@palbase/backend 24.2.0 → 25.0.0

package/dist/chunk-OEQBHE2Z.js

@@ -0,0 +1,825 @@
+import {
+  TxPlanBuilder,
+  runTxPlan
+} from "./chunk-P2Q27SGP.js";
+
+// src/db/schema-json.ts
+function defOf(column) {
+  return "_def" in column ? column._def : column;
+}
+function columnToJSON(column) {
+  const def = defOf(column);
+  const out = {
+    type: def.type,
+    nullable: def.nullable,
+    primaryKey: def.primaryKey
+  };
+  if (def.defaultValue !== void 0) out.defaultValue = def.defaultValue;
+  if (def.defaultRandom === true) out.defaultRandom = true;
+  if (def.defaultNow === true) out.defaultNow = true;
+  if (def.renamedFrom !== void 0) out.renamedFrom = def.renamedFrom;
+  if (def.ignored === true) out.ignored = true;
+  if (def.references !== void 0) {
+    out.references = { table: def.references.table, column: def.references.column };
+  }
+  if (def.onDeleteAction !== void 0) out.onDeleteAction = def.onDeleteAction;
+  if (def.enumName !== void 0) out.enumName = def.enumName;
+  if (def.enumValues !== void 0) out.enumValues = [...def.enumValues];
+  if (def.unique === true) out.unique = true;
+  if (def.dimensions !== void 0) out.dimensions = def.dimensions;
+  return out;
+}
+function policyToJSON(policy2) {
+  return {
+    name: policy2.name,
+    command: policy2.command ?? "all",
+    roles: policy2.roles ? [...policy2.roles] : [],
+    // null rather than omitted: a policy with no USING clause is a different
+    // thing from one whose clause the emitter forgot, and Go reads the
+    // difference.
+    using: policy2.using ?? null,
+    withCheck: policy2.withCheck ?? null,
+    permissive: policy2.permissive !== false
+  };
+}
+function commonSearchFields(search, out) {
+  if (search.synonyms !== void 0 && Object.keys(search.synonyms).length > 0) {
+    out.synonyms = Object.fromEntries(
+      Object.entries(search.synonyms).map(([word, alts]) => [word, [...alts]])
+    );
+  }
+  if (search.validity === true) out.validity = true;
+}
+function searchToJSON(search, vectorColumn) {
+  if (search.from !== void 0 && search.model !== void 0) {
+    const out2 = {};
+    const textCols = search.text === false ? void 0 : Array.isArray(search.text) && search.text.length > 0 ? search.text : search.from;
+    if (textCols !== void 0) out2.text = { columns: [...textCols] };
+    const v = { metric: search.metric ?? "cosine" };
+    if (vectorColumn !== void 0) v.column = vectorColumn;
+    v.embed = {
+      provider: search.model.provider,
+      model: search.model.model,
+      from: [...search.from],
+      ...search.model.apiKeyName !== void 0 ? { apiKeyName: search.model.apiKeyName } : {},
+      ...search.model.dimensions !== void 0 ? { dimensions: search.model.dimensions } : {},
+      ...search.model.baseURL !== void 0 ? { baseURL: search.model.baseURL } : {}
+    };
+    if (search.staleness !== void 0) v.staleness = search.staleness;
+    if (vectorColumn === void 0) {
+      v.mode = "chunks";
+      if (search.chunks !== void 0) {
+        const c = {};
+        if (search.chunks.size !== void 0 && search.chunks.size > 0) c.sizeChars = search.chunks.size;
+        if (search.chunks.overlap !== void 0 && search.chunks.overlap > 0) c.overlapChars = search.chunks.overlap;
+        if (Object.keys(c).length > 0) v.chunks = c;
+      }
+    }
+    out2.vector = [v];
+    commonSearchFields(search, out2);
+    return out2;
+  }
+  const out = {};
+  if (Array.isArray(search.text) && search.text.length > 0) out.text = { columns: [...search.text] };
+  const legs = search.vector === void 0 ? [] : Array.isArray(search.vector) ? search.vector : [search.vector];
+  if (legs.length > 0) {
+    out.vector = legs.map((leg) => {
+      const v = { metric: leg.metric ?? "cosine" };
+      if (leg.column !== void 0) v.column = leg.column;
+      if (leg.staleness !== void 0) v.staleness = leg.staleness;
+      if (leg.model !== void 0) {
+        v.embed = {
+          provider: leg.model.provider,
+          model: leg.model.model,
+          from: [...leg.from ?? []],
+          ...leg.model.apiKeyName !== void 0 ? { apiKeyName: leg.model.apiKeyName } : {},
+          ...leg.model.dimensions !== void 0 ? { dimensions: leg.model.dimensions } : {},
+          ...leg.model.baseURL !== void 0 ? { baseURL: leg.model.baseURL } : {}
+        };
+      }
+      return v;
+    });
+  }
+  commonSearchFields(search, out);
+  return out;
+}
+function memoryToJSON(m) {
+  return {
+    from: [...m.from],
+    into: m.into,
+    ...m.subject !== void 0 ? { subject: m.subject } : {},
+    extract: { provider: m.extract.provider, model: m.extract.model }
+  };
+}
+function tableToJSON(table, schemaName) {
+  const columns = {};
+  for (const [name, column] of Object.entries(table.columns)) {
+    columns[name] = columnToJSON(column);
+  }
+  const out = {
+    name: table.name,
+    schema: schemaName,
+    columns,
+    // Read, not re-derived. `defineSchema` already resolves the fail-closed
+    // default (RLS on unless the author wrote `rls: false`, and forced on by any
+    // policy), and a second copy of a SECURITY default is exactly the thing that
+    // drifts — the direction it drifted last time was "expose everything", and
+    // the live proof was one user reading another's rows.
+    rls: table.rls,
+    policies: (table.policies ?? []).map(policyToJSON)
+  };
+  if (table.primaryKey !== void 0 && table.primaryKey.length > 0) {
+    out.primaryKey = [...table.primaryKey];
+  }
+  if (table.unique !== void 0 && table.unique.length > 0) {
+    out.uniqueConstraints = table.unique.map((u) => ({ name: u.name, columns: [...u.columns] }));
+  }
+  if (table.raw !== void 0 && table.raw.length > 0) {
+    out.rawConstraints = table.raw.map((r) => ({
+      name: r.name,
+      up: r.up,
+      down: r.down ?? null
+    }));
+  }
+  if (table.checks !== void 0 && table.checks.length > 0) {
+    out.checks = table.checks.map((c) => ({ name: c.name, expr: c.expr }));
+  }
+  if (table.indexes !== void 0 && table.indexes.length > 0) {
+    out.indexes = table.indexes.map((i) => ({ name: i.name, columns: [...i.columns] }));
+  }
+  if (table.search !== void 0) {
+    const vectorColumn = Object.entries(columns).find(([, c]) => c.dimensions !== void 0)?.[0];
+    const sj = searchToJSON(table.search, vectorColumn);
+    if (sj.text !== void 0 || sj.vector !== void 0) out.search = sj;
+  }
+  if (table.memory !== void 0) {
+    out.memory = memoryToJSON(table.memory);
+  }
+  return out;
+}
+function qualifiedTableKey(schemaName, tableName) {
+  return schemaName === "public" ? tableName : `${schemaName}.${tableName}`;
+}
+function toSchemaJSON(schemas) {
+  const tables = {};
+  const extensions = [];
+  const meta = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const schema of schemas) {
+    if (seen.has(schema.name)) {
+      throw new Error(`two schemas declare the name "${schema.name}" \u2014 schema names must be unique`);
+    }
+    seen.add(schema.name);
+    for (const table of Object.values(schema.tables)) {
+      const json = tableToJSON(table, schema.name);
+      tables[qualifiedTableKey(schema.name, json.name)] = json;
+    }
+    extensions.push(...schema.extensions ?? []);
+    meta.push({ name: schema.name, exposed: schema.exposed });
+  }
+  return { tables, extensions: [...new Set(extensions)], schemas: meta };
+}
+
+// src/db/policy.ts
+function quote(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+var PolicyBuilder = class {
+  _def;
+  constructor(name) {
+    this._def = {
+      name,
+      command: "all",
+      roles: ["authenticated"],
+      using: null,
+      withCheck: null,
+      permissive: true
+    };
+  }
+  /** Restrict the policy to a single SQL command (default `"all"`). */
+  for(command) {
+    this._def.command = command;
+    return this;
+  }
+  /**
+   * Set the DB roles the policy applies to (the `TO` clause), replacing any
+   * previously-set roles. Call with no arguments to target PUBLIC (all roles).
+   *
+   * @example
+   * policy("p").to("authenticated")
+   * policy("p").to("authenticated", "service_role")
+   * policy("p").to() // PUBLIC
+   */
+  to(...roles) {
+    this._def.roles = roles;
+    return this;
+  }
+  /** Set the `USING (...)` row-visibility expression (raw SQL). */
+  using(sqlExpr) {
+    this._def.using = sqlExpr;
+    return this;
+  }
+  /**
+   * "Rows of THIS table whose owner the caller is a member of" — the membership
+   * pattern, written so it cannot recurse.
+   *
+   * THE TRAP IT EXISTS FOR. Written by hand, membership policies point at each
+   * other: `channels` is visible to members, so its policy reads
+   * `channel_members`; `channel_members` is visible to members, so its policy
+   * reads `channels`. Postgres refuses the pair at query time with `infinite
+   * recursion detected in policy for relation ...`, and the error names the
+   * relation but not the cycle. The way out is asymmetry — the MEMBERSHIP table
+   * is protected by `user_id = auth.uid()` and nothing else, and every other
+   * table subqueries INTO it. That shape was in the platform's own schema and
+   * written down nowhere; a customer recovered it by reading that schema.
+   *
+   * `(select auth.uid())` rather than a bare call: the scalar subquery is
+   * evaluated ONCE per statement instead of per row.
+   *
+   * @example
+   * // channels: visible to members. The membership table gets the simple one.
+   * policy("member_read").for("select").to("authenticated")
+   *   .memberOf("channel_members", "channel_id")
+   * // → id IN (SELECT "channel_id" FROM "channel_members"
+   * //          WHERE "user_id" = (select auth.uid()))
+   */
+  memberOf(membershipTable, foreignKey, options = {}) {
+    if (this._def.using !== null) {
+      throw new Error(
+        `policy(${this._def.name}).memberOf(): this policy already has a using() expression. Write one or the other \u2014 memberOf IS the using expression.`
+      );
+    }
+    const column = options.column ?? "id";
+    const userColumn = options.userColumn ?? "user_id";
+    this._def.using = `${quote(column)} IN (SELECT ${quote(foreignKey)} FROM ${quote(membershipTable)} WHERE ${quote(userColumn)} = (select auth.uid()))`;
+    return this;
+  }
+  /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */
+  withCheck(sqlExpr) {
+    this._def.withCheck = sqlExpr;
+    return this;
+  }
+  /** Set the policy mode: `"permissive"` (default, OR-combined) or
+   * `"restrictive"` (AND-combined). */
+  as(mode) {
+    this._def.permissive = mode === "permissive";
+    return this;
+  }
+};
+function policy(name) {
+  return new PolicyBuilder(name);
+}
+
+// src/db/schema.ts
+function toPolicyDef(p) {
+  return p instanceof PolicyBuilder ? p._def : p;
+}
+var TABLE_META = /* @__PURE__ */ Symbol.for("palbase.table.meta");
+function defineTable(name, input) {
+  if (name.trim() === "") {
+    throw new Error("defineTable(name, \u2026): name must not be empty");
+  }
+  const policies = (input.policies ?? []).map(toPolicyDef);
+  const rls = policies.length > 0 || input.rls !== false;
+  const def = {
+    name,
+    columns: input.columns,
+    rls,
+    policies
+  };
+  if (input.primaryKey !== void 0) def.primaryKey = input.primaryKey;
+  if (input.unique !== void 0) def.unique = input.unique;
+  if (input.raw !== void 0 && input.raw.length > 0) def.raw = input.raw.slice();
+  if (input.checks !== void 0 && input.checks.length > 0) def.checks = input.checks.slice();
+  if (input.indexes !== void 0 && input.indexes.length > 0) def.indexes = input.indexes.slice();
+  if (input.search !== void 0) {
+    const s = input.search;
+    if (s.from !== void 0) {
+      if (s.vector !== void 0) {
+        throw new Error(
+          `table ${name}: search beyan\u0131nda tek bi\xE7im kullan\u0131n \u2014 'from' (yeni) ile 'vector' (eski) birlikte olamaz`
+        );
+      }
+      if (s.from.length === 0) {
+        throw new Error(`table ${name}: search.from bo\u015F olamaz`);
+      }
+      if (s.model === void 0) {
+        throw new Error(
+          `table ${name}: search.from model'siz anlams\u0131z \u2014 auto-embed i\xE7in model verin (BYO i\xE7in eski 'vector' bi\xE7imini kullan\u0131n)`
+        );
+      }
+      if (Array.isArray(s.text) && s.text.length === 0) {
+        throw new Error(`table ${name}: search.text bo\u015F dizi olamaz \u2014 FTS istemiyorsan text: false yaz\u0131n`);
+      }
+    } else {
+      if (typeof s.text === "boolean") {
+        throw new Error(`table ${name}: text:${String(s.text)} yaln\u0131z yeni bi\xE7imde ('from' ile) ge\xE7erli`);
+      }
+      if (s.text === void 0 && s.vector === void 0) {
+        throw new Error(
+          `table ${name}: search beyan\u0131 bo\u015F \u2014 en az bir kol (text ya da vector) verin, yoksa alan\u0131 hi\xE7 yazmay\u0131n`
+        );
+      }
+      if (s.text !== void 0 && s.text.length === 0) {
+        throw new Error(`table ${name}: search.text bo\u015F olamaz \u2014 FTS kolu istemiyorsan alan\u0131 hi\xE7 yazma`);
+      }
+      const legs = s.vector === void 0 ? [] : Array.isArray(s.vector) ? s.vector : [s.vector];
+      for (const leg of legs) {
+        if (leg.model !== void 0 && (leg.from === void 0 || leg.from.length === 0)) {
+          throw new Error(`table ${name}: search.vector.model beyan edildi ama 'from' yok \u2014 embed kayna\u011F\u0131 kolonlar zorunlu (C-2)`);
+        }
+        if (leg.model === void 0 && leg.from !== void 0) {
+          throw new Error(`table ${name}: search.vector.from model'siz anlams\u0131z \u2014 auto-embed i\xE7in model verin`);
+        }
+      }
+    }
+    def.search = s;
+  }
+  if (input.memory !== void 0) {
+    if (input.memory.from.length === 0) {
+      throw new Error(`table ${name}: memory.from bo\u015F olamaz`);
+    }
+    def.memory = input.memory;
+  }
+  for (const b of Object.values(input.columns)) {
+    b._def.ownerTable = def;
+  }
+  const handle = { ...input.columns };
+  Object.defineProperty(handle, TABLE_META, { value: def, enumerable: false });
+  return handle;
+}
+var declaringSchemaOf = /* @__PURE__ */ new WeakMap();
+function resolveReferences(tables, schemaName) {
+  for (const table of Object.values(tables)) {
+    for (const [colName, builder] of Object.entries(table.columns)) {
+      const def = builder._def;
+      if (def.selfRefColumn !== void 0) {
+        if (!(def.selfRefColumn in table.columns)) {
+          throw new Error(
+            `table "${table.name}" column "${colName}": selfReferences("${def.selfRefColumn}") \u2014 no such column on this table`
+          );
+        }
+        def.references = {
+          table: qualifiedTableKey(schemaName, table.name),
+          column: def.selfRefColumn
+        };
+        continue;
+      }
+      if (def.referencesThunk === void 0) continue;
+      const target = def.referencesThunk();
+      const owner = target?._def?.ownerTable;
+      if (owner === void 0) {
+        throw new Error(
+          `table "${table.name}" column "${colName}": references(() => \u2026) must point at a column of a table declared with defineTable(...)`
+        );
+      }
+      const targetColumn = Object.entries(owner.columns).find(
+        ([, b]) => b._def === target._def
+      )?.[0];
+      if (targetColumn === void 0) {
+        throw new Error(
+          `table "${table.name}" column "${colName}": the referenced column was not found on table "${owner.name}"`
+        );
+      }
+      const targetSchema = declaringSchemaOf.get(owner);
+      if (targetSchema === void 0) {
+        throw new Error(
+          `table "${table.name}" column "${colName}": references(() => \u2026) points at table "${owner.name}", which no defineSchema(...) has claimed yet \u2014 a foreign key cannot be written without its target's schema. Declare that table's schema first (one file per schema: db/public.ts, db/billing.ts \u2026, imported by this one).`
+        );
+      }
+      def.references = {
+        table: qualifiedTableKey(targetSchema, owner.name),
+        column: targetColumn
+      };
+    }
+  }
+}
+function defineSchema(name, input) {
+  if (typeof name !== "string") {
+    throw new Error(
+      `defineSchema(...) takes the schema NAME first: defineSchema("public", { tables: [todos, lists] }). The one-argument form defineSchema({ tables: { \u2026 } }) is gone \u2014 a schema that does not say its own name cannot be told apart from another schema's table of the same name, which is what a cross-schema foreign key has to do. Migrate db/public.ts (one file per schema: db/public.ts, db/billing.ts \u2026): name the schema, and lift each table key onto the table itself with defineTable("todos", { columns: { \u2026 } }), then list the tables in the array.`
+    );
+  }
+  if (name.trim() === "") {
+    throw new Error("defineSchema(name, \u2026): name must not be empty");
+  }
+  const tables = {};
+  for (const handle of input.tables) {
+    const table = handle[TABLE_META];
+    if (tables[table.name] !== void 0) {
+      throw new Error(
+        `defineSchema("${name}"): two tables declare the name "${table.name}" \u2014 table names must be unique within a schema`
+      );
+    }
+    tables[table.name] = table;
+    declaringSchemaOf.set(table, name);
+  }
+  resolveReferences(tables, name);
+  for (const [name2, def] of Object.entries(tables)) {
+    const m = def.memory;
+    if (m === void 0) continue;
+    const target = Object.values(tables).find((t) => t.name === m.into);
+    if (target === void 0) {
+      throw new Error(`table ${name2}: memory.into "${m.into}" \u015Femada declared de\u011Fil`);
+    }
+    const subject = m.subject ?? "owner";
+    if (!(subject in def.columns)) {
+      throw new Error(`table ${name2}: memory.subject "${subject}" kolonu kaynak tabloda yok`);
+    }
+    if (!(subject in target.columns)) {
+      throw new Error(`table ${name2}: memory.subject "${subject}" kolonu hedef "${m.into}" tablosunda yok`);
+    }
+    const factCol = target.columns["fact"];
+    const factDef = factCol !== void 0 && "_def" in factCol ? factCol._def : factCol;
+    if (factDef === void 0 || factDef.type !== "text") {
+      throw new Error(`table ${name2}: memory.into "${m.into}" tablosunda "fact" (text) kolonu zorunlu`);
+    }
+    for (const c of m.from) {
+      if (!(c in def.columns)) {
+        throw new Error(`table ${name2}: memory.from kolonu "${c}" kaynak tabloda yok`);
+      }
+    }
+  }
+  const extensions = [...new Set(input.extensions ?? [])];
+  return {
+    name,
+    tables,
+    extensions,
+    exposed: input.exposed ?? name === "public"
+  };
+}
+
+// src/db/extensions.ts
+var PALBASE_EXTENSIONS = [
+  // Search & text
+  "vector",
+  // pgvector: AI embeddings + vector similarity search (semantic search / RAG).
+  // NB: the Postgres extension is named "vector", not "pgvector" — declare "vector".
+  "pg_trgm",
+  // trigram fuzzy / typo-tolerant text search
+  "unaccent",
+  // accent-insensitive text search
+  "citext",
+  // case-insensitive text type
+  // Geospatial / location
+  "cube",
+  // multi-dimensional cubes (dependency of earthdistance)
+  "earthdistance",
+  // great-circle distance (needs cube)
+  // Data types & structures
+  "hstore",
+  // key/value pairs in a single column
+  "ltree",
+  // hierarchical tree-structured labels
+  // Indexing & constraints
+  "btree_gist",
+  // GiST operator classes for scalar types — needed for EXCLUDE
+  // constraints that mix "=" with a range/&& overlap (e.g. no-double-booking).
+  // Scheduling
+  // Crypto / ids (also installed by default; listable for explicitness)
+  "pgcrypto",
+  // cryptographic functions (hashing, encryption)
+  "uuid-ossp"
+  // UUID generation functions
+];
+var EXTENSION_DEPENDENCIES = {
+  earthdistance: ["cube"]
+};
+function isPalbaseExtension(name) {
+  return PALBASE_EXTENSIONS.includes(name);
+}
+
+// src/db/columns.ts
+function refuseOnVector(def, modifier) {
+  if (def.type === "vector") {
+    throw new Error(`vector column: .${modifier}() is not supported (FR-002 \u2014 allowed: nullable()/notNull())`);
+  }
+}
+var ColumnBuilder = class _ColumnBuilder {
+  _def;
+  constructor(type, existingDef) {
+    this._def = existingDef ?? {
+      type,
+      nullable: false,
+      primaryKey: false
+    };
+  }
+  /** Mark this column as the primary key. */
+  primaryKey() {
+    refuseOnVector(this._def, "primaryKey");
+    this._def.primaryKey = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Mark this column as NOT NULL (default). */
+  notNull() {
+    this._def.nullable = false;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Allow NULL values. */
+  nullable() {
+    this._def.nullable = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Set a default value. */
+  default(value) {
+    refuseOnVector(this._def, "default");
+    this._def.defaultValue = value;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** UUID: generate a random default (gen_random_uuid()). */
+  defaultRandom() {
+    refuseOnVector(this._def, "defaultRandom");
+    this._def.defaultRandom = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Timestamp: default to now(). */
+  defaultNow() {
+    refuseOnVector(this._def, "defaultNow");
+    this._def.defaultNow = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /**
+   * The DATABASE assigns this column's value — a trigger, a rule, an identity.
+   *
+   * The column becomes optional on INSERT (the author has nothing to send) while
+   * the DDL stays free of a DEFAULT this schema would not honour. It is NOT
+   * `default()`: that declares a value the schema promises to write.
+   *
+   * Naming: deliberately not `generated()`. Postgres has GENERATED columns and
+   * they are a different thing; borrowing the word would send a reader — or a
+   * model writing a schema — to the wrong feature.
+   */
+  dbAssigned() {
+    this._def.dbAssigned = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Add a foreign key reference. */
+  /**
+   * Declares that this column used to be called `previous`.
+   *
+   * A schema diff sees one name gone and another present; it cannot know whether
+   * you renamed a column or dropped one and added another, and the two are very
+   * different — the second loses every value. Saying so here turns the plan into
+   * `ALTER TABLE … RENAME COLUMN` instead.
+   *
+   * Once the rename has been applied the annotation is inert (the old name is no
+   * longer there to rename), so it can be deleted at your leisure.
+   */
+  renamedFrom(previous) {
+    this._def.renamedFrom = previous;
+    return this;
+  }
+  /**
+   * See {@link ColumnDef.ignored}.
+   *
+   * COPIES the def rather than mutating it. The constructor takes an existing
+   * def BY REFERENCE, so every builder derived from another shares one object —
+   * `const a = slug.unique()` leaves `a._def === slug._def`. An in-place
+   * `ignored = true` therefore marks every column sharing that def, including
+   * one another table actively reads, and the gate would let THAT column be
+   * dropped. Measured before this copy existed.
+   *
+   * The aliasing is older than this method and other fields leak through it too.
+   * The reason this one cannot wait: every other leak produces a VISIBLE schema
+   * difference — the plan shows it, the DDL shows it. This one is invisible by
+   * design (no DDL, no diff, no plan line), so its only effect is to disarm a
+   * safety gate in silence.
+   */
+  ignored() {
+    return new _ColumnBuilder(this._def.type, {
+      ...this._def,
+      ignored: true
+    });
+  }
+  /**
+   * Foreign key onto another table's column.
+   *
+   * The target is a THUNK, not a direct reference. In a cycle (`x → y`, `y → x`)
+   * the second table does not exist yet when the first is built; a direct
+   * reference makes TypeScript chase its own tail (TS7022 — measured, and making
+   * the return type independent of the target does NOT help). The thunk is
+   * invoked in `defineSchema`, where every binding exists and every table
+   * already knows its name.
+   *
+   * In a cycle, ONE side needs an explicit return type:
+   * `references((): AnyColumn => y.id)`. One side is enough — measured.
+   * For a self-reference use `selfReferences(column)`: no thunk, no annotation.
+   */
+  references(target, opts) {
+    refuseOnVector(this._def, "references");
+    if (typeof target !== "function") {
+      throw new Error(
+        `references(...) takes a callback: write references(() => otherTable.column). The two-string form references("table", "column") is gone \u2014 a string cannot be type-checked and cannot point at a table that does not exist yet.`
+      );
+    }
+    this._def.referencesThunk = target;
+    if (opts?.as !== void 0) this._def.refAs = opts.as;
+    if (opts?.onDelete !== void 0) this._def.onDeleteAction = opts.onDelete;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /**
+   * Foreign key onto THIS table (`parent_id → id`) — category trees, comment
+   * replies, org charts.
+   *
+   * No thunk and no type annotation: the target table is the one being declared,
+   * so there is nothing to defer and nothing for TypeScript to chase in a circle.
+   * Drizzle forces an explicit `(): AnyPgColumn =>` here because its reference
+   * always goes through a callback; measured, we do not need one.
+   */
+  selfReferences(column, opts) {
+    refuseOnVector(this._def, "selfReferences");
+    this._def.selfRefColumn = column;
+    if (opts?.as !== void 0) this._def.refAs = opts.as;
+    if (opts?.onDelete !== void 0) this._def.onDeleteAction = opts.onDelete;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Set the ON DELETE action for a foreign key reference. */
+  onDelete(action) {
+    this._def.onDeleteAction = action;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /** Add a single-column UNIQUE constraint. */
+  unique() {
+    refuseOnVector(this._def, "unique");
+    this._def.unique = true;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+  /**
+   * Declare how this column's value is projected in and out of the process.
+   *
+   * The DDL does not move: `numeric` stays `numeric`, and the driver still hands
+   * back what Postgres sent. What changes is the type the row surface exposes —
+   * it becomes `Target`:
+   *
+   *   amount: numeric().transform<number>({ fromDb: Number, toDb: String })
+   *
+   * `numeric` surfacing as `string` is CORRECT (a JS number cannot hold
+   * arbitrary precision), and that is exactly why this exists: application code
+   * that does arithmetic on the column otherwise rewrites the same
+   * `Number(row.amount)` / `String(x)` pair in every controller that touches it,
+   * and each rewrite is a place the two directions can drift apart.
+   *
+   * A transform is a PROJECTION, never a constraint: it lives only in this
+   * process, so it can neither validate nor migrate what is stored.
+   */
+  transform(fns) {
+    this._def.transform = fns;
+    return new _ColumnBuilder(this._def.type, this._def);
+  }
+};
+function uuid() {
+  return new ColumnBuilder("uuid");
+}
+function text() {
+  return new ColumnBuilder("text");
+}
+function integer() {
+  return new ColumnBuilder("integer");
+}
+function bigint() {
+  return new ColumnBuilder("bigint");
+}
+function numeric() {
+  return new ColumnBuilder("numeric");
+}
+function boolean() {
+  return new ColumnBuilder("boolean");
+}
+function timestamp() {
+  return new ColumnBuilder("timestamp");
+}
+function jsonb() {
+  return new ColumnBuilder("jsonb");
+}
+function enumType(name, values) {
+  const builder = new ColumnBuilder("enum");
+  builder._def.enumName = name;
+  builder._def.enumValues = [...values];
+  return builder;
+}
+function vector(dimensions) {
+  if (!Number.isInteger(dimensions) || dimensions < 1 || dimensions > 2e3) {
+    throw new Error(`vector(): dimensions must be an integer in [1, 2000], got ${String(dimensions)}`);
+  }
+  const b = new ColumnBuilder("vector");
+  b._def.dimensions = dimensions;
+  return b;
+}
+function ownedByUser() {
+  const b = new ColumnBuilder("text");
+  b._def.nullable = false;
+  b._def.references = { table: "auth.users", column: "id" };
+  b._def.onDeleteAction = "cascade";
+  b._def.owns = true;
+  return b;
+}
+function userRef(opts) {
+  const b = new ColumnBuilder("text");
+  b._def.references = { table: "auth.users", column: "id" };
+  b._def.onDeleteAction = opts.onDelete;
+  if (opts.as !== void 0) b._def.refAs = opts.as;
+  return b;
+}
+function installationRef(opts) {
+  const b = new ColumnBuilder("text");
+  b._def.references = { table: "auth.installations", column: "id" };
+  b._def.onDeleteAction = opts.onDelete;
+  if (opts.as !== void 0) b._def.refAs = opts.as;
+  return b;
+}
+
+// src/db/raw.ts
+function raw(name, up, opts) {
+  return { name, up, ...opts?.down != null ? { down: opts.down } : {} };
+}
+
+// src/db/embedding.ts
+var openai = {
+  embedding(model, opts) {
+    return {
+      provider: "openai",
+      model,
+      apiKeyName: opts?.apiKeyName ?? "OPENAI_API_KEY",
+      ...opts?.dimensions !== void 0 ? { dimensions: opts.dimensions } : {},
+      ...opts?.baseURL !== void 0 ? { baseURL: opts.baseURL } : {}
+    };
+  },
+  chat(model) {
+    return { provider: "openai", model };
+  }
+};
+
+// src/db/typed-db.ts
+function makeTypedTable(name, raw2) {
+  return {
+    insert: (data) => raw2.insert(name, data),
+    upsert: (data, opts) => raw2.upsert(name, data, opts),
+    update: (id, data) => raw2.update(name, id, data),
+    delete: (id) => raw2.delete(name, id),
+    findById: (id) => raw2.findById(name, id),
+    findMany: (query, opts) => raw2.findMany(name, query, opts),
+    updateMany: (where, set) => raw2.updateMany(
+      name,
+      where,
+      set
+    ),
+    deleteMany: (where) => raw2.deleteMany(name, where),
+    count: (where) => raw2.count(name, where)
+  };
+}
+function makeTypedDB(schema, raw2) {
+  const tables = {};
+  for (const key of Object.keys(schema.tables)) {
+    const tableDef = schema.tables[key];
+    if (tableDef !== void 0) {
+      tables[key] = makeTypedTable(tableDef.name, raw2);
+    }
+  }
+  const result = {
+    tables,
+    transaction(fn) {
+      const builder = new TxPlanBuilder();
+      const planTables = {};
+      for (const key of Object.keys(schema.tables)) {
+        const tableDef = schema.tables[key];
+        if (tableDef !== void 0) planTables[key] = builder.table(tableDef.name);
+      }
+      return runTxPlan(
+        raw2,
+        planTables,
+        builder,
+        fn
+      );
+    }
+  };
+  return result;
+}
+
+export {
+  toSchemaJSON,
+  PolicyBuilder,
+  policy,
+  TABLE_META,
+  defineTable,
+  defineSchema,
+  PALBASE_EXTENSIONS,
+  EXTENSION_DEPENDENCIES,
+  isPalbaseExtension,
+  uuid,
+  text,
+  integer,
+  bigint,
+  numeric,
+  boolean,
+  timestamp,
+  jsonb,
+  enumType,
+  vector,
+  ownedByUser,
+  userRef,
+  installationRef,
+  raw,
+  openai,
+  makeTypedDB
+};
+//# sourceMappingURL=chunk-OEQBHE2Z.js.map