@palbase/backend 25.0.4 → 27.0.0

package/dist/{chunk-AILPKEK5.js → chunk-OO7R25AI.js}

@@ -1,27 +1,46 @@
 import {
   __requestALS,
   __runStartHooks,
-  __runWithRuntime
-} from "./chunk-CRQKCRGF.js";
+  __runWithRuntime,
+  assertNoOrphanEntryPoints,
+  buildContainer,
+  buildRelations
+} from "./chunk-I3C4PFIW.js";
 import {
+  qualifiedTableKey
+} from "./chunk-DRZFQRJI.js";
+import {
+  assertNoExpressionHandles,
   assertUsableFilter,
-  assertUsableWriteValues
-} from "./chunk-XABBC7JP.js";
+  assertUsableWriteValues,
+  columnExprOf,
+  isColRef,
+  isPlanRef,
+  isSqlFragment,
+  looksLikeUnbrandedPlanRef,
+  looksLikeUnbrandedRef
+} from "./chunk-GYK6QYS4.js";
 import {
-  qualifiedTableKey
-} from "./chunk-CJSKYY76.js";
+  getRoutes,
+  resolveEffectiveAuth
+} from "./chunk-VVMJEVQP.js";
 import {
+  DeadlockDetected,
+  SerializationFailure,
   UniqueViolation,
-  assertZeroArgConstructor,
-  getRoutes,
   isEngineRaised,
   isHttpError,
-  markEngineRaised,
-  resolveEffectiveAuth
-} from "./chunk-35PNTIRN.js";
+  markEngineRaised
+} from "./chunk-CGNN2PUH.js";
+import {
+  __name
+} from "./chunk-VXPNPVAG.js";
 
 // src/engine/config.ts
 var BootRefused = class extends Error {
+  static {
+    __name(this, "BootRefused");
+  }
   missing;
   constructor(missing, message) {
     super(message);
@@ -30,18 +49,21 @@ var BootRefused = class extends Error {
   }
 };
 var MANDATORY = [
-  { key: "DATABASE_URL", what: "the stack's Postgres (Database module)" },
-  { key: "AUTH_JWKS_URL", what: "where this stack publishes its token signing keys (Auth module)" }
+  {
+    key: "DATABASE_URL",
+    what: "the stack's Postgres (Database module)"
+  },
+  {
+    key: "AUTH_JWKS_URL",
+    what: "where this stack publishes its token signing keys (Auth module)"
+  }
 ];
 function loadConfig(env) {
   const missing = MANDATORY.filter((m) => !env[m.key]?.trim()).map((m) => m.key);
   if (missing.length > 0) {
     const detail = MANDATORY.filter((m) => missing.includes(m.key)).map((m) => `  ${m.key.padEnd(16)}${m.what}`).join("\n");
-    throw new BootRefused(
-      missing,
-      `boot refused: mandatory module not configured \u2014 missing ${missing.join(", ")}.
-${detail}`
-    );
+    throw new BootRefused(missing, `boot refused: mandatory module not configured \u2014 missing ${missing.join(", ")}.
+${detail}`);
   }
   const port = Number(env.PORT ?? 3e3);
   if (!Number.isInteger(port) || port < 0 || port > 65535) {
@@ -75,6 +97,7 @@ ${detail}`
     poolMax
   };
 }
+__name(loadConfig, "loadConfig");
 
 // src/engine/auth.ts
 function b64urlToBytes(s) {
@@ -85,7 +108,11 @@ function b64urlToBytes(s) {
   for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
   return out;
 }
+__name(b64urlToBytes, "b64urlToBytes");
 var AuthVerifier = class {
+  static {
+    __name(this, "AuthVerifier");
+  }
   keys = /* @__PURE__ */ new Map();
   fetchedAt = 0;
   inflight = null;
@@ -111,16 +138,18 @@ var AuthVerifier = class {
         for (const jwk of body.keys ?? []) {
           if (jwk.kty !== "EC" || jwk.crv !== "P-256") continue;
           try {
-            next.set(
-              jwk.kid,
-              await crypto.subtle.importKey(
-                "jwk",
-                { kty: "EC", crv: jwk.crv, x: jwk.x, y: jwk.y, ext: true },
-                { name: "ECDSA", namedCurve: "P-256" },
-                true,
-                ["verify"]
-              )
-            );
+            next.set(jwk.kid, await crypto.subtle.importKey("jwk", {
+              kty: "EC",
+              crv: jwk.crv,
+              x: jwk.x,
+              y: jwk.y,
+              ext: true
+            }, {
+              name: "ECDSA",
+              namedCurve: "P-256"
+            }, true, [
+              "verify"
+            ]));
           } catch {
           }
         }
@@ -140,12 +169,12 @@ var AuthVerifier = class {
     return this.keys.get(kid) ?? null;
   }
   /**
-   * Verify an `Authorization` header value.
-   *
-   * @returns the verified claims, or `null` for absent / malformed / expired /
-   *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
-   *   the caller answers 401 either way, and a detailed reason is an oracle.
-   */
+  * Verify an `Authorization` header value.
+  *
+  * @returns the verified claims, or `null` for absent / malformed / expired /
+  *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
+  *   the caller answers 401 either way, and a detailed reason is an oracle.
+  */
   async verify(authorization) {
     if (!authorization || !authorization.startsWith("Bearer ")) return null;
     const parts = authorization.slice(7).trim().split(".");
@@ -167,12 +196,10 @@ var AuthVerifier = class {
     if (!key) return null;
     let ok = false;
     try {
-      ok = await crypto.subtle.verify(
-        { name: "ECDSA", hash: "SHA-256" },
-        key,
-        b64urlToBytes(sig),
-        new TextEncoder().encode(`${h}.${p}`)
-      );
+      ok = await crypto.subtle.verify({
+        name: "ECDSA",
+        hash: "SHA-256"
+      }, key, b64urlToBytes(sig), new TextEncoder().encode(`${h}.${p}`));
     } catch {
       return null;
     }
@@ -184,9 +211,18 @@ var AuthVerifier = class {
 };
 function effectiveAuth(routeAuth, controllerAuth) {
   const spec = routeAuth !== void 0 ? routeAuth : controllerAuth;
-  if (spec === false) return { required: false, verifiedEmail: false };
-  if (spec === true || spec === void 0 || spec === null) return { required: true, verifiedEmail: false };
-  if (typeof spec !== "object") return { required: true, verifiedEmail: false };
+  if (spec === false) return {
+    required: false,
+    verifiedEmail: false
+  };
+  if (spec === true || spec === void 0 || spec === null) return {
+    required: true,
+    verifiedEmail: false
+  };
+  if (typeof spec !== "object") return {
+    required: true,
+    verifiedEmail: false
+  };
   const o = spec;
   const role = typeof o.role === "string" && o.role.trim() !== "" ? o.role.trim() : void 0;
   return {
@@ -195,23 +231,27 @@ function effectiveAuth(routeAuth, controllerAuth) {
     verifiedEmail: o.verifiedEmail === true
   };
 }
+__name(effectiveAuth, "effectiveAuth");
 
 // src/engine/ratelimit.ts
 var RateLimiter = class {
+  static {
+    __name(this, "RateLimiter");
+  }
+  maxKeys;
+  buckets = /* @__PURE__ */ new Map();
   /** Bound on distinct keys held, so an attacker cycling identities cannot
-   * grow this map without limit. On overflow the oldest windows are dropped —
-   * forgiving, consistent with the restart behaviour above. */
+  * grow this map without limit. On overflow the oldest windows are dropped —
+  * forgiving, consistent with the restart behaviour above. */
   constructor(maxKeys = 1e5) {
     this.maxKeys = maxKeys;
   }
-  maxKeys;
-  buckets = /* @__PURE__ */ new Map();
   /**
-   * Identify the caller: the signed-in user when the route resolved one,
-   * otherwise the address the edge forwarded. Callers the edge did not
-   * identify share one bucket — deliberately conservative, since the
-   * alternative is a limit anyone resets by omitting a header.
-   */
+  * Identify the caller: the signed-in user when the route resolved one,
+  * otherwise the address the edge forwarded. Callers the edge did not
+  * identify share one bucket — deliberately conservative, since the
+  * alternative is a limit anyone resets by omitting a header.
+  */
   static key(routeId, userId, headers) {
     if (userId) return `${routeId}\0u:${userId}`;
     const fwd = headers.get("x-forwarded-for");
@@ -219,16 +259,19 @@ var RateLimiter = class {
     return `${routeId}\0a:${addr || "anonymous"}`;
   }
   /**
-   * @returns `null` when the request may proceed, or the number of seconds to
-   *   wait (never 0 — a caller told to wait 0 comes straight back to the same
-   *   refusal).
-   */
+  * @returns `null` when the request may proceed, or the number of seconds to
+  *   wait (never 0 — a caller told to wait 0 comes straight back to the same
+  *   refusal).
+  */
   check(rule, key, now) {
     if (!rule || !(rule.max > 0) || !(rule.window > 0)) return null;
     const bucket = this.buckets.get(key);
     if (!bucket || now >= bucket.resetAt) {
       if (this.buckets.size >= this.maxKeys) this.evict(now);
-      this.buckets.set(key, { count: 1, resetAt: now + rule.window * 1e3 });
+      this.buckets.set(key, {
+        count: 1,
+        resetAt: now + rule.window * 1e3
+      });
       return null;
     }
     if (bucket.count < rule.max) {
@@ -238,7 +281,7 @@ var RateLimiter = class {
     return Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
   }
   /** Drop expired windows; if none are expired, drop the earliest-resetting
-   * quarter so the map cannot wedge at the ceiling. */
+  * quarter so the map cannot wedge at the ceiling. */
   evict(now) {
     let dropped = 0;
     for (const [k, b] of this.buckets) {
@@ -248,7 +291,9 @@ var RateLimiter = class {
       }
     }
     if (dropped > 0) return;
-    const byReset = [...this.buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);
+    const byReset = [
+      ...this.buckets.entries()
+    ].sort((a, b) => a[1].resetAt - b[1].resetAt);
     for (let i = 0; i < Math.ceil(byReset.length / 4); i++) {
       const victim = byReset[i];
       if (victim) this.buckets.delete(victim[0]);
@@ -266,7 +311,7 @@ function makeMemoryCache(opts = {}) {
   const now = opts.now ?? (() => Date.now());
   const store = /* @__PURE__ */ new Map();
   const inflight = /* @__PURE__ */ new Map();
-  const live = (key) => {
+  const live = /* @__PURE__ */ __name((key) => {
     const e = store.get(key);
     if (!e) return void 0;
     if (e.expiresAt !== 0 && e.expiresAt <= now()) {
@@ -274,8 +319,8 @@ function makeMemoryCache(opts = {}) {
       return void 0;
     }
     return e;
-  };
-  const evict = () => {
+  }, "live");
+  const evict = /* @__PURE__ */ __name(() => {
     const t = now();
     let dropped = 0;
     for (const [k, e] of store) {
@@ -285,18 +330,21 @@ function makeMemoryCache(opts = {}) {
       }
     }
     if (dropped > 0) return;
-    const order = [...store.entries()].sort(
-      (a, b) => (a[1].expiresAt || Infinity) - (b[1].expiresAt || Infinity)
-    );
+    const order = [
+      ...store.entries()
+    ].sort((a, b) => (a[1].expiresAt || Infinity) - (b[1].expiresAt || Infinity));
     for (let i = 0; i < Math.ceil(order.length / 4); i++) {
       const victim = order[i];
       if (victim) store.delete(victim[0]);
     }
-  };
-  const set = async (key, value, ttl) => {
+  }, "evict");
+  const set = /* @__PURE__ */ __name(async (key, value, ttl) => {
     if (store.size >= maxEntries && !store.has(key)) evict();
-    store.set(key, { value, expiresAt: ttl && ttl > 0 ? now() + ttl * 1e3 : 0 });
-  };
+    store.set(key, {
+      value,
+      expiresAt: ttl && ttl > 0 ? now() + ttl * 1e3 : 0
+    });
+  }, "set");
   return {
     async get(key) {
       const e = live(key);
@@ -309,7 +357,10 @@ function makeMemoryCache(opts = {}) {
     async incr(key) {
       const e = live(key);
       const next = (typeof e?.value === "number" ? e.value : 0) + 1;
-      store.set(key, { value: next, expiresAt: e?.expiresAt ?? 0 });
+      store.set(key, {
+        value: next,
+        expiresAt: e?.expiresAt ?? 0
+      });
       return next;
     },
     async getOrSet(key, ttl, fn) {
@@ -331,34 +382,45 @@ function makeMemoryCache(opts = {}) {
     }
   };
 }
+__name(makeMemoryCache, "makeMemoryCache");
 
 // src/engine/db.ts
 function quoteIdent(name) {
   return `"${name.replace(/"/g, '""')}"`;
 }
+__name(quoteIdent, "quoteIdent");
 function quoteTable(key) {
   const dot = key.indexOf(".");
   if (dot === -1) return quoteIdent(key);
   return `${quoteIdent(key.slice(0, dot))}.${quoteIdent(key.slice(dot + 1))}`;
 }
+__name(quoteTable, "quoteTable");
 function encodePgArray(value) {
-  const element = (x) => {
+  const element = /* @__PURE__ */ __name((x) => {
     if (x === null || x === void 0) return "NULL";
     if (Array.isArray(x)) return encodePgArray(x);
     return `"${String(x).replace(/(["\\])/g, "\\$1")}"`;
-  };
+  }, "element");
   return `{${value.map(element).join(",")}}`;
 }
+__name(encodePgArray, "encodePgArray");
 var BIND_SQL = "select set_config('role',$1,true), set_config('search_path','public',true), set_config('request.jwt.claims',$2,true)";
 function createLazyTransaction(sql, role, claimsJson, options = {}) {
   const { lockTimeout } = options;
   const bindSql = lockTimeout ? `${BIND_SQL}, set_config('lock_timeout',$3,true)` : BIND_SQL;
-  const bindParams = lockTimeout ? [role, claimsJson, lockTimeout] : [role, claimsJson];
+  const bindParams = lockTimeout ? [
+    role,
+    claimsJson,
+    lockTimeout
+  ] : [
+    role,
+    claimsJson
+  ];
   let opening = null;
   let release = null;
   let fail = null;
   let settled = null;
-  const ensure = () => {
+  const ensure = /* @__PURE__ */ __name(() => {
     if (opening) return opening;
     opening = new Promise((resolveTx2, rejectTx) => {
       const parked = new Promise((res, rej) => {
@@ -375,7 +437,7 @@ function createLazyTransaction(sql, role, claimsJson, options = {}) {
       });
     });
     return opening;
-  };
+  }, "ensure");
   return {
     ensure,
     get opened() {
@@ -393,24 +455,29 @@ function createLazyTransaction(sql, role, claimsJson, options = {}) {
     }
   };
 }
-var resolveTx = async (tx) => typeof tx.ensure === "function" ? await tx.ensure() : tx;
+__name(createLazyTransaction, "createLazyTransaction");
+var resolveTx = /* @__PURE__ */ __name(async (tx) => typeof tx.ensure === "function" ? await tx.ensure() : tx, "resolveTx");
 function asWireValue(value) {
   if (value instanceof Date) return value.toISOString();
   if (Array.isArray(value)) return value.map(asWireValue);
   return value;
 }
+__name(asWireValue, "asWireValue");
 function asWireRow(row) {
   if (row === null || typeof row !== "object") return row;
   const out = {};
   for (const [key, value] of Object.entries(row)) out[key] = asWireValue(value);
   return out;
 }
+__name(asWireRow, "asWireRow");
 function asWireRows(rows) {
   return rows.map((row) => asWireRow(row));
 }
+__name(asWireRows, "asWireRows");
 function toVectorLiteral(v) {
   return `[${v.join(",")}]`;
 }
+__name(toVectorLiteral, "toVectorLiteral");
 function vectorColumnsOf(schema, table) {
   const out = /* @__PURE__ */ new Set();
   const def = tableDefOf(table, schema);
@@ -422,9 +489,11 @@ function vectorColumnsOf(schema, table) {
   }
   return out;
 }
+__name(vectorColumnsOf, "vectorColumnsOf");
 function tableDefOf(key, schema = currentSchema) {
   return schema.tables?.[key] ?? null;
 }
+__name(tableDefOf, "tableDefOf");
 function reviveVectors(row, vectorCols) {
   if (row === null || typeof row !== "object" || vectorCols.size === 0) return row;
   const out = row;
@@ -434,6 +503,7 @@ function reviveVectors(row, vectorCols) {
   }
   return row;
 }
+__name(reviveVectors, "reviveVectors");
 function transformsOf(schema, table) {
   const out = /* @__PURE__ */ new Map();
   const def = tableDefOf(table, schema);
@@ -448,6 +518,7 @@ function transformsOf(schema, table) {
   }
   return out;
 }
+__name(transformsOf, "transformsOf");
 function applyFromDb(row, transforms) {
   if (transforms.size === 0) return row;
   for (const [col, t] of transforms) {
@@ -458,17 +529,21 @@ function applyFromDb(row, transforms) {
   }
   return row;
 }
+__name(applyFromDb, "applyFromDb");
 function asTableRow(table, row) {
   const revived = reviveVectors(asWireRow(row), vectorColumnsOf(currentSchema, table));
   return applyFromDb(revived, transformsOf(currentSchema, table));
 }
+__name(asTableRow, "asTableRow");
 function asTableRows(table, rows) {
   const vectorCols = vectorColumnsOf(currentSchema, table);
   const transforms = transformsOf(currentSchema, table);
   return rows.map((row) => applyFromDb(reviveVectors(asWireRow(row), vectorCols), transforms));
 }
+__name(asTableRows, "asTableRows");
 function asBindParams(table, cols, data, caller) {
   assertUsableWriteValues(caller, table, cols, data);
+  assertNoExpressionHandles(caller, table, cols, data);
   const vectorCols = vectorColumnsOf(currentSchema, table);
   const transforms = transformsOf(currentSchema, table);
   return cols.map((c) => {
@@ -479,6 +554,7 @@ function asBindParams(table, cols, data, caller) {
     return v;
   });
 }
+__name(asBindParams, "asBindParams");
 var SELECTIVITY_EXACT_THRESHOLD = 1e4;
 var METRIC_OPERATOR = {
   cosine: "<=>",
@@ -489,27 +565,33 @@ function searchConfigFor(table) {
   const t = tableDefOf(table);
   if (!t) return null;
   const columns = t.columns ?? {};
-  const defOf = (c) => c !== null && typeof c === "object" && "_def" in c ? c._def : c ?? {};
+  const defOf = /* @__PURE__ */ __name((c) => c !== null && typeof c === "object" && "_def" in c ? c._def : c ?? {}, "defOf");
   const cols = Object.keys(columns);
   const vectorCols = cols.filter((c) => defOf(columns[c]).type === "vector");
-  const defOfFull = (c) => c !== null && typeof c === "object" && "_def" in c ? c._def : c ?? {};
+  const defOfFull = /* @__PURE__ */ __name((c) => c !== null && typeof c === "object" && "_def" in c ? c._def : c ?? {}, "defOfFull");
   const pkCols = cols.filter((c) => defOfFull(columns[c]).primaryKey === true);
   const pk = pkCols.length === 1 ? pkCols[0] : cols.includes("id") ? "id" : null;
   if (pk === null) {
-    throw new Error(
-      `search(${table}): tek-kolon primary key bulunamad\u0131 \u2014 arama s\u0131ralamas\u0131 ve sat\u0131r birle\u015Fimi PK ister (FR-020)`
-    );
+    throw new Error(`search(${table}): tek-kolon primary key bulunamad\u0131 \u2014 arama s\u0131ralamas\u0131 ve sat\u0131r birle\u015Fimi PK ister (FR-020)`);
   }
   const search = t.search;
-  const synonyms = search?.synonyms !== void 0 && Object.keys(search.synonyms).length > 0 ? { synonyms: search.synonyms } : {};
-  const validity = search?.validity === true ? { validity: true } : {};
+  const synonyms = search?.synonyms !== void 0 && Object.keys(search.synonyms).length > 0 ? {
+    synonyms: search.synonyms
+  } : {};
+  const validity = search?.validity === true ? {
+    validity: true
+  } : {};
   if (search?.from !== void 0 && search.model !== void 0) {
     const m = search.model;
     const embed = {
       model: m.model,
       apiKeyName: m.apiKeyName ?? "OPENAI_API_KEY",
-      ...m.baseURL !== void 0 ? { baseURL: m.baseURL } : {},
-      ...m.dimensions !== void 0 ? { dimensions: m.dimensions } : {}
+      ...m.baseURL !== void 0 ? {
+        baseURL: m.baseURL
+      } : {},
+      ...m.dimensions !== void 0 ? {
+        dimensions: m.dimensions
+      } : {}
     };
     const metric = search.metric ?? "cosine";
     const ftsOn = search.text !== false;
@@ -520,7 +602,13 @@ function searchConfigFor(table) {
         cols,
         colSet: new Set(cols),
         ftsCols: ftsColsNew,
-        legs: [{ column: vectorCols[0], metric, embed }],
+        legs: [
+          {
+            column: vectorCols[0],
+            metric,
+            embed
+          }
+        ],
         ...synonyms,
         ...validity
       };
@@ -531,13 +619,20 @@ function searchConfigFor(table) {
       colSet: new Set(cols),
       ftsCols: ftsColsNew,
       legs: [],
-      chunk: { table: `${table}__palbase_chunks`, metric, embed, fts: ftsOn },
+      chunk: {
+        table: `${table}__palbase_chunks`,
+        metric,
+        embed,
+        fts: ftsOn
+      },
       ...synonyms,
       ...validity
     };
   }
   const ftsCols = (Array.isArray(search?.text) ? search.text : void 0) ?? [];
-  const rawLegs = search?.vector === void 0 ? [] : Array.isArray(search.vector) ? search.vector : [search.vector];
+  const rawLegs = search?.vector === void 0 ? [] : Array.isArray(search.vector) ? search.vector : [
+    search.vector
+  ];
   let legs;
   if (rawLegs.length > 0) {
     legs = rawLegs.map((leg) => {
@@ -550,35 +645,57 @@ function searchConfigFor(table) {
       return {
         column,
         metric: l.metric ?? "cosine",
-        ...model !== void 0 ? { embed: {
-          model: model.model,
-          apiKeyName: model.apiKeyName ?? "OPENAI_API_KEY",
-          ...model.baseURL !== void 0 ? { baseURL: model.baseURL } : {},
-          ...model.dimensions !== void 0 ? { dimensions: model.dimensions } : {}
-        } } : {}
+        ...model !== void 0 ? {
+          embed: {
+            model: model.model,
+            apiKeyName: model.apiKeyName ?? "OPENAI_API_KEY",
+            ...model.baseURL !== void 0 ? {
+              baseURL: model.baseURL
+            } : {},
+            ...model.dimensions !== void 0 ? {
+              dimensions: model.dimensions
+            } : {}
+          }
+        } : {}
       };
     });
   } else {
-    legs = vectorCols.map((column) => ({ column, metric: "cosine" }));
+    legs = vectorCols.map((column) => ({
+      column,
+      metric: "cosine"
+    }));
   }
   if (ftsCols.length === 0 && legs.length === 0) return null;
-  return { pk, cols, colSet: new Set(cols), ftsCols, legs, ...synonyms, ...validity };
+  return {
+    pk,
+    cols,
+    colSet: new Set(cols),
+    ftsCols,
+    legs,
+    ...synonyms,
+    ...validity
+  };
 }
+__name(searchConfigFor, "searchConfigFor");
 function pickLeg(table, legs, using) {
   if (legs.length === 0) return null;
   if (using !== void 0) {
     const hit = legs.find((l) => l.column === using);
     if (!hit) {
-      throw new Error(
-        `search(${table}): using "${using}" bir vekt\xF6r kolunu adlam\u0131yor \u2014 mevcut: ${legs.map((l) => l.column).join(", ")}`
-      );
+      throw new Error(`search(${table}): using "${using}" bir vekt\xF6r kolunu adlam\u0131yor \u2014 mevcut: ${legs.map((l) => l.column).join(", ")}`);
     }
     return hit;
   }
   if (legs.length === 1) return legs[0];
   throw new Error(`search(${table}): birden \xE7ok vekt\xF6r kolu var \u2014 'using' ile se\xE7in (FR-013) \u2014 salt metin ar\u0131yorsan mode:"text" kullan`);
 }
-var HALF_LIFE_UNIT_SECONDS = { s: 1, m: 60, h: 3600, d: 86400 };
+__name(pickLeg, "pickLeg");
+var HALF_LIFE_UNIT_SECONDS = {
+  s: 1,
+  m: 60,
+  h: 3600,
+  d: 86400
+};
 function parseHalfLife(s) {
   const m = /^(\d+)(s|m|h|d)$/.exec(s);
   const sec = m === null ? 0 : Number(m[1]) * HALF_LIFE_UNIT_SECONDS[m[2]];
@@ -587,10 +704,20 @@ function parseHalfLife(s) {
   }
   return sec;
 }
-var WHERE_OPS = { gt: ">", gte: ">=", lt: "<", lte: "<=", neq: "<>" };
+__name(parseHalfLife, "parseHalfLife");
+var WHERE_OPS = {
+  gt: ">",
+  gte: ">=",
+  lt: "<",
+  lte: "<=",
+  neq: "<>"
+};
 function ftsExprOf(ftsCols) {
-  return [...ftsCols].sort().map((c) => `coalesce(t.${quoteIdent(c)},'')`).join(" || ' ' || ");
+  return [
+    ...ftsCols
+  ].sort().map((c) => `coalesce(t.${quoteIdent(c)},'')`).join(" || ' ' || ");
 }
+__name(ftsExprOf, "ftsExprOf");
 function expandSynonyms(query, map) {
   const lower = {};
   for (const [word, alts] of Object.entries(map)) lower[word.toLowerCase()] = alts;
@@ -603,9 +730,10 @@ function expandSynonyms(query, map) {
     }).join("");
   }).join("");
 }
-var searchLogger = (evt, fields) => {
+__name(expandSynonyms, "expandSynonyms");
+var searchLogger = /* @__PURE__ */ __name((evt, fields) => {
   console.log(evt, JSON.stringify(fields));
-};
+}, "searchLogger");
 function logNoResults(table, query, mode, n) {
   if (n === 0) {
     searchLogger?.("palbase.search.no_results", {
@@ -615,26 +743,29 @@ function logNoResults(table, query, mode, n) {
     });
   }
 }
+__name(logNoResults, "logNoResults");
 async function fetchFacets(live, table, colSet, facets, where, extraWhere = () => "") {
   const bind = [];
-  const add = (v) => {
+  const add = /* @__PURE__ */ __name((v) => {
     bind.push(v);
     return `$${bind.length}`;
-  };
+  }, "add");
   const whereSql = compileWhere(table, colSet, where, add) + extraWhere(add);
-  const parts = facets.map(
-    (col) => `(SELECT '${col.replace(/'/g, "''")}' AS f, t.${quoteIdent(col)}::text AS v, count(*) AS n FROM ${quoteTable(table)} t WHERE true${whereSql} GROUP BY 2 ORDER BY 3 DESC LIMIT 20)`
-  );
+  const parts = facets.map((col) => `(SELECT '${col.replace(/'/g, "''")}' AS f, t.${quoteIdent(col)}::text AS v, count(*) AS n FROM ${quoteTable(table)} t WHERE true${whereSql} GROUP BY 2 ORDER BY 3 DESC LIMIT 20)`);
   const rows = await live.unsafe(parts.join(" UNION ALL "), bind);
   const out = {};
   for (const col of facets) out[col] = [];
   for (const r of rows) {
     if (typeof r.f === "string" && out[r.f] !== void 0) {
-      out[r.f].push({ value: r.v ?? null, count: Number(r.n) });
+      out[r.f].push({
+        value: r.v ?? null,
+        count: Number(r.n)
+      });
     }
   }
   return out;
 }
+__name(fetchFacets, "fetchFacets");
 function validitySql(v, add) {
   if (v === "all") return "";
   if (v !== void 0) {
@@ -643,26 +774,96 @@ function validitySql(v, add) {
   }
   return ` AND t."valid_to" IS NULL`;
 }
+__name(validitySql, "validitySql");
 function excludeSql(pk, ids, add) {
   if (ids.length === 0) return "";
   if (ids.length === 1) return ` AND t.${quoteIdent(pk)} <> ${add(ids[0])}`;
   return ` AND t.${quoteIdent(pk)}::text <> ALL(ARRAY[${ids.map((x) => add(x)).join(", ")}])`;
 }
+__name(excludeSql, "excludeSql");
+function primaryKeyOf(table) {
+  const t = tableDefOf(table);
+  const columns = t?.columns ?? {};
+  const cols = Object.keys(columns);
+  if (cols.length === 0) return null;
+  const declared = t?.primaryKey;
+  if (Array.isArray(declared)) {
+    if (declared.length !== 1) return null;
+    const only = declared[0];
+    return typeof only === "string" && cols.includes(only) ? only : null;
+  }
+  const pkOf = /* @__PURE__ */ __name((c) => {
+    if (c === null || typeof c !== "object") return false;
+    const rec = c;
+    const def = "_def" in rec ? rec._def : rec;
+    return def !== null && typeof def === "object" && def.primaryKey === true;
+  }, "pkOf");
+  const pks = cols.filter((c) => pkOf(columns[c]));
+  return pks.length === 1 ? pks[0] : null;
+}
+__name(primaryKeyOf, "primaryKeyOf");
+function isSinglePkEquality(where, pk) {
+  if (pk === null) return false;
+  const keys = Object.keys(where);
+  if (keys.length !== 1 || keys[0] !== pk) return false;
+  const v = where[pk];
+  return v !== null && (typeof v !== "object" || Array.isArray(v));
+}
+__name(isSinglePkEquality, "isSinglePkEquality");
+function assertNotAppendOnly(caller, table) {
+  const def = tableDefOf(table);
+  if (def?.appendOnly !== true) return;
+  throw new Error(`${caller}(${table}): "${table}" append-only \u2014 sat\u0131r g\xFCncellenemez ya da silinemez. D\xFCzeltme i\xE7in TELAF\u0130 KAYDI ekleyin: insert("${table}", { \u2026 }) ile ters i\u015Fareti ta\u015F\u0131yan yeni bir sat\u0131r yaz\u0131n; ge\xE7mi\u015F oldu\u011Fu gibi kals\u0131n diye tablo b\xF6yle bildirilmi\u015F (appendOnly: true).`);
+}
+__name(assertNotAppendOnly, "assertNotAppendOnly");
 function schemaColumns(table) {
   const t = tableDefOf(table);
   const cols = t?.columns ? Object.keys(t.columns) : [];
   return cols.length > 0 ? new Set(cols) : null;
 }
+__name(schemaColumns, "schemaColumns");
+function colRefSql(table, known, ref, caller, alias = "t") {
+  const name = ref.$col;
+  const shapeOK = /^[A-Za-z_][A-Za-z0-9_]*$/.test(name);
+  if (known !== null ? !known.has(name) : !shapeOK) {
+    throw new Error(`${caller}(${table}): col("${name}") tabloda yok (FR-011)`);
+  }
+  return `${alias}.${quoteIdent(name)}`;
+}
+__name(colRefSql, "colRefSql");
+function selectClause(table, known, select) {
+  if (select !== void 0 && select.length === 0) {
+    throw new Error(`findMany(${table}): select bo\u015F bir liste ald\u0131 \u2014 bu "hepsini ver" DE\u011E\u0130L, "hi\xE7birini saymad\u0131m" demek. Projeksiyon istemiyorsan\u0131z anahtar\u0131 hi\xE7 koymay\u0131n; istiyorsan\u0131z en az bir kolon ad\u0131 verin.`);
+  }
+  if (select === void 0) return "*";
+  return select.map((col) => {
+    const shapeOK = /^[A-Za-z_][A-Za-z0-9_]*$/.test(col);
+    if (known !== null ? !known.has(col) : !shapeOK) {
+      throw new Error(`findMany(${table}): select kolonu "${col}" tabloda yok`);
+    }
+    return `t.${quoteIdent(col)}`;
+  }).join(", ");
+}
+__name(selectClause, "selectClause");
 function orderClause(table, known, orderBy) {
   if (!orderBy) return "";
-  const col = orderBy.column;
-  const shapeOK = /^[A-Za-z_][A-Za-z0-9_]*$/.test(col);
-  if (known !== null ? !known.has(col) : !shapeOK) {
-    throw new Error(`findMany(${table}): orderBy kolonu "${col}" tabloda yok`);
-  }
-  const dir = orderBy.direction === "desc" ? "DESC" : "ASC";
-  return ` ORDER BY ${quoteIdent(col)} ${dir}`;
+  const items = Array.isArray(orderBy) ? orderBy : [
+    orderBy
+  ];
+  if (items.length === 0) return "";
+  const rendered = items.map((o) => {
+    const col = o.column;
+    const shapeOK = /^[A-Za-z_][A-Za-z0-9_]*$/.test(col);
+    if (known !== null ? !known.has(col) : !shapeOK) {
+      throw new Error(`findMany(${table}): orderBy kolonu "${col}" tabloda yok`);
+    }
+    const dir = o.direction === "desc" ? "DESC" : "ASC";
+    const nulls = o.nulls === "first" ? " NULLS FIRST" : o.nulls === "last" ? " NULLS LAST" : "";
+    return `${quoteIdent(col)} ${dir}${nulls}`;
+  });
+  return ` ORDER BY ${rendered.join(", ")}`;
 }
+__name(orderClause, "orderClause");
 function limitClause(limit) {
   if (limit === void 0) return "";
   if (!Number.isInteger(limit) || limit < 0) {
@@ -670,46 +871,118 @@ function limitClause(limit) {
   }
   return ` LIMIT ${limit}`;
 }
+__name(limitClause, "limitClause");
 function offsetClause(offset, limit) {
   if (offset === void 0) return "";
   if (!Number.isInteger(offset) || offset < 0) {
-    throw new Error(
-      `findMany: offset bir negatif olmayan tam say\u0131 olmal\u0131 (geldi: ${String(offset)})`
-    );
+    throw new Error(`findMany: offset bir negatif olmayan tam say\u0131 olmal\u0131 (geldi: ${String(offset)})`);
   }
   if (limit === void 0) {
-    throw new Error(
-      "findMany: offset yaln\u0131z limit ile birlikte verilir \u2014 limitsiz offset bir sayfa de\u011Fil, s\u0131n\u0131rs\u0131z bir kuyru\u011Fun kayd\u0131r\u0131lm\u0131\u015F\u0131d\u0131r"
-    );
+    throw new Error("findMany: offset yaln\u0131z limit ile birlikte verilir \u2014 limitsiz offset bir sayfa de\u011Fil, s\u0131n\u0131rs\u0131z bir kuyru\u011Fun kayd\u0131r\u0131lm\u0131\u015F\u0131d\u0131r");
   }
   return ` OFFSET ${offset}`;
 }
-function compileWhere(table, colSet, where, add, caller = "search") {
+__name(offsetClause, "offsetClause");
+function compileWhereBare(table, colSet, where, add, caller = "search", alias = "t", depth = 0) {
   const parts = [];
   const transforms = transformsOf(currentSchema, table);
-  const bindFor = (col) => {
+  const bindFor = /* @__PURE__ */ __name((col) => {
     const t = transforms.get(col);
     return t?.toDb === void 0 ? add : (v) => add(v === null || v === void 0 ? v : t.toDb(v));
-  };
+  }, "bindFor");
   assertUsableFilter(caller, table, where);
+  if (isSqlFragment(where)) {
+    const { text, values } = where.$sql;
+    if (text.length !== values.length + 1) {
+      throw new Error(`${caller}(${table}): sqlFragment par\xE7alar\u0131 bozuk (${text.length} metin, ${values.length} de\u011Fer) \u2014 bunu \xFCreten tek \u015Fey template tag'i, elle kurulmu\u015F bir nesne de\u011Fil`);
+    }
+    let out = text[0] ?? "";
+    for (let i = 0; i < values.length; i++) out += `${add(values[i])}${text[i + 1] ?? ""}`;
+    return `(${out})`;
+  }
   for (const [col, cond] of Object.entries(where)) {
+    if (col === "OR" || col === "AND") {
+      const branches = cond;
+      if (branches.length === 0) {
+        parts.push(col === "OR" ? "false" : "true");
+        continue;
+      }
+      const compiled = branches.map((b) => `(${compileWhereBare(table, colSet, b, add, caller, alias, depth)})`);
+      parts.push(`(${compiled.join(col === "OR" ? " OR " : " AND ")})`);
+      continue;
+    }
+    if (col === "has") {
+      const rels = currentRelations.get(table) ?? [];
+      for (const [relName, inner] of Object.entries(cond)) {
+        const rel = rels.find((r) => r.name === relName);
+        if (rel === void 0) {
+          const known = rels.map((r) => r.name).sort();
+          throw new Error(`${caller}(${table}): has.${relName} diye bir ili\u015Fki yok${known.length > 0 ? ` (bilinenler: ${known.join(", ")})` : " \u2014 bu tablonun hi\xE7 ili\u015Fkisi yok"}. \u0130li\u015Fkiler yabanc\u0131 anahtarlardan T\xDCRET\u0130L\u0130R; ad\u0131n\u0131 de\u011Fi\u015Ftirmek i\xE7in references(..., { as, reverseAs }).`);
+        }
+        const ourCol = rel.kind === "many" ? primaryKeyOf(table) : rel.via;
+        const theirCol = rel.kind === "many" ? rel.via : primaryKeyOf(rel.to);
+        if (ourCol === null || theirCol === null) {
+          const missing = ourCol === null ? table : rel.to;
+          throw new Error(`${caller}(${table}): has.${relName} kurulam\u0131yor \u2014 "${missing}" tablosunun tek kolonlu bir primary key'i yok. Korelasyon bir anahtar ister; \xE7ok kolonlu anahtarda ili\u015Fki \xFCzerinden s\xFCzmek yerine sqlFragment ile yaz\u0131n.`);
+        }
+        const sub = `r${depth + 1}`;
+        const innerSql = compileWhereBare(rel.to, schemaColumns(rel.to), inner ?? {}, add, caller, sub, depth + 1);
+        parts.push(`${alias}.${quoteIdent(ourCol)} IN (SELECT ${sub}.${quoteIdent(theirCol)} FROM ${quoteTable(rel.to)} ${sub}${innerSql === "" ? "" : ` WHERE ${innerSql}`})`);
+      }
+      continue;
+    }
+    if (col === "NOT") {
+      parts.push(`NOT (${compileWhereBare(table, colSet, cond, add, caller, alias, depth)})`);
+      continue;
+    }
     if (colSet !== null && !colSet.has(col)) {
       throw new Error(`${caller}(${table}): where kolonu "${col}" tabloda yok (FR-016)`);
     }
-    const q = `t.${quoteIdent(col)}`;
+    const q = `${alias}.${quoteIdent(col)}`;
     const bind = bindFor(col);
+    if (isColRef(cond)) {
+      parts.push(`${q} = ${colRefSql(table, colSet, cond, caller, alias)}`);
+      continue;
+    }
     if (cond !== null && typeof cond === "object" && !Array.isArray(cond)) {
       for (const [op, v] of Object.entries(cond)) {
+        if (op === "contains" || op === "icontains" || op === "startsWith" || op === "endsWith") {
+          if (typeof v !== "string") {
+            throw new Error(`${caller}(${table}): where.${col}.${op} bir string olmal\u0131`);
+          }
+          const lit = v.replace(/([\\%_])/g, "\\$1");
+          const pattern = op === "startsWith" ? `${lit}%` : op === "endsWith" ? `%${lit}` : `%${lit}%`;
+          parts.push(`${q} ${op === "icontains" ? "ILIKE" : "LIKE"} ${bind(pattern)}`);
+          continue;
+        }
+        if (op === "isNull") {
+          if (typeof v !== "boolean") {
+            throw new Error(`${caller}(${table}): where.${col}.isNull bir boolean olmal\u0131`);
+          }
+          parts.push(`${q} IS ${v ? "NULL" : "NOT NULL"}`);
+          continue;
+        }
         if (op === "in") {
           if (!Array.isArray(v)) throw new Error(`${caller}(${table}): where.${col}.in bir dizi olmal\u0131`);
+          if (v.some(isColRef)) {
+            throw new Error(`${caller}(${table}): where.${col}.in col() ile kullan\u0131lamaz \u2014 kolon kar\u015F\u0131la\u015Ft\u0131rmas\u0131 i\xE7in \xE7\u0131plak bi\xE7imi ({ ${col}: col("\u2026") }) ya da gt/gte/lt/lte/neq kullan\u0131n`);
+          }
           if (v.length === 0) {
             parts.push("false");
             continue;
           }
           parts.push(`${q} IN (${v.map((x) => bind(x)).join(", ")})`);
+        } else if (isColRef(v)) {
+          if (!(op in WHERE_OPS)) {
+            throw new Error(`${caller}(${table}): where.${col}.${op} col() ile kullan\u0131lamaz \u2014 e\u015Fitlik i\xE7in \xE7\u0131plak bi\xE7imi kullan\u0131n: { ${col}: col("\u2026") }`);
+          }
+          parts.push(`${q} ${WHERE_OPS[op]} ${colRefSql(table, colSet, v, caller, alias)}`);
+        } else if (looksLikeUnbrandedRef(v) !== null) {
+          const kind = looksLikeUnbrandedRef(v);
+          throw new Error(`${caller}(${table}): where.${col}.${op} bir ${kind === "col" ? "col()" : "sqlFragment"} TAKL\u0130D\u0130 ald\u0131 \u2014 bu nesne bu s\xFCre\xE7te ${kind === "col" ? "col()" : "sqlFragment"} ile \xFCretilmemi\u015F. \u0130stek g\xF6vdesinden gelen bir filtre i\u015Faret\xE7i TA\u015EIYAMAZ; kolon kar\u015F\u0131la\u015Ft\u0131rmas\u0131n\u0131 kendi kodunuzda ${kind === "col" ? 'col("kolon_ad\u0131")' : "sqlFragment`\u2026`"} ile kurun.`);
         } else if (op in WHERE_OPS) {
-          if (v === null && (op === "neq" || op === "eq")) {
-            parts.push(`${q} IS ${op === "neq" ? "NOT " : ""}NULL`);
+          if (v === null && op === "neq") {
+            parts.push(`${q} IS NOT NULL`);
             continue;
           }
           parts.push(`${q} ${WHERE_OPS[op]} ${bind(v)}`);
@@ -723,8 +996,14 @@ function compileWhere(table, colSet, where, add, caller = "search") {
       parts.push(`${q} = ${bind(cond)}`);
     }
   }
-  return parts.length === 0 ? "" : ` AND ${parts.join(" AND ")}`;
+  return parts.join(" AND ");
+}
+__name(compileWhereBare, "compileWhereBare");
+function compileWhere(table, colSet, where, add, caller = "search") {
+  const bare = compileWhereBare(table, colSet, where, add, caller);
+  return bare === "" ? "" : ` AND ${bare}`;
 }
+__name(compileWhere, "compileWhere");
 function onConflictTail(cols, conflict, action) {
   const target = `ON CONFLICT (${conflict.map(quoteIdent).join(", ")})`;
   if (action === "ignore") return `${target} DO NOTHING`;
@@ -732,26 +1011,22 @@ function onConflictTail(cols, conflict, action) {
   const sets = cols.filter((c) => !conflictSet.has(c)).map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`);
   return sets.length ? `${target} DO UPDATE SET ${sets.join(", ")}` : `${target} DO UPDATE SET ${quoteIdent(conflict[0])} = EXCLUDED.${quoteIdent(conflict[0])}`;
 }
+__name(onConflictTail, "onConflictTail");
 var cachedVectorSchema = null;
 var cachedTrgmSchema = null;
 async function trgmSchemaOf(live) {
   if (cachedTrgmSchema !== null) return cachedTrgmSchema;
-  const rows = await live.unsafe(
-    "select n.nspname from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_trgm'"
-  );
+  const rows = await live.unsafe("select n.nspname from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'pg_trgm'");
   cachedTrgmSchema = rows?.[0]?.nspname ?? "public";
   return cachedTrgmSchema;
 }
+__name(trgmSchemaOf, "trgmSchemaOf");
 async function vectorSchemaWithGuc(runner) {
   if (cachedVectorSchema !== null) {
-    await runner.unsafe(
-      "select set_config('hnsw.iterative_scan','relaxed_order',true), set_config('hnsw.max_scan_tuples','200000',true), set_config('hnsw.ef_search','200',true)"
-    );
+    await runner.unsafe("select set_config('hnsw.iterative_scan','relaxed_order',true), set_config('hnsw.max_scan_tuples','200000',true), set_config('hnsw.ef_search','200',true)");
     return cachedVectorSchema;
   }
-  const rows = await runner.unsafe(
-    "select set_config('hnsw.iterative_scan','relaxed_order',true), set_config('hnsw.max_scan_tuples','200000',true), set_config('hnsw.ef_search','200',true), (select n.nspname from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'vector') as nspname"
-  );
+  const rows = await runner.unsafe("select set_config('hnsw.iterative_scan','relaxed_order',true), set_config('hnsw.max_scan_tuples','200000',true), set_config('hnsw.ef_search','200',true), (select n.nspname from pg_extension e join pg_namespace n on n.oid = e.extnamespace where e.extname = 'vector') as nspname");
   const name = rows?.[0]?.nspname;
   if (typeof name !== "string" || name === "") {
     throw new Error("pgvector extension kurulu de\u011Fil \u2014 vector aramas\u0131 \xE7al\u0131\u015Famaz (extensions beyan\u0131 deploy'dan ge\xE7ti mi?)");
@@ -759,11 +1034,13 @@ async function vectorSchemaWithGuc(runner) {
   cachedVectorSchema = name;
   return name;
 }
+__name(vectorSchemaWithGuc, "vectorSchemaWithGuc");
 var secretReader = null;
 function setSecretReader(fn) {
   secretReader = fn;
 }
-var embedFetch = (url, init) => fetch(url, init);
+__name(setSecretReader, "setSecretReader");
+var embedFetch = /* @__PURE__ */ __name((url, init) => fetch(url, init), "embedFetch");
 async function embedQuery(embed, text) {
   if (secretReader === null) {
     throw new Error(`query embed: secret reader ba\u011Flanmam\u0131\u015F \u2014 ${embed.apiKeyName} okunam\u0131yor`);
@@ -778,11 +1055,18 @@ async function embedQuery(embed, text) {
   try {
     const res = await embedFetch(url, {
       method: "POST",
-      headers: { "Content-Type": "application/json", Authorization: `Bearer ${key}` },
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${key}`
+      },
       body: JSON.stringify({
         model: embed.model,
-        input: [text],
-        ...embed.dimensions !== void 0 ? { dimensions: embed.dimensions } : {}
+        input: [
+          text
+        ],
+        ...embed.dimensions !== void 0 ? {
+          dimensions: embed.dimensions
+        } : {}
       }),
       signal: controller.signal
     });
@@ -799,9 +1083,13 @@ async function embedQuery(embed, text) {
     clearTimeout(timer);
   }
 }
+__name(embedQuery, "embedQuery");
 function createOps(tx) {
-  const at = () => resolveTx(tx);
+  const at = /* @__PURE__ */ __name(() => resolveTx(tx), "at");
   const ops = {
+    // Generic dönüş, çağıranın İDDİASIDIR (FR-021). Motor her zaman satır objeleri
+    // üretir; `T` onlara bir ad vermekten ibarettir ve verilmezse `unknown` kalır —
+    // yani "bilmiyorum", ki ham SQL için doğru cevap odur.
     async query(sql, params = []) {
       const bound = params.map((p) => Array.isArray(p) ? encodePgArray(p) : p);
       return asWireRows(await (await at()).unsafe(sql, bound));
@@ -814,27 +1102,141 @@ function createOps(tx) {
       const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data, "insert"));
       const inserted = rows[0];
       if (!inserted) {
-        throw new Error(
-          `insert into ${table} returned no row \u2014 the write was rejected (an RLS policy, most likely).`
-        );
+        throw new Error(`insert into ${table} returned no row \u2014 the write was rejected (an RLS policy, most likely).`);
       }
       return asTableRow(table, inserted);
     },
     /**
-     * INSERT the row, or UPDATE it when it collides on `onConflict`.
-     *
-     * WHY IT IS AN OPERATION rather than a recipe. "Try the insert, catch the
-     * unique violation, update instead" does not work here: a request runs in ONE
-     * Postgres transaction, so the failed insert aborts it and every later
-     * statement answers `current transaction is aborted`. A tenant measured that
-     * as 7 of 8 concurrent requests returning 500, gave up on upsert, and had a
-     * trigger create the row instead — a workaround that needs a new trigger for
-     * every table with a unique row.
-     *
-     * The conflict columns are excluded from the SET list: they are what MATCHED,
-     * so writing them back is at best a no-op and at worst a surprise.
-     */
-    async upsert(table, data, opts) {
+    * Bir ADI kilitle — satırı değil (FR-054).
+    *
+    * "Aynı anda tek bir fatura kapanışı koşsun" gibi, kilitlenecek satırı
+    * OLMAYAN işler için. Anahtar bir metin; Postgres 64-bit tamsayı istediği
+    * için `hashtextextended` ile hash'leniyor ve metin SQL'e hiç GİRMİYOR.
+    *
+    * YALNIZ transaction kapsamlı aile (`pg_advisory_xact_lock`). Oturum
+    * kapsamlı sürüm bırakıldığı yerde KALIR: bağlantı havuza döner, kilit
+    * üstünde kalır ve bir sonraki isteği — hiç bitmeyecek şekilde — bekletir.
+    * Transaction kapsamlısı commit/rollback'te Postgres tarafından bırakılır,
+    * yani unutulması imkânsız.
+    */
+    async advisoryXactLock(key) {
+      await (await at()).unsafe("select pg_advisory_xact_lock(hashtextextended($1, 0))", [
+        key
+      ]);
+    },
+    /**
+    * Bu satırları KİLİTLE, ve sırayı KATMAN koysun (FR-035).
+    *
+    * D-017: katman sıralamayı değil, **sıralamayı mümkün kılan primitifi**
+    * verir. Uygulama dokunacağı kümeyi önden bildirir; sırayı burası koyar.
+    * Çağıranın verdiği sıraya güvenmek, iki çağıranın aynı iki satıra ters
+    * sırayla girmesi demektir — ve deadlock'un bedeli ucuz değil:
+    * `deadlock_timeout` varsayılanı **1 saniye**, yani kaybeden işlem bir
+    * saniye bekledikten sonra hata alır.
+    *
+    * `FOR NO KEY UPDATE`, `updateMany`'nin CTE'siyle AYNI kilit modu: iki
+    * yazma yolunun tek bir sırası ve tek bir modu olmak zorunda, yoksa biri
+    * diğerini bekletir.
+    */
+    async lockRows(table, ids) {
+      const unique = [
+        ...new Set(ids)
+      ].sort();
+      if (unique.length === 0) {
+        return;
+      }
+      const pk = primaryKeyOf(table);
+      if (pk === null) {
+        throw new Error(`lockRows(${table}): tek-kolon primary key bulunamad\u0131 \u2014 kilit s\u0131ras\u0131 bir anahtar ister (FR-035).`);
+      }
+      const params = [];
+      const add = /* @__PURE__ */ __name((v) => {
+        params.push(v);
+        return `$${params.length}`;
+      }, "add");
+      const list = unique.map((id) => add(id)).join(", ");
+      await (await at()).unsafe(`SELECT t.${quoteIdent(pk)} FROM ${quoteTable(table)} t WHERE t.${quoteIdent(pk)} IN (${list}) ORDER BY t.${quoteIdent(pk)} FOR NO KEY UPDATE`, params);
+    },
+    /**
+    * Bir idempotency anahtarını SAHİPLEN (FR-033).
+    *
+    * `{ inserted: true, row }` → bu çağrı yazdı.
+    * `{ inserted: false, row }` → başkası önce yazdı; dönen satır ONUN satırı.
+    *
+    * ÖLÇÜLDÜ (pg16, spec Research Appendix) — üç dalın üçü de farklı davranıyor:
+    *
+    *   plain INSERT           ikinci oturum 2121 ms BLOKLANIR, sonra 23505 alır;
+    *                          birincinin satırı korunur              ← istenen
+    *   ON CONFLICT DO UPDATE  ikincinin verisi birincininkini EZER
+    *   ON CONFLICT DO NOTHING `INSERT 0 0` — sessiz; çağıran ne olduğunu bilemez
+    *
+    * Bu yüzden `ON CONFLICT` KULLANILMIYOR. Ödeme yolunda "ikinci çağrı
+    * birincinin sonucunu görsün" idempotency'nin tanımıdır; ezmek ya da
+    * susmak ikisi de yanlış cevap.
+    *
+    * INSERT bir SAVEPOINT içinde koşuyor: başarısız bir INSERT transaction'ı
+    * ABORT eder (25P02) ve savepoint olmadan yakalama işe yaramaz — hata
+    * yakalanır ama sonraki SELECT de "current transaction is aborted" alır.
+    */
+    async claim(table, unique, extra = {}) {
+      const keyCols = Object.keys(unique);
+      if (keyCols.length === 0) {
+        throw new Error(`claim(${table}): benzersiz alan verilmedi. claim, bir anahtar\u0131 sahiplenmektir; anahtar yoksa sahiplenecek bir \u015Fey de yok \u2014 insert(${table}, \u2026) kullan\u0131n.`);
+      }
+      assertUsableWriteValues("claim", table, keyCols, unique);
+      const data = {
+        ...unique,
+        ...extra
+      };
+      const cols = Object.keys(data);
+      const live = await at();
+      try {
+        return await live.savepoint(async (sp) => {
+          const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
+          const rows = await sp.unsafe(`INSERT INTO ${quoteTable(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) RETURNING *`, asBindParams(table, cols, data, "claim"));
+          if (!rows[0]) {
+            throw new Error(`claim(${table}): INSERT sat\u0131r d\xF6nd\xFCrmedi \u2014 yazma reddedildi (b\xFCy\xFCk olas\u0131l\u0131kla bir RLS policy'si).`);
+          }
+          return {
+            inserted: true,
+            row: asTableRow(table, rows[0])
+          };
+        });
+      } catch (e) {
+        if (!isUniqueViolation(e)) throw e;
+        const params = [];
+        const add = /* @__PURE__ */ __name((v) => {
+          params.push(v);
+          return `$${params.length}`;
+        }, "add");
+        const where = keyCols.map((c) => `t.${quoteIdent(c)} = ${add(unique[c])}`).join(" AND ");
+        const found = await (await at()).unsafe(`SELECT * FROM ${quoteTable(table)} t WHERE ${where} LIMIT 1`, params);
+        if (!found[0]) {
+          const named = constraintOf(e);
+          throw new Error(`claim(${table}): benzersizlik ihlali${named ? ` (${named})` : ""} yakaland\u0131 ama ${keyCols.join(", ")} ile sat\u0131r bulunamad\u0131. Ya ihlal BA\u015EKA bir unique k\u0131s\u0131ttan geliyor \u2014 o zaman claim() bu \xE7a\u011Fr\u0131 i\xE7in yanl\u0131\u015F ara\xE7 \u2014 ya da sat\u0131r var ve bir RLS policy'si onu bu \xE7a\u011F\u0131randan gizliyor.`);
+        }
+        return {
+          inserted: false,
+          row: asTableRow(table, found[0])
+        };
+      }
+    },
+    /**
+    * INSERT the row, or UPDATE it when it collides on `onConflict`.
+    *
+    * WHY IT IS AN OPERATION rather than a recipe. "Try the insert, catch the
+    * unique violation, update instead" does not work here: a request runs in ONE
+    * Postgres transaction, so the failed insert aborts it and every later
+    * statement answers `current transaction is aborted`. A tenant measured that
+    * as 7 of 8 concurrent requests returning 500, gave up on upsert, and had a
+    * trigger create the row instead — a workaround that needs a new trigger for
+    * every table with a unique row.
+    *
+    * The conflict columns are excluded from the SET list: they are what MATCHED,
+    * so writing them back is at best a no-op and at worst a surprise.
+    */
+    async put(table, data, opts) {
+      assertNotAppendOnly("put", table);
       const conflict = opts.onConflict;
       if (conflict.length === 0) {
         throw new Error(`upsert into ${table}: onConflict en az bir kolon ad\u0131 ister`);
@@ -845,33 +1247,29 @@ function createOps(tx) {
         const ph = cols.map((_, i) => `$${i + 1}`).join(", ");
         const insertSql = `INSERT INTO ${quoteTable(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${ph}) ON CONFLICT (${conflict.map(quoteIdent).join(", ")}) WHERE "valid_to" IS NULL DO NOTHING RETURNING *`;
         const live = await at();
-        const bindData = asBindParams(table, cols, data, "upsert");
+        const bindData = asBindParams(table, cols, data, "put");
         const first = await live.unsafe(insertSql, bindData);
         if (first[0]) return asTableRow(table, first[0]);
         const condSql = conflict.map((c, i) => `${quoteIdent(c)} = $${i + 1}`).join(" AND ");
         const condBind = conflict.map((c) => data[c]);
-        const cur = await live.unsafe(
-          `SELECT * FROM ${quoteTable(table)} WHERE ${condSql} AND "valid_to" IS NULL`,
-          condBind
-        );
+        const cur = await live.unsafe(`SELECT * FROM ${quoteTable(table)} WHERE ${condSql} AND "valid_to" IS NULL`, condBind);
         const old = cur[0];
         if (old === void 0) {
           throw new Error(`upsert into ${table}: e\u015Fzamanl\u0131 supersede yar\u0131\u015F\u0131 \u2014 ge\xE7erli sat\u0131r bulunamad\u0131, iste\u011Fi yineleyin (D-020)`);
         }
         const pk = Object.keys(old).includes("id") ? "id" : Object.keys(old)[0];
-        await live.unsafe(
-          `UPDATE ${quoteTable(table)} SET "valid_to" = now() WHERE ${quoteIdent(pk)} = $1 AND "valid_to" IS NULL`,
-          [old[pk]]
-        );
+        await live.unsafe(`UPDATE ${quoteTable(table)} SET "valid_to" = now() WHERE ${quoteIdent(pk)} = $1 AND "valid_to" IS NULL`, [
+          old[pk]
+        ]);
         const second = await live.unsafe(insertSql, bindData);
         if (!second[0]) {
           throw new Error(`upsert into ${table}: e\u015Fzamanl\u0131 supersede yar\u0131\u015F\u0131 \u2014 yeni sat\u0131r a\xE7\u0131lamad\u0131, iste\u011Fi yineleyin (D-020)`);
         }
         const fresh = second[0];
-        await live.unsafe(
-          `UPDATE ${quoteTable(table)} SET "superseded_by" = $2 WHERE ${quoteIdent(pk)} = $1`,
-          [old[pk], fresh[pk]]
-        );
+        await live.unsafe(`UPDATE ${quoteTable(table)} SET "superseded_by" = $2 WHERE ${quoteIdent(pk)} = $1`, [
+          old[pk],
+          fresh[pk]
+        ]);
         return asTableRow(table, second[0]);
       }
       const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
@@ -879,50 +1277,54 @@ function createOps(tx) {
       const assignments = cols.filter((c) => !conflictSet.has(c)).map((c) => `${quoteIdent(c)} = EXCLUDED.${quoteIdent(c)}`);
       const action = assignments.length ? `DO UPDATE SET ${assignments.join(", ")}` : `DO UPDATE SET ${quoteIdent(conflict[0])} = EXCLUDED.${quoteIdent(conflict[0])}`;
       const sql = `INSERT INTO ${quoteTable(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) ON CONFLICT (${conflict.map(quoteIdent).join(", ")}) ${action} RETURNING *`;
-      const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data, "upsert"));
+      const rows = await (await at()).unsafe(sql, asBindParams(table, cols, data, "put"));
       const row = rows[0];
       if (!row) {
-        throw new Error(
-          `upsert into ${table} returned no row \u2014 the write was rejected (an RLS policy, most likely).`
-        );
+        throw new Error(`upsert into ${table} returned no row \u2014 the write was rejected (an RLS policy, most likely).`);
       }
       return asTableRow(table, row);
     },
     async update(table, id, data) {
+      assertNotAppendOnly("update", table);
       const cols = Object.keys(data);
       if (cols.length === 0) return ops.findById(table, id);
       const assignments = cols.map((c, i) => `${quoteIdent(c)} = $${i + 1}`).join(", ");
       const sql = `UPDATE ${quoteTable(table)} SET ${assignments} WHERE id = $${cols.length + 1} RETURNING *`;
-      const rows = await (await at()).unsafe(sql, [...asBindParams(table, cols, data, "update"), id]);
+      const rows = await (await at()).unsafe(sql, [
+        ...asBindParams(table, cols, data, "update"),
+        id
+      ]);
       return rows[0] ? asTableRow(table, rows[0]) : null;
     },
     async delete(table, id) {
-      await (await at()).unsafe(`DELETE FROM ${quoteTable(table)} WHERE id = $1`, [id]);
+      assertNotAppendOnly("delete", table);
+      await (await at()).unsafe(`DELETE FROM ${quoteTable(table)} WHERE id = $1`, [
+        id
+      ]);
     },
     /**
-     * Update every row the filter matches, in ONE statement.
-     *
-     * The capability was already here and only reachable from inside a
-     * transaction plan (`tx.tables.x.updateWhere`, since 11.0.0). Outside it the
-     * only door was `update(id, …)`, so "mark every unapproved row in this
-     * household" was an N+1 loop or hand-written SQL — and hand-written SQL is
-     * where the typed surface and RLS both stop helping.
-     *
-     * The filter language is `findMany`'s, compiled by the same `compileWhere`:
-     * one filter language, or the two spellings drift.
-     *
-     * AN EMPTY FILTER IS REFUSED. `UPDATE … WHERE true` is a whole-table write,
-     * and the shape that produces it by accident — a filter object built from
-     * request input that happened to come back empty — is exactly the shape that
-     * should not silently succeed. Callers who mean every row say so with a
-     * predicate that is true for every row.
-     */
+    * Update every row the filter matches, in ONE statement.
+    *
+    * The capability was already here and only reachable from inside a
+    * transaction plan (`tx.tables.x.updateWhere`, since 11.0.0). Outside it the
+    * only door was `update(id, …)`, so "mark every unapproved row in this
+    * household" was an N+1 loop or hand-written SQL — and hand-written SQL is
+    * where the typed surface and RLS both stop helping.
+    *
+    * The filter language is `findMany`'s, compiled by the same `compileWhere`:
+    * one filter language, or the two spellings drift.
+    *
+    * AN EMPTY FILTER IS REFUSED. `UPDATE … WHERE true` is a whole-table write,
+    * and the shape that produces it by accident — a filter object built from
+    * request input that happened to come back empty — is exactly the shape that
+    * should not silently succeed. Callers who mean every row say so with a
+    * predicate that is true for every row.
+    */
     async updateMany(table, where, set) {
+      assertNotAppendOnly("updateMany", table);
       const cols = Object.keys(set);
       if (cols.length === 0) {
-        throw new Error(
-          `updateMany(${table}): nothing to set. An update with no columns is not a no-op worth pretending happened \u2014 pass the columns to write.`
-        );
+        throw new Error(`updateMany(${table}): nothing to set. An update with no columns is not a no-op worth pretending happened \u2014 pass the columns to write.`);
       }
       const known = schemaColumns(table);
       if (known !== null) {
@@ -933,27 +1335,43 @@ function createOps(tx) {
         }
       }
       const params = [];
-      const add = (v) => {
+      const add = /* @__PURE__ */ __name((v) => {
         params.push(v);
         return `$${params.length}`;
-      };
-      const assignments = cols.map((c) => `${quoteIdent(c)} = ${add(asBindParams(table, [c], set, "updateMany")[0])}`).join(", ");
+      }, "add");
+      const assignments = cols.map((c) => {
+        const expr = columnExprOf(set[c]);
+        if (expr !== null && expr.fn === "now") {
+          return `${quoteIdent(c)} = now()`;
+        }
+        if (expr !== null) {
+          const operator = expr.fn === "inc" ? "+" : "-";
+          const t = transformsOf(currentSchema, table).get(c);
+          const amount = t?.toDb === void 0 || expr.by === null || expr.by === void 0 ? expr.by : t.toDb(expr.by);
+          return `${quoteIdent(c)} = ${quoteIdent(c)} ${operator} ${add(amount)}`;
+        }
+        return `${quoteIdent(c)} = ${add(asBindParams(table, [
+          c
+        ], set, "updateMany")[0])}`;
+      }).join(", ");
       const whereSql = compileWhere(table, known, where, add, "updateMany");
       assertHasPredicate(whereSql, "updateMany", table);
-      const sql = `UPDATE ${quoteTable(table)} AS t SET ${assignments} WHERE true${whereSql} RETURNING *`;
+      const pk = primaryKeyOf(table);
+      const sql = isSinglePkEquality(where, pk) || pk === null ? `UPDATE ${quoteTable(table)} AS t SET ${assignments} WHERE true${whereSql} RETURNING *` : `WITH locked AS (SELECT t.${quoteIdent(pk)} FROM ${quoteTable(table)} t WHERE true${whereSql} ORDER BY t.${quoteIdent(pk)} FOR NO KEY UPDATE) UPDATE ${quoteTable(table)} AS t SET ${assignments} FROM locked WHERE t.${quoteIdent(pk)} = locked.${quoteIdent(pk)} RETURNING t.*`;
       return asTableRows(table, await (await at()).unsafe(sql, params));
     },
     /**
-     * Delete every row the filter matches, in ONE statement; resolves to how
-     * many went. Same filter language, same empty-filter refusal as
-     * {@link updateMany} — and here the accident is worse.
-     */
+    * Delete every row the filter matches, in ONE statement; resolves to how
+    * many went. Same filter language, same empty-filter refusal as
+    * {@link updateMany} — and here the accident is worse.
+    */
     async deleteMany(table, where) {
+      assertNotAppendOnly("deleteMany", table);
       const params = [];
-      const add = (v) => {
+      const add = /* @__PURE__ */ __name((v) => {
         params.push(v);
         return `$${params.length}`;
-      };
+      }, "add");
       const known = schemaColumns(table);
       const whereSql = compileWhere(table, known, where, add, "deleteMany");
       assertHasPredicate(whereSql, "deleteMany", table);
@@ -962,20 +1380,20 @@ function createOps(tx) {
       return rows.length;
     },
     /**
-     * How many rows match — the half of pagination `limit`/`offset` cannot
-     * supply. Without it a page count is either a guess or "fetch everything and
-     * read .length", and the second one is the scale risk this surface exists to
-     * remove.
-     *
-     * An empty filter is legitimate HERE: counting a whole table is a read, and
-     * reads do not destroy anything.
-     */
+    * How many rows match — the half of pagination `limit`/`offset` cannot
+    * supply. Without it a page count is either a guess or "fetch everything and
+    * read .length", and the second one is the scale risk this surface exists to
+    * remove.
+    *
+    * An empty filter is legitimate HERE: counting a whole table is a read, and
+    * reads do not destroy anything.
+    */
     async count(table, where = {}) {
       const params = [];
-      const add = (v) => {
+      const add = /* @__PURE__ */ __name((v) => {
         params.push(v);
         return `$${params.length}`;
-      };
+      }, "add");
       const known = schemaColumns(table);
       const whereSql = compileWhere(table, known, where, add, "count");
       const sql = `SELECT count(*) AS n FROM ${quoteTable(table)} t WHERE true${whereSql}`;
@@ -983,33 +1401,33 @@ function createOps(tx) {
       return Number(rows[0]?.n ?? 0);
     },
     async findById(table, id) {
-      const rows = await (await at()).unsafe(
-        `SELECT * FROM ${quoteTable(table)} WHERE id = $1`,
-        [id]
-      );
+      const rows = await (await at()).unsafe(`SELECT * FROM ${quoteTable(table)} WHERE id = $1`, [
+        id
+      ]);
       return rows[0] ? asTableRow(table, rows[0]) : null;
     },
     async findMany(table, query = {}, opts = {}) {
       const params = [];
-      const add = (v) => {
+      const add = /* @__PURE__ */ __name((v) => {
         params.push(v);
         return `$${params.length}`;
-      };
+      }, "add");
       const known = schemaColumns(table);
       const whereSql = compileWhere(table, known, query, add, "findMany");
       const order = orderClause(table, known, opts.orderBy);
       const limit = limitClause(opts.limit);
       const offset = offsetClause(opts.offset, opts.limit);
-      const sql = `SELECT * FROM ${quoteTable(table)} t WHERE true${whereSql}${order}${limit}${offset}`;
+      const cols = selectClause(table, known, opts.select);
+      const sql = `SELECT ${cols} FROM ${quoteTable(table)} t WHERE true${whereSql}${order}${limit}${offset}`;
       return asTableRows(table, await (await at()).unsafe(sql, params));
     },
     /**
-     * Tek-SQL hibrit arama (FR-014): iki kol CTE + FULL OUTER JOIN + RRF
-     * (1/(50+rank), CLAIM-N4). Operatör şema-nitelikli (C-10, M-1); GUC
-     * hnsw.iterative_scan=relaxed_order aynı tx'te set_config ile (CLAIM-N3 —
-     * RLS/filtre altında LIMIT-altı dönüş açığını kapatır). Sorgu-anı embed
-     * T024'te gelir; o zamana dek vector kolu yalnız params.vector ile koşar.
-     */
+    * Tek-SQL hibrit arama (FR-014): iki kol CTE + FULL OUTER JOIN + RRF
+    * (1/(50+rank), CLAIM-N4). Operatör şema-nitelikli (C-10, M-1); GUC
+    * hnsw.iterative_scan=relaxed_order aynı tx'te set_config ile (CLAIM-N3 —
+    * RLS/filtre altında LIMIT-altı dönüş açığını kapatır). Sorgu-anı embed
+    * T024'te gelir; o zamana dek vector kolu yalnız params.vector ile koşar.
+    */
     async search(table, params = {}) {
       const cfg = searchConfigFor(table);
       if (!cfg) {
@@ -1017,18 +1435,12 @@ function createOps(tx) {
       }
       const excl = params.__excludeIds ?? [];
       if (params.facets !== void 0) {
-        for (const col of params.facets) {
-          if (!cfg.colSet.has(col)) {
-            throw new Error(`search(${table}): facets kolonu "${col}" tabloda yok (FR-027)`);
-          }
-        }
+        throw new Error(`search(${table}): facets art\u0131k search'\xFCn parametresi de\u011Fil \u2014 saya\xE7lar dizi \xFCst\xFCnde ta\u015F\u0131n\u0131nca JSON.stringify onlar\u0131 d\xFC\u015F\xFCr\xFCyordu (FR-058). Ba\u011F\u0131ms\u0131z \xE7a\u011F\u0131r\u0131n: facets({ facets: [...], where })`);
       }
       if (params.validity !== void 0 && cfg.validity !== true) {
-        throw new Error(
-          `search(${table}): validity parametresi verildi ama tablo validity beyan\u0131 ta\u015F\u0131m\u0131yor (FR-029)`
-        );
+        throw new Error(`search(${table}): validity parametresi verildi ama tablo validity beyan\u0131 ta\u015F\u0131m\u0131yor (FR-029)`);
       }
-      const validityFor = (adder) => cfg.validity === true ? validitySql(params.validity, adder) : "";
+      const validityFor = /* @__PURE__ */ __name((adder) => cfg.validity === true ? validitySql(params.validity, adder) : "", "validityFor");
       const rawLimit = params.limit ?? 20;
       if (typeof rawLimit !== "number" || !Number.isFinite(rawLimit)) {
         throw new Error(`search(${table}): limit sonlu bir say\u0131 olmal\u0131, ${String(rawLimit)} verildi (FR-013)`);
@@ -1074,15 +1486,13 @@ function createOps(tx) {
           }
         }
         if (!wantTextC && qvC === null) {
-          throw new Error(
-            `search(${table}): ko\u015Fulabilir kol yok \u2014 metin i\xE7in 'query' (FTS beyan\u0131 gerekir), semantik i\xE7in 'vector' verin (FR-015)`
-          );
+          throw new Error(`search(${table}): ko\u015Fulabilir kol yok \u2014 metin i\xE7in 'query' (FTS beyan\u0131 gerekir), semantik i\xE7in 'vector' verin (FR-015)`);
         }
         const bindC = [];
-        const addC = (v) => {
+        const addC = /* @__PURE__ */ __name((v) => {
           bindC.push(v);
           return `$${bindC.length}`;
-        };
+        }, "addC");
         const userWhereC = compileWhere(table, cfg.colSet, params.where ?? {}, addC);
         const whereC = userWhereC + excludeSql(cfg.pk, excl, addC) + validityFor(addC);
         const parentJoinC = ` JOIN ${quoteTable(table)} t ON t.${quoteIdent(cfg.pk)} = c.${pidQ} WHERE true${whereC} AND `;
@@ -1096,10 +1506,7 @@ function createOps(tx) {
           const op = METRIC_OPERATOR[ck.metric] ?? METRIC_OPERATOR.cosine;
           let exactOrderC = "";
           if (userWhereC !== "") {
-            const probeRows = await liveC.unsafe(
-              `SELECT count(*)::int AS n FROM (SELECT 1 FROM ${quoteTable(ck.table)} c${parentJoinC}c.embedding IS NOT NULL LIMIT ${SELECTIVITY_EXACT_THRESHOLD + 1}) s`,
-              bindC.slice()
-            );
+            const probeRows = await liveC.unsafe(`SELECT count(*)::int AS n FROM (SELECT 1 FROM ${quoteTable(ck.table)} c${parentJoinC}c.embedding IS NOT NULL LIMIT ${SELECTIVITY_EXACT_THRESHOLD + 1}) s`, bindC.slice());
             const n = probeRows?.[0]?.n;
             if (typeof n === "number" && n <= SELECTIVITY_EXACT_THRESHOLD) {
               exactOrderC = " + 0.0";
@@ -1119,7 +1526,7 @@ function createOps(tx) {
         const msC = params.minScore === void 0 ? "" : addC(params.minScore);
         const colListC = cfg.cols.map((c) => `t.${quoteIdent(c)}`).join(", ");
         const scoreC = scoreMul === "" ? "g._score" : `(g._score)${scoreMul}`;
-        const assembleC = (kwIn, withKwn) => {
+        const assembleC = /* @__PURE__ */ __name((kwIn, withKwn) => {
           const kwnCol = withKwn ? `, (SELECT count(*) FROM kw)::int AS _kwn` : "";
           let fusedSrc;
           if (semC !== "" && kwIn !== "") {
@@ -1131,7 +1538,7 @@ function createOps(tx) {
           }
           const inner = `${fusedSrc}, ranked AS (SELECT f.pid, f.chunk_seq, f.cscore, ROW_NUMBER() OVER (PARTITION BY f.pid ORDER BY f.cscore DESC, f.chunk_seq) AS rn FROM fused f), grouped AS (SELECT r.pid, MAX(r.cscore) AS _score, json_agg(json_build_object('content', c.content, 'score', r.cscore, 'chunkSeq', r.chunk_seq, 'charStart', c.char_start) ORDER BY r.cscore DESC, r.chunk_seq) FILTER (WHERE r.rn <= ${bpr}) AS blocks FROM ranked r JOIN ${quoteTable(ck.table)} c ON c.${pidQ} = r.pid AND c.chunk_seq = r.chunk_seq GROUP BY r.pid) SELECT ${colListC}, ${scoreC}::float8 AS _score, g.blocks AS blocks${kwnCol} FROM grouped g JOIN ${quoteTable(table)} t ON t.${quoteIdent(cfg.pk)} = g.pid`;
           return msC === "" ? `SELECT * FROM (${inner}) q ORDER BY q._score DESC, q.${quoteIdent(cfg.pk)} LIMIT ${limit}` : `SELECT * FROM (${inner}) q WHERE q._score >= ${msC} ORDER BY q._score DESC, q.${quoteIdent(cfg.pk)} LIMIT ${limit}`;
-        };
+        }, "assembleC");
         let rowsC = await liveC.unsafe(assembleC(kwC, kwC !== ""), bindC);
         if (wantTextC && kwC !== "" && (rowsC.length === 0 || rowsC[0]._kwn === 0)) {
           const tsch = await trgmSchemaOf(liveC);
@@ -1141,12 +1548,10 @@ function createOps(tx) {
           rowsC = await liveC.unsafe(assembleC(trgmKwC, false), retryBindC);
         }
         for (const r of rowsC) delete r._kwn;
-        const outC = asTableRows(table, rowsC).map((r) => ({ ...r, blocks: r.blocks ?? [] }));
-        if (params.facets !== void 0 && params.facets.length > 0) {
-          Object.assign(outC, {
-            _facets: await fetchFacets(liveC, table, cfg.colSet, params.facets, params.where ?? {}, validityFor)
-          });
-        }
+        const outC = asTableRows(table, rowsC).map((r) => ({
+          ...r,
+          blocks: r.blocks ?? []
+        }));
         logNoResults(table, params.query, params.mode, outC.length);
         return outC;
       }
@@ -1165,15 +1570,13 @@ function createOps(tx) {
       }
       const wantVector = leg !== null && qv !== null;
       if (!wantText && !wantVector) {
-        throw new Error(
-          `search(${table}): ko\u015Fulabilir kol yok \u2014 metin i\xE7in 'query' (FTS beyan\u0131 gerekir), semantik i\xE7in 'vector' verin (FR-015)`
-        );
+        throw new Error(`search(${table}): ko\u015Fulabilir kol yok \u2014 metin i\xE7in 'query' (FTS beyan\u0131 gerekir), semantik i\xE7in 'vector' verin (FR-015)`);
       }
       const bind = [];
-      const add = (v) => {
+      const add = /* @__PURE__ */ __name((v) => {
         bind.push(v);
         return `$${bind.length}`;
-      };
+      }, "add");
       const userWhere = compileWhere(table, cfg.colSet, params.where ?? {}, add);
       const whereSql = userWhere + excludeSql(cfg.pk, excl, add) + validityFor(add);
       const live = await at();
@@ -1185,10 +1588,7 @@ function createOps(tx) {
         const op = METRIC_OPERATOR[leg.metric] ?? METRIC_OPERATOR.cosine;
         let exactOrder = "";
         if (userWhere !== "") {
-          const probeRows = await live.unsafe(
-            `SELECT count(*)::int AS n FROM (SELECT 1 FROM ${quoteTable(table)} t WHERE t.${quoteIdent(leg.column)} IS NOT NULL${whereSql} LIMIT ${SELECTIVITY_EXACT_THRESHOLD + 1}) s`,
-            bind.slice()
-          );
+          const probeRows = await live.unsafe(`SELECT count(*)::int AS n FROM (SELECT 1 FROM ${quoteTable(table)} t WHERE t.${quoteIdent(leg.column)} IS NOT NULL${whereSql} LIMIT ${SELECTIVITY_EXACT_THRESHOLD + 1}) s`, bind.slice());
           const n = probeRows?.[0]?.n;
           if (typeof n === "number" && n <= SELECTIVITY_EXACT_THRESHOLD) {
             exactOrder = " + 0.0";
@@ -1209,7 +1609,7 @@ function createOps(tx) {
       const colList = cfg.cols.map((c) => `t.${quoteIdent(c)}`).join(", ");
       const msP = params.minScore === void 0 ? "" : add(params.minScore);
       const hlCol = params.highlight === true && wantText ? `, ts_headline('simple', ${ftsExprOf(cfg.ftsCols)}, websearch_to_tsquery('simple', ${qpRef})) AS _highlight` : "";
-      const assemble = (kwIn, withKwn) => {
+      const assemble = /* @__PURE__ */ __name((kwIn, withKwn) => {
         const kwnCol = withKwn ? `, (SELECT count(*) FROM kw)::int AS _kwn` : "";
         let inner;
         let orderScore;
@@ -1226,7 +1626,7 @@ function createOps(tx) {
           orderScore = "_score";
         }
         return msP === "" ? `${inner} ORDER BY ${orderScore} DESC, t.${quoteIdent(cfg.pk)} LIMIT ${limit}` : `SELECT * FROM (${inner}) q WHERE q._score >= ${msP} ORDER BY q._score DESC, q.${quoteIdent(cfg.pk)} LIMIT ${limit}`;
-      };
+      }, "assemble");
       let rows = await live.unsafe(assemble(kwSql, kwSql !== ""), bind);
       if (wantText && kwSql !== "" && (rows.length === 0 || rows[0]._kwn === 0)) {
         const tsch = await trgmSchemaOf(live);
@@ -1237,28 +1637,26 @@ function createOps(tx) {
         rows = await live.unsafe(assemble(trgmKw, false), retryBind);
       }
       for (const r of rows) delete r._kwn;
-      const out = asTableRows(table, rows).map((r) => ({ ...r, blocks: [] }));
-      if (params.facets !== void 0 && params.facets.length > 0) {
-        Object.assign(out, {
-          _facets: await fetchFacets(live, table, cfg.colSet, params.facets, params.where ?? {}, validityFor)
-        });
-      }
+      const out = asTableRows(table, rows).map((r) => ({
+        ...r,
+        blocks: []
+      }));
       logNoResults(table, params.query, params.mode, out.length);
       return out;
     },
     /**
-     * similar (T018, FR-022): "bu satıra benzeyenler". Hedef vektör DB'den
-     * okunur — satır-modu satırın kendi kolonu, chunk-modu parent chunk'larının
-     * şema-nitelikli avg'ı — ve ana arama search'ün vector yoluyla koşar;
-     * kaynak satır sonuçtan düşer. İKİ tur BİLİNÇLİ (plan T018): target-CTE'li
-     * tek SQL'de "id yok" ile "0 komşu" ayrılamazdı; +1 küçük turla id-yokluğu
-     * adlandırılmış hataya çevrilir. Sonuç şekli search ile aynı (FR-015).
-     */
+    * similar (T018, FR-022): "bu satıra benzeyenler". Hedef vektör DB'den
+    * okunur — satır-modu satırın kendi kolonu, chunk-modu parent chunk'larının
+    * şema-nitelikli avg'ı — ve ana arama search'ün vector yoluyla koşar;
+    * kaynak satır sonuçtan düşer. İKİ tur BİLİNÇLİ (plan T018): target-CTE'li
+    * tek SQL'de "id yok" ile "0 komşu" ayrılamazdı; +1 küçük turla id-yokluğu
+    * adlandırılmış hataya çevrilir. Sonuç şekli search ile aynı (FR-015).
+    */
     /** D-021 (FR-027 DX): sayaçlar BAĞIMSIZ op'la — search'ün dizi-üstü
-     * `_facets` özelliği JSON.stringify'da kaybolur (dizi özelliği), tenant
-     * yanıtına koyunca sessizce yok olurdu. Ayrı dönüş ciddi bir sözleşmedir;
-     * search'teki alan geriye-uyum için DURUR. where + validity default'u
-     * sayaçlara da uygulanır (sayaç, kullanıcının gördüğü kümeyi anlatır). */
+    * `_facets` özelliği JSON.stringify'da kaybolur (dizi özelliği), tenant
+    * yanıtına koyunca sessizce yok olurdu. Ayrı dönüş ciddi bir sözleşmedir;
+    * search'teki alan geriye-uyum için DURUR. where + validity default'u
+    * sayaçlara da uygulanır (sayaç, kullanıcının gördüğü kümeyi anlatır). */
     async facets(table, params) {
       const cfg = searchConfigFor(table);
       if (!cfg) {
@@ -1282,20 +1680,18 @@ function createOps(tx) {
       let v;
       if (cfg.chunk !== void 0) {
         const sch = await vectorSchemaWithGuc(live);
-        const rows = await live.unsafe(
-          `SELECT ${quoteIdent(sch)}.avg(c.embedding) AS v FROM ${quoteTable(cfg.chunk.table)} c WHERE c.${quoteIdent(`parent_${cfg.pk}`)} = $1 AND c.embedding IS NOT NULL`,
-          [id]
-        );
+        const rows = await live.unsafe(`SELECT ${quoteIdent(sch)}.avg(c.embedding) AS v FROM ${quoteTable(cfg.chunk.table)} c WHERE c.${quoteIdent(`parent_${cfg.pk}`)} = $1 AND c.embedding IS NOT NULL`, [
+          id
+        ]);
         v = rows?.[0]?.v;
       } else {
         const leg = pickLeg(table, cfg.legs, opts.using);
         if (leg === null) {
           throw new Error(`similar(${table}): tabloda vekt\xF6r kolonu yok \u2014 benzerlik semantik vekt\xF6r ister (FR-022)`);
         }
-        const rows = await live.unsafe(
-          `SELECT t.${quoteIdent(leg.column)} AS v FROM ${quoteTable(table)} t WHERE t.${quoteIdent(cfg.pk)} = $1`,
-          [id]
-        );
+        const rows = await live.unsafe(`SELECT t.${quoteIdent(leg.column)} AS v FROM ${quoteTable(table)} t WHERE t.${quoteIdent(cfg.pk)} = $1`, [
+          id
+        ]);
         v = rows?.[0]?.v;
       }
       if (typeof v !== "string") {
@@ -1312,18 +1708,20 @@ function createOps(tx) {
         blocksPerRow: opts.blocksPerRow,
         validity: opts.validity,
         boost: opts.boost,
-        __excludeIds: [id]
+        __excludeIds: [
+          id
+        ]
       };
       return ops.search(table, p);
     },
     /**
-     * recommend (T018, FR-023): positive/negative id kümelerinden öneri.
-     * Hedef vektör DB-İÇİ CTE'lerle türer: pos = avg(embedding of positives),
-     * negative varsa hedef = pos.v + (pos.v - neg.v) — pgvector avg agregası
-     * ve +/- operatörleri ŞEMA-NİTELİKLİ (M-1: search_path'e güvenilmez).
-     * Vektör matematiği istemciye inmez; bulunamayan positive/negative
-     * adlandırılmış hatadır ve kaynak id'ler sonuçtan düşer.
-     */
+    * recommend (T018, FR-023): positive/negative id kümelerinden öneri.
+    * Hedef vektör DB-İÇİ CTE'lerle türer: pos = avg(embedding of positives),
+    * negative varsa hedef = pos.v + (pos.v - neg.v) — pgvector avg agregası
+    * ve +/- operatörleri ŞEMA-NİTELİKLİ (M-1: search_path'e güvenilmez).
+    * Vektör matematiği istemciye inmez; bulunamayan positive/negative
+    * adlandırılmış hatadır ve kaynak id'ler sonuçtan düşer.
+    */
     async recommend(table, opts) {
       const positive = opts?.positive;
       if (!Array.isArray(positive) || positive.length === 0) {
@@ -1344,14 +1742,14 @@ function createOps(tx) {
       const live = await at();
       const sch = await vectorSchemaWithGuc(live);
       const bind = [];
-      const add = (x) => {
+      const add = /* @__PURE__ */ __name((x) => {
         bind.push(x);
         return `$${bind.length}`;
-      };
-      const avgSel = (ids) => {
+      }, "add");
+      const avgSel = /* @__PURE__ */ __name((ids) => {
         const inList = ids.map((x) => add(x)).join(", ");
         return cfg.chunk !== void 0 ? `SELECT ${quoteIdent(sch)}.avg(c.embedding) AS v FROM ${quoteTable(cfg.chunk.table)} c WHERE c.${quoteIdent(`parent_${cfg.pk}`)} IN (${inList}) AND c.embedding IS NOT NULL` : `SELECT ${quoteIdent(sch)}.avg(t.${quoteIdent(leg.column)}) AS v FROM ${quoteTable(table)} t WHERE t.${quoteIdent(cfg.pk)} IN (${inList}) AND t.${quoteIdent(leg.column)} IS NOT NULL`;
-      };
+      }, "avgSel");
       const targetSql = negative.length === 0 ? `WITH pos AS (${avgSel(positive)}) SELECT pos.v AS v, (pos.v IS NULL) AS pos_missing FROM pos` : `WITH pos AS (${avgSel(positive)}), neg AS (${avgSel(negative)}) SELECT (pos.v OPERATOR(${quoteIdent(sch)}.+) (pos.v OPERATOR(${quoteIdent(sch)}.-) neg.v)) AS v, (pos.v IS NULL) AS pos_missing, (neg.v IS NULL) AS neg_missing FROM pos, neg`;
       const rows = await live.unsafe(targetSql, bind);
       const r0 = rows?.[0];
@@ -1375,21 +1773,25 @@ function createOps(tx) {
         blocksPerRow: opts.blocksPerRow,
         validity: opts.validity,
         boost: opts.boost,
-        __excludeIds: [...positive, ...negative]
+        __excludeIds: [
+          ...positive,
+          ...negative
+        ]
       };
       return ops.search(table, p);
     },
     /**
-     * supersede (T021, FR-029, C-9): validity'li tabloda satırın YENİ
-     * versiyonunu TEK savepoint'te yazar — eski satır kapatılır
-     * (valid_to = now(), superseded_by = yeni pk), yeni satır eklenir, dönüş
-     * yeni satırdır. Yeni pk CLIENT'ta üretilir (row'da verilmemişse
-     * randomUUID — declared şemaların uuid().defaultRandom() standardı) ki
-     * kapatma UPDATE'i INSERT'ten ÖNCE koşabilsin: 0 satır = zaten superseded
-     * ya da yok → INSERT hiç denenmez; INSERT hatası ise savepoint'le
-     * kapatmayı da geri sarar — yarım supersede diye bir durum yoktur.
-     */
+    * supersede (T021, FR-029, C-9): validity'li tabloda satırın YENİ
+    * versiyonunu TEK savepoint'te yazar — eski satır kapatılır
+    * (valid_to = now(), superseded_by = yeni pk), yeni satır eklenir, dönüş
+    * yeni satırdır. Yeni pk CLIENT'ta üretilir (row'da verilmemişse
+    * randomUUID — declared şemaların uuid().defaultRandom() standardı) ki
+    * kapatma UPDATE'i INSERT'ten ÖNCE koşabilsin: 0 satır = zaten superseded
+    * ya da yok → INSERT hiç denenmez; INSERT hatası ise savepoint'le
+    * kapatmayı da geri sarar — yarım supersede diye bir durum yoktur.
+    */
     async supersede(table, id, row) {
+      assertNotAppendOnly("supersede", table);
       const cfg = searchConfigFor(table);
       if (cfg === null || cfg.validity !== true) {
         throw new Error(`supersede(${table}): tablo validity beyan\u0131 ta\u015F\u0131m\u0131yor (FR-029)`);
@@ -1397,24 +1799,22 @@ function createOps(tx) {
       const live = await at();
       return live.savepoint(async (sp) => {
         const newId = row[cfg.pk] ?? crypto.randomUUID();
-        const closed = await sp.unsafe(
-          `UPDATE ${quoteTable(table)} SET "valid_to" = now(), "superseded_by" = $1 WHERE ${quoteIdent(cfg.pk)} = $2 AND "valid_to" IS NULL RETURNING ${quoteIdent(cfg.pk)}`,
-          [newId, id]
-        );
+        const closed = await sp.unsafe(`UPDATE ${quoteTable(table)} SET "valid_to" = now(), "superseded_by" = $1 WHERE ${quoteIdent(cfg.pk)} = $2 AND "valid_to" IS NULL RETURNING ${quoteIdent(cfg.pk)}`, [
+          newId,
+          id
+        ]);
         if (closed.length === 0) {
           throw new Error(`supersede(${table}): id "${String(id)}" zaten superseded ya da yok (FR-029)`);
         }
-        const data = { ...row, [cfg.pk]: newId };
+        const data = {
+          ...row,
+          [cfg.pk]: newId
+        };
         const cols = Object.keys(data);
         const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
-        const rows = await sp.unsafe(
-          `INSERT INTO ${quoteTable(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) RETURNING *`,
-          asBindParams(table, cols, data, "supersede")
-        );
+        const rows = await sp.unsafe(`INSERT INTO ${quoteTable(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) RETURNING *`, asBindParams(table, cols, data, "supersede"));
         if (!rows[0]) {
-          throw new Error(
-            `supersede(${table}): INSERT sat\u0131r d\xF6nd\xFCrmedi \u2014 yazma reddedildi (b\xFCy\xFCk olas\u0131l\u0131kla bir RLS policy'si)`
-          );
+          throw new Error(`supersede(${table}): INSERT sat\u0131r d\xF6nd\xFCrmedi \u2014 yazma reddedildi (b\xFCy\xFCk olas\u0131l\u0131kla bir RLS policy'si)`);
         }
         return asTableRow(table, rows[0]);
       });
@@ -1425,61 +1825,68 @@ function createOps(tx) {
       return live.savepoint(async (sp) => cb(withTables(createOps(sp), currentSchema)));
     },
     /**
-     * Run `fn` against a handle bound to a SAVEPOINT, so a failure inside it
-     * rolls back only what that handle wrote and the request can keep writing.
-     *
-     * WHY THE HANDLE IS AN ARGUMENT. The obvious shape — `attempt(async () => {
-     * ... Database.insert(...) ... })`, with no parameter — would have to point
-     * the ambient `Database` at the savepoint for the duration, and a request is
-     * concurrent with itself: `Promise.all([Database.insert(a),
-     * Database.attempt(...)])` would put `a` inside the savepoint and roll it
-     * back with it. Silent data loss, and the same interleaving this file already
-     * refuses for `asService()`. Passing the handle makes the boundary something
-     * you can see in the code that crosses it.
-     *
-     * Postgres, not us: the savepoint is released on success and rolled back on
-     * failure by the driver, so an aborted statement inside `fn` does not poison
-     * the surrounding transaction.
-     */
+    * Run `fn` against a handle bound to a SAVEPOINT, so a failure inside it
+    * rolls back only what that handle wrote and the request can keep writing.
+    *
+    * WHY THE HANDLE IS AN ARGUMENT. The obvious shape — `attempt(async () => {
+    * ... Database.$insert(...) ... })`, with no parameter — would have to point
+    * the ambient `Database` at the savepoint for the duration, and a request is
+    * concurrent with itself: `Promise.all([Database.$insert(a),
+    * Database.$attempt(...)])` would put `a` inside the savepoint and roll it
+    * back with it. Silent data loss, and the same interleaving this file already
+    * refuses for `asService()`. Passing the handle makes the boundary something
+    * you can see in the code that crosses it.
+    *
+    * Postgres, not us: the savepoint is released on success and rolled back on
+    * failure by the driver, so an aborted statement inside `fn` does not poison
+    * the surrounding transaction.
+    */
     async attempt(fn) {
       const live = await at();
       return live.savepoint(async (sp) => fn(withTables(createOps(sp), currentSchema)));
     },
     /**
-     * Execute a whole transaction plan — what `Database.transaction(fn)` builds.
-     *
-     * WHY IT RUNS HERE. The platform used to carry a complete implementation
-     * of this at `/internal-api/db/tx`, for tenant code that ran in an isolate
-     * with no connection of its own. Running the plan there means running it on
-     * a DIFFERENT connection: a transaction would not see the uncommitted
-     * writes of the request that started it, and the two would hold separate
-     * RLS bindings of the same identity. In this stack the tenant's code and
-     * the connection share a process, so the plan runs on the request's own
-     * transaction inside one SAVEPOINT — and that surface was removed on
-     * 2026-08-15, once this was the last thing that could have called it.
-     *
-     * Until 2026-08-15 it ran NOWHERE: `runTxPlan` called `transport.txPlan` and
-     * nothing here implemented it, so a live handler answered
-     * "transport.txPlan is not a function" while every test that covered
-     * transactions passed against a mock that did implement it.
-     */
+    * Execute a whole transaction plan — what `Database.$transaction(fn)` builds.
+    *
+    * WHY IT RUNS HERE. The platform used to carry a complete implementation
+    * of this at `/internal-api/db/tx`, for tenant code that ran in an isolate
+    * with no connection of its own. Running the plan there means running it on
+    * a DIFFERENT connection: a transaction would not see the uncommitted
+    * writes of the request that started it, and the two would hold separate
+    * RLS bindings of the same identity. In this stack the tenant's code and
+    * the connection share a process, so the plan runs on the request's own
+    * transaction inside one SAVEPOINT — and that surface was removed on
+    * 2026-08-15, once this was the last thing that could have called it.
+    *
+    * Until 2026-08-15 it ran NOWHERE: `runTxPlan` called `transport.txPlan` and
+    * nothing here implemented it, so a live handler answered
+    * "transport.txPlan is not a function" while every test that covered
+    * transactions passed against a mock that did implement it.
+    */
     async txPlan(plan) {
       const live = await at();
       return live.savepoint(async (sp) => {
         const results = [];
         for (const op of plan.ops) {
           const rows = asTableRows(op.table, await runPlanOp(sp, op, results));
-          const result = { rows, rows_affected: rows.length };
+          const result = {
+            rows,
+            rows_affected: rows.length
+          };
           results.push(result);
           assertGuard(op, result);
         }
-        return { results };
+        return {
+          results
+        };
       });
     }
   };
   return ops;
 }
+__name(createOps, "createOps");
 var currentSchema = {};
+var currentRelations = /* @__PURE__ */ new Map();
 function setSchema(schemas) {
   cachedVectorSchema = null;
   cachedTrgmSchema = null;
@@ -1492,22 +1899,52 @@ function setSchema(schemas) {
       tables[qualifiedTableKey(schemaName, table.name ?? key)] = table;
     }
   }
-  currentSchema = { tables };
+  currentSchema = {
+    tables
+  };
+  currentRelations = buildRelations(schemas.map((entry) => {
+    const mod = entry;
+    const def = (mod && "default" in mod ? mod.default : mod) ?? {};
+    const tables2 = {};
+    for (const [key, t] of Object.entries(def.tables ?? {})) {
+      const table = t ?? {};
+      const columns = {};
+      for (const [cname, c] of Object.entries(table.columns ?? {})) {
+        const cd = c ?? {};
+        columns[cname] = "_def" in cd ? cd : {
+          ...cd,
+          _def: cd
+        };
+      }
+      tables2[key] = {
+        ...table,
+        name: table.name ?? key,
+        columns
+      };
+    }
+    return {
+      name: def.name ?? "public",
+      tables: tables2
+    };
+  }));
 }
+__name(setSchema, "setSchema");
 function withTables(ops, schema = currentSchema) {
-  const bind = (key) => ({
-    insert: (data) => ops.insert(key, data),
-    update: (id, data) => ops.update(key, id, data),
-    delete: (id) => ops.delete(key, id),
-    findById: (id) => ops.findById(key, id),
-    findMany: (query, opts) => ops.findMany(key, query ?? {}, opts),
-    upsert: (data, opts) => ops.upsert(key, data, opts)
-  });
+  const bind = /* @__PURE__ */ __name((key) => ({
+    insert: /* @__PURE__ */ __name((data) => ops.insert(key, data), "insert"),
+    update: /* @__PURE__ */ __name((id, data) => ops.update(key, id, data), "update"),
+    delete: /* @__PURE__ */ __name((id) => ops.delete(key, id), "delete"),
+    findById: /* @__PURE__ */ __name((id) => ops.findById(key, id), "findById"),
+    findMany: /* @__PURE__ */ __name((query, opts) => ops.findMany(key, query ?? {}, opts), "findMany"),
+    put: /* @__PURE__ */ __name((q) => ops.put(key, q.data, {
+      onConflict: q.onConflict
+    }), "put")
+  }), "bind");
   const tables = {};
   for (const key of Object.keys(schema.tables ?? {})) {
     if (!key.includes(".")) tables[key] = bind(key);
   }
-  const schemaOf = (name) => {
+  const schemaOf = /* @__PURE__ */ __name((name) => {
     const out = {};
     const prefix = `${name}.`;
     for (const key of Object.keys(schema.tables ?? {})) {
@@ -1517,25 +1954,31 @@ function withTables(ops, schema = currentSchema) {
         out[key.slice(prefix.length)] = bind(key);
       }
     }
-    return { tables: out };
-  };
+    return {
+      tables: out
+    };
+  }, "schemaOf");
   const base = /* @__PURE__ */ Object.create(null);
-  return Object.assign(base, ops, { tables, schema: schemaOf });
+  return Object.assign(base, ops, {
+    tables,
+    schema: schemaOf
+  });
 }
+__name(withTables, "withTables");
 var SERVICE_LOCK_TIMEOUT = "5s";
 function isAbortedTransaction(e) {
   const message = String(e?.message ?? "");
   return sqlstateOf(e) === "25P02" || /current transaction is aborted/i.test(message);
 }
+__name(isAbortedTransaction, "isAbortedTransaction");
 function assertHasPredicate(whereSql, op, table) {
   if (whereSql.trim().length > 0) return;
-  throw new Error(
-    `${op}(${table}): the filter compiled to no condition, so this would have written EVERY row. An empty filter \u2014 or an operator object with no operators in it, like { col: {} } \u2014 is refused. Name a condition.`
-  );
+  throw new Error(`${op}(${table}): the filter compiled to no condition, so this would have written EVERY row. An empty filter \u2014 or an operator object with no operators in it, like { col: {} } \u2014 is refused. Name a condition.`);
 }
+__name(assertHasPredicate, "assertHasPredicate");
 function sqlstateOf(e) {
   const err = e;
-  const isState = (v) => typeof v === "string" && /^[0-9A-Z]{5}$/.test(v);
+  const isState = /* @__PURE__ */ __name((v) => typeof v === "string" && /^[0-9A-Z]{5}$/.test(v), "isState");
   if (isState(err?.code)) return err.code;
   if (isState(err?.errno)) return err.errno;
   if (typeof err?.errno === "number") {
@@ -1544,46 +1987,48 @@ function sqlstateOf(e) {
   }
   return void 0;
 }
+__name(sqlstateOf, "sqlstateOf");
 function isForeignKeyViolation(e) {
   return sqlstateOf(e) === "23503";
 }
+__name(isForeignKeyViolation, "isForeignKeyViolation");
 function isUniqueViolation(e) {
-  return sqlstateOf(e) === "23505";
+  return sqlstateOf(e) === "23505" || UniqueViolation.is(e);
 }
+__name(isUniqueViolation, "isUniqueViolation");
 function constraintOf(e) {
   const named = e?.constraint;
   if (typeof named === "string" && named.length > 0) return named;
   const message = String(e?.message ?? "");
   return /violates unique constraint "([^"]+)"/.exec(message)?.[1] ?? "";
 }
+__name(constraintOf, "constraintOf");
 function isLockTimeout(e) {
   const message = String(e?.message ?? "");
   return sqlstateOf(e) === "55P03" || /lock timeout/i.test(message);
 }
+__name(isLockTimeout, "isLockTimeout");
 function diagnosingDriver(sql, surface = "service") {
-  const original = (e) => String(e?.message ?? e);
-  const explain = (e) => {
+  const original = /* @__PURE__ */ __name((e) => String(e?.message ?? e), "original");
+  const explain = /* @__PURE__ */ __name((e) => {
     if (isAbortedTransaction(e)) {
-      return new Error(
-        `This request cannot write any more: an earlier write in it failed, and a request runs in ONE Postgres transaction, so every statement after the failure is refused. Nothing here is retryable in place. Wrap a write you expect to fail in \`Database.attempt(async (tx) => \u2026)\` \u2014 it takes a SAVEPOINT, so only that write rolls back \u2014 or use \`Database.tables.<t>.upsert(data, { onConflict: [...] })\` when the failure you were bracing for is a duplicate row. (${original(e)})`
-      );
+      return new Error(`This request cannot write any more: an earlier write in it failed, and a request runs in ONE Postgres transaction, so every statement after the failure is refused. Nothing here is retryable in place. Wrap a write you expect to fail in \`Database.$attempt(async (tx) => \u2026)\` \u2014 it takes a SAVEPOINT, so only that write rolls back \u2014 or use \`Database.public.<t>.upsert(data, { onConflict: [...] })\` when the failure you were bracing for is a duplicate row. (${original(e)})`);
     }
     if (isUniqueViolation(e)) {
       return markEngineRaised(new UniqueViolation(constraintOf(e)));
     }
+    const state = sqlstateOf(e);
+    if (state === "40001") return markEngineRaised(new SerializationFailure(state));
+    if (state === "40P01") return markEngineRaised(new DeadlockDetected(state));
     if (surface === "service" && isForeignKeyViolation(e)) {
-      return new Error(
-        `Database.asService() hit a foreign key with nothing to point at. It runs in its OWN transaction on its OWN connection, so a row this request wrote through \`Database.*\` is not visible to it until the request commits \u2014 and the request cannot commit until the handler returns. If the row it needs is one this request just created, do both writes on ONE surface. (${original(e)})`
-      );
+      return new Error(`Database.$asService() hit a foreign key with nothing to point at. It runs in its OWN transaction on its OWN connection, so a row this request wrote through \`Database.*\` is not visible to it until the request commits \u2014 and the request cannot commit until the handler returns. If the row it needs is one this request just created, do both writes on ONE surface. (${original(e)})`);
     }
     if (isLockTimeout(e)) {
-      return new Error(
-        `Database.asService() waited too long for a row lock. It runs in its OWN transaction, so a row this request already wrote through Database.* is locked against it until the request commits \u2014 a wait that cannot end. Do that row's work on one surface or the other. (${original(e)})`
-      );
+      return new Error(`Database.$asService() waited too long for a row lock. It runs in its OWN transaction, so a row this request already wrote through Database.* is locked against it until the request commits \u2014 a wait that cannot end. Do that row's work on one surface or the other. (${original(e)})`);
     }
     return e;
-  };
-  const wrapTx = (tx) => ({
+  }, "explain");
+  const wrapTx = /* @__PURE__ */ __name((tx) => ({
     async unsafe(text, params) {
       try {
         return await tx.unsafe(text, params);
@@ -1594,30 +2039,30 @@ function diagnosingDriver(sql, surface = "service") {
     savepoint(cb) {
       return tx.savepoint((sp) => cb(wrapTx(sp)));
     }
-  });
+  }), "wrapTx");
   return {
-    unsafe: (text, params) => sql.unsafe(text, params),
-    begin: (cb) => sql.begin((tx) => cb(wrapTx(tx)))
+    unsafe: /* @__PURE__ */ __name((text, params) => sql.unsafe(text, params), "unsafe"),
+    begin: /* @__PURE__ */ __name((cb) => sql.begin((tx) => cb(wrapTx(tx))), "begin")
   };
 }
+__name(diagnosingDriver, "diagnosingDriver");
 function createRequestDatabase(sql, identity) {
   const tx = createLazyTransaction(diagnosingDriver(sql, "user"), identity.role, identity.claimsJson);
   let serviceTx = null;
   let serviceClient = null;
-  const asService = () => {
+  const asService = /* @__PURE__ */ __name(() => {
     if (serviceClient === null) {
-      serviceTx = createLazyTransaction(
-        diagnosingDriver(sql, "service"),
-        identity.serviceRole,
-        identity.claimsJson,
-        { lockTimeout: SERVICE_LOCK_TIMEOUT }
-      );
+      serviceTx = createLazyTransaction(diagnosingDriver(sql, "service"), identity.serviceRole, identity.claimsJson, {
+        lockTimeout: SERVICE_LOCK_TIMEOUT
+      });
       serviceClient = withTables(createOps(serviceTx));
     }
     return serviceClient;
-  };
+  }, "asService");
   return {
-    client: Object.assign(withTables(createOps(tx)), { asService }),
+    client: Object.assign(withTables(createOps(tx)), {
+      asService
+    }),
     async commit() {
       await tx.commit();
       await serviceTx?.commit();
@@ -1628,7 +2073,11 @@ function createRequestDatabase(sql, identity) {
     }
   };
 }
-var Args = class {
+__name(createRequestDatabase, "createRequestDatabase");
+var Args = class Args2 {
+  static {
+    __name(this, "Args");
+  }
   values = [];
   bind(value) {
     this.values.push(value);
@@ -1636,17 +2085,37 @@ var Args = class {
   }
 };
 function isRef(v) {
-  return typeof v === "object" && v !== null && "$ref" in v;
+  return isPlanRef(v);
+}
+__name(isRef, "isRef");
+function refUnresolvedMessage(ref, results) {
+  if (ref.op < 0 || ref.op >= results.length) {
+    return `transaction plan: referans ${ref.op} numaral\u0131 i\u015Fleme bak\u0131yor ama planda ${results.length} i\u015Flem var (0\u2026${results.length - 1}). Referans yaln\u0131z KEND\u0130NDEN \xD6NCEK\u0130 bir i\u015Flemin sat\u0131r\u0131na bakabilir.`;
+  }
+  const row = results[ref.op]?.rows[0];
+  if (!row) {
+    return `transaction plan: ${ref.op} numaral\u0131 i\u015Flem H\u0130\xC7 SATIR d\xF6nd\xFCrmedi, o y\xFCzden "${ref.field}" okunam\u0131yor. Bir referans okunacak sat\u0131r\u0131n var oldu\u011Funu garanti etmez \u2014 \xF6nce beklentiyi bildirin (\`.expectOne(err)\`).`;
+  }
+  return `transaction plan: ${ref.op} numaral\u0131 i\u015Flemin sat\u0131r\u0131nda "${ref.field}" kolonu yok (d\xF6nen kolonlar: ${Object.keys(row).join(", ")}).`;
 }
+__name(refUnresolvedMessage, "refUnresolvedMessage");
+function refuseUnbrandedRef(v, where) {
+  if (looksLikeUnbrandedPlanRef(v)) {
+    throw new Error(`${where}: bir plan referans\u0131 TAKL\u0130D\u0130 ald\u0131 ({ $ref: \u2026 }) \u2014 bu nesne bu plan\u0131n builder'\u0131 taraf\u0131ndan \xFCretilmemi\u015F. Referans yaln\u0131z kendi kodunuzda, \xF6nceki bir i\u015Flemin sat\u0131r\u0131ndan okunarak kurulur (\xF6r. insert(...).expectOne(err).id); istek g\xF6vdesinden gelen bir filtre referans TA\u015EIYAMAZ.`);
+  }
+}
+__name(refuseUnbrandedRef, "refuseUnbrandedRef");
 function isExpr(v) {
   return typeof v === "object" && v !== null && "$expr" in v;
 }
+__name(isExpr, "isExpr");
 function renderValue(value, column, args, results, vectorCols, transforms) {
+  refuseUnbrandedRef(value, `transaction plan (${column})`);
   if (isRef(value)) {
     const source = results[value.$ref.op];
     const row = source?.rows[0];
     if (!row || !(value.$ref.field in row)) {
-      throw Object.assign(new Error(`op ${value.$ref.op} has no column "${value.$ref.field}" to reference`), {
+      throw Object.assign(new Error(refUnresolvedMessage(value.$ref, results)), {
         error_code: "tx_ref_unresolved"
       });
     }
@@ -1660,16 +2129,50 @@ function renderValue(value, column, args, results, vectorCols, transforms) {
   }
   return bindMaybeVector(args, column, vectorCols, value, transforms);
 }
-function renderWhere(where, args, results) {
-  const cols = Object.keys(where ?? {});
-  if (cols.length === 0) return "";
-  const terms = cols.map((c) => {
-    const v = where[c];
-    if (v === null) return `${quoteIdent(c)} IS NULL`;
-    return `${quoteIdent(c)} = ${renderValue(v, c, args, results)}`;
-  });
-  return ` WHERE ${terms.join(" AND ")}`;
+__name(renderValue, "renderValue");
+function resolveRefsDeep(value, results) {
+  refuseUnbrandedRef(value, "transaction plan filtresi");
+  if (isRef(value)) {
+    const source = results[value.$ref.op];
+    const row = source?.rows[0];
+    if (!row || !(value.$ref.field in row)) {
+      throw Object.assign(new Error(refUnresolvedMessage(value.$ref, results)), {
+        error_code: "tx_ref_unresolved"
+      });
+    }
+    return row[value.$ref.field];
+  }
+  if (Array.isArray(value)) return value.map((v) => resolveRefsDeep(v, results));
+  if (value !== null && typeof value === "object" && !isColRef(value) && !isSqlFragment(value) && !isExpr(value) && !(value instanceof Date)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value)) {
+      out[k] = resolveRefsDeep(v, results);
+    }
+    return out;
+  }
+  return value;
+}
+__name(resolveRefsDeep, "resolveRefsDeep");
+function renderWhere(table, where, args, results) {
+  return planWhere(table, where, args, results).sql;
+}
+__name(renderWhere, "renderWhere");
+function planWhere(table, where, args, results) {
+  if (where === void 0 || Object.keys(where).length === 0) {
+    return {
+      sql: "",
+      resolved: {}
+    };
+  }
+  const resolved = resolveRefsDeep(where, results);
+  const known = schemaColumns(table);
+  const bare = compileWhereBare(table, known, resolved, (v) => args.bind(v), "transaction plan");
+  return {
+    sql: bare === "" ? "" : ` AND ${bare}`,
+    resolved
+  };
 }
+__name(planWhere, "planWhere");
 function bindMaybeVector(args, column, vectorCols, value, transforms) {
   if (column !== void 0 && vectorCols?.has(column) && Array.isArray(value)) {
     return args.bind(toVectorLiteral(value));
@@ -1680,11 +2183,12 @@ function bindMaybeVector(args, column, vectorCols, value, transforms) {
   }
   return args.bind(value);
 }
+__name(bindMaybeVector, "bindMaybeVector");
 async function runPlanOp(sp, op, results) {
   const opVectorCols = vectorColumnsOf(currentSchema, op.table);
   const opTransforms = transformsOf(currentSchema, op.table);
   const args = new Args();
-  const table = quoteIdent(op.table);
+  const table = quoteTable(op.table);
   let sql;
   switch (op.op) {
     case "insert": {
@@ -1694,6 +2198,7 @@ async function runPlanOp(sp, op, results) {
       break;
     }
     case "upsert": {
+      assertNotAppendOnly("put", op.table);
       const cols = Object.keys(op.values ?? {});
       const conflict = op.onConflict ?? [];
       if (cols.length === 0 || conflict.length === 0) {
@@ -1701,9 +2206,7 @@ async function runPlanOp(sp, op, results) {
           error_code: "tx_bad_upsert"
         });
       }
-      const rendered = cols.map(
-        (c) => renderValue(op.values[c], c, args, results, opVectorCols, opTransforms)
-      );
+      const rendered = cols.map((c) => renderValue(op.values[c], c, args, results, opVectorCols, opTransforms));
       sql = `INSERT INTO ${table} (${cols.map(quoteIdent).join(", ")}) VALUES (${rendered.join(", ")}) ${onConflictTail(cols, conflict, "update")} RETURNING *`;
       break;
     }
@@ -1711,31 +2214,44 @@ async function runPlanOp(sp, op, results) {
       const rows = op.rows ?? [];
       if (rows.length === 0 || !rows[0]) return [];
       const cols = Object.keys(rows[0]);
-      const tuples = rows.map(
-        (r) => `(${cols.map((c) => renderValue(r[c], c, args, results, opVectorCols, opTransforms)).join(", ")})`
-      );
+      const tuples = rows.map((r) => `(${cols.map((c) => renderValue(r[c], c, args, results, opVectorCols, opTransforms)).join(", ")})`);
       const conflictCols = op.onConflict ?? [];
       const tail = op.action !== void 0 && conflictCols.length > 0 ? ` ${onConflictTail(cols, conflictCols, op.action)}` : "";
       sql = `INSERT INTO ${table} (${cols.map(quoteIdent).join(", ")}) VALUES ${tuples.join(", ")}${tail} RETURNING *`;
       break;
     }
     case "update": {
+      assertNotAppendOnly("updateWhere", op.table);
       const cols = Object.keys(op.set ?? {});
       if (cols.length === 0) throw new Error(`update ${op.table}: nothing to set`);
-      const assignments = cols.map(
-        (c) => `${quoteIdent(c)} = ${renderValue(op.set[c], c, args, results, opVectorCols, opTransforms)}`
-      );
-      sql = `UPDATE ${table} SET ${assignments.join(", ")}${renderWhere(op.where, args, results)} RETURNING *`;
+      const knownSet = schemaColumns(op.table);
+      for (const c of cols) {
+        if (knownSet !== null && !knownSet.has(c)) {
+          throw new Error(`transaction plan (${op.table}): set kolonu "${c}" tabloda yok`);
+        }
+      }
+      const assignments = cols.map((c) => `${quoteIdent(c)} = ${renderValue(op.set[c], c, args, results, opVectorCols, opTransforms)}`);
+      const planned = planWhere(op.table, op.where, args, results);
+      const planPk = primaryKeyOf(op.table);
+      sql = isSinglePkEquality(planned.resolved, planPk) || planPk === null ? `UPDATE ${table} AS t SET ${assignments.join(", ")} WHERE true${planned.sql} RETURNING t.*` : `WITH locked AS (SELECT t.${quoteIdent(planPk)} FROM ${table} t WHERE true${planned.sql} ORDER BY t.${quoteIdent(planPk)} FOR NO KEY UPDATE) UPDATE ${table} AS t SET ${assignments.join(", ")} FROM locked WHERE t.${quoteIdent(planPk)} = locked.${quoteIdent(planPk)} RETURNING t.*`;
       break;
     }
     case "delete": {
-      sql = `DELETE FROM ${table}${renderWhere(op.where, args, results)} RETURNING *`;
+      assertNotAppendOnly("deleteWhere", op.table);
+      sql = `DELETE FROM ${table} AS t WHERE true${renderWhere(op.table, op.where, args, results)} RETURNING t.*`;
       break;
     }
     case "select": {
-      const limit = op.limit !== void 0 ? ` LIMIT ${Number(op.limit)}` : "";
+      let limit = "";
+      if (op.limit !== void 0) {
+        const n = Number(op.limit);
+        if (!Number.isInteger(n) || n < 0) {
+          throw new Error(`transaction plan (${op.table}): limit bir tam say\u0131 olmal\u0131, "${String(op.limit)}" al\u0131nd\u0131`);
+        }
+        limit = ` LIMIT ${n}`;
+      }
       const lock = op.lock === "update" ? " FOR UPDATE" : "";
-      sql = `SELECT * FROM ${table}${renderWhere(op.where, args, results)}${limit}${lock}`;
+      sql = `SELECT t.* FROM ${table} t WHERE true${renderWhere(op.table, op.where, args, results)}${limit}${lock}`;
       break;
     }
     default:
@@ -1743,6 +2259,7 @@ async function runPlanOp(sp, op, results) {
   }
   return await sp.unsafe(sql, args.values);
 }
+__name(runPlanOp, "runPlanOp");
 function assertGuard(op, result) {
   const guard = op.guard;
   if (!guard) return;
@@ -1754,6 +2271,7 @@ function assertGuard(op, result) {
     slot: guard.slot
   });
 }
+__name(assertGuard, "assertGuard");
 
 // src/engine/router.ts
 var ROOM_META = /* @__PURE__ */ Symbol.for("palbase.backend.room");
@@ -1761,7 +2279,8 @@ var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta
 function toSegments(path) {
   return path.split("/").filter(Boolean).map((s) => s.startsWith("{") && s.endsWith("}") ? `:${s.slice(1, -1)}` : s);
 }
-function buildRouteTable(controllers) {
+__name(toSegments, "toSegments");
+function buildRouteTable(controllers, container) {
   const table = [];
   for (const Ctrl of controllers) {
     if (Ctrl[ROOM_META] !== void 0) continue;
@@ -1771,12 +2290,9 @@ function buildRouteTable(controllers) {
     const routes = getRoutes(Ctrl);
     if (routes.length === 0) {
       const name = Ctrl.name ?? "<anonymous>";
-      throw new Error(
-        `controller ${name} collected zero routes. Either it declares no @Get/@Post/\u2026 , or its decorator metadata was erased at build time \u2014 check that the bundle was compiled with experimentalDecorators enabled.`
-      );
+      throw new Error(`controller ${name} collected zero routes. Either it declares no @Get/@Post/\u2026 , or its decorator metadata was erased at build time \u2014 check that the bundle was compiled with experimentalDecorators enabled.`);
     }
-    assertZeroArgConstructor(Ctrl, "controller");
-    const instance = new ctor();
+    const instance = container.get(Ctrl);
     for (const r of routes) {
       const full = `${basePath}${r.subpath ?? ""}` || "/";
       table.push({
@@ -1794,6 +2310,7 @@ function buildRouteTable(controllers) {
   }
   return table;
 }
+__name(buildRouteTable, "buildRouteTable");
 function matchRoute(table, method, pathname) {
   const parts = pathname.split("/").filter(Boolean);
   for (const entry of table) {
@@ -1814,10 +2331,222 @@ function matchRoute(table, method, pathname) {
         break;
       }
     }
-    if (ok) return { entry, params };
+    if (ok) return {
+      entry,
+      params
+    };
   }
   return null;
 }
+__name(matchRoute, "matchRoute");
+
+// src/engine/attest.ts
+var HEADER_DEVICE_ID = "x-palbase-device-id";
+var HEADER_PAYLOAD = "x-palbase-attest-payload";
+var HEADER_SIGNATURE = "x-palbase-attest-signature";
+var HEADER_CHALLENGE = "x-palbase-attest-challenge";
+var HEADER_CAPABLE = "x-palbase-attest-capable";
+var HEADER_INSTALLATION = "x-palbase-installation";
+var HEADER_ANCHOR = "x-palbase-installation-anchor";
+var DEFAULT_POLICY_TTL_MS = 3e4;
+var DEFAULT_REQUEST_TIMEOUT_MS = 2e3;
+async function bodyDigest(body) {
+  if (!body || body.byteLength === 0) return "";
+  const bytes = new Uint8Array(new ArrayBuffer(body.byteLength));
+  bytes.set(body);
+  const buf = await crypto.subtle.digest("SHA-256", bytes);
+  return btoa(String.fromCharCode(...new Uint8Array(buf)));
+}
+__name(bodyDigest, "bodyDigest");
+function readCapable(req) {
+  const v = req.headers.get(HEADER_CAPABLE);
+  return v === "yes" || v === "no" ? v : "unknown";
+}
+__name(readCapable, "readCapable");
+function createAttestGate(deps) {
+  const doFetch = deps.fetchImpl ?? fetch;
+  const ttl = deps.policyTtlMs ?? DEFAULT_POLICY_TTL_MS;
+  const policyTimeoutMs = deps.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+  let cachedMode = "off";
+  let cachedAt = -Infinity;
+  async function mode() {
+    if (Date.now() - cachedAt < ttl) return cachedMode;
+    try {
+      const res = await doFetch(`${deps.moduleBaseUrl}/admin/attest/devices/attest-policy`, {
+        headers: {
+          apikey: deps.serviceRoleKey
+        },
+        signal: AbortSignal.timeout(policyTimeoutMs)
+      });
+      if (!res.ok) throw new Error(`attest-policy ${res.status}`);
+      const body = await res.json();
+      cachedMode = body.mode === "monitor" || body.mode === "enforce" ? body.mode : "off";
+      cachedAt = Date.now();
+    } catch {
+    }
+    return cachedMode;
+  }
+  __name(mode, "mode");
+  return /* @__PURE__ */ __name(async function gate(req, body, _ctx) {
+    const m = await mode();
+    if (m === "off") {
+      return {
+        outcome: "pass",
+        reason: "",
+        device: null,
+        observation: null,
+        nextChallenge: null
+      };
+    }
+    const deviceId = req.headers.get(HEADER_DEVICE_ID) ?? "";
+    const payload = req.headers.get(HEADER_PAYLOAD) ?? "";
+    const signature = req.headers.get(HEADER_SIGNATURE) ?? "";
+    const hasEvidence = deviceId !== "" && payload !== "" && signature !== "";
+    const observation = {
+      capable: readCapable(req),
+      attested: false,
+      installationId: req.headers.get(HEADER_INSTALLATION) || null
+    };
+    if (m === "monitor") {
+      observation.attested = hasEvidence;
+      return {
+        outcome: "pass",
+        reason: "",
+        device: null,
+        observation,
+        nextChallenge: null
+      };
+    }
+    const url = new URL(req.url);
+    let verdict;
+    try {
+      const res = await doFetch(`${deps.moduleBaseUrl}/admin/attest/devices/assert`, {
+        method: "POST",
+        headers: {
+          apikey: deps.serviceRoleKey,
+          "content-type": "application/json"
+        },
+        // A HUNG palauth must not become a hung tenant. Without this, a
+        // process that accepts the connection and never answers holds every
+        // request open until the client gives up — the gate would take the
+        // whole stack down while claiming to protect it.
+        signal: AbortSignal.timeout(policyTimeoutMs),
+        body: JSON.stringify({
+          installation_id: req.headers.get(HEADER_ANCHOR) ?? "",
+          device_id: deviceId,
+          challenge: req.headers.get(HEADER_CHALLENGE) ?? "",
+          payload,
+          signature,
+          method: req.method,
+          // pathname + search, NOT pathname alone.
+          //
+          // The client signs the path string it was given, and that string can
+          // carry a query — the transport splits and reattaches one on purpose.
+          // Recomputing from pathname alone would drop the query from the
+          // signed definition, which breaks it BOTH ways: an attested call
+          // carrying a query would fail to verify, and a captured assertion
+          // could be replayed against the same route with different query
+          // parameters, which is exactly the substitution the binding exists to
+          // prevent.
+          path: url.pathname + url.search,
+          body_sha256: await bodyDigest(body)
+        })
+      });
+      if (!res.ok) throw new Error(`assert ${res.status}`);
+      verdict = await res.json();
+    } catch {
+      return {
+        outcome: "reject",
+        reason: "app_attest_required",
+        device: null,
+        observation,
+        nextChallenge: null
+      };
+    }
+    if (!verdict.ok) {
+      const reason = verdict.reason === "assertion_invalid" || verdict.reason === "assertion_stale" ? verdict.reason : "app_attest_required";
+      return {
+        outcome: "reject",
+        reason,
+        device: null,
+        observation,
+        nextChallenge: verdict.next_challenge || null
+      };
+    }
+    observation.attested = true;
+    return {
+      outcome: "pass",
+      reason: "",
+      device: {
+        installationId: "",
+        authDeviceId: deviceId,
+        platform: "ios",
+        assurance: "attested"
+      },
+      observation,
+      nextChallenge: verdict.next_challenge || null
+    };
+  }, "gate");
+}
+__name(createAttestGate, "createAttestGate");
+function createObservationSink(deps) {
+  const doFetch = deps.fetchImpl ?? fetch;
+  const maxBatch = deps.maxBatch ?? 1e3;
+  const intervalMs = deps.intervalMs ?? 1e4;
+  let buffer = [];
+  let inFlight = Promise.resolve();
+  const timer = setInterval(() => {
+    void flush();
+  }, intervalMs);
+  timer.unref?.();
+  function bucketsOf(batch) {
+    const counts = {
+      capable: 0,
+      incapable: 0,
+      unknown: 0,
+      no_sdk: 0
+    };
+    for (const o of batch) {
+      if (o.attested || o.capable === "yes") counts.capable += 1;
+      else if (o.capable === "no") counts.incapable += 1;
+      else if (o.installationId) counts.unknown += 1;
+      else counts.no_sdk += 1;
+    }
+    return counts;
+  }
+  __name(bucketsOf, "bucketsOf");
+  async function flush() {
+    if (buffer.length === 0) return;
+    const batch = buffer;
+    buffer = [];
+    inFlight = (async () => {
+      try {
+        await doFetch(`${deps.moduleBaseUrl}/admin/attest/devices/observations`, {
+          method: "POST",
+          headers: {
+            apikey: deps.serviceRoleKey,
+            "content-type": "application/json"
+          },
+          body: JSON.stringify(bucketsOf(batch))
+        });
+      } catch {
+      }
+    })();
+    await inFlight;
+  }
+  __name(flush, "flush");
+  return {
+    record(o) {
+      buffer.push(o);
+      if (buffer.length >= maxBatch) void flush();
+    },
+    flush,
+    stop() {
+      clearInterval(timer);
+    }
+  };
+}
+__name(createObservationSink, "createObservationSink");
 
 // src/engine/upload.ts
 var AUTHORIZE_PATH = "/__palbase/upload/authorize";
@@ -1825,10 +2554,12 @@ var SIGNATURE_HEADER = "x-palbase-upload-signature";
 function renderPath(template, tokens) {
   return template.replaceAll("{userId}", sanitizeSegment(tokens.userId ?? "anonymous")).replaceAll("{uploadId}", sanitizeSegment(tokens.uploadId)).replaceAll("{filename}", sanitizeSegment(tokens.filename ?? "file"));
 }
+__name(renderPath, "renderPath");
 function sanitizeSegment(raw) {
   const cleaned = raw.replace(/[\x00-\x1F\x7F]/g, "").replace(/[/\\]/g, "-").replace(/\.{2,}/g, ".").replace(/^\.+/, "").trim();
   return cleaned === "" ? "file" : cleaned.slice(0, 200);
 }
+__name(sanitizeSegment, "sanitizeSegment");
 function grantFor(entry, ctx, bucketLimits) {
   const cfg = entry?.meta?.options?.uploadConfig;
   if (!cfg) return null;
@@ -1844,12 +2575,16 @@ function grantFor(entry, ctx, bucketLimits) {
     ownerUid: ctx.userId ?? null
   };
 }
+__name(grantFor, "grantFor");
 var CompletionLedger = class {
-  constructor(capacity = 1024) {
-    this.capacity = capacity;
+  static {
+    __name(this, "CompletionLedger");
   }
   capacity;
   seen = /* @__PURE__ */ new Map();
+  constructor(capacity = 1024) {
+    this.capacity = capacity;
+  }
   recall(uploadId) {
     return this.seen.get(uploadId);
   }
@@ -1874,6 +2609,7 @@ function verifySignature(presented, expected) {
   }
   return diff === 0;
 }
+__name(verifySignature, "verifySignature");
 
 // src/engine/sse.ts
 var SSE_CONTENT_TYPE = "text/event-stream";
@@ -1882,12 +2618,16 @@ function encodeFrame(value) {
 
 `;
 }
+__name(encodeFrame, "encodeFrame");
 function encodeErrorFrame(requestId) {
   return `event: error
-data: ${JSON.stringify({ requestId })}
+data: ${JSON.stringify({
+    requestId
+  })}
 
 `;
 }
+__name(encodeErrorFrame, "encodeErrorFrame");
 function makeSseWriter(opts) {
   let begun = false;
   let chain = Promise.resolve();
@@ -1909,6 +2649,7 @@ function makeSseWriter(opts) {
     }
   };
 }
+__name(makeSseWriter, "makeSseWriter");
 
 // src/engine/fence.ts
 var SECRET_ENV = [
@@ -1929,8 +2670,12 @@ function scrubSecrets(env) {
     removed.push(name);
   }
   for (const name of Object.keys(env)) if (name.startsWith("PALBASE_VAR_")) kept.push(name);
-  return { removed, kept };
+  return {
+    removed,
+    kept
+  };
 }
+__name(scrubSecrets, "scrubSecrets");
 function hostAllowed(host, allow) {
   const h = host.toLowerCase();
   for (const raw of allow) {
@@ -1943,39 +2688,49 @@ function hostAllowed(host, allow) {
   }
   return false;
 }
+__name(hostAllowed, "hostAllowed");
 function installEgressFence(policy) {
   const original = globalThis.fetch.bind(globalThis);
   const declared = policy.allow.length > 0;
   const platform = (policy.alwaysAllow ?? []).map((h) => h.toLowerCase()).filter(Boolean);
   if (!declared && policy.whenUndeclared === "allow") return original;
-  const fenced = async (input, init) => {
+  const fenced = /* @__PURE__ */ __name(async (input, init) => {
     const url = typeof input === "string" ? new URL(input) : input instanceof URL ? input : new URL(input.url);
     if (platform.includes(url.hostname.toLowerCase())) return original(input, init);
     if (!declared || !hostAllowed(url.hostname, policy.allow)) {
-      throw new Error(
-        `egress denied: ${url.hostname} is not in this backend's declared allowlist. Add it to config/egress.ts and deploy.`
-      );
+      throw new Error(`egress denied: ${url.hostname} is not in this backend's declared allowlist. Add it to config/egress.ts and deploy.`);
     }
     if (policy.timeoutMs > 0) {
       const controller = new AbortController();
       const timer = setTimeout(() => controller.abort(), policy.timeoutMs);
       try {
-        return await original(input, { ...init, signal: init?.signal ?? controller.signal });
+        return await original(input, {
+          ...init,
+          signal: init?.signal ?? controller.signal
+        });
       } finally {
         clearTimeout(timer);
       }
     }
     return original(input, init);
-  };
+  }, "fenced");
   globalThis.fetch = fenced;
   return original;
 }
+__name(installEgressFence, "installEgressFence");
 
 // src/engine/index.ts
-var JSON_HEADERS = { "content-type": "application/json" };
+var MAX_BODY_BYTES = 10 * 1024 * 1024;
+var JSON_HEADERS = {
+  "content-type": "application/json"
+};
 function fieldErrors(err) {
-  return err.issues.map((i) => ({ field: i.path.join("."), message: i.message }));
+  return err.issues.map((i) => ({
+    field: i.path.join("."),
+    message: i.message
+  }));
 }
+__name(fieldErrors, "fieldErrors");
 function headersFor(raw, schema) {
   const shape = schema.shape;
   if (typeof shape !== "object" || shape === null) return raw;
@@ -1985,53 +2740,92 @@ function headersFor(raw, schema) {
     if (lower === declared) continue;
     const value = raw[lower];
     if (value === void 0) continue;
-    aliased ??= { ...raw };
+    aliased ??= {
+      ...raw
+    };
     aliased[declared] = value;
   }
   return aliased ?? raw;
 }
+__name(headersFor, "headersFor");
 function envelope(error, description, status, requestId, extra) {
-  return new Response(
-    JSON.stringify({ error, error_description: description, status, request_id: requestId, ...extra }),
-    { status, headers: JSON_HEADERS }
-  );
+  return new Response(JSON.stringify({
+    error,
+    error_description: description,
+    status,
+    request_id: requestId,
+    ...extra
+  }), {
+    status,
+    headers: JSON_HEADERS
+  });
 }
+__name(envelope, "envelope");
 function unavailable(name) {
-  throw new Error(
-    `${name} is unavailable. Either this backend was started without module clients (set MODULE_BASE_URL and the API keys so the engine can reach the module surface), or ${name} is not one of the modules this backend provides.`
-  );
+  throw new Error(`${name} is unavailable. Either this backend was started without module clients (set MODULE_BASE_URL and the API keys so the engine can reach the module surface), or ${name} is not one of the modules this backend provides.`);
 }
+__name(unavailable, "unavailable");
 function stubModule(name) {
-  return new Proxy(
-    {},
-    {
-      get: () => unavailable(name),
-      apply: () => unavailable(name)
-    }
-  );
+  return new Proxy({}, {
+    get: /* @__PURE__ */ __name(() => unavailable(name), "get"),
+    apply: /* @__PURE__ */ __name(() => unavailable(name), "apply")
+  });
 }
+__name(stubModule, "stubModule");
 async function defaultSqlDriver(config) {
   const g = globalThis;
   if (!g.Bun?.SQL) {
-    throw new BootRefused(
-      [],
-      "boot refused: no SQL driver. Running outside Bun means the driver must be supplied \u2014 pass `sql` to createApp()."
-    );
+    throw new BootRefused([], "boot refused: no SQL driver. Running outside Bun means the driver must be supplied \u2014 pass `sql` to createApp().");
   }
-  return new g.Bun.SQL({ url: config.databaseUrl, max: config.poolMax });
+  return new g.Bun.SQL({
+    url: config.databaseUrl,
+    max: config.poolMax
+  });
 }
-var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([400, 401, 403, 404, 409, 429]);
+__name(defaultSqlDriver, "defaultSqlDriver");
+var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([
+  400,
+  401,
+  403,
+  404,
+  409,
+  429
+]);
 async function createApp(opts) {
   const { config, controllers } = opts;
-  setSchema(opts.schemas ?? []);
-  setSecretReader(opts.secretReader ?? null);
-  const routes = buildRouteTable(controllers);
+  const container = buildContainer();
+  let released = false;
+  const liveContainer = {
+    get(t) {
+      if (released) {
+        throw new Error("this app has shut down \u2014 its container no longer resolves. A class resolved here would hold a closed database pool.");
+      }
+      return container.get(t);
+    },
+    owned: container.owned,
+    pressure: container.pressure
+  };
+  assertNoOrphanEntryPoints(controllers, container.owned);
+  const routes = buildRouteTable(controllers, liveContainer);
   if (routes.length === 0) {
     throw new BootRefused([], "boot refused: zero endpoints collected \u2014 nothing would answer.");
   }
   const sql = opts.sql ?? await defaultSqlDriver(config);
   await sql.unsafe("select 1");
-  const auth = new AuthVerifier({ jwksUrl: config.authJwksUrl, issuer: config.authIssuer });
+  setSchema(opts.schemas ?? []);
+  setSecretReader(opts.secretReader ?? null);
+  const auth = new AuthVerifier({
+    jwksUrl: config.authJwksUrl,
+    issuer: config.authIssuer
+  });
+  const attestGate = createAttestGate({
+    moduleBaseUrl: config.moduleBaseUrl,
+    serviceRoleKey: config.serviceRoleKey
+  });
+  const observations = createObservationSink({
+    moduleBaseUrl: config.moduleBaseUrl,
+    serviceRoleKey: config.serviceRoleKey
+  });
   const limiter = new RateLimiter();
   const cache = opts.cache ?? makeMemoryCache();
   const log = opts.logger ?? console;
@@ -2057,6 +2851,7 @@ async function createApp(opts) {
       Secrets: modules.Secrets ?? stubModule("Secrets")
     };
   }
+  __name(buildServices, "buildServices");
   async function runInServiceScope(fn) {
     const db = createRequestDatabase(sql, {
       role: config.dbRole,
@@ -2072,6 +2867,7 @@ async function createApp(opts) {
       throw err;
     }
   }
+  __name(runInServiceScope, "runInServiceScope");
   async function handleAuthorize(req, requestId) {
     if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
       return envelope("unauthorized", "This endpoint is not callable directly", 401, requestId);
@@ -2095,15 +2891,14 @@ async function createApp(opts) {
       filename: body.filename
     });
     if (!grant) {
-      return envelope(
-        "not_an_upload_route",
-        `${body.method ?? "POST"} ${body.path} does not declare @Upload`,
-        400,
-        requestId
-      );
+      return envelope("not_an_upload_route", `${body.method ?? "POST"} ${body.path} does not declare @Upload`, 400, requestId);
     }
-    return new Response(JSON.stringify(grant), { status: 200, headers: JSON_HEADERS });
+    return new Response(JSON.stringify(grant), {
+      status: 200,
+      headers: JSON_HEADERS
+    });
   }
+  __name(handleAuthorize, "handleAuthorize");
   async function handle(req) {
     const requestId = `req_${crypto.randomUUID()}`;
     const url = new URL(req.url);
@@ -2113,6 +2908,8 @@ async function createApp(opts) {
     const hit = matchRoute(routes, req.method, url.pathname);
     if (!hit) return envelope("not_found", "No route matches this method and path", 404, requestId);
     const { meta } = hit.entry;
+    let attestedDevice = null;
+    let attestChallengeOut = null;
     const spec = effectiveAuth(meta.options?.auth, hit.entry.controllerAuth);
     const claims = await auth.verify(req.headers.get("authorization"));
     if (spec.required && !claims) {
@@ -2125,45 +2922,108 @@ async function createApp(opts) {
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
       return envelope("email_not_verified", "A verified email address is required", 403, requestId);
     }
-    const retryAfter = limiter.check(
-      meta.options?.rateLimit,
-      RateLimiter.key(hit.entry.id, userId, req.headers),
-      Date.now()
-    );
+    let parsedBody;
+    let bodyRead = false;
+    let rawBody = null;
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      const declared = Number(req.headers.get("content-length") ?? "");
+      if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        return new Response(JSON.stringify({
+          error: "payload_too_large",
+          error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
+          status: 413,
+          request_id: requestId
+        }), {
+          status: 413,
+          headers: JSON_HEADERS
+        });
+      }
+      const buf = await req.arrayBuffer().catch(() => null);
+      if (buf && buf.byteLength > MAX_BODY_BYTES) {
+        return new Response(JSON.stringify({
+          error: "payload_too_large",
+          error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
+          status: 413,
+          request_id: requestId
+        }), {
+          status: 413,
+          headers: JSON_HEADERS
+        });
+      }
+      if (buf && buf.byteLength > 0) rawBody = new Uint8Array(buf);
+    }
+    const readParsedBody = /* @__PURE__ */ __name(() => {
+      if (bodyRead) return parsedBody;
+      bodyRead = true;
+      if (!rawBody) {
+        parsedBody = {};
+        return parsedBody;
+      }
+      try {
+        parsedBody = JSON.parse(new TextDecoder().decode(rawBody));
+      } catch {
+        parsedBody = {};
+      }
+      return parsedBody;
+    }, "readParsedBody");
+    const attest = await attestGate(req, rawBody, {
+      userId
+    });
+    if (attest.observation) observations.record(attest.observation);
+    if (attest.outcome === "reject") {
+      const headers = {
+        ...JSON_HEADERS
+      };
+      if (attest.nextChallenge) headers["x-palbase-attest-challenge"] = attest.nextChallenge;
+      return new Response(JSON.stringify({
+        error: attest.reason,
+        error_description: "This endpoint requires a verified app instance",
+        status: 401,
+        request_id: requestId
+      }), {
+        status: 401,
+        headers
+      });
+    }
+    if (attest.device && claims) attestedDevice = attest.device;
+    attestChallengeOut = attest.nextChallenge;
+    const retryAfter = limiter.check(meta.options?.rateLimit, RateLimiter.key(hit.entry.id, userId, req.headers), Date.now());
     if (retryAfter !== null) {
-      return new Response(
-        JSON.stringify({
-          error: "too_many_requests",
-          error_description: "Rate limit exceeded for this endpoint",
-          status: 429,
-          request_id: requestId,
-          data: { retryAfter }
-        }),
-        { status: 429, headers: { ...JSON_HEADERS, "retry-after": String(retryAfter) } }
-      );
+      return new Response(JSON.stringify({
+        error: "too_many_requests",
+        error_description: "Rate limit exceeded for this endpoint",
+        status: 429,
+        request_id: requestId,
+        data: {
+          retryAfter
+        }
+      }), {
+        status: 429,
+        headers: {
+          ...JSON_HEADERS,
+          "retry-after": String(retryAfter)
+        }
+      });
     }
     let completionUploadId = null;
     const args = [];
-    let parsedBody;
-    let bodyRead = false;
     let sseEnqueue = null;
-    let sseSettle = async () => {
-    };
+    let sseSettle = /* @__PURE__ */ __name(async () => {
+    }, "sseSettle");
     const sseWriter = makeSseWriter({
-      enqueue: (chunk) => sseEnqueue?.(chunk),
-      onFirstWrite: () => sseSettle()
+      enqueue: /* @__PURE__ */ __name((chunk) => sseEnqueue?.(chunk), "enqueue"),
+      onFirstWrite: /* @__PURE__ */ __name(() => sseSettle(), "onFirstWrite")
     });
     for (const p of meta.params ?? []) {
       switch (p.kind) {
         case "body": {
-          if (!bodyRead) {
-            parsedBody = await req.json().catch(() => ({}));
-            bodyRead = true;
-          }
+          readParsedBody();
           const r = p.schema.safeParse(parsedBody);
           if (!r.success) {
             return envelope("bad_request", "Request body failed validation", 400, requestId, {
-              data: { fields: fieldErrors(r.error) }
+              data: {
+                fields: fieldErrors(r.error)
+              }
             });
           }
           args[p.index] = r.data;
@@ -2173,7 +3033,9 @@ async function createApp(opts) {
           const r = p.schema.safeParse(Object.fromEntries(url.searchParams));
           if (!r.success) {
             return envelope("bad_request", "Query parameters failed validation", 400, requestId, {
-              data: { fields: fieldErrors(r.error) }
+              data: {
+                fields: fieldErrors(r.error)
+              }
             });
           }
           args[p.index] = r.data;
@@ -2191,7 +3053,9 @@ async function createApp(opts) {
           const r = p.schema.safeParse(headersFor(raw, p.schema));
           if (!r.success) {
             return envelope("bad_request", "Request headers failed validation", 400, requestId, {
-              data: { fields: fieldErrors(r.error) }
+              data: {
+                fields: fieldErrors(r.error)
+              }
             });
           }
           args[p.index] = r.data;
@@ -2204,22 +3068,19 @@ async function createApp(opts) {
             email: claims.email,
             role: claims.role,
             emailVerified: claims.email_verified === true,
-            metadata: claims.metadata ?? {}
+            metadata: claims.metadata ?? {},
+            // Server-owned and only ever filled from a verdict palauth
+            // returned. Never from a raw header, never from JWT metadata —
+            // the type has said so since it was written and this is the
+            // first writer.
+            device: attestedDevice
           } : null;
           break;
         case "uploadedObject": {
           if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
-            return envelope(
-              "unauthorized",
-              "This endpoint accepts uploads through storage, not directly",
-              401,
-              requestId
-            );
-          }
-          if (!bodyRead) {
-            parsedBody = await req.json().catch(() => ({}));
-            bodyRead = true;
+            return envelope("unauthorized", "This endpoint accepts uploads through storage, not directly", 401, requestId);
           }
+          readParsedBody();
           const envelopeIn = parsedBody;
           if (!envelopeIn?.uploadedObject) {
             return envelope("bad_request", "the completion call carried no uploaded object", 400, requestId);
@@ -2230,7 +3091,9 @@ async function createApp(opts) {
             if (already) {
               return new Response(already.body, {
                 status: already.status,
-                headers: already.contentType ? { "content-type": already.contentType } : void 0
+                headers: already.contentType ? {
+                  "content-type": already.contentType
+                } : void 0
               });
             }
             completionUploadId = uploadId;
@@ -2290,26 +3153,24 @@ async function createApp(opts) {
             sseController = c;
           }
         });
-        sseEnqueue = (chunk) => {
+        sseEnqueue = /* @__PURE__ */ __name((chunk) => {
           try {
             sseController.enqueue(sseEncoder.encode(chunk));
           } catch {
           }
-        };
+        }, "sseEnqueue");
         let sawFirstFrame;
         const firstFrame = new Promise((r) => sawFirstFrame = r);
-        sseSettle = async () => {
+        sseSettle = /* @__PURE__ */ __name(async () => {
           await db.commit();
           sawFirstFrame();
-        };
+        }, "sseSettle");
         const guarded = {
           ...services,
           Database: new Proxy(services.Database, {
             get(target, prop, recv) {
               if (sseWriter.started()) {
-                throw new Error(
-                  `sse_db_after_write: ${hit.entry.id} touched the database after its first write(). A streaming response settles its transaction with the first frame \u2014 do the database work before the first write.`
-                );
+                throw new Error(`sse_db_after_write: ${hit.entry.id} touched the database after its first write(). A streaming response settles its transaction with the first frame \u2014 do the database work before the first write.`);
               }
               return Reflect.get(target, prop, recv);
             }
@@ -2325,23 +3186,23 @@ async function createApp(opts) {
           }
           const method = hit.entry.instance[meta.fnName];
           if (typeof method !== "function") {
-            throw new Error(
-              `route ${hit.entry.id} names method ${meta.fnName}, which the controller does not define`
-            );
+            throw new Error(`route ${hit.entry.id} names method ${meta.fnName}, which the controller does not define`);
           }
           return method.apply(hit.entry.instance, args);
-        })).then(
-          () => void 0,
-          (err) => {
-            thrown = err;
-          }
-        );
-        await Promise.race([firstFrame, ran]);
+        })).then(() => void 0, (err) => {
+          thrown = err;
+        });
+        await Promise.race([
+          firstFrame,
+          ran
+        ]);
         if (!sseWriter.started()) {
           await ran;
           await db.commit();
           if (thrown !== null) throw thrown;
-          return new Response(null, { status: 204 });
+          return new Response(null, {
+            status: 204
+          });
         }
         void (async () => {
           await ran;
@@ -2357,7 +3218,10 @@ async function createApp(opts) {
         })();
         return new Response(stream, {
           status: 200,
-          headers: { "content-type": SSE_CONTENT_TYPE, "cache-control": "no-cache" }
+          headers: {
+            "content-type": SSE_CONTENT_TYPE,
+            "cache-control": "no-cache"
+          }
         });
       }
       const result = await runWithRuntime(services, () => {
@@ -2369,9 +3233,7 @@ async function createApp(opts) {
         }
         const method = hit.entry.instance[meta.fnName];
         if (typeof method !== "function") {
-          throw new Error(
-            `route ${hit.entry.id} names method ${meta.fnName}, which the controller does not define`
-          );
+          throw new Error(`route ${hit.entry.id} names method ${meta.fnName}, which the controller does not define`);
         }
         return method.apply(hit.entry.instance, args);
       });
@@ -2380,19 +3242,20 @@ async function createApp(opts) {
         const v = meta.returnSchema.safeParse(result);
         if (!v.success) {
           log.error(`[engine] ${hit.entry.id} returned a value its declared type rejects`, v.error.issues);
-          return envelope(
-            "output_invalid",
-            "The handler returned a value its declared return type rejects",
-            500,
-            requestId
-          );
+          return envelope("output_invalid", "The handler returned a value its declared return type rejects", 500, requestId);
         }
       }
       if (result === void 0 || result === null) {
         if (completionUploadId) {
-          completions.remember(completionUploadId, { status: 204, body: null, contentType: null });
+          completions.remember(completionUploadId, {
+            status: 204,
+            body: null,
+            contentType: null
+          });
         }
-        return new Response(null, { status: 204 });
+        return new Response(null, {
+          status: 204
+        });
       }
       const payload = JSON.stringify(result);
       if (completionUploadId) {
@@ -2402,25 +3265,28 @@ async function createApp(opts) {
           contentType: JSON_HEADERS["content-type"] ?? "application/json"
         });
       }
-      return new Response(payload, { status: 200, headers: JSON_HEADERS });
+      return new Response(payload, {
+        status: 200,
+        headers: attestChallengeOut ? {
+          ...JSON_HEADERS,
+          "x-palbase-attest-challenge": attestChallengeOut
+        } : JSON_HEADERS
+      });
     } catch (err) {
       await db.rollback(err);
       if (isHttpError(err)) {
         if (isEngineRaised(err) || !AUTHOR_ANSWERED.has(err.status)) {
           log.error(`[engine] unhandled ${err.error} in ${hit.entry.id}`, err);
         }
-        return envelope(
-          err.error,
-          err.errorDescription,
-          err.status,
-          requestId,
-          err.data !== void 0 ? { data: err.data } : void 0
-        );
+        return envelope(err.error, err.errorDescription, err.status, requestId, err.data !== void 0 ? {
+          data: err.data
+        } : void 0);
       }
       log.error(`[engine] unhandled error in ${hit.entry.id}`, err);
       return envelope("internal_error", "The request could not be completed", 500, requestId);
     }
   }
+  __name(handle, "handle");
   const bootServices = buildServices(null);
   let runShutdownHooks;
   try {
@@ -2433,18 +3299,22 @@ async function createApp(opts) {
     handle,
     routes,
     config,
+    container: liveContainer,
     runInServiceScope,
     async shutdown() {
       await runShutdownHooks();
       await closeDriver(sql);
+      released = true;
     }
   };
 }
+__name(createApp, "createApp");
 async function closeDriver(sql) {
   const closable = sql;
   await closable.close?.();
   await closable.end?.();
 }
+__name(closeDriver, "closeDriver");
 
 export {
   BootRefused,
@@ -2465,4 +3335,4 @@ export {
   installEgressFence,
   createApp
 };
-//# sourceMappingURL=chunk-AILPKEK5.js.map
+//# sourceMappingURL=chunk-OO7R25AI.js.map