@palbase/backend 25.1.0 → 27.1.0

package/dist/index-CW21M9Z3.d.ts

@@ -1,1222 +0,0 @@
-import { Tables, TableTypes, Schemas } from './db/env.js';
-import { D as DBClient, b8 as TxPlanHandle, bh as TxTable, M as Materialized } from './endpoint-CTEHhb7A.js';
-
-/** On delete action for foreign key references. */
-type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
-/**
- * The ON DELETE actions permitted on a foreign key to the built-in auth users
- * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached
- * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK
- * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the
- * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real
- * boundary, this narrows the type so the common mistake is caught at compile time.
- */
-type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
-/** Column type identifiers. */
-type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum' | 'vector';
-/** Base column definition shared by all column types. */
-interface ColumnDef {
-    type: ColumnType;
-    nullable: boolean;
-    primaryKey: boolean;
-    defaultValue?: unknown;
-    defaultRandom?: boolean;
-    defaultNow?: boolean;
-    references?: {
-        table: string;
-        column: string;
-    };
-    /** Pending FK target, resolved by `defineSchema` once every binding exists. */
-    referencesThunk?: () => ColumnBuilder;
-    /** FK onto THIS table — no thunk needed, the target is the declaring table. */
-    selfRefColumn?: string;
-    /** This column OWNS the row: erasure, RLS and the `owner` relation read it. */
-    owns?: true;
-    /** Explicit name for the FORWARD relation (child → parent), when the one
-     * derived from the column would be ambiguous or unclear. */
-    refAs?: string;
-    /**
-     * Explicit name for the REVERSE relation (parent → children).
-     *
-     * Separate from {@link refAs} because the two directions are different facts:
-     * the forward name describes the parent this row points at (`author`), the
-     * reverse one describes the rows hanging off the parent (`posts`). One option
-     * naming both made an ordinary schema undeclarable — `posts.author_id` and
-     * `comments.author_id` both named `{ as: "author" }` collided on `users`, and
-     * the refusal asked for the `{ as }` they had both already written.
-     */
-    reverseAs?: string;
-    /** The table this column belongs to; set by `defineTable`. */
-    ownerTable?: {
-        name: string;
-        columns: Record<string, ColumnBuilder>;
-    };
-    /**
-     * The name this column used to have. A diff cannot tell a rename from a drop and
-     * an add — both leave one name gone and another present — so the intent has to be
-     * declared. Without it, renaming a column loses its data.
-     */
-    renamedFrom?: string;
-    /**
-     * This release's PROMISE that it does not reference this column — neither
-     * reads it nor writes it, and never names it in a filter, a sort or a SET.
-     *
-     * The contraction gate reads it and nothing else does: dropping a column is
-     * refused while the RUNNING release's declaration still lacks this mark, so
-     * removing a column is two deploys — mark it, ship, then drop it.
-     *
-     * The word is `ignored` and not `deprecated` deliberately: RFC 9745 defines
-     * deprecation as changing NO behaviour, and this changes what a deploy will
-     * accept. Rails calls the same thing `ignored_columns`.
-     */
-    ignored?: boolean;
-    onDeleteAction?: OnDeleteAction;
-    enumName?: string;
-    enumValues?: string[];
-    unique?: boolean;
-    /**
-     * The value is written by the DATABASE — a trigger, a rule, an identity — not by
-     * the author and not by a DEFAULT this schema declares. It makes the column
-     * optional on INSERT without putting a DEFAULT in the DDL.
-     *
-     * Before this existed the only way to keep a trigger-filled column off the
-     * INSERT type was to give it a fake `default()`: a value the schema claimed to
-     * write and the trigger immediately overwrote. That made the schema lie about
-     * its own data.
-     */
-    dbAssigned?: boolean;
-    /** vector(n): the declared dimension count — part of the TYPE (typmod), read
-     * by the wire serializer and the deploy's auto-index (FR-001). */
-    dimensions?: number;
-    /**
-     * How the stored value is projected in and out of this process (FR-009).
-     *
-     * NOT part of the DDL: the column's Postgres type is unchanged and this pair
-     * is never serialized into a migration. It exists so the row surface can hand
-     * back the type the application actually works with.
-     */
-    transform?: ColumnTransform;
-}
-/**
- * The read/write pair a column may declare (FR-009).
- *
- * `fromDb` takes whatever the driver produced for this column and returns the
- * value the application sees; `toDb` is its inverse on the way out. Kept
- * deliberately unexported — a column declares one inline, nobody needs to name
- * the shape.
- */
-interface ColumnTransform<T = unknown> {
-    fromDb: (value: unknown) => T;
-    toDb: (value: T) => unknown;
-}
-declare const __colKind: unique symbol;
-declare const __colNullable: unique symbol;
-declare const __colHasDefault: unique symbol;
-declare const __colEnumValues: unique symbol;
-declare const __colPayload: unique symbol;
-declare const __colTransform: unique symbol;
-/**
- * Fluent column builder with phantom type params:
- *  K — ColumnType literal (e.g. "text", "integer")
- *  N — boolean: true when nullable() has been called last (false = NOT NULL)
- *  D — boolean: true when a default has been set
- *  E — enum value union (never for non-enum columns)
- *  P — jsonb payload shape (unknown unless jsonb<T>() supplied one)
- *  T — transform target type (`never` when the column declares no transform;
- *      `never` is the sentinel because it is the only type that survives
- *      `[T] extends [never]` and never collides with a real target type)
- *
- * All six params have defaults so bare `ColumnBuilder` (no args) still
- * satisfies `Record<string, ColumnBuilder>` in schema.ts without modification.
- *
- * The six `declare readonly` brand fields carry the phantom types into the
- * structural shape so that conditional types like ColValue<C> can discriminate
- * on K without requiring runtime values on those fields.
- */
-declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean = boolean, D extends boolean = boolean, E = unknown, P = unknown, T = unknown> {
-    readonly [__colKind]: K;
-    readonly [__colNullable]: N;
-    readonly [__colHasDefault]: D;
-    readonly [__colEnumValues]: E;
-    readonly [__colPayload]: P;
-    readonly [__colTransform]: T;
-    readonly _def: ColumnDef;
-    constructor(type: K, existingDef?: ColumnDef);
-    /** Mark this column as the primary key. */
-    primaryKey(): ColumnBuilder<K, N, D, E, P, T>;
-    /** Mark this column as NOT NULL (default). */
-    notNull(): ColumnBuilder<K, false, D, E, P, T>;
-    /** Allow NULL values. */
-    nullable(): ColumnBuilder<K, true, D, E, P, T>;
-    /** Set a default value. */
-    default(value: unknown): ColumnBuilder<K, N, true, E, P, T>;
-    /** UUID: generate a random default (gen_random_uuid()). */
-    defaultRandom(): ColumnBuilder<K, N, true, E, P, T>;
-    /** Timestamp: default to now(). */
-    defaultNow(): ColumnBuilder<K, N, true, E, P, T>;
-    /**
-     * The DATABASE assigns this column's value — a trigger, a rule, an identity.
-     *
-     * The column becomes optional on INSERT (the author has nothing to send) while
-     * the DDL stays free of a DEFAULT this schema would not honour. It is NOT
-     * `default()`: that declares a value the schema promises to write.
-     *
-     * Naming: deliberately not `generated()`. Postgres has GENERATED columns and
-     * they are a different thing; borrowing the word would send a reader — or a
-     * model writing a schema — to the wrong feature.
-     */
-    dbAssigned(): ColumnBuilder<K, N, true, E, P, T>;
-    /** Add a foreign key reference. */
-    /**
-     * Declares that this column used to be called `previous`.
-     *
-     * A schema diff sees one name gone and another present; it cannot know whether
-     * you renamed a column or dropped one and added another, and the two are very
-     * different — the second loses every value. Saying so here turns the plan into
-     * `ALTER TABLE … RENAME COLUMN` instead.
-     *
-     * Once the rename has been applied the annotation is inert (the old name is no
-     * longer there to rename), so it can be deleted at your leisure.
-     */
-    renamedFrom(previous: string): ColumnBuilder<K, N, D, E, P, T>;
-    /**
-     * See {@link ColumnDef.ignored}.
-     *
-     * COPIES the def rather than mutating it. The constructor takes an existing
-     * def BY REFERENCE, so every builder derived from another shares one object —
-     * `const a = slug.unique()` leaves `a._def === slug._def`. An in-place
-     * `ignored = true` therefore marks every column sharing that def, including
-     * one another table actively reads, and the gate would let THAT column be
-     * dropped. Measured before this copy existed.
-     *
-     * The aliasing is older than this method and other fields leak through it too.
-     * The reason this one cannot wait: every other leak produces a VISIBLE schema
-     * difference — the plan shows it, the DDL shows it. This one is invisible by
-     * design (no DDL, no diff, no plan line), so its only effect is to disarm a
-     * safety gate in silence.
-     */
-    ignored(): ColumnBuilder<K, N, D, E, P, T>;
-    /**
-     * Foreign key onto another table's column.
-     *
-     * The target is a THUNK, not a direct reference. In a cycle (`x → y`, `y → x`)
-     * the second table does not exist yet when the first is built; a direct
-     * reference makes TypeScript chase its own tail (TS7022 — measured, and making
-     * the return type independent of the target does NOT help). The thunk is
-     * invoked in `defineSchema`, where every binding exists and every table
-     * already knows its name.
-     *
-     * In a cycle, ONE side needs an explicit return type:
-     * `references((): AnyColumn => y.id)`. One side is enough — measured.
-     * For a self-reference use `selfReferences(column)`: no thunk, no annotation.
-     *
-     * `as` names the FORWARD relation (`author_id` → `author` by default);
-     * `reverseAs` names the REVERSE one on the parent, whose default is this
-     * table's own name (`users.posts`). Two foreign keys from one table onto one
-     * parent therefore need a `reverseAs` on at least one of them — the reverse
-     * names would otherwise both be this table's name.
-     */
-    references(target: () => AnyColumn, opts?: {
-        as?: string;
-        reverseAs?: string;
-        onDelete?: OnDeleteAction;
-    }): ColumnBuilder<K, N, D, E, P, T>;
-    /**
-     * Foreign key onto THIS table (`parent_id → id`) — category trees, comment
-     * replies, org charts.
-     *
-     * No thunk and no type annotation: the target table is the one being declared,
-     * so there is nothing to defer and nothing for TypeScript to chase in a circle.
-     * Drizzle forces an explicit `(): AnyPgColumn =>` here because its reference
-     * always goes through a callback; measured, we do not need one.
-     */
-    selfReferences(column: string, opts?: {
-        as?: string;
-        onDelete?: OnDeleteAction;
-    }): ColumnBuilder<K, N, D, E, P, T>;
-    /** Set the ON DELETE action for a foreign key reference. */
-    onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P, T>;
-    /** Add a single-column UNIQUE constraint. */
-    unique(): ColumnBuilder<K, N, D, E, P, T>;
-    /**
-     * Declare how this column's value is projected in and out of the process.
-     *
-     * The DDL does not move: `numeric` stays `numeric`, and the driver still hands
-     * back what Postgres sent. What changes is the type the row surface exposes —
-     * it becomes `Target`:
-     *
-     *   amount: numeric().transform<number>({ fromDb: Number, toDb: String })
-     *
-     * `numeric` surfacing as `string` is CORRECT (a JS number cannot hold
-     * arbitrary precision), and that is exactly why this exists: application code
-     * that does arithmetic on the column otherwise rewrites the same
-     * `Number(row.amount)` / `String(x)` pair in every controller that touches it,
-     * and each rewrite is a place the two directions can drift apart.
-     *
-     * A transform is a PROJECTION, never a constraint: it lives only in this
-     * process, so it can neither validate nor migrate what is stored.
-     */
-    transform<Target>(fns: ColumnTransform<Target>): ColumnBuilder<K, N, D, E, P, Target>;
-}
-/**
- * Extracts the TypeScript value type for a column, respecting nullability.
- * - "uuid" | "text" | "timestamp" | "bigint" | "numeric" → string (or string | null when N = true)
- *   Note: bigint/numeric surface as string — JS number loses precision past 2^53,
- *   and pgx/PostgREST serialize int8/numeric as strings. App code uses
- *   BigInt(row.amount) for bigint, or a decimal lib for numeric.
- * - "integer" → number
- * - "boolean" → boolean
- * - "jsonb" → P (the dev-supplied payload shape from jsonb<T>(), else unknown)
- * - "enum" → E (the union of literal values)
- *
- * A declared `.transform<T>()` OVERRIDES the table above: the column then
- * surfaces as T (or T | null when nullable), because that is the value the
- * application is handed. Nullability is still the column's, not the
- * transform's — `fromDb` is not called for a NULL.
- */
-type ColValue<C> = C extends ColumnBuilder<ColumnType, infer N, boolean, unknown, unknown, infer T> ? [unknown] extends [T] ? ColStoredValue<C> : N extends true ? T | null : T : never;
-/** The value as the DATABASE hands it over — the branch table above, before any
- * transform. This is what a column's `fromDb` receives. */
-type ColStoredValue<C> = C extends ColumnBuilder<'uuid' | 'text' | 'timestamp' | 'bigint' | 'numeric', infer N, infer _D, infer _E, infer _P> ? N extends true ? string | null : string : C extends ColumnBuilder<'integer', infer N, infer _D, infer _E, infer _P> ? N extends true ? number | null : number : C extends ColumnBuilder<'boolean', infer N, infer _D, infer _E, infer _P> ? N extends true ? boolean | null : boolean : C extends ColumnBuilder<'jsonb', infer N, infer _D, infer _E, infer P> ? N extends true ? P | null : P : C extends ColumnBuilder<'vector', infer N, infer _D, infer _E, infer _P> ? N extends true ? number[] | null : number[] : C extends ColumnBuilder<'enum', infer N, infer _D, infer E, infer _P> ? N extends true ? E | null : E : never;
-/**
- * True when a column is optional on INSERT:
- *  - nullable columns (N = true) — the DB allows NULL so the field may be omitted
- *  - columns with a default (D = true) — the DB fills in the value when absent
- */
-type ColIsOptionalOnInsert<C> = C extends ColumnBuilder<ColumnType, true, boolean, unknown, unknown, unknown> ? true : C extends ColumnBuilder<ColumnType, boolean, true, unknown, unknown, unknown> ? true : false;
-/** Create a UUID column. */
-declare function uuid(): ColumnBuilder<'uuid', false, false, never>;
-/** Create a TEXT column. */
-declare function text(): ColumnBuilder<'text', false, false, never>;
-/** Create an INTEGER column. Emits int4 (max ~2.1B). */
-declare function integer(): ColumnBuilder<'integer', false, false, never>;
-/**
- * Create a BIGINT column (Postgres int8, max ~9.2×10^18).
- * Surfaces as `string` in row/insert types — JS number loses precision past 2^53
- * and pgx/PostgREST serialize int8 as a JSON string. Use BigInt(row.column) in app code.
- */
-declare function bigint(): ColumnBuilder<'bigint', false, false, never>;
-/**
- * Create a NUMERIC column (Postgres `numeric`/`decimal`, arbitrary precision).
- * For exact fractional values (money with cents as a decimal, rates, weights)
- * where int4/int8 don't fit. Surfaces as `string` in row/insert types — JS
- * number can't hold arbitrary-precision decimals without rounding, and
- * pgx/PostgREST serialize numeric as a JSON string. Parse with a decimal lib
- * (or BigInt for scaled integers) in app code.
- */
-declare function numeric(): ColumnBuilder<'numeric', false, false, never>;
-/** Create a BOOLEAN column. */
-declare function boolean(): ColumnBuilder<'boolean', false, false, never>;
-/** Create a TIMESTAMP column. */
-declare function timestamp(): ColumnBuilder<'timestamp', false, false, never>;
-/**
- * Create a JSONB column. Pass a payload type to make the generated row/insert
- * type concrete instead of `unknown`:
- *
- *   tags: jsonb<string[]>()           // row.tags: string[]
- *   meta: jsonb<{ tier: string }>()   // row.meta: { tier: string }
- *   raw:  jsonb()                      // row.raw: unknown (back-compat)
- *
- * The runtime accepts a plain JS object/array directly (no JSON.stringify); the
- * generic only refines the TYPE the env codegen emits.
- */
-declare function jsonb<T = unknown>(): ColumnBuilder<'jsonb', false, false, never, T>;
-/**
- * Create an ENUM column.
- * @param name   The PostgreSQL enum type name (used in DDL).
- * @param values A readonly tuple of valid string values — kept `const` so the
- *               union `V[number]` is as narrow as possible.
- */
-declare function enumType<const V extends readonly string[]>(name: string, values: V): ColumnBuilder<'enum', false, false, V[number]>;
-/** vector(n) — pgvector kolonu. n TİPİN parçasıdır (typmod) ve [1, 2000] —
- * 2000 = pgvector'ün HNSW-indekslenebilir tavanı; auto-index bu beyanla bağlı
- * (spec FR-001, D-3). */
-declare function vector(dimensions: number): ColumnBuilder<'vector', false, false, unknown, number[]>;
-/**
- * Any column, whatever its type parameters.
- *
- * Exported so a cycle can be broken from ONE side:
- * `references((): AnyColumn => y.id)`.
- */
-type AnyColumn = ColumnBuilder;
-/**
- * The column that OWNS this row: a `text` FK onto `auth.users(id)`, NOT NULL,
- * ON DELETE CASCADE.
- *
- * Ownership drives account erasure, so cascade is the only correct action and
- * takes no argument. The referencing column must be `text` (palauth ids are
- * `usr_<uuid>`) and NOT NULL — both are implied here rather than left to the
- * caller, so three rules the type could not express before become UNWRITABLE.
- *
- * At most ONE per table. The old shape let several columns reference
- * `auth.users` and picked the FIRST IN DECLARATION ORDER as the owner — moving a
- * `created_by` above a `user_id` silently changed which rows an account deletion
- * took with it. A second one is now rejected at push.
- *
- * For a column that merely POINTS at a user without owning the row
- * (`created_by`, `edited_by`), use `userRef({ onDelete })`.
- */
-declare function ownedByUser(): ColumnBuilder<'text', false, false, never>;
-/**
- * A plain FK onto `auth.users(id)` that does NOT own the row.
- *
- * `created_by` / `edited_by`: deleting that user must not delete the row. ON
- * DELETE is required and limited to `cascade | set null` so an erasure request
- * is never blocked by a lingering FK; `set null` needs a nullable column.
- */
-declare function userRef(opts: {
-    onDelete: AuthUserOnDelete;
-    as?: string;
-}): ColumnBuilder<'text', boolean, false, never>;
-/**
- * A plain FK onto `auth.installations(id)` — the app-scoped verified-device
- * anchor.
- *
- * An installation is an APP INSTALL, not a user: this is NOT ownership. A
- * user-owned row still needs its own `ownedByUser()` so account erasure removes
- * it; an installation reference alone does not tie a row to a user's deletion.
- */
-declare function installationRef(opts: {
-    onDelete: AuthUserOnDelete;
-    as?: string;
-}): ColumnBuilder<'text', boolean, false, never>;
-
-/**
- * policy.ts — the RLS policy authoring DSL.
- *
- * `policy(name)` returns a fluent builder that mirrors the `ColumnBuilder`
- * style in columns.ts: each chainable method mutates the underlying
- * definition and returns the builder so calls compose. The terminal value is
- * a plain {@link PolicyDef} — the exact JSON shape the runtime's
- * `schema_extract.js` reads off the bundled module and the Go side parses into
- * `PolicyJSON` (CONTRACT-POLICY).
- *
- * @example
- * import { policy } from "@palbase/backend";
- *
- * policy("owner_select")
- *   .for("select")
- *   .to("authenticated")
- *   .using("owner = (select auth.uid())");
- */
-/** The SQL command a policy applies to. `"all"` covers SELECT/INSERT/UPDATE/DELETE. */
-type PolicyCommand = "all" | "select" | "insert" | "update" | "delete";
-/** Whether a policy is permissive (OR-combined, the default) or restrictive
- * (AND-combined). Mirrors Postgres `CREATE POLICY ... AS PERMISSIVE|RESTRICTIVE`. */
-type PolicyMode = "permissive" | "restrictive";
-/**
- * The compiled, serializable policy definition — the EXACT shape consumed by
- * `schema_extract.js` → Go `PolicyJSON` (CONTRACT-POLICY).
- *
- * - `roles`: the DB roles this policy applies to (`TO` clause). An empty array
- *   means the policy applies to PUBLIC (all roles) — the Postgres default.
- * - `using`: the `USING (...)` row-visibility expression, or `null` when none.
- * - `withCheck`: the `WITH CHECK (...)` write-validation expression, or `null`.
- * - `permissive`: `true` for `AS PERMISSIVE` (default), `false` for restrictive.
- */
-interface PolicyDef {
-    name: string;
-    command: PolicyCommand;
-    roles: string[];
-    using: string | null;
-    withCheck: string | null;
-    permissive: boolean;
-}
-declare class PolicyBuilder {
-    readonly _def: PolicyDef;
-    constructor(name: string);
-    /** Restrict the policy to a single SQL command (default `"all"`). */
-    for(command: PolicyCommand): this;
-    /**
-     * Set the DB roles the policy applies to (the `TO` clause), replacing any
-     * previously-set roles. Call with no arguments to target PUBLIC (all roles).
-     *
-     * @example
-     * policy("p").to("authenticated")
-     * policy("p").to("authenticated", "service_role")
-     * policy("p").to() // PUBLIC
-     */
-    to(...roles: string[]): this;
-    /** Set the `USING (...)` row-visibility expression (raw SQL). */
-    using(sqlExpr: string): this;
-    /**
-     * "Rows of THIS table whose owner the caller is a member of" — the membership
-     * pattern, written so it cannot recurse.
-     *
-     * THE TRAP IT EXISTS FOR. Written by hand, membership policies point at each
-     * other: `channels` is visible to members, so its policy reads
-     * `channel_members`; `channel_members` is visible to members, so its policy
-     * reads `channels`. Postgres refuses the pair at query time with `infinite
-     * recursion detected in policy for relation ...`, and the error names the
-     * relation but not the cycle. The way out is asymmetry — the MEMBERSHIP table
-     * is protected by `user_id = auth.uid()` and nothing else, and every other
-     * table subqueries INTO it. That shape was in the platform's own schema and
-     * written down nowhere; a customer recovered it by reading that schema.
-     *
-     * `(select auth.uid())` rather than a bare call: the scalar subquery is
-     * evaluated ONCE per statement instead of per row.
-     *
-     * @example
-     * // channels: visible to members. The membership table gets the simple one.
-     * policy("member_read").for("select").to("authenticated")
-     *   .memberOf("channel_members", "channel_id")
-     * // → id IN (SELECT "channel_id" FROM "channel_members"
-     * //          WHERE "user_id" = (select auth.uid()))
-     */
-    memberOf(membershipTable: string, foreignKey: string, options?: {
-        column?: string;
-        userColumn?: string;
-    }): this;
-    /** Set the `WITH CHECK (...)` write-validation expression (raw SQL). */
-    withCheck(sqlExpr: string): this;
-    /** Set the policy mode: `"permissive"` (default, OR-combined) or
-     * `"restrictive"` (AND-combined). */
-    as(mode: PolicyMode): this;
-}
-/**
- * Start authoring an RLS policy. Returns a {@link PolicyBuilder}; the resulting
- * `PolicyBuilder` is accepted directly in a table's `policies: [...]` array
- * (its `_def` is read at schema-extract time).
- *
- * @param name The policy name. Palbase reconciliation keys policies by
- *             `(table, name)`, so names must be unique per table.
- */
-declare function policy(name: string): PolicyBuilder;
-
-/**
- * Postgres extensions a Palbase project can enable from its schema.
- *
- * Extensions are config-as-code: declare them in `defineSchema({ extensions })`
- * and the deploy installs them (CREATE EXTENSION … SCHEMA extensions) using the
- * deploy path's privileged connection. They are NOT toggled live from Studio —
- * CREATE EXTENSION requires a superuser role that only the deploy path holds.
- *
- * The list is an allowlist (a string-literal union) so editors autocomplete the
- * supported names and a typo fails typecheck. It is intentionally extensible:
- * add a name here (+ confirm the base image ships it) to support more.
- */
-declare const PALBASE_EXTENSIONS: readonly ["vector", "pg_trgm", "unaccent", "citext", "cube", "earthdistance", "hstore", "ltree", "btree_gist", "pgcrypto", "uuid-ossp"];
-/** A Postgres extension supported by Palbase (allowlist union). */
-type PalbaseExtension = (typeof PALBASE_EXTENSIONS)[number];
-/**
- * Extensions that depend on another extension. The deploy installs
- * dependencies first; declaring `earthdistance` without `cube` still works
- * because the deploy resolves the order, but listing both is clearer.
- */
-declare const EXTENSION_DEPENDENCIES: Partial<Record<PalbaseExtension, PalbaseExtension[]>>;
-/** Runtime guard: is `name` a supported Palbase extension? */
-declare function isPalbaseExtension(name: string): name is PalbaseExtension;
-
-/**
- * A named raw-SQL DDL object declared in a schema file (`db/public.ts`,
- * `db/billing.ts`, …) for anything the typed DSL
- * cannot express (EXCLUDE, CHECK, partial/expression indexes, triggers, views).
- * The deploy emits `up` verbatim on the privileged DDL connection — same trust
- * posture as policy().using(). Tracked by NAME (not by diffing the body), so a
- * changed body needs a new name or an explicit drop+add.
- */
-interface RawConstraintDef {
-    name: string;
-    up: string;
-    down?: string;
-}
-declare function raw(name: string, up: string, opts?: {
-    down?: string;
-}): RawConstraintDef;
-
-/** Embedding sağlayıcı DESKRIPTORU — canlı istemci değil, düz veri: şemayla
- * birlikte serileşir, çağrıyı Go worker (yazma) ve engine (sorgu) yapar.
- * Adlandırma Vercel AI SDK'nın aynasıdır (openai.embedding("...")) ama paket
- * bağımlılığı bilinçli olarak YOKTUR (spec C-3, UD-016). v1 sağlayıcı: openai (D-10). */
-interface EmbeddingModelRef {
-    provider: "openai";
-    model: string;
-    dimensions?: number;
-    apiKeyName?: string;
-    baseURL?: string;
-}
-/** Chat/damıtma modeli DESKRIPTORU (C-11, D-019) — memory beyanının extract'i.
- * Embedding gibi düz veridir; çağrıyı worker yapar, anahtar vault'taki
- * OPENAI_API_KEY'dir (D-017: aynı sağlayıcı, yeni dış sistem yok). */
-interface ChatModelRef {
-    provider: "openai";
-    model: string;
-}
-declare const openai: {
-    embedding(model: string, opts?: {
-        dimensions?: number;
-        apiKeyName?: string;
-        baseURL?: string;
-    }): EmbeddingModelRef;
-    chat(model: string): ChatModelRef;
-};
-
-/**
- * A map of column builders keyed by column name — the value you write under
- * the `columns` key of `defineTable("<name>", { columns })`.
- *
- * The default `Record<string, ColumnBuilder>` keeps bare references compiling
- * without a type argument.
- */
-type ColumnMap = Record<string, ColumnBuilder>;
-/**
- * The author-facing value written under each table key:
- * `{ columns, rls?, policies? }`.
- *
- * - `columns`: the column map (required).
- * - `rls`: enable + FORCE row-level security on this table. **Defaults to
- *   `true`**, and is forced on when `policies` is non-empty. A table with RLS
- *   and no policies is deny-all, which is the starting state: nothing reads it
- *   until a policy says who may. Set `rls: false` only for a genuinely public
- *   table — it is an explicit opt-out that a reviewer can grep for, not
- *   something you get by forgetting.
- * - `policies`: the RLS policies for this table, authored with `policy(name)`.
- *   Each entry may be a {@link PolicyBuilder} (the normal `policy(...)` chain)
- *   or a raw {@link PolicyDef} object.
- *
- * The `C` type parameter preserves the precise per-column phantom types so the
- * typed `Database.tables.*` surface keeps inferring insert/row shapes.
- */
-/** Arama metriği — tek kelime; opclass ve operatör bundan türetilir, asla yüzeye çıkmaz (D-5/D-6). */
-type SearchMetric = "cosine" | "euclidean" | "inner_product";
-/** Bir vektör arama kolu. `model` varsa auto-embed: platform yazma+sorgu embedding'ini üstlenir (D-9). */
-interface VectorSearchDecl {
-    /** Hedef vector kolonu; tabloda TEK vector kolonu varsa atlanabilir (Go apply çözer, FR-010). */
-    column?: string;
-    /** Varsa auto-embed. Deskriptor düz veridir — şemayla serileşir (C-3). */
-    model?: EmbeddingModelRef;
-    /** model varsa ZORUNLU: embed kaynak kolonları = trigger'ın UPDATE OF listesi (C-2). */
-    from?: string[];
-    metric?: SearchMetric;
-    /** Kaynak metin değişince ara-dönem davranışı (yalnız auto-embed'de):
-     * "null" (vars.) — embedding anında NULL'lanır; satır yeni vektör yazılana
-     *   dek anlamsal aramada aday değildir. Bayat eşleşme asla servis edilmez.
-     * "keep" — eski vektör aramada kalır, platform yenisini yazınca sessizce
-     *   değişir. Görünürlük penceresi sıfır; bedeli saniyeler süren bayat
-     *   eşleşme riski (Confluence-tipi sync yükleri için). */
-    staleness?: "null" | "keep";
-}
-/** Tablonun arama beyanı — İKİ biçim (D-007, tek yüzey):
- *
- * YENİ (önerilen): `{ from, model, ... }` — `from` kolonları hem FTS'e hem
- * embed'e girer. Tabloda vector kolonu declare edilmişse SATIR-modu; yoksa
- * CHUNK-modu otomatiktir (D-010): vektörler türev `__palbase_chunks`
- * tablosunda yaşar, içerik otomatik bölünür. `text: false` FTS'i kapatır,
- * `text: [..]` FTS kolonlarını from'dan ayırır. `chunks` yalnız ince ayar.
- *
- * ESKİ: `text: string[]` + `vector: {...}` — aynen çalışır, wire çıktısı
- * bayt-aynı kalır (NFR-B1). İki biçim KARIŞTIRILAMAZ. */
-interface SearchDecl {
-    text?: string[] | boolean;
-    vector?: VectorSearchDecl | VectorSearchDecl[];
-    /** Yeni biçim: arama kaynağı kolonlar (FTS + embed). Varlığı yeni biçimi seçer. */
-    from?: string[];
-    /** Yeni biçim: auto-embed modeli (zorunlu — BYO için eski biçimi kullanın). */
-    model?: EmbeddingModelRef;
-    metric?: SearchMetric;
-    staleness?: "null" | "keep";
-    /** Chunk-modu ince ayarı (yalnız vector kolonsuz tabloda anlamlı). */
-    chunks?: {
-        size?: number;
-        overlap?: number;
-    };
-    /** Sorgu-yeniden-yazımı: tek yönlü eş anlamlı haritası (FR-026). */
-    synonyms?: Record<string, string[]>;
-    /** Geçerlilik kolonları türetilir; arama varsayılan yalnız günceli tarar (FR-029). */
-    validity?: boolean;
-}
-/** Hafıza beyanı (FR-032, D-019): kaynak tablonun yazımlarından platform
- * fact damıtır ve `into` tablosuna yazar. Hedef NORMAL declared tablodur —
- * kendi search/unique/validity beyanlarıyla. Okuma = Database.search(into).
- * subject default "owner": fact'in kime ait olduğu kolonu (iki tabloda da). */
-interface MemoryDecl {
-    from: string[];
-    into: string;
-    extract: ChatModelRef;
-    subject?: string;
-}
-interface TableInput<C extends ColumnMap = ColumnMap> {
-    columns: C;
-    rls?: boolean;
-    policies?: (PolicyBuilder | PolicyDef)[];
-    /** Composite/named primary key (ordered column names). Omit for single-column inline .primaryKey(). */
-    primaryKey?: string[];
-    /** Named multi-column UNIQUE constraints. */
-    unique?: {
-        name: string;
-        columns: string[];
-    }[];
-    /** Named raw-SQL DDL objects (EXCLUDE, triggers, views) that the typed DSL cannot express. */
-    raw?: RawConstraintDef[];
-    /**
-     * Named first-class CHECK constraints. Diffed by NAME with a BODY compare:
-     * a changed `expr` (after pg normalization) recreates the constraint
-     * (DROP + ADD). `expr` is trusted SQL emitted verbatim (like policy USING),
-     * `name` is identifier-validated.
-     */
-    checks?: {
-        name: string;
-        expr: string;
-    }[];
-    /**
-     * Plain (non-unique) btree indexes over an ordered column list, emitted as
-     * standalone `CREATE INDEX [IF NOT EXISTS] name ON table (col1, col2)`
-     * statements (NOT a table clause — a separate migration statement category).
-     * Structural compare by NAME (no expression normalization). `name` and each
-     * column are identifier-validated by the Go differ.
-     *
-     * Scope: columns-only plain btree. Partial (`where`) and expression indexes
-     * are a deliberate follow-up — modelling them needs the same raw-SQL
-     * normalization round-trip CHECK uses (Task 10), so they are NOT in this
-     * type yet to avoid a half-working partial-index path.
-     */
-    indexes?: {
-        name: string;
-        columns: string[];
-    }[];
-    /** Arama beyanı — bkz. SearchDecl. */
-    search?: SearchDecl;
-    /** Hafıza beyanı — bkz. MemoryDecl (FR-032). */
-    memory?: MemoryDecl;
-}
-/**
- * A table definition — the runtime value the Go runtime's `schema_extract.js`
- * reads. It keys tables by `tableDef.name`, reads `tableDef.columns` for the
- * column DDL, and `tableDef.rls` + `tableDef.policies` for RLS.
- *
- * `defineSchema` derives `name` from the object key, so authors never repeat
- * the table name. `rls`/`policies` are always present after normalization
- * (defaulted to `true`/`[]`).
- *
- * The `C` type parameter preserves the precise per-column phantom types so that
- * downstream mapped types (InsertShape, RowShape) can discriminate on them.
- */
-interface TableDef<C extends ColumnMap = ColumnMap> {
-    name: string;
-    columns: C;
-    rls: boolean;
-    policies: PolicyDef[];
-    primaryKey?: string[];
-    unique?: {
-        name: string;
-        columns: string[];
-    }[];
-    /** Named raw-SQL DDL objects emitted verbatim on deploy. Tracked by name. */
-    raw?: RawConstraintDef[];
-    /** Named first-class CHECK constraints. Diffed by name + (normalized) body. */
-    checks?: {
-        name: string;
-        expr: string;
-    }[];
-    /** Plain btree indexes (columns-only), emitted as standalone CREATE INDEX. Diffed by name. */
-    indexes?: {
-        name: string;
-        columns: string[];
-    }[];
-    /** Arama beyanı, doğrulanmış ve taşınmış hali. */
-    search?: SearchDecl;
-    /** Hafıza beyanı, doğrulanmış ve taşınmış hali (FR-032). */
-    memory?: MemoryDecl;
-}
-/**
- * A schema definition containing multiple tables, keyed by table name.
- *
- * The `T` type parameter preserves the exact `TableDef<...>` type for each
- * table so that `SchemaDef["tables"]["rooms"]` resolves to the precise
- * `TableDef<{ id: ColumnBuilder<'uuid', false, true, never>; ... }>`.
- */
-interface SchemaDef<T extends Record<string, TableDef> = Record<string, TableDef>> {
-    /** The schema's own name — `public`, `billing`, … Declared, never derived. */
-    name: string;
-    /** Reachable over HTTP? False unless the author opts in. */
-    exposed: boolean;
-    tables: T;
-    /** Postgres extensions to install on deploy. Normalized to `[]` when absent. */
-    extensions: PalbaseExtension[];
-}
-/** Map the author's `{ tables: { <name>: { columns } } }` input to the
- * `{ tables: { <name>: TableDef<columns> } }` runtime/type shape, threading the
- * per-table column map `T[K]["columns"]` so column-level inference survives. */
-type TablesByName<T extends readonly TableHandle[]> = {
-    [K in T[number] as K[typeof TABLE_META]["name"]]: K[typeof TABLE_META];
-};
-/**
- * How a schema file reads. One file per schema — `db/public.ts`, `db/billing.ts`
- * — and the schema says its own name:
- *
- *   const todos = defineTable("todos", {
- *     columns: {
- *       id:    uuid().primaryKey().defaultRandom(),
- *       owner: text().notNull(),
- *       title: text().notNull(),
- *     },
- *     rls: true,
- *     policies: [
- *       policy("owner_all").for("all").to("authenticated")
- *         .using("owner = (select auth.uid())")
- *         .withCheck("owner = (select auth.uid())"),
- *     ],
- *   });
- *
- *   export default defineSchema("public", { tables: [todos] });
- *
- * The dictionary form `defineSchema({ tables: { todos: {…} } })` is RETIRED and
- * refused by name: a table whose name comes from a key does not know what it is
- * called while it is being built, so it cannot resolve `references(() =>
- * other.id)`, and a schema that does not say its own name cannot tell one
- * `invoices` from another schema's `invoices`.
- *
- * The returned value is `{ name, tables: { todos: { name, columns, rls,
- * policies } }, extensions, exposed }` — the exact shape the runtime schema
- * extractor parses. Per-column phantom types are preserved so
- * `Database.tables.todos.insert({...})` stays typed.
- *
- * RLS normalization: `rls` defaults to **`true`**, `policies` to `[]`. A table
- * that declares neither is therefore deny-all — nothing reads it until a policy
- * says who may, which is the safe starting point rather than a bug. Declare
- * `rls: false` for a genuinely public table; that is an explicit, greppable
- * statement of intent instead of an omission. When `policies` is non-empty,
- * `rls` is forced on (ENABLE + FORCE) regardless of the declared flag — a table
- * with policies must have RLS enabled or the policies would be inert.
- */
-/**
- * Where a table's metadata lives.
- *
- * The table VALUE is its columns, so `lists.id` is the column — which means a
- * column called `name` would overwrite the table's own name if metadata sat in
- * a plain field. Measured, not imagined: the existing `users` / `rooms` tests
- * (both declare a `name` column) produced an `[object Object]` table key.
- * `columns`, `rls`, `search`, `memory`, `unique` and `indexes` are all plausible
- * column names too. A column cannot collide with a symbol.
- */
-declare const TABLE_META: unique symbol;
-/** A value produced by `defineTable`: the columns, plus metadata behind the symbol. */
-type TableHandle<C extends ColumnMap = ColumnMap, N extends string = string> = C & {
-    readonly [TABLE_META]: TableDef<C> & {
-        name: N;
-    };
-};
-/**
- * Declare one table as a standalone value that KNOWS ITS OWN NAME.
- *
- * The name lives here, not in a dictionary key. A table whose name comes from a
- * key cannot resolve `references(() => other.id)` when it is built — it does not
- * know what to call itself — which forces a two-phase resolution with an
- * empty-name intermediate state. One name source, no empty identity.
- *
- * The returned object spreads its own columns, so a sibling can point at it:
- * `references(() => lists.id)`.
- */
-declare function defineTable<const N extends string, C extends ColumnMap>(name: N, input: TableInput<C>): TableHandle<C, N>;
-/**
- * Collect declared tables into one schema.
- *
- * Takes an ARRAY, not a dictionary: the tables already carry their names, and a
- * second name source is a second thing that can disagree.
- */
-declare function defineSchema<const T extends readonly TableHandle[]>(name: string, input: {
-    tables: T;
-    exposed?: boolean;
-    extensions?: PalbaseExtension[];
-}): SchemaDef<TablesByName<T>>;
-
-/**
- * typed-db.ts — Task 2: TypedDB schema-derived insert/row shapes.
- *
- * Derives INSERT and full-row TypeScript types from a `defineSchema()` result
- * and wraps the untyped runtime `DBClient` with a typed facade.
- *
- * No value-any. No `as unknown as X`. The two narrow `as` casts in
- * `makeTypedTable` are safe because:
- *  - `data as Record<string, unknown>`: InsertShape<T> maps string keys to
- *    typed values; all value types are subsets of `unknown`, so the cast is
- *    structurally sound.
- *  - `result as RowShape<T>`: The runtime DBClient returns `Record<string,
- *    unknown>` which is the erased form of the typed row; we're narrowing back
- *    to the precise shape that the schema declared.
- * Both casts are narrowing only (not widening) and correctness is guaranteed
- * by the schema the caller provides.
- */
-
-/** Keys of C whose columns are required on INSERT (not nullable, no default). */
-type RequiredKeys<C> = {
-    [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? never : K;
-}[keyof C];
-/** Keys of C whose columns are optional on INSERT (nullable or has a default). */
-type OptionalKeys<C> = {
-    [K in keyof C]: ColIsOptionalOnInsert<C[K]> extends true ? K : never;
-}[keyof C];
-/**
- * The TypeScript type for an INSERT payload for table `T`.
- * - Required: columns that are NOT NULL and have no DB-level default.
- * - Optional: columns that are nullable or carry a default.
- *
- * When all columns are optional, `RequiredKeys<C>` resolves to `never` and
- * the first part becomes `{}`, which is a neutral element for `&`.
- */
-type InsertShape<T extends TableDef> = {
-    [K in RequiredKeys<T["columns"]>]: ColValue<T["columns"][K]>;
-} & {
-    [K in OptionalKeys<T["columns"]>]?: ColValue<T["columns"][K]>;
-};
-/**
- * The TypeScript type for a full row returned by the DB for table `T`.
- * Every column is present; nullable columns resolve to `T | null`.
- */
-type RowShape<T extends TableDef> = {
-    [K in keyof T["columns"]]: ColValue<T["columns"][K]>;
-};
-/** A typed table accessor that mirrors the runtime DBClient surface. */
-interface TypedTable<T extends TableDef> {
-    insert(data: InsertShape<T>): Promise<RowShape<T>>;
-    upsert(data: InsertShape<T>, opts: {
-        onConflict: readonly string[];
-    }): Promise<RowShape<T>>;
-    /** Update the row by id; resolves to the updated row, or `null` if no row
-     * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
-     * `findById`. The runtime returns a null row rather than throwing. */
-    update(id: string, data: Partial<InsertShape<T>>): Promise<RowShape<T> | null>;
-    delete(id: string): Promise<void>;
-    findById(id: string): Promise<RowShape<T> | null>;
-    /** Rows matching the filter. Operators, ordering and paging are the ENGINE's
-     * surface — this declaration is what makes them callable. */
-    findMany(query?: WhereFilter<RowShape<T>>, opts?: FindManyOpts<RowShape<T>>): Promise<RowShape<T>[]>;
-    /** Update every matching row in one statement; an empty filter is refused. */
-    updateMany(where: WhereFilter<RowShape<T>>, set: Partial<InsertShape<T>>): Promise<RowShape<T>[]>;
-    /** Delete every matching row; resolves to how many. Empty filter refused. */
-    deleteMany(where: WhereFilter<RowShape<T>>): Promise<number>;
-    /** How many rows match. An empty filter is legitimate: counting is a read. */
-    count(where?: WhereFilter<RowShape<T>>): Promise<number>;
-}
-/** A typed DB facade covering all tables declared in schema `S`. */
-interface TypedDB<S extends SchemaDef> {
-    tables: {
-        [K in keyof S["tables"]]: TypedTable<S["tables"][K]>;
-    };
-    /** Run a transaction plan. See {@link EnvTypedDatabase.transaction}. */
-    transaction<T>(fn: (tx: TypedTx<S>) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
-}
-/** The plan-building handle a `TypedDB<S>` transaction callback receives: the
- * schema's tables, expressed as plan operations rather than awaited calls. */
-type TypedTx<S extends SchemaDef> = TxPlanHandle<{
-    [K in keyof S["tables"]]: TxTable<RowShape<S["tables"][K]>, InsertShape<S["tables"][K]>>;
-}>;
-/**
- * Wraps a raw `DBClient` with the type-safe `TypedDB<S>` facade derived from
- * the provided schema. No behavior change for the direct ops — all calls
- * delegate to `raw` with the table name as a plain string.
- *
- * `transaction` does NOT delegate to a per-op client: the callback describes a
- * plan against a fresh {@link TxPlanBuilder}, and the whole plan travels in one
- * `raw.txPlan` call. The schema is used only for its table NAMES; the values
- * are typed by `S` at compile time and are plain strings at run time.
- *
- * The `as` casts are single structural narrowings from a dynamically-built
- * object to the precise mapped type (TS cannot infer the mapped-type result
- * through `Object.keys` iteration) — see the module-level doc comment.
- */
-declare function makeTypedDB<S extends SchemaDef>(schema: S, raw: DBClient): TypedDB<S>;
-/** Bir where değeri: düz eşitlik YA DA operatör nesnesi (FR-016). */
-type WhereOp<V> = V | {
-    gt?: V;
-    gte?: V;
-    lt?: V;
-    lte?: V;
-    neq?: V;
-    in?: V[];
-};
-/**
- * A filter over a row: every field optional, each one a plain value (equality)
- * or an operator object. THE filter language — `findMany`, `updateMany`,
- * `deleteMany` and `count` all take this one, because two spellings of a filter
- * is how the two come to disagree.
- */
-type WhereFilter<Row> = {
-    [K in keyof Row]?: WhereOp<Row[K]>;
-};
-/**
- * Ordering and paging for a read.
- *
- * `column` is `keyof Row`, not `string`: a mistyped column name is a compile
- * error here rather than a runtime rejection three layers down. `offset`
- * without `limit` is refused by the engine — a page with no size is not a page.
- */
-type FindManyOpts<Row> = {
-    orderBy?: {
-        column: Extract<keyof Row, string>;
-        direction?: "asc" | "desc";
-    };
-    limit?: number;
-    offset?: number;
-};
-/** search() parametreleri, satır tipiyle koşullanmış (FR-013). `offset` BİLEREK yok (UD-013). */
-interface SearchParamsTyped<T extends TableTypes> {
-    /** Metin sorgusu: FTS kolunu besler; embed beyanlıysa sorgu vektörü de bundan üretilir. */
-    query?: string;
-    /** Hazır sorgu vektörü — verilirse embed çağrısı olmaz (FR-025). */
-    vector?: number[];
-    where?: {
-        [K in keyof T["row"]]?: WhereOp<T["row"][K]>;
-    };
-    /** default 20, tavan 100 (engine uygular). */
-    limit?: number;
-    /** Birden çok vektör kolonunda hedef seçimi (model geçişi, FR-013/using). */
-    using?: string;
-    mode?: "hybrid" | "text" | "vector";
-    /** Nihai (RRF-sonrası) skor alt eşiği — süzme LIMIT'ten önce uygulanır (FR-001). */
-    minScore?: number;
-    /** Chunk-modunda satır başına en iyi blok sayısı (1..10, vars. 3; FR-015). */
-    blocksPerRow?: number;
-    /** Tazelik çürümesi: nihai skor RRF-sonrası exp(-ln(2)*yaş/halfLife) ile çarpılır;
-     * field bir timestamp kolonu, halfLife "90s" | "15m" | "12h" | "30d" biçiminde (FR-004). */
-    recency?: {
-        field: Extract<keyof T["row"], string>;
-        halfLife: string;
-    };
-    /** Filtrelenmiş küme üzerinde kolon başına top-20 değer sayacı — dönüş
-     * dizisinin `_facets` özelliği (FR-027). */
-    facets?: Extract<keyof T["row"], string>[];
-    /** Satır-modunda FTS eşleşme vurgusu: sonuç satırına `_highlight` ekler;
-     * chunk-modda no-op — bloklar zaten eşleşen kesittir (FR-025). */
-    highlight?: boolean;
-    /** Validity'li tabloda zaman penceresi: varsayılan yalnız güncel versiyon;
-     * "all" tüm versiyonlar; {asOf} o anda geçerli olan (FR-029). */
-    validity?: "all" | {
-        asOf: string;
-    };
-    /** Alan-boost (FR-030): skor * (1 + w·x/(1+x)) — sayısal kolonla sınırlı
-     * çarpan, dış servissiz; bileşim RRF → boost → recency → minScore. */
-    boost?: {
-        field: Extract<keyof T["row"], string>;
-        weight: number;
-    };
-}
-/** search() dönüş dizisinin sorgu-düzeyi ekleri (FR-027): `_facets` dizinin
- * ÖZELLİĞİDİR, satırlara kopyalanmaz (JSON'a satır başına şişme olmasın). */
-type SearchFacets = Record<string, {
-    value: string | null;
-    count: number;
-}[]>;
-/** similar()/recommend() taşıyıcı opsiyonları (T018, FR-022): search'ün
- * paramlarından query/vector/mode düşer — hedef vektörü metodun kendisi
- * DB'den kurar; facets/highlight de düşer (T020) — engine bu ikisini
- * similar/recommend'e geçirmez, tip vaadi gerçekle aynı kalır. */
-type SimilarParamsTyped<T extends TableTypes> = Omit<SearchParamsTyped<T>, "query" | "vector" | "mode" | "facets" | "highlight">;
-/** recommend() parametreleri (T018, FR-023). */
-type RecommendParamsTyped<T extends TableTypes> = SimilarParamsTyped<T> & {
-    /** Kaynak beğeniler — hedef vektör bunların DB-içi avg'ı; boş olamaz. */
-    positive: string[];
-    /** İtilen örnekler — hedef pos.v + (pos.v - neg.v) ile yönlenir. */
-    negative?: string[];
-};
-/** Temel tablo erişimcisi — search'süz beş op. */
-interface EnvTypedTableBase<T extends TableTypes> {
-    insert(data: T["insert"]): Promise<T["row"]>;
-    /**
-     * Insert the row, or update it when it collides on `onConflict`.
-     *
-     * The conflict columns must carry a unique constraint or index — that is what
-     * Postgres matches on — and they are excluded from the update, since they are
-     * what matched.
-     */
-    upsert(data: T["insert"], opts: {
-        onConflict: readonly Extract<keyof T["row"], string>[];
-    }): Promise<T["row"]>;
-    /** Update the row by id; resolves to the updated row, or `null` if no row
-     * matched (absent or RLS-hidden) — an idempotent outcome, mirroring
-     * `findById`. The runtime returns a null row rather than throwing. */
-    update(id: string, data: Partial<T["insert"]>): Promise<T["row"] | null>;
-    delete(id: string): Promise<void>;
-    findById(id: string): Promise<T["row"] | null>;
-    /** Rows matching the filter. See {@link WhereFilter} / {@link FindManyOpts} —
-     * this declaration is what makes the engine's operators callable. */
-    findMany(query?: WhereFilter<T["row"]>, opts?: FindManyOpts<T["row"]>): Promise<T["row"][]>;
-    /** Update every matching row in one statement; an empty filter is refused. */
-    updateMany(where: WhereFilter<T["row"]>, set: Partial<T["insert"]>): Promise<T["row"][]>;
-    /** Delete every matching row; resolves to how many. Empty filter refused. */
-    deleteMany(where: WhereFilter<T["row"]>): Promise<number>;
-    /** How many rows match. An empty filter is legitimate: counting is a read. */
-    count(where?: WhereFilter<T["row"]>): Promise<number>;
-    /** Validity'li tabloda satırın yeni versiyonu (FR-029, C-9): eski satır
-     * kapanır (valid_to/superseded_by), yenisi TEK savepoint'te eklenir; dönüş
-     * yeni satır. Validity beyanı olmayan tabloda adlandırılmış çalışma-zamanı
-     * hatası — tip düzeyinde ayrım env `Tables` bayrağı taşımadığından yapılamaz. */
-    supersede(id: string, row: T["insert"]): Promise<T["row"]>;
-}
-/** Tablo erişimcisi: env girdisi `searchable: true` taşıyorsa (vector kolonu ya da
- * search beyanı — env-gen üretir) `search()` üyesi VARDIR; yoksa üye hiç yoktur ve
- * çağrı derleme hatasıdır (FR-013). Yapısal koşul TableTypes'ı genişletmeden çalışır. */
-type EnvTypedTable<T extends TableTypes> = EnvTypedTableBase<T> & (T extends {
-    searchable: true;
-} ? {
-    search(params: SearchParamsTyped<T>): Promise<Array<T["row"] & {
-        _score: number;
-    }> & {
-        _facets?: SearchFacets;
-    }>;
-    /** "Bu satıra benzeyenler" (FR-022): hedef vektör DB'den okunur,
-     * kaynak satır sonuçta yoktur; id yoksa adlandırılmış hata. */
-    similar(id: string, params?: SimilarParamsTyped<T>): Promise<Array<T["row"] & {
-        _score: number;
-    }>>;
-    /** D-021: sayaçlar bağımsız dönüşle — search'ün dizi-üstü _facets'i
-     * JSON.stringify'da kaybolur; ciddi sözleşme budur. */
-    facets(params: {
-        facets: Array<keyof T["row"] & string>;
-        where?: Partial<T["row"]>;
-        validity?: "all" | {
-            asOf: string;
-        };
-    }): Promise<Record<string, {
-        value: string | null;
-        count: number;
-    }[]>>;
-    /** positive/negative beğenilerden öneri (FR-023): hedef vektör DB-içi
-     * avg CTE'leriyle; kaynak id'ler sonuçta yoktur. */
-    recommend(params: RecommendParamsTyped<T>): Promise<Array<T["row"] & {
-        _score: number;
-    }>>;
-} : Record<never, never>);
-/** The `tables` map exposed on `Database`/`tx`, keyed by the env `Tables`
- * interface. When no schema is declared `Tables` is empty, so `tables` is an
- * empty object — accessing `.tables.foo` is then a compile error (no member). */
-type EnvTables = {
-    [K in keyof Tables]: EnvTypedTable<Tables[K]>;
-};
-/**
- * The project's NON-public schemas, keyed by schema name, each exposing its own
- * `tables` map — the shape `Database.schema("billing")` returns.
- *
- * The intermediate `tables` is there for the reason {@link EnvTables} sits under
- * `.tables`: a schema's table names must not share a namespace with anything the
- * accessor itself might grow.
- *
- * Empty by default. The generated `palbase-env.d.ts` augments `Schemas` with one
- * member per declared schema other than `public`, so a project that declares
- * none has `keyof Schemas = never` and every `schema(...)` call is a compile
- * error rather than a runtime surprise.
- */
-type EnvSchemas = {
-    [S in keyof Schemas]: {
-        tables: {
-            [T in keyof Schemas[S]]: EnvTypedTable<Extract<Schemas[S][T], TableTypes>>;
-        };
-    };
-};
-/** The project's tables as PLAN operations, keyed by the env `Tables`
- * interface. The transaction twin of {@link EnvTables}. */
-type TxTables = {
-    [K in keyof Tables]: TxTable<Tables[K]["row"], Tables[K]["insert"]>;
-};
-/**
- * The handle a `Database.transaction(…)` callback receives.
- *
- * Tables only — no `query`, no `findById`, no `asService`. A read whose value
- * the plan does not write belongs outside the transaction, where it costs one
- * round trip and is an ordinary value you can branch on.
- */
-type TxPlan = TxPlanHandle<TxTables>;
-/**
- * The RLS-bypass sibling returned by `Database.asService()`. Same typed surface
- * as {@link EnvTypedDatabase} — `tables`, the raw string ops, and a typed
- * `transaction` — but it does NOT re-expose `asService` (no double-bypass).
- * Every op it performs runs as the `service_role` (BYPASSRLS).
- */
-interface EnvServiceDatabase extends Omit<DBClient, "txPlan" | "asService"> {
-    tables: EnvTables;
-    /** See {@link EnvTypedDatabase.schema}. The bypass sibling reaches every
-     * schema the default surface does — a `billing` table is no less reachable
-     * because the caller asked to run as the service role. */
-    schema<S extends keyof Schemas>(name: S): EnvSchemas[S];
-    transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
-}
-/**
- * The typed-by-default Database surface: the raw string-keyed `DBClient` ops
- * PLUS a `tables` map typed against the project's generated `palbase-env.d.ts`,
- * a `transaction` that runs a whole plan in one request, and `asService()` for
- * the explicit RLS-bypass sibling.
- *
- * The low-level `txPlan` op is deliberately NOT re-exposed here: `transaction`
- * is the surface, and a hand-built plan would bypass the ref/guard machinery
- * that makes one safe to write.
- */
-interface EnvTypedDatabase extends Omit<DBClient, "txPlan" | "asService"> {
-    tables: EnvTables;
-    /**
-     * The tables of a schema other than `public`.
-     *
-     * `Database.tables.*` is the PUBLIC schema and only the public schema. Two
-     * schemas may declare the same table name — `public.invoices` and
-     * `billing.invoices` are different tables — so one flat namespace would make
-     * `Database.tables.invoices` resolve by declaration order. It does not: the
-     * bare name is always public's, and everything else is asked for by schema.
-     *
-     * The name is `keyof Schemas`, so a schema the project never declared is a
-     * compile error. On the wire the table travels schema-qualified
-     * (`billing.invoices`); `public` stays bare.
-     *
-     * Declaring a schema does not publish it — reachability over HTTP is the
-     * schema's own `exposed` flag, checked by the broker.
-     *
-     * @example
-     * const inv = await Database.schema("billing").tables.invoices.findById(id);
-     */
-    schema<S extends keyof Schemas>(name: S): EnvSchemas[S];
-    /**
-     * Run a transaction. The callback DESCRIBES the operations; the whole
-     * description travels in one request and the broker runs it inside a single
-     * transaction — committing when it finishes, rolling back on any failure.
-     *
-     * The callback is SYNCHRONOUS: nothing has run when it returns, so there is
-     * nothing to await. `async` on it and `await` inside it are compile errors.
-     * Values a later operation needs are {@link Ref}s, written straight into the
-     * next operation; values the CALLER needs are returned and substituted before
-     * this promise resolves.
-     *
-     * @example
-     * const { statementId } = await Database.transaction((tx) => {
-     *   const st = tx.tables.statements
-     *     .insert({ household_id: hid, file_sha256: sha, status: "reviewing" })
-     *     .expectOne(new Internal("statement insert failed"));
-     *
-     *   tx.tables.statement_lines.insertMany(
-     *     lines.map((l) => ({ statement_id: st.id, category: resolveCategory(l) })),
-     *   );
-     *
-     *   return { statementId: st.id };
-     * });
-     */
-    transaction<T>(fn: (tx: TxPlan) => T extends Promise<unknown> ? never : T): Promise<Materialized<T>>;
-    /**
-     * Run `fn` inside a SAVEPOINT, so a write that fails in it does not poison the
-     * rest of the request.
-     *
-     * A request is ONE Postgres transaction: a failed statement aborts it and
-     * every later one answers `current transaction is aborted`. That is why
-     * "insert, catch the unique violation, update instead" cannot be written
-     * directly — and why {@link EnvTypedTableBase.upsert} exists for the common
-     * case. Reach for `attempt` when the recovery is not an upsert.
-     *
-     * The handle is a parameter, not the ambient `Database`: only what `tx` writes
-     * is inside the boundary, so a concurrent branch of the same request cannot be
-     * rolled back by someone else's failure.
-     *
-     * @example
-     * const claimed = await Database.attempt(async (tx) => {
-     *   await tx.insert("seats", { row: 4, seat: 12, user_id: user.id });
-     *   return true;
-     * }).catch(() => false);
-     */
-    attempt<T>(fn: (tx: Omit<DBClient, "attempt" | "txPlan" | "asService">) => Promise<T>): Promise<T>;
-    /**
-     * Return a sibling that bypasses RLS by running as the `service_role`. Use
-     * sparingly and explicitly — the default `Database.*` path is RLS-enforced.
-     *
-     * @example
-     * const all = await Database.asService().tables.todos.findMany({});
-     * const rows = await Database.asService().query("SELECT * FROM todos");
-     */
-    asService(): EnvServiceDatabase;
-}
-
-export { type AnyColumn as A, defineTable as B, ColumnBuilder as C, enumType as D, type EnvTypedDatabase as E, installationRef as F, integer as G, isPalbaseExtension as H, type InsertShape as I, jsonb as J, makeTypedDB as K, numeric as L, openai as M, ownedByUser as N, type OnDeleteAction as O, PALBASE_EXTENSIONS as P, policy as Q, type RawConstraintDef as R, type SchemaDef as S, TABLE_META as T, raw as U, text as V, timestamp as W, userRef as X, uuid as Y, vector as Z, type ColumnDef as a, type ColumnMap as b, type ColumnType as c, EXTENSION_DEPENDENCIES as d, type EmbeddingModelRef as e, type EnvSchemas as f, type EnvServiceDatabase as g, type EnvTables as h, type EnvTypedTable as i, type PalbaseExtension as j, PolicyBuilder as k, type PolicyCommand as l, type PolicyDef as m, type PolicyMode as n, type RowShape as o, type TableDef as p, type TableHandle as q, type TableInput as r, type TxPlan as s, type TxTables as t, type TypedDB as u, type TypedTable as v, type TypedTx as w, bigint as x, boolean as y, defineSchema as z };