@palbase/backend 30.0.1 → 33.0.0

package/dist/{chunk-CGNN2PUH.js.map → chunk-KATPXCJ5.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts"],"sourcesContent":["/**\n * The brand that identifies an HttpError ACROSS SDK instances.\n *\n * A process legitimately holds more than one copy of this SDK — the runtime\n * loads the engine from its own node_modules while the tenant's bundle carries\n * an inlined copy, which is why the controller registry and the error registry\n * are both anchored on `Symbol.for`. The one place that did not follow the\n * pattern was the engine's catch: `err instanceof HttpError` compares CLASS\n * IDENTITY, so a `throw new NotFound()` from the bundle's copy did not match\n * the engine's copy and every typed error in every deployed backend degraded to\n * `500 internal_error`. Measured through the edge on a real deploy: a route\n * throwing `NotFound` answered 500 while the runtime's own log printed the\n * error object with `status: 404` right beside it.\n *\n * `Symbol.for` puts this in the cross-realm registry, so every copy of the SDK\n * agrees on it by VALUE rather than by identity.\n */\nexport const HTTP_ERROR_BRAND: unique symbol = Symbol.for(\"palbase.backend.httpError\");\n\n/**\n * Set on an `HttpError` the ENGINE built out of a driver failure, as opposed to\n * one the author constructed to ANSWER a request.\n *\n * The distinction cannot be read off the status, and 409 is why. The scaffold\n * teaches `throw new Conflict(\"title already taken\")` as the way to answer\n * (template/AGENTS.md), and the engine raises `UniqueViolation` — also a 409 —\n * when a write hits a unique index. Logging by status therefore either loses the\n * engine's event or writes an \"unhandled\" line every time an author takes the\n * documented path. Measured: it did the second.\n *\n * `Symbol.for` so the mark survives the bundle/runtime SDK split, the same way\n * {@link HTTP_ERROR_BRAND} does.\n */\nexport const ENGINE_RAISED: unique symbol = Symbol.for(\"palbase.backend.engineRaised\") as never;\n\n/** Mark `e` as engine-raised and return it, so a conversion site reads as one expression. */\nexport function markEngineRaised<E extends object>(e: E): E {\n  (e as Record<symbol, unknown>)[ENGINE_RAISED] = true;\n  return e;\n}\n\n/** Whether the engine built this error, rather than the author throwing it to answer. */\nexport function isEngineRaised(e: unknown): boolean {\n  return typeof e === \"object\" && e !== null && (e as Record<symbol, unknown>)[ENGINE_RAISED] === true;\n}\n\n/**\n * Whether a thrown value is an HttpError from ANY copy of this SDK.\n *\n * The shape is checked as well as the brand: the brand says \"this claims to be\n * one of ours\", the fields say the envelope can actually be built from it, and\n * a half-formed object must fall through to the 500 path rather than produce a\n * malformed response.\n */\nexport function isHttpError(err: unknown): err is HttpError {\n  if (typeof err !== \"object\" || err === null) return false;\n  const e = err as Record<PropertyKey, unknown>;\n  return (\n    e[HTTP_ERROR_BRAND] === true &&\n    typeof e.status === \"number\" &&\n    typeof e.error === \"string\" &&\n    typeof e.errorDescription === \"string\"\n  );\n}\n\n/** HTTP error with structured error response format.\n *\n * The base class for the throwable error classes (`PalError`, `Conflict`,\n * `NotFound`, …). Construct one directly with `throw new HttpError(404,\n * \"todo_not_found\", \"No such todo\")`, or throw a named subclass\n * (`throw new NotFound(\"todo not found\")`). The runtime catches any `HttpError`\n * and emits the standard envelope; on the wire (and to iOS) it surfaces as\n * `BackendError.server(code, status, message, requestId)`.\n *\n * The optional `data` field carries a structured payload alongside the\n * standard envelope — for errors that need to ship extra context\n * (e.g. `new Conflict(\"locked\", \"title_locked\", { retryAfter: 30 })`). It rides\n * through to the iOS typed enum's associated value.\n */\nexport class HttpError extends Error {\n  public readonly status: number;\n  public readonly error: string;\n  public readonly errorDescription: string;\n  public readonly data?: unknown;\n  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */\n  public readonly [HTTP_ERROR_BRAND] = true;\n\n  constructor(status: number, error: string, errorDescription: string, data?: unknown) {\n    super(errorDescription);\n    this.name = \"HttpError\";\n    this.status = status;\n    this.error = error;\n    this.errorDescription = errorDescription;\n    if (data !== undefined) {\n      this.data = data;\n    }\n  }\n\n  /**\n   * Serialize to the standard Palbase error response format.\n   * The `requestId` is injected by the runtime layer from the request context.\n   * When called without arguments (e.g. JSON.stringify), request_id is omitted.\n   * When `data` is set, it is appended as a strict-superset field.\n   */\n  toJSON(requestId?: string): {\n    error: string;\n    error_description: string;\n    status: number;\n    request_id?: string;\n    data?: unknown;\n  } {\n    const result: {\n      error: string;\n      error_description: string;\n      status: number;\n      request_id?: string;\n      data?: unknown;\n    } = {\n      error: this.error,\n      error_description: this.errorDescription,\n      status: this.status,\n    };\n    if (requestId) {\n      result.request_id = requestId;\n    }\n    if (this.data !== undefined) {\n      result.data = this.data;\n    }\n    return result;\n  }\n}\n\n/**\n * Throw with a custom HTTP status + wire code. The general-purpose escape hatch\n * when none of the named classes (`Conflict`/`NotFound`/…) fits.\n *\n * @example\n * throw new PalError(418, \"teapot\", \"I'm a teapot\");\n */\nexport class PalError extends HttpError {\n  constructor(status: number, code: string, description: string, data?: unknown) {\n    super(status, code, description, data);\n    this.name = \"PalError\";\n  }\n}\n\n/** Base for the named status classes. Each subclass fixes its HTTP status; the\n * `code` defaults to the class's canonical wire code (overridable), and the\n * `message` defaults to a human-readable label (overridable). */\nabstract class NamedHttpError extends HttpError {\n  protected constructor(\n    status: number,\n    defaultCode: string,\n    name: string,\n    message?: string,\n    code?: string,\n    data?: unknown,\n  ) {\n    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);\n    this.name = name;\n  }\n}\n\n/** Derive a default human-readable message from a class name\n * (\"NotFound\" → \"Not found\", \"TooManyRequests\" → \"Too many requests\"). */\nfunction defaultMessage(name: string): string {\n  const spaced = name.replace(/([a-z0-9])([A-Z])/g, \"$1 $2\");\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();\n}\n\n/**\n * 400 — the request was malformed or failed validation. Carries a fixed typed\n * payload: `new BadRequest({ fields: [{ field: \"email\", message: \"invalid\" }] })`.\n * The shape is declared once in the SDK so codegen surfaces `error.data.fields`\n * typed on the client.\n */\nexport class BadRequest extends NamedHttpError {\n  public declare readonly data: BadRequestData;\n  constructor(data: BadRequestData, message?: string) {\n    super(400, \"bad_request\", \"BadRequest\", message, undefined, data);\n  }\n}\n\n/** 401 — the caller is not authenticated. */\nexport class Unauthorized extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(401, \"unauthorized\", \"Unauthorized\", message, code, data);\n  }\n}\n\n/** 403 — the caller is authenticated but not allowed. */\nexport class Forbidden extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(403, \"forbidden\", \"Forbidden\", message, code, data);\n  }\n}\n\n/** 404 — the requested resource does not exist. */\nexport class NotFound extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(404, \"not_found\", \"NotFound\", message, code, data);\n  }\n}\n\n/** 409 — the request conflicts with the current state. */\nexport class Conflict extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(409, \"conflict\", \"Conflict\", message, code, data);\n  }\n}\n\n/**\n * 409 — a write was refused because it would duplicate an existing row.\n * Carries the NAME of the unique constraint Postgres named (`users_email_key`).\n *\n * The engine produces it: a statement rejected with SQLSTATE `23505` is\n * converted here rather than surfacing as an opaque driver error (see\n * `engine/db.ts`, `diagnosingDriver`). What that removes is the string match —\n * before this, the only way to act on a duplicate was to test the driver\n * message for \"duplicate key value violates unique constraint\", a contract\n * nobody signed that breaks on a Postgres upgrade, a locale, or a constraint\n * rename, silently and in production.\n *\n * THE NAME IS A FIELD AND STAYS OUT OF THE DEFAULT MESSAGE. The two are not\n * the same audience. `constraint` is read by the code that catches this — the\n * developer, who already knows the schema. `errorDescription` is the HTTP\n * response body, and an UNCAUGHT duplicate puts it in front of the\n * application's end user: `users_email_key` there discloses how the schema is\n * built to whoever sent the request. The platform's own data API took the same\n * decision one surface over and wrote down why —\n * `v2/internal/modules/database/internal/handler/pgerror.go:83-87` collapses\n * every 23xxx to a generic conflict, \"never disclose the constraint/column\n * name\". A thrower who WANTS the name on the wire passes it deliberately\n * (`new UniqueViolation(c, \\`\\${c} already exists\\`)`, or through `data`).\n *\n * @example\n * try {\n *   await Database.public.users.insert({ email });\n * } catch (e) {\n *   if (UniqueViolation.is(e) && e.constraint === \"users_email_key\") {\n *     throw new Conflict(\"That email is taken\", \"email_taken\");\n *   }\n *   throw e;\n * }\n */\nexport class UniqueViolation extends Conflict {\n  /**\n   * Whether `e` is a unique violation — REGARDLESS of which copy of this SDK\n   * constructed it.\n   *\n   * Use this instead of `instanceof`. Measured on a live stack: a controller\n   * bundle INLINES its own copy of `@palbase/backend`, and the engine that\n   * raises this error is the runtime's copy. Two copies, two class identities,\n   * and `e instanceof UniqueViolation` is false in the one place a caller\n   * writes it — a check that reads as correct and silently never matches.\n   */\n  static is(e: unknown): e is UniqueViolation {\n    return (\n      typeof e === \"object\" &&\n      e !== null &&\n      (e as { name?: unknown }).name === \"UniqueViolation\" &&\n      typeof (e as { constraint?: unknown }).constraint === \"string\"\n    );\n  }\n\n  /** The unique constraint the statement violated, as Postgres named it.\n   * `\"\"` when the driver did not say which — see `engine/db.ts`. */\n  public readonly constraint: string;\n\n  constructor(constraint: string, message?: string, code?: string, data?: unknown) {\n    super(message ?? \"Unique constraint violated\", code ?? \"unique_violation\", data);\n    this.name = \"UniqueViolation\";\n    this.constraint = constraint;\n  }\n}\n\n/**\n * Eşzamanlılık yüzünden BAŞARISIZ OLAN, ama TEKRAR DENENİRSE başarılı olabilecek\n * hataların ortak yüzeyi (FR-036).\n *\n * `retryable: true` bir tahmin değil, Postgres'in söylediği şey: `40001` ve\n * `40P01` \"bu işlemi baştan çalıştır\" anlamına gelir. Kümenin DAR tutulması\n * kasıtlı — `23505` buraya girseydi, tekrar denemek aynı cevabı verir ve\n * döngü sonsuza kadar dönerdi.\n */\nexport interface RetryableError extends Error {\n  readonly retryable: true;\n  /** Beş karakterlik SQLSTATE — hangi eşzamanlılık hatası olduğunu SÖYLER. */\n  readonly sqlstate: string;\n}\n\n/**\n * `e` tekrar denenebilir mi?\n *\n * `instanceof` DEĞİL şekil kontrolü — ve sebebi ÖLÇÜLMÜŞ (bkz. {@link\n * UniqueViolation.is}): bir controller bundle'ı kendi `@palbase/backend`\n * kopyasını inline'lıyor, hatayı fırlatan motor ise runtime'ın kopyası. İki\n * sınıf kimliği, ve `e instanceof SerializationFailure` yazan tek yerde\n * sessizce hiç eşleşmiyor.\n */\nexport function isRetryable(e: unknown): e is RetryableError {\n  return (\n    typeof e === \"object\" &&\n    e !== null &&\n    (e as { retryable?: unknown }).retryable === true &&\n    typeof (e as { sqlstate?: unknown }).sqlstate === \"string\"\n  );\n}\n\n/**\n * `40001 serialization_failure` — SERIALIZABLE ya da REPEATABLE READ altında\n * eşzamanlı bir işlem bu işlemi geçersiz kıldı.\n *\n * D-016: bu hata BLOKLANMIYOR, FIRLATILIYOR. Retry'sız bir izolasyon\n * yükseltmesi sunmak defect'tir — kullanıcıya çalışmayan bir düğme vermektir:\n * SERIALIZABLE'a çıkıp `40001`'i yakalamayan kod, önceden çalışan işlemleri\n * rastgele kaybetmeye başlar.\n */\nexport class SerializationFailure extends Conflict implements RetryableError {\n  public readonly retryable = true as const;\n  public readonly sqlstate: string;\n\n  static is(e: unknown): e is SerializationFailure {\n    return (\n      typeof e === \"object\" && e !== null &&\n      (e as { name?: unknown }).name === \"SerializationFailure\"\n    );\n  }\n\n  constructor(sqlstate = \"40001\", message?: string, data?: unknown) {\n    super(\n      message ??\n        \"işlem eşzamanlı bir işlemle serileştirilemedi — aynı işlemi baştan çalıştırın \" +\n          \"($transaction'a { retry: n } verebilirsiniz)\",\n      \"serialization_failure\",\n      data,\n    );\n    this.name = \"SerializationFailure\";\n    this.sqlstate = sqlstate;\n  }\n}\n\n/**\n * `40P01 deadlock_detected` — iki işlem birbirinin kilidini bekliyordu;\n * Postgres birini seçip iptal etti.\n *\n * Bu hatayı GÖRMEK bir tasarım sinyali: kilit sırası deterministik değilse\n * tekrar denemek yalnız maliyeti öteler. `Database.$lockRows(...)` (FR-035)\n * ya da çok satırlı yazmanın CTE'si (FR-015) sırayı sabitler.\n */\nexport class DeadlockDetected extends Conflict implements RetryableError {\n  public readonly retryable = true as const;\n  public readonly sqlstate: string;\n\n  static is(e: unknown): e is DeadlockDetected {\n    return (\n      typeof e === \"object\" && e !== null &&\n      (e as { name?: unknown }).name === \"DeadlockDetected\"\n    );\n  }\n\n  constructor(sqlstate = \"40P01\", message?: string, data?: unknown) {\n    super(\n      message ??\n        \"deadlock: iki işlem birbirinin kilidini bekledi ve bu işlem iptal edildi — \" +\n          \"kilit sırasını sabitlemek için Database.$lockRows(tablo, id'ler) kullanın\",\n      \"deadlock_detected\",\n      data,\n    );\n    this.name = \"DeadlockDetected\";\n    this.sqlstate = sqlstate;\n  }\n}\n\n/** A single field-level validation failure carried by {@link BadRequest}. */\nexport interface FieldError {\n  /** The offending field's name (dotted path for nested fields). */\n  field: string;\n  /** Human-readable reason the field failed. */\n  message: string;\n}\n\n/** The fixed, typed payload {@link BadRequest} ships. */\nexport interface BadRequestData {\n  /** The fields that failed validation. */\n  fields: FieldError[];\n}\n\n/** The fixed, typed payload {@link TooManyRequests} ships. */\nexport interface TooManyRequestsData {\n  /** Seconds the caller should wait before retrying. */\n  retryAfter: number;\n}\n\n/**\n * 429 — the caller has exceeded the rate limit. Carries a fixed typed payload:\n * `new TooManyRequests({ retryAfter: 30 })`. The shape is declared once in the\n * SDK (error-registry pre-seed) so codegen surfaces `error.data.retryAfter`\n * typed on the client — no per-project definition needed.\n */\nexport class TooManyRequests extends NamedHttpError {\n  public declare readonly data: TooManyRequestsData;\n  constructor(data: TooManyRequestsData, message?: string) {\n    super(429, \"too_many_requests\", \"TooManyRequests\", message, undefined, data);\n  }\n}\n"],"mappings":";;;;;AAiBO,IAAMA,mBAAkCC,uBAAOC,IAAI,2BAAA;AAgBnD,IAAMC,gBAA+BF,uBAAOC,IAAI,8BAAA;AAGhD,SAASE,iBAAmCC,GAAI;AACpDA,IAA8BF,aAAAA,IAAiB;AAChD,SAAOE;AACT;AAHgBD;AAMT,SAASE,eAAeD,GAAU;AACvC,SAAO,OAAOA,MAAM,YAAYA,MAAM,QAASA,EAA8BF,aAAAA,MAAmB;AAClG;AAFgBG;AAYT,SAASC,YAAYC,KAAY;AACtC,MAAI,OAAOA,QAAQ,YAAYA,QAAQ,KAAM,QAAO;AACpD,QAAMH,IAAIG;AACV,SACEH,EAAEL,gBAAAA,MAAsB,QACxB,OAAOK,EAAEI,WAAW,YACpB,OAAOJ,EAAEK,UAAU,YACnB,OAAOL,EAAEM,qBAAqB;AAElC;AATgBJ;AAyBT,IAAMK,YAAN,cAAwBC,MAAAA;EA/E/B,OA+E+BA;;;EACbJ;EACAC;EACAC;EACAG;;EAEA,CAACd,gBAAAA,IAAoB;EAErC,YAAYS,QAAgBC,OAAeC,kBAA0BG,MAAgB;AACnF,UAAMH,gBAAAA;AACN,SAAKI,OAAO;AACZ,SAAKN,SAASA;AACd,SAAKC,QAAQA;AACb,SAAKC,mBAAmBA;AACxB,QAAIG,SAASE,QAAW;AACtB,WAAKF,OAAOA;IACd;EACF;;;;;;;EAQAG,OAAOC,WAML;AACA,UAAMC,SAMF;MACFT,OAAO,KAAKA;MACZU,mBAAmB,KAAKT;MACxBF,QAAQ,KAAKA;IACf;AACA,QAAIS,WAAW;AACbC,aAAOE,aAAaH;IACtB;AACA,QAAI,KAAKJ,SAASE,QAAW;AAC3BG,aAAOL,OAAO,KAAKA;IACrB;AACA,WAAOK;EACT;AACF;AASO,IAAMG,WAAN,cAAuBV,UAAAA;EA3I9B,OA2I8BA;;;EAC5B,YAAYH,QAAgBc,MAAcC,aAAqBV,MAAgB;AAC7E,UAAML,QAAQc,MAAMC,aAAaV,IAAAA;AACjC,SAAKC,OAAO;EACd;AACF;AAKA,IAAeU,iBAAf,MAAeA,wBAAuBb,UAAAA;EArJtC,OAqJsCA;;;EACpC,YACEH,QACAiB,aACAX,MACAY,SACAJ,MACAT,MACA;AACA,UAAML,QAAQc,QAAQG,aAAaC,WAAWC,eAAeb,IAAAA,GAAOD,IAAAA;AACpE,SAAKC,OAAOA;EACd;AACF;AAIA,SAASa,eAAeb,MAAY;AAClC,QAAMc,SAASd,KAAKe,QAAQ,sBAAsB,OAAA;AAClD,SAAOD,OAAOE,OAAO,CAAA,EAAGC,YAAW,IAAKH,OAAOI,MAAM,CAAA,EAAGC,YAAW;AACrE;AAHSN;AAWF,IAAMO,aAAN,cAAyBV,eAAAA;EAhLhC,OAgLgCA;;;EAE9B,YAAYX,MAAsBa,SAAkB;AAClD,UAAM,KAAK,eAAe,cAAcA,SAASX,QAAWF,IAAAA;EAC9D;AACF;AAGO,IAAMsB,eAAN,cAA2BX,eAAAA;EAxLlC,OAwLkCA;;;EAChC,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,gBAAgB,gBAAgBa,SAASJ,MAAMT,IAAAA;EAC5D;AACF;AAGO,IAAMuB,YAAN,cAAwBZ,eAAAA;EA/L/B,OA+L+BA;;;EAC7B,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,aAAa,aAAaa,SAASJ,MAAMT,IAAAA;EACtD;AACF;AAGO,IAAMwB,WAAN,cAAuBb,eAAAA;EAtM9B,OAsM8BA;;;EAC5B,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,aAAa,YAAYa,SAASJ,MAAMT,IAAAA;EACrD;AACF;AAGO,IAAMyB,WAAN,cAAuBd,eAAAA;EA7M9B,OA6M8BA;;;EAC5B,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,YAAY,YAAYa,SAASJ,MAAMT,IAAAA;EACpD;AACF;AAoCO,IAAM0B,kBAAN,cAA8BD,SAAAA;EArPrC,OAqPqCA;;;;;;;;;;;;;EAWnC,OAAOE,GAAGpC,GAAkC;AAC1C,WACE,OAAOA,MAAM,YACbA,MAAM,QACLA,EAAyBU,SAAS,qBACnC,OAAQV,EAA+BqC,eAAe;EAE1D;;;EAIgBA;EAEhB,YAAYA,YAAoBf,SAAkBJ,MAAeT,MAAgB;AAC/E,UAAMa,WAAW,8BAA8BJ,QAAQ,oBAAoBT,IAAAA;AAC3E,SAAKC,OAAO;AACZ,SAAK2B,aAAaA;EACpB;AACF;AA0BO,SAASC,YAAYtC,GAAU;AACpC,SACE,OAAOA,MAAM,YACbA,MAAM,QACLA,EAA8BuC,cAAc,QAC7C,OAAQvC,EAA6BwC,aAAa;AAEtD;AAPgBF;AAkBT,IAAMG,uBAAN,cAAmCP,SAAAA;EA9T1C,OA8T0CA;;;EACxBK,YAAY;EACZC;EAEhB,OAAOJ,GAAGpC,GAAuC;AAC/C,WACE,OAAOA,MAAM,YAAYA,MAAM,QAC9BA,EAAyBU,SAAS;EAEvC;EAEA,YAAY8B,WAAW,SAASlB,SAAkBb,MAAgB;AAChE,UACEa,WACE,kMAEF,yBACAb,IAAAA;AAEF,SAAKC,OAAO;AACZ,SAAK8B,WAAWA;EAClB;AACF;AAUO,IAAME,mBAAN,cAA+BR,SAAAA;EA9VtC,OA8VsCA;;;EACpBK,YAAY;EACZC;EAEhB,OAAOJ,GAAGpC,GAAmC;AAC3C,WACE,OAAOA,MAAM,YAAYA,MAAM,QAC9BA,EAAyBU,SAAS;EAEvC;EAEA,YAAY8B,WAAW,SAASlB,SAAkBb,MAAgB;AAChE,UACEa,WACE,8LAEF,qBACAb,IAAAA;AAEF,SAAKC,OAAO;AACZ,SAAK8B,WAAWA;EAClB;AACF;AA4BO,IAAMG,kBAAN,cAA8BvB,eAAAA;EAhZrC,OAgZqCA;;;EAEnC,YAAYX,MAA2Ba,SAAkB;AACvD,UAAM,KAAK,qBAAqB,mBAAmBA,SAASX,QAAWF,IAAAA;EACzE;AACF;","names":["HTTP_ERROR_BRAND","Symbol","for","ENGINE_RAISED","markEngineRaised","e","isEngineRaised","isHttpError","err","status","error","errorDescription","HttpError","Error","data","name","undefined","toJSON","requestId","result","error_description","request_id","PalError","code","description","NamedHttpError","defaultCode","message","defaultMessage","spaced","replace","charAt","toUpperCase","slice","toLowerCase","BadRequest","Unauthorized","Forbidden","NotFound","Conflict","UniqueViolation","is","constraint","isRetryable","retryable","sqlstate","SerializationFailure","DeadlockDetected","TooManyRequests"]}
+{"version":3,"sources":["../src/errors.ts"],"sourcesContent":["/**\n * The brand that identifies an HttpError ACROSS SDK instances.\n *\n * A process legitimately holds more than one copy of this SDK — the runtime\n * loads the engine from its own node_modules while the tenant's bundle carries\n * an inlined copy, which is why the controller registry and the error registry\n * are both anchored on `Symbol.for`. The one place that did not follow the\n * pattern was the engine's catch: `err instanceof HttpError` compares CLASS\n * IDENTITY, so a `throw new NotFound()` from the bundle's copy did not match\n * the engine's copy and every typed error in every deployed backend degraded to\n * `500 internal_error`. Measured through the edge on a real deploy: a route\n * throwing `NotFound` answered 500 while the runtime's own log printed the\n * error object with `status: 404` right beside it.\n *\n * `Symbol.for` puts this in the cross-realm registry, so every copy of the SDK\n * agrees on it by VALUE rather than by identity.\n */\nexport const HTTP_ERROR_BRAND: unique symbol = Symbol.for(\"palbase.backend.httpError\");\n\n/**\n * Set on an `HttpError` the ENGINE built out of a driver failure, as opposed to\n * one the author constructed to ANSWER a request.\n *\n * The distinction cannot be read off the status, and 409 is why. The scaffold\n * teaches `throw new Conflict(\"title already taken\")` as the way to answer\n * (template/AGENTS.md), and the engine raises `UniqueViolation` — also a 409 —\n * when a write hits a unique index. Logging by status therefore either loses the\n * engine's event or writes an \"unhandled\" line every time an author takes the\n * documented path. Measured: it did the second.\n *\n * `Symbol.for` so the mark survives the bundle/runtime SDK split, the same way\n * {@link HTTP_ERROR_BRAND} does.\n */\nexport const ENGINE_RAISED: unique symbol = Symbol.for(\"palbase.backend.engineRaised\") as never;\n\n/** Mark `e` as engine-raised and return it, so a conversion site reads as one expression. */\nexport function markEngineRaised<E extends object>(e: E): E {\n  (e as Record<symbol, unknown>)[ENGINE_RAISED] = true;\n  return e;\n}\n\n/** Whether the engine built this error, rather than the author throwing it to answer. */\nexport function isEngineRaised(e: unknown): boolean {\n  return typeof e === \"object\" && e !== null && (e as Record<symbol, unknown>)[ENGINE_RAISED] === true;\n}\n\n/**\n * Whether a thrown value is an HttpError from ANY copy of this SDK.\n *\n * The shape is checked as well as the brand: the brand says \"this claims to be\n * one of ours\", the fields say the envelope can actually be built from it, and\n * a half-formed object must fall through to the 500 path rather than produce a\n * malformed response.\n */\nexport function isHttpError(err: unknown): err is HttpError {\n  if (typeof err !== \"object\" || err === null) return false;\n  const e = err as Record<PropertyKey, unknown>;\n  return (\n    e[HTTP_ERROR_BRAND] === true &&\n    typeof e.status === \"number\" &&\n    typeof e.error === \"string\" &&\n    typeof e.errorDescription === \"string\"\n  );\n}\n\n/** HTTP error with structured error response format.\n *\n * The base class for the throwable error classes (`PalError`, `Conflict`,\n * `NotFound`, …). Construct one directly with `throw new HttpError(404,\n * \"todo_not_found\", \"No such todo\")`, or throw a named subclass\n * (`throw new NotFound(\"todo not found\")`). The runtime catches any `HttpError`\n * and emits the standard envelope; on the wire (and to iOS) it surfaces as\n * `BackendError.server(code, status, message, requestId)`.\n *\n * The optional `data` field carries a structured payload alongside the\n * standard envelope — for errors that need to ship extra context\n * (e.g. `new Conflict(\"locked\", \"title_locked\", { retryAfter: 30 })`). It rides\n * through to the iOS typed enum's associated value.\n */\nexport class HttpError extends Error {\n  public readonly status: number;\n  public readonly error: string;\n  public readonly errorDescription: string;\n  public readonly data?: unknown;\n  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */\n  public readonly [HTTP_ERROR_BRAND] = true;\n\n  constructor(status: number, error: string, errorDescription: string, data?: unknown) {\n    super(errorDescription);\n    this.name = \"HttpError\";\n    this.status = status;\n    this.error = error;\n    this.errorDescription = errorDescription;\n    if (data !== undefined) {\n      this.data = data;\n    }\n  }\n\n  /**\n   * Serialize to the standard Palbase error response format.\n   * The `requestId` is injected by the runtime layer from the request context.\n   * When called without arguments (e.g. JSON.stringify), request_id is omitted.\n   * When `data` is set, it is appended as a strict-superset field.\n   */\n  toJSON(requestId?: string): {\n    error: string;\n    error_description: string;\n    status: number;\n    request_id?: string;\n    data?: unknown;\n  } {\n    const result: {\n      error: string;\n      error_description: string;\n      status: number;\n      request_id?: string;\n      data?: unknown;\n    } = {\n      error: this.error,\n      error_description: this.errorDescription,\n      status: this.status,\n    };\n    if (requestId) {\n      result.request_id = requestId;\n    }\n    if (this.data !== undefined) {\n      result.data = this.data;\n    }\n    return result;\n  }\n}\n\n/**\n * Throw with a custom HTTP status + wire code. The general-purpose escape hatch\n * when none of the named classes (`Conflict`/`NotFound`/…) fits.\n *\n * @example\n * throw new PalError(418, \"teapot\", \"I'm a teapot\");\n */\nexport class PalError extends HttpError {\n  constructor(status: number, code: string, description: string, data?: unknown) {\n    super(status, code, description, data);\n    this.name = \"PalError\";\n  }\n}\n\n/** Base for the named status classes. Each subclass fixes its HTTP status; the\n * `code` defaults to the class's canonical wire code (overridable), and the\n * `message` defaults to a human-readable label (overridable). */\nabstract class NamedHttpError extends HttpError {\n  protected constructor(\n    status: number,\n    defaultCode: string,\n    name: string,\n    message?: string,\n    code?: string,\n    data?: unknown,\n  ) {\n    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);\n    this.name = name;\n  }\n}\n\n/** Derive a default human-readable message from a class name\n * (\"NotFound\" → \"Not found\", \"TooManyRequests\" → \"Too many requests\"). */\nfunction defaultMessage(name: string): string {\n  const spaced = name.replace(/([a-z0-9])([A-Z])/g, \"$1 $2\");\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();\n}\n\n/**\n * 400 — the request was malformed or failed validation. Carries a fixed typed\n * payload: `new BadRequest({ fields: [{ field: \"email\", message: \"invalid\" }] })`.\n * The shape is declared once in the SDK so codegen surfaces `error.data.fields`\n * typed on the client.\n */\nexport class BadRequest extends NamedHttpError {\n  public declare readonly data: BadRequestData;\n  constructor(data: BadRequestData, message?: string) {\n    super(400, \"bad_request\", \"BadRequest\", message, undefined, data);\n  }\n}\n\n/** 401 — the caller is not authenticated. */\nexport class Unauthorized extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(401, \"unauthorized\", \"Unauthorized\", message, code, data);\n  }\n}\n\n/** 403 — the caller is authenticated but not allowed. */\nexport class Forbidden extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(403, \"forbidden\", \"Forbidden\", message, code, data);\n  }\n}\n\n/** 404 — the requested resource does not exist. */\nexport class NotFound extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(404, \"not_found\", \"NotFound\", message, code, data);\n  }\n}\n\n/** 409 — the request conflicts with the current state. */\nexport class Conflict extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(409, \"conflict\", \"Conflict\", message, code, data);\n  }\n}\n\n/**\n * 409 — a write was refused because it would duplicate an existing row.\n * Carries the NAME of the unique constraint Postgres named (`users_email_key`).\n *\n * The engine produces it: a statement rejected with SQLSTATE `23505` is\n * converted here rather than surfacing as an opaque driver error (see\n * `engine/db.ts`, `diagnosingDriver`). What that removes is the string match —\n * before this, the only way to act on a duplicate was to test the driver\n * message for \"duplicate key value violates unique constraint\", a contract\n * nobody signed that breaks on a Postgres upgrade, a locale, or a constraint\n * rename, silently and in production.\n *\n * THE NAME IS A FIELD AND STAYS OUT OF THE DEFAULT MESSAGE. The two are not\n * the same audience. `constraint` is read by the code that catches this — the\n * developer, who already knows the schema. `errorDescription` is the HTTP\n * response body, and an UNCAUGHT duplicate puts it in front of the\n * application's end user: `users_email_key` there discloses how the schema is\n * built to whoever sent the request. The platform's own data API took the same\n * decision one surface over and wrote down why —\n * `v2/internal/modules/database/internal/handler/pgerror.go:83-87` collapses\n * every 23xxx to a generic conflict, \"never disclose the constraint/column\n * name\". A thrower who WANTS the name on the wire passes it deliberately\n * (`new UniqueViolation(c, \\`\\${c} already exists\\`)`, or through `data`).\n *\n * @example\n * try {\n *   await Database.public.users.insert({ email });\n * } catch (e) {\n *   if (UniqueViolation.is(e) && e.constraint === \"users_email_key\") {\n *     throw new Conflict(\"That email is taken\", \"email_taken\");\n *   }\n *   throw e;\n * }\n */\nexport class UniqueViolation extends Conflict {\n  /**\n   * Whether `e` is a unique violation — REGARDLESS of which copy of this SDK\n   * constructed it.\n   *\n   * Use this instead of `instanceof`. Measured on a live stack: a controller\n   * bundle INLINES its own copy of `@palbase/backend`, and the engine that\n   * raises this error is the runtime's copy. Two copies, two class identities,\n   * and `e instanceof UniqueViolation` is false in the one place a caller\n   * writes it — a check that reads as correct and silently never matches.\n   */\n  static is(e: unknown): e is UniqueViolation {\n    return (\n      typeof e === \"object\" &&\n      e !== null &&\n      (e as { name?: unknown }).name === \"UniqueViolation\" &&\n      typeof (e as { constraint?: unknown }).constraint === \"string\"\n    );\n  }\n\n  /** The unique constraint the statement violated, as Postgres named it.\n   * `\"\"` when the driver did not say which — see `engine/db.ts`. */\n  public readonly constraint: string;\n\n  constructor(constraint: string, message?: string, code?: string, data?: unknown) {\n    super(message ?? \"Unique constraint violated\", code ?? \"unique_violation\", data);\n    this.name = \"UniqueViolation\";\n    this.constraint = constraint;\n  }\n}\n\n/**\n * Eşzamanlılık yüzünden BAŞARISIZ OLAN, ama TEKRAR DENENİRSE başarılı olabilecek\n * hataların ortak yüzeyi (FR-036).\n *\n * `retryable: true` bir tahmin değil, Postgres'in söylediği şey: `40001` ve\n * `40P01` \"bu işlemi baştan çalıştır\" anlamına gelir. Kümenin DAR tutulması\n * kasıtlı — `23505` buraya girseydi, tekrar denemek aynı cevabı verir ve\n * döngü sonsuza kadar dönerdi.\n */\nexport interface RetryableError extends Error {\n  readonly retryable: true;\n  /** Beş karakterlik SQLSTATE — hangi eşzamanlılık hatası olduğunu SÖYLER. */\n  readonly sqlstate: string;\n}\n\n/**\n * `e` tekrar denenebilir mi?\n *\n * `instanceof` DEĞİL şekil kontrolü — ve sebebi ÖLÇÜLMÜŞ (bkz. {@link\n * UniqueViolation.is}): bir controller bundle'ı kendi `@palbase/backend`\n * kopyasını inline'lıyor, hatayı fırlatan motor ise runtime'ın kopyası. İki\n * sınıf kimliği, ve `e instanceof SerializationFailure` yazan tek yerde\n * sessizce hiç eşleşmiyor.\n */\nexport function isRetryable(e: unknown): e is RetryableError {\n  return (\n    typeof e === \"object\" &&\n    e !== null &&\n    (e as { retryable?: unknown }).retryable === true &&\n    typeof (e as { sqlstate?: unknown }).sqlstate === \"string\"\n  );\n}\n\n/**\n * `40001 serialization_failure` — SERIALIZABLE ya da REPEATABLE READ altında\n * eşzamanlı bir işlem bu işlemi geçersiz kıldı.\n *\n * D-016: bu hata BLOKLANMIYOR, FIRLATILIYOR. Retry'sız bir izolasyon\n * yükseltmesi sunmak defect'tir — kullanıcıya çalışmayan bir düğme vermektir:\n * SERIALIZABLE'a çıkıp `40001`'i yakalamayan kod, önceden çalışan işlemleri\n * rastgele kaybetmeye başlar.\n */\nexport class SerializationFailure extends Conflict implements RetryableError {\n  public readonly retryable = true as const;\n  public readonly sqlstate: string;\n\n  static is(e: unknown): e is SerializationFailure {\n    return (\n      typeof e === \"object\" && e !== null &&\n      (e as { name?: unknown }).name === \"SerializationFailure\"\n    );\n  }\n\n  constructor(sqlstate = \"40001\", message?: string, data?: unknown) {\n    super(\n      message ??\n        \"işlem eşzamanlı bir işlemle serileştirilemedi — aynı işlemi baştan çalıştırın \" +\n          \"($transaction'a { retry: n } verebilirsiniz)\",\n      \"serialization_failure\",\n      data,\n    );\n    this.name = \"SerializationFailure\";\n    this.sqlstate = sqlstate;\n  }\n}\n\n/**\n * `40P01 deadlock_detected` — iki işlem birbirinin kilidini bekliyordu;\n * Postgres birini seçip iptal etti.\n *\n * Bu hatayı GÖRMEK bir tasarım sinyali: kilit sırası deterministik değilse\n * tekrar denemek yalnız maliyeti öteler. `Database.$lockRows(...)` (FR-035)\n * ya da çok satırlı yazmanın CTE'si (FR-015) sırayı sabitler.\n */\nexport class DeadlockDetected extends Conflict implements RetryableError {\n  public readonly retryable = true as const;\n  public readonly sqlstate: string;\n\n  static is(e: unknown): e is DeadlockDetected {\n    return (\n      typeof e === \"object\" && e !== null &&\n      (e as { name?: unknown }).name === \"DeadlockDetected\"\n    );\n  }\n\n  constructor(sqlstate = \"40P01\", message?: string, data?: unknown) {\n    super(\n      message ??\n        \"deadlock: iki işlem birbirinin kilidini bekledi ve bu işlem iptal edildi — \" +\n          \"kilit sırasını sabitlemek için Database.$lockRows(tablo, id'ler) kullanın\",\n      \"deadlock_detected\",\n      data,\n    );\n    this.name = \"DeadlockDetected\";\n    this.sqlstate = sqlstate;\n  }\n}\n\n/** A single field-level validation failure carried by {@link BadRequest}. */\nexport interface FieldError {\n  /** The offending field's name (dotted path for nested fields). */\n  field: string;\n  /** Human-readable reason the field failed. */\n  message: string;\n}\n\n/** The fixed, typed payload {@link BadRequest} ships. */\nexport interface BadRequestData {\n  /** The fields that failed validation. */\n  fields: FieldError[];\n}\n\n/** The fixed, typed payload {@link TooManyRequests} ships. */\nexport interface TooManyRequestsData {\n  /** Seconds the caller should wait before retrying. */\n  retryAfter: number;\n}\n\n/**\n * 429 — the caller has exceeded the rate limit. Carries a fixed typed payload:\n * `new TooManyRequests({ retryAfter: 30 })`. The shape is declared once in the\n * SDK (error-registry pre-seed) so codegen surfaces `error.data.retryAfter`\n * typed on the client — no per-project definition needed.\n */\nexport class TooManyRequests extends NamedHttpError {\n  public declare readonly data: TooManyRequestsData;\n  constructor(data: TooManyRequestsData, message?: string) {\n    super(429, \"too_many_requests\", \"TooManyRequests\", message, undefined, data);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBO,IAAMA,mBAAkCC,uBAAOC,IAAI,2BAAA;AAgBnD,IAAMC,gBAA+BF,uBAAOC,IAAI,8BAAA;AAGhD,SAASE,iBAAmCC,GAAI;AACpDA,IAA8BF,aAAAA,IAAiB;AAChD,SAAOE;AACT;AAHgBD;AAMT,SAASE,eAAeD,GAAU;AACvC,SAAO,OAAOA,MAAM,YAAYA,MAAM,QAASA,EAA8BF,aAAAA,MAAmB;AAClG;AAFgBG;AAYT,SAASC,YAAYC,KAAY;AACtC,MAAI,OAAOA,QAAQ,YAAYA,QAAQ,KAAM,QAAO;AACpD,QAAMH,IAAIG;AACV,SACEH,EAAEL,gBAAAA,MAAsB,QACxB,OAAOK,EAAEI,WAAW,YACpB,OAAOJ,EAAEK,UAAU,YACnB,OAAOL,EAAEM,qBAAqB;AAElC;AATgBJ;AAyBT,IAAMK,YAAN,cAAwBC,MAAAA;EA/E/B,OA+E+BA;;;EACbJ;EACAC;EACAC;EACAG;;EAEA,CAACd,gBAAAA,IAAoB;EAErC,YAAYS,QAAgBC,OAAeC,kBAA0BG,MAAgB;AACnF,UAAMH,gBAAAA;AACN,SAAKI,OAAO;AACZ,SAAKN,SAASA;AACd,SAAKC,QAAQA;AACb,SAAKC,mBAAmBA;AACxB,QAAIG,SAASE,QAAW;AACtB,WAAKF,OAAOA;IACd;EACF;;;;;;;EAQAG,OAAOC,WAML;AACA,UAAMC,SAMF;MACFT,OAAO,KAAKA;MACZU,mBAAmB,KAAKT;MACxBF,QAAQ,KAAKA;IACf;AACA,QAAIS,WAAW;AACbC,aAAOE,aAAaH;IACtB;AACA,QAAI,KAAKJ,SAASE,QAAW;AAC3BG,aAAOL,OAAO,KAAKA;IACrB;AACA,WAAOK;EACT;AACF;AASO,IAAMG,WAAN,cAAuBV,UAAAA;EA3I9B,OA2I8BA;;;EAC5B,YAAYH,QAAgBc,MAAcC,aAAqBV,MAAgB;AAC7E,UAAML,QAAQc,MAAMC,aAAaV,IAAAA;AACjC,SAAKC,OAAO;EACd;AACF;AAKA,IAAeU,iBAAf,MAAeA,wBAAuBb,UAAAA;EArJtC,OAqJsCA;;;EACpC,YACEH,QACAiB,aACAX,MACAY,SACAJ,MACAT,MACA;AACA,UAAML,QAAQc,QAAQG,aAAaC,WAAWC,eAAeb,IAAAA,GAAOD,IAAAA;AACpE,SAAKC,OAAOA;EACd;AACF;AAIA,SAASa,eAAeb,MAAY;AAClC,QAAMc,SAASd,KAAKe,QAAQ,sBAAsB,OAAA;AAClD,SAAOD,OAAOE,OAAO,CAAA,EAAGC,YAAW,IAAKH,OAAOI,MAAM,CAAA,EAAGC,YAAW;AACrE;AAHSN;AAWF,IAAMO,aAAN,cAAyBV,eAAAA;EAhLhC,OAgLgCA;;;EAE9B,YAAYX,MAAsBa,SAAkB;AAClD,UAAM,KAAK,eAAe,cAAcA,SAASX,QAAWF,IAAAA;EAC9D;AACF;AAGO,IAAMsB,eAAN,cAA2BX,eAAAA;EAxLlC,OAwLkCA;;;EAChC,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,gBAAgB,gBAAgBa,SAASJ,MAAMT,IAAAA;EAC5D;AACF;AAGO,IAAMuB,YAAN,cAAwBZ,eAAAA;EA/L/B,OA+L+BA;;;EAC7B,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,aAAa,aAAaa,SAASJ,MAAMT,IAAAA;EACtD;AACF;AAGO,IAAMwB,WAAN,cAAuBb,eAAAA;EAtM9B,OAsM8BA;;;EAC5B,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,aAAa,YAAYa,SAASJ,MAAMT,IAAAA;EACrD;AACF;AAGO,IAAMyB,WAAN,cAAuBd,eAAAA;EA7M9B,OA6M8BA;;;EAC5B,YAAYE,SAAkBJ,MAAeT,MAAgB;AAC3D,UAAM,KAAK,YAAY,YAAYa,SAASJ,MAAMT,IAAAA;EACpD;AACF;AAoCO,IAAM0B,kBAAN,cAA8BD,SAAAA;EArPrC,OAqPqCA;;;;;;;;;;;;;EAWnC,OAAOE,GAAGpC,GAAkC;AAC1C,WACE,OAAOA,MAAM,YACbA,MAAM,QACLA,EAAyBU,SAAS,qBACnC,OAAQV,EAA+BqC,eAAe;EAE1D;;;EAIgBA;EAEhB,YAAYA,YAAoBf,SAAkBJ,MAAeT,MAAgB;AAC/E,UAAMa,WAAW,8BAA8BJ,QAAQ,oBAAoBT,IAAAA;AAC3E,SAAKC,OAAO;AACZ,SAAK2B,aAAaA;EACpB;AACF;AA0BO,SAASC,YAAYtC,GAAU;AACpC,SACE,OAAOA,MAAM,YACbA,MAAM,QACLA,EAA8BuC,cAAc,QAC7C,OAAQvC,EAA6BwC,aAAa;AAEtD;AAPgBF;AAkBT,IAAMG,uBAAN,cAAmCP,SAAAA;EA9T1C,OA8T0CA;;;EACxBK,YAAY;EACZC;EAEhB,OAAOJ,GAAGpC,GAAuC;AAC/C,WACE,OAAOA,MAAM,YAAYA,MAAM,QAC9BA,EAAyBU,SAAS;EAEvC;EAEA,YAAY8B,WAAW,SAASlB,SAAkBb,MAAgB;AAChE,UACEa,WACE,kMAEF,yBACAb,IAAAA;AAEF,SAAKC,OAAO;AACZ,SAAK8B,WAAWA;EAClB;AACF;AAUO,IAAME,mBAAN,cAA+BR,SAAAA;EA9VtC,OA8VsCA;;;EACpBK,YAAY;EACZC;EAEhB,OAAOJ,GAAGpC,GAAmC;AAC3C,WACE,OAAOA,MAAM,YAAYA,MAAM,QAC9BA,EAAyBU,SAAS;EAEvC;EAEA,YAAY8B,WAAW,SAASlB,SAAkBb,MAAgB;AAChE,UACEa,WACE,8LAEF,qBACAb,IAAAA;AAEF,SAAKC,OAAO;AACZ,SAAK8B,WAAWA;EAClB;AACF;AA4BO,IAAMG,kBAAN,cAA8BvB,eAAAA;EAhZrC,OAgZqCA;;;EAEnC,YAAYX,MAA2Ba,SAAkB;AACvD,UAAM,KAAK,qBAAqB,mBAAmBA,SAASX,QAAWF,IAAAA;EACzE;AACF;","names":["HTTP_ERROR_BRAND","Symbol","for","ENGINE_RAISED","markEngineRaised","e","isEngineRaised","isHttpError","err","status","error","errorDescription","HttpError","Error","data","name","undefined","toJSON","requestId","result","error_description","request_id","PalError","code","description","NamedHttpError","defaultCode","message","defaultMessage","spaced","replace","charAt","toUpperCase","slice","toLowerCase","BadRequest","Unauthorized","Forbidden","NotFound","Conflict","UniqueViolation","is","constraint","isRetryable","retryable","sqlstate","SerializationFailure","DeadlockDetected","TooManyRequests"]}

package/dist/{chunk-YRVIWHJC.js → chunk-N54QZER3.js}

@@ -1,311 +1,12 @@
 import {
-  qualifiedTableKey,
-  withRetry
-} from "./chunk-SG4UTNOP.js";
+  CODECS
+} from "./chunk-XOX6RFPZ.js";
 import {
-  TxPlanBuilder,
-  runTxPlan
-} from "./chunk-3TUJWHC2.js";
+  qualifiedTableKey
+} from "./chunk-C4ZA5AT2.js";
 import {
   __name
-} from "./chunk-VXPNPVAG.js";
-
-// src/runtime.ts
-import { AsyncLocalStorage } from "async_hooks";
-var __requestALS = new AsyncLocalStorage();
-var runtime = null;
-function __setRuntime(services) {
-  runtime = services;
-}
-__name(__setRuntime, "__setRuntime");
-function __runWithRuntime(services, fn) {
-  return __requestALS.run({
-    runtime: services
-  }, fn);
-}
-__name(__runWithRuntime, "__runWithRuntime");
-function __getRuntime() {
-  const scoped = __requestALS.getStore();
-  if (scoped) return scoped.runtime;
-  if (runtime === null) {
-    throw new Error("Palbase services accessed outside a request scope. The Database/Documents/\u2026 singletons are only available inside an endpoint handler (or after the runtime has called __runWithRuntime / __setRuntime).");
-  }
-  return runtime;
-}
-__name(__getRuntime, "__getRuntime");
-var LIFECYCLE = /* @__PURE__ */ Symbol.for("palbase.backend.lifecycleHooks");
-function declaredLifecycle() {
-  const g = globalThis;
-  return g[LIFECYCLE] ??= {
-    start: [],
-    shutdown: []
-  };
-}
-__name(declaredLifecycle, "declaredLifecycle");
-function onStart(name, hook) {
-  declaredLifecycle().start.push({
-    name,
-    run: hook
-  });
-}
-__name(onStart, "onStart");
-function onShutdown(name, hook) {
-  declaredLifecycle().shutdown.push({
-    name,
-    run: hook
-  });
-}
-__name(onShutdown, "onShutdown");
-function reason(err) {
-  return err instanceof Error ? err.message : String(err);
-}
-__name(reason, "reason");
-async function drain(hooks) {
-  for (const h of [
-    ...hooks
-  ].reverse()) {
-    try {
-      await h.run();
-    } catch (err) {
-      console.error(`[palbase] shutdown hook "${h.name}" failed: ${reason(err)}`, err);
-    }
-  }
-}
-__name(drain, "drain");
-async function __runStartHooks() {
-  const slot3 = declaredLifecycle();
-  const start = slot3.start.splice(0);
-  const shutdown = slot3.shutdown.splice(0);
-  for (const h of start) {
-    try {
-      await h.run();
-    } catch (err) {
-      await drain(shutdown);
-      throw new Error(`[palbase] start hook "${h.name}" failed: ${reason(err)}`, {
-        cause: err
-      });
-    }
-  }
-  let drained = false;
-  return async () => {
-    if (drained) return;
-    drained = true;
-    await drain(shutdown);
-  };
-}
-__name(__runStartHooks, "__runStartHooks");
-function __resetLifecycleHooks() {
-  const g = globalThis;
-  delete g[LIFECYCLE];
-}
-__name(__resetLifecycleHooks, "__resetLifecycleHooks");
-function makeServiceProxy(key) {
-  const handler = {
-    get(_target, prop, receiver) {
-      const client = __getRuntime()[key];
-      const value = Reflect.get(client, prop, receiver);
-      return typeof value === "function" ? value.bind(client) : value;
-    }
-  };
-  return new Proxy({}, handler);
-}
-__name(makeServiceProxy, "makeServiceProxy");
-function makeTableProxy(ops, prefix) {
-  return new Proxy({}, {
-    get(_t, prop) {
-      if (typeof prop !== "string") return void 0;
-      const name = `${prefix}${prop}`;
-      return {
-        insert: /* @__PURE__ */ __name((data) => ops().insert(name, data), "insert"),
-        // DÖRDÜNCÜ FİİL, aynı gerekçeyle: tip söz veriyor, ops katmanı
-        // uyguluyor, ve bir handler'ın gerçekten dokunduğu yer BURASI.
-        // `runtime-table-verbs` kapısı bunu adıyla saydı.
-        aggregate: /* @__PURE__ */ __name((q) => ops().aggregate(name, q), "aggregate"),
-        insertMany: /* @__PURE__ */ __name((rows, opts) => ops().insertMany(name, rows, opts), "insertMany"),
-        update: /* @__PURE__ */ __name((q) => ops().update(name, q.where.id, q.set), "update"),
-        delete: /* @__PURE__ */ __name((id) => ops().delete(name, id), "delete"),
-        findById: /* @__PURE__ */ __name((id) => ops().findById(name, id), "findById"),
-        findMany: /* @__PURE__ */ __name((q) => {
-          const { where, ...opts } = q ?? {};
-          return ops().findMany(name, where, opts);
-        }, "findMany"),
-        put: /* @__PURE__ */ __name((q) => ops().put(name, q.data, {
-          onConflict: q.onConflict
-        }), "put"),
-        // THREE VERBS THE TYPE PROMISED AND THIS PROXY DID NOT EMIT.
-        //
-        // `EnvTypedTableBase` declares `updateMany`, `deleteMany` and `count`
-        // (typed-db.ts) and the ops layer implements all three — only this
-        // proxy, which is what a handler actually touches, left them out. So
-        // the type said the verb exists, autocomplete offered it, and the call
-        // answered `undefined is not a function`.
-        //
-        // Older than this run, but the run rewrote this proxy for
-        // `Database.schema(name).tables.*` and would have carried the gap onto
-        // the new surface too.
-        updateMany: /* @__PURE__ */ __name((q) => ops().updateMany(name, q.where, q.set), "updateMany"),
-        deleteMany: /* @__PURE__ */ __name((q) => ops().deleteMany(name, q.where), "deleteMany"),
-        count: /* @__PURE__ */ __name((q) => ops().count(name, q?.where), "count"),
-        search: /* @__PURE__ */ __name((params) => ops().search(name, params), "search"),
-        similar: /* @__PURE__ */ __name((id, params) => ops().similar(name, id, params), "similar"),
-        recommend: /* @__PURE__ */ __name((params) => ops().recommend(name, params), "recommend"),
-        facets: /* @__PURE__ */ __name((params) => ops().facets(name, params), "facets"),
-        supersede: /* @__PURE__ */ __name((id, row) => ops().supersede(name, id, row), "supersede"),
-        claim: /* @__PURE__ */ __name((unique, extra) => ops().claim(name, unique, extra), "claim")
-      };
-    }
-  });
-}
-__name(makeTableProxy, "makeTableProxy");
-var rawDatabase = makeServiceProxy("Database");
-function makeTypedSurface(raw) {
-  const reco = raw;
-  const ops = {
-    $query: /* @__PURE__ */ __name((sql, params) => raw.query(sql, params), "$query"),
-    $insert: /* @__PURE__ */ __name((table, data) => raw.insert(table, data), "$insert"),
-    $update: /* @__PURE__ */ __name((table, id, data) => raw.update(table, id, data), "$update"),
-    $delete: /* @__PURE__ */ __name((table, id) => raw.delete(table, id), "$delete"),
-    $findById: /* @__PURE__ */ __name((table, id) => raw.findById(table, id), "$findById"),
-    $findMany: /* @__PURE__ */ __name((table, query, opts) => raw.findMany(table, query, opts), "$findMany"),
-    $put: /* @__PURE__ */ __name((table, data, opts) => raw.put(table, data, opts), "$put"),
-    $updateMany: /* @__PURE__ */ __name((table, where, set) => raw.updateMany(table, where, set), "$updateMany"),
-    $deleteMany: /* @__PURE__ */ __name((table, where) => raw.deleteMany(table, where), "$deleteMany"),
-    $count: /* @__PURE__ */ __name((table, where) => raw.count(table, where), "$count"),
-    $search: /* @__PURE__ */ __name((table, params) => raw.search(table, params), "$search"),
-    $similar: /* @__PURE__ */ __name((table, id, params) => reco.similar(table, id, params), "$similar"),
-    $recommend: /* @__PURE__ */ __name((table, params) => reco.recommend(table, params), "$recommend"),
-    $facets: /* @__PURE__ */ __name((table, params) => reco.facets(table, params), "$facets"),
-    $claim: /* @__PURE__ */ __name((table, unique, extra) => reco.claim(table, unique, extra), "$claim"),
-    $lockRows: /* @__PURE__ */ __name((table, ids) => reco.lockRows(table, ids), "$lockRows"),
-    $advisoryXactLock: /* @__PURE__ */ __name((key) => reco.advisoryXactLock(key), "$advisoryXactLock"),
-    $aggregate: /* @__PURE__ */ __name((table, q) => raw.aggregate(table, q), "$aggregate"),
-    $insertMany: /* @__PURE__ */ __name((table, rows, opts) => raw.insertMany(table, rows, opts), "$insertMany"),
-    $supersede: /* @__PURE__ */ __name((table, id, row) => raw.supersede(table, id, row), "$supersede")
-  };
-  const base = Object.assign(ops, {
-    // Both surfaces get it: a savepoint on the service transaction is as useful
-    // as one on the request's, and each is bound to its own connection.
-    $attempt: /* @__PURE__ */ __name((fn) => raw.attempt(fn), "$attempt"),
-    $transaction(fn, opts) {
-      return withRetry(() => {
-        const builder = new TxPlanBuilder();
-        return runTxPlan(raw, makeTxPlanHandle(builder), builder, fn);
-      }, opts ?? {});
-    }
-  });
-  return new Proxy(base, {
-    get(target, prop, receiver) {
-      if (prop === "tables") return makeTableProxy(() => reco, "");
-      if (typeof prop === "string" && !prop.startsWith("$") && !(prop in target)) {
-        return makeTableProxy(() => reco, qualifiedTableKey(prop, ""));
-      }
-      return Reflect.get(target, prop, receiver);
-    }
-  });
-}
-__name(makeTypedSurface, "makeTypedSurface");
-function makeTxTablesAccessor(builder, prefix = "") {
-  const tablesProxy = new Proxy({}, {
-    get(_t, prop) {
-      if (typeof prop !== "string") return void 0;
-      return builder.table(prefix + prop);
-    }
-  });
-  return tablesProxy;
-}
-__name(makeTxTablesAccessor, "makeTxTablesAccessor");
-function makeTxPlanHandle(builder) {
-  const publicTables = makeTxTablesAccessor(builder);
-  return new Proxy({}, {
-    get(_t, prop) {
-      if (typeof prop !== "string") return void 0;
-      if (prop === "tables") return publicTables;
-      return makeTxTablesAccessor(builder, qualifiedTableKey(prop, ""));
-    }
-  });
-}
-__name(makeTxPlanHandle, "makeTxPlanHandle");
-var Database = Object.assign(makeTypedSurface(rawDatabase), {
-  /**
-  * Lazily resolve the runtime's service-role sibling on each call. We do NOT
-  * cache it: `rawDatabase.asService()` reads the CURRENT request scope through
-  * the runtime proxy, and the per-request runtime injects a service client
-  * bound to that request's identity headers — caching would leak one request's
-  * sibling into another concurrent request.
-  */
-  $asService() {
-    return makeTypedSurface(rawDatabase.asService());
-  }
-});
-var Documents = makeServiceProxy("Documents");
-function makeBucketsAccessor(storage) {
-  return new Proxy({}, {
-    get(_t, prop) {
-      if (typeof prop !== "string") return void 0;
-      return storage().bucket(prop);
-    }
-  });
-}
-__name(makeBucketsAccessor, "makeBucketsAccessor");
-var rawStorage = makeServiceProxy("Storage");
-var Storage = Object.assign({
-  // FORWARDED explicitly, not assigned onto the service proxy.
-  //
-  // `Object.assign(rawStorage, {buckets})` writes onto the proxy's TARGET, and
-  // the proxy's only trap is `get`, which forwards every read to the module
-  // client — so the property landed somewhere nothing reads and
-  // `Storage.buckets.docs` was `undefined` in a deployed handler. It
-  // typechecked, every test passed, and the live call answered
-  // "TypeError: undefined is not an object". `Database` never had the bug
-  // because it builds a plain surface the same way this now does.
-  bucket: /* @__PURE__ */ __name((name) => rawStorage.bucket(name), "bucket")
-}, {
-  buckets: makeBucketsAccessor(() => rawStorage)
-});
-var Cache = makeServiceProxy("Cache");
-var Secrets = makeServiceProxy("Secrets");
-var Auth = makeServiceProxy("Auth");
-var Log = makeServiceProxy("Log");
-var Notifications = makeServiceProxy("Notifications");
-var rawFlags = makeServiceProxy("Flags");
-var Flags = Object.assign({
-  isEnabled(flagName, context) {
-    return rawFlags.isEnabled(flagName, context);
-  },
-  getVariant(flagName, context) {
-    return rawFlags.getVariant(flagName, context);
-  },
-  getAll(context) {
-    return rawFlags.getAll(context);
-  },
-  /**
-   * Resolve a flag's value, with an optional fallback.
-   *
-   * FORWARDED as of 2026-08-15. This surface is written out by hand, method
-   * by method, and `get` was missing from it — so the client implemented it,
-   * thirty assertions covered it, and `Flags.get("x")` was `undefined` in a
-   * deployed handler. Exactly the shape of the `Storage.buckets` defect found
-   * the same day: a hand-maintained forwarding list is a list somebody has to
-   * remember to update.
-   */
-  get(flagName, defaultOrContext, maybeContext) {
-    return rawFlags.get(flagName, defaultOrContext, maybeContext);
-  },
-  setOverride(key, value) {
-    return rawFlags.setOverride(key, value);
-  }
-}, {
-  /**
-   * Lazily resolve the runtime's cross-user sibling on each call. We do NOT
-   * cache it: `rawFlags.asService()` reads the CURRENT request scope through
-   * the runtime proxy, so caching would leak one request's sibling into
-   * another concurrent request. Mirrors `Database.asService()`.
-   */
-  asService() {
-    return rawFlags.asService();
-  }
-});
-var Realtime = makeServiceProxy("Realtime");
+} from "./chunk-KATPXCJ5.js";
 
 // src/refusals.ts
 var DECLARATION_REFUSAL = /* @__PURE__ */ Symbol.for("palbase.backend.declarationRefusal");
@@ -327,6 +28,9 @@ __name(isDeclarationRefused, "isDeclarationRefused");
 
 // src/db/env-gen.ts
 function baseTsType(def) {
+  if (def.codec !== void 0 && def.codec in CODECS) {
+    return CODECS[def.codec].tsType;
+  }
   switch (def.type) {
     case "uuid":
     case "text":
@@ -504,7 +208,21 @@ function tableBlock(table, relations, indent) {
   ].join("\n");
 }
 __name(tableBlock, "tableBlock");
+function refuseFreeFormTransforms(schemas) {
+  for (const schema of schemas) {
+    for (const table of Object.values(schema.tables)) {
+      for (const [col, builder] of Object.entries(table.columns)) {
+        const def = builder._def;
+        if (def.transform === void 0 || def.codec !== void 0) continue;
+        const where = qualifiedTableKey(schema.name, table.name);
+        throw new DeclarationRefused(`table "${where}" column "${col}" declares .transform<T>(): its target type does not exist at runtime, so the generated types would say something the engine contradicts. Declare a named codec instead \u2014 .asNumber() for a JS number, .asDecimal() for the exact string.`);
+      }
+    }
+  }
+}
+__name(refuseFreeFormTransforms, "refuseFreeFormTransforms");
 function makeEnvDts(schemas) {
+  refuseFreeFormTransforms(schemas);
   const relations = buildRelations(schemas);
   const publicSchema = schemas.find((s) => s.name === "public");
   const others = schemas.filter((s) => s.name !== "public");
@@ -961,24 +679,6 @@ function assertNoOrphanEntryPoints(registered, owned2) {
 __name(assertNoOrphanEntryPoints, "assertNoOrphanEntryPoints");
 
 export {
-  __requestALS,
-  __setRuntime,
-  __runWithRuntime,
-  __getRuntime,
-  onStart,
-  onShutdown,
-  __runStartHooks,
-  __resetLifecycleHooks,
-  Database,
-  Documents,
-  Storage,
-  Cache,
-  Secrets,
-  Auth,
-  Log,
-  Notifications,
-  Flags,
-  Realtime,
   DECLARATION_REFUSAL,
   DeclarationRefused,
   isDeclarationRefused,
@@ -997,4 +697,4 @@ export {
   buildContainer,
   assertNoOrphanEntryPoints
 };
-//# sourceMappingURL=chunk-YRVIWHJC.js.map
+//# sourceMappingURL=chunk-N54QZER3.js.map