@palbase/backend 25.1.0 → 27.1.0

package/dist/test/index.js

@@ -1,8 +1,16 @@
 import {
+  assertNoExpressionHandles,
   assertUsableFilter,
-  assertUsableWriteValues
-} from "../chunk-XABBC7JP.js";
-import "../chunk-7D4SUZUM.js";
+  assertUsableWriteValues,
+  columnExprOf,
+  isColRef,
+  isColumnExpr,
+  isNowExpr,
+  isSqlFragment
+} from "../chunk-JVZQCC77.js";
+import {
+  __name
+} from "../chunk-VXPNPVAG.js";
 
 // ../core/dist/index.js
 var CACHE_TTL_MS = 5 * 60 * 1e3;
@@ -17,8 +25,13 @@ function asPowChallenge(details) {
   const { id, prefix, difficulty } = c;
   if (typeof id !== "string" || typeof prefix !== "string") return null;
   if (typeof difficulty !== "number" || !Number.isInteger(difficulty) || difficulty < 0) return null;
-  return { id, prefix, difficulty };
+  return {
+    id,
+    prefix,
+    difficulty
+  };
 }
+__name(asPowChallenge, "asPowChallenge");
 var encoder = new TextEncoder();
 var hasher = null;
 async function digester() {
@@ -33,16 +46,17 @@ async function digester() {
       );
       if (typeof mod.createHash === "function") {
         const createHash = mod.createHash;
-        hasher = (input) => new Uint8Array(createHash("sha256").update(input).digest());
+        hasher = /* @__PURE__ */ __name((input) => new Uint8Array(createHash("sha256").update(input).digest()), "hasher");
         return hasher;
       }
     } catch {
     }
   }
-  hasher = async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(input)));
+  hasher = /* @__PURE__ */ __name(async (input) => new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(input))), "hasher");
   return hasher;
 }
-var now = () => typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now();
+__name(digester, "digester");
+var now = /* @__PURE__ */ __name(() => typeof performance !== "undefined" && typeof performance.now === "function" ? performance.now() : Date.now(), "now");
 function leadingZeroBits(hash) {
   let bits = 0;
   for (const byte of hash) {
@@ -54,18 +68,18 @@ function leadingZeroBits(hash) {
   }
   return bits;
 }
+__name(leadingZeroBits, "leadingZeroBits");
 var MAX_POW_DIFFICULTY = 24;
 function powBudget(difficulty) {
   return 8 * 2 ** difficulty;
 }
+__name(powBudget, "powBudget");
 var POW_TIME_BUDGET_MS = 12e4;
 var CALIBRATION_WARMUP = 1024;
 var CALIBRATION_END = 9216;
 async function solvePowChallenge(challenge, maxIterations = powBudget(challenge.difficulty), signal) {
   if (challenge.difficulty > MAX_POW_DIFFICULTY) {
-    throw new Error(
-      `proof-of-work: refusing difficulty ${challenge.difficulty}; this client attempts at most ${MAX_POW_DIFFICULTY}, which is the highest a Palbase stack issues`
-    );
+    throw new Error(`proof-of-work: refusing difficulty ${challenge.difficulty}; this client attempts at most ${MAX_POW_DIFFICULTY}, which is the highest a Palbase stack issues`);
   }
   const digest = await digester();
   let warmedAt = 0;
@@ -77,9 +91,7 @@ async function solvePowChallenge(challenge, maxIterations = powBudget(challenge.
         throw new DOMException("proof-of-work solve aborted", "AbortError");
       }
       if (now() > deadline) {
-        throw new Error(
-          `proof-of-work: gave up on difficulty ${challenge.difficulty} after ${POW_TIME_BUDGET_MS / 1e3}s and ${nonce.toLocaleString()} attempts \u2014 the tail this run drew is longer than the allowance`
-        );
+        throw new Error(`proof-of-work: gave up on difficulty ${challenge.difficulty} after ${POW_TIME_BUDGET_MS / 1e3}s and ${nonce.toLocaleString()} attempts \u2014 the tail this run drew is longer than the allowance`);
       }
     }
     if (nonce === CALIBRATION_WARMUP) {
@@ -91,9 +103,7 @@ async function solvePowChallenge(challenge, maxIterations = powBudget(challenge.
       const rate = (CALIBRATION_END - CALIBRATION_WARMUP) / (elapsed / 1e3);
       const expectedMs = 2 ** challenge.difficulty / rate * 1e3;
       if (expectedMs > POW_TIME_BUDGET_MS) {
-        throw new Error(
-          `proof-of-work: difficulty ${challenge.difficulty} needs about ${Math.round(expectedMs / 1e3)}s here (${Math.round(rate).toLocaleString()} digests/s) and this client allows ${POW_TIME_BUDGET_MS / 1e3}s; refusing before spending the time rather than after`
-        );
+        throw new Error(`proof-of-work: difficulty ${challenge.difficulty} needs about ${Math.round(expectedMs / 1e3)}s here (${Math.round(rate).toLocaleString()} digests/s) and this client allows ${POW_TIME_BUDGET_MS / 1e3}s; refusing before spending the time rather than after`);
       }
       deadline = now() + (POW_TIME_BUDGET_MS - (now() - warmedAt));
     }
@@ -105,13 +115,15 @@ async function solvePowChallenge(challenge, maxIterations = powBudget(challenge.
       };
     }
   }
-  throw new Error(
-    `proof-of-work: no nonce found for difficulty ${challenge.difficulty} within ${maxIterations} attempts`
-  );
+  throw new Error(`proof-of-work: no nonce found for difficulty ${challenge.difficulty} within ${maxIterations} attempts`);
 }
+__name(solvePowChallenge, "solvePowChallenge");
 
 // src/test/api.ts
 var TestApiError = class extends Error {
+  static {
+    __name(this, "TestApiError");
+  }
   status;
   error;
   /** Payload of an error your code threw — `new BadRequest({ fields })` arrives here. */
@@ -131,12 +143,11 @@ var TestApiError = class extends Error {
 };
 function required(value, envName) {
   if (!value) {
-    throw new Error(
-      `${envName} is not set \u2014 the test client has nowhere to send requests. This is set by the deploy that runs your tests; if you are running them by hand, set it yourself.`
-    );
+    throw new Error(`${envName} is not set \u2014 the test client has nowhere to send requests. This is set by the deploy that runs your tests; if you are running them by hand, set it yourself.`);
   }
   return value;
 }
+__name(required, "required");
 function isLocalTarget(baseUrl) {
   try {
     const { hostname } = new URL(baseUrl);
@@ -145,6 +156,7 @@ function isLocalTarget(baseUrl) {
     return false;
   }
 }
+__name(isLocalTarget, "isLocalTarget");
 function secondsUntilExpiry(token) {
   const body = token.split(".")[1];
   if (!body) return null;
@@ -155,6 +167,7 @@ function secondsUntilExpiry(token) {
     return null;
   }
 }
+__name(secondsUntilExpiry, "secondsUntilExpiry");
 function createTestApi(config) {
   const baseUrl = required(config.baseUrl, "PALBASE_TEST_BASE_URL").replace(/\/$/, "");
   const apiKey = required(config.apiKey, "PALBASE_TEST_API_KEY");
@@ -169,7 +182,9 @@ function createTestApi(config) {
       // Selects the release under test. Omit it and the gateway serves the LIVE
       // one, which would make the whole suite grade the wrong code. Absent only
       // against a local stack, which has a single version.
-      ...candidateToken ? { "x-palbase-candidate": candidateToken } : {},
+      ...candidateToken ? {
+        "x-palbase-candidate": candidateToken
+      } : {},
       ...opts.headers
     };
     if (bearer) headers.authorization = `Bearer ${bearer}`;
@@ -182,7 +197,12 @@ function createTestApi(config) {
     });
     const text = await res.text();
     const parsed = text ? safeParse(text) : void 0;
-    requests.push({ method, path, status: res.status, ms: Date.now() - startedAt });
+    requests.push({
+      method,
+      path,
+      status: res.status,
+      ms: Date.now() - startedAt
+    });
     if (!res.ok) {
       if (res.status === 401 && bearer) {
         const left = secondsUntilExpiry(bearer);
@@ -197,41 +217,39 @@ function createTestApi(config) {
     }
     return parsed;
   }
+  __name(call, "call");
   return {
     requests,
-    get: (path, opts) => call("GET", path, void 0, opts),
-    post: (path, body, opts) => call("POST", path, body, opts),
-    patch: (path, body, opts) => call("PATCH", path, body, opts),
-    put: (path, body, opts) => call("PUT", path, body, opts),
-    delete: (path, opts) => call("DELETE", path, void 0, opts),
-    query: (path, body, opts) => call("QUERY", path, body, opts),
+    get: /* @__PURE__ */ __name((path, opts) => call("GET", path, void 0, opts), "get"),
+    post: /* @__PURE__ */ __name((path, body, opts) => call("POST", path, body, opts), "post"),
+    patch: /* @__PURE__ */ __name((path, body, opts) => call("PATCH", path, body, opts), "patch"),
+    put: /* @__PURE__ */ __name((path, body, opts) => call("PUT", path, body, opts), "put"),
+    delete: /* @__PURE__ */ __name((path, opts) => call("DELETE", path, void 0, opts), "delete"),
+    query: /* @__PURE__ */ __name((path, body, opts) => call("QUERY", path, body, opts), "query"),
     async signInAs(name) {
       const identity = (config.identities ?? {})[name];
       if (!identity) {
         const declared = Object.keys(config.identities ?? {});
-        throw new Error(
-          `no test identity named ${JSON.stringify(name)} \u2014 the deploy mints one per user declared in config/test-users.ts` + (declared.length ? `; this run has: ${declared.join(", ")}` : (
-            // Not "you declared none": from here the two causes are
-            // indistinguishable, and blaming the customer's config for a
-            // platform failure sends them to look in the wrong file. The
-            // deploy log names which one it was.
-            ", and this run has none \u2014 either your config declares no users or the deploy could not mint them; the deploy log says which"
-          ))
-        );
+        throw new Error(`no test identity named ${JSON.stringify(name)} \u2014 the deploy mints one per user declared in config/test-users.ts` + (declared.length ? `; this run has: ${declared.join(", ")}` : (
+          // indistinguishable, and blaming the customer's config for a
+          // platform failure sends them to look in the wrong file. The
+          // deploy log names which one it was.
+          ", and this run has none \u2014 either your config declares no users or the deploy could not mint them; the deploy log says which"
+        )));
       }
       if (identity.accessToken) {
         bearer = identity.accessToken;
-        return { id: identity.id ?? "", email: identity.email };
+        return {
+          id: identity.id ?? "",
+          email: identity.email
+        };
       }
       return this.signIn(identity);
     },
     async signIn(credentials) {
-      const attempt = async (extra) => call(
-        "POST",
-        "/auth/login",
-        credentials,
-        extra ? { headers: extra } : {}
-      );
+      const attempt = /* @__PURE__ */ __name(async (extra) => call("POST", "/auth/login", credentials, extra ? {
+        headers: extra
+      } : {}), "attempt");
       let result;
       try {
         result = await attempt();
@@ -242,7 +260,9 @@ function createTestApi(config) {
         result = await attempt(await solvePowChallenge(challenge));
       }
       bearer = result.access_token;
-      return result.user ?? { id: "" };
+      return result.user ?? {
+        id: ""
+      };
     },
     async signOut() {
       await call("POST", "/auth/logout", void 0);
@@ -253,6 +273,7 @@ function createTestApi(config) {
     }
   };
 }
+__name(createTestApi, "createTestApi");
 function parseIdentities(raw) {
   if (!raw) return {};
   try {
@@ -261,6 +282,7 @@ function parseIdentities(raw) {
     return {};
   }
 }
+__name(parseIdentities, "parseIdentities");
 function safeParse(text) {
   try {
     return JSON.parse(text);
@@ -268,6 +290,7 @@ function safeParse(text) {
     return text;
   }
 }
+__name(safeParse, "safeParse");
 var configured = null;
 var api = new Proxy({}, {
   get(_target, prop) {
@@ -281,7 +304,184 @@ var api = new Proxy({}, {
   }
 });
 
+// src/test/container.ts
+import "reflect-metadata";
+function isolated() {
+  const over = /* @__PURE__ */ new Map();
+  const local = /* @__PURE__ */ new Map();
+  const make = /* @__PURE__ */ __name((c) => {
+    if (over.has(c)) return over.get(c);
+    const hit = local.get(c);
+    if (hit !== void 0) return hit;
+    const meta = Reflect.getMetadata("design:paramtypes", c) ?? [];
+    const inst = new c(...meta.map((d) => make(d)));
+    local.set(c, inst);
+    return inst;
+  }, "make");
+  const api2 = {
+    with(t, v) {
+      over.set(t, v);
+      return api2;
+    },
+    get(t) {
+      return make(t);
+    }
+  };
+  return api2;
+}
+__name(isolated, "isolated");
+
 // src/__tests__/helpers/mock-db.ts
+function refuseFragment(caller, table, where) {
+  if (isSqlFragment(where)) {
+    throw new Error(`${caller}(${table}): fakeDatabase bir sqlFragment'i de\u011Ferlendiremez \u2014 sahte depo SQL \xE7al\u0131\u015Ft\u0131rmaz. Filtreyi tipli filtre diliyle kurun (gt/gte/lt/lte/neq/in/contains/isNull, OR/AND/NOT), ya da bu testi ger\xE7ek bir Postgres'e kar\u015F\u0131 yaz\u0131n.`);
+  }
+  if (where === null || typeof where !== "object") return;
+  for (const [k, v] of Object.entries(where)) {
+    if (k === "OR" || k === "AND") {
+      for (const branch of Array.isArray(v) ? v : []) refuseFragment(caller, table, branch);
+    } else if (k === "NOT") {
+      refuseFragment(caller, table, v);
+    }
+  }
+}
+__name(refuseFragment, "refuseFragment");
+function addDecimal(cell, by, sign) {
+  if (cell === null || cell === void 0) return null;
+  if (typeof cell === "number" && typeof by === "number") return cell + sign * by;
+  const a = String(cell);
+  const b = String(by);
+  const parse = /* @__PURE__ */ __name((x) => {
+    const m = /^([+-]?)(\d*)(?:\.(\d*))?$/.exec(x.trim());
+    if (m === null || m[2] === "" && (m[3] ?? "") === "") return null;
+    const frac = m[3] ?? "";
+    const unit = BigInt(`${m[1] === "-" ? "-" : ""}${m[2] === "" ? "0" : m[2]}${frac}`);
+    return {
+      unit,
+      scale: frac.length
+    };
+  }, "parse");
+  const pa = parse(a);
+  const pb = parse(b);
+  if (pa === null || pb === null) {
+    throw new Error(`fakeDatabase: increment()/decrement() say\u0131sal olmayan bir de\u011Fere uyguland\u0131 ("${a}") \u2014 Postgres bunu "operator does not exist" ile reddeder.`);
+  }
+  const scale = Math.max(pa.scale, pb.scale);
+  const lift = /* @__PURE__ */ __name((v) => v.unit * 10n ** BigInt(scale - v.scale), "lift");
+  const total = lift(pa) + BigInt(sign) * lift(pb);
+  if (scale === 0) return typeof cell === "number" ? Number(total) : total.toString();
+  const neg = total < 0n;
+  const digits = (neg ? -total : total).toString().padStart(scale + 1, "0");
+  const out = `${neg ? "-" : ""}${digits.slice(0, -scale)}.${digits.slice(-scale)}`;
+  return typeof cell === "number" ? Number(out) : out;
+}
+__name(addDecimal, "addDecimal");
+function rowMatchesFilter(caller, table, row, f) {
+  return Object.entries(f).every(([k, c]) => {
+    if (k === "OR") return c.some((b) => rowMatchesFilter(caller, table, row, b));
+    if (k === "AND") return c.every((b) => rowMatchesFilter(caller, table, row, b));
+    if (k === "NOT") return !rowMatchesFilter(caller, table, row, c);
+    if (k === "has") {
+      throw new Error(`${caller}(${table}): fakeDatabase bir \`has\` filtresini \xE7\xF6zemez \u2014 ili\u015Fki grafi\u011Fi bildirimden t\xFCretiliyor ve sahte deponun bildirimi yok. Bu testi ger\xE7ek bir Postgres'e kar\u015F\u0131 yaz\u0131n, ya da ili\u015Fkiyi filtrede A\xC7IK\xC7A kurun (\xF6nce ili\u015Fki tablosunu okuyup { id: { in: [...] } } ile s\xFCz\xFCn).`);
+    }
+    return matchesCell(caller, table, row, k, c);
+  });
+}
+__name(rowMatchesFilter, "rowMatchesFilter");
+function cmp(a, b, op) {
+  if (a === null || a === void 0 || b === null || b === void 0) return false;
+  const l = a instanceof Date ? a.getTime() : a;
+  const r = b instanceof Date ? b.getTime() : b;
+  switch (op) {
+    case "eq":
+      return l === r;
+    case "neq":
+      return l !== r;
+    case "gt":
+      return l > r;
+    case "gte":
+      return l >= r;
+    case "lt":
+      return l < r;
+    case "lte":
+      return l <= r;
+    default:
+      return false;
+  }
+}
+__name(cmp, "cmp");
+function matchesCell(caller, table, row, key, cond) {
+  if (isColRef(cond)) return cmp(row[key], row[cond.$col], "eq");
+  if (isNowExpr(cond)) return cmp(row[key], (/* @__PURE__ */ new Date()).toISOString(), "eq");
+  if (cond !== null && typeof cond === "object" && !Array.isArray(cond)) {
+    return Object.entries(cond).every(([op, v]) => {
+      const cell = row[key];
+      if (isNowExpr(v)) {
+        if (![
+          "neq",
+          "gt",
+          "gte",
+          "lt",
+          "lte"
+        ].includes(op)) {
+          throw new Error(`${caller}(${table}): where.${key}.${op} now() ile kullan\u0131lamaz`);
+        }
+        return cmp(cell, (/* @__PURE__ */ new Date()).toISOString(), op);
+      }
+      if (isColumnExpr(v)) {
+        throw new Error(`${caller}(${table}): where.${key}.${op} bir YAZMA ifadesi ald\u0131 (increment/decrement) \u2014 kar\u015F\u0131la\u015Ft\u0131rma de\u011Feri de\u011Fil. Sunucu saati i\xE7in now() kullan\u0131n.`);
+      }
+      if (isColRef(v)) {
+        if (![
+          "neq",
+          "gt",
+          "gte",
+          "lt",
+          "lte"
+        ].includes(op)) {
+          throw new Error(`${caller}(${table}): where.${key}.${op} col() ile kullan\u0131lamaz`);
+        }
+        return cmp(cell, row[v.$col], op);
+      }
+      switch (op) {
+        case "in":
+          if (!Array.isArray(v)) throw new Error(`${caller}(${table}): where.${key}.in bir dizi olmal\u0131`);
+          if (v.some(isColRef)) {
+            throw new Error(`${caller}(${table}): where.${key}.in col() ile kullan\u0131lamaz \u2014 kolon kar\u015F\u0131la\u015Ft\u0131rmas\u0131 i\xE7in gt/gte/lt/lte/neq kullan\u0131n`);
+          }
+          return v.includes(cell);
+        case "neq":
+        case "gt":
+        case "gte":
+        case "lt":
+        case "lte":
+          return cmp(cell, v, op);
+        // K1 metin operatörleri (FR-005) ve null testi (FR-006). Bunlar BURADA
+        // da olmak zorunda: guard onları KABUL ettiği anda fake sessizce yanlış
+        // cevap verir ve yazarın testi, üretimde farklı davranan koda karşı
+        // yeşil verirdi (input-guards.ts'in uyardığı tam sınıf).
+        case "isNull":
+          if (typeof v !== "boolean") throw new Error(`${caller}(${table}): where.${key}.isNull bir boolean olmal\u0131`);
+          return v ? cell == null : cell != null;
+        case "contains":
+        case "icontains":
+        case "startsWith":
+        case "endsWith": {
+          if (typeof v !== "string") throw new Error(`${caller}(${table}): where.${key}.${op} bir string olmal\u0131`);
+          if (typeof cell !== "string") return false;
+          if (op === "contains") return cell.includes(v);
+          if (op === "icontains") return cell.toLowerCase().includes(v.toLowerCase());
+          if (op === "startsWith") return cell.startsWith(v);
+          return cell.endsWith(v);
+        }
+        default:
+          throw new Error(`${caller}(${table}): where.${key} bilinmeyen operat\xF6r "${op}"`);
+      }
+    });
+  }
+  return row[key] === cond;
+}
+__name(matchesCell, "matchesCell");
 function createMockDB() {
   const store = /* @__PURE__ */ new Map();
   const tracked = {
@@ -297,11 +497,15 @@ function createMockDB() {
     }
     return rows;
   }
+  __name(rowsOf, "rowsOf");
   function track(map, table, row) {
     const list = map.get(table);
     if (list) list.push(row);
-    else map.set(table, [row]);
+    else map.set(table, [
+      row
+    ]);
   }
+  __name(track, "track");
   const ops = {
     // The bulk ops and count run against the SAME in-memory store the direct
     // ops write to, so a test that writes three rows and counts them gets 3 —
@@ -310,26 +514,38 @@ function createMockDB() {
     async updateMany(table, where, set) {
       if (Object.keys(where).length === 0) throw new Error(`updateMany(${table}): bo\u015F filtre`);
       assertUsableFilter("updateMany", table, where);
+      refuseFragment("updateMany", table, where);
       assertUsableWriteValues("updateMany", table, Object.keys(set), set);
-      const hit = (store.get(table) ?? []).filter(
-        (r) => Object.entries(where).every(([k, v]) => r[k] === v)
-      );
-      for (const row of hit) Object.assign(row, set);
+      const hit = (store.get(table) ?? []).filter((r) => rowMatchesFilter("updateMany", table, r, where));
+      for (const row of hit) {
+        for (const [k, v] of Object.entries(set)) {
+          const expr = columnExprOf(v);
+          if (expr !== null && expr.fn === "now") {
+            row[k] = /* @__PURE__ */ new Date();
+            continue;
+          }
+          if (expr !== null) {
+            row[k] = addDecimal(row[k], expr.by, expr.fn === "inc" ? 1 : -1);
+            continue;
+          }
+          row[k] = v;
+        }
+      }
       return hit;
     },
     async deleteMany(table, where) {
       if (Object.keys(where).length === 0) throw new Error(`deleteMany(${table}): bo\u015F filtre`);
       assertUsableFilter("deleteMany", table, where);
+      refuseFragment("deleteMany", table, where);
       const list = store.get(table) ?? [];
-      const keep = list.filter((r) => !Object.entries(where).every(([k, v]) => r[k] === v));
+      const keep = list.filter((r) => !rowMatchesFilter("deleteMany", table, r, where));
       store.set(table, keep);
       return list.length - keep.length;
     },
     async count(table, where = {}) {
       assertUsableFilter("count", table, where);
-      return (store.get(table) ?? []).filter(
-        (r) => Object.entries(where).every(([k, v]) => r[k] === v)
-      ).length;
+      refuseFragment("count", table, where);
+      return (store.get(table) ?? []).filter((r) => rowMatchesFilter("count", table, r, where)).length;
     },
     async search(_table, _params) {
       return [];
@@ -344,25 +560,90 @@ function createMockDB() {
       return [];
     },
     async supersede(_table, _id, row) {
-      return { id: crypto.randomUUID(), ...row };
+      return {
+        id: crypto.randomUUID(),
+        ...row
+      };
     },
     async query(_sql, _params) {
       return [];
     },
     async insert(table, data) {
       assertUsableWriteValues("insert", table, Object.keys(data), data);
-      const record = { id: crypto.randomUUID(), ...data };
+      assertNoExpressionHandles("insert", table, Object.keys(data), data);
+      const record = {
+        id: crypto.randomUUID(),
+        ...data
+      };
       rowsOf(table).push(record);
       track(tracked.inserted, table, record);
       return record;
     },
+    /**
+    * `claim` — motorla PARİTE (FR-033).
+    *
+    * Fake bunu sunmasaydı `claim` ile yazılmış bir servis, iskelenin yazarlara
+    * önerdiği test yolunda `undefined is not a function` verirdi; sunup da
+    * FARKLI davransaydı (ör. hep `inserted: true`) idempotency testi üretimde
+    * çalışmayan koda karşı yeşil olurdu.
+    *
+    * Anahtar ZATEN VARSA var olan satır dönüyor ve hiçbir şey yazılmıyor —
+    * motorun 23505 dalının aynısı.
+    */
+    /**
+    * `lockRows` — sahte depoda kilit YOKTUR, ama çağrı da patlamamalı.
+    *
+    * Motorla parite burada "aynı SQL" değil, "aynı SÖZLEŞME": boş liste
+    * no-op, tekrar edenler tekilleşir, ve PK'sı olmayan tablo adıyla
+    * reddedilir. Kilidin kendisi tek işlemli bir sahte depoda anlamsız —
+    * ama sözleşmeyi bozan bir çağrı burada da hata almalı.
+    */
+    async lockRows(table, ids) {
+      if (ids.length === 0) return;
+      const rows = store.get(table) ?? [];
+      const unique = [
+        ...new Set(ids)
+      ].sort();
+      const missing = unique.filter((id) => !rows.some((r) => r["id"] === id));
+      if (missing.length > 0 && rows.length > 0) {
+        throw new Error(`lockRows(${table}): \u015Fu id'ler yok: ${missing.join(", ")} \u2014 kilitlenecek sat\u0131r bulunamad\u0131.`);
+      }
+    },
+    /** Sahte depoda kilit yok; sözleşme (çağrı patlamaz) korunuyor. */
+    async advisoryXactLock(_key) {
+      return void 0;
+    },
+    async claim(table, unique, extra = {}) {
+      const keyCols = Object.keys(unique);
+      if (keyCols.length === 0) {
+        throw new Error(`claim(${table}): benzersiz alan verilmedi. claim, bir anahtar\u0131 sahiplenmektir; anahtar yoksa sahiplenecek bir \u015Fey de yok \u2014 insert(${table}, \u2026) kullan\u0131n.`);
+      }
+      assertUsableWriteValues("claim", table, keyCols, unique);
+      const existing = (store.get(table) ?? []).find((r) => keyCols.every((c) => r[c] === unique[c]));
+      if (existing) return {
+        inserted: false,
+        row: existing
+      };
+      const record = {
+        id: crypto.randomUUID(),
+        ...unique,
+        ...extra
+      };
+      rowsOf(table).push(record);
+      track(tracked.inserted, table, record);
+      return {
+        inserted: true,
+        row: record
+      };
+    },
     // Same semantics the engine's SQL has: match on the conflict columns, update
     // everything else, and return the resulting row either way.
-    async upsert(table, data, opts) {
+    async put(table, data, opts) {
       if (opts.onConflict.length === 0) {
-        throw new Error(`upsert into ${table}: onConflict en az bir kolon ad\u0131 ister`);
+        throw new Error(`put into ${table}: onConflict en az bir kolon ad\u0131 ister`);
       }
       assertUsableWriteValues("upsert", table, Object.keys(data), data);
+      assertNoExpressionHandles("upsert", table, Object.keys(data), data);
       const rows = rowsOf(table);
       const existing = rows.find((r) => opts.onConflict.every((c) => r[c] === data[c]));
       if (existing) {
@@ -371,16 +652,26 @@ function createMockDB() {
         }
         return existing;
       }
-      const record = { id: crypto.randomUUID(), ...data };
+      const record = {
+        id: crypto.randomUUID(),
+        ...data
+      };
       rows.push(record);
       track(tracked.inserted, table, record);
       return record;
     },
     async update(table, id, data) {
       assertUsableWriteValues("update", table, Object.keys(data), data);
+      assertNoExpressionHandles("update", table, Object.keys(data), data);
       const rows = store.get(table) ?? [];
       const idx = rows.findIndex((r) => r["id"] === id);
-      const updated = idx >= 0 ? { ...rows[idx], ...data } : { id, ...data };
+      const updated = idx >= 0 ? {
+        ...rows[idx],
+        ...data
+      } : {
+        id,
+        ...data
+      };
       if (idx >= 0) {
         rows[idx] = updated;
       }
@@ -393,7 +684,9 @@ function createMockDB() {
       if (idx >= 0) rows.splice(idx, 1);
       const list = tracked.deleted.get(table);
       if (list) list.push(id);
-      else tracked.deleted.set(table, [id]);
+      else tracked.deleted.set(table, [
+        id
+      ]);
     },
     async findById(table, id) {
       const rows = store.get(table) ?? [];
@@ -405,51 +698,60 @@ function createMockDB() {
     // thing a stand-in must never do.
     async findMany(table, query, opts) {
       assertUsableFilter("findMany", table, query);
+      refuseFragment("findMany", table, query);
       const rows = store.get(table) ?? [];
-      const matches2 = (row, key, cond) => {
-        if (cond !== null && typeof cond === "object" && !Array.isArray(cond)) {
-          return Object.entries(cond).every(([op, v]) => {
-            const cell = row[key];
-            switch (op) {
-              case "in":
-                return Array.isArray(v) && v.includes(cell);
-              case "neq":
-                return cell !== v;
-              case "gt":
-                return cell > v;
-              case "gte":
-                return cell >= v;
-              case "lt":
-                return cell < v;
-              case "lte":
-                return cell <= v;
-              default:
-                throw new Error(`findMany(${table}): where.${key} bilinmeyen operat\xF6r "${op}"`);
+      let out = query ? rows.filter((row) => rowMatchesFilter("findMany", table, row, query)) : [
+        ...rows
+      ];
+      const orderSpecs = opts?.orderBy === void 0 ? [] : Array.isArray(opts.orderBy) ? opts.orderBy : [
+        opts.orderBy
+      ];
+      if (orderSpecs.length > 0) {
+        out = [
+          ...out
+        ].sort((a, b) => {
+          for (const o of orderSpecs) {
+            const dir = o.direction === "desc" ? -1 : 1;
+            const x = a[o.column];
+            const y = b[o.column];
+            const xNull = x === null || x === void 0;
+            const yNull = y === null || y === void 0;
+            if (xNull || yNull) {
+              if (xNull && yNull) continue;
+              const nullsFirst = o.nulls === void 0 ? dir === -1 : o.nulls === "first";
+              return (xNull ? 1 : -1) * (nullsFirst ? -1 : 1);
             }
-          });
-        }
-        return row[key] === cond;
-      };
-      let out = query ? rows.filter((row) => Object.entries(query).every(([k, c]) => matches2(row, k, c))) : [...rows];
-      const order = opts?.orderBy;
-      if (order) {
-        const dir = order.direction === "desc" ? -1 : 1;
-        out = [...out].sort((a, b) => {
-          const x = a[order.column];
-          const y = b[order.column];
-          return x === y ? 0 : (x < y ? -1 : 1) * dir;
+            if (x === y) continue;
+            return (x < y ? -1 : 1) * dir;
+          }
+          return 0;
         });
       }
-      return opts?.limit === void 0 ? out : out.slice(0, opts.limit);
+      const page = opts?.limit === void 0 ? out : out.slice(0, opts.limit);
+      const cols = opts?.select;
+      if (cols === void 0 || cols.length === 0) return page;
+      return page.map((row) => Object.fromEntries(cols.map((c) => [
+        c,
+        row[c]
+      ])));
     }
   };
   async function txPlan(plan) {
     const snapshot = /* @__PURE__ */ new Map();
-    for (const [table, rows] of store) snapshot.set(table, [...rows]);
+    for (const [table, rows] of store) snapshot.set(table, [
+      ...rows
+    ]);
     const trackedSnapshot = {
       inserted: cloneTracked(tracked.inserted),
       updated: cloneTracked(tracked.updated),
-      deleted: new Map([...tracked.deleted].map(([k, v]) => [k, [...v]]))
+      deleted: new Map([
+        ...tracked.deleted
+      ].map(([k, v]) => [
+        k,
+        [
+          ...v
+        ]
+      ]))
     };
     const results = [];
     try {
@@ -467,8 +769,11 @@ function createMockDB() {
       tracked.deleted = trackedSnapshot.deleted;
       throw err;
     }
-    return { results };
+    return {
+      results
+    };
   }
+  __name(txPlan, "txPlan");
   function applyOp(op, results) {
     switch (op.op) {
       case "upsert": {
@@ -480,27 +785,54 @@ function createMockDB() {
           for (const [key, value] of Object.entries(values)) {
             if (!conflict.includes(key)) hit[key] = value;
           }
-          return { rows: [hit], rows_affected: 1 };
+          return {
+            rows: [
+              hit
+            ],
+            rows_affected: 1
+          };
         }
-        const created = { id: crypto.randomUUID(), ...values };
+        const created = {
+          id: crypto.randomUUID(),
+          ...values
+        };
         rows.push(created);
         track(tracked.inserted, op.table, created);
-        return { rows: [created], rows_affected: 1 };
+        return {
+          rows: [
+            created
+          ],
+          rows_affected: 1
+        };
       }
       case "insert": {
-        const record = { id: crypto.randomUUID(), ...resolveMap(op.values ?? {}, results, null) };
+        const record = {
+          id: crypto.randomUUID(),
+          ...resolveMap(op.values ?? {}, results, null)
+        };
         rowsOf(op.table).push(record);
         track(tracked.inserted, op.table, record);
-        return { rows: [record], rows_affected: 1 };
+        return {
+          rows: [
+            record
+          ],
+          rows_affected: 1
+        };
       }
       case "insertMany": {
         const written = (op.rows ?? []).map((row) => {
-          const record = { id: crypto.randomUUID(), ...resolveMap(row, results, null) };
+          const record = {
+            id: crypto.randomUUID(),
+            ...resolveMap(row, results, null)
+          };
           rowsOf(op.table).push(record);
           track(tracked.inserted, op.table, record);
           return record;
         });
-        return { rows: written, rows_affected: written.length };
+        return {
+          rows: written,
+          rows_affected: written.length
+        };
       }
       case "update": {
         const rows = rowsOf(op.table);
@@ -509,12 +841,18 @@ function createMockDB() {
         for (let i = 0; i < rows.length; i++) {
           const row = rows[i];
           if (!row || !matches(row, where)) continue;
-          const next = { ...row, ...resolveMap(op.set ?? {}, results, row) };
+          const next = {
+            ...row,
+            ...resolveMap(op.set ?? {}, results, row)
+          };
           rows[i] = next;
           track(tracked.updated, op.table, next);
           written.push(next);
         }
-        return { rows: written, rows_affected: written.length };
+        return {
+          rows: written,
+          rows_affected: written.length
+        };
       }
       case "delete": {
         const rows = rowsOf(op.table);
@@ -526,23 +864,32 @@ function createMockDB() {
           const list = tracked.deleted.get(op.table);
           const key = typeof id === "string" ? id : String(id);
           if (list) list.push(key);
-          else tracked.deleted.set(op.table, [key]);
+          else tracked.deleted.set(op.table, [
+            key
+          ]);
         }
-        return { rows: removed, rows_affected: removed.length };
+        return {
+          rows: removed,
+          rows_affected: removed.length
+        };
       }
       case "select": {
         const where = resolveMap(op.where ?? {}, results, null);
         let found = rowsOf(op.table).filter((row) => matches(row, where));
         if (op.limit !== void 0) found = found.slice(0, op.limit);
-        return { rows: found, rows_affected: found.length };
+        return {
+          rows: found,
+          rows_affected: found.length
+        };
       }
     }
   }
+  __name(applyOp, "applyOp");
   const client = {
     ...ops,
     // No real savepoint in memory: the fake runs the callback against the SAME
     // store. An assertion about rollback here would be asserting the fake.
-    attempt: (fn) => fn(ops),
+    attempt: /* @__PURE__ */ __name((fn) => fn(ops), "attempt"),
     txPlan,
     // In tests there is no real DB role; `asService()` returns the same
     // in-memory client so RLS-bypass code paths still hit the same store and
@@ -561,14 +908,25 @@ function createMockDB() {
       return tracked.deleted.get(table) ?? [];
     },
     seed(table, data) {
-      store.set(table, [...data]);
+      store.set(table, [
+        ...data
+      ]);
     }
   };
   return client;
 }
+__name(createMockDB, "createMockDB");
 function cloneTracked(map) {
-  return new Map([...map].map(([k, v]) => [k, [...v]]));
+  return new Map([
+    ...map
+  ].map(([k, v]) => [
+    k,
+    [
+      ...v
+    ]
+  ]));
 }
+__name(cloneTracked, "cloneTracked");
 function resolveValue(value, results, current, column) {
   if (typeof value !== "object" || value === null) return value;
   const tagged = value;
@@ -590,6 +948,7 @@ function resolveValue(value, results, current, column) {
   }
   return value;
 }
+__name(resolveValue, "resolveValue");
 function resolveMap(map, results, current) {
   const out = {};
   for (const [key, value] of Object.entries(map)) {
@@ -597,11 +956,11 @@ function resolveMap(map, results, current) {
   }
   return out;
 }
+__name(resolveMap, "resolveMap");
 function matches(row, where) {
-  return Object.entries(where).every(
-    ([key, value]) => value === null ? row[key] === null || row[key] === void 0 : row[key] === value
-  );
+  return Object.entries(where).every(([key, value]) => value === null ? row[key] === null || row[key] === void 0 : row[key] === value);
 }
+__name(matches, "matches");
 function guardFailure(guard, count) {
   if (!guard) return null;
   const ok = guard.kind === "one" ? count === 1 : guard.kind === "none" ? count === 0 : guard.kind === "atLeast" ? count >= guard.n : count <= guard.n;
@@ -611,6 +970,7 @@ function guardFailure(guard, count) {
     message: `expected ${guard.kind} ${guard.n} row(s), got ${count}`
   });
 }
+__name(guardFailure, "guardFailure");
 function txRejection(status, code, extra) {
   const err = new Error(extra.message);
   err.status = status;
@@ -618,30 +978,36 @@ function txRejection(status, code, extra) {
   if (extra.slot !== void 0) err.slot = extra.slot;
   return err;
 }
+__name(txRejection, "txRejection");
 
 // src/test/fake-db.ts
 function fakeDatabase() {
   const mock = createMockDB();
   const queries = [];
   const db = Object.assign(Object.create(Object.getPrototypeOf(mock)), mock, {
-    query: async (sql, params = []) => {
-      queries.push({ sql, params });
+    query: /* @__PURE__ */ __name(async (sql, params = []) => {
+      queries.push({
+        sql,
+        params
+      });
       return mock.query(sql, params);
-    }
+    }, "query")
   });
   return {
     db,
     queries,
-    seed: (table, rows) => mock.seed(table, rows),
-    inserted: (table) => mock.inserted(table),
-    updated: (table) => mock.updated(table),
-    deleted: (table) => mock.deleted(table)
+    seed: /* @__PURE__ */ __name((table, rows) => mock.seed(table, rows), "seed"),
+    inserted: /* @__PURE__ */ __name((table) => mock.inserted(table), "inserted"),
+    updated: /* @__PURE__ */ __name((table) => mock.updated(table), "updated"),
+    deleted: /* @__PURE__ */ __name((table) => mock.deleted(table), "deleted")
   };
 }
+__name(fakeDatabase, "fakeDatabase");
 export {
   TestApiError,
   api,
   createTestApi,
-  fakeDatabase
+  fakeDatabase,
+  isolated
 };
 //# sourceMappingURL=index.js.map