@palbase/backend 27.0.0 → 28.0.0

package/dist/engine/index.d.cts

@@ -1,8 +1,8 @@
-import '../index-Bve7BBTL.cjs';
-export { A as App, e as AuthVerifier, B as BootRefused, f as CreateAppOptions, E as EgressPolicy, g as EngineConfig, M as ModuleClients, R as RateLimiter, h as RequestDatabase, i as RouteEntry, j as RuntimeHooks, S as ScrubResult, k as SqlDriver, l as SqlTx, m as buildRouteTable, n as createApp, o as createLazyTransaction, p as createOps, q as createRequestDatabase, r as effectiveAuth, s as hostAllowed, t as installEgressFence, u as loadConfig, v as makeMemoryCache, w as matchRoute, x as quoteIdent, y as scrubSecrets, z as withTables } from '../index-VtToZmUm.cjs';
+import '../index-DtISj9QX.cjs';
+export { A as App, g as AuthVerifier, B as BootRefused, h as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, j as EngineConfig, M as ModuleClients, R as RateLimiter, k as RequestDatabase, l as RouteEntry, m as RuntimeHooks, S as ScrubResult, n as SqlDriver, o as SqlTx, p as buildRouteTable, q as createApp, r as createLazyTransaction, s as createOps, t as createRequestDatabase, u as effectiveAuth, v as hostAllowed, w as installEgressFence, i as isDeclarationRefused, x as loadConfig, y as makeMemoryCache, z as matchRoute, F as quoteIdent, G as scrubSecrets, H as withTables } from '../index-9C3JHxg-.cjs';
 import '../db/env.cjs';
 import '../stack.cjs';
 import 'zod';
 import 'node:async_hooks';
 import '../module-Dl1KFVtc.cjs';
-import '../registry-Bk9_rbNd.cjs';
+import '../registry-qIPM5BQe.cjs';

package/dist/engine/index.d.ts

@@ -1,8 +1,8 @@
-import '../index-BrvvxSpn.js';
-export { A as App, e as AuthVerifier, B as BootRefused, f as CreateAppOptions, E as EgressPolicy, g as EngineConfig, M as ModuleClients, R as RateLimiter, h as RequestDatabase, i as RouteEntry, j as RuntimeHooks, S as ScrubResult, k as SqlDriver, l as SqlTx, m as buildRouteTable, n as createApp, o as createLazyTransaction, p as createOps, q as createRequestDatabase, r as effectiveAuth, s as hostAllowed, t as installEgressFence, u as loadConfig, v as makeMemoryCache, w as matchRoute, x as quoteIdent, y as scrubSecrets, z as withTables } from '../index-NuzRCuxe.js';
+import '../index-dTTLlHIn.js';
+export { A as App, g as AuthVerifier, B as BootRefused, h as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, j as EngineConfig, M as ModuleClients, R as RateLimiter, k as RequestDatabase, l as RouteEntry, m as RuntimeHooks, S as ScrubResult, n as SqlDriver, o as SqlTx, p as buildRouteTable, q as createApp, r as createLazyTransaction, s as createOps, t as createRequestDatabase, u as effectiveAuth, v as hostAllowed, w as installEgressFence, i as isDeclarationRefused, x as loadConfig, y as makeMemoryCache, z as matchRoute, F as quoteIdent, G as scrubSecrets, H as withTables } from '../index-BbvOoZFr.js';
 import '../db/env.js';
 import '../stack.js';
 import 'zod';
 import 'node:async_hooks';
 import '../module-Dl1KFVtc.js';
-import '../registry-B0eyOF9x.js';
+import '../registry-JQNIX-eA.js';

package/dist/engine/index.js

@@ -16,16 +16,22 @@ import {
   quoteIdent,
   scrubSecrets,
   withTables
-} from "../chunk-OO7R25AI.js";
-import "../chunk-I3C4PFIW.js";
-import "../chunk-DRZFQRJI.js";
-import "../chunk-GYK6QYS4.js";
+} from "../chunk-75YROPRZ.js";
+import {
+  DECLARATION_REFUSAL,
+  DeclarationRefused,
+  isDeclarationRefused
+} from "../chunk-RVP6BTEZ.js";
+import "../chunk-SNDXY565.js";
+import "../chunk-3TUJWHC2.js";
 import "../chunk-VVMJEVQP.js";
 import "../chunk-CGNN2PUH.js";
 import "../chunk-VXPNPVAG.js";
 export {
   AuthVerifier,
   BootRefused,
+  DECLARATION_REFUSAL,
+  DeclarationRefused,
   RateLimiter,
   buildRouteTable,
   createApp,
@@ -35,6 +41,7 @@ export {
   effectiveAuth,
   hostAllowed,
   installEgressFence,
+  isDeclarationRefused,
   loadConfig,
   makeMemoryCache,
   matchRoute,

package/dist/{index-VtToZmUm.d.cts → index-9C3JHxg-.d.cts}

@@ -1,6 +1,6 @@
-import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-Bve7BBTL.cjs';
+import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-DtISj9QX.cjs';
 import { T as Token } from './module-Dl1KFVtc.cjs';
-import { R as RouteMeta } from './registry-Bk9_rbNd.cjs';
+import { R as RouteMeta } from './registry-qIPM5BQe.cjs';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses
@@ -66,7 +66,15 @@ interface EngineConfig {
     dbServiceRole: string;
     poolMax: number;
 }
-/** Thrown when a mandatory module is unconfigured. Carries the missing names. */
+/**
+ * THE ENVIRONMENT THIS STACK WAS HANDED IS UNUSABLE. Carries the missing names.
+ *
+ * ONLY the environment. A refusal about the author's own declarations is
+ * `DeclarationRefused` (see `src/refusals.ts`) and the difference is not
+ * severity, it is the CURE: no push fixes a missing DATABASE_URL, so the
+ * runtime must keep treating this one as fatal rather than waiting for an
+ * artifact that would change nothing.
+ */
 declare class BootRefused extends Error {
     readonly missing: readonly string[];
     constructor(missing: readonly string[], message: string);
@@ -171,10 +179,27 @@ interface FindManyOptions {
      * refused without it — see `offsetClause`. */
     offset?: number;
 }
-/** The six string-keyed operations, plus an interactive `transaction`. */
 declare function createOps(tx: TxLike): {
     query<T = unknown>(sql: string, params?: unknown[]): Promise<T[]>;
     insert(table: string, data: Row): Promise<Row>;
+    /**
+     * Çok satırı TEK statement'la ekle.
+     *
+     * Motor bunu zaten yapıyordu ve yalnız PLAN yolundan erişilebiliyordu
+     * (`tx.public.x.insertMany`). Dışarıda tek kapı `insert(row)` olduğu için
+     * "şu 200 satırı yaz" ya 200 gidiş-dönüş ya da ham SQL oluyordu — ölçüldü:
+     * bir müşteri projesinde bir seed rutini satırları tek tek siliyor
+     * (`deleteMany` VARKEN) ve tek tek ekliyor.
+     *
+     * SATIRLARIN ANAHTAR KÜMESİ AYNI OLMAK ZORUNDA. Kolon listesi tek bir
+     * statement'ta paylaşıldığı için ilk satırdan türer; farklı anahtar taşıyan
+     * bir satırın fazla kolonu SESSİZCE YAZILMAZDI. Eksik kolon için `null`
+     * yazın ya da varsayılanı istiyorsanız o satırları ayrı çağrıda ekleyin.
+     */
+    insertMany(table: string, rows: readonly Row[], opts?: {
+        onConflict: readonly string[];
+        action?: "ignore" | "update";
+    }): Promise<Row[]>;
     /**
      * Bir ADI kilitle — satırı değil (FR-054).
      *
@@ -527,6 +552,80 @@ declare function createRequestDatabase(sql: SqlDriver, identity: {
     claimsJson: string;
 }): RequestDatabase;
 
+/**
+ * The two ways a stack refuses to boot — and they are two because their CURES
+ * are two.
+ *
+ * A LEAF MODULE ON PURPOSE. `db/` does not import from `engine/` and must not
+ * start: the schema layer is below the engine, and a refusal both of them raise
+ * cannot live in either. Anything imported here would invert that.
+ *
+ * WHY THE SPLIT EXISTS AT ALL — measured live on 2026-09-04.
+ *
+ * `8qitbtucm` ran for days on an image whose `setSchema` did not build
+ * relations. Moved onto one that does, the same artifact hit
+ * `buildRelations` at boot, threw a bare `Error`, and the runtime — which waits
+ * only on its own `ArtifactRefused` — treated it as fatal. The supervisor took
+ * the pod down, palsvc with it. CrashLoopBackOff, back-off 5m, and palsvc is
+ * THE PROCESS THAT ACCEPTS THE PUSH the message asks for.
+ *
+ * That is verbatim the lesson `v2/runtime/src/loader.ts` already carries for
+ * ABI refusals: *"the cure was named in the error and made impossible by the
+ * exit that carried it."* It cost a tenant a third time because the second
+ * refusal had no type to be recognised by.
+ *
+ * SO THE RULE IS THE CURE, NOT THE SEVERITY:
+ *
+ *   {@link DeclarationRefused} — what was PUSHED cannot be built. Restarting
+ *     re-reads the same bytes and fails identically; only a new artifact
+ *     changes the answer. The runtime WAITS on this, keeps palsvc alive, and
+ *     says the reason out loud.
+ *
+ *   {@link BootRefused} — the ENVIRONMENT this stack was handed is unusable
+ *     (no DATABASE_URL, an unparseable PORT, no SQL driver). No push fixes it;
+ *     waiting for one would be a lie told in a log line forever. Stays fatal.
+ *
+ * NOT A MESSAGE PATTERN. The runtime's loader already says why: *"The
+ * distinction is the loader's TYPE, not a pattern over its wording."* A gate
+ * that reads wording drifts from the thing it claims to measure the first time
+ * someone improves an error message.
+ */
+/**
+ * The tag that survives a realm boundary.
+ *
+ * `instanceof` compares constructor identity, and identity is per module
+ * instance. In the pod today the runtime and the bundle share one install
+ * (measured: both frames resolve to `/app/node_modules/@palbase/backend`), so
+ * `instanceof` would work — but it works by a coincidence of packaging, and a
+ * bundle that ever carries its own copy would make every declaration refusal
+ * silently fatal again. `Symbol.for` reads from the process-wide registry, so
+ * the tag means the same thing in every copy.
+ *
+ * Exported so the runtime can recognise the refusal without importing the
+ * class — see {@link isDeclarationRefused}.
+ */
+declare const DECLARATION_REFUSAL: unique symbol;
+/**
+ * What was pushed cannot be built. The cure is a NEW ARTIFACT.
+ *
+ * Thrown by the declaration layer — relation naming, ownership, entry points —
+ * wherever a fact about the author's code makes the app impossible to
+ * construct. Never thrown for anything the environment could change.
+ */
+declare class DeclarationRefused extends Error {
+    /** @see DECLARATION_REFUSAL — realm-safe, unlike `instanceof`. */
+    readonly [DECLARATION_REFUSAL]: true;
+    constructor(message: string);
+}
+/**
+ * True for a refusal whose only cure is a new artifact — across realms.
+ *
+ * Takes `unknown` because every caller is a `catch`. A non-object, a null, a
+ * plain `Error`: all false, and false is the safe answer — it means "keep
+ * treating this as fatal", which is what the code did before this type existed.
+ */
+declare function isDeclarationRefused(e: unknown): e is DeclarationRefused;
+
 /**
  * How a container refuses.
  *
@@ -550,6 +649,14 @@ declare class DiError extends Error {
     readonly path: string[];
     readonly at: string;
     readonly fixes: string[];
+    /**
+     * EVERY `DiKind` IS A FACT ABOUT THE AUTHOR'S DECLARATIONS — an unresolvable
+     * dependency, a cycle, a class no module owns. Not one of them is something
+     * the environment could change, so restarting re-reads the same bytes and
+     * fails identically. The cure is a new artifact, and the tag is how the
+     * runtime learns that without matching on wording.
+     */
+    readonly [DECLARATION_REFUSAL]: true;
     constructor(kind: DiKind, path: string[], at: string, detail: string, fixes: string[]);
 }
 /** How often a module appears in the OTHERS' `imports`. */
@@ -927,4 +1034,4 @@ interface App {
  */
 declare function createApp(opts: CreateAppOptions): Promise<App>;
 
-export { type App as A, BootRefused as B, type Container as C, DiError as D, type EgressPolicy as E, type ModuleClients as M, RateLimiter as R, type ScrubResult as S, type DiKind as a, type ModulePressure as b, assertNoOrphanEntryPoints as c, buildContainer as d, AuthVerifier as e, type CreateAppOptions as f, type EngineConfig as g, type RequestDatabase as h, type RouteEntry as i, type RuntimeHooks as j, type SqlDriver as k, type SqlTx as l, buildRouteTable as m, createApp as n, createLazyTransaction as o, createOps as p, createRequestDatabase as q, effectiveAuth as r, hostAllowed as s, installEgressFence as t, loadConfig as u, makeMemoryCache as v, matchRoute as w, quoteIdent as x, scrubSecrets as y, withTables as z };
+export { type App as A, BootRefused as B, type Container as C, DECLARATION_REFUSAL as D, type EgressPolicy as E, quoteIdent as F, scrubSecrets as G, withTables as H, type ModuleClients as M, RateLimiter as R, type ScrubResult as S, DeclarationRefused as a, DiError as b, type DiKind as c, type ModulePressure as d, assertNoOrphanEntryPoints as e, buildContainer as f, AuthVerifier as g, type CreateAppOptions as h, isDeclarationRefused as i, type EngineConfig as j, type RequestDatabase as k, type RouteEntry as l, type RuntimeHooks as m, type SqlDriver as n, type SqlTx as o, buildRouteTable as p, createApp as q, createLazyTransaction as r, createOps as s, createRequestDatabase as t, effectiveAuth as u, hostAllowed as v, installEgressFence as w, loadConfig as x, makeMemoryCache as y, matchRoute as z };

package/dist/{index-NuzRCuxe.d.ts → index-BbvOoZFr.d.ts}

@@ -1,6 +1,6 @@
-import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-BrvvxSpn.js';
+import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-dTTLlHIn.js';
 import { T as Token } from './module-Dl1KFVtc.js';
-import { R as RouteMeta } from './registry-B0eyOF9x.js';
+import { R as RouteMeta } from './registry-JQNIX-eA.js';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses
@@ -66,7 +66,15 @@ interface EngineConfig {
     dbServiceRole: string;
     poolMax: number;
 }
-/** Thrown when a mandatory module is unconfigured. Carries the missing names. */
+/**
+ * THE ENVIRONMENT THIS STACK WAS HANDED IS UNUSABLE. Carries the missing names.
+ *
+ * ONLY the environment. A refusal about the author's own declarations is
+ * `DeclarationRefused` (see `src/refusals.ts`) and the difference is not
+ * severity, it is the CURE: no push fixes a missing DATABASE_URL, so the
+ * runtime must keep treating this one as fatal rather than waiting for an
+ * artifact that would change nothing.
+ */
 declare class BootRefused extends Error {
     readonly missing: readonly string[];
     constructor(missing: readonly string[], message: string);
@@ -171,10 +179,27 @@ interface FindManyOptions {
      * refused without it — see `offsetClause`. */
     offset?: number;
 }
-/** The six string-keyed operations, plus an interactive `transaction`. */
 declare function createOps(tx: TxLike): {
     query<T = unknown>(sql: string, params?: unknown[]): Promise<T[]>;
     insert(table: string, data: Row): Promise<Row>;
+    /**
+     * Çok satırı TEK statement'la ekle.
+     *
+     * Motor bunu zaten yapıyordu ve yalnız PLAN yolundan erişilebiliyordu
+     * (`tx.public.x.insertMany`). Dışarıda tek kapı `insert(row)` olduğu için
+     * "şu 200 satırı yaz" ya 200 gidiş-dönüş ya da ham SQL oluyordu — ölçüldü:
+     * bir müşteri projesinde bir seed rutini satırları tek tek siliyor
+     * (`deleteMany` VARKEN) ve tek tek ekliyor.
+     *
+     * SATIRLARIN ANAHTAR KÜMESİ AYNI OLMAK ZORUNDA. Kolon listesi tek bir
+     * statement'ta paylaşıldığı için ilk satırdan türer; farklı anahtar taşıyan
+     * bir satırın fazla kolonu SESSİZCE YAZILMAZDI. Eksik kolon için `null`
+     * yazın ya da varsayılanı istiyorsanız o satırları ayrı çağrıda ekleyin.
+     */
+    insertMany(table: string, rows: readonly Row[], opts?: {
+        onConflict: readonly string[];
+        action?: "ignore" | "update";
+    }): Promise<Row[]>;
     /**
      * Bir ADI kilitle — satırı değil (FR-054).
      *
@@ -527,6 +552,80 @@ declare function createRequestDatabase(sql: SqlDriver, identity: {
     claimsJson: string;
 }): RequestDatabase;
 
+/**
+ * The two ways a stack refuses to boot — and they are two because their CURES
+ * are two.
+ *
+ * A LEAF MODULE ON PURPOSE. `db/` does not import from `engine/` and must not
+ * start: the schema layer is below the engine, and a refusal both of them raise
+ * cannot live in either. Anything imported here would invert that.
+ *
+ * WHY THE SPLIT EXISTS AT ALL — measured live on 2026-09-04.
+ *
+ * `8qitbtucm` ran for days on an image whose `setSchema` did not build
+ * relations. Moved onto one that does, the same artifact hit
+ * `buildRelations` at boot, threw a bare `Error`, and the runtime — which waits
+ * only on its own `ArtifactRefused` — treated it as fatal. The supervisor took
+ * the pod down, palsvc with it. CrashLoopBackOff, back-off 5m, and palsvc is
+ * THE PROCESS THAT ACCEPTS THE PUSH the message asks for.
+ *
+ * That is verbatim the lesson `v2/runtime/src/loader.ts` already carries for
+ * ABI refusals: *"the cure was named in the error and made impossible by the
+ * exit that carried it."* It cost a tenant a third time because the second
+ * refusal had no type to be recognised by.
+ *
+ * SO THE RULE IS THE CURE, NOT THE SEVERITY:
+ *
+ *   {@link DeclarationRefused} — what was PUSHED cannot be built. Restarting
+ *     re-reads the same bytes and fails identically; only a new artifact
+ *     changes the answer. The runtime WAITS on this, keeps palsvc alive, and
+ *     says the reason out loud.
+ *
+ *   {@link BootRefused} — the ENVIRONMENT this stack was handed is unusable
+ *     (no DATABASE_URL, an unparseable PORT, no SQL driver). No push fixes it;
+ *     waiting for one would be a lie told in a log line forever. Stays fatal.
+ *
+ * NOT A MESSAGE PATTERN. The runtime's loader already says why: *"The
+ * distinction is the loader's TYPE, not a pattern over its wording."* A gate
+ * that reads wording drifts from the thing it claims to measure the first time
+ * someone improves an error message.
+ */
+/**
+ * The tag that survives a realm boundary.
+ *
+ * `instanceof` compares constructor identity, and identity is per module
+ * instance. In the pod today the runtime and the bundle share one install
+ * (measured: both frames resolve to `/app/node_modules/@palbase/backend`), so
+ * `instanceof` would work — but it works by a coincidence of packaging, and a
+ * bundle that ever carries its own copy would make every declaration refusal
+ * silently fatal again. `Symbol.for` reads from the process-wide registry, so
+ * the tag means the same thing in every copy.
+ *
+ * Exported so the runtime can recognise the refusal without importing the
+ * class — see {@link isDeclarationRefused}.
+ */
+declare const DECLARATION_REFUSAL: unique symbol;
+/**
+ * What was pushed cannot be built. The cure is a NEW ARTIFACT.
+ *
+ * Thrown by the declaration layer — relation naming, ownership, entry points —
+ * wherever a fact about the author's code makes the app impossible to
+ * construct. Never thrown for anything the environment could change.
+ */
+declare class DeclarationRefused extends Error {
+    /** @see DECLARATION_REFUSAL — realm-safe, unlike `instanceof`. */
+    readonly [DECLARATION_REFUSAL]: true;
+    constructor(message: string);
+}
+/**
+ * True for a refusal whose only cure is a new artifact — across realms.
+ *
+ * Takes `unknown` because every caller is a `catch`. A non-object, a null, a
+ * plain `Error`: all false, and false is the safe answer — it means "keep
+ * treating this as fatal", which is what the code did before this type existed.
+ */
+declare function isDeclarationRefused(e: unknown): e is DeclarationRefused;
+
 /**
  * How a container refuses.
  *
@@ -550,6 +649,14 @@ declare class DiError extends Error {
     readonly path: string[];
     readonly at: string;
     readonly fixes: string[];
+    /**
+     * EVERY `DiKind` IS A FACT ABOUT THE AUTHOR'S DECLARATIONS — an unresolvable
+     * dependency, a cycle, a class no module owns. Not one of them is something
+     * the environment could change, so restarting re-reads the same bytes and
+     * fails identically. The cure is a new artifact, and the tag is how the
+     * runtime learns that without matching on wording.
+     */
+    readonly [DECLARATION_REFUSAL]: true;
     constructor(kind: DiKind, path: string[], at: string, detail: string, fixes: string[]);
 }
 /** How often a module appears in the OTHERS' `imports`. */
@@ -927,4 +1034,4 @@ interface App {
  */
 declare function createApp(opts: CreateAppOptions): Promise<App>;
 
-export { type App as A, BootRefused as B, type Container as C, DiError as D, type EgressPolicy as E, type ModuleClients as M, RateLimiter as R, type ScrubResult as S, type DiKind as a, type ModulePressure as b, assertNoOrphanEntryPoints as c, buildContainer as d, AuthVerifier as e, type CreateAppOptions as f, type EngineConfig as g, type RequestDatabase as h, type RouteEntry as i, type RuntimeHooks as j, type SqlDriver as k, type SqlTx as l, buildRouteTable as m, createApp as n, createLazyTransaction as o, createOps as p, createRequestDatabase as q, effectiveAuth as r, hostAllowed as s, installEgressFence as t, loadConfig as u, makeMemoryCache as v, matchRoute as w, quoteIdent as x, scrubSecrets as y, withTables as z };
+export { type App as A, BootRefused as B, type Container as C, DECLARATION_REFUSAL as D, type EgressPolicy as E, quoteIdent as F, scrubSecrets as G, withTables as H, type ModuleClients as M, RateLimiter as R, type ScrubResult as S, DeclarationRefused as a, DiError as b, type DiKind as c, type ModulePressure as d, assertNoOrphanEntryPoints as e, buildContainer as f, AuthVerifier as g, type CreateAppOptions as h, isDeclarationRefused as i, type EngineConfig as j, type RequestDatabase as k, type RouteEntry as l, type RuntimeHooks as m, type SqlDriver as n, type SqlTx as o, buildRouteTable as p, createApp as q, createLazyTransaction as r, createOps as s, createRequestDatabase as t, effectiveAuth as u, hostAllowed as v, installEgressFence as w, loadConfig as x, makeMemoryCache as y, matchRoute as z };

package/dist/{index-Bve7BBTL.d.cts → index-DtISj9QX.d.cts}

@@ -2825,7 +2825,12 @@ type RowShape<T extends TableDef> = {
 };
 /** A typed table accessor that mirrors the runtime DBClient surface. */
 interface TypedTable<T extends TableDef> {
-    insert(data: InsertShape<T>): Promise<RowShape<T>>;
+    insert(data: InsertValues<InsertShape<T>>): Promise<RowShape<T>>;
+    /** Çok satır, TEK statement. Satırların anahtar kümesi aynı olmalı. */
+    insertMany(rows: readonly InsertValues<InsertShape<T>>[], opts?: {
+        onConflict: readonly string[];
+        action?: "ignore" | "update";
+    }): Promise<RowShape<T>[]>;
     put(q: {
         data: InsertShape<T>;
         onConflict: readonly string[];
@@ -2837,7 +2842,7 @@ interface TypedTable<T extends TableDef> {
         where: {
             id: string;
         };
-        set: Partial<InsertShape<T>>;
+        set: SetShape<InsertShape<T>>;
     }): Promise<RowShape<T> | null>;
     delete(id: string): Promise<void>;
     findById(id: string): Promise<RowShape<T> | null>;
@@ -2974,9 +2979,39 @@ declare function col<const N extends string>(name: N): ColRef<N>;
  * kabul, `numeric ↔ text` ret olur ve ikisi de DOĞRU olur. Defterde teklif.
  */
 type PgFamily<V> = [NonNullable<V>] extends [boolean] ? "bool" : [NonNullable<V>] extends [readonly (number | string)[]] ? "array" : [NonNullable<V>] extends [Date] ? "date" : [NonNullable<V>] extends [string | number] ? "scalar" : "opaque";
-/** `Row`'un `V` ile karşılaştırılabilir kolonları — aynı aileden olanlar. */
+/**
+ * Kolonun BİLDİRİLMİŞ Postgres tipi — `env-gen`'in bastığı markadan.
+ *
+ * Marka yoksa `"?"`: elle yazılmış bir `Tables` (testler) ya da yeniden
+ * üretilmemiş bir `palbase-env.d.ts`. O durumda eski TS-tipi sezgiseline
+ * düşülüyor, çünkü marka olmadan söylenebilecek daha doğru bir şey yok.
+ */
+type PgTag<V> = [NonNullable<V>] extends [{
+    readonly __pg?: infer N;
+}] ? [N] extends [string] ? N : "?" : "?";
+/**
+ * Postgres'te birbirleriyle karşılaştırılabilen tipler tek "cins".
+ *
+ * `integer`, `bigint` ve `numeric` örtük sayısal dönüşümle karşılaştırılır;
+ * geri kalan her tip yalnız kendisiyle. `uuid ↔ text` ve `enum ↔ text`
+ * Postgres'te `operator does not exist` verir — D-021'de CANLI ölçülmüştü ve
+ * tip bunu göremediği için kabul ediyordu.
+ */
+type PgKind<P> = P extends "integer" | "bigint" | "numeric" ? "num" : P;
+/** İki tarafın da markası var mı — yoksa sezgisele düşülür. */
+type BothBranded<A, B> = "?" extends PgTag<A> ? false : "?" extends PgTag<B> ? false : true;
+type PgSameKind<A, B> = [PgKind<PgTag<A>>] extends [PgKind<PgTag<B>>] ? [PgKind<PgTag<B>>] extends [PgKind<PgTag<A>>] ? true : false : false;
+/**
+ * `A` kolonu `B` ile karşılaştırılabilir mi.
+ *
+ * Marka varsa CEVAP KESİN: ne yanlış ret ne yanlış kabul. D-021 bu kuralı
+ * "doğru olamaz" diye kaydetmişti çünkü tipte ayırt edecek bilgi yoktu; bilgi
+ * artık tipte.
+ */
+type ColComparable<A, B> = BothBranded<A, B> extends true ? PgSameKind<A, B> : [PgFamily<A>] extends [PgFamily<B>] ? true : false;
+/** `Row`'un `V` ile karşılaştırılabilir kolonları. */
 type ColumnsComparableTo<Row, V> = {
-    [K in keyof Row]-?: PgFamily<Row[K]> extends PgFamily<V> ? K : never;
+    [K in keyof Row]-?: ColComparable<Row[K], V> extends true ? K : never;
 }[keyof Row];
 /**
  * Bu satırın kolonlarından birine referans. `Row` bilinmiyorsa hiçbiri.
@@ -3052,12 +3087,24 @@ type TextOps<V> = V extends string ? {
  * `C` bir parametre, çünkü `ColRefOf<Row, V>` aksi hâlde altı operatör
  * konumunda AYRI AYRI instantiate edilirdi — kolon başına altı mapped type.
  * Böyle kolon başına BİR tane (N-2). */
+/**
+ * `now()` HANGİ kolonlarda karşılaştırma değeri olabilir.
+ *
+ * `timestamp` TypeScript'e `string` olarak geliyor — `text` ile aynı tip. Yani
+ * "yalnız zaman kolonları" tip düzeyinde İFADE EDİLEMEZ (D-021'in tam olarak
+ * kaydettiği sınır: TS numeric/bigint/text/uuid/timestamp'ı `string`'e
+ * çöktürüyor). İki seçenekten yanlış KABUL, yanlış RET'e tercih ediliyor:
+ * `now()`'ı bir metin kolonunda yazmak Postgres hatası verir, ama zaman
+ * kolonunda YASAKLAMAK yazarı bu yüzden `sqlFragment`e düşürürdü — ve bu
+ * özelliğin var olma nedeni tam olarak o düşüşü kaldırmak.
+ */
+type NowComparable<V> = "?" extends PgTag<V> ? [NonNullable<V>] extends [string | Date] ? TxNow : never : PgTag<V> extends "timestamp" ? TxNow : never;
 type WhereOpBody<V, C> = {
-    gt?: V | C;
-    gte?: V | C;
-    lt?: V | C;
-    lte?: V | C;
-    neq?: V | C;
+    gt?: V | C | NowComparable<V>;
+    gte?: V | C | NowComparable<V>;
+    lt?: V | C | NowComparable<V>;
+    lte?: V | C | NowComparable<V>;
+    neq?: V | C | NowComparable<V>;
     in?: V[];
     /** `IS NULL` / `IS NOT NULL` (FR-006) — `= NULL` SQL'de her zaman UNKNOWN'dır. */
     isNull?: boolean;
@@ -3072,7 +3119,7 @@ type WhereOp<V, Row = unknown> = WhereOpWith<V, ColRefOf<Row, V>>;
  * `TextOps<V>` `V extends string` diye soruyor ve `string | Ref<string>` o
  * soruya HAYIR der, yani `contains`/`startsWith` sessizce KAYBOLURDU.
  */
-type WhereOpWith<V, C> = V | C | WhereOpBody<V, C>;
+type WhereOpWith<V, C> = V | C | NowComparable<V> | WhereOpBody<V, C>;
 /**
  * A filter over a row: every field optional, each one a plain value (equality)
  * or an operator object. THE filter language — `findMany`, `updateMany`,
@@ -3089,10 +3136,18 @@ type WhereFilter<Row> = {
      * Kysely'nin TS7'de 9,8M instantiation üreten vakası derin generic
      * özyinelemeydi. Burada derinlik yazarın filtresi kadardır ve pratikte
      * bir-iki seviyedir; tip maliyeti T001'in tavanına karşı ölçülür.
+     *
+     * Dal bir `sqlFragment` DE olabilir. Motor bunu zaten derliyordu — parantezli
+     * ve parametreli (`… AND (((expires_at > now())) AND (t."city" = $2))`) —
+     * ama tip yalnız üst düzey `where`'de fragment'e izin veriyordu. Yani
+     * "fragment sorgudan KAÇMAK için değil, sorgunun İÇİNE girmek için" sözü tam
+     * da bileşim anında kırılıyordu: bir koşulu bir fragment'le birleştirmek
+     * isteyen yazar SORGUNUN TAMAMINI ham SQL'e taşımak zorunda kalıyordu.
+     * Ölçüldü: bir müşteri sorgusunda tam olarak bu oldu.
      */
-    OR?: WhereFilter<Row>[];
-    AND?: WhereFilter<Row>[];
-    NOT?: WhereFilter<Row>;
+    OR?: (WhereFilter<Row> | SqlFragment)[];
+    AND?: (WhereFilter<Row> | SqlFragment)[];
+    NOT?: WhereFilter<Row> | SqlFragment;
 };
 /**
  * Ordering and paging for a read.
@@ -3237,7 +3292,25 @@ type MutateInput<Row, Insert, Rels = unknown> = {
  * string de sayısal sayılır; ayrımı burada yapamayız, ama D-007 zaten miktarın
  * JS `number`'a hiç uğramamasını istiyor.
  */
-type SetValue<V> = V | (NonNullable<V> extends number | string ? TxColumnExpr : never) | (NonNullable<V> extends Date ? TxNow : never);
+/** `increment()`/`decrement()` HANGİ kolonlarda anlamlı — bildirilmiş PG tipine
+ *  göre. Marka yoksa eski sezgisel (`number | string`), ki o `text` kolonda da
+ *  izin veriyordu: Postgres `text + 1` demez. */
+type NumericCol<V> = "?" extends PgTag<V> ? NonNullable<V> extends number | string ? TxColumnExpr : never : PgKind<PgTag<V>> extends "num" ? TxColumnExpr : never;
+/**
+ * Bir EKLEME yolunda yazılabilecek değer.
+ *
+ * Kolonun kendi tipi ya da — zaman kolonlarında — sunucu saati. `increment()`
+ * burada YOK ve olamaz: satır henüz yokken "kolonun şu anki değeri" diye bir
+ * şey yok, motor da bunu adıyla reddediyor.
+ *
+ * Var olma nedeni ölçülmüş: introspect edilmiş şemalarda zaman kolonlarının
+ * çoğu varsayılansız (`timestamp()`), yani "eklerken sunucu saatini yaz"ın tek
+ * karşılığı istemci saatiydi — 33 tablolu bir projede 12 yerde.
+ */
+type InsertValues<Insert> = {
+    [K in keyof Insert]: Insert[K] | NowComparable<Insert[K]>;
+};
+type SetValue<V> = V | NumericCol<V> | NowComparable<V>;
 /** Bir update'in `set`'i: insert şeklinin herhangi bir alt kümesi, ifadelerle. */
 type SetShape<Insert> = {
     [K in keyof Insert]?: SetValue<Insert[K]>;
@@ -3320,7 +3393,30 @@ type RelsOf<T> = T extends {
 } ? R : unknown;
 /** Temel tablo erişimcisi — search'süz beş op. */
 interface EnvTypedTableBase<T extends TableTypes> {
-    insert(data: T["insert"]): Promise<T["row"]>;
+    insert(data: InsertValues<T["insert"]>): Promise<T["row"]>;
+    /**
+     * Çok satırı TEK statement'la ekle (tek gidiş-dönüş).
+     *
+     * ```ts
+     * await Database.public.journey_stops.insertMany(
+     *   stops.map((s, i) => ({ journey_id, name: s.name, sort_order: i })),
+     * );
+     * ```
+     *
+     * Satırların anahtar kümesi AYNI olmalı: tek statement kolon listesini
+     * paylaşır, yani farklı şekilli bir satırın fazla kolonu sessizce yazılmaz
+     * ve eksiği yanlış sütuna kayardı. Eksik alan için `null` yazın.
+     *
+     * Boş dizi boş sonuç döner — hata değil: "eklenecek bir şey yoktu".
+     */
+    insertMany(rows: readonly InsertValues<T["insert"]>[], opts?: {
+        /** Çakışmanın ARANDIĞI kolonlar — benzersiz bir kısıt ya da index taşımalı. */
+        onConflict: readonly Extract<keyof T["row"], string>[];
+        /** `"ignore"` (VARSAYILAN, plan yoluyla aynı) çakışanı atlar ve o satır
+         *  SONUÇTA DÖNMEZ — Postgres yalnız yazdıklarını döndürür; `"update"`
+         *  üzerine yazar. */
+        action?: "ignore" | "update";
+    }): Promise<T["row"][]>;
     /**
      * Bir idempotency anahtarını sahiplen (FR-033).
      *
@@ -3336,7 +3432,7 @@ interface EnvTypedTableBase<T extends TableTypes> {
      * İlk argüman satırı BULAN alanlar, ikincisi yalnız yazılanlar — ikinci çağrı
      * farklı bir yük gönderse bile satır anahtarla bulunur.
      */
-    claim(unique: Partial<T["insert"]>, extra?: Partial<T["insert"]>): Promise<{
+    claim(unique: Partial<T["insert"]>, extra?: Partial<InsertValues<T["insert"]>>): Promise<{
         inserted: boolean;
         row: T["row"];
     }>;
@@ -3361,7 +3457,7 @@ interface EnvTypedTableBase<T extends TableTypes> {
      * seçmeyi kolay yapıyordu.
      */
     put(q: {
-        data: T["insert"];
+        data: InsertValues<T["insert"]>;
         onConflict: readonly Extract<keyof T["row"], string>[];
     }): Promise<T["row"]>;
     /** Update the row by id; resolves to the updated row, or `null` if no row
@@ -3371,7 +3467,7 @@ interface EnvTypedTableBase<T extends TableTypes> {
         where: {
             id: string;
         };
-        set: Partial<T["insert"]>;
+        set: SetShape<T["insert"]>;
     }): Promise<T["row"] | null>;
     delete(id: string): Promise<void>;
     findById(id: string): Promise<T["row"] | null>;
@@ -3406,7 +3502,7 @@ interface EnvTypedTableBase<T extends TableTypes> {
      * kapanır (valid_to/superseded_by), yenisi TEK savepoint'te eklenir; dönüş
      * yeni satır. Validity beyanı olmayan tabloda adlandırılmış çalışma-zamanı
      * hatası — tip düzeyinde ayrım env `Tables` bayrağı taşımadığından yapılamaz. */
-    supersede(id: string, row: T["insert"]): Promise<T["row"]>;
+    supersede(id: string, row: InsertValues<T["insert"]>): Promise<T["row"]>;
 }
 /** Tablo erişimcisi: env girdisi `searchable: true` taşıyorsa (vector kolonu ya da
  * search beyanı — env-gen üretir) `search()` üyesi VARDIR; yoksa üye hiç yoktur ve
@@ -3960,9 +4056,9 @@ type TxWhereField<Row, K extends keyof Row> = WhereOpWith<Row[K], ColRefOf<Row,
 type TxWhere<Row, Rels = unknown> = {
     [K in keyof Row]?: TxWhereField<Row, K>;
 } & {
-    OR?: TxWhere<Row, Rels>[];
-    AND?: TxWhere<Row, Rels>[];
-    NOT?: TxWhere<Row, Rels>;
+    OR?: (TxWhere<Row, Rels> | SqlFragment)[];
+    AND?: (TxWhere<Row, Rels> | SqlFragment)[];
+    NOT?: TxWhere<Row, Rels> | SqlFragment;
 } & HasOnly<Rels>;
 /** Options for a plan `select`. */
 interface TxSelectOptions {
@@ -4342,6 +4438,13 @@ interface DBOps {
      */
     query<T = unknown>(sql: string, params?: unknown[]): Promise<T[]>;
     insert(table: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
+    /** Çok satır, TEK statement. Satırların anahtar kümesi aynı olmalı — kolon
+     *  listesi paylaşıldığı için farklı şekilli bir satırın kolonu sessizce
+     *  yazılmazdı. */
+    insertMany(table: string, rows: readonly Record<string, unknown>[], opts?: {
+        onConflict: readonly string[];
+        action?: "ignore" | "update";
+    }): Promise<Record<string, unknown>[]>;
     /**
      * Insert the row, or update it when it collides on `onConflict` — one
      * statement, so two concurrent callers cannot both lose.