@palbase/backend 34.0.0 → 34.1.1

package/dist/engine/index.d.cts

@@ -1,8 +1,8 @@
-import '../endpoint-kYgEHrrV.cjs';
-export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-pnDsEfxJ.cjs';
+import '../endpoint-DqhUP7RT.cjs';
+export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-Co0Hj_aO.cjs';
 import 'zod';
 import '../stack.cjs';
 import '../db/env.cjs';
 import 'node:async_hooks';
 import '../module-Dl1KFVtc.cjs';
-import '../registry-BcOd8Zhf.cjs';
+import '../registry-BkIVHPzB.cjs';

package/dist/engine/index.d.ts

@@ -1,8 +1,8 @@
-import '../endpoint-DpNUx-ON.js';
-export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-JrHqNsjQ.js';
+import '../endpoint-BXPdsTA5.js';
+export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-MhCL7ll4.js';
 import 'zod';
 import '../stack.js';
 import '../db/env.js';
 import 'node:async_hooks';
 import '../module-Dl1KFVtc.js';
-import '../registry-BoX5iNyY.js';
+import '../registry-CvGLR5j1.js';

package/dist/engine/index.js

@@ -20,16 +20,16 @@ import {
   setCursorKey,
   withQueryCancellation,
   withTables
-} from "../chunk-MNGZE2MM.js";
+} from "../chunk-XZPDPYVY.js";
 import {
   DECLARATION_REFUSAL,
   DeclarationRefused,
   isDeclarationRefused
-} from "../chunk-YX7UA7VC.js";
+} from "../chunk-X2UYIXDS.js";
 import "../chunk-GHNC2UHS.js";
-import "../chunk-LOGL2ZHD.js";
+import "../chunk-YO5GYM73.js";
 import "../chunk-PRH45NZU.js";
-import "../chunk-FOWA7PF4.js";
+import "../chunk-P7MGSAFT.js";
 import "../chunk-JJW3L62T.js";
 import "../chunk-UMESJJRS.js";
 import "../chunk-VXPNPVAG.js";

package/dist/{index-pnDsEfxJ.d.cts → index-Co0Hj_aO.d.cts}

@@ -1,6 +1,6 @@
-import { c as DatabaseDiagnosticsOptions, d as DatabaseDiagnostics, a as DBClient, T as TransactionIsolation, e as DBOps, P as PreparedRead, C as CompiledRead, f as RawPageOptions, g as Page, h as TxPlanBody, i as CommandOptions, j as TxPlanResponse, A as AuthSpec, k as CacheClient, b as RuntimeServices, _ as __runWithRuntime, l as __requestALS } from './endpoint-kYgEHrrV.cjs';
+import { c as DatabaseDiagnosticsOptions, d as DatabaseDiagnostics, a as DBClient, T as TransactionIsolation, e as DBOps, P as PreparedRead, C as CompiledRead, f as RawPageOptions, g as Page, h as TxPlanBody, i as CommandOptions, j as TxPlanResponse, A as AuthSpec, k as CacheClient, b as RuntimeServices, _ as __runWithRuntime, l as __requestALS } from './endpoint-DqhUP7RT.cjs';
 import { T as Token } from './module-Dl1KFVtc.cjs';
-import { R as RouteMeta } from './registry-BcOd8Zhf.cjs';
+import { R as RouteMeta } from './registry-BkIVHPzB.cjs';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses

package/dist/{index-JrHqNsjQ.d.ts → index-MhCL7ll4.d.ts}

@@ -1,6 +1,6 @@
-import { c as DatabaseDiagnosticsOptions, d as DatabaseDiagnostics, a as DBClient, T as TransactionIsolation, e as DBOps, P as PreparedRead, C as CompiledRead, f as RawPageOptions, g as Page, h as TxPlanBody, i as CommandOptions, j as TxPlanResponse, A as AuthSpec, k as CacheClient, b as RuntimeServices, _ as __runWithRuntime, l as __requestALS } from './endpoint-DpNUx-ON.js';
+import { c as DatabaseDiagnosticsOptions, d as DatabaseDiagnostics, a as DBClient, T as TransactionIsolation, e as DBOps, P as PreparedRead, C as CompiledRead, f as RawPageOptions, g as Page, h as TxPlanBody, i as CommandOptions, j as TxPlanResponse, A as AuthSpec, k as CacheClient, b as RuntimeServices, _ as __runWithRuntime, l as __requestALS } from './endpoint-BXPdsTA5.js';
 import { T as Token } from './module-Dl1KFVtc.js';
-import { R as RouteMeta } from './registry-BoX5iNyY.js';
+import { R as RouteMeta } from './registry-CvGLR5j1.js';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses

package/dist/index.cjs

@@ -108,6 +108,7 @@ __export(src_exports, {
   boolean: () => boolean,
   buildContainer: () => buildContainer,
   buildModuleClients: () => buildModuleClients,
+  can: () => can,
   col: () => col,
   controllersOf: () => controllersOf,
   dec: () => dec,
@@ -169,7 +170,7 @@ __export(src_exports, {
   vector: () => vector,
   webhooksOf: () => webhooksOf,
   withRetry: () => withRetry,
-  z: () => import_zod3.z
+  z: () => import_zod4.z
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -975,6 +976,11 @@ function tableToJSON(table, schemaName) {
     // drifts — the direction it drifted last time was "expose everything", and
     // the live proof was one user reading another's rows.
     rls: table.rls,
+    // KOŞAN SÜRÜMÜN SÖZÜ TELE ÇIKAR — yoksa daralma kapısı onu göremez.
+    // `ColumnJSON.ignored` ile aynı sözleşme: işaretlenmemişse alan YOK.
+    ...table.ignored === true ? {
+      ignored: true
+    } : {},
     policies: (table.policies ?? []).map(policyToJSON)
   };
   if (table.primaryKey !== void 0 && table.primaryKey.length > 0) {
@@ -2585,6 +2591,7 @@ function buildModuleClients(cfg) {
 __name(buildModuleClients, "buildModuleClients");
 
 // src/db/policy.ts
+var import_zod = require("zod");
 var PolicyExprRef = class _PolicyExprRef {
   static {
     __name(this, "PolicyExprRef");
@@ -2817,6 +2824,45 @@ function policy(name) {
   return new PolicyBuilder(name);
 }
 __name(policy, "policy");
+function can(table) {
+  const def = table;
+  if (typeof def.name !== "string" || def.columns === null || typeof def.columns !== "object" || !Array.isArray(def.policies)) {
+    throw new Error("can(<table>): expects the schema's table definition \u2014 can(publicSchema.tables.notes) \u2014 not the defineTable handle (`notes`)");
+  }
+  if (Object.prototype.hasOwnProperty.call(table.columns, "can")) {
+    throw new Error(`can(${table.name}): the table declares a column named "can", so the row carries that column and no policy echo \u2014 rename the column to get can`);
+  }
+  const rel = reservedCanRelation(table.name, table.columns);
+  if (rel !== null) {
+    throw new Error(`can(${table.name}): ${rel}`);
+  }
+  const names = table.policies.filter((p) => p.command === "update" && p.permissive !== false && Buffer.byteLength(`can:${p.name}`, "utf8") <= 63).map((p) => p.name);
+  if (names.length === 0) {
+    const all = table.policies.filter((p) => p.command === "all").map((p) => p.name);
+    const hint = all.length > 0 ? ` The table's ${all.map((n) => `"${n}"`).join(", ")} ${all.length === 1 ? "policy is" : "policies are"} for("all") \u2014 for("all") governs UPDATE but is not a named update policy and never appears in can.` : "";
+    throw new Error(`can(${table.name}): the table declares no update policy \u2014 there is nothing a row could echo. Name one with policy("<name>").for("update").using(\u2026) first.${hint}`);
+  }
+  return import_zod.z.array(import_zod.z.enum(names));
+}
+__name(can, "can");
+function reservedCanRelation(tableName, columns) {
+  if (tableName === "can") {
+    return `a table named "can" would put a relation named "can" on every parent it references \u2014 rename the table`;
+  }
+  for (const [col2, b] of Object.entries(columns)) {
+    const def = b._def;
+    if (def.referencesThunk === void 0 && def.selfRefColumn === void 0) continue;
+    if (def.reverseAs === "can") {
+      return `column "${col2}" names its reverse relation "can" \u2014 the parent's rows would carry a relation where can is reserved; pick another reverseAs`;
+    }
+    const forward = def.owns === true ? "owner" : def.refAs ?? (col2.endsWith("_id") ? col2.slice(0, -3) : col2);
+    if (forward === "can") {
+      return `column "${col2}" would be read as a relation named "can" (${def.refAs === void 0 ? "derived from the column name" : "its as: option"}) \u2014 can is reserved for the policy echo; rename it`;
+    }
+  }
+  return null;
+}
+__name(reservedCanRelation, "reservedCanRelation");
 
 // src/db/schema.ts
 var IndexBuilder = class {
@@ -2894,6 +2940,10 @@ function defineTable(name, input) {
   if (name.trim() === "") {
     throw new Error("defineTable(name, \u2026): name must not be empty");
   }
+  {
+    const reserved = reservedCanRelation(name, input.columns);
+    if (reserved !== null) throw new Error(`defineTable(${JSON.stringify(name)}): ${reserved}`);
+  }
   const policies = (input.policies?.(exprCtx(Object.keys(input.columns), 0, name)) ?? []).map(toPolicyDef);
   const rls = policies.length > 0 || input.rls !== false;
   const owned2 = {};
@@ -2922,6 +2972,7 @@ function defineTable(name, input) {
   const declaredIndexes = (input.indexes?.(exprCtx(Object.keys(input.columns), 0, name)) ?? []).map((i) => i instanceof IndexBuilder ? i._def : i);
   if (declaredIndexes.length > 0) def.indexes = declaredIndexes;
   if (input.appendOnly === true) def.appendOnly = true;
+  if (input.ignored === true) def.ignored = true;
   if (input.search !== void 0) {
     const s = input.search;
     if (s.from !== void 0) {
@@ -4078,6 +4129,9 @@ function tableBlock(table, relations, indent) {
   const rowLines = cols.map(([col2, builder]) => {
     return `${indent}    ${col2}: ${rowType(builder._def)};`;
   });
+  const hasCanColumn = Object.prototype.hasOwnProperty.call(table.columns, "can") || relations.some((r) => r.name === "can");
+  const canNames = (table.policies ?? []).filter((p) => p.command === "update" && p.permissive !== false && Buffer.byteLength(`can:${p.name}`, "utf8") <= 63).map((p) => JSON.stringify(p.name));
+  const canLine = hasCanColumn ? null : `${indent}    can: ${canNames.length === 0 ? "never[]" : `(${canNames.join(" | ")})[]`};`;
   const insertLines = cols.map(([col2, builder]) => {
     const def = builder._def;
     const opt = optionalOnInsert(def) ? "?" : "";
@@ -4088,6 +4142,9 @@ function tableBlock(table, relations, indent) {
     `${indent}${table.name}: {`,
     `${indent}  row: {`,
     ...rowLines,
+    ...canLine === null ? [] : [
+      canLine
+    ],
     `${indent}  };`,
     `${indent}  insert: {`,
     ...insertLines,
@@ -4910,18 +4967,18 @@ __name(defineMiddleware, "defineMiddleware");
 
 // src/error-registry.ts
 var import_zod_to_openapi = require("@asteasolutions/zod-to-openapi");
-var import_zod = require("zod");
-(0, import_zod_to_openapi.extendZodWithOpenApi)(import_zod.z);
+var import_zod2 = require("zod");
+(0, import_zod_to_openapi.extendZodWithOpenApi)(import_zod2.z);
 var ERROR_REGISTRY = /* @__PURE__ */ Symbol.for("palbase.backend.errorRegistry");
 var BUILTIN_DATA_SCHEMAS = {
-  bad_request: import_zod.z.object({
-    fields: import_zod.z.array(import_zod.z.object({
-      field: import_zod.z.string(),
-      message: import_zod.z.string()
+  bad_request: import_zod2.z.object({
+    fields: import_zod2.z.array(import_zod2.z.object({
+      field: import_zod2.z.string(),
+      message: import_zod2.z.string()
     }))
   }),
-  too_many_requests: import_zod.z.object({
-    retryAfter: import_zod.z.number().int()
+  too_many_requests: import_zod2.z.object({
+    retryAfter: import_zod2.z.number().int()
   })
 };
 function getErrorRegistry() {
@@ -5038,7 +5095,7 @@ __name(defineError, "defineError");
 function digestOf(code, dataSchema) {
   const TMP_REF = "__PalbaseErrorDataDigest";
   const tmpRegistry = new import_zod_to_openapi.OpenAPIRegistry();
-  tmpRegistry.register(TMP_REF, import_zod.z.object({
+  tmpRegistry.register(TMP_REF, import_zod2.z.object({
     data: dataSchema
   }).openapi(TMP_REF));
   const generated = new import_zod_to_openapi.OpenApiGeneratorV31(tmpRegistry.definitions).generateComponents();
@@ -5632,10 +5689,10 @@ function getJobConfig(ctor, container) {
 __name(getJobConfig, "getJobConfig");
 
 // src/index.ts
-var import_zod3 = require("zod");
+var import_zod4 = require("zod");
 
 // src/db/query.ts
-var import_zod2 = require("zod");
+var import_zod3 = require("zod");
 var import_zod_to_openapi2 = require("@asteasolutions/zod-to-openapi");
 
 // src/db/query-contract.ts
@@ -5668,27 +5725,27 @@ function stableContract(value) {
 __name(stableContract, "stableContract");
 
 // src/db/query.ts
-(0, import_zod_to_openapi2.extendZodWithOpenApi)(import_zod2.z);
+(0, import_zod_to_openapi2.extendZodWithOpenApi)(import_zod3.z);
 function responseColumn(column, validator) {
   const contract = queryColumnContract(column);
   let schema;
   if (validator) return validator;
-  if (contract.codec === "number") schema = import_zod2.z.number().finite();
-  else if (contract.codec === "decimal") schema = import_zod2.z.string();
+  if (contract.codec === "number") schema = import_zod3.z.number().finite();
+  else if (contract.codec === "decimal") schema = import_zod3.z.string();
   else switch (contract.type) {
     case "integer":
-      schema = import_zod2.z.number().int().min(-2147483648).max(2147483647);
+      schema = import_zod3.z.number().int().min(-2147483648).max(2147483647);
       break;
     case "boolean":
-      schema = import_zod2.z.boolean();
+      schema = import_zod3.z.boolean();
       break;
     case "vector":
-      schema = import_zod2.z.array(import_zod2.z.number().finite());
+      schema = import_zod3.z.array(import_zod3.z.number().finite());
       break;
     case "enum": {
       const values = contract.enumValues;
       if (!values?.length) throw new Error("Query response requires declared enum values");
-      schema = import_zod2.z.enum(values);
+      schema = import_zod3.z.enum(values);
       break;
     }
     case "uuid":
@@ -5696,7 +5753,7 @@ function responseColumn(column, validator) {
     case "timestamp":
     case "numeric":
     case "bigint":
-      schema = import_zod2.z.string();
+      schema = import_zod3.z.string();
       break;
     case "jsonb":
       throw new Error("Query response requires a fields validator for a selected jsonb column: its TypeScript payload is erased at runtime");
@@ -5719,7 +5776,7 @@ function defineQuery(name, options) {
     columns[key] = queryColumnContract(options.table[key]);
     shape[key] = responseColumn(options.table[key], options.fields?.[key]);
   }
-  const response = import_zod2.z.array(import_zod2.z.object(shape).strict());
+  const response = import_zod3.z.array(import_zod3.z.object(shape).strict());
   const queryInput = options.input, where = options.where, limit = options.limit;
   const orderBy = options.orderBy === void 0 ? void 0 : JSON.parse(JSON.stringify(options.orderBy));
   const prepare = /* @__PURE__ */ __name((input) => {
@@ -5903,6 +5960,7 @@ __name(assertQueryManifest, "assertQueryManifest");
   boolean,
   buildContainer,
   buildModuleClients,
+  can,
   col,
   controllersOf,
   dec,