@somewhere-tech/cli 0.31.23 → 0.32.0

package/runtime/declared-data.cjs

@@ -0,0 +1,1571 @@
+// Generated by scripts/vendor-declared-data.mjs; edit the platform source.
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __commonJS = (cb, mod) => function __require() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// worker/containers/compile/declared-data-contract.cjs
+var require_declared_data_contract = __commonJS({
+  "worker/containers/compile/declared-data-contract.cjs"(exports2, module2) {
+    "use strict";
+    var identifier = /^[a-z_][a-z0-9_]*$/;
+    var types = /* @__PURE__ */ new Set(["integer", "number", "text", "boolean", "timestamp", "json", "blob"]);
+    function fail(detail) {
+      throw new Error(`Invalid declared data contract: ${detail}`);
+    }
+    function record(value, name) {
+      if (!value || typeof value !== "object" || Array.isArray(value)) fail(name);
+    }
+    function fields(value, columns, name, empty = false) {
+      if (!Array.isArray(value) || !empty && !value.length) fail(name);
+      const result = [...value];
+      if (result.some((field) => typeof field !== "string" || !columns.has(field)) || new Set(result).size !== result.length) fail(name);
+      return result.sort();
+    }
+    function canonicalize2(schema, intents, scopes) {
+      record(schema, "schema");
+      record(intents, "intents");
+      record(scopes, "scopes");
+      const tables = [];
+      const membershipTables = new Set(Object.values(schema).filter((table) => table && table.member).map((table) => table.member.m));
+      for (const name of Object.keys(schema).sort()) {
+        const table = schema[name];
+        record(table, `table ${name}`);
+        if (table.client === void 0) {
+          if (table.clientPrimaryKey !== void 0) fail(`${name} has a primary key without client permissions`);
+          continue;
+        }
+        if (!identifier.test(name) || name.startsWith("_") || name.startsWith("sqlite_")) fail(`table ${name}`);
+        record(table.client, `${name}.client`);
+        if (!Array.isArray(table.columns) || !table.columns.length) fail(`${name}.columns`);
+        const seen = /* @__PURE__ */ new Set();
+        const columns = table.columns.map((column) => {
+          record(column, `${name}.column`);
+          if (typeof column.n !== "string" || !identifier.test(column.n) || seen.has(column.n) || !types.has(column.t)) fail(`${name}.column`);
+          if (column.nul !== void 0 && column.nul !== 1 || column.d !== void 0 && column.d !== 1) fail(`${name}.${column.n} flags`);
+          seen.add(column.n);
+          return { n: column.n, t: column.t, ...column.nul ? { nul: 1 } : {}, ...column.d ? { d: 1 } : {} };
+        }).sort((a, b) => a.n < b.n ? -1 : a.n > b.n ? 1 : 0);
+        const pk = table.clientPrimaryKey;
+        if (!seen.has(pk) || !["integer", "text"].includes(columns.find((column) => column.n === pk).t)) fail(`${name} primary key`);
+        const input = table.client;
+        if (Object.keys(input).some((key) => !["read", "publicRead", "create", "update", "delete", "identity"].includes(key))) fail(`${name} permissions`);
+        const read = typeof input.read === "boolean" ? input.read : fields(input.read, seen, `${name}.read`);
+        if (Array.isArray(read) && !read.includes(pk)) fail(`${name}.read must include the primary key`);
+        if (typeof input.publicRead !== "boolean" || typeof input.delete !== "boolean" || !["authenticated", "visitor"].includes(input.identity)) fail(`${name} permissions`);
+        const create = input.create === null ? null : fields(input.create, seen, `${name}.create`, true);
+        const update = input.update === null ? null : fields(input.update, seen, `${name}.update`);
+        if (membershipTables.has(name) && (create !== null || update !== null || input.delete)) fail(`${name} membership authority writes`);
+        if ([...create || [], ...update || []].some((field) => columns.find((column) => column.n === field).t === "blob")) fail(`${name} blob browser writes require a server function`);
+        const intent = intents[name];
+        if (!["scoped", "shared", "member"].includes(intent)) fail(`${name} intent`);
+        const owner = intent === "scoped" ? scopes[name] : null;
+        if (intent === "scoped" && (typeof owner !== "string" || !identifier.test(owner))) fail(`${name} owner`);
+        if (table.visitors !== void 0 && table.visitors !== true) fail(`${name} visitors`);
+        const visitors = table.visitors === true;
+        if (visitors && intent !== "scoped") fail(`${name} visitors require ownership`);
+        if (input.identity !== (visitors ? "visitor" : "authenticated")) fail(`${name} identity must match visitor declaration`);
+        const author = intent === "shared" ? table.author : null;
+        if (intent === "shared" && (author !== "_sw_author_id" || !columns.some((column) => column.n === author && column.t === "text" && column.nul === 1))) fail(`${name} author`);
+        if (Array.isArray(read) && read.includes(author)) fail(`${name} internal author projection`);
+        if (input.identity === "visitor" && intent !== "scoped") fail(`${name} visitor identity`);
+        if (input.publicRead && !Array.isArray(read)) fail(`${name} public read`);
+        if ([...create || [], ...update || []].some((field) => field === pk || field === owner || field === author)) fail(`${name} identity writes`);
+        let member = null;
+        if (intent === "member") {
+          record(table.member, `${name}.member`);
+          const { g, m, u, mg } = table.member;
+          if (typeof m !== "string" || typeof u !== "string" || !identifier.test(m) || !identifier.test(u) || !Array.isArray(mg) || mg.some((field) => typeof field !== "string" || !identifier.test(field))) fail(`${name}.member`);
+          fields(g, seen, `${name}.member.g`);
+          if (g.length !== mg.length || new Set(mg).size !== mg.length) fail(`${name}.member`);
+          if ((update || []).some((field) => g.includes(field))) fail(`${name} membership writes`);
+          member = { g: [...g], m, u, mg: [...mg] };
+        }
+        tables.push({ name, columns, client: { identity: input.identity, read, publicRead: input.publicRead, create, update, delete: input.delete }, primaryKey: pk, intent, owner, author, visitors, member });
+      }
+      return JSON.stringify({ version: 1, tables });
+    }
+    function columnType(column) {
+      const type = { integer: "number | string", number: "number", text: "string", timestamp: "string", boolean: "boolean", json: "Json", blob: "number[]" }[column.t];
+      return column.nul ? `${type} | null` : type;
+    }
+    function shape(columns, names, mode) {
+      const values = names.map((name) => {
+        const column = columns.find((candidate) => candidate.n === name);
+        const optional = mode === "update" || mode === "create" && (column.d || column.nul);
+        return `${JSON.stringify(name)}${optional ? "?" : ""}: ${columnType(column)}`;
+      });
+      return values.length ? `{ ${values.join("; ")} }` : "Record<string, never>";
+    }
+    function describeDataClient2(authority, contract_digest) {
+      const canonical = authority ? canonicalize2(authority.schema, authority.intents, authority.scopes) : canonicalize2({}, {}, {});
+      const { tables } = JSON.parse(canonical);
+      const declarations = [];
+      const runtimeTables = [];
+      for (const table of tables) {
+        const { name, columns, client, primaryKey } = table;
+        const readable = client.read === true ? columns.filter((column) => column.n !== table.author).map((column) => column.n) : client.read || [];
+        const row = shape(columns, readable, "read");
+        const id = columnType(columns.find((column) => column.n === primaryKey));
+        const operations = [];
+        const methods = [];
+        if (client.read !== false) {
+          const equality = readable.filter((field) => !["json", "blob"].includes(columns.find((column) => column.n === field).t));
+          operations.push(`list(options?: { limit?: number; after?: ${id}; where?: ${shape(columns, equality, "update")} }): Promise<{ data: ${row}[]; next: ${id} | null; has_more: boolean }>`);
+          operations.push(`get(id: ${id}): Promise<{ data: ${row} | null }>`);
+          methods.push("list", "get");
+        }
+        const mutation = client.read === false ? "{ count: number; changes: number }" : `{ data: ${row} | null; count: number; changes: number }`;
+        if (client.create !== null) {
+          operations.push(`create(values: ${shape(columns, client.create, "create")}): Promise<${mutation}>`);
+          methods.push("create");
+        }
+        if (client.update !== null) {
+          operations.push(`update(id: ${id}, values: ${shape(columns, client.update, "update")}): Promise<${mutation}>`);
+          methods.push("update");
+        }
+        if (client.delete) {
+          operations.push(`delete(id: ${id}): Promise<${mutation}>`);
+          methods.push("delete");
+        }
+        declarations.push(`${JSON.stringify(name)}: { ${operations.join("; ")} }`);
+        runtimeTables.push([name, methods]);
+      }
+      const declaration = `declare module ${JSON.stringify("somewhere:data")} {
+  export type Json = string | number | boolean | null | Json[] | { [key: string]: Json };
+  export class DataError extends Error { readonly status: number; readonly code: string | null; constructor(status: number, payload: unknown); }
+  export const data: { ${declarations.join(";\n    ")} };
+}
+`;
+      const runtime = `const contract=${JSON.stringify(contract_digest)};
+class DataError extends Error{constructor(status,payload){super(payload&&typeof payload.message==="string"?payload.message:payload&&typeof payload.error==="string"?payload.error:"Data operation failed");this.name="DataError";this.status=status;this.code=payload&&typeof payload.error==="string"?payload.error:null}}
+const invoke=async(table,operation,input)=>{const response=await fetch("/__sw/data",{method:"POST",credentials:"same-origin",headers:{"Content-Type":"application/json"},body:JSON.stringify({...input,contract,table,operation})});const payload=await response.json().catch(()=>{throw new DataError(response.status,{error:"INVALID_DATA_RESPONSE",message:"Data operation returned an invalid response"})});if(!response.ok)throw new DataError(response.status,payload);return payload};
+const data=Object.freeze(Object.fromEntries(${JSON.stringify(runtimeTables)}.map(([table,operations])=>[table,Object.freeze(Object.fromEntries(operations.map(operation=>[operation,operation==="list"?(options={})=>invoke(table,operation,options):operation==="create"?values=>invoke(table,operation,{values}):operation==="update"?(id,values)=>invoke(table,operation,{id,values}):id=>invoke(table,operation,{id})])))])));
+export{data,DataError};
+`;
+      return { contract_digest, declaration, runtime, manifest: { version: 1, contract_digest, tables, declaration } };
+    }
+    module2.exports = { canonicalize: canonicalize2, describeDataClient: describeDataClient2 };
+  }
+});
+
+// worker/containers/compile/typed-data.cjs
+var require_typed_data = __commonJS({
+  "worker/containers/compile/typed-data.cjs"(exports2, module2) {
+    "use strict";
+    var crypto2 = require("node:crypto");
+    var { canonicalize: canonicalize2, describeDataClient: describeDataClient2 } = require_declared_data_contract();
+    var MODULE_NAME = "somewhere:data";
+    var CLIENT_FILE = "__somewhere_data.d.ts";
+    var MANIFEST_PATH = "_internal/declared-data.json";
+    function generateDataClient2(authority) {
+      const canonical = authority ? canonicalize2(authority.schema, authority.intents, authority.scopes) : canonicalize2({}, {}, {});
+      return describeDataClient2(authority, crypto2.createHash("sha256").update(canonical).digest("hex"));
+    }
+    function virtualDataPlugin(analysis) {
+      return {
+        name: "somewhere-declared-data",
+        setup(build) {
+          build.onResolve({ filter: /^somewhere:data$/ }, () => ({ path: MODULE_NAME, namespace: "somewhere-declared-data" }));
+          build.onLoad({ filter: /.*/, namespace: "somewhere-declared-data" }, () => {
+            if (!analysis || !analysis.manifest.tables.length) return { errors: [{ text: "somewhere:data requires db/schema.ts with explicit client permissions." }] };
+            return { contents: analysis.runtime, loader: "js" };
+          });
+        }
+      };
+    }
+    module2.exports = { MODULE_NAME, CLIENT_FILE, MANIFEST_PATH, generateDataClient: generateDataClient2, virtualDataPlugin };
+  }
+});
+
+// worker/containers/compile/schema-types.cjs
+var require_schema_types = __commonJS({
+  "worker/containers/compile/schema-types.cjs"(exports2, module2) {
+    "use strict";
+    var types = `declare namespace SomewhereSchemaDeclaration {
+  interface Column { readonly __somewhereColumn: unique symbol }
+  interface Table { readonly __somewhereTable: unique symbol }
+  interface TableMarker { readonly __somewhereTableMarker: unique symbol }
+  interface ColumnMarker { readonly __somewhereColumnMarker: unique symbol }
+  interface Relation { readonly __somewhereRelation: unique symbol }
+  interface Scope { readonly __somewhereScope: unique symbol }
+  interface OwnerScope extends Scope { readonly __somewhereOwner: unique symbol }
+  interface ColumnOptions<Default> {
+    nullable?: boolean; default?: Default | null; unique?: boolean;
+    references?: string; onDelete?: 'cascade' | 'restrict'; renamedFrom?: string;
+  }
+  interface ClientPermissions<Field extends string> {
+    identity?: 'authenticated' | 'visitor'; read?: boolean | Field[]; publicRead?: boolean;
+    create?: Field[] | false | null; update?: Field[] | false | null; delete?: boolean;
+  }
+  interface TableOptions<Field extends string> {
+    scope?: Scope; client?: ClientPermissions<Field>; indexes?: string[][];
+    unique?: string[][]; relations?: Record<string, Relation>;
+  }
+}
+`;
+    var signatures = `function schema(tables: Record<string, SomewhereSchemaDeclaration.Table | SomewhereSchemaDeclaration.TableMarker>, options?: { search: SomewhereSchemaDeclaration.OwnerScope }): unknown;
+function table<Columns extends Record<string, SomewhereSchemaDeclaration.Column | SomewhereSchemaDeclaration.ColumnMarker>>(columns: Columns, options?: SomewhereSchemaDeclaration.TableOptions<Extract<keyof Columns, string>>): SomewhereSchemaDeclaration.Table;
+function id(options?: { uuid?: boolean }): SomewhereSchemaDeclaration.Column;
+function text(options?: SomewhereSchemaDeclaration.ColumnOptions<string>): SomewhereSchemaDeclaration.Column;
+function number(options?: SomewhereSchemaDeclaration.ColumnOptions<number>): SomewhereSchemaDeclaration.Column;
+function integer(options?: SomewhereSchemaDeclaration.ColumnOptions<number>): SomewhereSchemaDeclaration.Column;
+function boolean(options?: SomewhereSchemaDeclaration.ColumnOptions<boolean>): SomewhereSchemaDeclaration.Column;
+function timestamp(options?: SomewhereSchemaDeclaration.ColumnOptions<string>): SomewhereSchemaDeclaration.Column;
+function json(options?: SomewhereSchemaDeclaration.ColumnOptions<string>): SomewhereSchemaDeclaration.Column;
+function blob(options?: SomewhereSchemaDeclaration.ColumnOptions<never>): SomewhereSchemaDeclaration.Column;
+function owner(options?: { column?: string; visitors?: boolean }): SomewhereSchemaDeclaration.OwnerScope;
+function shared(): SomewhereSchemaDeclaration.Scope;
+function serverOnly(): SomewhereSchemaDeclaration.Scope;
+function member(options: { group: string | string[]; membership: string; member_user: string; member_group: string | string[] }): SomewhereSchemaDeclaration.Scope;
+function hasMany(table: string, foreignKey: string): SomewhereSchemaDeclaration.Relation;
+function removed(): SomewhereSchemaDeclaration.ColumnMarker;
+function removedTable(): SomewhereSchemaDeclaration.TableMarker;
+function exported(): SomewhereSchemaDeclaration.TableMarker;
+`;
+    var SCHEMA_DECLARATION2 = types + signatures.replace(/^function /gm, "declare function ") + `declare module 'somewhere/db' {
+${signatures.replace(/^function /gm, "  export function ")}}
+`;
+    module2.exports = { SCHEMA_DECLARATION: SCHEMA_DECLARATION2 };
+  }
+});
+
+// worker/containers/compile/runtime-types.cjs
+var require_runtime_types = __commonJS({
+  "worker/containers/compile/runtime-types.cjs"(exports2, module2) {
+    "use strict";
+    var RUNTIME_CONTEXT_DECLARATION2 = `
+type __SomewhereJsonPrimitive = string | number | boolean | null;
+type __SomewhereJson = __SomewhereJsonPrimitive | { [key: string]: __SomewhereJson } | __SomewhereJson[];
+type SomewhereDbScalar = string | number | boolean | null;
+type __SomewhereDbOperators = {
+  eq: SomewhereDbScalar; ne: SomewhereDbScalar;
+  lt: SomewhereDbScalar; lte: SomewhereDbScalar;
+  gt: SomewhereDbScalar; gte: SomewhereDbScalar;
+  like: SomewhereDbScalar; in: readonly SomewhereDbScalar[];
+  not: null; contains: string; startsWith: string; endsWith: string;
+};
+type __SomewhereDbOperator = {
+  [K in keyof __SomewhereDbOperators]: Pick<__SomewhereDbOperators, K>
+    & Partial<Record<Exclude<keyof __SomewhereDbOperators, K>, never>>
+}[keyof __SomewhereDbOperators];
+type SomewhereDbCondition = SomewhereDbScalar | __SomewhereDbOperator;
+type SomewhereDbWhere = Readonly<Record<string, SomewhereDbCondition | readonly SomewhereDbCondition[]>>;
+type SomewhereDbOrder = string | readonly [string, ('asc' | 'desc')?]
+  | readonly (readonly [string, ('asc' | 'desc')?])[];
+interface SomewhereDbReadOptions {
+  where?: SomewhereDbWhere | null;
+  order?: SomewhereDbOrder | null;
+  limit?: number | null;
+  offset?: number | null;
+  columns?: readonly string[] | null;
+  include?: readonly string[] | null;
+  has?: Readonly<Record<string, SomewhereDbWhere>> | null;
+}
+interface SomewhereDbCountOptions { where?: SomewhereDbWhere | null }
+interface SomewhereDbInsertOptions { onConflict?: 'ignore' | 'update' | null }
+type SomewhereDbValues = Readonly<Record<string, __SomewhereJson>>;
+interface SomewhereDbUpdate {
+  set: SomewhereDbValues;
+  where?: SomewhereDbWhere | null;
+}
+interface SomewhereDbRemove { where?: SomewhereDbWhere | null }
+type SomewhereDbWriteIntent =
+  | { op: 'insert'; table: string; values: SomewhereDbValues; options?: SomewhereDbInsertOptions | null }
+  | { op: 'update'; table: string; set: SomewhereDbValues; where?: SomewhereDbWhere | null }
+  | { op: 'remove'; table: string; where?: SomewhereDbWhere | null };
+interface SomewhereDbResult {
+  // Composed results preserve the database representation. They do not use
+  // the browser client's boolean/JSON normalization or its field projection.
+  data: Record<string, unknown>[];
+  error: null;
+  count: number;
+  changes: number;
+  last_row_id: number | string | null;
+  live_delivery?: { delivery: 'invalidated' }
+    | { delivery: 'resync_required'; reason: string };
+}
+interface SomewhereServerDb {
+  from(table: string, options?: SomewhereDbReadOptions | null): Promise<SomewhereDbResult>;
+  count(table: string, options?: SomewhereDbCountOptions | null): Promise<{ data: number; error: null }>;
+  insert(table: string, values: SomewhereDbValues, options?: SomewhereDbInsertOptions | null): Promise<SomewhereDbResult>;
+  update(table: string, spec: SomewhereDbUpdate): Promise<SomewhereDbResult>;
+  remove(table: string, spec?: SomewhereDbRemove | null): Promise<SomewhereDbResult>;
+  // Closed atomic batch, 1-100 intents checked before execution. No callback,
+  // reads, SQL, or caller-supplied authority. A lost acknowledgement can have
+  // an unknown outcome; a rejection never promises rollback or safe replay.
+  tx(intents: readonly SomewhereDbWriteIntent[]): Promise<SomewhereDbResult[]>;
+}
+interface SomewhereCallerDb extends Omit<SomewhereServerDb, 'from' | 'count'> {
+  from(table: string, options?: (SomewhereDbReadOptions & { asServer?: true }) | null): Promise<SomewhereDbResult>;
+  count(table: string, options?: (SomewhereDbCountOptions & { asServer?: true }) | null): Promise<{ data: number; error: null }>;
+  delete(table: string, spec?: SomewhereDbRemove | null): Promise<SomewhereDbResult>;
+  readonly server: SomewhereServerDb;
+}
+// Deliberately describes the composed database subset. Other sw namespaces
+// are not inferred from code or copied from the unrelated developer SDK.
+interface SomewhereRuntimeContext { readonly db: SomewhereCallerDb }
+interface __SomewhereTypedRequest<Input> extends Request { json(): Promise<Input> }
+type ServerFunction<Contract extends { input: unknown; output: unknown }> =
+  (req: __SomewhereTypedRequest<Contract["input"]>, sw: SomewhereRuntimeContext) =>
+    Contract["output"] | Promise<Contract["output"]>;
+`;
+    module2.exports = { RUNTIME_CONTEXT_DECLARATION: RUNTIME_CONTEXT_DECLARATION2 };
+  }
+});
+
+// declared-data-vendor-entry.js
+var declared_data_vendor_entry_exports = {};
+__export(declared_data_vendor_entry_exports, {
+  RUNTIME_CONTEXT_DECLARATION: () => import_runtime_types.RUNTIME_CONTEXT_DECLARATION,
+  SCHEMA_DECLARATION: () => import_schema_types.SCHEMA_DECLARATION,
+  generateFromFiles: () => generateFromFiles
+});
+module.exports = __toCommonJS(declared_data_vendor_entry_exports);
+
+// worker/src/utils/db-schema-deploy/schema-ownership.ts
+var SHARED_AUTHOR_COLUMN = "_sw_author_id";
+
+// worker/src/utils/db-schema-deploy/client-permissions.ts
+function parseClientPermissions(value, columns, scope) {
+  const fail = (message) => ({ ok: false, message });
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return fail("client must be an object declaring read, publicRead, create, update, delete, or identity.");
+  }
+  const input = value;
+  for (const key of Object.keys(input)) {
+    if (!["identity", "read", "publicRead", "create", "update", "delete"].includes(key)) {
+      return fail(`Unknown client permission "${key}".`);
+    }
+  }
+  if (!["owner", "member", "shared"].includes(scope.kind)) {
+    return fail("serverOnly() tables cannot declare client access. Use a server function for business logic.");
+  }
+  const identity = scope.kind === "owner" && scope.visitors === true ? "visitor" : "authenticated";
+  if (input.identity !== void 0 && input.identity !== "authenticated" && input.identity !== "visitor") {
+    return fail('client.identity must be "authenticated" or "visitor".');
+  }
+  if (input.identity !== void 0 && input.identity !== identity) {
+    return fail("client.identity must match the owner() declaration. Visitor access requires owner({ visitors: true }); owner() and other scopes require authenticated identity.");
+  }
+  let read = input.read ?? false;
+  const publicRead = input.publicRead ?? false;
+  if (typeof publicRead !== "boolean") return fail("client.publicRead must be true or false.");
+  if (read !== true && read !== false && !Array.isArray(read)) return fail("client.read must list readable fields, or be true or false.");
+  if (publicRead && (!Array.isArray(read) || read.length === 0)) {
+    return fail("client.publicRead requires an explicit non-empty client.read field list.");
+  }
+  const remove = input.delete ?? false;
+  if (typeof remove !== "boolean") return fail("client.delete must be true or false.");
+  const fields = new Map(columns.map((column) => [column.name, column]));
+  if (Array.isArray(read)) {
+    const names = [];
+    for (const entry of read) {
+      if (typeof entry !== "string" || !fields.has(entry.toLowerCase())) return fail("client.read must contain only declared column names.");
+      const name = entry.toLowerCase();
+      if (names.includes(name)) return fail(`client.read declares field "${entry}" twice.`);
+      names.push(name);
+    }
+    if (names.length === 0) return fail("client.read must name at least one field, or be false.");
+    read = names.sort();
+  }
+  const writes = { create: null, update: null };
+  for (const operation of ["create", "update"]) {
+    const declared = input[operation];
+    if (declared === void 0 || declared === false || declared === null) continue;
+    if (!Array.isArray(declared)) return fail(`client.${operation} must list the writable fields, or be false.`);
+    const allowed = [];
+    for (const entry of declared) {
+      if (typeof entry !== "string") return fail(`client.${operation} fields must be column names.`);
+      const name = entry.toLowerCase();
+      const column = fields.get(name);
+      if (!column) return fail(`client.${operation} names undeclared or platform-managed field "${entry}".`);
+      if (column.helper === "id" || scope.kind === "owner" && name === scope.column) {
+        return fail(`client.${operation} cannot write the platform-assigned identity field "${entry}".`);
+      }
+      if (column.helper === "blob") return fail(`client.${operation} cannot write binary field "${entry}". Use project files for uploads.`);
+      if (operation === "update" && scope.kind === "member" && scope.group?.includes(name)) {
+        return fail(`client.update cannot move a row between membership groups by changing "${entry}".`);
+      }
+      if (allowed.includes(name)) return fail(`client.${operation} declares field "${entry}" twice.`);
+      allowed.push(name);
+    }
+    if (operation === "update" && allowed.length === 0) return fail("client.update must name at least one writable field, or be false.");
+    writes[operation] = allowed.sort();
+  }
+  if (writes.create !== null) {
+    for (const column of columns) {
+      if (column.helper !== "id" && !column.nullable && !column.hasDefault && !column.autoNow && !writes.create.includes(column.name)) {
+        return fail(`client.create must include required field "${column.name}", or that field needs a declared default.`);
+      }
+    }
+  }
+  return { ok: true, permissions: { identity, read, publicRead, ...writes, delete: remove } };
+}
+
+// worker/src/utils/authority/scope-enforcement.ts
+var SAFE_SCOPE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function bakedTableSchemaFromDeclared(declaredJson) {
+  let shape;
+  try {
+    shape = JSON.parse(declaredJson);
+  } catch {
+    return null;
+  }
+  if (shape === null || typeof shape !== "object") return null;
+  const columns = shape.columns;
+  if (!Array.isArray(columns) || columns.length === 0) return null;
+  const out = [];
+  const permissionColumns = [];
+  const primaryKeys = [];
+  for (const c of columns) {
+    if (c === null || typeof c !== "object") return null;
+    const col = c;
+    if (typeof col.name !== "string" || !SAFE_SCOPE_IDENTIFIER.test(col.name) || col.name.toLowerCase() === SHARED_AUTHOR_COLUMN) return null;
+    if (typeof col.helper !== "string") return null;
+    let t;
+    let implicitDefault = false;
+    if (col.helper === "id") {
+      t = col.uuid === true ? "text" : "integer";
+      implicitDefault = true;
+    } else if (col.helper === "integer" || col.helper === "number" || col.helper === "text" || col.helper === "boolean" || col.helper === "timestamp" || col.helper === "json" || col.helper === "blob") {
+      t = col.helper;
+    } else {
+      return null;
+    }
+    const entry = { n: col.name.toLowerCase(), t };
+    if (col.nullable === true) entry.nul = 1;
+    if (implicitDefault || col.hasDefault === true || col.autoNow === true) entry.d = 1;
+    out.push(entry);
+    permissionColumns.push({ name: entry.n, helper: col.helper, nullable: col.nullable === true, hasDefault: col.hasDefault === true, autoNow: col.autoNow === true });
+    if (col.helper === "id") primaryKeys.push(entry.n);
+  }
+  const relations = bakedRelationsFromDeclared(shape.relations);
+  const scope = shape.scope;
+  let visitors;
+  if (scope !== null && typeof scope === "object" && Object.prototype.hasOwnProperty.call(scope, "visitors")) {
+    const declaredScope = scope;
+    if (declaredScope.kind !== "owner" || typeof declaredScope.visitors !== "boolean") return null;
+    if (declaredScope.visitors) visitors = true;
+  }
+  let browser = {};
+  if (Object.prototype.hasOwnProperty.call(shape, "client")) {
+    if (!scope || typeof scope !== "object" || primaryKeys.length !== 1) return null;
+    const sc = scope;
+    if (typeof sc.kind !== "string") return null;
+    const parsed = parseClientPermissions(shape.client, permissionColumns, {
+      kind: sc.kind,
+      ...visitors ? { visitors: true } : {},
+      ...typeof sc.column === "string" ? { column: sc.column } : {},
+      ...Array.isArray(sc.group) && sc.group.every((value) => typeof value === "string") ? { group: sc.group } : {}
+    });
+    if (!parsed.ok) return null;
+    if (Array.isArray(parsed.permissions.read) && !parsed.permissions.read.includes(primaryKeys[0])) return null;
+    browser = { client: parsed.permissions, clientPrimaryKey: primaryKeys[0] };
+  }
+  if (scope !== null && typeof scope === "object" && scope.kind === "member") {
+    const member = bakedMemberFromDeclared(scope);
+    if (!member) return null;
+    return relations ? { columns: out, member, relations, ...browser } : { columns: out, member, ...browser };
+  }
+  const author = scope !== null && typeof scope === "object" && scope.kind === "shared" ? SHARED_AUTHOR_COLUMN : void 0;
+  if (author) out.push({ n: author, t: "text", nul: 1 });
+  return { columns: out, ...relations ? { relations } : {}, ...author ? { author } : {}, ...visitors ? { visitors } : {}, ...browser };
+}
+function bakedRelationsFromDeclared(value) {
+  if (!Array.isArray(value) || value.length === 0) return void 0;
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object") continue;
+    const rel = entry;
+    if (typeof rel.name !== "string" || !SAFE_SCOPE_IDENTIFIER.test(rel.name)) continue;
+    if (typeof rel.table !== "string" || !SAFE_SCOPE_IDENTIFIER.test(rel.table)) continue;
+    if (typeof rel.fk !== "string" || !SAFE_SCOPE_IDENTIFIER.test(rel.fk)) continue;
+    if (typeof rel.parentKey !== "string" || !SAFE_SCOPE_IDENTIFIER.test(rel.parentKey)) continue;
+    const name = rel.name.toLowerCase();
+    if (seen.has(name)) continue;
+    seen.add(name);
+    out.push({ name, table: rel.table.toLowerCase(), fk: rel.fk.toLowerCase(), parentKey: rel.parentKey.toLowerCase() });
+  }
+  return out.length > 0 ? out : void 0;
+}
+function bakedMemberFromDeclared(scope) {
+  const s = scope;
+  const cols = (v) => {
+    if (!Array.isArray(v) || v.length === 0) return null;
+    const out = [];
+    for (const c of v) {
+      if (typeof c !== "string" || !SAFE_SCOPE_IDENTIFIER.test(c)) return null;
+      out.push(c.toLowerCase());
+    }
+    return out;
+  };
+  const g = cols(s.group);
+  const mg = cols(s.memberGroup);
+  if (!g || !mg || g.length !== mg.length) return null;
+  if (typeof s.membership !== "string" || !SAFE_SCOPE_IDENTIFIER.test(s.membership)) return null;
+  if (typeof s.memberUser !== "string" || !SAFE_SCOPE_IDENTIFIER.test(s.memberUser)) return null;
+  return { g, m: s.membership.toLowerCase(), u: s.memberUser.toLowerCase(), mg };
+}
+
+// worker/src/utils/db-schema-deploy/extract-schema-ts.ts
+var COLUMN_HELPERS = /* @__PURE__ */ new Set([
+  "id",
+  "text",
+  "number",
+  "integer",
+  "boolean",
+  "timestamp",
+  "json",
+  "blob"
+]);
+var SCOPE_HELPERS = /* @__PURE__ */ new Set(["owner", "shared", "serverOnly", "member"]);
+var TABLE_MARKER_HELPERS = /* @__PURE__ */ new Set(["removedTable", "exported"]);
+var SAFE_IDENT = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
+var RESERVED_PREFIXES = ["app_", "sqlite_", "d1_", "__sw_"];
+var MAX_TABLES = 100;
+var MAX_COLUMNS = 100;
+var MAX_INDEXES = 40;
+var MAX_INDEX_COLUMNS = 8;
+var MAX_NAME_LENGTH = 64;
+var MAX_SOURCE_BYTES = 256 * 1024;
+var DEFAULT_OWNER_COLUMN = "user_id";
+var SchemaTsError = class extends Error {
+};
+function tokenize(source) {
+  const tokens = [];
+  let i = 0;
+  let line = 1;
+  const n = source.length;
+  while (i < n) {
+    const ch = source[i];
+    if (ch === "\n") {
+      line++;
+      i++;
+      continue;
+    }
+    if (ch === " " || ch === "	" || ch === "\r") {
+      i++;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "/") {
+      while (i < n && source[i] !== "\n") i++;
+      continue;
+    }
+    if (ch === "/" && source[i + 1] === "*") {
+      i += 2;
+      while (i < n && !(source[i] === "*" && source[i + 1] === "/")) {
+        if (source[i] === "\n") line++;
+        i++;
+      }
+      i += 2;
+      continue;
+    }
+    if (ch === "`") {
+      throw new SchemaTsError(`line ${line}: template literals are not allowed in db/schema.ts \u2014 use plain 'single-quoted' strings.`);
+    }
+    if (ch === "'" || ch === '"') {
+      const startLine = line;
+      let value = "";
+      i++;
+      let closed = false;
+      while (i < n) {
+        const c = source[i];
+        if (c === "\\") {
+          const next = source[i + 1];
+          if (next === "'" || next === '"' || next === "\\") {
+            value += next;
+            i += 2;
+            continue;
+          }
+          throw new SchemaTsError(`line ${line}: unsupported escape "\\${next ?? ""}" in a string \u2014 db/schema.ts strings allow only \\', \\" and \\\\.`);
+        }
+        if (c === "\n") {
+          throw new SchemaTsError(`line ${startLine}: unterminated string.`);
+        }
+        if (c === ch) {
+          closed = true;
+          i++;
+          break;
+        }
+        value += c;
+        i++;
+      }
+      if (!closed) throw new SchemaTsError(`line ${startLine}: unterminated string.`);
+      tokens.push({ kind: "string", value, line: startLine });
+      continue;
+    }
+    if (/[0-9]/.test(ch) || ch === "-" && /[0-9]/.test(source[i + 1] ?? "")) {
+      let j = i + (ch === "-" ? 1 : 0);
+      while (j < n && /[0-9]/.test(source[j])) j++;
+      if (source[j] === ".") {
+        j++;
+        while (j < n && /[0-9]/.test(source[j])) j++;
+      }
+      const text = source.slice(i, j);
+      const num = Number(text);
+      if (!Number.isFinite(num)) throw new SchemaTsError(`line ${line}: invalid number "${text}".`);
+      tokens.push({ kind: "number", value: text, line });
+      i = j;
+      continue;
+    }
+    if (/[A-Za-z_$]/.test(ch)) {
+      let j = i;
+      while (j < n && /[A-Za-z0-9_$]/.test(source[j])) j++;
+      tokens.push({ kind: "ident", value: source.slice(i, j), line });
+      i = j;
+      continue;
+    }
+    if ("(){}[]:,;.".includes(ch)) {
+      tokens.push({ kind: "punct", value: ch, line });
+      i++;
+      continue;
+    }
+    throw new SchemaTsError(`line ${line}: unexpected character "${ch}". db/schema.ts holds only the schema declaration \u2014 no expressions, operators, or type annotations.`);
+  }
+  tokens.push({ kind: "eof", value: "", line });
+  return tokens;
+}
+var Reader = class {
+  constructor(tokens) {
+    this.tokens = tokens;
+  }
+  pos = 0;
+  peek() {
+    return this.tokens[this.pos];
+  }
+  next() {
+    return this.tokens[this.pos++];
+  }
+  fail(msg) {
+    throw new SchemaTsError(`line ${this.peek().line}: ${msg}`);
+  }
+  expectPunct(p, context) {
+    const t = this.next();
+    if (t.kind !== "punct" || t.value !== p) {
+      throw new SchemaTsError(`line ${t.line}: expected "${p}" ${context}, found ${describeToken(t)}.`);
+    }
+  }
+  tryPunct(p) {
+    const t = this.peek();
+    if (t.kind === "punct" && t.value === p) {
+      this.pos++;
+      return true;
+    }
+    return false;
+  }
+  expectIdent(context) {
+    const t = this.next();
+    if (t.kind !== "ident") {
+      throw new SchemaTsError(`line ${t.line}: expected a name ${context}, found ${describeToken(t)}.`);
+    }
+    return t;
+  }
+  /** An object key: identifier or quoted string. */
+  readKey(context) {
+    const t = this.next();
+    if (t.kind === "ident" || t.kind === "string") return { name: t.value, line: t.line };
+    throw new SchemaTsError(`line ${t.line}: expected a name ${context}, found ${describeToken(t)}.`);
+  }
+  readLiteral(context) {
+    const t = this.next();
+    if (t.kind === "string") return t.value;
+    if (t.kind === "number") return Number(t.value);
+    if (t.kind === "ident" && t.value === "true") return true;
+    if (t.kind === "ident" && t.value === "false") return false;
+    if (t.kind === "ident" && t.value === "null") return null;
+    throw new SchemaTsError(
+      `line ${t.line}: expected a literal value (string, number, true/false, or null) ${context}, found ${describeToken(t)}. Computed values are not allowed \u2014 the declaration must be readable without running it.`
+    );
+  }
+  /** { key: literal, … } with trailing commas allowed. */
+  readLiteralObject(context) {
+    this.expectPunct("{", context);
+    const out = /* @__PURE__ */ new Map();
+    while (!this.tryPunct("}")) {
+      const key = this.readKey(`for an option key ${context}`);
+      this.expectPunct(":", `after "${key.name}" ${context}`);
+      const value = this.readLiteral(`for "${key.name}" ${context}`);
+      if (out.has(key.name)) throw new SchemaTsError(`line ${key.line}: option "${key.name}" appears twice ${context}.`);
+      out.set(key.name, { value, line: key.line });
+      if (!this.tryPunct(",")) {
+        this.expectPunct("}", context);
+        break;
+      }
+    }
+    return out;
+  }
+  atEof() {
+    return this.peek().kind === "eof";
+  }
+};
+function describeToken(t) {
+  if (t.kind === "eof") return "the end of the file";
+  if (t.kind === "string") return `the string '${t.value.slice(0, 40)}'`;
+  return `"${t.value}"`;
+}
+function readClientPermissions(r) {
+  r.expectPunct("{", "opening client permissions");
+  const out = /* @__PURE__ */ Object.create(null);
+  while (!r.tryPunct("}")) {
+    const key = r.readKey("for a client permission");
+    if (Object.prototype.hasOwnProperty.call(out, key.name)) r.fail(`client declares "${key.name}" twice.`);
+    r.expectPunct(":", `after client permission "${key.name}"`);
+    if (r.tryPunct("[")) {
+      const fields = [];
+      while (!r.tryPunct("]")) {
+        fields.push(r.readLiteral(`in client.${key.name}`));
+        if (!r.tryPunct(",")) {
+          r.expectPunct("]", `closing client.${key.name}`);
+          break;
+        }
+      }
+      out[key.name] = fields;
+    } else {
+      out[key.name] = r.readLiteral(`for client.${key.name}`);
+    }
+    if (!r.tryPunct(",")) {
+      r.expectPunct("}", "closing client permissions");
+      break;
+    }
+  }
+  return out;
+}
+function skipImport(r) {
+  r.next();
+  r.expectPunct("{", 'after "import"');
+  while (!r.tryPunct("}")) {
+    r.expectIdent("inside the import list");
+    if (!r.tryPunct(",")) {
+      r.expectPunct("}", "closing the import list");
+      break;
+    }
+  }
+  const from = r.expectIdent("after the import list");
+  if (from.value !== "from") throw new SchemaTsError(`line ${from.line}: expected "from" after the import list.`);
+  const src = r.next();
+  if (src.kind !== "string") throw new SchemaTsError(`line ${src.line}: expected a module name string after "from".`);
+  r.tryPunct(";");
+}
+function checkDeclaredName(kind, raw, line) {
+  if (raw.length > MAX_NAME_LENGTH) {
+    throw new SchemaTsError(`line ${line}: ${kind} name "${raw.slice(0, 40)}\u2026" is longer than ${MAX_NAME_LENGTH} characters.`);
+  }
+  if (!SAFE_IDENT.test(raw)) {
+    throw new SchemaTsError(`line ${line}: ${kind} name "${raw}" is invalid. Use letters, digits, and underscores, starting with a letter or underscore.`);
+  }
+  const name = raw.toLowerCase();
+  if (name.startsWith("_") || RESERVED_PREFIXES.some((p) => name.startsWith(p))) {
+    throw new SchemaTsError(`line ${line}: ${kind} name "${raw}" uses a reserved platform prefix and cannot be declared. Pick a different name \u2014 in particular, names starting with "app_" or "_" belong to the platform.`);
+  }
+  return name;
+}
+function readColumn(r, tableName, rawName, line) {
+  const helperTok = r.expectIdent(`for column "${tableName}"."${rawName}"`);
+  const helper = helperTok.value;
+  if (helper === "removed") {
+    r.expectPunct("(", 'after "removed"');
+    r.expectPunct(")", `closing removed() on "${tableName}"."${rawName}" \u2014 the removal marker takes no options`);
+    return { kind: "removed", name: checkDeclaredName("Column", rawName, line) };
+  }
+  if (TABLE_MARKER_HELPERS.has(helper)) {
+    throw new SchemaTsError(
+      `line ${helperTok.line}: "${tableName}"."${rawName}" uses ${helper}(), which marks a whole table. To remove this column, mark it ${rawName}: removed().`
+    );
+  }
+  if (!COLUMN_HELPERS.has(helper)) {
+    throw new SchemaTsError(
+      `line ${helperTok.line}: unknown column type "${helper}" on "${tableName}"."${rawName}". Use one of: id, text, number, integer, boolean, timestamp, json, blob.`
+    );
+  }
+  r.expectPunct("(", `after "${helper}"`);
+  let opts = /* @__PURE__ */ new Map();
+  if (!r.tryPunct(")")) {
+    opts = r.readLiteralObject(`in ${helper}() options for "${tableName}"."${rawName}"`);
+    r.tryPunct(",");
+    r.expectPunct(")", `closing ${helper}()`);
+  }
+  const name = checkDeclaredName("Column", rawName, line);
+  const col = {
+    name,
+    helper,
+    uuid: false,
+    nullable: false,
+    hasDefault: false,
+    default: null,
+    autoNow: false,
+    unique: false,
+    references: null,
+    onDelete: "restrict",
+    renamedFrom: null
+  };
+  const allowed = helper === "id" ? /* @__PURE__ */ new Set(["uuid"]) : /* @__PURE__ */ new Set(["nullable", "default", "unique", "references", "onDelete", "renamedFrom"]);
+  for (const [key, { value, line: optLine }] of opts) {
+    if (!allowed.has(key)) {
+      throw new SchemaTsError(
+        `line ${optLine}: ${helper}() on "${tableName}"."${rawName}" has an unknown option "${key}". Allowed: ${[...allowed].join(", ")}.`
+      );
+    }
+    switch (key) {
+      case "uuid":
+        if (typeof value !== "boolean") throw new SchemaTsError(`line ${optLine}: "uuid" must be true or false.`);
+        col.uuid = value;
+        break;
+      case "nullable":
+        if (typeof value !== "boolean") throw new SchemaTsError(`line ${optLine}: "nullable" must be true or false.`);
+        col.nullable = value;
+        break;
+      case "unique":
+        if (typeof value !== "boolean") throw new SchemaTsError(`line ${optLine}: "unique" must be true or false.`);
+        col.unique = value;
+        break;
+      case "default": {
+        const t = col.helper;
+        if (t === "timestamp" && value === "now") {
+          col.autoNow = true;
+          break;
+        }
+        const okType = value === null || t === "boolean" && typeof value === "boolean" || (t === "number" || t === "integer") && typeof value === "number" || (t === "text" || t === "timestamp" || t === "json") && typeof value === "string";
+        if (!okType) {
+          throw new SchemaTsError(
+            `line ${optLine}: the default for "${tableName}"."${rawName}" (${t}) must be ${t === "boolean" ? "true or false" : t === "number" || t === "integer" ? "a number" : t === "blob" ? "omitted \u2014 blob columns cannot declare a default" : "a string"} or null.`
+          );
+        }
+        if (t === "integer" && typeof value === "number" && !Number.isInteger(value)) {
+          throw new SchemaTsError(`line ${optLine}: the default for integer column "${tableName}"."${rawName}" must be a whole number.`);
+        }
+        col.hasDefault = true;
+        col.default = value;
+        break;
+      }
+      case "references":
+        if (typeof value !== "string" || !SAFE_IDENT.test(value)) {
+          throw new SchemaTsError(`line ${optLine}: "references" must be the name of a table declared in this file.`);
+        }
+        col.references = value.toLowerCase();
+        break;
+      case "onDelete":
+        if (value !== "cascade" && value !== "restrict") {
+          throw new SchemaTsError(`line ${optLine}: "onDelete" must be 'cascade' or 'restrict'.`);
+        }
+        col.onDelete = value;
+        break;
+      case "renamedFrom":
+        if (typeof value !== "string" || !SAFE_IDENT.test(value) || value.length > MAX_NAME_LENGTH) {
+          throw new SchemaTsError(`line ${optLine}: "renamedFrom" on "${tableName}"."${rawName}" must be the previous column name.`);
+        }
+        col.renamedFrom = value.toLowerCase();
+        break;
+    }
+  }
+  if (col.renamedFrom === col.name) {
+    throw new SchemaTsError(
+      `line ${line}: "${tableName}"."${rawName}" declares renamedFrom: '${col.renamedFrom}' \u2014 that is its own name. A rename needs the OLD name there.`
+    );
+  }
+  if (col.onDelete === "cascade" && !col.references) {
+    throw new SchemaTsError(`line ${line}: "onDelete" on "${tableName}"."${rawName}" needs "references" on the same column.`);
+  }
+  if (col.hasDefault && col.default === null) {
+    if (!col.nullable) {
+      throw new SchemaTsError(
+        `line ${line}: "${tableName}"."${rawName}" is required but declares { default: null } \u2014 a required column can never hold null. Give it a real default, or mark it { nullable: true }.`
+      );
+    }
+    col.hasDefault = false;
+  }
+  return { kind: "column", column: col };
+}
+function readColumnOrColumnList(r, ctx) {
+  if (r.tryPunct("[")) {
+    const out = [];
+    while (!r.tryPunct("]")) {
+      const t2 = r.next();
+      if (t2.kind !== "string") {
+        throw new SchemaTsError(`line ${t2.line}: ${ctx} must be quoted column names.`);
+      }
+      out.push(t2.value.toLowerCase());
+      if (!r.tryPunct(",")) {
+        r.expectPunct("]", `closing ${ctx}`);
+        break;
+      }
+    }
+    return out;
+  }
+  const t = r.next();
+  if (t.kind !== "string") {
+    throw new SchemaTsError(`line ${t.line}: ${ctx} must be a quoted column name, or a list of them for a composite key.`);
+  }
+  return [t.value.toLowerCase()];
+}
+function readSingleColumn(r, ctx) {
+  const t = r.next();
+  if (t.kind !== "string") {
+    throw new SchemaTsError(`line ${t.line}: ${ctx} must be a single quoted column name.`);
+  }
+  return t.value.toLowerCase();
+}
+function validateMemberColumns(names, optionLabel, tableName, line) {
+  const seen = /* @__PURE__ */ new Set();
+  for (const name of names) {
+    if (!SAFE_IDENT.test(name) || name.length > MAX_NAME_LENGTH) {
+      throw new SchemaTsError(`line ${line}: member(${optionLabel}) on table "${tableName}" names an invalid column "${name}".`);
+    }
+    if (seen.has(name)) {
+      throw new SchemaTsError(`line ${line}: member(${optionLabel}) on table "${tableName}" lists "${name}" twice.`);
+    }
+    seen.add(name);
+  }
+}
+function readMemberScope(r, tableName, scopeLine) {
+  r.expectPunct("{", `in member() options for table "${tableName}" \u2014 member() needs { group, membership, member_user, member_group }`);
+  let group = null;
+  let membership = null;
+  let memberUser = null;
+  let memberGroup = null;
+  while (!r.tryPunct("}")) {
+    const key = r.readKey(`for a member() option of table "${tableName}"`);
+    r.expectPunct(":", `after "${key.name}" in member() for table "${tableName}"`);
+    if (key.name === "group") {
+      group = readColumnOrColumnList(r, `member({ group }) on table "${tableName}"`);
+    } else if (key.name === "membership") {
+      membership = readSingleColumn(r, `member({ membership }) on table "${tableName}"`);
+    } else if (key.name === "member_user") {
+      memberUser = readSingleColumn(r, `member({ member_user }) on table "${tableName}"`);
+    } else if (key.name === "member_group") {
+      memberGroup = readColumnOrColumnList(r, `member({ member_group }) on table "${tableName}"`);
+    } else {
+      throw new SchemaTsError(
+        `line ${key.line}: member() on table "${tableName}" has an unknown option "${key.name}". Allowed: group, membership, member_user, member_group.`
+      );
+    }
+    if (!r.tryPunct(",")) {
+      r.expectPunct("}", `closing member() options for table "${tableName}"`);
+      break;
+    }
+  }
+  const missing = [];
+  if (!group) missing.push("group");
+  if (!membership) missing.push("membership");
+  if (!memberUser) missing.push("member_user");
+  if (!memberGroup) missing.push("member_group");
+  if (missing.length > 0 || !group || !membership || !memberUser || !memberGroup) {
+    throw new SchemaTsError(
+      `line ${scopeLine}: member() on table "${tableName}" is missing ${missing.join(", ")}. It needs member({ group, membership, member_user, member_group }) \u2014 group and member_group name the group-key columns on this table and on the membership table.`
+    );
+  }
+  validateMemberColumns(group, "group", tableName, scopeLine);
+  validateMemberColumns([membership], "membership", tableName, scopeLine);
+  validateMemberColumns([memberUser], "member_user", tableName, scopeLine);
+  validateMemberColumns(memberGroup, "member_group", tableName, scopeLine);
+  if (group.length > MAX_INDEX_COLUMNS) {
+    throw new SchemaTsError(`line ${scopeLine}: member({ group }) on table "${tableName}" lists ${group.length} columns (max ${MAX_INDEX_COLUMNS}).`);
+  }
+  if (group.length !== memberGroup.length) {
+    throw new SchemaTsError(
+      `line ${scopeLine}: member() on table "${tableName}" has a ${group.length}-column group but a ${memberGroup.length}-column member_group. The group key must have the same number of columns on both sides.`
+    );
+  }
+  return { kind: "member", group, membership, memberUser, memberGroup };
+}
+function readRelations(r, tableName) {
+  r.expectPunct("{", `for "relations" of table "${tableName}"`);
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  while (!r.tryPunct("}")) {
+    const key = r.readKey(`for a relation name of table "${tableName}"`);
+    if (!SAFE_IDENT.test(key.name) || key.name.length > MAX_NAME_LENGTH) {
+      throw new SchemaTsError(`line ${key.line}: relation name "${key.name}" on table "${tableName}" is invalid. Use letters, digits, and underscores, starting with a letter or underscore.`);
+    }
+    const name = key.name.toLowerCase();
+    if (seen.has(name)) throw new SchemaTsError(`line ${key.line}: relation "${key.name}" on table "${tableName}" is declared twice.`);
+    seen.add(name);
+    r.expectPunct(":", `after relation "${key.name}" on table "${tableName}"`);
+    const callee = r.expectIdent(`for relation "${key.name}" on table "${tableName}"`);
+    if (callee.value !== "hasMany") {
+      throw new SchemaTsError(`line ${callee.line}: relation "${key.name}" on table "${tableName}" uses "${callee.value}()", which is not supported. Only hasMany('child_table', 'foreign_key') is available.`);
+    }
+    r.expectPunct("(", 'after "hasMany"');
+    const childTok = r.next();
+    if (childTok.kind !== "string") throw new SchemaTsError(`line ${childTok.line}: hasMany() for relation "${key.name}" on table "${tableName}" needs the child table name as a quoted string first.`);
+    r.expectPunct(",", `after the child table in hasMany() for relation "${key.name}" on table "${tableName}" \u2014 hasMany('child_table', 'foreign_key')`);
+    const fkTok = r.next();
+    if (fkTok.kind !== "string") throw new SchemaTsError(`line ${fkTok.line}: hasMany() for relation "${key.name}" on table "${tableName}" needs the child foreign-key column as a quoted string second.`);
+    r.tryPunct(",");
+    r.expectPunct(")", `closing hasMany() for relation "${key.name}" on table "${tableName}"`);
+    const childTable = childTok.value.toLowerCase();
+    const fk = fkTok.value.toLowerCase();
+    if (!SAFE_IDENT.test(childTable) || childTable.length > MAX_NAME_LENGTH) {
+      throw new SchemaTsError(`line ${childTok.line}: hasMany() child table "${childTok.value}" for relation "${key.name}" on table "${tableName}" is not a valid table name.`);
+    }
+    if (!SAFE_IDENT.test(fk) || fk.length > MAX_NAME_LENGTH) {
+      throw new SchemaTsError(`line ${fkTok.line}: hasMany() foreign key "${fkTok.value}" for relation "${key.name}" on table "${tableName}" is not a valid column name.`);
+    }
+    out.push({ name, table: childTable, fk, parentKey: "" });
+    if (!r.tryPunct(",")) {
+      r.expectPunct("}", `closing "relations" of table "${tableName}"`);
+      break;
+    }
+  }
+  out.sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return out;
+}
+function readScope(r, tableName) {
+  const tok = r.expectIdent(`for the scope of table "${tableName}"`);
+  if (!SCOPE_HELPERS.has(tok.value)) {
+    throw new SchemaTsError(
+      `line ${tok.line}: unknown scope "${tok.value}" on table "${tableName}". Use owner(), member(), shared(), or serverOnly().`
+    );
+  }
+  if (tok.value === "member") {
+    r.expectPunct("(", 'after "member"');
+    const scope = readMemberScope(r, tableName, tok.line);
+    r.tryPunct(",");
+    r.expectPunct(")", "closing member()");
+    return scope;
+  }
+  r.expectPunct("(", `after "${tok.value}"`);
+  let opts = /* @__PURE__ */ new Map();
+  if (!r.tryPunct(")")) {
+    opts = r.readLiteralObject(`in ${tok.value}() options for table "${tableName}"`);
+    r.tryPunct(",");
+    r.expectPunct(")", `closing ${tok.value}()`);
+  }
+  if (tok.value === "owner") {
+    let column = DEFAULT_OWNER_COLUMN;
+    let visitors = false;
+    for (const [key, { value, line }] of opts) {
+      if (key === "visitors") {
+        if (typeof value !== "boolean") {
+          throw new SchemaTsError(`line ${line}: owner({ visitors }) on table "${tableName}" must be true or false.`);
+        }
+        visitors = value;
+        continue;
+      }
+      if (key !== "column") {
+        throw new SchemaTsError(`line ${line}: owner() on table "${tableName}" has an unknown option "${key}". Allowed: column, visitors.`);
+      }
+      if (typeof value !== "string" || !SAFE_IDENT.test(value) || value.length > MAX_NAME_LENGTH) {
+        throw new SchemaTsError(`line ${line}: owner({ column }) on table "${tableName}" must be a valid column name.`);
+      }
+      column = value.toLowerCase();
+    }
+    return { kind: "owner", column, ...visitors ? { visitors: true } : {} };
+  }
+  if (opts.size > 0) {
+    throw new SchemaTsError(`line ${tok.line}: ${tok.value}() on table "${tableName}" takes no options.`);
+  }
+  return tok.value === "shared" ? { kind: "shared" } : { kind: "server_only" };
+}
+function readColumnLists(r, tableName, optionName) {
+  const startLine = r.peek().line;
+  r.expectPunct("[", `for "${optionName}" of table "${tableName}"`);
+  const entries = [];
+  while (!r.tryPunct("]")) {
+    const entryLine = r.peek().line;
+    r.expectPunct("[", `for a "${optionName}" entry of table "${tableName}" (it is a list of column lists, e.g. [['a'], ['b', 'c']])`);
+    const entry = [];
+    while (!r.tryPunct("]")) {
+      const t = r.next();
+      if (t.kind !== "string") {
+        throw new SchemaTsError(`line ${t.line}: "${optionName}" columns for table "${tableName}" must be quoted column names.`);
+      }
+      const colName = t.value.toLowerCase();
+      if (entry.includes(colName)) {
+        throw new SchemaTsError(`line ${t.line}: a "${optionName}" entry on table "${tableName}" lists "${t.value}" twice.`);
+      }
+      entry.push(colName);
+      if (!r.tryPunct(",")) {
+        r.expectPunct("]", `closing a "${optionName}" entry of table "${tableName}"`);
+        break;
+      }
+    }
+    if (entry.length === 0) {
+      throw new SchemaTsError(`line ${entryLine}: a "${optionName}" entry on table "${tableName}" is empty.`);
+    }
+    if (entry.length > MAX_INDEX_COLUMNS) {
+      throw new SchemaTsError(`line ${entryLine}: a "${optionName}" entry on table "${tableName}" lists ${entry.length} columns (max ${MAX_INDEX_COLUMNS}).`);
+    }
+    entries.push({ columns: entry, line: entryLine });
+    if (!r.tryPunct(",")) {
+      r.expectPunct("]", `closing "${optionName}" of table "${tableName}"`);
+      break;
+    }
+  }
+  if (entries.length > MAX_INDEXES) {
+    throw new SchemaTsError(`line ${startLine}: table "${tableName}" declares ${entries.length} "${optionName}" entries (max ${MAX_INDEXES}).`);
+  }
+  return entries;
+}
+function readTable(r, rawName, nameLine) {
+  const callee = r.expectIdent(`for table "${rawName}"`);
+  if (callee.value === "removed") {
+    throw new SchemaTsError(
+      `line ${callee.line}: table "${rawName}" uses removed(), which marks a single column. To remove this table, mark it ${rawName}: removedTable().`
+    );
+  }
+  if (TABLE_MARKER_HELPERS.has(callee.value)) {
+    r.expectPunct("(", `after "${callee.value}"`);
+    r.expectPunct(")", `closing ${callee.value}() on table "${rawName}" \u2014 the marker takes no options`);
+    return {
+      kind: callee.value,
+      name: checkDeclaredName("Table", rawName, nameLine)
+    };
+  }
+  if (callee.value !== "table") {
+    throw new SchemaTsError(`line ${callee.line}: expected table(\u2026) for "${rawName}", found "${callee.value}(".`);
+  }
+  const name = checkDeclaredName("Table", rawName, nameLine);
+  r.expectPunct("(", 'after "table"');
+  r.expectPunct("{", `opening the columns of table "${rawName}"`);
+  const columns = [];
+  const removedColumns = [];
+  const seen = /* @__PURE__ */ new Set();
+  while (!r.tryPunct("}")) {
+    const key = r.readKey(`for a column of table "${rawName}"`);
+    r.expectPunct(":", `after column "${key.name}"`);
+    const entry = readColumn(r, rawName, key.name, key.line);
+    const entryName = entry.kind === "column" ? entry.column.name : entry.name;
+    if (seen.has(entryName)) {
+      throw new SchemaTsError(`line ${key.line}: column "${rawName}"."${key.name}" is declared twice (names are case-insensitive).`);
+    }
+    seen.add(entryName);
+    if (entry.kind === "column") columns.push(entry.column);
+    else removedColumns.push(entry.name);
+    if (!r.tryPunct(",")) {
+      r.expectPunct("}", `closing the columns of table "${rawName}"`);
+      break;
+    }
+  }
+  if (columns.length === 0) {
+    throw new SchemaTsError(`line ${nameLine}: table "${rawName}" declares no columns${removedColumns.length > 0 ? " (removal markers do not count \u2014 a table needs at least one kept column, or mark the whole table removedTable())" : ""}.`);
+  }
+  if (columns.length > MAX_COLUMNS) {
+    throw new SchemaTsError(`line ${nameLine}: table "${rawName}" declares ${columns.length} columns (max ${MAX_COLUMNS}).`);
+  }
+  const idCols = columns.filter((c) => c.helper === "id");
+  if (idCols.length > 1) {
+    throw new SchemaTsError(`line ${nameLine}: table "${rawName}" declares ${idCols.length} id() columns \u2014 a table has at most one.`);
+  }
+  let scope = null;
+  let indexEntries = null;
+  let uniqueEntries = null;
+  let relations = [];
+  let relationsDeclared = false;
+  let clientInput;
+  if (r.tryPunct(",")) {
+    r.expectPunct("{", `opening the options of table "${rawName}"`);
+    while (!r.tryPunct("}")) {
+      const key = r.readKey(`for an option of table "${rawName}"`);
+      r.expectPunct(":", `after "${key.name}"`);
+      if (key.name === "scope") {
+        if (scope) throw new SchemaTsError(`line ${key.line}: table "${rawName}" declares "scope" twice.`);
+        scope = readScope(r, rawName);
+      } else if (key.name === "indexes") {
+        if (indexEntries) throw new SchemaTsError(`line ${key.line}: table "${rawName}" declares "indexes" twice.`);
+        indexEntries = readColumnLists(r, rawName, "indexes");
+      } else if (key.name === "unique") {
+        if (uniqueEntries) throw new SchemaTsError(`line ${key.line}: table "${rawName}" declares "unique" twice.`);
+        uniqueEntries = readColumnLists(r, rawName, "unique");
+      } else if (key.name === "relations") {
+        if (relationsDeclared) throw new SchemaTsError(`line ${key.line}: table "${rawName}" declares "relations" twice.`);
+        relationsDeclared = true;
+        relations = readRelations(r, rawName);
+      } else if (key.name === "client") {
+        if (clientInput) throw new SchemaTsError(`line ${key.line}: table "${rawName}" declares "client" twice.`);
+        clientInput = readClientPermissions(r);
+      } else {
+        throw new SchemaTsError(
+          `line ${key.line}: table "${rawName}" has an unknown option "${key.name}". Allowed: scope, indexes, unique, relations, client.`
+        );
+      }
+      if (!r.tryPunct(",")) {
+        r.expectPunct("}", `closing the options of table "${rawName}"`);
+        break;
+      }
+    }
+  }
+  r.tryPunct(",");
+  r.expectPunct(")", `closing table("${rawName}")`);
+  scope ??= { kind: "owner", column: DEFAULT_OWNER_COLUMN };
+  if (columns.some((column) => column.name === SHARED_AUTHOR_COLUMN || column.renamedFrom === SHARED_AUTHOR_COLUMN) || removedColumns.includes(SHARED_AUTHOR_COLUMN) || scope.kind === "owner" && scope.column === SHARED_AUTHOR_COLUMN) {
+    throw new SchemaTsError(`line ${nameLine}: "${SHARED_AUTHOR_COLUMN}" is platform-maintained row authorship and cannot be declared, removed, renamed, or used as a custom owner column.`);
+  }
+  if (scope.kind === "owner") {
+    const clash = columns.find((c) => c.name === scope.column);
+    if (clash) {
+      throw new SchemaTsError(
+        `line ${nameLine}: table "${rawName}" declares the column "${scope.column}", but that is its owner column, which the platform creates and manages. Remove it from the columns \u2014 or pick a different owner column with owner({ column: '\u2026' }).`
+      );
+    }
+    if (removedColumns.includes(scope.column)) {
+      throw new SchemaTsError(
+        `line ${nameLine}: table "${rawName}" marks its owner column "${scope.column}" as removed(). The owner column carries the table's per-user scope and cannot be removed while the scope is owner().`
+      );
+    }
+  }
+  const declaredNow = new Set(columns.map((c) => c.name));
+  const renameSources = /* @__PURE__ */ new Set();
+  for (const c of columns) {
+    if (!c.renamedFrom) continue;
+    if (declaredNow.has(c.renamedFrom)) {
+      throw new SchemaTsError(
+        `line ${nameLine}: "${rawName}"."${c.name}" declares renamedFrom: '${c.renamedFrom}', but "${c.renamedFrom}" is still declared as a column. A rename replaces the old column \u2014 remove its declaration.`
+      );
+    }
+    if (scope.kind === "owner" && c.renamedFrom === scope.column) {
+      throw new SchemaTsError(
+        `line ${nameLine}: "${rawName}"."${c.name}" declares renamedFrom: '${c.renamedFrom}', but that is the table's owner column, which the platform creates and manages \u2014 it cannot be renamed into an ordinary column.`
+      );
+    }
+    if (removedColumns.includes(c.renamedFrom)) {
+      throw new SchemaTsError(
+        `line ${nameLine}: "${rawName}"."${c.renamedFrom}" is marked removed() AND named by renamedFrom on "${c.name}" \u2014 it cannot be both removed and renamed. Keep one.`
+      );
+    }
+    if (renameSources.has(c.renamedFrom)) {
+      throw new SchemaTsError(
+        `line ${nameLine}: two columns of "${rawName}" declare renamedFrom: '${c.renamedFrom}' \u2014 a column can only be renamed to one new name.`
+      );
+    }
+    renameSources.add(c.renamedFrom);
+  }
+  const known = new Set(columns.map((c) => c.name));
+  if (scope.kind === "owner") known.add(scope.column);
+  const indexes = [];
+  for (const entry of indexEntries ?? []) {
+    for (const colName of entry.columns) {
+      if (!known.has(colName)) {
+        throw new SchemaTsError(
+          `line ${entry.line}: index on table "${rawName}" names "${colName}", which is not one of its declared columns.`
+        );
+      }
+    }
+    indexes.push(entry.columns);
+  }
+  const uniques = [];
+  for (const entry of uniqueEntries ?? []) {
+    if (entry.columns.length < 2) {
+      throw new SchemaTsError(
+        `line ${entry.line}: the "unique" option on table "${rawName}" is for MULTI-column uniqueness. For a single column, put { unique: true } on the column itself.`
+      );
+    }
+    for (const colName of entry.columns) {
+      if (!known.has(colName)) {
+        throw new SchemaTsError(
+          `line ${entry.line}: a "unique" entry on table "${rawName}" names "${colName}", which is not one of its declared columns.`
+        );
+      }
+    }
+    uniques.push(entry.columns);
+  }
+  let client;
+  if (clientInput) {
+    if (columns.filter((column) => column.helper === "id").length !== 1) {
+      throw new SchemaTsError(`line ${nameLine}: table "${rawName}": client operations require exactly one id() column.`);
+    }
+    const parsed = parseClientPermissions(clientInput, columns, scope);
+    if (!parsed.ok) throw new SchemaTsError(`line ${nameLine}: table "${rawName}": ${parsed.message}`);
+    const key = columns.find((column) => column.helper === "id").name;
+    if (Array.isArray(parsed.permissions.read) && !parsed.permissions.read.includes(key)) {
+      throw new SchemaTsError(`line ${nameLine}: table "${rawName}": client.read must include primary key "${key}" for stable pagination.`);
+    }
+    client = parsed.permissions;
+  }
+  return { kind: "table", table: { name, scope, relations, columns, indexes, uniques, removedColumns: [...removedColumns].sort(), ...client ? { client } : {} } };
+}
+function extractSchemaTs(source) {
+  if (typeof source !== "string" || source.trim().length === 0) {
+    return { ok: false, errors: ["db/schema.ts is empty. Declare at least one table, or remove the file to leave the database unmanaged."] };
+  }
+  if (source.length > MAX_SOURCE_BYTES) {
+    return { ok: false, errors: [`db/schema.ts is larger than ${Math.floor(MAX_SOURCE_BYTES / 1024)}KB \u2014 that is not a schema declaration.`] };
+  }
+  try {
+    const r = new Reader(tokenize(source));
+    while (r.peek().kind === "ident" && r.peek().value === "import") skipImport(r);
+    const exp = r.expectIdent("to start the declaration");
+    if (exp.value !== "export") {
+      throw new SchemaTsError(
+        `line ${exp.line}: db/schema.ts must contain only the schema declaration: optional imports, then "export default schema({ \u2026 })". Found "${exp.value}".`
+      );
+    }
+    const def = r.expectIdent('after "export"');
+    if (def.value !== "default") throw new SchemaTsError(`line ${def.line}: expected "default" after "export".`);
+    const schemaTok = r.expectIdent('after "export default"');
+    if (schemaTok.value !== "schema") {
+      throw new SchemaTsError(`line ${schemaTok.line}: expected schema({ \u2026 }) after "export default", found "${schemaTok.value}".`);
+    }
+    r.expectPunct("(", 'after "schema"');
+    r.expectPunct("{", "opening the schema tables");
+    const tables = [];
+    const removedTables = [];
+    const exportedTables = [];
+    const seen = /* @__PURE__ */ new Set();
+    const reader = r;
+    while (!reader.tryPunct("}")) {
+      const key = reader.readKey("for a table name");
+      reader.expectPunct(":", `after table "${key.name}"`);
+      const entry = readTable(reader, key.name, key.line);
+      const entryName = entry.kind === "table" ? entry.table.name : entry.name;
+      if (seen.has(entryName)) {
+        throw new SchemaTsError(`line ${key.line}: table "${key.name}" is declared twice (names are case-insensitive).`);
+      }
+      seen.add(entryName);
+      if (entry.kind === "table") tables.push(entry.table);
+      else if (entry.kind === "removedTable") removedTables.push(entryName);
+      else exportedTables.push(entryName);
+      if (!reader.tryPunct(",")) {
+        reader.expectPunct("}", "closing the schema tables");
+        break;
+      }
+    }
+    let managedSearch;
+    if (reader.tryPunct(",") && !(reader.peek().kind === "punct" && reader.peek().value === ")")) {
+      reader.expectPunct("{", "opening schema options");
+      const option = reader.readKey("for a schema option");
+      if (option.name !== "search") {
+        throw new SchemaTsError(`line ${option.line}: unknown schema option "${option.name}". The only schema-level option is search: owner().`);
+      }
+      reader.expectPunct(":", 'after schema option "search"');
+      const helper = reader.expectIdent('for schema option "search"');
+      if (helper.value !== "owner") {
+        throw new SchemaTsError(`line ${helper.line}: search ownership must be declared with owner().`);
+      }
+      reader.expectPunct("(", "after search: owner");
+      reader.expectPunct(")", "closing search: owner()");
+      managedSearch = { kind: "owner" };
+      reader.tryPunct(",");
+      reader.expectPunct("}", "closing schema options");
+      reader.tryPunct(",");
+    }
+    reader.expectPunct(")", "closing schema(\u2026)");
+    reader.tryPunct(";");
+    if (!reader.atEof()) {
+      reader.fail(
+        `db/schema.ts must end after "export default schema({ \u2026 })" \u2014 found ${describeToken(reader.peek())}. The file holds only the schema declaration.`
+      );
+    }
+    if (tables.length === 0 && removedTables.length === 0 && exportedTables.length === 0 && !managedSearch) {
+      return { ok: false, errors: ["db/schema.ts declares no tables. Declare at least one table, or remove the file to leave the database unmanaged."] };
+    }
+    if (tables.length > MAX_TABLES) {
+      return { ok: false, errors: [`db/schema.ts declares ${tables.length} tables (max ${MAX_TABLES}).`] };
+    }
+    const errors = [];
+    const names = new Set(tables.map((t) => t.name));
+    for (const t of tables) {
+      for (const c of t.columns) {
+        if (c.references && !names.has(c.references)) {
+          const marked = removedTables.includes(c.references) || exportedTables.includes(c.references);
+          errors.push(
+            marked ? `Column "${t.name}"."${c.name}" references "${c.references}", which this file marks ${removedTables.includes(c.references) ? "removedTable()" : "exported()"}. Remove the reference (mark the column removed(), or drop "references" from it) before the table can go.` : `Column "${t.name}"."${c.name}" references "${c.references}", which is not declared in db/schema.ts. Foreign keys can only target tables in the same declaration.`
+          );
+        }
+      }
+    }
+    const tableByName = new Map(tables.map((t) => [t.name, t]));
+    const knownColumns = (t) => {
+      const s = new Set(t.columns.map((c) => c.name));
+      if (t.scope.kind === "owner") s.add(t.scope.column);
+      return s;
+    };
+    for (const t of tables) {
+      if (t.scope.kind !== "member") continue;
+      const sc = t.scope;
+      const own = knownColumns(t);
+      for (const g of sc.group) {
+        if (!own.has(g)) {
+          errors.push(
+            `Table "${t.name}" is member-scoped on "${g}", but "${g}" is not one of its declared columns. The group-key columns must be real columns on the table.`
+          );
+        }
+      }
+      const membershipTable = tableByName.get(sc.membership);
+      if (!membershipTable) {
+        errors.push(
+          `Table "${t.name}" is member-scoped through the membership table "${sc.membership}", which is not declared in db/schema.ts. The membership table must be a managed table in the same schema.`
+        );
+        continue;
+      }
+      const membershipCols = knownColumns(membershipTable);
+      if (membershipTable.client && (membershipTable.client.create !== null || membershipTable.client.update !== null || membershipTable.client.delete)) {
+        errors.push(`Table "${sc.membership}" grants membership access to "${t.name}" and cannot allow client writes. Change membership through a server function.`);
+      }
+      if (!membershipCols.has(sc.memberUser)) {
+        errors.push(
+          `The membership table "${sc.membership}" (for member-scoped "${t.name}") has no "${sc.memberUser}" column named in member({ member_user }).`
+        );
+      }
+      for (const mg of sc.memberGroup) {
+        if (!membershipCols.has(mg)) {
+          errors.push(
+            `The membership table "${sc.membership}" (for member-scoped "${t.name}") has no "${mg}" column named in member({ member_group }).`
+          );
+        }
+      }
+    }
+    const columnByName = (t, col) => t.columns.find((c) => c.name === col);
+    for (const t of tables) {
+      if (t.relations.length === 0) continue;
+      const idCol = t.columns.find((c) => c.helper === "id");
+      const rootNames = knownColumns(t);
+      for (const rel of t.relations) {
+        if (rel.name === "__proto__" || rel.name === "prototype" || rel.name === "constructor") {
+          errors.push(
+            `Relation "${t.name}"."${rel.name}" uses a reserved object name. Choose a relation name that can be returned as an ordinary row field.`
+          );
+        } else if (rootNames.has(rel.name)) {
+          errors.push(
+            `Relation "${t.name}"."${rel.name}" has the same name as a column on "${t.name}". Choose a different relation name so nesting child rows cannot overwrite the root column.`
+          );
+        }
+        if (!idCol) {
+          errors.push(
+            `Table "${t.name}" declares relation "${rel.name}" but has no id() column to join on. A hasMany relation joins the child's foreign key to this table's primary key \u2014 declare an id() column.`
+          );
+        } else {
+          rel.parentKey = idCol.name;
+        }
+        const child = tableByName.get(rel.table);
+        if (!child) {
+          const marked = removedTables.includes(rel.table) || exportedTables.includes(rel.table);
+          errors.push(
+            marked ? `Relation "${t.name}"."${rel.name}" targets "${rel.table}", which this file marks ${removedTables.includes(rel.table) ? "removedTable()" : "exported()"}. Remove the relation before the table can go.` : `Relation "${t.name}"."${rel.name}" targets child table "${rel.table}", which is not declared in db/schema.ts. A relation can only target a managed table in the same declaration.`
+          );
+          continue;
+        }
+        const fkCol = columnByName(child, rel.fk);
+        if (!fkCol) {
+          errors.push(
+            `Relation "${t.name}"."${rel.name}" joins on "${rel.table}"."${rel.fk}", but "${rel.table}" has no column "${rel.fk}". The foreign key must be a real column on the child table.`
+          );
+          continue;
+        }
+        if (fkCol.references !== t.name) {
+          errors.push(
+            fkCol.references === null ? `Relation "${t.name}"."${rel.name}" joins on "${rel.table}"."${rel.fk}", but that column declares no foreign key. Declare it as ${rel.fk}: <type>({ references: '${t.name}' }) so the join key is a proven foreign key, not a free-form join.` : `Relation "${t.name}"."${rel.name}" joins on "${rel.table}"."${rel.fk}", but that column references "${fkCol.references}", not "${t.name}". The foreign key must reference the table that declares the relation.`
+          );
+        } else if (idCol) {
+          const expectedHelper = idCol.uuid ? "text" : "integer";
+          if (fkCol.helper !== expectedHelper) {
+            errors.push(
+              `Relation "${t.name}"."${rel.name}" joins "${rel.table}"."${rel.fk}" to "${t.name}"."${idCol.name}", but their key types do not match. Use ${expectedHelper}() for the foreign key so fetched child rows can be stitched to the ${idCol.uuid ? "text" : "whole-number"} parent id exactly.`
+            );
+          }
+        }
+      }
+    }
+    if (errors.length > 0) return { ok: false, errors };
+    return {
+      ok: true,
+      declaration: {
+        tables,
+        removedTables: removedTables.sort(),
+        exportedTables: exportedTables.sort(),
+        ...managedSearch ? { search: managedSearch } : {}
+      }
+    };
+  } catch (err) {
+    if (err instanceof SchemaTsError) {
+      return { ok: false, errors: [`db/schema.ts could not be read: ${err.message}`] };
+    }
+    throw err;
+  }
+}
+function canonicalTableShape(t) {
+  return {
+    name: t.name,
+    scope: t.scope,
+    ...t.client ? { client: t.client } : {},
+    columns: t.columns.map((c) => ({
+      name: c.name,
+      helper: c.helper,
+      uuid: c.uuid,
+      nullable: c.nullable,
+      hasDefault: c.hasDefault,
+      default: c.default,
+      autoNow: c.autoNow,
+      unique: c.unique,
+      references: c.references,
+      onDelete: c.onDelete,
+      // conditional: a marker-free declaration keeps its slice-1 generation id
+      ...c.renamedFrom ? { renamedFrom: c.renamedFrom } : {}
+    })),
+    indexes: t.indexes,
+    uniques: t.uniques,
+    ...t.removedColumns.length > 0 ? { removedColumns: t.removedColumns } : {},
+    // conditional: a relation-free table keeps its slice-1 generation id. Ordered
+    // by name (readRelations sorts) so the shape is deterministic.
+    ...t.relations.length > 0 ? { relations: t.relations.map((rel) => ({ name: rel.name, table: rel.table, fk: rel.fk, parentKey: rel.parentKey })) } : {}
+  };
+}
+
+// worker/src/utils/db-schema-deploy/client-contract-source.ts
+var import_declared_data_contract = __toESM(require_declared_data_contract());
+function declareEntry(dictionary, name, value) {
+  Object.defineProperty(dictionary, name, { value, writable: true, enumerable: true, configurable: true });
+}
+function clientAuthorityFromSource(files) {
+  const authority = schemaAuthorityFromSource(files);
+  return Object.values(authority?.schema ?? {}).some((table) => table.client !== void 0) ? authority : void 0;
+}
+function schemaAuthorityFromSource(files) {
+  const source = files["db/schema.ts"];
+  if (source === void 0) return void 0;
+  const parsed = extractSchemaTs(source);
+  if (!parsed.ok) throw new Error(`Invalid db/schema.ts: ${parsed.errors.join(" ")}`);
+  const schema = {};
+  const intents = {};
+  const scopes = {};
+  for (const table of parsed.declaration.tables) {
+    const baked = bakedTableSchemaFromDeclared(JSON.stringify(canonicalTableShape(table)));
+    if (!baked) throw new Error(`Could not derive the client contract for declared table "${table.name}".`);
+    declareEntry(schema, table.name, baked);
+    declareEntry(intents, table.name, table.scope.kind === "owner" ? "scoped" : table.scope.kind);
+    if (table.scope.kind === "owner") declareEntry(scopes, table.name, table.scope.column);
+  }
+  return { schema, intents, scopes };
+}
+
+// declared-data-vendor-entry.js
+var import_typed_data = __toESM(require_typed_data());
+var import_schema_types = __toESM(require_schema_types());
+var import_runtime_types = __toESM(require_runtime_types());
+function generateFromFiles(files) {
+  const authority = clientAuthorityFromSource(files);
+  return authority ? (0, import_typed_data.generateDataClient)(authority) : void 0;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  RUNTIME_CONTEXT_DECLARATION,
+  SCHEMA_DECLARATION,
+  generateFromFiles
+});