) return hasher;\n  // Read off globalThis with an inline shape rather than by naming `process`,\n  // which needs @types/node — a dependency this package does not have and should\n  // not grow for one branch. It typechecked locally only because those types\n  // were hoisted into node_modules by a sibling package; the publish workflow's\n  // clean checkout is what said so, which is exactly what it is for.\n  const runtime = globalThis as {\n    process?: { versions?: { node?: string; bun?: string } };\n  };\n  const nodeish =\n    runtime.process?.versions?.node !== undefined ||\n    runtime.process?.versions?.bun !== undefined;\n  if (nodeish) {\n    try {\n      const mod = (await import(/* @vite-ignore */ `${'node:'}crypto`)) as {\n        createHash?: (alg: string) => { update(s: string): { digest(): Uint8Array } };\n      };\n      if (typeof mod.createHash === 'function') {\n        const createHash = mod.createHash;\n        hasher = (input: string) => new Uint8Array(createHash('sha256').update(input).digest());\n        return hasher;\n      }\n    } catch {\n      // No node:crypto here. WebCrypto below is not a fallback in the apologetic\n      // sense — it is the only hash a browser has, and it is correct.\n    }\n  }\n  hasher = async (input: string) =>\n    new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(input)));\n  return hasher;\n}\n\n/** Monotonic where it exists, wall-clock where it does not. */\nconst now = (): number =>\n  typeof performance !== 'undefined' && typeof performance.now === 'function'\n    ? performance.now()\n    : Date.now();\n\n/** Counts leading zero bits, stopping at the first byte that has a one. */\nfunction leadingZeroBits(hash: Uint8Array): number {\n  let bits = 0;\n  for (const byte of hash) {\n    if (byte === 0) {\n      bits += 8;\n      continue;\n    }\n    // clz32 counts across 32 bits; a byte occupies the low 8, so the first 24\n    // are always zero and get subtracted back off.\n    return bits + Math.clz32(byte) - 24;\n  }\n  return bits;\n}\n\n/**\n * The hardest challenge this client will attempt.\n *\n * Not a taste: it is the server's own ceiling. palauth maps a risk score to a\n * difficulty and its worst case is 24 (`DifficultyForRisk`, bot/pow.go:156-166).\n * Anything above that cannot have come from a stack behaving as designed, and\n * the cost of humouring it falls entirely on this side — each step up DOUBLES\n * the work, so difficulty 30 is sixty-four times a legitimate worst case and, on\n * the web, sixty-four times a frozen main thread. Refused immediately, by name.\n */\nexport const MAX_POW_DIFFICULTY = 24;\n\n/**\n * Finds a nonce satisfying the challenge and returns the headers a retry needs.\n *\n * THE BUDGET SCALES WITH THE CHALLENGE, and the first version of this did not.\n * It bounded the search at a flat `1 << 24` — which is not a generous bound for\n * difficulty 24, it is the EXPECTED number of attempts. Finding a nonce is a\n * geometric process: the chance of needing more than 2^d attempts is 1/e, so a\n * flat 2^24 would have failed roughly 37% of legitimate hardest-risk challenges,\n * and failed them for precisely the users the gate exists to slow down — who\n * would have been unable to sign in at all rather than made to wait.\n *\n * Eight times expected puts that at e^-8, about three in ten thousand, while\n * leaving the common case (the server's default 16, and 12 for an unremarkable\n * caller) exactly as cheap as it was.\n *\n * `powBudget` is exported and separate so the RELATIONSHIP can be asserted\n * directly. A test that only watches a cheap challenge succeed cannot tell this\n * budget from the flat one it replaced — measured: reinstating `1 << 24` left\n * such a test green.\n */\nexport function powBudget(difficulty: number): number {\n  return 8 * 2 ** difficulty;\n}\n\n/**\n * The longest a solve may be ALLOWED to take, and the difference from a\n * deadline is the whole point.\n *\n * The first version of this was a flat 120s deadline, and it was measured to be\n * worse than the flat iteration budget it was meant to backstop: at ~105k\n * digests/s, difficulty 24 EXPECTS 159 seconds, so a 120s clock killed the\n * majority of legitimate hardest-risk solves — reintroducing, larger, exactly\n * the class of defect that replacing `1 << 24` had removed. Guessing a number\n * for an unknown machine cannot work: the same difficulty is 13 seconds on a\n * runtime with a sync hasher and 159 on one without.\n *\n * So the machine is MEASURED, and the decision moves to the front. A short\n * calibration gives the rate this process actually hashes at; if the whole\n * iteration budget cannot fit in this window at that rate, the solve is refused\n * IMMEDIATELY, naming the numbers. A caller then learns in milliseconds that\n * this difficulty is unpayable here, instead of after two minutes of work\n * thrown away.\n *\n * What remains after that is a guarantee rather than a gamble: a solve that\n * starts can always finish inside its budget, so the only failure left is the\n * budget's own e^-8.\n */\nexport const POW_TIME_BUDGET_MS = 120_000;\n\n/**\n * The window the rate is measured over, and the warm-up it deliberately skips.\n *\n * All of these are REAL attempts — the search starts at nonce 0 and never\n * restarts — so calibration costs nothing but the reading. The first 1024 are\n * excluded from the timing because they include this loop's own JIT warm-up:\n * measured, timing from zero reported 747k digests/s on a machine whose steady\n * rate is 1.32M, and the decision below would have refused a difficulty this\n * machine can pay in half the allowance.\n */\nconst CALIBRATION_WARMUP = 1024;\nconst CALIBRATION_END = 9216;\n\nexport async function solvePowChallenge(\n  challenge: PowChallenge,\n  maxIterations = powBudget(challenge.difficulty),\n  // The caller's AbortSignal, honoured INSIDE the loop rather than only around\n  // the fetch it precedes — for the callers that have one. `pb.auth.signIn` does\n  // NOT: it reaches the network through @palbase/auth's client, which takes\n  // credentials and nothing else. So it is the extra a caller can opt into, and\n  // POW_TIME_BUDGET_MS below is what actually bounds the work.\n  signal?: AbortSignal,\n): Promise<Record<string, string>> {\n  if (challenge.difficulty > MAX_POW_DIFFICULTY) {\n    throw new Error(\n      `proof-of-work: refusing difficulty ${challenge.difficulty}; this client attempts at most ${MAX_POW_DIFFICULTY}, which is the highest a Palbase stack issues`,\n    );\n  }\n\n  const digest = await digester();\n  let warmedAt = 0;\n  let calibrated = false;\n  // Armed by the calibration below, never before it: until the rate is known\n  // there is no honest number to put here.\n  let deadline = Number.POSITIVE_INFINITY;\n\n  for (let nonce = 0; nonce < maxIterations; nonce++) {\n    // Checked in batches: reading them is cheap but not free, and a\n    // 1024-digest granularity bounds the delay at a few milliseconds.\n    if ((nonce & 1023) === 0) {\n      if (signal?.aborted) {\n        throw new DOMException('proof-of-work solve aborted', 'AbortError');\n      }\n      if (now() > deadline) {\n        throw new Error(\n          `proof-of-work: gave up on difficulty ${challenge.difficulty} after ${POW_TIME_BUDGET_MS / 1000}s ` +\n            `and ${nonce.toLocaleString()} attempts — the tail this run drew is longer than the allowance`,\n        );\n      }\n    }\n\n    // THE DECISION, TAKEN ONCE AND TAKEN EARLY.\n    //\n    // After CALIBRATION_DIGESTS real attempts the rate of THIS process is\n    // known, so the question \"can this machine pay this difficulty\" has an\n    // answer instead of an assumption. If the whole budget cannot fit in the\n    // time budget, refuse here — milliseconds in, with the numbers — rather\n    // than spend two minutes and throw them away. If it fits, everything after\n    // this point is guaranteed to finish inside the window, so the only\n    // remaining failure is the budget's own e^-8.\n    if (nonce === CALIBRATION_WARMUP) {\n      warmedAt = now();\n    }\n    if (!calibrated && nonce === CALIBRATION_END) {\n      calibrated = true;\n      const elapsed = Math.max(now() - warmedAt, 0.001);\n      const rate = (CALIBRATION_END - CALIBRATION_WARMUP) / (elapsed / 1000);\n      // EXPECTED, not worst case, and the difference is the whole judgement.\n      //\n      // Finding a nonce is geometric: 2^difficulty attempts on average, with a\n      // long tail the 8x budget covers. Refusing because the TAIL will not fit\n      // would turn away work whose expected cost is seventeen seconds — measured\n      // exactly that on this machine at difficulty 24. Refusing on the EXPECTED\n      // cost turns away only what is genuinely unpayable here, and what it lets\n      // through is then cut by the clock with probability e^-(budget/expected):\n      // at 120s against a 17s expectation that is one run in a thousand, and at\n      // difficulty 20 on a browser it is one in a hundred and fifty thousand.\n      const expectedMs = (2 ** challenge.difficulty / rate) * 1000;\n      if (expectedMs > POW_TIME_BUDGET_MS) {\n        throw new Error(\n          `proof-of-work: difficulty ${challenge.difficulty} needs about ${Math.round(expectedMs / 1000)}s here ` +\n            `(${Math.round(rate).toLocaleString()} digests/s) and this client allows ${POW_TIME_BUDGET_MS / 1000}s; ` +\n            `refusing before spending the time rather than after`,\n        );\n      }\n      deadline = now() + (POW_TIME_BUDGET_MS - (now() - warmedAt));\n    }\n\n    const hash = await digest(challenge.prefix + nonce);\n    if (leadingZeroBits(hash) >= challenge.difficulty) {\n      return {\n        [POW_CHALLENGE_ID_HEADER]: challenge.id,\n        [POW_NONCE_HEADER]: String(nonce),\n      };\n    }\n  }\n  throw new Error(\n    `proof-of-work: no nonce found for difficulty ${challenge.difficulty} within ${maxIterations} attempts`,\n  );\n}\n","export type Platform = 'browser' | 'node' | 'react-native' | 'deno' | 'bun';\n\ndeclare const Deno: unknown;\ndeclare const process: { versions: Record<string, string> } | undefined;\n\nexport function detectPlatform(): Platform {\n  if (typeof Deno !== 'undefined') {\n    return 'deno';\n  }\n\n  if (process?.versions) {\n    if ('bun' in process.versions) {\n      return 'bun';\n    }\n    if ('node' in process.versions) {\n      return 'node';\n    }\n  }\n\n  if (typeof navigator !== 'undefined' && navigator.product === 'ReactNative') {\n    return 'react-native';\n  }\n\n  return 'browser';\n}\n\n/**\n * The platform word this SDK puts on the wire (`X-Platform`), which the server\n * reads to target flags and to label telemetry.\n *\n * It is NOT `detectPlatform()`'s value verbatim: that reports the JS host\n * (\"browser\"), while the wire wants the platform. iOS sends \"ios\", not the name\n * of its runtime, and a condition author writes `client.platform == 'web'` —\n * the word every other flag vendor uses too. Server hosts keep their own names,\n * where the distinction is the useful part.\n */\nexport function wirePlatform(): string {\n  const host = detectPlatform();\n  return host === 'browser' ? 'web' : host;\n}\n","import { PalbaseError } from './errors.js';\nimport { asPowChallenge, solvePowChallenge } from './pow.js';\nimport { wirePlatform } from './platform.js';\nimport type { TokenManager } from './token.js';\nimport type { HttpClientOptions, PalbaseResponse, RequestOptions } from './types.js';\n\n/**\n * Default production host. Dev / staging / local callers override via\n * `options.url`. Apex-style routing is the only supported production path;\n * Kong resolves Environment identity from the API key.\n */\nconst PALBASE_DEFAULT_HOST = 'api.palbase.studio';\n\n/**\n * Parse the Environment ref from a Palbase API key.\n *\n * Canonical shape: `pb_{environment_ref}_c{random}`, where the Environment ref\n * is 4-24 lowercase ASCII alphanumeric characters and random is AT LEAST 20\n * base62 chars.\n *\n * The length is a floor, not an equality. The stack's own minter writes 20\n * (v2/cmd/palsvc/initenv.go) and the cloud control plane writes 32\n * (v2-cloud/platform/server/services/keys.ts), and the door that admits the\n * request refuses to rule on the difference: *\"a shorter or longer secret is\n * not a security property this door can rule on\"*\n * (v2/internal/platform/identitymw.go: parseAPIKey). A client that is stricter\n * than the server does not add safety — it just refuses working keys, which is\n * exactly what this one did to every cloud project until 2026-08-25.\n *\n * Returns the Environment ref on match; `null` otherwise.\n */\nconst API_KEY_RE = /^pb_([a-z0-9]{4,24})_c[A-Za-z0-9]{20,}$/;\n\nfunction parseEnvironmentRef(apiKey: string): string | null {\n  return API_KEY_RE.exec(apiKey)?.[1] ?? null;\n}\nconst MAX_RETRIES = 3;\nconst INITIAL_BACKOFF_MS = 200;\n/**\n * Upper bound on a single 429 retry sleep. A server may return a long\n * Retry-After (a locked account can send minutes/hours); honoring it verbatim\n * would HANG the request for that whole window. Cap each retry at 10s — after\n * MAX_RETRIES the 429 envelope surfaces to the caller (fail fast, don't sleep\n * minutes). The clamp never skips a retry; it only bounds how long each waits.\n */\nconst MAX_RETRY_DELAY_MS = 10_000;\n\n/**\n * Carry a 429's retry hint into the error envelope when only the header has it.\n *\n * A REFUSAL FROM THE EDGE CARRIES NOTHING BUT THE HEADER. Envoy and the\n * gateway limiter answer before any Palbase service is reached, so their 429\n * has no `retry_after` and no `data.retryAfter` — and every reader above this\n * layer (`@palbase/web`'s BackendError, the iOS SDK) looks in the BODY. The\n * seconds were on the wire and unreachable to all of them.\n *\n * Lifted under `retry_after`, the platform's own name for it (palauth's\n * rate-limit envelope), never overwriting a hint the service itself sent — a\n * service knows its window, the edge only knows its own.\n */\nfunction withRetryHint(\n  body: Record<string, unknown> | undefined,\n  response: Response,\n): Record<string, unknown> | undefined {\n  if (response.status !== 429) return body;\n  const data = body?.data;\n  const alreadyStated =\n    typeof body?.retry_after === 'number' ||\n    (typeof data === 'object' && data !== null && 'retryAfter' in data);\n  if (alreadyStated) return body;\n  const seconds = Number.parseInt(response.headers.get('Retry-After') ?? '', 10);\n  if (Number.isNaN(seconds) || seconds <= 0) return body;\n  return { ...body, retry_after: seconds };\n}\n\n/**\n * Request interceptor. Runs before every HTTP request.\n * Can modify headers, body, or reject the request.\n */\nexport type RequestInterceptor = (request: {\n  headers: Record<string, string>;\n  method: string;\n  path: string;\n}) => void | Promise<void>;\n\nexport class HttpClient {\n  protected readonly apiKey: string;\n  protected readonly options?: HttpClientOptions;\n\n  tokenManager: TokenManager | null = null;\n\n  /**\n   * Admin JWT used for platform admin endpoints (/admin/*).\n   * When set, takes precedence over tokenManager access token in the\n   * Authorization header.\n   */\n  adminToken: string | null = null;\n\n  private readonly interceptors: RequestInterceptor[] = [];\n\n  constructor(apiKey: string, options?: HttpClientOptions) {\n    this.apiKey = apiKey;\n    this.options = options;\n  }\n\n  /** Set (or clear) the admin JWT used on admin endpoints. */\n  setAdminToken(token: string | null): void {\n    this.adminToken = token;\n  }\n\n  /**\n   * Create a scoped HttpClient that adds the given extra headers to every\n   * request. The returned client shares the admin token and token manager\n   * with the parent at runtime — later changes on the parent propagate to\n   * the scope and vice versa.\n   *\n   * Typical use: adding an Environment-routing header for an admin call.\n   */\n  withHeaders(extra: Record<string, string>): HttpClient {\n    const mergedHeaders = { ...(this.options?.headers ?? {}), ...extra };\n\n    const scoped: HttpClient = new HttpClient(this.apiKey, {\n      ...this.options,\n      headers: mergedHeaders,\n    });\n    scoped.tokenManager = this.tokenManager;\n    // Delegate adminToken reads + writes to the parent so the scope always\n    // sees the latest token, and setAdminToken on the scope affects the parent.\n    Object.defineProperty(scoped, 'adminToken', {\n      get: () => this.adminToken,\n      set: (v: string | null) => {\n        this.adminToken = v;\n      },\n      configurable: true,\n    });\n    return scoped;\n  }\n\n  /** Add a request interceptor. Runs before every request. */\n  addInterceptor(interceptor: RequestInterceptor): void {\n    this.interceptors.push(interceptor);\n  }\n\n  async request<T>(\n    method: string,\n    path: string,\n    options?: RequestOptions,\n  ): Promise<PalbaseResponse<T>> {\n    // If token is expired and refresh is available, refresh before making the request\n    if (\n      this.tokenManager?.isExpired() &&\n      this.tokenManager.getRefreshToken() &&\n      this.tokenManager.refreshFunction\n    ) {\n      try {\n        await this.tokenManager.refreshSession();\n      } catch (e) {\n        const status = e instanceof PalbaseError ? e.status : 0;\n        if (status === 400 || status === 401 || status === 403) {\n          // Terminal: the refresh token is dead (revoked/expired/forbidden).\n          // Clear the session (listeners persist the sign-out) and proceed\n          // unauthenticated — the endpoint will 401 into the normal error\n          // envelope instead of bricking every subsequent call including\n          // the recovery sign-in.\n          this.tokenManager.clearSession();\n        } else {\n          throw e; // network/5xx: transient, stay loud\n        }\n      }\n    }\n\n    return this.executeWithRetry<T>(method, path, options, 0);\n  }\n\n  private getBaseUrl(): string {\n    // Explicit URL always wins (local dev, staging, test rigs).\n    if (this.options?.url) {\n      return this.options.url;\n    }\n\n    // Validate the key shape up front so apex-routed callers still\n    // fail loud on a malformed key instead of hitting the gateway\n    // with bad credentials.\n    if (this.apiKey && parseEnvironmentRef(this.apiKey) === null) {\n      throw new PalbaseError(\n        'invalid_api_key',\n        'Invalid API key format. Expected pb_{environment_ref}_c{at least 20 base62 chars}. For dev/staging pass `url: \"https://api.dev.palbase.studio\"` via options.',\n        0,\n      );\n    }\n\n    return `https://${PALBASE_DEFAULT_HOST}`;\n  }\n\n  private buildHeaders(options?: RequestOptions): Record<string, string> {\n    const headers: Record<string, string> = {\n      'Content-Type': 'application/json',\n      // Client identity, the web counterpart of the iOS SDK's\n      // ClientInfo.augment(). The server reads these to resolve flag targeting\n      // conditions and to label telemetry, so an app declares nothing and calls\n      // nothing — whatever the SDK can know, it sends.\n      'X-Platform': wirePlatform(),\n    };\n    // The host app's own version is not knowable on the web (no bundle to read\n    // it from), so it is opt-in; when given it fills the same header iOS fills\n    // from CFBundleShortVersionString.\n    const appVersion = this.options?.appVersion?.trim();\n    if (appVersion) {\n      headers['X-Palbase-Client-Version'] = appVersion;\n    }\n\n    // Palbase Environment keys live in the `apikey` header — never in\n    // `Authorization` — because Kong's key-auth resolves them on that\n    // header and the gateway's pre-function plugin stamps the downstream\n    // identity.\n    const effectiveKey = this.apiKey;\n    if (effectiveKey) {\n      headers['apikey'] = effectiveKey;\n    }\n\n    // User session token, if any. Kong's pre-function plugin strips\n    // Authorization on /v1/* routes anyway (PostgREST has no JWT\n    // secret and would crash on a Bearer it can't decode), but\n    // sending it preserves the contract for /auth/* endpoints that\n    // do consume the bearer (e.g. session refresh).\n    const token = this.tokenManager?.getAccessToken();\n    if (token) {\n      headers['Authorization'] = `Bearer ${token}`;\n    }\n\n    // adminToken (platform admin JWT) takes precedence — used by the\n    // @palbase/admin internal flows that hit /admin/* routes; those\n    // routes verify the bearer themselves and aren't subject to the\n    // /v1/* Authorization-strip rule.\n    if (this.adminToken) {\n      headers['Authorization'] = `Bearer ${this.adminToken}`;\n    }\n\n    // Merge global custom headers\n    if (this.options?.headers) {\n      Object.assign(headers, this.options.headers);\n    }\n\n    // Merge per-request headers\n    if (options?.headers) {\n      Object.assign(headers, options.headers);\n    }\n\n    return headers;\n  }\n\n  private async executeWithRetry<T>(\n    method: string,\n    path: string,\n    options: RequestOptions | undefined,\n    attempt: number,\n    // Headers a PREVIOUS attempt earned and this one has to carry. Today that\n    // is only the solved proof-of-work pair; it is a parameter rather than a\n    // field because it belongs to one request's second try, and a field would\n    // leak it onto every later call made through this client.\n    earned?: Record<string, string>,\n  ): Promise<PalbaseResponse<T>> {\n    const url = `${this.getBaseUrl()}${path}`;\n    const headers = { ...this.buildHeaders(options), ...earned };\n\n    // Run interceptors\n    for (const interceptor of this.interceptors) {\n      await interceptor({ headers, method, path });\n    }\n\n    const fetchOptions: RequestInit = {\n      method,\n      headers,\n      signal: options?.signal,\n    };\n\n    if (options?.body !== undefined) {\n      fetchOptions.body = JSON.stringify(options.body);\n    }\n\n    let response: Response;\n    try {\n      response = await fetch(url, fetchOptions);\n    } catch (error) {\n      // Network error — retry with backoff\n      if (attempt < MAX_RETRIES - 1) {\n        const backoff = INITIAL_BACKOFF_MS * 2 ** attempt;\n        await this.delay(backoff);\n        // WITHOUT `earned`, and that is the whole point of this line.\n        //\n        // A network error means the response was lost, not that the request\n        // was. If it reached the server, the challenge is already SPENT —\n        // palauth's VerifyChallenge reads and deletes in one step\n        // (bot/pow.go:96-104), deliberately, because a proof presented twice is\n        // not proof. Replaying the nonce would then answer `pow_invalid`, and\n        // the one-solve guard below would refuse to try again: a request one\n        // fresh solve away from succeeding, failed. Dropping it costs nothing\n        // in the other case — if the server never saw the request, a fresh\n        // challenge works exactly as well as the old one.\n        return this.executeWithRetry<T>(method, path, options, attempt + 1);\n      }\n\n      // All retries exhausted — throw PalbaseError\n      throw new PalbaseError(\n        'network_error',\n        error instanceof Error ? error.message : 'Network request failed',\n        0,\n      );\n    }\n\n    // Handle 429 Too Many Requests — retry with Retry-After or backoff;\n    // if retries exhausted, fall through to normal error response handling below\n    if (response.status === 429) {\n      if (attempt < MAX_RETRIES - 1) {\n        const retryAfter = response.headers.get('Retry-After');\n        const parsed = retryAfter ? Number.parseInt(retryAfter, 10) : Number.NaN;\n        // Clamp the server-requested wait: a long Retry-After (locked account)\n        // must not hang the request — cap each sleep, exhaust MAX_RETRIES, then\n        // fall through to surface the 429 envelope below.\n        const delayMs = Number.isNaN(parsed)\n          ? INITIAL_BACKOFF_MS * 2 ** attempt\n          : Math.min(parsed * 1000, MAX_RETRY_DELAY_MS);\n        await this.delay(delayMs);\n        // WITH `earned`, unlike the network path above: a 429 is a refusal the\n        // server issued INSTEAD of doing the work, so the challenge was never\n        // consumed. The edge's rate limiter answers before palsvc, and on the\n        // auth routes palauth's own limiter runs BEFORE the proof-of-work\n        // middleware (auth/internal/server/server.go: rl.LoginByIP, then powMW).\n        return this.executeWithRetry<T>(method, path, options, attempt + 1, earned);\n      }\n    }\n\n    // Parse response body\n    let data: T | null = null;\n    let errorBody: { error?: string; error_description?: string; status?: number } | undefined;\n\n    // HEAD responses have no body by spec — skip parsing.\n    const contentType = response.headers.get('Content-Type');\n    if (method !== 'HEAD' && contentType?.includes('json')) {\n      const body = (await response.json()) as Record<string, unknown>;\n      if (response.ok) {\n        data = body as T;\n      } else {\n        errorBody = body as typeof errorBody;\n      }\n    }\n\n    // Proof-of-work: /auth/signup and /auth/token sit behind a bot gate that\n    // answers an unsolved request with 403 and the challenge in the body. Solve\n    // it and repeat the request carrying the two headers; the caller never\n    // learns the gate is there.\n    //\n    // HERE, in core, because this is the layer that issues the request for every\n    // client in the repo — @palbase/auth's sign-in, @palbase/web's facades, the\n    // server SDK. The same retry lived one layer up in @palbase/web until\n    // 2026-08-18 and covered everything EXCEPT `pb.auth.*`, which reaches the\n    // network through this method; so the gate stayed unsatisfiable on exactly\n    // the two endpoints it guards.\n    //\n    // ONE retry, and only when the body really carries a challenge: `earned`\n    // being set already means this IS the second try. A 403 that says\n    // pow_required without a challenge is a server the client cannot satisfy,\n    // and looping on it would turn a broken gate into a hang.\n    if (response.status === 403 && !earned) {\n      const challenge = asPowChallenge(errorBody);\n      if (challenge) {\n        return this.executeWithRetry<T>(\n          method,\n          path,\n          options,\n          attempt,\n          await solvePowChallenge(challenge, undefined, options?.signal),\n        );\n      }\n    }\n\n    if (!response.ok) {\n      return {\n        data: null,\n        error: new PalbaseError(\n          errorBody?.error ?? 'unknown_error',\n          errorBody?.error_description ?? response.statusText,\n          response.status,\n          withRetryHint(errorBody, response),\n        ),\n        status: response.status,\n      };\n    }\n\n    // Parse PostgREST Content-Range for count queries (e.g. \"0-9/42\" or \"*/42\").\n    const contentRange = response.headers.get('Content-Range');\n    let count: number | undefined;\n    if (contentRange) {\n      const slash = contentRange.lastIndexOf('/');\n      if (slash >= 0) {\n        const totalPart = contentRange.slice(slash + 1);\n        if (totalPart !== '*') {\n          const parsed = Number.parseInt(totalPart, 10);\n          if (!Number.isNaN(parsed)) {\n            count = parsed;\n          }\n        }\n      }\n    }\n\n    return {\n      data,\n      error: null,\n      status: response.status,\n      ...(count !== undefined ? { count } : {}),\n    };\n  }\n\n  private delay(ms: number): Promise<void> {\n    return new Promise((resolve) => setTimeout(resolve, ms));\n  }\n}\n","import type { AuthStateCallback, Session, Unsubscribe } from './types.js';\n\nexport class TokenManager {\n  private session: Session | null = null;\n  private listeners: Set<AuthStateCallback> = new Set();\n  private refreshPromise: Promise<void> | null = null;\n  private refreshing = false;\n\n  refreshFunction: ((refreshToken: string) => Promise<Session>) | null = null;\n\n  setSession(session: Session): void {\n    this.session = session;\n    this.notify('SESSION_SET', session);\n  }\n\n  getAccessToken(): string | null {\n    return this.session?.accessToken ?? null;\n  }\n\n  getRefreshToken(): string | null {\n    return this.session?.refreshToken ?? null;\n  }\n\n  clearSession(): void {\n    this.session = null;\n    this.notify('SESSION_CLEARED', null);\n  }\n\n  isExpired(): boolean {\n    if (!this.session) return true;\n    return Date.now() >= this.session.expiresAt;\n  }\n\n  async refreshSession(): Promise<void> {\n    if (!this.session?.refreshToken || !this.refreshFunction) {\n      return;\n    }\n\n    // Collapse concurrent refresh calls into a single request\n    if (this.refreshPromise) {\n      return this.refreshPromise;\n    }\n\n    // Re-entrancy guard: the wired refreshFunction issues its own HTTP request\n    // (POST /auth/token/refresh) through HttpClient, whose pre-flight calls\n    // refreshSession() again SYNCHRONOUSLY — before `refreshPromise` below is\n    // assigned (the whole chain runs before the first real await). Without\n    // this flag that recursion is unbounded (stack overflow). Returning early\n    // lets the refresh request itself proceed unauthenticated — it carries\n    // the refresh token in its body, not the Bearer header.\n    if (this.refreshing) {\n      return;\n    }\n\n    this.refreshing = true;\n    this.refreshPromise = this.executeRefresh(this.session.refreshToken);\n\n    try {\n      await this.refreshPromise;\n    } finally {\n      this.refreshPromise = null;\n      this.refreshing = false;\n    }\n  }\n\n  onAuthStateChange(callback: AuthStateCallback): Unsubscribe {\n    this.listeners.add(callback);\n    return () => {\n      this.listeners.delete(callback);\n    };\n  }\n\n  private async executeRefresh(refreshToken: string): Promise<void> {\n    if (!this.refreshFunction) return;\n    const newSession = await this.refreshFunction(refreshToken);\n    this.setSession(newSession);\n  }\n\n  private notify(event: 'SESSION_SET' | 'SESSION_CLEARED', session: Session | null): void {\n    for (const listener of this.listeners) {\n      listener(event, session);\n    }\n  }\n}\n","/** The client a tenant's tests use to call their own backend.\n *\n * These tests run against a REAL deployment — the release the deploy just built,\n * serving from the same Environment as production, with the same database, the\n * same secrets and the same gateway in front of it. So this client is a plain\n * HTTP client, not a simulation: every call crosses the gateway, the API key\n * check, the auth rail, the zod validation at the boundary, and row-level\n * security, exactly as a shipped app's call does.\n *\n * There is deliberately no schema knowledge here. The tenant already wrote their\n * types — `import type { TodoSchema } from \"../models/todos/shared.js\"` — so a\n * test types its own call (`api.get<TodoSchema[]>(\"/todos\")`) and can validate it\n * with the same zod schema the endpoint declares. A second generated client would\n * be a second thing to keep in step.\n */\n\nimport { asPowChallenge, solvePowChallenge } from \"@palbase/core\";\n\n/** How to reach the release under test. Supplied by the deploy, never guessed. */\nexport interface TestApiConfig {\n  baseUrl: string;\n  apiKey: string;\n  /** This deploy's secret. Without it the request is served the LIVE release.\n   *\n   * OPTIONAL against a stack running on this machine: a local stack serves one\n   * version — the directory `palbase start` mounted — so there is no candidate\n   * to select. Required everywhere else. */\n  candidateToken?: string;\n  /** The run's minted logins, keyed by the name declared in config/test-users.ts. */\n  identities?: Record<string, TestIdentity>;\n  /** The fetch to use. Injected by tests of this client; production passes none. */\n  fetch?: typeof fetch;\n}\n\n/** One login the deploy minted for this run.\n *\n * `accessToken` is the session issued when the identity was created, and is what\n * `signInAs` uses. The credentials come along for a test that wants to exercise\n * the login rail itself — but a suite that switches users repeatedly must not be\n * signing in each time: those calls come from one address and trip the login rate\n * limiter, failing tests for a reason that has nothing to do with the code\n * under test.\n */\nexport interface TestIdentity {\n  id?: string;\n  email: string;\n  password: string;\n  accessToken?: string;\n}\n\n/** One call the suite made, in the order it was made. */\nexport interface RecordedRequest {\n  method: string;\n  path: string;\n  status: number;\n  ms: number;\n}\n\n/** A non-2xx answer, carrying the platform's error envelope.\n *\n * The envelope is the contract every Palbase endpoint answers with, so a test\n * asserts on `status`/`error`/`data` rather than parsing a message. The message\n * exists for the human reading a failed deploy.\n */\nexport class TestApiError extends Error {\n  readonly status: number;\n  readonly error: string;\n  /** Payload of an error your code threw — `new BadRequest({ fields })` arrives here. */\n  readonly data: unknown;\n  /** The whole envelope, exactly as the server sent it. */\n  readonly body: ErrorEnvelope;\n\n  constructor(method: string, path: string, status: number, body: unknown) {\n    const envelope = (body ?? {}) as ErrorEnvelope;\n    const code = envelope.error ?? String(status);\n    super(`${method} ${path} → ${status} ${code}${envelope.error_description ? `: ${envelope.error_description}` : \"\"}`);\n    this.name = \"TestApiError\";\n    this.status = status;\n    this.error = code;\n    this.data = envelope.data;\n    this.body = envelope;\n  }\n}\n\n/** A Palbase error response.\n *\n * `data` carries the payload of an error your code threw. Validation refused at\n * the boundary — before your handler runs — answers with `details` instead, one\n * entry per field. The index signature is deliberate: whatever the server sends\n * is readable from a test, so no assertion is ever blocked on this type being\n * exhaustive.\n */\nexport interface ErrorEnvelope {\n  error?: string;\n  error_description?: string;\n  status?: number;\n  request_id?: string;\n  data?: unknown;\n  details?: Array<{ field: string; message: string }>;\n  [key: string]: unknown;\n}\n\nexport interface CallOptions {\n  headers?: Record<string, string>;\n}\n\nexport interface TestApi {\n  get<T = unknown>(path: string, opts?: CallOptions): Promise<T>;\n  post<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  patch<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  put<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  delete<T = unknown>(path: string, opts?: CallOptions): Promise<T>;\n  /** HTTP QUERY (RFC 10008): a safe, idempotent read whose filter travels in the body. */\n  query<T = unknown>(path: string, body?: unknown, opts?: CallOptions): Promise<T>;\n  /** Sign in with credentials you supply. */\n  signIn(credentials: { email: string; password: string }): Promise<{ id: string; email?: string }>;\n  /**\n   * Sign in as one of the identities this run was given, by the name you\n   * declared it under in `config/test-users.ts`.\n   *\n   * Each is minted by the platform for the length of ONE deploy, seeded with the\n   * data that declaration describes, and retired after — which is why this works\n   * on every Environment including production, where a committed fixture password\n   * is refused on purpose.\n   */\n  signInAs(name: string): Promise<{ id: string; email?: string }>;\n  signOut(): Promise<void>;\n  /** Drop the bearer without calling the server — the anonymous caller. */\n  asAnonymous(): void;\n  /** Every call made, in order. Printed for the failing test in a red deploy. */\n  readonly requests: readonly RecordedRequest[];\n}\n\nfunction required(value: string, envName: string): string {\n  if (!value) {\n    throw new Error(\n      `${envName} is not set — the test client has nowhere to send requests. ` +\n        `This is set by the deploy that runs your tests; if you are running them by hand, set it yourself.`,\n    );\n  }\n  return value;\n}\n\n/** A stack running on this machine. There is exactly ONE version there — the\n * directory `palbase start` mounted — so there is no candidate to select, and\n * demanding a token for one made local runs invent a value to satisfy a header\n * nothing reads. */\nfunction isLocalTarget(baseUrl: string): boolean {\n  try {\n    const { hostname } = new URL(baseUrl);\n    return hostname === \"127.0.0.1\" || hostname === \"localhost\" || hostname === \"[::1]\" || hostname === \"::1\";\n  } catch {\n    return false;\n  }\n}\n\n/** Seconds until a JWT's `exp`, or null when the token carries no readable one.\n * Read WITHOUT verifying: this is a diagnosis, never a decision — the server\n * remains the only authority on whether a token is good. */\nfunction secondsUntilExpiry(token: string): number | null {\n  const body = token.split(\".\")[1];\n  if (!body) return null;\n  try {\n    const claims = JSON.parse(Buffer.from(body, \"base64url\").toString(\"utf8\")) as { exp?: unknown };\n    return typeof claims.exp === \"number\" ? claims.exp - Math.floor(Date.now() / 1000) : null;\n  } catch {\n    return null;\n  }\n}\n\nexport function createTestApi(config: TestApiConfig): TestApi {\n  const baseUrl = required(config.baseUrl, \"PALBASE_TEST_BASE_URL\").replace(/\\/$/, \"\");\n  const apiKey = required(config.apiKey, \"PALBASE_TEST_API_KEY\");\n  const local = isLocalTarget(baseUrl);\n  // Local stacks serve one version, so there is nothing to select. Everywhere\n  // else the token stays REQUIRED: without it the gateway serves the LIVE\n  // release and the suite would grade code that is not under test.\n  const candidateToken = local ? (config.candidateToken ?? \"\") : required(config.candidateToken ?? \"\", \"PALBASE_TEST_CANDIDATE\");\n  const doFetch = config.fetch ?? fetch;\n\n  const requests: RecordedRequest[] = [];\n  let bearer: string | null = null;\n\n  async function call<T>(method: string, path: string, body: unknown, opts: CallOptions = {}): Promise<T> {\n    const headers: Record<string, string> = {\n      apikey: apiKey,\n      // Selects the release under test. Omit it and the gateway serves the LIVE\n      // one, which would make the whole suite grade the wrong code. Absent only\n      // against a local stack, which has a single version.\n      ...(candidateToken ? { \"x-palbase-candidate\": candidateToken } : {}),\n      ...opts.headers,\n    };\n    if (bearer) headers.authorization = `Bearer ${bearer}`;\n    if (body !== undefined) headers[\"content-type\"] = \"application/json\";\n\n    const startedAt = Date.now();\n    const res = await doFetch(`${baseUrl}${path}`, {\n      method,\n      headers,\n      body: body === undefined ? undefined : JSON.stringify(body),\n    });\n    const text = await res.text();\n    const parsed: unknown = text ? safeParse(text) : undefined;\n\n    requests.push({ method, path, status: res.status, ms: Date.now() - startedAt });\n\n    if (!res.ok) {\n      // A 401 on a token that has simply RUN OUT is the most likely 401 a suite\n      // sees, and the least legible: the mint issues ~30 minutes, so a file of\n      // credentials written yesterday answers `401 unauthorized` with nothing to\n      // act on. Measured on a customer run: the next step taken was to blame the\n      // credentials rather than their age.\n      if (res.status === 401 && bearer) {\n        const left = secondsUntilExpiry(bearer);\n        if (left !== null && left <= 0) {\n          throw new TestApiError(method, path, res.status, {\n            error: \"access_token_expired\",\n            error_description:\n              `this run's access token EXPIRED ${Math.abs(left)}s ago — a test identity is minted for the ` +\n              `length of ONE deploy, so a saved token does not survive to the next run. Re-mint it ` +\n              \"(`palbase test-user create --json`, or let `palbase test` do it) and run again.\",\n          });\n        }\n      }\n      throw new TestApiError(method, path, res.status, parsed);\n    }\n    return parsed as T;\n  }\n\n  return {\n    requests,\n    get: (path, opts) => call(\"GET\", path, undefined, opts),\n    post: (path, body, opts) => call(\"POST\", path, body, opts),\n    patch: (path, body, opts) => call(\"PATCH\", path, body, opts),\n    put: (path, body, opts) => call(\"PUT\", path, body, opts),\n    delete: (path, opts) => call(\"DELETE\", path, undefined, opts),\n    query: (path, body, opts) => call(\"QUERY\", path, body, opts),\n\n    async signInAs(name) {\n      const identity = (config.identities ?? {})[name];\n      if (!identity) {\n        const declared = Object.keys(config.identities ?? {});\n        throw new Error(\n          `no test identity named ${JSON.stringify(name)} — the deploy mints one per user declared in ` +\n            `config/test-users.ts` +\n            (declared.length\n              ? `; this run has: ${declared.join(\", \")}`\n              : // Not \"you declared none\": from here the two causes are\n                // indistinguishable, and blaming the customer's config for a\n                // platform failure sends them to look in the wrong file. The\n                // deploy log names which one it was.\n                \", and this run has none — either your config declares no users \" +\n                \"or the deploy could not mint them; the deploy log says which\"),\n        );\n      }\n      // The session the mint already issued — no network call, so switching\n      // users is free and the login rail never sees this run.\n      if (identity.accessToken) {\n        bearer = identity.accessToken;\n        return { id: identity.id ?? \"\", email: identity.email };\n      }\n      return this.signIn(identity);\n    },\n\n    async signIn(credentials) {\n      // PROOF-OF-WORK IS PART OF LOGGING IN, so a client that cannot solve one\n      // cannot log in at all. The web SDK has solved it since bot protection\n      // shipped; this harness went straight to `fetch` and therefore answered\n      // `403 pow_required` on every password login — which made the whole\n      // credentials path DEAD on a stack with the gate on, exactly when a\n      // suite falls back to it because its minted token ran out.\n      //\n      // One retry, and only when the refusal really carries a challenge: a 403\n      // saying pow_required without one is a server this client cannot satisfy,\n      // and looping would turn a broken gate into a hang. Same rule as\n      // @palbase/core's own retry.\n      const attempt = async (extra?: Record<string, string>) =>\n        call<{ access_token: string; user?: { id: string; email?: string } }>(\n          \"POST\",\n          \"/auth/login\",\n          credentials,\n          extra ? { headers: extra } : {},\n        );\n\n      let result: { access_token: string; user?: { id: string; email?: string } };\n      try {\n        result = await attempt();\n      } catch (e) {\n        const refusal = e as { status?: number; body?: unknown };\n        const challenge = refusal.status === 403 ? asPowChallenge(refusal.body) : null;\n        if (!challenge) throw e;\n        result = await attempt(await solvePowChallenge(challenge));\n      }\n      bearer = result.access_token;\n      return result.user ?? { id: \"\" };\n    },\n    async signOut() {\n      await call(\"POST\", \"/auth/logout\", undefined);\n      bearer = null;\n    },\n    asAnonymous() {\n      bearer = null;\n    },\n  };\n}\n\n/** The run's identities, as the deploy passed them. Absent is not an error: a\n * project that declares none still runs every test that needs no login. */\nfunction parseIdentities(raw: string | undefined): Record<string, TestIdentity> {\n  if (!raw) return {};\n  try {\n    return JSON.parse(raw) as Record<string, TestIdentity>;\n  } catch {\n    return {};\n  }\n}\n\nfunction safeParse(text: string): unknown {\n  try {\n    return JSON.parse(text);\n  } catch {\n    return text;\n  }\n}\n\n/** The client the deploy configured, from the environment it set.\n *\n * Constructed lazily so importing this module outside a test run — a typecheck,\n * an editor — does not fail on absent configuration.\n */\nlet configured: TestApi | null = null;\n\nexport const api: TestApi = new Proxy({} as TestApi, {\n  get(_target, prop) {\n    configured ??= createTestApi({\n      baseUrl: process.env.PALBASE_TEST_BASE_URL ?? \"\",\n      apiKey: process.env.PALBASE_TEST_API_KEY ?? \"\",\n      candidateToken: process.env.PALBASE_TEST_CANDIDATE ?? \"\",\n      identities: parseIdentities(process.env.PALBASE_TEST_IDENTITIES),\n    });\n    return Reflect.get(configured, prop, configured);\n  },\n});\n","import type { DBClient, DBOps } from \"../../endpoint.js\";\nimport type {\n  TxPlanBody,\n  TxPlanOpResult,\n  TxPlanRejection,\n  TxPlanResponse,\n  TxWireGuard,\n  TxWireOp,\n  TxWireValue,\n} from \"../../db/tx-plan.js\";\n\n/** Tracked records for assertions. */\ninterface TrackedRecords {\n  inserted: Map<string, Record<string, unknown>[]>;\n  updated: Map<string, Record<string, unknown>[]>;\n  deleted: Map<string, string[]>;\n}\n\n/** Mock DB client with tracking and seed data support. */\nexport interface MockDBClient extends DBClient {\n  /** Get records inserted into a table. */\n  inserted(table: string): Record<string, unknown>[];\n  /** Get records updated in a table. */\n  updated(table: string): Record<string, unknown>[];\n  /** Get IDs deleted from a table. */\n  deleted(table: string): string[];\n  /** Pre-seed data into a table for findById/findMany. */\n  seed(table: string, data: Record<string, unknown>[]): void;\n}\n\n/** Create a mock DB client with in-memory tracking. */\nexport function createMockDB(): MockDBClient {\n  const store = new Map<string, Record<string, unknown>[]>();\n  const tracked: TrackedRecords = {\n    inserted: new Map(),\n    updated: new Map(),\n    deleted: new Map(),\n  };\n\n  function rowsOf(table: string): Record<string, unknown>[] {\n    let rows = store.get(table);\n    if (!rows) {\n      rows = [];\n      store.set(table, rows);\n    }\n    return rows;\n  }\n\n  function track(\n    map: Map<string, Record<string, unknown>[]>,\n    table: string,\n    row: Record<string, unknown>,\n  ): void {\n    const list = map.get(table);\n    if (list) list.push(row);\n    else map.set(table, [row]);\n  }\n\n  // Build the op surface first (the six string-keyed ops). `txPlan` below\n  // interprets a whole plan against the SAME in-memory store and tracking maps,\n  // so a transaction's writes are visible to later assertions exactly as a\n  // direct write would be.\n  const ops: DBOps = {\n    async search(_table: string, _params?: Record<string, unknown>) {\n      return [];\n    },\n    async similar() {\n      return [];\n    },\n    async recommend() {\n      return [];\n    },\n    async supersede(_table: string, _id: string, row: Record<string, unknown>) {\n      return { id: crypto.randomUUID(), ...row };\n    },\n    async query(_sql: string, _params?: unknown[]) {\n      return [];\n    },\n\n    async insert(table: string, data: Record<string, unknown>) {\n      const record = { id: crypto.randomUUID(), ...data };\n      rowsOf(table).push(record);\n      track(tracked.inserted, table, record);\n      return record;\n    },\n\n    // Same semantics the engine's SQL has: match on the conflict columns, update\n    // everything else, and return the resulting row either way.\n    async upsert(\n      table: string,\n      data: Record<string, unknown>,\n      opts: { onConflict: readonly string[] },\n    ) {\n      if (opts.onConflict.length === 0) {\n        throw new Error(`upsert into ${table}: onConflict en az bir kolon adı ister`);\n      }\n      const rows = rowsOf(table);\n      const existing = rows.find((r) => opts.onConflict.every((c) => r[c] === data[c]));\n      if (existing) {\n        for (const [k, v] of Object.entries(data)) {\n          if (!opts.onConflict.includes(k)) existing[k] = v;\n        }\n        return existing;\n      }\n      const record = { id: crypto.randomUUID(), ...data };\n      rows.push(record);\n      track(tracked.inserted, table, record);\n      return record;\n    },\n\n    async update(table: string, id: string, data: Record<string, unknown>) {\n      const rows = store.get(table) ?? [];\n      const idx = rows.findIndex((r) => r[\"id\"] === id);\n      const updated = idx >= 0\n        ? { ...rows[idx], ...data }\n        : { id, ...data };\n      if (idx >= 0) {\n        rows[idx] = updated;\n      }\n      track(tracked.updated, table, updated);\n      return updated;\n    },\n\n    async delete(table: string, id: string) {\n      const rows = store.get(table) ?? [];\n      const idx = rows.findIndex((r) => r[\"id\"] === id);\n      if (idx >= 0) rows.splice(idx, 1);\n      const list = tracked.deleted.get(table);\n      if (list) list.push(id);\n      else tracked.deleted.set(table, [id]);\n    },\n\n    async findById(table: string, id: string) {\n      const rows = store.get(table) ?? [];\n      return rows.find((r) => r[\"id\"] === id) ?? null;\n    },\n\n    // The SAME filter language the engine compiles to SQL: a plain value is\n    // equality, an object is an operator set. A fake that understood less would\n    // pass a service test that the live database then fails — which is the one\n    // thing a stand-in must never do.\n    async findMany(\n      table: string,\n      query?: Record<string, unknown>,\n      opts?: { orderBy?: { column: string; direction?: \"asc\" | \"desc\" }; limit?: number },\n    ) {\n      const rows = store.get(table) ?? [];\n      const matches = (row: Record<string, unknown>, key: string, cond: unknown): boolean => {\n        if (cond !== null && typeof cond === \"object\" && !Array.isArray(cond)) {\n          return Object.entries(cond as Record<string, unknown>).every(([op, v]) => {\n            const cell = row[key];\n            switch (op) {\n              case \"in\": return Array.isArray(v) && v.includes(cell);\n              case \"neq\": return cell !== v;\n              case \"gt\": return (cell as number) > (v as number);\n              case \"gte\": return (cell as number) >= (v as number);\n              case \"lt\": return (cell as number) < (v as number);\n              case \"lte\": return (cell as number) <= (v as number);\n              default: throw new Error(`findMany(${table}): where.${key} bilinmeyen operatör \"${op}\"`);\n            }\n          });\n        }\n        return row[key] === cond;\n      };\n      let out = query\n        ? rows.filter((row) => Object.entries(query).every(([k, c]) => matches(row, k, c)))\n        : [...rows];\n      const order = opts?.orderBy;\n      if (order) {\n        const dir = order.direction === \"desc\" ? -1 : 1;\n        out = [...out].sort((a, b) => {\n          const x = a[order.column] as never;\n          const y = b[order.column] as never;\n          return x === y ? 0 : (x < y ? -1 : 1) * dir;\n        });\n      }\n      return opts?.limit === undefined ? out : out.slice(0, opts.limit);\n    },\n  };\n\n  /**\n   * Interpret a whole plan, atomically.\n   *\n   * The rollback is the point. A test that asserts \"the second write failed, so\n   * the first one is not there\" must be able to FAIL — a mock that applied ops\n   * and left them applied would pass that test while the real broker rolled the\n   * transaction back, or the other way round. So the store and the tracking maps\n   * are snapshotted, and any failure restores both before rejecting.\n   *\n   * The rejection carries the same envelope fields the runtime copies off the\n   * broker's response (`error_code`, `slot`), because the SDK maps `slot` back\n   * to the caller's own Error — a mock that rejected with a bare Error would\n   * make every guard in every tenant test look like a generic failure.\n   */\n  async function txPlan(plan: TxPlanBody): Promise<TxPlanResponse> {\n    const snapshot = new Map<string, Record<string, unknown>[]>();\n    for (const [table, rows] of store) snapshot.set(table, [...rows]);\n    const trackedSnapshot: TrackedRecords = {\n      inserted: cloneTracked(tracked.inserted),\n      updated: cloneTracked(tracked.updated),\n      deleted: new Map([...tracked.deleted].map(([k, v]) => [k, [...v]])),\n    };\n\n    const results: TxPlanOpResult[] = [];\n    try {\n      for (const op of plan.ops) {\n        const result = applyOp(op, results);\n        results.push(result);\n        const failure = guardFailure(op.guard, result.rows.length);\n        if (failure) throw failure;\n      }\n    } catch (err) {\n      store.clear();\n      for (const [table, rows] of snapshot) store.set(table, rows);\n      tracked.inserted = trackedSnapshot.inserted;\n      tracked.updated = trackedSnapshot.updated;\n      tracked.deleted = trackedSnapshot.deleted;\n      throw err;\n    }\n    return { results };\n  }\n\n  function applyOp(op: TxWireOp, results: TxPlanOpResult[]): TxPlanOpResult {\n    switch (op.op) {\n      case \"upsert\": {\n        const values = resolveMap(op.values ?? {}, results, null);\n        const conflict = op.onConflict ?? [];\n        const rows = rowsOf(op.table);\n        const hit = rows.find((r) => conflict.every((c) => r[c] === values[c]));\n        if (hit) {\n          for (const [key, value] of Object.entries(values)) {\n            if (!conflict.includes(key)) hit[key] = value;\n          }\n          return { rows: [hit], rows_affected: 1 };\n        }\n        const created = { id: crypto.randomUUID(), ...values };\n        rows.push(created);\n        track(tracked.inserted, op.table, created);\n        return { rows: [created], rows_affected: 1 };\n      }\n      case \"insert\": {\n        const record = { id: crypto.randomUUID(), ...resolveMap(op.values ?? {}, results, null) };\n        rowsOf(op.table).push(record);\n        track(tracked.inserted, op.table, record);\n        return { rows: [record], rows_affected: 1 };\n      }\n      case \"insertMany\": {\n        const written = (op.rows ?? []).map((row) => {\n          const record = { id: crypto.randomUUID(), ...resolveMap(row, results, null) };\n          rowsOf(op.table).push(record);\n          track(tracked.inserted, op.table, record);\n          return record;\n        });\n        return { rows: written, rows_affected: written.length };\n      }\n      case \"update\": {\n        const rows = rowsOf(op.table);\n        const where = resolveMap(op.where ?? {}, results, null);\n        const written: Record<string, unknown>[] = [];\n        for (let i = 0; i < rows.length; i++) {\n          const row = rows[i];\n          if (!row || !matches(row, where)) continue;\n          const next = { ...row, ...resolveMap(op.set ?? {}, results, row) };\n          rows[i] = next;\n          track(tracked.updated, op.table, next);\n          written.push(next);\n        }\n        return { rows: written, rows_affected: written.length };\n      }\n      case \"delete\": {\n        const rows = rowsOf(op.table);\n        const where = resolveMap(op.where ?? {}, results, null);\n        const removed = rows.filter((row) => matches(row, where));\n        for (const row of removed) {\n          rows.splice(rows.indexOf(row), 1);\n          const id = row[\"id\"];\n          const list = tracked.deleted.get(op.table);\n          const key = typeof id === \"string\" ? id : String(id);\n          if (list) list.push(key);\n          else tracked.deleted.set(op.table, [key]);\n        }\n        return { rows: removed, rows_affected: removed.length };\n      }\n      case \"select\": {\n        const where = resolveMap(op.where ?? {}, results, null);\n        let found = rowsOf(op.table).filter((row) => matches(row, where));\n        if (op.limit !== undefined) found = found.slice(0, op.limit);\n        return { rows: found, rows_affected: found.length };\n      }\n    }\n  }\n\n  const client: MockDBClient = {\n    ...ops,\n\n    // No real savepoint in memory: the fake runs the callback against the SAME\n    // store. An assertion about rollback here would be asserting the fake.\n    attempt: <T,>(fn: (tx: DBOps) => Promise<T>): Promise<T> => fn(ops),\n\n    txPlan,\n\n    // In tests there is no real DB role; `asService()` returns the same\n    // in-memory client so RLS-bypass code paths still hit the same store and\n    // tracking maps. The omitted `asService` matches the contract (no\n    // double-bypass), so callers can't recurse.\n    asService(): Omit<DBClient, \"asService\"> {\n      return client;\n    },\n\n    inserted(table: string) {\n      return tracked.inserted.get(table) ?? [];\n    },\n\n    updated(table: string) {\n      return tracked.updated.get(table) ?? [];\n    },\n\n    deleted(table: string) {\n      return tracked.deleted.get(table) ?? [];\n    },\n\n    seed(table: string, data: Record<string, unknown>[]) {\n      store.set(table, [...data]);\n    },\n  };\n\n  return client;\n}\n\nfunction cloneTracked(\n  map: Map<string, Record<string, unknown>[]>,\n): Map<string, Record<string, unknown>[]> {\n  return new Map([...map].map(([k, v]) => [k, [...v]]));\n}\n\n/** Resolve one plan value: a `$ref` into an earlier result, a `$expr`, or a\n * literal. `current` is the row being updated, which is what `inc`/`dec` read. */\nfunction resolveValue(\n  value: TxWireValue,\n  results: TxPlanOpResult[],\n  current: Record<string, unknown> | null,\n  column: string,\n): unknown {\n  if (typeof value !== \"object\" || value === null) return value;\n  const tagged = value as { $ref?: { op: number; field: string }; $expr?: Record<string, unknown> };\n\n  if (tagged.$ref) {\n    const row = results[tagged.$ref.op]?.rows[0];\n    if (!row) {\n      throw txRejection(409, \"tx_ref_unresolved\", {\n        message: `operation ${tagged.$ref.op} produced no row to reference`,\n      });\n    }\n    return row[tagged.$ref.field];\n  }\n\n  if (tagged.$expr) {\n    const fn = tagged.$expr[\"fn\"];\n    if (fn === \"now\") return new Date().toISOString();\n    const by = Number(tagged.$expr[\"by\"]);\n    const base = Number(current?.[column] ?? 0);\n    return fn === \"dec\" ? base - by : base + by;\n  }\n\n  return value;\n}\n\nfunction resolveMap(\n  map: Record<string, TxWireValue>,\n  results: TxPlanOpResult[],\n  current: Record<string, unknown> | null,\n): Record<string, unknown> {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(map)) {\n    out[key] = resolveValue(value, results, current, key);\n  }\n  return out;\n}\n\n/** Equality filter, with `null` meaning IS NULL — the broker's rule, so a\n * `{ accepted_at: null }` guard behaves the same in a test as in production. */\nfunction matches(row: Record<string, unknown>, where: Record<string, unknown>): boolean {\n  return Object.entries(where).every(([key, value]) =>\n    value === null ? row[key] === null || row[key] === undefined : row[key] === value,\n  );\n}\n\nfunction guardFailure(guard: TxWireGuard | undefined, count: number): unknown {\n  if (!guard) return null;\n  const ok =\n    guard.kind === \"one\"\n      ? count === 1\n      : guard.kind === \"none\"\n        ? count === 0\n        : guard.kind === \"atLeast\"\n          ? count >= guard.n\n          : count <= guard.n;\n  if (ok) return null;\n  return txRejection(409, \"tx_guard_failed\", {\n    slot: guard.slot,\n    message: `expected ${guard.kind} ${guard.n} row(s), got ${count}`,\n  });\n}\n\n/** Build a rejection shaped like the one the runtime throws for a broker error:\n * an Error carrying the envelope's `status`/`error_code`/`slot`. */\nfunction txRejection(\n  status: number,\n  code: string,\n  extra: { slot?: number; message: string },\n): Error & TxPlanRejection {\n  const err = new Error(extra.message) as Error & TxPlanRejection;\n  err.status = status;\n  err.error_code = code;\n  if (extra.slot !== undefined) err.slot = extra.slot;\n  return err;\n}\n","/**\n * `fakeDatabase()` — the in-memory `Database` a SERVICE-LAYER test runs against.\n *\n * WHY IT IS PUBLIC. The scaffold's own AGENTS.md tells authors to \"test the\n * service layer… the test passes a stand-in\", and the SDK shipped no stand-in to\n * pass. So every project wrote its own: a measured customer run carried two — a\n * hand-written `MembershipDb` interface for one service, and a bare `{ query }`\n * object in the tests of another. Both are guesses at this SDK's own surface,\n * and both stop compiling the moment the surface grows.\n *\n * The engine already had exactly this object; it just lived under `__tests__/`\n * where only this package could reach it.\n *\n * WHAT IT IS NOT. It does not interpret SQL. `query()` records what it was asked\n * and answers no rows, because a fake that parsed SQL would be a second, worse\n * Postgres — and a test that passed against it would prove nothing about the\n * real one. Assert on `queries` when the SQL is the thing under test, and put\n * anything that depends on what SQL RETURNS in a live test (`palbase test`).\n */\nimport { createMockDB } from \"../__tests__/helpers/mock-db.js\";\nimport type { DBClient } from \"../endpoint.js\";\n\n/** One `Database.query(...)` call, as the service made it. */\nexport interface RecordedQuery {\n  sql: string;\n  params: unknown[];\n}\n\n/** What a service-layer test is handed. */\nexport interface FakeDatabase {\n  /** Pass this where the service expects `Database`. */\n  db: DBClient;\n  /** Every `query()` call, in order. */\n  queries: readonly RecordedQuery[];\n  /** Put rows in a table before the code under test runs. */\n  seed(table: string, rows: Record<string, unknown>[]): void;\n  /** Rows inserted into a table, for asserting a write happened. */\n  inserted(table: string): Record<string, unknown>[];\n  /** Rows updated in a table. */\n  updated(table: string): Record<string, unknown>[];\n  /** Ids deleted from a table. */\n  deleted(table: string): string[];\n}\n\nexport function fakeDatabase(): FakeDatabase {\n  const mock = createMockDB();\n  const queries: RecordedQuery[] = [];\n\n  // The recorder wraps `query` and leaves every other op alone, so the fake's\n  // behaviour is the engine's mock plus one observation.\n  const db: DBClient = Object.assign(Object.create(Object.getPrototypeOf(mock) as object) as DBClient, mock, {\n    query: async (sql: string, params: unknown[] = []) => {\n      queries.push({ sql, params });\n      return mock.query(sql, params);\n    },\n  });\n\n  return {\n    db,\n    queries,\n    seed: (table, rows) => mock.seed(table, rows),\n    inserted: (table) => mock.inserted(table),\n    updated: (table) => mock.updated(table),\n    deleted: (table) => mock.deleted(table),\n  };\n}\n"],"mappings":";;;AAGA,IAAM,eAAe,IAAI,KAAK;AEkCvB,IAAM,0BAA0B;AAChC,IAAM,mBAAmB;AASzB,SAAS,eAAe,SAAuC;AACpE,MAAI,OAAO,YAAY,YAAY,YAAY,KAAM,QAAO;AAC5D,QAAM,MAAM;AACZ,MAAI,IAAI,UAAU,eAAgB,QAAO;AACzC,QAAM,IAAI,IAAI;AACd,MAAI,OAAO,MAAM,YAAY,MAAM,KAAM,QAAO;AAChD,QAAM,EAAE,IAAI,QAAQ,WAAW,IAAI;AACnC,MAAI,OAAO,OAAO,YAAY,OAAO,WAAW,SAAU,QAAO;AACjE,MAAI,OAAO,eAAe,YAAY,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,EAAG,QAAO;AAC9F,SAAO,EAAE,IAAI,QAAQ,WAAW;AAClC;AAEA,IAAM,UAAU,IAAI,YAAY;AAqBhC,IAAI,SAAwB;AAE5B,eAAe,WAA4B;AACzC,MAAI,OAAQ,QAAO;AAMnB,QAAM,UAAU;AAGhB,QAAM,UACJ,QAAQ,SAAS,UAAU,SAAS,UACpC,QAAQ,SAAS,UAAU,QAAQ;AACrC,MAAI,SAAS;AACX,QAAI;AACF,YAAM,MAAO,MAAM;;QAA0B,GAAG,OAAO;;AAGvD,UAAI,OAAO,IAAI,eAAe,YAAY;AACxC,cAAM,aAAa,IAAI;AACvB,iBAAS,CAAC,UAAkB,IAAI,WAAW,WAAW,QAAQ,EAAE,OAAO,KAAK,EAAE,OAAO,CAAC;AACtF,eAAO;MACT;IACF,QAAQ;IAGR;EACF;AACA,WAAS,OAAO,UACd,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC,CAAC;AAC7E,SAAO;AACT;AAGA,IAAM,MAAM,MACV,OAAO,gBAAgB,eAAe,OAAO,YAAY,QAAQ,aAC7D,YAAY,IAAI,IAChB,KAAK,IAAI;AAGf,SAAS,gBAAgB,MAA0B;AACjD,MAAI,OAAO;AACX,aAAW,QAAQ,MAAM;AACvB,QAAI,SAAS,GAAG;AACd,cAAQ;AACR;IACF;AAGA,WAAO,OAAO,KAAK,MAAM,IAAI,IAAI;EACnC;AACA,SAAO;AACT;AAYO,IAAM,qBAAqB;AAsB3B,SAAS,UAAU,YAA4B;AACpD,SAAO,IAAI,KAAK;AAClB;AAyBO,IAAM,qBAAqB;AAYlC,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AAExB,eAAsB,kBACpB,WACA,gBAAgB,UAAU,UAAU,UAAU,GAM9C,QACiC;AACjC,MAAI,UAAU,aAAa,oBAAoB;AAC7C,UAAM,IAAI;MACR,sCAAsC,UAAU,UAAU,kCAAkC,kBAAkB;IAChH;EACF;AAEA,QAAM,SAAS,MAAM,SAAS;AAC9B,MAAI,WAAW;AACf,MAAI,aAAa;AAGjB,MAAI,WAAW,OAAO;AAEtB,WAAS,QAAQ,GAAG,QAAQ,eAAe,SAAS;AAGlD,SAAK,QAAQ,UAAU,GAAG;AACxB,UAAI,QAAQ,SAAS;AACnB,cAAM,IAAI,aAAa,+BAA+B,YAAY;MACpE;AACA,UAAI,IAAI,IAAI,UAAU;AACpB,cAAM,IAAI;UACR,wCAAwC,UAAU,UAAU,UAAU,qBAAqB,GAAI,SACtF,MAAM,eAAe,CAAC;QACjC;MACF;IACF;AAWA,QAAI,UAAU,oBAAoB;AAChC,iBAAW,IAAI;IACjB;AACA,QAAI,CAAC,cAAc,UAAU,iBAAiB;AAC5C,mBAAa;AACb,YAAM,UAAU,KAAK,IAAI,IAAI,IAAI,UAAU,IAAK;AAChD,YAAM,QAAQ,kBAAkB,uBAAuB,UAAU;AAWjE,YAAM,aAAc,KAAK,UAAU,aAAa,OAAQ;AACxD,UAAI,aAAa,oBAAoB;AACnC,cAAM,IAAI;UACR,6BAA6B,UAAU,UAAU,gBAAgB,KAAK,MAAM,aAAa,GAAI,CAAC,WACxF,KAAK,MAAM,IAAI,EAAE,eAAe,CAAC,sCAAsC,qBAAqB,GAAI;QAExG;MACF;AACA,iBAAW,IAAI,KAAK,sBAAsB,IAAI,IAAI;IACpD;AAEA,UAAM,OAAO,MAAM,OAAO,UAAU,SAAS,KAAK;AAClD,QAAI,gBAAgB,IAAI,KAAK,UAAU,YAAY;AACjD,aAAO;QACL,CAAC,uBAAuB,GAAG,UAAU;QACrC,CAAC,gBAAgB,GAAG,OAAO,KAAK;MAClC;IACF;EACF;AACA,QAAM,IAAI;IACR,gDAAgD,UAAU,UAAU,WAAW,aAAa;EAC9F;AACF;;;AIxOO,IAAM,eAAN,cAA2B,MAAM;AAAA,EAC7B;AAAA,EACA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA,EAET,YAAY,QAAgB,MAAc,QAAgB,MAAe;AACvE,UAAM,WAAY,QAAQ,CAAC;AAC3B,UAAM,OAAO,SAAS,SAAS,OAAO,MAAM;AAC5C,UAAM,GAAG,MAAM,IAAI,IAAI,WAAM,MAAM,IAAI,IAAI,GAAG,SAAS,oBAAoB,KAAK,SAAS,iBAAiB,KAAK,EAAE,EAAE;AACnH,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,OAAO,SAAS;AACrB,SAAK,OAAO;AAAA,EACd;AACF;AAmDA,SAAS,SAAS,OAAe,SAAyB;AACxD,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,GAAG,OAAO;AAAA,IAEZ;AAAA,EACF;AACA,SAAO;AACT;AAMA,SAAS,cAAc,SAA0B;AAC/C,MAAI;AACF,UAAM,EAAE,SAAS,IAAI,IAAI,IAAI,OAAO;AACpC,WAAO,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa;AAAA,EACtG,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,mBAAmB,OAA8B;AACxD,QAAM,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC;AAC/B,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,EAAE,SAAS,MAAM,CAAC;AACzE,WAAO,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI;AAAA,EACvF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,cAAc,QAAgC;AAC5D,QAAM,UAAU,SAAS,OAAO,SAAS,uBAAuB,EAAE,QAAQ,OAAO,EAAE;AACnF,QAAM,SAAS,SAAS,OAAO,QAAQ,sBAAsB;AAC7D,QAAM,QAAQ,cAAc,OAAO;AAInC,QAAM,iBAAiB,QAAS,OAAO,kBAAkB,KAAM,SAAS,OAAO,kBAAkB,IAAI,wBAAwB;AAC7H,QAAM,UAAU,OAAO,SAAS;AAEhC,QAAM,WAA8B,CAAC;AACrC,MAAI,SAAwB;AAE5B,iBAAe,KAAQ,QAAgB,MAAc,MAAe,OAAoB,CAAC,GAAe;AACtG,UAAM,UAAkC;AAAA,MACtC,QAAQ;AAAA;AAAA;AAAA;AAAA,MAIR,GAAI,iBAAiB,EAAE,uBAAuB,eAAe,IAAI,CAAC;AAAA,MAClE,GAAG,KAAK;AAAA,IACV;AACA,QAAI,OAAQ,SAAQ,gBAAgB,UAAU,MAAM;AACpD,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAElD,UAAM,YAAY,KAAK,IAAI;AAC3B,UAAM,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,MAC7C;AAAA,MACA;AAAA,MACA,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AACD,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAkB,OAAO,UAAU,IAAI,IAAI;AAEjD,aAAS,KAAK,EAAE,QAAQ,MAAM,QAAQ,IAAI,QAAQ,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC;AAE9E,QAAI,CAAC,IAAI,IAAI;AAMX,UAAI,IAAI,WAAW,OAAO,QAAQ;AAChC,cAAM,OAAO,mBAAmB,MAAM;AACtC,YAAI,SAAS,QAAQ,QAAQ,GAAG;AAC9B,gBAAM,IAAI,aAAa,QAAQ,MAAM,IAAI,QAAQ;AAAA,YAC/C,OAAO;AAAA,YACP,mBACE,mCAAmC,KAAK,IAAI,IAAI,CAAC;AAAA,UAGrD,CAAC;AAAA,QACH;AAAA,MACF;AACA,YAAM,IAAI,aAAa,QAAQ,MAAM,IAAI,QAAQ,MAAM;AAAA,IACzD;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,KAAK,CAAC,MAAM,SAAS,KAAK,OAAO,MAAM,QAAW,IAAI;AAAA,IACtD,MAAM,CAAC,MAAM,MAAM,SAAS,KAAK,QAAQ,MAAM,MAAM,IAAI;AAAA,IACzD,OAAO,CAAC,MAAM,MAAM,SAAS,KAAK,SAAS,MAAM,MAAM,IAAI;AAAA,IAC3D,KAAK,CAAC,MAAM,MAAM,SAAS,KAAK,OAAO,MAAM,MAAM,IAAI;AAAA,IACvD,QAAQ,CAAC,MAAM,SAAS,KAAK,UAAU,MAAM,QAAW,IAAI;AAAA,IAC5D,OAAO,CAAC,MAAM,MAAM,SAAS,KAAK,SAAS,MAAM,MAAM,IAAI;AAAA,IAE3D,MAAM,SAAS,MAAM;AACnB,YAAM,YAAY,OAAO,cAAc,CAAC,GAAG,IAAI;AAC/C,UAAI,CAAC,UAAU;AACb,cAAM,WAAW,OAAO,KAAK,OAAO,cAAc,CAAC,CAAC;AACpD,cAAM,IAAI;AAAA,UACR,0BAA0B,KAAK,UAAU,IAAI,CAAC,4EAE3C,SAAS,SACN,mBAAmB,SAAS,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,YAKtC;AAAA;AAAA,QAER;AAAA,MACF;AAGA,UAAI,SAAS,aAAa;AACxB,iBAAS,SAAS;AAClB,eAAO,EAAE,IAAI,SAAS,MAAM,IAAI,OAAO,SAAS,MAAM;AAAA,MACxD;AACA,aAAO,KAAK,OAAO,QAAQ;AAAA,IAC7B;AAAA,IAEA,MAAM,OAAO,aAAa;AAYxB,YAAM,UAAU,OAAO,UACrB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA,QAAQ,EAAE,SAAS,MAAM,IAAI,CAAC;AAAA,MAChC;AAEF,UAAI;AACJ,UAAI;AACF,iBAAS,MAAM,QAAQ;AAAA,MACzB,SAAS,GAAG;AACV,cAAM,UAAU;AAChB,cAAM,YAAY,QAAQ,WAAW,MAAM,eAAe,QAAQ,IAAI,IAAI;AAC1E,YAAI,CAAC,UAAW,OAAM;AACtB,iBAAS,MAAM,QAAQ,MAAM,kBAAkB,SAAS,CAAC;AAAA,MAC3D;AACA,eAAS,OAAO;AAChB,aAAO,OAAO,QAAQ,EAAE,IAAI,GAAG;AAAA,IACjC;AAAA,IACA,MAAM,UAAU;AACd,YAAM,KAAK,QAAQ,gBAAgB,MAAS;AAC5C,eAAS;AAAA,IACX;AAAA,IACA,cAAc;AACZ,eAAS;AAAA,IACX;AAAA,EACF;AACF;AAIA,SAAS,gBAAgB,KAAuD;AAC9E,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,UAAU,MAAuB;AACxC,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,IAAI,aAA6B;AAE1B,IAAM,MAAe,IAAI,MAAM,CAAC,GAAc;AAAA,EACnD,IAAI,SAAS,MAAM;AACjB,mBAAe,cAAc;AAAA,MAC3B,SAAS,QAAQ,IAAI,yBAAyB;AAAA,MAC9C,QAAQ,QAAQ,IAAI,wBAAwB;AAAA,MAC5C,gBAAgB,QAAQ,IAAI,0BAA0B;AAAA,MACtD,YAAY,gBAAgB,QAAQ,IAAI,uBAAuB;AAAA,IACjE,CAAC;AACD,WAAO,QAAQ,IAAI,YAAY,MAAM,UAAU;AAAA,EACjD;AACF,CAAC;;;ACvTM,SAAS,eAA6B;AAC3C,QAAM,QAAQ,oBAAI,IAAuC;AACzD,QAAM,UAA0B;AAAA,IAC9B,UAAU,oBAAI,IAAI;AAAA,IAClB,SAAS,oBAAI,IAAI;AAAA,IACjB,SAAS,oBAAI,IAAI;AAAA,EACnB;AAEA,WAAS,OAAO,OAA0C;AACxD,QAAI,OAAO,MAAM,IAAI,KAAK;AAC1B,QAAI,CAAC,MAAM;AACT,aAAO,CAAC;AACR,YAAM,IAAI,OAAO,IAAI;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AAEA,WAAS,MACP,KACA,OACA,KACM;AACN,UAAM,OAAO,IAAI,IAAI,KAAK;AAC1B,QAAI,KAAM,MAAK,KAAK,GAAG;AAAA,QAClB,KAAI,IAAI,OAAO,CAAC,GAAG,CAAC;AAAA,EAC3B;AAMA,QAAM,MAAa;AAAA,IACjB,MAAM,OAAO,QAAgB,SAAmC;AAC9D,aAAO,CAAC;AAAA,IACV;AAAA,IACA,MAAM,UAAU;AACd,aAAO,CAAC;AAAA,IACV;AAAA,IACA,MAAM,YAAY;AAChB,aAAO,CAAC;AAAA,IACV;AAAA,IACA,MAAM,UAAU,QAAgB,KAAa,KAA8B;AACzE,aAAO,EAAE,IAAI,OAAO,WAAW,GAAG,GAAG,IAAI;AAAA,IAC3C;AAAA,IACA,MAAM,MAAM,MAAc,SAAqB;AAC7C,aAAO,CAAC;AAAA,IACV;AAAA,IAEA,MAAM,OAAO,OAAe,MAA+B;AACzD,YAAM,SAAS,EAAE,IAAI,OAAO,WAAW,GAAG,GAAG,KAAK;AAClD,aAAO,KAAK,EAAE,KAAK,MAAM;AACzB,YAAM,QAAQ,UAAU,OAAO,MAAM;AACrC,aAAO;AAAA,IACT;AAAA;AAAA;AAAA,IAIA,MAAM,OACJ,OACA,MACA,MACA;AACA,UAAI,KAAK,WAAW,WAAW,GAAG;AAChC,cAAM,IAAI,MAAM,eAAe,KAAK,6CAAwC;AAAA,MAC9E;AACA,YAAM,OAAO,OAAO,KAAK;AACzB,YAAM,WAAW,KAAK,KAAK,CAAC,MAAM,KAAK,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;AAChF,UAAI,UAAU;AACZ,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAAI,GAAG;AACzC,cAAI,CAAC,KAAK,WAAW,SAAS,CAAC,EAAG,UAAS,CAAC,IAAI;AAAA,QAClD;AACA,eAAO;AAAA,MACT;AACA,YAAM,SAAS,EAAE,IAAI,OAAO,WAAW,GAAG,GAAG,KAAK;AAClD,WAAK,KAAK,MAAM;AAChB,YAAM,QAAQ,UAAU,OAAO,MAAM;AACrC,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,OAAe,IAAY,MAA+B;AACrE,YAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC;AAClC,YAAM,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE;AAChD,YAAM,UAAU,OAAO,IACnB,EAAE,GAAG,KAAK,GAAG,GAAG,GAAG,KAAK,IACxB,EAAE,IAAI,GAAG,KAAK;AAClB,UAAI,OAAO,GAAG;AACZ,aAAK,GAAG,IAAI;AAAA,MACd;AACA,YAAM,QAAQ,SAAS,OAAO,OAAO;AACrC,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,OAAO,OAAe,IAAY;AACtC,YAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC;AAClC,YAAM,MAAM,KAAK,UAAU,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE;AAChD,UAAI,OAAO,EAAG,MAAK,OAAO,KAAK,CAAC;AAChC,YAAM,OAAO,QAAQ,QAAQ,IAAI,KAAK;AACtC,UAAI,KAAM,MAAK,KAAK,EAAE;AAAA,UACjB,SAAQ,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC;AAAA,IACtC;AAAA,IAEA,MAAM,SAAS,OAAe,IAAY;AACxC,YAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC;AAClC,aAAO,KAAK,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,EAAE,KAAK;AAAA,IAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,MAAM,SACJ,OACA,OACA,MACA;AACA,YAAM,OAAO,MAAM,IAAI,KAAK,KAAK,CAAC;AAClC,YAAMA,WAAU,CAAC,KAA8B,KAAa,SAA2B;AACrF,YAAI,SAAS,QAAQ,OAAO,SAAS,YAAY,CAAC,MAAM,QAAQ,IAAI,GAAG;AACrE,iBAAO,OAAO,QAAQ,IAA+B,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM;AACxE,kBAAM,OAAO,IAAI,GAAG;AACpB,oBAAQ,IAAI;AAAA,cACV,KAAK;AAAM,uBAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,IAAI;AAAA,cACrD,KAAK;AAAO,uBAAO,SAAS;AAAA,cAC5B,KAAK;AAAM,uBAAQ,OAAmB;AAAA,cACtC,KAAK;AAAO,uBAAQ,QAAoB;AAAA,cACxC,KAAK;AAAM,uBAAQ,OAAmB;AAAA,cACtC,KAAK;AAAO,uBAAQ,QAAoB;AAAA,cACxC;AAAS,sBAAM,IAAI,MAAM,YAAY,KAAK,YAAY,GAAG,4BAAyB,EAAE,GAAG;AAAA,YACzF;AAAA,UACF,CAAC;AAAA,QACH;AACA,eAAO,IAAI,GAAG,MAAM;AAAA,MACtB;AACA,UAAI,MAAM,QACN,KAAK,OAAO,CAAC,QAAQ,OAAO,QAAQ,KAAK,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,MAAMA,SAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,IAChF,CAAC,GAAG,IAAI;AACZ,YAAM,QAAQ,MAAM;AACpB,UAAI,OAAO;AACT,cAAM,MAAM,MAAM,cAAc,SAAS,KAAK;AAC9C,cAAM,CAAC,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,MAAM;AAC5B,gBAAM,IAAI,EAAE,MAAM,MAAM;AACxB,gBAAM,IAAI,EAAE,MAAM,MAAM;AACxB,iBAAO,MAAM,IAAI,KAAK,IAAI,IAAI,KAAK,KAAK;AAAA,QAC1C,CAAC;AAAA,MACH;AACA,aAAO,MAAM,UAAU,SAAY,MAAM,IAAI,MAAM,GAAG,KAAK,KAAK;AAAA,IAClE;AAAA,EACF;AAgBA,iBAAe,OAAO,MAA2C;AAC/D,UAAM,WAAW,oBAAI,IAAuC;AAC5D,eAAW,CAAC,OAAO,IAAI,KAAK,MAAO,UAAS,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC;AAChE,UAAM,kBAAkC;AAAA,MACtC,UAAU,aAAa,QAAQ,QAAQ;AAAA,MACvC,SAAS,aAAa,QAAQ,OAAO;AAAA,MACrC,SAAS,IAAI,IAAI,CAAC,GAAG,QAAQ,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAAA,IACpE;AAEA,UAAM,UAA4B,CAAC;AACnC,QAAI;AACF,iBAAW,MAAM,KAAK,KAAK;AACzB,cAAM,SAAS,QAAQ,IAAI,OAAO;AAClC,gBAAQ,KAAK,MAAM;AACnB,cAAM,UAAU,aAAa,GAAG,OAAO,OAAO,KAAK,MAAM;AACzD,YAAI,QAAS,OAAM;AAAA,MACrB;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,MAAM;AACZ,iBAAW,CAAC,OAAO,IAAI,KAAK,SAAU,OAAM,IAAI,OAAO,IAAI;AAC3D,cAAQ,WAAW,gBAAgB;AACnC,cAAQ,UAAU,gBAAgB;AAClC,cAAQ,UAAU,gBAAgB;AAClC,YAAM;AAAA,IACR;AACA,WAAO,EAAE,QAAQ;AAAA,EACnB;AAEA,WAAS,QAAQ,IAAc,SAA2C;AACxE,YAAQ,GAAG,IAAI;AAAA,MACb,KAAK,UAAU;AACb,cAAM,SAAS,WAAW,GAAG,UAAU,CAAC,GAAG,SAAS,IAAI;AACxD,cAAM,WAAW,GAAG,cAAc,CAAC;AACnC,cAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,cAAM,MAAM,KAAK,KAAK,CAAC,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC;AACtE,YAAI,KAAK;AACP,qBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,MAAM,GAAG;AACjD,gBAAI,CAAC,SAAS,SAAS,GAAG,EAAG,KAAI,GAAG,IAAI;AAAA,UAC1C;AACA,iBAAO,EAAE,MAAM,CAAC,GAAG,GAAG,eAAe,EAAE;AAAA,QACzC;AACA,cAAM,UAAU,EAAE,IAAI,OAAO,WAAW,GAAG,GAAG,OAAO;AACrD,aAAK,KAAK,OAAO;AACjB,cAAM,QAAQ,UAAU,GAAG,OAAO,OAAO;AACzC,eAAO,EAAE,MAAM,CAAC,OAAO,GAAG,eAAe,EAAE;AAAA,MAC7C;AAAA,MACA,KAAK,UAAU;AACb,cAAM,SAAS,EAAE,IAAI,OAAO,WAAW,GAAG,GAAG,WAAW,GAAG,UAAU,CAAC,GAAG,SAAS,IAAI,EAAE;AACxF,eAAO,GAAG,KAAK,EAAE,KAAK,MAAM;AAC5B,cAAM,QAAQ,UAAU,GAAG,OAAO,MAAM;AACxC,eAAO,EAAE,MAAM,CAAC,MAAM,GAAG,eAAe,EAAE;AAAA,MAC5C;AAAA,MACA,KAAK,cAAc;AACjB,cAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ;AAC3C,gBAAM,SAAS,EAAE,IAAI,OAAO,WAAW,GAAG,GAAG,WAAW,KAAK,SAAS,IAAI,EAAE;AAC5E,iBAAO,GAAG,KAAK,EAAE,KAAK,MAAM;AAC5B,gBAAM,QAAQ,UAAU,GAAG,OAAO,MAAM;AACxC,iBAAO;AAAA,QACT,CAAC;AACD,eAAO,EAAE,MAAM,SAAS,eAAe,QAAQ,OAAO;AAAA,MACxD;AAAA,MACA,KAAK,UAAU;AACb,cAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,cAAM,QAAQ,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,IAAI;AACtD,cAAM,UAAqC,CAAC;AAC5C,iBAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,gBAAM,MAAM,KAAK,CAAC;AAClB,cAAI,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,EAAG;AAClC,gBAAM,OAAO,EAAE,GAAG,KAAK,GAAG,WAAW,GAAG,OAAO,CAAC,GAAG,SAAS,GAAG,EAAE;AACjE,eAAK,CAAC,IAAI;AACV,gBAAM,QAAQ,SAAS,GAAG,OAAO,IAAI;AACrC,kBAAQ,KAAK,IAAI;AAAA,QACnB;AACA,eAAO,EAAE,MAAM,SAAS,eAAe,QAAQ,OAAO;AAAA,MACxD;AAAA,MACA,KAAK,UAAU;AACb,cAAM,OAAO,OAAO,GAAG,KAAK;AAC5B,cAAM,QAAQ,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,IAAI;AACtD,cAAM,UAAU,KAAK,OAAO,CAAC,QAAQ,QAAQ,KAAK,KAAK,CAAC;AACxD,mBAAW,OAAO,SAAS;AACzB,eAAK,OAAO,KAAK,QAAQ,GAAG,GAAG,CAAC;AAChC,gBAAM,KAAK,IAAI,IAAI;AACnB,gBAAM,OAAO,QAAQ,QAAQ,IAAI,GAAG,KAAK;AACzC,gBAAM,MAAM,OAAO,OAAO,WAAW,KAAK,OAAO,EAAE;AACnD,cAAI,KAAM,MAAK,KAAK,GAAG;AAAA,cAClB,SAAQ,QAAQ,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC;AAAA,QAC1C;AACA,eAAO,EAAE,MAAM,SAAS,eAAe,QAAQ,OAAO;AAAA,MACxD;AAAA,MACA,KAAK,UAAU;AACb,cAAM,QAAQ,WAAW,GAAG,SAAS,CAAC,GAAG,SAAS,IAAI;AACtD,YAAI,QAAQ,OAAO,GAAG,KAAK,EAAE,OAAO,CAAC,QAAQ,QAAQ,KAAK,KAAK,CAAC;AAChE,YAAI,GAAG,UAAU,OAAW,SAAQ,MAAM,MAAM,GAAG,GAAG,KAAK;AAC3D,eAAO,EAAE,MAAM,OAAO,eAAe,MAAM,OAAO;AAAA,MACpD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAuB;AAAA,IAC3B,GAAG;AAAA;AAAA;AAAA,IAIH,SAAS,CAAK,OAA8C,GAAG,GAAG;AAAA,IAElE;AAAA;AAAA;AAAA;AAAA;AAAA,IAMA,YAAyC;AACvC,aAAO;AAAA,IACT;AAAA,IAEA,SAAS,OAAe;AACtB,aAAO,QAAQ,SAAS,IAAI,KAAK,KAAK,CAAC;AAAA,IACzC;AAAA,IAEA,QAAQ,OAAe;AACrB,aAAO,QAAQ,QAAQ,IAAI,KAAK,KAAK,CAAC;AAAA,IACxC;AAAA,IAEA,QAAQ,OAAe;AACrB,aAAO,QAAQ,QAAQ,IAAI,KAAK,KAAK,CAAC;AAAA,IACxC;AAAA,IAEA,KAAK,OAAe,MAAiC;AACnD,YAAM,IAAI,OAAO,CAAC,GAAG,IAAI,CAAC;AAAA,IAC5B;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,aACP,KACwC;AACxC,SAAO,IAAI,IAAI,CAAC,GAAG,GAAG,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtD;AAIA,SAAS,aACP,OACA,SACA,SACA,QACS;AACT,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AAEf,MAAI,OAAO,MAAM;AACf,UAAM,MAAM,QAAQ,OAAO,KAAK,EAAE,GAAG,KAAK,CAAC;AAC3C,QAAI,CAAC,KAAK;AACR,YAAM,YAAY,KAAK,qBAAqB;AAAA,QAC1C,SAAS,aAAa,OAAO,KAAK,EAAE;AAAA,MACtC,CAAC;AAAA,IACH;AACA,WAAO,IAAI,OAAO,KAAK,KAAK;AAAA,EAC9B;AAEA,MAAI,OAAO,OAAO;AAChB,UAAM,KAAK,OAAO,MAAM,IAAI;AAC5B,QAAI,OAAO,MAAO,SAAO,oBAAI,KAAK,GAAE,YAAY;AAChD,UAAM,KAAK,OAAO,OAAO,MAAM,IAAI,CAAC;AACpC,UAAM,OAAO,OAAO,UAAU,MAAM,KAAK,CAAC;AAC1C,WAAO,OAAO,QAAQ,OAAO,KAAK,OAAO;AAAA,EAC3C;AAEA,SAAO;AACT;AAEA,SAAS,WACP,KACA,SACA,SACyB;AACzB,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC9C,QAAI,GAAG,IAAI,aAAa,OAAO,SAAS,SAAS,GAAG;AAAA,EACtD;AACA,SAAO;AACT;AAIA,SAAS,QAAQ,KAA8B,OAAyC;AACtF,SAAO,OAAO,QAAQ,KAAK,EAAE;AAAA,IAAM,CAAC,CAAC,KAAK,KAAK,MAC7C,UAAU,OAAO,IAAI,GAAG,MAAM,QAAQ,IAAI,GAAG,MAAM,SAAY,IAAI,GAAG,MAAM;AAAA,EAC9E;AACF;AAEA,SAAS,aAAa,OAAgC,OAAwB;AAC5E,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,KACJ,MAAM,SAAS,QACX,UAAU,IACV,MAAM,SAAS,SACb,UAAU,IACV,MAAM,SAAS,YACb,SAAS,MAAM,IACf,SAAS,MAAM;AACzB,MAAI,GAAI,QAAO;AACf,SAAO,YAAY,KAAK,mBAAmB;AAAA,IACzC,MAAM,MAAM;AAAA,IACZ,SAAS,YAAY,MAAM,IAAI,IAAI,MAAM,CAAC,gBAAgB,KAAK;AAAA,EACjE,CAAC;AACH;AAIA,SAAS,YACP,QACA,MACA,OACyB;AACzB,QAAM,MAAM,IAAI,MAAM,MAAM,OAAO;AACnC,MAAI,SAAS;AACb,MAAI,aAAa;AACjB,MAAI,MAAM,SAAS,OAAW,KAAI,OAAO,MAAM;AAC/C,SAAO;AACT;;;ACpXO,SAAS,eAA6B;AAC3C,QAAM,OAAO,aAAa;AAC1B,QAAM,UAA2B,CAAC;AAIlC,QAAM,KAAe,OAAO,OAAO,OAAO,OAAO,OAAO,eAAe,IAAI,CAAW,GAAe,MAAM;AAAA,IACzG,OAAO,OAAO,KAAa,SAAoB,CAAC,MAAM;AACpD,cAAQ,KAAK,EAAE,KAAK,OAAO,CAAC;AAC5B,aAAO,KAAK,MAAM,KAAK,MAAM;AAAA,IAC/B;AAAA,EACF,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,CAAC,OAAO,SAAS,KAAK,KAAK,OAAO,IAAI;AAAA,IAC5C,UAAU,CAAC,UAAU,KAAK,SAAS,KAAK;AAAA,IACxC,SAAS,CAAC,UAAU,KAAK,QAAQ,KAAK;AAAA,IACtC,SAAS,CAAC,UAAU,KAAK,QAAQ,KAAK;AAAA,EACxC;AACF;","names":["matches"]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@palbase/backend",
-  "version": "23.0.0",
-  "description": "Palbase Backend SDK — class controllers (@Controller/@Get/@Post + @Body/@QueryParams/@Param), error classes, schema DSL",
+  "version": "23.1.0",
+  "description": "Palbase Backend SDK \u2014 class controllers (@Controller/@Get/@Post + @Body/@QueryParams/@Param), error classes, schema DSL",
   "license": "MIT",
   "repository": {
     "type": "git",
@@ -116,7 +116,8 @@
     "tsup": "^8.0.0",
     "tsx": "^4.22.4",
     "typescript": "^5.7.0",
-    "vitest": "^3.0.0"
+    "vitest": "^3.0.0",
+    "@palbase/core": "workspace:^"
   },
   "publishConfig": {
     "access": "public"

package/stager/return_types.js

@@ -94,9 +94,22 @@ function readReturnTypes(sourceText, fileLabel) {
   // `import { TodoSchema as T } from "../models/todo"`    → T:"../models/todo" (+ original)
   const imports = {};        // localName → specifier
   const importOriginal = {}; // localName → originalExportedName (for aliases)
+  // localName → true when the binding is TYPE-ONLY. Both spellings count:
+  // `import type { X }` (clause-level) and `import { type X }` (specifier-level).
+  //
+  // WHY IT IS TRACKED. A return schema has to survive to RUNTIME: this module
+  // emits code that binds the same-named zod const onto the route registry. A
+  // type-only import is ERASED by esbuild, so the emitted line then refers to an
+  // identifier that does not exist and the deploy fails with a bare
+  // `X is not defined` — no controller, no method, no cause. Measured on a
+  // customer run 2026-08-29. The check costs one flag read; not doing it is what
+  // made this module's own promise ("a violation is a HARD build error, never
+  // silent") false for the single most likely mistake.
+  const typeOnly = {};
   for (const stmt of sf.statements) {
     if (!tsapi.isImportDeclaration(stmt) || !stmt.importClause) continue;
     const spec = stmt.moduleSpecifier.text;
+    const clauseIsTypeOnly = stmt.importClause.isTypeOnly === true;
     const named = stmt.importClause.namedBindings;
     if (named && tsapi.isNamedImports(named)) {
       for (const el of named.elements) {
@@ -104,6 +117,7 @@ function readReturnTypes(sourceText, fileLabel) {
         const original = el.propertyName ? el.propertyName.text : local;
         imports[local] = spec;
         importOriginal[local] = original;
+        if (clauseIsTypeOnly || el.isTypeOnly === true) typeOnly[local] = true;
       }
     }
   }
@@ -254,6 +268,15 @@ function readReturnTypes(sourceText, fileLabel) {
             `export \`const ${typeName} = z.object(...)\` and import it`,
         );
       }
+      if (typeOnly[typeName]) {
+        throw err(
+          fnName,
+          `return type \`${typeName}\` is imported as TYPE-ONLY, but a response schema has to exist at ` +
+            `RUNTIME: the deploy binds the zod value of that name onto the route. A type-only import is ` +
+            `erased when the bundle is built, so this would fail at boot with \`${typeName} is not ` +
+            `defined\`. Drop the \`type\` keyword: \`import { ${typeName} } from ...\``,
+        );
+      }
       methods.push({ fnName, typeName, isArray });
     }
   }

package/dist/chunk-FSGSB42K.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/runtime.ts"],"sourcesContent":["/**\n * runtime.ts — request-scoped service singletons.\n *\n * The backend SDK no longer threads a `ctx` god-object through every handler.\n * Instead, controller methods import PascalCase service singletons directly:\n *\n *   import { Controller, Post, Body, Database } from \"@palbase/backend\";\n *\n *   \\@Controller(\"/todos\")\n *   export default class TodosController {\n *     \\@Post(\"\") create(\\@Body(CreateTodoBody) body: CreateTodoBody): unknown {\n *       return Database.insert(\"todos\", { title: body.title });\n *     }\n *   }\n *\n * The singletons are thin Proxies. Every property access forwards to the live\n * client for the CURRENT request scope, resolved through {@link __getRuntime}.\n *\n * # Request-scope resolution (persistent app-server)\n *\n * The runtime is a long-running Node process that serves many concurrent\n * requests on one event loop (NOT a fresh subprocess per request). A single\n * module-global slot would let one in-flight request's services bleed into\n * another's. So the services are carried in an {@link AsyncLocalStorage} store\n * ({@link __requestALS}) that the runtime sets per request with\n * {@link __runWithRuntime}; every async continuation of that request reads its\n * own store. `__getRuntime` reads the ALS store first; the module-global slot\n * (set by {@link __setRuntime}) is only a fallback for callers that run OUTSIDE\n * an ALS scope (dev-server, unit tests, the legacy single-shot path). Because\n * each `br-<ref>` pod is single-tenant, there is no cross-tenant leakage; the\n * ALS store is what prevents cross-REQUEST leakage within the shared process.\n *\n * The seam that makes `import { Database } from \"@palbase/backend\"` resolve to\n * the runtime-injected client: `@palbase/backend` is marked esbuild-EXTERNAL\n * when the tenant bundle is built, and the package is installed globally in the\n * pod (NODE_PATH=/usr/local/lib/node_modules). So worker.js's\n * `require('@palbase/backend')` and the bundle's `import` resolve to ONE shared\n * module instance — the ALS store and `__setRuntime` slot on that instance are\n * visible to the singletons the bundle imported.\n */\n\nimport type { PalbaseFlagKey } from \"./stack.js\";\nimport type { Buckets, BucketTypes } from \"./db/env.js\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\n\nimport type {\n  DBClient,\n  DBOps,\n  CacheClient,\n  Logger,\n  PalbaseDocsClient,\n  SecretsService,\n} from \"./endpoint.js\";\nimport type {\n  PalbaseStorageClient,\n  PalbaseBucketClient,\n  PalbaseNotificationsClient,\n  PalbaseFlagsClient,\n  PalbaseFlagsServiceClient,\n  PalbaseFlagContext,\n  PalbaseFlagVariant,\n  PalbaseFlag,\n  PalbaseFlagValue,\n  PalbaseSetOverrideResult,\n  PalbaseRealtimeClient,\n} from \"./clients.js\";\nimport type { PalbaseResult } from \"./endpoint.js\";\nimport type {\n  EnvTypedDatabase,\n  EnvServiceDatabase,\n  EnvTables,\n  TxPlan,\n  TxTables,\n} from \"./db/typed-db.js\";\nimport type { Materialized } from \"./db/tx-plan.js\";\nimport { TxPlanBuilder, runTxPlan } from \"./db/tx-plan.js\";\n\n/** The set of live clients the runtime injects per request scope.\n *\n * Realtime is BROADCAST-ONLY here (a stateless handler can push an event but\n * cannot hold a subscription socket — `subscribe()` lives on the client SDK).\n *\n * EXCLUDED on purpose: Functions, Links, Analytics, Auth. They are not\n * exposed as backend handler singletons (auth lives on the client SDK; the rest\n * are out of scope for backend endpoints). */\nexport interface RuntimeServices {\n  Database: DBClient;\n  Secrets: SecretsService;\n  Documents: PalbaseDocsClient;\n  Storage: PalbaseStorageClient;\n  Cache: CacheClient;\n  Log: Logger;\n  Notifications: PalbaseNotificationsClient;\n  Flags: PalbaseFlagsClient;\n  Realtime: PalbaseRealtimeClient;\n}\n\n/**\n * The per-request ALS box.\n *\n * `runtime` is the service bundle. `userId` is the request's authenticated user\n * id, written by the runtime immediately after it assembles the request object\n * (worker.js: `requestALS.getStore().userId = pbReq.user?.id || null`) and\n * `null` on an anonymous request. It was already being written there for the\n * Flags client's auto-bind; declaring it here makes the existing contract typed\n * instead of implicit, which is what lets `currentSubjectId()` read a\n * server-owned identity rather than trusting anything the caller sent.\n */\nexport interface RequestStore {\n  runtime: RuntimeServices;\n  userId?: string | null;\n  /** This request's id (`req_…`), written by the runtime. Used as the spend\n   * idempotency scope when the caller supplied no `Idempotency-Key`. */\n  requestId?: string;\n  /** The caller's `Idempotency-Key` header, or `null` when absent. What makes a\n   * client's retry replay its first result instead of charging twice. */\n  idempotencyKey?: string | null;\n}\n\n/**\n * Per-request store. The persistent runtime runs each request inside\n * {@link __runWithRuntime}, so every async continuation of that request reads\n * its OWN `runtime` (and any other request-scoped fields the runtime adds).\n *\n * Exported with a `__` prefix so the runtime (worker.js) shares the SAME ALS\n * instance across the one module instance — two ALS instances would silently\n * not see each other's stores. NOT part of the public author-facing API.\n */\nexport const __requestALS = new AsyncLocalStorage<RequestStore>();\n\n/** Process-global fallback slot. Used only OUTSIDE an ALS scope (dev-server,\n * unit tests, legacy single-shot worker). Inside the persistent server every\n * request runs in {@link __requestALS}, which takes precedence. */\nlet runtime: RuntimeServices | null = null;\n\n/** Install the live clients in the process-global fallback slot.\n *\n * Persistent-server requests should use {@link __runWithRuntime} instead; this\n * remains for dev-server / tests / the legacy single-shot path that run without\n * an ALS scope. NOT part of the public author-facing API. */\nexport function __setRuntime(services: RuntimeServices): void {\n  runtime = services;\n}\n\n/** Run `fn` with `services` bound as the request-scoped runtime.\n *\n * The persistent worker calls this once per request so concurrent requests\n * never share a services slot. NOT part of the public author-facing API. */\nexport function __runWithRuntime<T>(services: RuntimeServices, fn: () => T): T {\n  return __requestALS.run({ runtime: services }, fn);\n}\n\n/** Read the live clients, throwing if accessed outside a request scope.\n *\n * Resolves the ALS store first (persistent server, per-request), then the\n * process-global fallback (dev-server / tests). NOT part of the public\n * author-facing API — used by the runtime and the singleton Proxies. */\nexport function __getRuntime(): RuntimeServices {\n  const scoped = __requestALS.getStore();\n  if (scoped) return scoped.runtime;\n  if (runtime === null) {\n    throw new Error(\n      \"Palbase services accessed outside a request scope. The Database/Documents/… \" +\n        \"singletons are only available inside an endpoint handler (or after the \" +\n        \"runtime has called __runWithRuntime / __setRuntime).\",\n    );\n  }\n  return runtime;\n}\n\n/**\n * Build a Proxy singleton that forwards every property access to the live\n * client named `key` on the current runtime.\n *\n * The single `as RuntimeServices[K]` is the only contained cast in the surface:\n * `Reflect.get` on a typed object returns `unknown` for a `string | symbol`\n * key, but `prop` is constrained to keys of the client interface at the call\n * sites (the exported singletons are typed below), so the forward is sound.\n */\nfunction makeServiceProxy<K extends keyof RuntimeServices>(key: K): RuntimeServices[K] {\n  const handler: ProxyHandler<RuntimeServices[K]> = {\n    get(_target, prop, receiver) {\n      const client = __getRuntime()[key];\n      const value = Reflect.get(client as object, prop, receiver) as unknown;\n      // Bind methods to their owning client so `this` stays correct when the\n      // author destructures or calls `Database.query(...)`.\n      return typeof value === \"function\" ? value.bind(client) : value;\n    },\n  };\n  // The Proxy target is irrelevant (all access goes through `get`); the cast\n  // names the surface type the singleton presents to authors.\n  return new Proxy({} as RuntimeServices[K], handler);\n}\n\n/**\n * Build the `.tables` accessor for the top-level `Database`. Each\n * `tables.<name>` access returns a small object that forwards the five CRUD ops\n * to the underlying client using `name` as the string table identifier. The\n * shapes are typed against the generated `palbase-env.d.ts` (`EnvTables`); at\n * runtime they are plain string-keyed calls, so no schema value is needed here.\n *\n * Returns `EnvTables` — TS cannot infer the mapped type through the Proxy, so\n * a single structural narrowing names the surface (the proxy returns a\n * correctly-shaped accessor for whatever string member is read).\n */\n/** T018 (C-8): similar/recommend'in string-keyed yüzü. DBOps'a (endpoint.ts)\n * BİLEREK eklenmedi — search-param imza üçlüsü (engine/db + typed-db +\n * endpoint) büyümesin: proxy dispatch runtime'da engine ops'una zaten ulaşır,\n * derleme güvenliğini typed yüzey (EnvTypedTable) verir. */\ninterface RecoOps {\n  similar(table: string, id: string, params?: Record<string, unknown>): Promise<Record<string, unknown>[]>;\n  recommend(table: string, params: Record<string, unknown>): Promise<Record<string, unknown>[]>;\n}\n\nfunction makeTablesAccessor(ops: () => DBOps & RecoOps): EnvTables {\n  const tablesProxy = new Proxy(\n    {},\n    {\n      get(_t, prop: string | symbol) {\n        if (typeof prop !== \"string\") return undefined;\n        const name = prop;\n        return {\n          insert: (data: Record<string, unknown>) => ops().insert(name, data),\n          update: (id: string, data: Record<string, unknown>) => ops().update(name, id, data),\n          delete: (id: string) => ops().delete(name, id),\n          findById: (id: string) => ops().findById(name, id),\n          findMany: (query?: Record<string, unknown>) => ops().findMany(name, query),\n          search: (params?: Record<string, unknown>) => ops().search(name, params),\n          similar: (id: string, params?: Record<string, unknown>) => ops().similar(name, id, params),\n          recommend: (params: Record<string, unknown>) => ops().recommend(name, params),\n          supersede: (id: string, row: Record<string, unknown>) => ops().supersede(name, id, row),\n        };\n      },\n    },\n  );\n  return tablesProxy as EnvTables;\n}\n\n/** The raw string-keyed `DBClient` for the current request scope. */\nconst rawDatabase: DBClient = makeServiceProxy(\"Database\");\n\n/**\n * Wrap a raw `DBClient` into the typed `{ ...ops, tables, transaction }`\n * surface. The five string ops forward straight through; `tables` is the\n * env-typed accessor; `transaction` yields typed tables. Reused for both the\n * default (RLS-enforced) `Database` and the `asService()` sibling — each is\n * fed its own raw client (the default proxy vs `rawDatabase.asService()`).\n *\n * The `satisfies` pins the op surface so a missing/renamed op is a compile\n * error; the assembled object carries `tables`/`transaction` alongside.\n */\nfunction makeTypedSurface(raw: Omit<DBClient, \"asService\">): EnvServiceDatabase {\n  // Proxy dispatch her üyeyi taşır; RecoOps tipi DBClient'a eklenmediğinden\n  // (yukarıdaki karar) similar/recommend erişimi bu daraltmadan geçer.\n  const reco = raw as Omit<DBClient, \"asService\"> & RecoOps;\n  const ops = {\n    query: (sql: string, params?: unknown[]) => raw.query(sql, params),\n    insert: (table: string, data: Record<string, unknown>) => raw.insert(table, data),\n    update: (table: string, id: string, data: Record<string, unknown>) =>\n      raw.update(table, id, data),\n    delete: (table: string, id: string) => raw.delete(table, id),\n    findById: (table: string, id: string) => raw.findById(table, id),\n    findMany: (table: string, query?: Record<string, unknown>) => raw.findMany(table, query),\n    search: (table: string, params?: Record<string, unknown>) => raw.search(table, params),\n    similar: (table: string, id: string, params?: Record<string, unknown>) =>\n      reco.similar(table, id, params),\n    recommend: (table: string, params: Record<string, unknown>) => reco.recommend(table, params),\n    supersede: (table: string, id: string, row: Record<string, unknown>) =>\n      raw.supersede(table, id, row),\n  } satisfies DBOps & RecoOps;\n  return Object.assign(ops, {\n    tables: makeTablesAccessor(() => reco),\n    transaction<T>(\n      fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T,\n    ): Promise<Materialized<T>> {\n      // A FRESH builder per call: it holds this transaction's ops and its error\n      // slot table, and the runtime serves concurrent requests on one event loop.\n      // A shared builder would splice one request's writes into another's plan.\n      const builder = new TxPlanBuilder();\n      return runTxPlan(raw, makeTxTablesAccessor(builder), builder, fn) as Promise<\n        Materialized<T>\n      >;\n    },\n  });\n}\n\n/**\n * The transaction twin of {@link makeTablesAccessor}: `tables.<name>` yields the\n * table's PLAN operations, recorded into `builder` instead of sent one by one.\n *\n * Same Proxy shape and same reason for the single narrowing — TS cannot infer a\n * mapped type through a Proxy, so the cast names what the trap returns.\n */\nfunction makeTxTablesAccessor(builder: TxPlanBuilder): TxTables {\n  const tablesProxy = new Proxy(\n    {},\n    {\n      get(_t, prop: string | symbol) {\n        if (typeof prop !== \"string\") return undefined;\n        return builder.table(prop);\n      },\n    },\n  );\n  return tablesProxy as TxTables;\n}\n\n/**\n * The project's own Postgres (pgx, schema `env_<envId>`).\n *\n * Typed by default: `Database.tables.<name>.insert({...})` is typed against\n * the project's generated `palbase-env.d.ts` with NO import and NO generic.\n * The raw string ops (`query`/`insert`/`update`/`delete`/`findById`/`findMany`)\n * are also available for dynamic table names and read-only SQL.\n *\n * RLS is enforced by default (the runtime runs each op as `authenticated` with\n * the verified user's claims). To bypass RLS, call `Database.asService()` —\n * explicit and greppable — which runs as the `service_role` (BYPASSRLS).\n *\n * @example\n * import { Database } from \"@palbase/backend\";\n *\n * const todo = await Database.tables.todos.insert({ title: req.input.title });\n * todo.id; // string ✓\n * const rows = await Database.query(\"SELECT id FROM todos WHERE done = $1\", [false]);\n * const all  = await Database.asService().tables.todos.findMany({}); // RLS bypass\n */\nexport const Database: EnvTypedDatabase = Object.assign(makeTypedSurface(rawDatabase), {\n  /**\n   * Lazily resolve the runtime's service-role sibling on each call. We do NOT\n   * cache it: `rawDatabase.asService()` reads the CURRENT request scope through\n   * the runtime proxy, and the per-request runtime injects a service client\n   * bound to that request's identity headers — caching would leak one request's\n   * sibling into another concurrent request.\n   */\n  asService(): EnvServiceDatabase {\n    return makeTypedSurface(rawDatabase.asService());\n  },\n});\n\n/** Firestore-like document client (PalDocs). */\nexport const Documents: PalbaseDocsClient = makeServiceProxy(\"Documents\");\n\n/**\n * `buckets.<name>` — the storage twin of `Database.tables.<name>`, and the same\n * mechanism: `config/storage.ts` generates a `Buckets` augmentation into\n * `palbase-env.d.ts`, so a bucket name is a property with no import and no\n * generic, and a typo is a compile error.\n *\n * The intermediate `.buckets` is there for the reason `.tables` is: bucket\n * names must not share a namespace with the client's own methods, or the day\n * somebody declares a bucket called `bucket` the surface breaks.\n */\nexport type EnvBuckets = {\n  [K in keyof Buckets]: TypedBucketClient<Buckets[K] extends BucketTypes ? Buckets[K] : BucketTypes>;\n};\n\n/** One bucket, with its declared variant names in the type. */\nexport interface TypedBucketClient<B extends BucketTypes> extends Omit<PalbaseBucketClient, \"getPublicUrl\"> {\n  /** The public URL for the object, or for one of THIS bucket's declared\n   * renditions. A name the bucket does not declare is a compile error. */\n  getPublicUrl(path: string, options?: { variant?: B[\"variants\"] }): string;\n}\n\nfunction makeBucketsAccessor(storage: () => PalbaseStorageClient): EnvBuckets {\n  return new Proxy(\n    {},\n    {\n      get(_t, prop: string | symbol) {\n        if (typeof prop !== \"string\") return undefined;\n        return storage().bucket(prop);\n      },\n    },\n  ) as EnvBuckets;\n}\n\nconst rawStorage: PalbaseStorageClient = makeServiceProxy(\"Storage\");\n\n/**\n * Object storage: buckets, objects, renditions and signed URLs.\n *\n * `Storage.buckets.posts.upload(...)` is the typed path. `Storage.bucket(name)`\n * remains for a name computed at runtime — rare, and it gives up the typing,\n * which is the honest trade rather than a second blessed way to do it.\n */\nexport const Storage: PalbaseStorageClient & { buckets: EnvBuckets } = Object.assign(\n  {\n    // FORWARDED explicitly, not assigned onto the service proxy.\n    //\n    // `Object.assign(rawStorage, {buckets})` writes onto the proxy's TARGET, and\n    // the proxy's only trap is `get`, which forwards every read to the module\n    // client — so the property landed somewhere nothing reads and\n    // `Storage.buckets.docs` was `undefined` in a deployed handler. It\n    // typechecked, every test passed, and the live call answered\n    // \"TypeError: undefined is not an object\". `Database` never had the bug\n    // because it builds a plain surface the same way this now does.\n    bucket: (name: string) => rawStorage.bucket(name),\n  },\n  { buckets: makeBucketsAccessor(() => rawStorage) },\n);\n\n/** JSON-typed cache (get/set/incr/getOrSet). */\nexport const Cache: CacheClient = makeServiceProxy(\"Cache\");\n\n\n/**\n * This tenant's secrets — API keys, provider credentials, signing material the\n * BACKEND owns.\n *\n * `await Secrets.get(\"STRIPE_KEY\")` in a handler. There is no `.env` to read\n * and no file to mount: a secret is written through the vault's authenticated\n * API (or the CLI/MCP that calls it), and this is how the deployed code reads\n * it back. A name this tenant has not set answers null — as does every name\n * the STACK holds, because no route returns a platform secret's value at all.\n */\nexport const Secrets: SecretsService = makeServiceProxy(\"Secrets\");\n\n/** Structured logger. */\nexport const Log: Logger = makeServiceProxy(\"Log\");\n\n/** Push / email / SMS / in-app notifications. */\nexport const Notifications: PalbaseNotificationsClient = makeServiceProxy(\"Notifications\");\n\n\n/**\n * The raw runtime Flags client for the current request scope. Carries the\n * default-surface reads + `setOverride` AND the runtime's `asService()` sibling\n * (the br-pod's `buildFlagsClient` returns both). The default `Flags` singleton\n * below forwards reads + `setOverride` through here; `Flags.asService()`\n * forwards to this client's own `asService()`.\n */\nconst rawFlags: PalbaseFlagsClient = makeServiceProxy(\"Flags\");\n\n/**\n * Feature flags.\n *\n * Mirrors the `Database` / `Database.asService()` model. The default surface is\n * RLS-equivalent for flags: reads resolve against the CURRENT request user and\n * `Flags.setOverride(key, value)` writes an override for that same signed-in\n * user (no userId argument, no admin power). Cross-user admin writes\n * (`setOverrideForUser`, …) live behind `Flags.asService()` — explicit and\n * greppable, just like `Database.asService()`.\n *\n * @example\n * import { Flags } from \"@palbase/backend\";\n *\n * if (await Flags.isEnabled(\"new_checkout\")) { ... }            // current user\n * await Flags.setOverride(\"new_checkout\", true);                // current user\n * await Flags.asService().setOverrideForUser(\"u_9\", \"x\", true); // cross-user\n */\nexport const Flags: PalbaseFlagsClient = Object.assign(\n  {\n    isEnabled(\n      flagName: PalbaseFlagKey,\n      context?: PalbaseFlagContext,\n    ): Promise<PalbaseResult<boolean>> {\n      return rawFlags.isEnabled(flagName, context);\n    },\n    getVariant(\n      flagName: PalbaseFlagKey,\n      context?: PalbaseFlagContext,\n    ): Promise<PalbaseResult<PalbaseFlagVariant>> {\n      return rawFlags.getVariant(flagName, context);\n    },\n    getAll(context?: PalbaseFlagContext): Promise<PalbaseResult<PalbaseFlag[]>> {\n      return rawFlags.getAll(context);\n    },\n    /**\n     * Resolve a flag's value, with an optional fallback.\n     *\n     * FORWARDED as of 2026-08-15. This surface is written out by hand, method\n     * by method, and `get` was missing from it — so the client implemented it,\n     * thirty assertions covered it, and `Flags.get(\"x\")` was `undefined` in a\n     * deployed handler. Exactly the shape of the `Storage.buckets` defect found\n     * the same day: a hand-maintained forwarding list is a list somebody has to\n     * remember to update.\n     */\n    get(\n      flagName: PalbaseFlagKey,\n      defaultOrContext?: PalbaseFlagValue | PalbaseFlagContext,\n      maybeContext?: PalbaseFlagContext,\n    ): Promise<PalbaseResult<PalbaseFlagValue>> {\n      return rawFlags.get(flagName, defaultOrContext, maybeContext);\n    },\n    setOverride(\n      key: PalbaseFlagKey,\n      value: PalbaseFlagValue,\n    ): Promise<PalbaseResult<PalbaseSetOverrideResult>> {\n      return rawFlags.setOverride(key, value);\n    },\n  },\n  {\n    /**\n     * Lazily resolve the runtime's cross-user sibling on each call. We do NOT\n     * cache it: `rawFlags.asService()` reads the CURRENT request scope through\n     * the runtime proxy, so caching would leak one request's sibling into\n     * another concurrent request. Mirrors `Database.asService()`.\n     */\n    asService(): PalbaseFlagsServiceClient {\n      return rawFlags.asService();\n    },\n  },\n);\n\n/**\n * The Realtime broadcast singleton for the current request scope. Backend-side\n * Realtime is BROADCAST-ONLY (a stateless handler can push but not subscribe —\n * `subscribe()` lives on the client SDK's `pb.realtime`). Fire-and-forget:\n * `broadcast` resolves once accepted (or with an `error`), never blocking the\n * handler on subscribers.\n *\n * @example\n * import { Realtime } from \"@palbase/backend\";\n *\n * await Realtime.broadcast(\"room:42\", \"message\", { text, from: user.id });\n */\nexport const Realtime: PalbaseRealtimeClient = makeServiceProxy(\"Realtime\");\n"],"mappings":";;;;;;AA2CA,SAAS,yBAAyB;AAqF3B,IAAM,eAAe,IAAI,kBAAgC;AAKhE,IAAI,UAAkC;AAO/B,SAAS,aAAa,UAAiC;AAC5D,YAAU;AACZ;AAMO,SAAS,iBAAoB,UAA2B,IAAgB;AAC7E,SAAO,aAAa,IAAI,EAAE,SAAS,SAAS,GAAG,EAAE;AACnD;AAOO,SAAS,eAAgC;AAC9C,QAAM,SAAS,aAAa,SAAS;AACrC,MAAI,OAAQ,QAAO,OAAO;AAC1B,MAAI,YAAY,MAAM;AACpB,UAAM,IAAI;AAAA,MACR;AAAA,IAGF;AAAA,EACF;AACA,SAAO;AACT;AAWA,SAAS,iBAAkD,KAA4B;AACrF,QAAM,UAA4C;AAAA,IAChD,IAAI,SAAS,MAAM,UAAU;AAC3B,YAAM,SAAS,aAAa,EAAE,GAAG;AACjC,YAAM,QAAQ,QAAQ,IAAI,QAAkB,MAAM,QAAQ;AAG1D,aAAO,OAAO,UAAU,aAAa,MAAM,KAAK,MAAM,IAAI;AAAA,IAC5D;AAAA,EACF;AAGA,SAAO,IAAI,MAAM,CAAC,GAAyB,OAAO;AACpD;AAsBA,SAAS,mBAAmB,KAAuC;AACjE,QAAM,cAAc,IAAI;AAAA,IACtB,CAAC;AAAA,IACD;AAAA,MACE,IAAI,IAAI,MAAuB;AAC7B,YAAI,OAAO,SAAS,SAAU,QAAO;AACrC,cAAM,OAAO;AACb,eAAO;AAAA,UACL,QAAQ,CAAC,SAAkC,IAAI,EAAE,OAAO,MAAM,IAAI;AAAA,UAClE,QAAQ,CAAC,IAAY,SAAkC,IAAI,EAAE,OAAO,MAAM,IAAI,IAAI;AAAA,UAClF,QAAQ,CAAC,OAAe,IAAI,EAAE,OAAO,MAAM,EAAE;AAAA,UAC7C,UAAU,CAAC,OAAe,IAAI,EAAE,SAAS,MAAM,EAAE;AAAA,UACjD,UAAU,CAAC,UAAoC,IAAI,EAAE,SAAS,MAAM,KAAK;AAAA,UACzE,QAAQ,CAAC,WAAqC,IAAI,EAAE,OAAO,MAAM,MAAM;AAAA,UACvE,SAAS,CAAC,IAAY,WAAqC,IAAI,EAAE,QAAQ,MAAM,IAAI,MAAM;AAAA,UACzF,WAAW,CAAC,WAAoC,IAAI,EAAE,UAAU,MAAM,MAAM;AAAA,UAC5E,WAAW,CAAC,IAAY,QAAiC,IAAI,EAAE,UAAU,MAAM,IAAI,GAAG;AAAA,QACxF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGA,IAAM,cAAwB,iBAAiB,UAAU;AAYzD,SAAS,iBAAiB,KAAsD;AAG9E,QAAM,OAAO;AACb,QAAM,MAAM;AAAA,IACV,OAAO,CAAC,KAAa,WAAuB,IAAI,MAAM,KAAK,MAAM;AAAA,IACjE,QAAQ,CAAC,OAAe,SAAkC,IAAI,OAAO,OAAO,IAAI;AAAA,IAChF,QAAQ,CAAC,OAAe,IAAY,SAClC,IAAI,OAAO,OAAO,IAAI,IAAI;AAAA,IAC5B,QAAQ,CAAC,OAAe,OAAe,IAAI,OAAO,OAAO,EAAE;AAAA,IAC3D,UAAU,CAAC,OAAe,OAAe,IAAI,SAAS,OAAO,EAAE;AAAA,IAC/D,UAAU,CAAC,OAAe,UAAoC,IAAI,SAAS,OAAO,KAAK;AAAA,IACvF,QAAQ,CAAC,OAAe,WAAqC,IAAI,OAAO,OAAO,MAAM;AAAA,IACrF,SAAS,CAAC,OAAe,IAAY,WACnC,KAAK,QAAQ,OAAO,IAAI,MAAM;AAAA,IAChC,WAAW,CAAC,OAAe,WAAoC,KAAK,UAAU,OAAO,MAAM;AAAA,IAC3F,WAAW,CAAC,OAAe,IAAY,QACrC,IAAI,UAAU,OAAO,IAAI,GAAG;AAAA,EAChC;AACA,SAAO,OAAO,OAAO,KAAK;AAAA,IACxB,QAAQ,mBAAmB,MAAM,IAAI;AAAA,IACrC,YACE,IAC0B;AAI1B,YAAM,UAAU,IAAI,cAAc;AAClC,aAAO,UAAU,KAAK,qBAAqB,OAAO,GAAG,SAAS,EAAE;AAAA,IAGlE;AAAA,EACF,CAAC;AACH;AASA,SAAS,qBAAqB,SAAkC;AAC9D,QAAM,cAAc,IAAI;AAAA,IACtB,CAAC;AAAA,IACD;AAAA,MACE,IAAI,IAAI,MAAuB;AAC7B,YAAI,OAAO,SAAS,SAAU,QAAO;AACrC,eAAO,QAAQ,MAAM,IAAI;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAsBO,IAAM,WAA6B,OAAO,OAAO,iBAAiB,WAAW,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQrF,YAAgC;AAC9B,WAAO,iBAAiB,YAAY,UAAU,CAAC;AAAA,EACjD;AACF,CAAC;AAGM,IAAM,YAA+B,iBAAiB,WAAW;AAuBxE,SAAS,oBAAoB,SAAiD;AAC5E,SAAO,IAAI;AAAA,IACT,CAAC;AAAA,IACD;AAAA,MACE,IAAI,IAAI,MAAuB;AAC7B,YAAI,OAAO,SAAS,SAAU,QAAO;AACrC,eAAO,QAAQ,EAAE,OAAO,IAAI;AAAA,MAC9B;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAM,aAAmC,iBAAiB,SAAS;AAS5D,IAAM,UAA0D,OAAO;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAUE,QAAQ,CAAC,SAAiB,WAAW,OAAO,IAAI;AAAA,EAClD;AAAA,EACA,EAAE,SAAS,oBAAoB,MAAM,UAAU,EAAE;AACnD;AAGO,IAAM,QAAqB,iBAAiB,OAAO;AAanD,IAAM,UAA0B,iBAAiB,SAAS;AAG1D,IAAM,MAAc,iBAAiB,KAAK;AAG1C,IAAM,gBAA4C,iBAAiB,eAAe;AAUzF,IAAM,WAA+B,iBAAiB,OAAO;AAmBtD,IAAM,QAA4B,OAAO;AAAA,EAC9C;AAAA,IACE,UACE,UACA,SACiC;AACjC,aAAO,SAAS,UAAU,UAAU,OAAO;AAAA,IAC7C;AAAA,IACA,WACE,UACA,SAC4C;AAC5C,aAAO,SAAS,WAAW,UAAU,OAAO;AAAA,IAC9C;AAAA,IACA,OAAO,SAAqE;AAC1E,aAAO,SAAS,OAAO,OAAO;AAAA,IAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAWA,IACE,UACA,kBACA,cAC0C;AAC1C,aAAO,SAAS,IAAI,UAAU,kBAAkB,YAAY;AAAA,IAC9D;AAAA,IACA,YACE,KACA,OACkD;AAClD,aAAO,SAAS,YAAY,KAAK,KAAK;AAAA,IACxC;AAAA,EACF;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOE,YAAuC;AACrC,aAAO,SAAS,UAAU;AAAA,IAC5B;AAAA,EACF;AACF;AAcO,IAAM,WAAkC,iBAAiB,UAAU;","names":[]}

package/dist/chunk-HAF67F2H.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/db/policy.ts","../src/db/schema.ts","../src/db/extensions.ts","../src/db/columns.ts","../src/db/raw.ts","../src/db/embedding.ts","../src/db/typed-db.ts"],"sourcesContent":["/**\n * policy.ts — the RLS policy authoring DSL.\n *\n * `policy(name)` returns a fluent builder that mirrors the `ColumnBuilder`\n * style in columns.ts: each chainable method mutates the underlying\n * definition and returns the builder so calls compose. The terminal value is\n * a plain {@link PolicyDef} — the exact JSON shape the runtime's\n * `schema_extract.js` reads off the bundled module and the Go side parses into\n * `PolicyJSON` (CONTRACT-POLICY).\n *\n * @example\n * import { policy } from \"@palbase/backend\";\n *\n * policy(\"owner_select\")\n *   .for(\"select\")\n *   .to(\"authenticated\")\n *   .using(\"owner = (select auth.uid())\");\n */\n\n/** The SQL command a policy applies to. `\"all\"` covers SELECT/INSERT/UPDATE/DELETE. */\nexport type PolicyCommand = \"all\" | \"select\" | \"insert\" | \"update\" | \"delete\";\n\n/** Whether a policy is permissive (OR-combined, the default) or restrictive\n * (AND-combined). Mirrors Postgres `CREATE POLICY ... AS PERMISSIVE|RESTRICTIVE`. */\nexport type PolicyMode = \"permissive\" | \"restrictive\";\n\n/**\n * The compiled, serializable policy definition — the EXACT shape consumed by\n * `schema_extract.js` → Go `PolicyJSON` (CONTRACT-POLICY).\n *\n * - `roles`: the DB roles this policy applies to (`TO` clause). An empty array\n *   means the policy applies to PUBLIC (all roles) — the Postgres default.\n * - `using`: the `USING (...)` row-visibility expression, or `null` when none.\n * - `withCheck`: the `WITH CHECK (...)` write-validation expression, or `null`.\n * - `permissive`: `true` for `AS PERMISSIVE` (default), `false` for restrictive.\n */\nexport interface PolicyDef {\n  name: string;\n  command: PolicyCommand;\n  roles: string[];\n  using: string | null;\n  withCheck: string | null;\n  permissive: boolean;\n}\n\n/**\n * Fluent RLS policy builder.\n *\n * Defaults (documented, applied at construction):\n *  - `command`: `\"all\"` — applies to every SQL command unless `.for(...)` narrows it.\n *  - `roles`: `[\"authenticated\"]` — the common case is \"rule applies to signed-in\n *    users\". Call `.to(...)` to override; pass `.to()` with no roles (or never\n *    call it after a reset) to target PUBLIC.\n *  - `using` / `withCheck`: `null` — no row filter / write check until set.\n *  - `permissive`: `true` — `AS PERMISSIVE` (policies OR together).\n *\n * Each method mutates `_def` in place and returns `this`, so the chain is a\n * single builder instance (no per-call allocation, like a tagged-template\n * compile target). The terminal `PolicyDef` is read directly off `_def` by\n * `schema_extract.js`.\n */\nexport class PolicyBuilder {\n  readonly _def: PolicyDef;\n\n  constructor(name: string) {\n    this._def = {\n      name,\n      command: \"all\",\n      roles: [\"authenticated\"],\n      using: null,\n      withCheck: null,\n      permissive: true,\n    };\n  }\n\n  /** Restrict the policy to a single SQL command (default `\"all\"`). */\n  for(command: PolicyCommand): this {\n    this._def.command = command;\n    return this;\n  }\n\n  /**\n   * Set the DB roles the policy applies to (the `TO` clause), replacing any\n   * previously-set roles. Call with no arguments to target PUBLIC (all roles).\n   *\n   * @example\n   * policy(\"p\").to(\"authenticated\")\n   * policy(\"p\").to(\"authenticated\", \"service_role\")\n   * policy(\"p\").to() // PUBLIC\n   */\n  to(...roles: string[]): this {\n    this._def.roles = roles;\n    return this;\n  }\n\n  /** Set the `USING (...)` row-visibility expression (raw SQL). */\n  using(sqlExpr: string): this {\n    this._def.using = sqlExpr;\n    return this;\n  }\n\n  /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */\n  withCheck(sqlExpr: string): this {\n    this._def.withCheck = sqlExpr;\n    return this;\n  }\n\n  /** Set the policy mode: `\"permissive\"` (default, OR-combined) or\n   * `\"restrictive\"` (AND-combined). */\n  as(mode: PolicyMode): this {\n    this._def.permissive = mode === \"permissive\";\n    return this;\n  }\n}\n\n/**\n * Start authoring an RLS policy. Returns a {@link PolicyBuilder}; the resulting\n * `PolicyBuilder` is accepted directly in a table's `policies: [...]` array\n * (its `_def` is read at schema-extract time).\n *\n * @param name The policy name. Palbase reconciliation keys policies by\n *             `(table, name)`, so names must be unique per table.\n */\nexport function policy(name: string): PolicyBuilder {\n  return new PolicyBuilder(name);\n}\n","import type { ColumnBuilder } from \"./columns.js\";\nimport { PolicyBuilder } from \"./policy.js\";\nimport type { PolicyDef } from \"./policy.js\";\nimport type { PalbaseExtension } from \"./extensions.js\";\nimport type { RawConstraintDef } from \"./raw.js\";\nimport type { ChatModelRef, EmbeddingModelRef } from \"./embedding.js\";\n\n/**\n * A map of column builders keyed by column name — the value you write under\n * the `columns` key of `defineSchema({ tables: { <name>: { columns } } })`.\n *\n * The default `Record<string, ColumnBuilder>` keeps bare references compiling\n * without a type argument.\n */\nexport type ColumnMap = Record<string, ColumnBuilder>;\n\n/**\n * The author-facing value written under each table key:\n * `{ columns, rls?, policies? }`.\n *\n * - `columns`: the column map (required).\n * - `rls`: enable + FORCE row-level security on this table. **Defaults to\n *   `true`**, and is forced on when `policies` is non-empty. A table with RLS\n *   and no policies is deny-all, which is the starting state: nothing reads it\n *   until a policy says who may. Set `rls: false` only for a genuinely public\n *   table — it is an explicit opt-out that a reviewer can grep for, not\n *   something you get by forgetting.\n * - `policies`: the RLS policies for this table, authored with `policy(name)`.\n *   Each entry may be a {@link PolicyBuilder} (the normal `policy(...)` chain)\n *   or a raw {@link PolicyDef} object.\n *\n * The `C` type parameter preserves the precise per-column phantom types so the\n * typed `Database.tables.*` surface keeps inferring insert/row shapes.\n */\n/** Arama metriği — tek kelime; opclass ve operatör bundan türetilir, asla yüzeye çıkmaz (D-5/D-6). */\nexport type SearchMetric = \"cosine\" | \"euclidean\" | \"inner_product\";\n\n/** Bir vektör arama kolu. `model` varsa auto-embed: platform yazma+sorgu embedding'ini üstlenir (D-9). */\nexport interface VectorSearchDecl {\n  /** Hedef vector kolonu; tabloda TEK vector kolonu varsa atlanabilir (Go apply çözer, FR-010). */\n  column?: string;\n  /** Varsa auto-embed. Deskriptor düz veridir — şemayla serileşir (C-3). */\n  model?: EmbeddingModelRef;\n  /** model varsa ZORUNLU: embed kaynak kolonları = trigger'ın UPDATE OF listesi (C-2). */\n  from?: string[];\n  metric?: SearchMetric;\n  /** Kaynak metin değişince ara-dönem davranışı (yalnız auto-embed'de):\n   * \"null\" (vars.) — embedding anında NULL'lanır; satır yeni vektör yazılana\n   *   dek anlamsal aramada aday değildir. Bayat eşleşme asla servis edilmez.\n   * \"keep\" — eski vektör aramada kalır, platform yenisini yazınca sessizce\n   *   değişir. Görünürlük penceresi sıfır; bedeli saniyeler süren bayat\n   *   eşleşme riski (Confluence-tipi sync yükleri için). */\n  staleness?: \"null\" | \"keep\";\n}\n\n/** Tablonun arama beyanı — İKİ biçim (D-007, tek yüzey):\n *\n * YENİ (önerilen): `{ from, model, ... }` — `from` kolonları hem FTS'e hem\n * embed'e girer. Tabloda vector kolonu declare edilmişse SATIR-modu; yoksa\n * CHUNK-modu otomatiktir (D-010): vektörler türev `__palbase_chunks`\n * tablosunda yaşar, içerik otomatik bölünür. `text: false` FTS'i kapatır,\n * `text: [..]` FTS kolonlarını from'dan ayırır. `chunks` yalnız ince ayar.\n *\n * ESKİ: `text: string[]` + `vector: {...}` — aynen çalışır, wire çıktısı\n * bayt-aynı kalır (NFR-B1). İki biçim KARIŞTIRILAMAZ. */\nexport interface SearchDecl {\n  text?: string[] | boolean;\n  vector?: VectorSearchDecl | VectorSearchDecl[];\n  /** Yeni biçim: arama kaynağı kolonlar (FTS + embed). Varlığı yeni biçimi seçer. */\n  from?: string[];\n  /** Yeni biçim: auto-embed modeli (zorunlu — BYO için eski biçimi kullanın). */\n  model?: EmbeddingModelRef;\n  metric?: SearchMetric;\n  staleness?: \"null\" | \"keep\";\n  /** Chunk-modu ince ayarı (yalnız vector kolonsuz tabloda anlamlı). */\n  chunks?: { size?: number; overlap?: number };\n  /** Sorgu-yeniden-yazımı: tek yönlü eş anlamlı haritası (FR-026). */\n  synonyms?: Record<string, string[]>;\n  /** Geçerlilik kolonları türetilir; arama varsayılan yalnız günceli tarar (FR-029). */\n  validity?: boolean;\n}\n\n/** Hafıza beyanı (FR-032, D-019): kaynak tablonun yazımlarından platform\n * fact damıtır ve `into` tablosuna yazar. Hedef NORMAL declared tablodur —\n * kendi search/unique/validity beyanlarıyla. Okuma = Database.search(into).\n * subject default \"owner\": fact'in kime ait olduğu kolonu (iki tabloda da). */\nexport interface MemoryDecl {\n  from: string[];\n  into: string;\n  extract: ChatModelRef;\n  subject?: string;\n}\n\nexport interface TableInput<C extends ColumnMap = ColumnMap> {\n  columns: C;\n  rls?: boolean;\n  policies?: (PolicyBuilder | PolicyDef)[];\n  /** Composite/named primary key (ordered column names). Omit for single-column inline .primaryKey(). */\n  primaryKey?: string[];\n  /** Named multi-column UNIQUE constraints. */\n  unique?: { name: string; columns: string[] }[];\n  /** Named raw-SQL DDL objects (EXCLUDE, triggers, views) that the typed DSL cannot express. */\n  raw?: RawConstraintDef[];\n  /**\n   * Named first-class CHECK constraints. Diffed by NAME with a BODY compare:\n   * a changed `expr` (after pg normalization) recreates the constraint\n   * (DROP + ADD). `expr` is trusted SQL emitted verbatim (like policy USING),\n   * `name` is identifier-validated.\n   */\n  checks?: { name: string; expr: string }[];\n  /**\n   * Plain (non-unique) btree indexes over an ordered column list, emitted as\n   * standalone `CREATE INDEX [IF NOT EXISTS] name ON table (col1, col2)`\n   * statements (NOT a table clause — a separate migration statement category).\n   * Structural compare by NAME (no expression normalization). `name` and each\n   * column are identifier-validated by the Go differ.\n   *\n   * Scope: columns-only plain btree. Partial (`where`) and expression indexes\n   * are a deliberate follow-up — modelling them needs the same raw-SQL\n   * normalization round-trip CHECK uses (Task 10), so they are NOT in this\n   * type yet to avoid a half-working partial-index path.\n   */\n  indexes?: { name: string; columns: string[] }[];\n  /** Arama beyanı — bkz. SearchDecl. */\n  search?: SearchDecl;\n  /** Hafıza beyanı — bkz. MemoryDecl (FR-032). */\n  memory?: MemoryDecl;\n}\n\n/**\n * A table definition — the runtime value the Go runtime's `schema_extract.js`\n * reads. It keys tables by `tableDef.name`, reads `tableDef.columns` for the\n * column DDL, and `tableDef.rls` + `tableDef.policies` for RLS.\n *\n * `defineSchema` derives `name` from the object key, so authors never repeat\n * the table name. `rls`/`policies` are always present after normalization\n * (defaulted to `true`/`[]`).\n *\n * The `C` type parameter preserves the precise per-column phantom types so that\n * downstream mapped types (InsertShape, RowShape) can discriminate on them.\n */\nexport interface TableDef<C extends ColumnMap = ColumnMap> {\n  name: string;\n  columns: C;\n  rls: boolean;\n  policies: PolicyDef[];\n  primaryKey?: string[];\n  unique?: { name: string; columns: string[] }[];\n  /** Named raw-SQL DDL objects emitted verbatim on deploy. Tracked by name. */\n  raw?: RawConstraintDef[];\n  /** Named first-class CHECK constraints. Diffed by name + (normalized) body. */\n  checks?: { name: string; expr: string }[];\n  /** Plain btree indexes (columns-only), emitted as standalone CREATE INDEX. Diffed by name. */\n  indexes?: { name: string; columns: string[] }[];\n  /** Arama beyanı, doğrulanmış ve taşınmış hali. */\n  search?: SearchDecl;\n  /** Hafıza beyanı, doğrulanmış ve taşınmış hali (FR-032). */\n  memory?: MemoryDecl;\n}\n\n/**\n * A schema definition containing multiple tables, keyed by table name.\n *\n * The `T` type parameter preserves the exact `TableDef<...>` type for each\n * table so that `SchemaDef[\"tables\"][\"rooms\"]` resolves to the precise\n * `TableDef<{ id: ColumnBuilder<'uuid', false, true, never>; ... }>`.\n */\nexport interface SchemaDef<\n  T extends Record<string, TableDef> = Record<string, TableDef>,\n> {\n  tables: T;\n  /** Postgres extensions to install on deploy. Normalized to `[]` when absent. */\n  extensions: PalbaseExtension[];\n}\n\n/** The author-facing input to `defineSchema` — a `tables` map whose keys are\n * the table names and whose values are `{ columns, rls?, policies? }`, plus an\n * optional `extensions` allowlist. */\nexport interface SchemaInput<\n  T extends Record<string, TableInput> = Record<string, TableInput>,\n> {\n  tables: T;\n  /**\n   * Postgres extensions to enable for this project, e.g. `[\"vector\"]`.\n   * Config-as-code: installed by the deploy (CREATE EXTENSION … SCHEMA\n   * extensions) with the privileged deploy connection. The type is an\n   * allowlist union, so unsupported names fail typecheck.\n   */\n  extensions?: PalbaseExtension[];\n}\n\n/** Map the author's `{ tables: { <name>: { columns } } }` input to the\n * `{ tables: { <name>: TableDef<columns> } }` runtime/type shape, threading the\n * per-table column map `T[K][\"columns\"]` so column-level inference survives. */\ntype TablesFromInput<T extends Record<string, TableInput>> = {\n  [K in keyof T]: TableDef<T[K][\"columns\"]>;\n};\n\n/** Normalize a single `policies` entry into a plain `PolicyDef` (read off a\n * `PolicyBuilder._def`, or passed through when already a `PolicyDef`). */\nfunction toPolicyDef(p: PolicyBuilder | PolicyDef): PolicyDef {\n  return p instanceof PolicyBuilder ? p._def : p;\n}\n\n/**\n * Define a schema. The table NAME comes from the object key. Each table value\n * is `{ columns, rls?, policies? }`:\n *\n *   export default defineSchema({\n *     tables: {\n *       todos: {\n *         columns: {\n *           id:    uuid().primaryKey().defaultRandom(),\n *           owner: text().notNull(),\n *           title: text().notNull(),\n *         },\n *         rls: true,\n *         policies: [\n *           policy(\"owner_all\").for(\"all\").to(\"authenticated\")\n *             .using(\"owner = (select auth.uid())\")\n *             .withCheck(\"owner = (select auth.uid())\"),\n *         ],\n *       },\n *     },\n *   });\n *\n * The returned value is\n * `{ tables: { todos: { name, columns, rls, policies } } }` — the exact shape\n * the runtime schema extractor parses. Per-column phantom types are preserved\n * so `Database.tables.todos.insert({...})` stays typed.\n *\n * RLS normalization: `rls` defaults to **`true`**, `policies` to `[]`. A table\n * that declares neither is therefore deny-all — nothing reads it until a policy\n * says who may, which is the safe starting point rather than a bug. Declare\n * `rls: false` for a genuinely public table; that is an explicit, greppable\n * statement of intent instead of an omission. When `policies` is non-empty,\n * `rls` is forced on (ENABLE + FORCE) regardless of the declared flag — a table\n * with policies must have RLS enabled or the policies would be inert.\n */\nexport function defineSchema<T extends Record<string, TableInput>>(\n  input: SchemaInput<T>,\n): SchemaDef<TablesFromInput<T>> {\n  const tables = {} as TablesFromInput<T>;\n  for (const name of Object.keys(input.tables) as (keyof T)[]) {\n    const table = input.tables[name];\n    // `noUncheckedIndexedAccess` widens the index access to `… | undefined`,\n    // but `name` comes straight from `Object.keys(input.tables)`, so the entry\n    // always exists. Guard to narrow without a cast.\n    if (table === undefined) continue;\n    const policies = (table.policies ?? []).map(toPolicyDef);\n    // Fail closed. RLS is on unless the schema explicitly says `rls: false`, and\n    // policies force it on regardless — a policy on a table without RLS enabled\n    // is inert, so declaring both is a contradiction that resolves towards the\n    // safe reading.\n    //\n    // This defaulted to `false` until 2026-08-07, which meant a table nobody\n    // thought about had no row-level security while `typed-db.ts` documented the\n    // default `Database.*` path as RLS-enforced. Both cannot be true, and the\n    // live proof settled which one was not: user B read user A's row in full\n    // through the typed client, while the same request against a table declaring\n    // `rls: true` returned 0 of 165 rows\n    // (docs/superpowers/uat/2026-08-07-rls-fail-open-proof.md). With no policies\n    // this is deny-all, so an unconsidered table now returns nothing instead of\n    // returning everything to everyone.\n    const rls = policies.length > 0 || table.rls !== false;\n    const tableDef: TableDef<T[typeof name][\"columns\"]> = {\n      name: name as string,\n      columns: table.columns,\n      rls,\n      policies,\n    };\n    if (table.primaryKey !== undefined) tableDef.primaryKey = table.primaryKey;\n    if (table.unique !== undefined) tableDef.unique = table.unique;\n    if (table.raw !== undefined && table.raw.length > 0) tableDef.raw = table.raw.slice();\n    if (table.checks !== undefined && table.checks.length > 0) tableDef.checks = table.checks.slice();\n    if (table.indexes !== undefined && table.indexes.length > 0) tableDef.indexes = table.indexes.slice();\n    if (table.search !== undefined) {\n      const s = table.search;\n      // Erken, beyan-anı doğrulama (apply doğrulamasını İKAME ETMEZ — yazım\n      // hatası deploy'a gitmeden yazarın yüzüne söylenir).\n      if (s.from !== undefined) {\n        // YENİ biçim (D-007). Eski alanlarla karışım tek biçime zorlanır:\n        // iki yarım beyanın hangisinin kazandığını okuyucu bilemez.\n        if (s.vector !== undefined) {\n          throw new Error(\n            `table ${String(name)}: search beyanında tek biçim kullanın — 'from' (yeni) ile 'vector' (eski) birlikte olamaz`,\n          );\n        }\n        if (s.from.length === 0) {\n          throw new Error(`table ${String(name)}: search.from boş olamaz`);\n        }\n        if (s.model === undefined) {\n          throw new Error(\n            `table ${String(name)}: search.from model'siz anlamsız — auto-embed için model verin (BYO için eski 'vector' biçimini kullanın)`,\n          );\n        }\n        if (Array.isArray(s.text) && s.text.length === 0) {\n          throw new Error(`table ${String(name)}: search.text boş dizi olamaz — FTS istemiyorsan text: false yazın`);\n        }\n      } else {\n        // ESKİ biçim — davranış ve hata metinleri aynen (NFR-B1'in DX yarısı).\n        if (typeof s.text === \"boolean\") {\n          throw new Error(`table ${String(name)}: text:${String(s.text)} yalnız yeni biçimde ('from' ile) geçerli`);\n        }\n        if (s.text === undefined && s.vector === undefined) {\n          throw new Error(\n            `table ${String(name)}: search beyanı boş — en az bir kol (text ya da vector) verin, yoksa alanı hiç yazmayın`,\n          );\n        }\n        if (s.text !== undefined && s.text.length === 0) {\n          throw new Error(`table ${String(name)}: search.text boş olamaz — FTS kolu istemiyorsan alanı hiç yazma`);\n        }\n        const legs = s.vector === undefined ? [] : Array.isArray(s.vector) ? s.vector : [s.vector];\n        for (const leg of legs) {\n          if (leg.model !== undefined && (leg.from === undefined || leg.from.length === 0)) {\n            throw new Error(`table ${String(name)}: search.vector.model beyan edildi ama 'from' yok — embed kaynağı kolonlar zorunlu (C-2)`);\n          }\n          if (leg.model === undefined && leg.from !== undefined) {\n            throw new Error(`table ${String(name)}: search.vector.from model'siz anlamsız — auto-embed için model verin`);\n          }\n        }\n      }\n      tableDef.search = s;\n    }\n    if (table.memory !== undefined) {\n      if (table.memory.from.length === 0) {\n        throw new Error(`table ${String(name)}: memory.from boş olamaz`);\n      }\n      tableDef.memory = table.memory;\n    }\n    tables[name] = tableDef;\n  }\n  // memory beyanları TABLOLAR-ARASI doğrulanır (into/subject/fact) — tüm\n  // tablolar kurulduktan sonra: beyan sırasına bağımlılık olmasın (FR-032).\n  for (const [name, def] of Object.entries(tables)) {\n    const m = (def as TableDef).memory;\n    if (m === undefined) continue;\n    const target = Object.values(tables).find((t) => (t as TableDef).name === m.into) as TableDef | undefined;\n    if (target === undefined) {\n      throw new Error(`table ${name}: memory.into \"${m.into}\" şemada declared değil`);\n    }\n    const subject = m.subject ?? \"owner\";\n    if (!(subject in (def as TableDef).columns)) {\n      throw new Error(`table ${name}: memory.subject \"${subject}\" kolonu kaynak tabloda yok`);\n    }\n    if (!(subject in target.columns)) {\n      throw new Error(`table ${name}: memory.subject \"${subject}\" kolonu hedef \"${m.into}\" tablosunda yok`);\n    }\n    const factCol = target.columns[\"fact\"];\n    const factDef = factCol !== undefined && \"_def\" in (factCol as object)\n      ? (factCol as { _def: { type?: string } })._def\n      : (factCol as { type?: string } | undefined);\n    if (factDef === undefined || factDef.type !== \"text\") {\n      throw new Error(`table ${name}: memory.into \"${m.into}\" tablosunda \"fact\" (text) kolonu zorunlu`);\n    }\n    for (const c of m.from) {\n      if (!(c in (def as TableDef).columns)) {\n        throw new Error(`table ${name}: memory.from kolonu \"${c}\" kaynak tabloda yok`);\n      }\n    }\n  }\n  // Dedupe + normalize extensions (order-independent; deploy resolves deps).\n  const extensions = [...new Set(input.extensions ?? [])];\n  return { tables, extensions };\n}\n","/**\n * Postgres extensions a Palbase project can enable from its schema.\n *\n * Extensions are config-as-code: declare them in `defineSchema({ extensions })`\n * and the deploy installs them (CREATE EXTENSION … SCHEMA extensions) using the\n * deploy path's privileged connection. They are NOT toggled live from Studio —\n * CREATE EXTENSION requires a superuser role that only the deploy path holds.\n *\n * The list is an allowlist (a string-literal union) so editors autocomplete the\n * supported names and a typo fails typecheck. It is intentionally extensible:\n * add a name here (+ confirm the base image ships it) to support more.\n */\nexport const PALBASE_EXTENSIONS = [\n  // Search & text\n  \"vector\", // pgvector: AI embeddings + vector similarity search (semantic search / RAG).\n  // NB: the Postgres extension is named \"vector\", not \"pgvector\" — declare \"vector\".\n  \"pg_trgm\", // trigram fuzzy / typo-tolerant text search\n  \"unaccent\", // accent-insensitive text search\n  \"citext\", // case-insensitive text type\n  // Geospatial / location\n  \"cube\", // multi-dimensional cubes (dependency of earthdistance)\n  \"earthdistance\", // great-circle distance (needs cube)\n  // Data types & structures\n  \"hstore\", // key/value pairs in a single column\n  \"ltree\", // hierarchical tree-structured labels\n  // Indexing & constraints\n  \"btree_gist\", // GiST operator classes for scalar types — needed for EXCLUDE\n  // constraints that mix \"=\" with a range/&& overlap (e.g. no-double-booking).\n  // Scheduling\n  // Crypto / ids (also installed by default; listable for explicitness)\n  \"pgcrypto\", // cryptographic functions (hashing, encryption)\n  \"uuid-ossp\", // UUID generation functions\n] as const;\n\n/** A Postgres extension supported by Palbase (allowlist union). */\nexport type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];\n\n/**\n * Extensions that depend on another extension. The deploy installs\n * dependencies first; declaring `earthdistance` without `cube` still works\n * because the deploy resolves the order, but listing both is clearer.\n */\nexport const EXTENSION_DEPENDENCIES: Partial<Record<PalbaseExtension, PalbaseExtension[]>> = {\n  earthdistance: [\"cube\"],\n};\n\n/** Runtime guard: is `name` a supported Palbase extension? */\nexport function isPalbaseExtension(name: string): name is PalbaseExtension {\n  return (PALBASE_EXTENSIONS as readonly string[]).includes(name);\n}\n","/** On delete action for foreign key references. */\nexport type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';\n\n/**\n * The ON DELETE actions permitted on a foreign key to the built-in auth users\n * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached\n * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK\n * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the\n * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real\n * boundary, this narrows the type so the common mistake is caught at compile time.\n */\nexport type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;\n\n/** Column type identifiers. */\nexport type ColumnType =\n  | 'uuid'\n  | 'text'\n  | 'integer'\n  | 'bigint'\n  | 'numeric'\n  | 'boolean'\n  | 'timestamp'\n  | 'jsonb'\n  | 'enum'\n  | 'vector';\n\n/** Base column definition shared by all column types. */\nexport interface ColumnDef {\n  type: ColumnType;\n  nullable: boolean;\n  primaryKey: boolean;\n  defaultValue?: unknown;\n  defaultRandom?: boolean;\n  defaultNow?: boolean;\n  references?: { table: string; column: string };\n  /**\n   * The name this column used to have. A diff cannot tell a rename from a drop and\n   * an add — both leave one name gone and another present — so the intent has to be\n   * declared. Without it, renaming a column loses its data.\n   */\n  renamedFrom?: string;\n  onDeleteAction?: OnDeleteAction;\n  enumName?: string;\n  enumValues?: string[];\n  unique?: boolean;\n  /** vector(n): the declared dimension count — part of the TYPE (typmod), read\n   * by the wire serializer and the deploy's auto-index (FR-001). */\n  dimensions?: number;\n}\n\n/** FR-002: a vector column cannot carry keys/defaults/references — the modifier\n * is named in the error so the author fixes the right line. */\nfunction refuseOnVector(def: ColumnDef, modifier: string): void {\n  if (def.type === 'vector') {\n    throw new Error(`vector column: .${modifier}() is not supported (FR-002 — allowed: nullable()/notNull())`);\n  }\n}\n\n// Phantom brand symbols — never have runtime values; exist only to force\n// TypeScript's structural type system to distinguish ColumnBuilder instances\n// with different type-param combinations. Without these, TS sees all\n// ColumnBuilder<K,...> as structurally identical and the first branch of\n// ColValue matches everything.\ndeclare const __colKind: unique symbol;\ndeclare const __colNullable: unique symbol;\ndeclare const __colHasDefault: unique symbol;\ndeclare const __colEnumValues: unique symbol;\ndeclare const __colPayload: unique symbol;\n\n/**\n * Fluent column builder with phantom type params:\n *  K — ColumnType literal (e.g. \"text\", \"integer\")\n *  N — boolean: true when nullable() has been called last (false = NOT NULL)\n *  D — boolean: true when a default has been set\n *  E — enum value union (never for non-enum columns)\n *  P — jsonb payload shape (unknown unless jsonb<T>() supplied one)\n *\n * All five params have defaults so bare `ColumnBuilder` (no args) still\n * satisfies `Record<string, ColumnBuilder>` in schema.ts without modification.\n *\n * The five `declare readonly` brand fields carry the phantom types into the\n * structural shape so that conditional types like ColValue<C> can discriminate\n * on K without requiring runtime values on those fields.\n */\nexport class ColumnBuilder<\n  K extends ColumnType = ColumnType,\n  N extends boolean = boolean,\n  D extends boolean = boolean,\n  E = unknown,\n  P = unknown,\n> {\n  // These fields exist only in the type layer (declared, never initialised at\n  // runtime — TypeScript allows declared class members without an initializer\n  // in strict mode as long as they're never read at runtime).\n  declare readonly [__colKind]: K;\n  declare readonly [__colNullable]: N;\n  declare readonly [__colHasDefault]: D;\n  declare readonly [__colEnumValues]: E;\n  declare readonly [__colPayload]: P;\n\n  readonly _def: ColumnDef;\n\n  constructor(type: K, existingDef?: ColumnDef) {\n    this._def = existingDef ?? {\n      type,\n      nullable: false,\n      primaryKey: false,\n    };\n  }\n\n  /** Mark this column as the primary key. */\n  primaryKey(): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, 'primaryKey');\n    this._def.primaryKey = true;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Mark this column as NOT NULL (default). */\n  notNull(): ColumnBuilder<K, false, D, E, P> {\n    this._def.nullable = false;\n    return new ColumnBuilder<K, false, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Allow NULL values. */\n  nullable(): ColumnBuilder<K, true, D, E, P> {\n    this._def.nullable = true;\n    return new ColumnBuilder<K, true, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Set a default value. */\n  default(value: unknown): ColumnBuilder<K, N, true, E, P> {\n    refuseOnVector(this._def, 'default');\n    this._def.defaultValue = value;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /** UUID: generate a random default (gen_random_uuid()). */\n  defaultRandom(): ColumnBuilder<K, N, true, E, P> {\n    refuseOnVector(this._def, 'defaultRandom');\n    this._def.defaultRandom = true;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Timestamp: default to now(). */\n  defaultNow(): ColumnBuilder<K, N, true, E, P> {\n    refuseOnVector(this._def, 'defaultNow');\n    this._def.defaultNow = true;\n    return new ColumnBuilder<K, N, true, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Add a foreign key reference. */\n  /**\n   * Declares that this column used to be called `previous`.\n   *\n   * A schema diff sees one name gone and another present; it cannot know whether\n   * you renamed a column or dropped one and added another, and the two are very\n   * different — the second loses every value. Saying so here turns the plan into\n   * `ALTER TABLE … RENAME COLUMN` instead.\n   *\n   * Once the rename has been applied the annotation is inert (the old name is no\n   * longer there to rename), so it can be deleted at your leisure.\n   */\n  renamedFrom(previous: string): ColumnBuilder<K, N, D, E, P> {\n    this._def.renamedFrom = previous;\n    return this as unknown as ColumnBuilder<K, N, D, E, P>;\n  }\n\n  references(table: string, column: string): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, 'references');\n    this._def.references = { table, column };\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /**\n   * Add a real DB-level foreign key to the built-in auth users\n   * (`REFERENCES auth.users(id)`), so a column like `user_id` gets true\n   * database cascade/integrity instead of app-layer-only. Sugar for\n   * `.references(\"auth.users\", \"id\")`.\n   *\n   * `auth.users` lives in the SAME tenant database (palauth-owned), so this is\n   * a genuine cross-schema integrity constraint scoped to THIS tenant's users.\n   * The referenced `auth.users.id` is `text` (palauth ids are `usr_<uuid>`), so\n   * the referencing column must be `text()` too.\n   *\n   * ON DELETE is REQUIRED here and may only be `cascade` or `set null`: an\n   * account-erasure request must never be blocked by a lingering FK, so\n   * `restrict` / `no action` are not accepted (they don't type-check). Example:\n   * `text().notNull().referencesAuthUser(\"cascade\")`, or\n   * `text().nullable().referencesAuthUser(\"set null\")`. The server\n   * (validateAuthUserFK) enforces this — and the remaining rules the type can't\n   * express (referencing column is text, `set null` needs a nullable column) —\n   * as the real boundary; this signature is the compile-time DX mirror.\n   */\n  referencesAuthUser(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, \"referencesAuthUser\");\n    this._def.references = { table: 'auth.users', column: 'id' };\n    this._def.onDeleteAction = onDelete;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /**\n   * Add a real DB-level foreign key to the canonical, server-minted installation\n   * anchor (`REFERENCES auth.installations(id)`) — the app-scoped verified-device\n   * root (`ins_...`). Sugar for `.references(\"auth.installations\", \"id\")`.\n   *\n   * An installation is an APP INSTALL, not a user: this FK is NOT user ownership.\n   * A user-owned row STILL needs its own `.referencesAuthUser(...)` FK so account\n   * erasure removes it — an installation reference alone does not tie a row to a\n   * user's deletion. Use this only for install-scoped state (device prefs, push\n   * routing, …), alongside a separate auth-user FK where the row is user-owned.\n   *\n   * `auth.installations` lives in the SAME tenant DB (palauth-owned); its `id` is\n   * `text` (`ins_<uuid>`), so the referencing column must be `text()` too. ON\n   * DELETE is REQUIRED and may only be `cascade` or `set null` (same allowed set\n   * as an auth-user FK): an installation revoke / orphan cleanup must never be\n   * blocked by a lingering FK. The server (validateAuthAnchorFK) is the real\n   * boundary; this signature is the compile-time DX mirror.\n   */\n  referencesInstallation(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, \"referencesInstallation\");\n    this._def.references = { table: 'auth.installations', column: 'id' };\n    this._def.onDeleteAction = onDelete;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Set the ON DELETE action for a foreign key reference. */\n  onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P> {\n    this._def.onDeleteAction = action;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n\n  /** Add a single-column UNIQUE constraint. */\n  unique(): ColumnBuilder<K, N, D, E, P> {\n    refuseOnVector(this._def, 'unique');\n    this._def.unique = true;\n    return new ColumnBuilder<K, N, D, E, P>(this._def.type as K, this._def);\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Type extractors — imported by Task 2 to derive insert/row shapes.\n// ---------------------------------------------------------------------------\n\n/**\n * Extracts the TypeScript value type for a column, respecting nullability.\n * - \"uuid\" | \"text\" | \"timestamp\" | \"bigint\" | \"numeric\" → string (or string | null when N = true)\n *   Note: bigint/numeric surface as string — JS number loses precision past 2^53,\n *   and pgx/PostgREST serialize int8/numeric as strings. App code uses\n *   BigInt(row.amount) for bigint, or a decimal lib for numeric.\n * - \"integer\" → number\n * - \"boolean\" → boolean\n * - \"jsonb\" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)\n * - \"enum\" → E (the union of literal values)\n */\nexport type ColValue<C> =\n  C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P>\n    ? N extends true\n      ? string | null\n      : string\n    : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P>\n      ? N extends true\n        ? number | null\n        : number\n      : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P>\n        ? N extends true\n          ? boolean | null\n          : boolean\n        : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P>\n          ? N extends true\n            ? P | null\n            : P\n          : C extends ColumnBuilder<'vector', infer N, infer _D, infer _E, infer _P>\n            ? N extends true\n              ? number[] | null\n              : number[]\n            : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P>\n              ? N extends true\n                ? E | null\n                : E\n              : never;\n\n/**\n * True when a column is optional on INSERT:\n *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted\n *  - columns with a default (D = true) — the DB fills in the value when absent\n */\nexport type ColIsOptionalOnInsert<C> =\n  C extends ColumnBuilder<infer _K, true, infer _D, infer _E>\n    ? true\n    : C extends ColumnBuilder<infer _K, infer _N, true, infer _E>\n      ? true\n      : false;\n\n// ---------------------------------------------------------------------------\n// Factory functions\n// ---------------------------------------------------------------------------\n\n/** Create a UUID column. */\nexport function uuid(): ColumnBuilder<'uuid', false, false, never> {\n  return new ColumnBuilder('uuid');\n}\n\n/** Create a TEXT column. */\nexport function text(): ColumnBuilder<'text', false, false, never> {\n  return new ColumnBuilder('text');\n}\n\n/** Create an INTEGER column. Emits int4 (max ~2.1B). */\nexport function integer(): ColumnBuilder<'integer', false, false, never> {\n  return new ColumnBuilder('integer');\n}\n\n/**\n * Create a BIGINT column (Postgres int8, max ~9.2×10^18).\n * Surfaces as `string` in row/insert types — JS number loses precision past 2^53\n * and pgx/PostgREST serialize int8 as a JSON string. Use BigInt(row.column) in app code.\n */\nexport function bigint(): ColumnBuilder<'bigint', false, false, never> {\n  return new ColumnBuilder('bigint');\n}\n\n/**\n * Create a NUMERIC column (Postgres `numeric`/`decimal`, arbitrary precision).\n * For exact fractional values (money with cents as a decimal, rates, weights)\n * where int4/int8 don't fit. Surfaces as `string` in row/insert types — JS\n * number can't hold arbitrary-precision decimals without rounding, and\n * pgx/PostgREST serialize numeric as a JSON string. Parse with a decimal lib\n * (or BigInt for scaled integers) in app code.\n */\nexport function numeric(): ColumnBuilder<'numeric', false, false, never> {\n  return new ColumnBuilder('numeric');\n}\n\n/** Create a BOOLEAN column. */\nexport function boolean(): ColumnBuilder<'boolean', false, false, never> {\n  return new ColumnBuilder('boolean');\n}\n\n/** Create a TIMESTAMP column. */\nexport function timestamp(): ColumnBuilder<'timestamp', false, false, never> {\n  return new ColumnBuilder('timestamp');\n}\n\n/**\n * Create a JSONB column. Pass a payload type to make the generated row/insert\n * type concrete instead of `unknown`:\n *\n *   tags: jsonb<string[]>()           // row.tags: string[]\n *   meta: jsonb<{ tier: string }>()   // row.meta: { tier: string }\n *   raw:  jsonb()                      // row.raw: unknown (back-compat)\n *\n * The runtime accepts a plain JS object/array directly (no JSON.stringify); the\n * generic only refines the TYPE the env codegen emits.\n */\nexport function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, never, T> {\n  return new ColumnBuilder('jsonb');\n}\n\n/**\n * Create an ENUM column.\n * @param name   The PostgreSQL enum type name (used in DDL).\n * @param values A readonly tuple of valid string values — kept `const` so the\n *               union `V[number]` is as narrow as possible.\n */\nexport function enumType<const V extends readonly string[]>(\n  name: string,\n  values: V,\n): ColumnBuilder<'enum', false, false, V[number]> {\n  const builder = new ColumnBuilder<'enum', false, false, V[number]>('enum');\n  builder._def.enumName = name;\n  builder._def.enumValues = [...values];\n  return builder;\n}\n\n/** vector(n) — pgvector kolonu. n TİPİN parçasıdır (typmod) ve [1, 2000] —\n * 2000 = pgvector'ün HNSW-indekslenebilir tavanı; auto-index bu beyanla bağlı\n * (spec FR-001, D-3). */\nexport function vector(dimensions: number): ColumnBuilder<'vector', false, false, unknown, number[]> {\n  if (!Number.isInteger(dimensions) || dimensions < 1 || dimensions > 2000) {\n    throw new Error(`vector(): dimensions must be an integer in [1, 2000], got ${String(dimensions)}`);\n  }\n  const b = new ColumnBuilder('vector') as ColumnBuilder<'vector', false, false, unknown, number[]>;\n  (b._def as { dimensions?: number }).dimensions = dimensions;\n  return b;\n}\n","/**\n * A named raw-SQL DDL object declared in db/schema.ts for anything the typed DSL\n * cannot express (EXCLUDE, CHECK, partial/expression indexes, triggers, views).\n * The deploy emits `up` verbatim on the privileged DDL connection — same trust\n * posture as policy().using(). Tracked by NAME (not by diffing the body), so a\n * changed body needs a new name or an explicit drop+add.\n */\nexport interface RawConstraintDef {\n  name: string;\n  up: string;\n  down?: string;\n}\n\nexport function raw(name: string, up: string, opts?: { down?: string }): RawConstraintDef {\n  return { name, up, ...(opts?.down != null ? { down: opts.down } : {}) };\n}\n","/** Embedding sağlayıcı DESKRIPTORU — canlı istemci değil, düz veri: şemayla\n * birlikte serileşir, çağrıyı Go worker (yazma) ve engine (sorgu) yapar.\n * Adlandırma Vercel AI SDK'nın aynasıdır (openai.embedding(\"...\")) ama paket\n * bağımlılığı bilinçli olarak YOKTUR (spec C-3, UD-016). v1 sağlayıcı: openai (D-10). */\nexport interface EmbeddingModelRef {\n  provider: \"openai\";\n  model: string;\n  dimensions?: number;\n  apiKeyName?: string;\n  baseURL?: string;\n}\n/** Chat/damıtma modeli DESKRIPTORU (C-11, D-019) — memory beyanının extract'i.\n * Embedding gibi düz veridir; çağrıyı worker yapar, anahtar vault'taki\n * OPENAI_API_KEY'dir (D-017: aynı sağlayıcı, yeni dış sistem yok). */\nexport interface ChatModelRef {\n  provider: \"openai\";\n  model: string;\n}\nexport const openai = {\n  embedding(\n    model: string,\n    opts?: { dimensions?: number; apiKeyName?: string; baseURL?: string },\n  ): EmbeddingModelRef {\n    return { provider: \"openai\", model, apiKeyName: opts?.apiKeyName ?? \"OPENAI_API_KEY\",\n      ...(opts?.dimensions !== undefined ? { dimensions: opts.dimensions } : {}),\n      ...(opts?.baseURL !== undefined ? { baseURL: opts.baseURL } : {}) };\n  },\n  chat(model: string): ChatModelRef {\n    return { provider: \"openai\", model };\n  },\n};\n","/**\n * typed-db.ts — Task 2: TypedDB schema-derived insert/row shapes.\n *\n * Derives INSERT and full-row TypeScript types from a `defineSchema()` result\n * and wraps the untyped runtime `DBClient` with a typed facade.\n *\n * No value-any. No `as unknown as X`. The two narrow `as` casts in\n * `makeTypedTable` are safe because:\n *  - `data as Record<string, unknown>`: InsertShape<T> maps string keys to\n *    typed values; all value types are subsets of `unknown`, so the cast is\n *    structurally sound.\n *  - `result as RowShape<T>`: The runtime DBClient returns `Record<string,\n *    unknown>` which is the erased form of the typed row; we're narrowing back\n *    to the precise shape that the schema declared.\n * Both casts are narrowing only (not widening) and correctness is guaranteed\n * by the schema the caller provides.\n */\n\nimport type { ColValue, ColIsOptionalOnInsert, ColumnBuilder } from \"./columns.js\";\nimport type { TableDef, SchemaDef } from \"./schema.js\";\nimport type { Tables, TableTypes } from \"./env.js\";\nimport type { DBClient, DBOps } from \"../endpoint.js\";\nimport type { Materialized, TxPlanHandle, TxTable } from \"./tx-plan.js\";\nimport { TxPlanBuilder, runTxPlan } from \"./tx-plan.js\";\n\n// ---------------------------------------------------------------------------\n// Key discriminators — split a column map into required vs optional keys.\n// ---------------------------------------------------------------------------\n\n/** Keys of C whose columns are required on INSERT (not nullable, no default). */\ntype RequiredKeys<C> = {\n  [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? never : K;\n}[keyof C];\n\n/** Keys of C whose columns are optional on INSERT (nullable or has a default). */\ntype OptionalKeys<C> = {\n  [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? K : never;\n}[keyof C];\n\n// ---------------------------------------------------------------------------\n// Public shape types — exported so callers can reference them directly.\n// ---------------------------------------------------------------------------\n\n/**\n * The TypeScript type for an INSERT payload for table `T`.\n * - Required: columns that are NOT NULL and have no DB-level default.\n * - Optional: columns that are nullable or carry a default.\n *\n * When all columns are optional, `RequiredKeys<C>` resolves to `never` and\n * the first part becomes `{}`, which is a neutral element for `&`.\n */\nexport type InsertShape<T extends TableDef> = {\n  [K in RequiredKeys<T[\"columns\"]>]: ColValue<T[\"columns\"][K]>;\n} & {\n  [K in OptionalKeys<T[\"columns\"]>]?: ColValue<T[\"columns\"][K]>;\n};\n\n/**\n * The TypeScript type for a full row returned by the DB for table `T`.\n * Every column is present; nullable columns resolve to `T | null`.\n */\nexport type RowShape<T extends TableDef> = {\n  [K in keyof T[\"columns\"]]: ColValue<T[\"columns\"][K]>;\n};\n\n// ---------------------------------------------------------------------------\n// TypedTable + TypedDB interfaces.\n// ---------------------------------------------------------------------------\n\n/** A typed table accessor that mirrors the runtime DBClient surface. */\nexport interface TypedTable<T extends TableDef> {\n  insert(data: InsertShape<T>): Promise<RowShape<T>>;\n  /** Update the row by id; resolves to the updated row, or `null` if no row\n   * matched (absent or RLS-hidden) — an idempotent outcome, mirroring\n   * `findById`. The runtime returns a null row rather than throwing. */\n  update(id: string, data: Partial<InsertShape<T>>): Promise<RowShape<T> | null>;\n  delete(id: string): Promise<void>;\n  findById(id: string): Promise<RowShape<T> | null>;\n  findMany(query?: Partial<RowShape<T>>): Promise<RowShape<T>[]>;\n}\n\n/** A typed DB facade covering all tables declared in schema `S`. */\nexport interface TypedDB<S extends SchemaDef> {\n  tables: {\n    [K in keyof S[\"tables\"]]: TypedTable<S[\"tables\"][K]>;\n  };\n  /** Run a transaction plan. See {@link EnvTypedDatabase.transaction}. */\n  transaction<T>(\n    fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T,\n  ): Promise<Materialized<T>>;\n}\n\n/** The plan-building handle a `TypedDB<S>` transaction callback receives: the\n * schema's tables, expressed as plan operations rather than awaited calls. */\nexport type TypedTx<S extends SchemaDef> = TxPlanHandle<{\n  [K in keyof S[\"tables\"]]: TxTable<RowShape<S[\"tables\"][K]>, InsertShape<S[\"tables\"][K]>>;\n}>;\n\n// ---------------------------------------------------------------------------\n// Runtime factory.\n// ---------------------------------------------------------------------------\n\n/**\n * Builds a typed table accessor that delegates every call to `raw` using the\n * runtime table name string. Two narrow `as` casts bridge the mapped-type\n * shapes to/from `Record<string, unknown>` — see module-level doc comment.\n *\n * The `raw` param is typed `DBOps` (the six string-keyed ops) because this only\n * ever calls those — never `txPlan`, which builds its own operations rather than\n * delegating to these.\n */\nfunction makeTypedTable<T extends TableDef<Record<string, ColumnBuilder>>>(\n  name: string,\n  raw: DBOps,\n): TypedTable<T> {\n  return {\n    insert: (data: InsertShape<T>) =>\n      raw.insert(name, data as Record<string, unknown>) as Promise<RowShape<T>>,\n\n    update: (id: string, data: Partial<InsertShape<T>>) =>\n      raw.update(name, id, data as Record<string, unknown>) as Promise<RowShape<T> | null>,\n\n    delete: (id: string) => raw.delete(name, id),\n\n    findById: (id: string) =>\n      raw.findById(name, id) as Promise<RowShape<T> | null>,\n\n    findMany: (query?: Partial<RowShape<T>>) =>\n      raw.findMany(name, query as Record<string, unknown> | undefined) as Promise<RowShape<T>[]>,\n  };\n}\n\n/**\n * Wraps a raw `DBClient` with the type-safe `TypedDB<S>` facade derived from\n * the provided schema. No behavior change for the direct ops — all calls\n * delegate to `raw` with the table name as a plain string.\n *\n * `transaction` does NOT delegate to a per-op client: the callback describes a\n * plan against a fresh {@link TxPlanBuilder}, and the whole plan travels in one\n * `raw.txPlan` call. The schema is used only for its table NAMES; the values\n * are typed by `S` at compile time and are plain strings at run time.\n *\n * The `as` casts are single structural narrowings from a dynamically-built\n * object to the precise mapped type (TS cannot infer the mapped-type result\n * through `Object.keys` iteration) — see the module-level doc comment.\n */\nexport function makeTypedDB<S extends SchemaDef>(\n  schema: S,\n  raw: DBClient,\n): TypedDB<S> {\n  const tables = {} as Record<string, TypedTable<TableDef>>;\n  for (const key of Object.keys(schema.tables)) {\n    const tableDef = schema.tables[key];\n    if (tableDef !== undefined) {\n      tables[key] = makeTypedTable(tableDef.name, raw);\n    }\n  }\n\n  const result = {\n    tables,\n    transaction<T>(\n      fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T,\n    ): Promise<Materialized<T>> {\n      const builder = new TxPlanBuilder();\n      const planTables: Record<string, unknown> = {};\n      for (const key of Object.keys(schema.tables)) {\n        const tableDef = schema.tables[key];\n        if (tableDef !== undefined) planTables[key] = builder.table(tableDef.name);\n      }\n      // Two narrowings at the same seam: the plan tables are built by NAME, so\n      // TS cannot see the mapped type through the loop, and the driver erases\n      // the callback's return type (see runTxPlan's doc). Both are the erasure\n      // this facade exists to undo.\n      return runTxPlan(\n        raw,\n        planTables as TypedTx<S>[\"tables\"],\n        builder,\n        fn,\n      ) as Promise<Materialized<T>>;\n    },\n  };\n\n  // Narrow cast: `result.tables` is structurally identical to\n  // TypedDB<S>[\"tables\"] — each key maps to a TypedTable for the matching\n  // TableDef. TS cannot infer the mapped-type result through Object.keys\n  // iteration, so a single `as` bridges the gap.\n  return result as TypedDB<S>;\n}\n\n// ---------------------------------------------------------------------------\n// Env-augmentation-driven typed surface — the typed-by-default `Database`.\n//\n// These types read the globally-augmented `Tables` interface from\n// `@palbase/backend/env` (filled by the generated `palbase-env.d.ts`). They\n// back `Database.tables.<name>` so handler code is typed with no import and no\n// generic (C5). They DELIBERATELY do not reference `ColumnBuilder` — the env\n// `Tables` interface carries flat `row`/`insert` object types.\n// ---------------------------------------------------------------------------\n\n/** Bir where değeri: düz eşitlik YA DA operatör nesnesi (FR-016). */\nexport type WhereOp<V> = V | { gt?: V; gte?: V; lt?: V; lte?: V; neq?: V; in?: V[] };\n\n/** search() parametreleri, satır tipiyle koşullanmış (FR-013). `offset` BİLEREK yok (UD-013). */\nexport interface SearchParamsTyped<T extends TableTypes> {\n  /** Metin sorgusu: FTS kolunu besler; embed beyanlıysa sorgu vektörü de bundan üretilir. */\n  query?: string;\n  /** Hazır sorgu vektörü — verilirse embed çağrısı olmaz (FR-025). */\n  vector?: number[];\n  where?: { [K in keyof T[\"row\"]]?: WhereOp<T[\"row\"][K]> };\n  /** default 20, tavan 100 (engine uygular). */\n  limit?: number;\n  /** Birden çok vektör kolonunda hedef seçimi (model geçişi, FR-013/using). */\n  using?: string;\n  mode?: \"hybrid\" | \"text\" | \"vector\";\n  /** Nihai (RRF-sonrası) skor alt eşiği — süzme LIMIT'ten önce uygulanır (FR-001). */\n  minScore?: number;\n  /** Chunk-modunda satır başına en iyi blok sayısı (1..10, vars. 3; FR-015). */\n  blocksPerRow?: number;\n  /** Tazelik çürümesi: nihai skor RRF-sonrası exp(-ln(2)*yaş/halfLife) ile çarpılır;\n   * field bir timestamp kolonu, halfLife \"90s\" | \"15m\" | \"12h\" | \"30d\" biçiminde (FR-004). */\n  recency?: { field: Extract<keyof T[\"row\"], string>; halfLife: string };\n  /** Filtrelenmiş küme üzerinde kolon başına top-20 değer sayacı — dönüş\n   * dizisinin `_facets` özelliği (FR-027). */\n  facets?: Extract<keyof T[\"row\"], string>[];\n  /** Satır-modunda FTS eşleşme vurgusu: sonuç satırına `_highlight` ekler;\n   * chunk-modda no-op — bloklar zaten eşleşen kesittir (FR-025). */\n  highlight?: boolean;\n  /** Validity'li tabloda zaman penceresi: varsayılan yalnız güncel versiyon;\n   * \"all\" tüm versiyonlar; {asOf} o anda geçerli olan (FR-029). */\n  validity?: \"all\" | { asOf: string };\n  /** Alan-boost (FR-030): skor * (1 + w·x/(1+x)) — sayısal kolonla sınırlı\n   * çarpan, dış servissiz; bileşim RRF → boost → recency → minScore. */\n  boost?: { field: Extract<keyof T[\"row\"], string>; weight: number };\n}\n\n/** search() dönüş dizisinin sorgu-düzeyi ekleri (FR-027): `_facets` dizinin\n * ÖZELLİĞİDİR, satırlara kopyalanmaz (JSON'a satır başına şişme olmasın). */\nexport type SearchFacets = Record<string, { value: string | null; count: number }[]>;\n\n/** similar()/recommend() taşıyıcı opsiyonları (T018, FR-022): search'ün\n * paramlarından query/vector/mode düşer — hedef vektörü metodun kendisi\n * DB'den kurar; facets/highlight de düşer (T020) — engine bu ikisini\n * similar/recommend'e geçirmez, tip vaadi gerçekle aynı kalır. */\nexport type SimilarParamsTyped<T extends TableTypes> = Omit<\n  SearchParamsTyped<T>,\n  \"query\" | \"vector\" | \"mode\" | \"facets\" | \"highlight\"\n>;\n\n/** recommend() parametreleri (T018, FR-023). */\nexport type RecommendParamsTyped<T extends TableTypes> = SimilarParamsTyped<T> & {\n  /** Kaynak beğeniler — hedef vektör bunların DB-içi avg'ı; boş olamaz. */\n  positive: string[];\n  /** İtilen örnekler — hedef pos.v + (pos.v - neg.v) ile yönlenir. */\n  negative?: string[];\n};\n\n/** Temel tablo erişimcisi — search'süz beş op. */\nexport interface EnvTypedTableBase<T extends TableTypes> {\n  insert(data: T[\"insert\"]): Promise<T[\"row\"]>;\n  /** Update the row by id; resolves to the updated row, or `null` if no row\n   * matched (absent or RLS-hidden) — an idempotent outcome, mirroring\n   * `findById`. The runtime returns a null row rather than throwing. */\n  update(id: string, data: Partial<T[\"insert\"]>): Promise<T[\"row\"] | null>;\n  delete(id: string): Promise<void>;\n  findById(id: string): Promise<T[\"row\"] | null>;\n  findMany(query?: Partial<T[\"row\"]>): Promise<T[\"row\"][]>;\n  /** Validity'li tabloda satırın yeni versiyonu (FR-029, C-9): eski satır\n   * kapanır (valid_to/superseded_by), yenisi TEK savepoint'te eklenir; dönüş\n   * yeni satır. Validity beyanı olmayan tabloda adlandırılmış çalışma-zamanı\n   * hatası — tip düzeyinde ayrım env `Tables` bayrağı taşımadığından yapılamaz. */\n  supersede(id: string, row: T[\"insert\"]): Promise<T[\"row\"]>;\n}\n\n/** Tablo erişimcisi: env girdisi `searchable: true` taşıyorsa (vector kolonu ya da\n * search beyanı — env-gen üretir) `search()` üyesi VARDIR; yoksa üye hiç yoktur ve\n * çağrı derleme hatasıdır (FR-013). Yapısal koşul TableTypes'ı genişletmeden çalışır. */\nexport type EnvTypedTable<T extends TableTypes> = EnvTypedTableBase<T> &\n  (T extends { searchable: true }\n    ? {\n        search(\n          params: SearchParamsTyped<T>,\n        ): Promise<Array<T[\"row\"] & { _score: number }> & { _facets?: SearchFacets }>;\n        /** \"Bu satıra benzeyenler\" (FR-022): hedef vektör DB'den okunur,\n         * kaynak satır sonuçta yoktur; id yoksa adlandırılmış hata. */\n        similar(id: string, params?: SimilarParamsTyped<T>): Promise<Array<T[\"row\"] & { _score: number }>>;\n        /** positive/negative beğenilerden öneri (FR-023): hedef vektör DB-içi\n         * avg CTE'leriyle; kaynak id'ler sonuçta yoktur. */\n        recommend(params: RecommendParamsTyped<T>): Promise<Array<T[\"row\"] & { _score: number }>>;\n      }\n    : Record<never, never>);\n\n/** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`\n * interface. When no schema is declared `Tables` is empty, so `tables` is an\n * empty object — accessing `.tables.foo` is then a compile error (no member). */\nexport type EnvTables = {\n  [K in keyof Tables]: EnvTypedTable<Tables[K]>;\n};\n\n/** The project's tables as PLAN operations, keyed by the env `Tables`\n * interface. The transaction twin of {@link EnvTables}. */\nexport type TxTables = {\n  [K in keyof Tables]: TxTable<Tables[K][\"row\"], Tables[K][\"insert\"]>;\n};\n\n/**\n * The handle a `Database.transaction(…)` callback receives.\n *\n * Tables only — no `query`, no `findById`, no `asService`. A read whose value\n * the plan does not write belongs outside the transaction, where it costs one\n * round trip and is an ordinary value you can branch on.\n */\nexport type TxPlan = TxPlanHandle<TxTables>;\n\n/**\n * The RLS-bypass sibling returned by `Database.asService()`. Same typed surface\n * as {@link EnvTypedDatabase} — `tables`, the raw string ops, and a typed\n * `transaction` — but it does NOT re-expose `asService` (no double-bypass).\n * Every op it performs runs as the `service_role` (BYPASSRLS).\n */\nexport interface EnvServiceDatabase extends Omit<DBClient, \"txPlan\" | \"asService\"> {\n  tables: EnvTables;\n  transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;\n}\n\n/**\n * The typed-by-default Database surface: the raw string-keyed `DBClient` ops\n * PLUS a `tables` map typed against the project's generated `palbase-env.d.ts`,\n * a `transaction` that runs a whole plan in one request, and `asService()` for\n * the explicit RLS-bypass sibling.\n *\n * The low-level `txPlan` op is deliberately NOT re-exposed here: `transaction`\n * is the surface, and a hand-built plan would bypass the ref/guard machinery\n * that makes one safe to write.\n */\nexport interface EnvTypedDatabase extends Omit<DBClient, \"txPlan\" | \"asService\"> {\n  tables: EnvTables;\n  /**\n   * Run a transaction. The callback DESCRIBES the operations; the whole\n   * description travels in one request and the broker runs it inside a single\n   * transaction — committing when it finishes, rolling back on any failure.\n   *\n   * The callback is SYNCHRONOUS: nothing has run when it returns, so there is\n   * nothing to await. `async` on it and `await` inside it are compile errors.\n   * Values a later operation needs are {@link Ref}s, written straight into the\n   * next operation; values the CALLER needs are returned and substituted before\n   * this promise resolves.\n   *\n   * @example\n   * const { statementId } = await Database.transaction((tx) => {\n   *   const st = tx.tables.statements\n   *     .insert({ household_id: hid, file_sha256: sha, status: \"reviewing\" })\n   *     .expectOne(new Internal(\"statement insert failed\"));\n   *\n   *   tx.tables.statement_lines.insertMany(\n   *     lines.map((l) => ({ statement_id: st.id, category: resolveCategory(l) })),\n   *   );\n   *\n   *   return { statementId: st.id };\n   * });\n   */\n  transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;\n  /**\n   * Return a sibling that bypasses RLS by running as the `service_role`. Use\n   * sparingly and explicitly — the default `Database.*` path is RLS-enforced.\n   *\n   * @example\n   * const all = await Database.asService().tables.todos.findMany({});\n   * const rows = await Database.asService().query(\"SELECT * FROM todos\");\n   */\n  asService(): EnvServiceDatabase;\n}\n"],"mappings":";;;;;;AA6DO,IAAM,gBAAN,MAAoB;AAAA,EAChB;AAAA,EAET,YAAY,MAAc;AACxB,SAAK,OAAO;AAAA,MACV;AAAA,MACA,SAAS;AAAA,MACT,OAAO,CAAC,eAAe;AAAA,MACvB,OAAO;AAAA,MACP,WAAW;AAAA,MACX,YAAY;AAAA,IACd;AAAA,EACF;AAAA;AAAA,EAGA,IAAI,SAA8B;AAChC,SAAK,KAAK,UAAU;AACpB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,OAAuB;AAC3B,SAAK,KAAK,QAAQ;AAClB,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,SAAuB;AAC3B,SAAK,KAAK,QAAQ;AAClB,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,UAAU,SAAuB;AAC/B,SAAK,KAAK,YAAY;AACtB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA,EAIA,GAAG,MAAwB;AACzB,SAAK,KAAK,aAAa,SAAS;AAChC,WAAO;AAAA,EACT;AACF;AAUO,SAAS,OAAO,MAA6B;AAClD,SAAO,IAAI,cAAc,IAAI;AAC/B;;;AC2EA,SAAS,YAAY,GAAyC;AAC5D,SAAO,aAAa,gBAAgB,EAAE,OAAO;AAC/C;AAqCO,SAAS,aACd,OAC+B;AAC/B,QAAM,SAAS,CAAC;AAChB,aAAW,QAAQ,OAAO,KAAK,MAAM,MAAM,GAAkB;AAC3D,UAAM,QAAQ,MAAM,OAAO,IAAI;AAI/B,QAAI,UAAU,OAAW;AACzB,UAAM,YAAY,MAAM,YAAY,CAAC,GAAG,IAAI,WAAW;AAevD,UAAM,MAAM,SAAS,SAAS,KAAK,MAAM,QAAQ;AACjD,UAAM,WAAgD;AAAA,MACpD;AAAA,MACA,SAAS,MAAM;AAAA,MACf;AAAA,MACA;AAAA,IACF;AACA,QAAI,MAAM,eAAe,OAAW,UAAS,aAAa,MAAM;AAChE,QAAI,MAAM,WAAW,OAAW,UAAS,SAAS,MAAM;AACxD,QAAI,MAAM,QAAQ,UAAa,MAAM,IAAI,SAAS,EAAG,UAAS,MAAM,MAAM,IAAI,MAAM;AACpF,QAAI,MAAM,WAAW,UAAa,MAAM,OAAO,SAAS,EAAG,UAAS,SAAS,MAAM,OAAO,MAAM;AAChG,QAAI,MAAM,YAAY,UAAa,MAAM,QAAQ,SAAS,EAAG,UAAS,UAAU,MAAM,QAAQ,MAAM;AACpG,QAAI,MAAM,WAAW,QAAW;AAC9B,YAAM,IAAI,MAAM;AAGhB,UAAI,EAAE,SAAS,QAAW;AAGxB,YAAI,EAAE,WAAW,QAAW;AAC1B,gBAAM,IAAI;AAAA,YACR,SAAS,OAAO,IAAI,CAAC;AAAA,UACvB;AAAA,QACF;AACA,YAAI,EAAE,KAAK,WAAW,GAAG;AACvB,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,+BAA0B;AAAA,QACjE;AACA,YAAI,EAAE,UAAU,QAAW;AACzB,gBAAM,IAAI;AAAA,YACR,SAAS,OAAO,IAAI,CAAC;AAAA,UACvB;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,KAAK,WAAW,GAAG;AAChD,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,mFAAoE;AAAA,QAC3G;AAAA,MACF,OAAO;AAEL,YAAI,OAAO,EAAE,SAAS,WAAW;AAC/B,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,UAAU,OAAO,EAAE,IAAI,CAAC,sDAA2C;AAAA,QAC1G;AACA,YAAI,EAAE,SAAS,UAAa,EAAE,WAAW,QAAW;AAClD,gBAAM,IAAI;AAAA,YACR,SAAS,OAAO,IAAI,CAAC;AAAA,UACvB;AAAA,QACF;AACA,YAAI,EAAE,SAAS,UAAa,EAAE,KAAK,WAAW,GAAG;AAC/C,gBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,oFAAkE;AAAA,QACzG;AACA,cAAM,OAAO,EAAE,WAAW,SAAY,CAAC,IAAI,MAAM,QAAQ,EAAE,MAAM,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM;AACzF,mBAAW,OAAO,MAAM;AACtB,cAAI,IAAI,UAAU,WAAc,IAAI,SAAS,UAAa,IAAI,KAAK,WAAW,IAAI;AAChF,kBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,yGAA0F;AAAA,UACjI;AACA,cAAI,IAAI,UAAU,UAAa,IAAI,SAAS,QAAW;AACrD,kBAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,oFAAuE;AAAA,UAC9G;AAAA,QACF;AAAA,MACF;AACA,eAAS,SAAS;AAAA,IACpB;AACA,QAAI,MAAM,WAAW,QAAW;AAC9B,UAAI,MAAM,OAAO,KAAK,WAAW,GAAG;AAClC,cAAM,IAAI,MAAM,SAAS,OAAO,IAAI,CAAC,+BAA0B;AAAA,MACjE;AACA,eAAS,SAAS,MAAM;AAAA,IAC1B;AACA,WAAO,IAAI,IAAI;AAAA,EACjB;AAGA,aAAW,CAAC,MAAM,GAAG,KAAK,OAAO,QAAQ,MAAM,GAAG;AAChD,UAAM,IAAK,IAAiB;AAC5B,QAAI,MAAM,OAAW;AACrB,UAAM,SAAS,OAAO,OAAO,MAAM,EAAE,KAAK,CAAC,MAAO,EAAe,SAAS,EAAE,IAAI;AAChF,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI,MAAM,SAAS,IAAI,kBAAkB,EAAE,IAAI,mCAAyB;AAAA,IAChF;AACA,UAAM,UAAU,EAAE,WAAW;AAC7B,QAAI,EAAE,WAAY,IAAiB,UAAU;AAC3C,YAAM,IAAI,MAAM,SAAS,IAAI,qBAAqB,OAAO,6BAA6B;AAAA,IACxF;AACA,QAAI,EAAE,WAAW,OAAO,UAAU;AAChC,YAAM,IAAI,MAAM,SAAS,IAAI,qBAAqB,OAAO,mBAAmB,EAAE,IAAI,kBAAkB;AAAA,IACtG;AACA,UAAM,UAAU,OAAO,QAAQ,MAAM;AACrC,UAAM,UAAU,YAAY,UAAa,UAAW,UAC/C,QAAwC,OACxC;AACL,QAAI,YAAY,UAAa,QAAQ,SAAS,QAAQ;AACpD,YAAM,IAAI,MAAM,SAAS,IAAI,kBAAkB,EAAE,IAAI,2CAA2C;AAAA,IAClG;AACA,eAAW,KAAK,EAAE,MAAM;AACtB,UAAI,EAAE,KAAM,IAAiB,UAAU;AACrC,cAAM,IAAI,MAAM,SAAS,IAAI,yBAAyB,CAAC,sBAAsB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AAEA,QAAM,aAAa,CAAC,GAAG,IAAI,IAAI,MAAM,cAAc,CAAC,CAAC,CAAC;AACtD,SAAO,EAAE,QAAQ,WAAW;AAC9B;;;AChWO,IAAM,qBAAqB;AAAA;AAAA,EAEhC;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA,EACA;AAAA;AAAA;AAAA,EAEA;AAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA;AAAA,EACA;AAAA;AACF;AAUO,IAAM,yBAAgF;AAAA,EAC3F,eAAe,CAAC,MAAM;AACxB;AAGO,SAAS,mBAAmB,MAAwC;AACzE,SAAQ,mBAAyC,SAAS,IAAI;AAChE;;;ACGA,SAAS,eAAe,KAAgB,UAAwB;AAC9D,MAAI,IAAI,SAAS,UAAU;AACzB,UAAM,IAAI,MAAM,mBAAmB,QAAQ,mEAA8D;AAAA,EAC3G;AACF;AA4BO,IAAM,gBAAN,MAAM,eAMX;AAAA,EAUS;AAAA,EAET,YAAY,MAAS,aAAyB;AAC5C,SAAK,OAAO,eAAe;AAAA,MACzB;AAAA,MACA,UAAU;AAAA,MACV,YAAY;AAAA,IACd;AAAA,EACF;AAAA;AAAA,EAGA,aAA2C;AACzC,mBAAe,KAAK,MAAM,YAAY;AACtC,SAAK,KAAK,aAAa;AACvB,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA,EAGA,UAA4C;AAC1C,SAAK,KAAK,WAAW;AACrB,WAAO,IAAI,eAAiC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC5E;AAAA;AAAA,EAGA,WAA4C;AAC1C,SAAK,KAAK,WAAW;AACrB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA,EAGA,QAAQ,OAAiD;AACvD,mBAAe,KAAK,MAAM,SAAS;AACnC,SAAK,KAAK,eAAe;AACzB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA,EAGA,gBAAiD;AAC/C,mBAAe,KAAK,MAAM,eAAe;AACzC,SAAK,KAAK,gBAAgB;AAC1B,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA,EAGA,aAA8C;AAC5C,mBAAe,KAAK,MAAM,YAAY;AACtC,SAAK,KAAK,aAAa;AACvB,WAAO,IAAI,eAAgC,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EAC3E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,YAAY,UAAgD;AAC1D,SAAK,KAAK,cAAc;AACxB,WAAO;AAAA,EACT;AAAA,EAEA,WAAW,OAAe,QAA8C;AACtE,mBAAe,KAAK,MAAM,YAAY;AACtC,SAAK,KAAK,aAAa,EAAE,OAAO,OAAO;AACvC,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAsBA,mBAAmB,UAA0D;AAC3E,mBAAe,KAAK,MAAM,oBAAoB;AAC9C,SAAK,KAAK,aAAa,EAAE,OAAO,cAAc,QAAQ,KAAK;AAC3D,SAAK,KAAK,iBAAiB;AAC3B,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBA,uBAAuB,UAA0D;AAC/E,mBAAe,KAAK,MAAM,wBAAwB;AAClD,SAAK,KAAK,aAAa,EAAE,OAAO,sBAAsB,QAAQ,KAAK;AACnE,SAAK,KAAK,iBAAiB;AAC3B,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA,EAGA,SAAS,QAAsD;AAC7D,SAAK,KAAK,iBAAiB;AAC3B,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AAAA;AAAA,EAGA,SAAuC;AACrC,mBAAe,KAAK,MAAM,QAAQ;AAClC,SAAK,KAAK,SAAS;AACnB,WAAO,IAAI,eAA6B,KAAK,KAAK,MAAW,KAAK,IAAI;AAAA,EACxE;AACF;AA6DO,SAAS,OAAmD;AACjE,SAAO,IAAI,cAAc,MAAM;AACjC;AAGO,SAAS,OAAmD;AACjE,SAAO,IAAI,cAAc,MAAM;AACjC;AAGO,SAAS,UAAyD;AACvE,SAAO,IAAI,cAAc,SAAS;AACpC;AAOO,SAAS,SAAuD;AACrE,SAAO,IAAI,cAAc,QAAQ;AACnC;AAUO,SAAS,UAAyD;AACvE,SAAO,IAAI,cAAc,SAAS;AACpC;AAGO,SAAS,UAAyD;AACvE,SAAO,IAAI,cAAc,SAAS;AACpC;AAGO,SAAS,YAA6D;AAC3E,SAAO,IAAI,cAAc,WAAW;AACtC;AAaO,SAAS,QAAqE;AACnF,SAAO,IAAI,cAAc,OAAO;AAClC;AAQO,SAAS,SACd,MACA,QACgD;AAChD,QAAM,UAAU,IAAI,cAA+C,MAAM;AACzE,UAAQ,KAAK,WAAW;AACxB,UAAQ,KAAK,aAAa,CAAC,GAAG,MAAM;AACpC,SAAO;AACT;AAKO,SAAS,OAAO,YAA8E;AACnG,MAAI,CAAC,OAAO,UAAU,UAAU,KAAK,aAAa,KAAK,aAAa,KAAM;AACxE,UAAM,IAAI,MAAM,6DAA6D,OAAO,UAAU,CAAC,EAAE;AAAA,EACnG;AACA,QAAM,IAAI,IAAI,cAAc,QAAQ;AACpC,EAAC,EAAE,KAAiC,aAAa;AACjD,SAAO;AACT;;;ACnXO,SAAS,IAAI,MAAc,IAAY,MAA4C;AACxF,SAAO,EAAE,MAAM,IAAI,GAAI,MAAM,QAAQ,OAAO,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC,EAAG;AACxE;;;ACGO,IAAM,SAAS;AAAA,EACpB,UACE,OACA,MACmB;AACnB,WAAO;AAAA,MAAE,UAAU;AAAA,MAAU;AAAA,MAAO,YAAY,MAAM,cAAc;AAAA,MAClE,GAAI,MAAM,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,MACxE,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,IAAG;AAAA,EACtE;AAAA,EACA,KAAK,OAA6B;AAChC,WAAO,EAAE,UAAU,UAAU,MAAM;AAAA,EACrC;AACF;;;ACiFA,SAAS,eACP,MACAA,MACe;AACf,SAAO;AAAA,IACL,QAAQ,CAAC,SACPA,KAAI,OAAO,MAAM,IAA+B;AAAA,IAElD,QAAQ,CAAC,IAAY,SACnBA,KAAI,OAAO,MAAM,IAAI,IAA+B;AAAA,IAEtD,QAAQ,CAAC,OAAeA,KAAI,OAAO,MAAM,EAAE;AAAA,IAE3C,UAAU,CAAC,OACTA,KAAI,SAAS,MAAM,EAAE;AAAA,IAEvB,UAAU,CAAC,UACTA,KAAI,SAAS,MAAM,KAA4C;AAAA,EACnE;AACF;AAgBO,SAAS,YACd,QACAA,MACY;AACZ,QAAM,SAAS,CAAC;AAChB,aAAW,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG;AAC5C,UAAM,WAAW,OAAO,OAAO,GAAG;AAClC,QAAI,aAAa,QAAW;AAC1B,aAAO,GAAG,IAAI,eAAe,SAAS,MAAMA,IAAG;AAAA,IACjD;AAAA,EACF;AAEA,QAAM,SAAS;AAAA,IACb;AAAA,IACA,YACE,IAC0B;AAC1B,YAAM,UAAU,IAAI,cAAc;AAClC,YAAM,aAAsC,CAAC;AAC7C,iBAAW,OAAO,OAAO,KAAK,OAAO,MAAM,GAAG;AAC5C,cAAM,WAAW,OAAO,OAAO,GAAG;AAClC,YAAI,aAAa,OAAW,YAAW,GAAG,IAAI,QAAQ,MAAM,SAAS,IAAI;AAAA,MAC3E;AAKA,aAAO;AAAA,QACLA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAMA,SAAO;AACT;","names":["raw"]}