@vantis/data 0.0.1

package/dist/index.mjs

@@ -0,0 +1,958 @@
+// src/verbs.ts
+var VERB_BRAND = /* @__PURE__ */ Symbol.for("@vantis/data:verb");
+function isVerbEnvelope(v) {
+  return v !== null && typeof v === "object" && v[VERB_BRAND] === true;
+}
+function makeVerb(op, props) {
+  const env = /* @__PURE__ */ Object.create(null);
+  Object.defineProperty(env, VERB_BRAND, {
+    value: true,
+    enumerable: false,
+    configurable: false,
+    writable: false
+  });
+  env["op"] = op;
+  if (props) {
+    for (const [k, vv] of Object.entries(props)) {
+      env[k] = vv;
+    }
+  }
+  return Object.freeze(env);
+}
+function numOp(n) {
+  return typeof n === "bigint" ? String(n) : n;
+}
+function increment(n) {
+  return makeVerb("increment", { v: numOp(n) });
+}
+function decrement(n) {
+  return makeVerb("decrement", { v: numOp(n) });
+}
+function multiply(n) {
+  return makeVerb("multiply", { v: numOp(n) });
+}
+function divide(n) {
+  return makeVerb("divide", { v: numOp(n) });
+}
+function min(v) {
+  return makeVerb("min", { v: numOp(v) });
+}
+function max(v) {
+  return makeVerb("max", { v: numOp(v) });
+}
+function toggle() {
+  return makeVerb("toggle");
+}
+function serverTimestamp() {
+  return makeVerb("serverTimestamp");
+}
+function concat(s) {
+  return makeVerb("concat", { v: s });
+}
+function merge(obj) {
+  return makeVerb("merge", { v: obj });
+}
+function jsonSet(path, v) {
+  return makeVerb("jsonSet", { path, v });
+}
+function setOnInsert(v) {
+  return makeVerb("setOnInsert", { v });
+}
+
+// src/errors.ts
+function makeConfigError(code, message) {
+  return { kind: "config", code, message, details: null, hint: null };
+}
+async function parsePostgRESTError(res) {
+  let code = "PGRST_UNKNOWN";
+  let message = `HTTP ${res.status} ${res.statusText}`;
+  let details = null;
+  let hint = null;
+  try {
+    const body = await res.json();
+    if (body !== null && typeof body === "object") {
+      const b = body;
+      if (typeof b["code"] === "string") code = b["code"];
+      if (typeof b["message"] === "string") message = b["message"];
+      if (typeof b["details"] === "string") details = b["details"];
+      else if (b["details"] == null) details = null;
+      if (typeof b["hint"] === "string") hint = b["hint"];
+      else if (b["hint"] == null) hint = null;
+    }
+  } catch {
+  }
+  return { kind: "postgrest", code, message, details, hint };
+}
+
+// src/client.ts
+var DEFAULT_TIMEOUT_MS = 3e4;
+var DEFAULT_RPC_TIMEOUT_MS = 65e3;
+function bigintReplacer(_key, value) {
+  return typeof value === "bigint" ? String(value) : value;
+}
+function resolveDataApiEnv() {
+  const _g = globalThis;
+  if (_g["window"] !== void 0 || _g["document"] !== void 0) {
+    return {
+      configError: makeConfigError(
+        "BROWSER_ENV",
+        "@vantis/data is server-only. DATA_API_TOKEN must never run in a browser. The client-side SDK is tracked as VAN-846."
+      )
+    };
+  }
+  const apiUrl = (typeof process !== "undefined" ? process.env["DATA_API_URL"] : void 0) ?? "";
+  const apiToken = (typeof process !== "undefined" ? process.env["DATA_API_TOKEN"] : void 0) ?? "";
+  if (!apiUrl) {
+    return {
+      configError: makeConfigError(
+        "MISSING_DATA_API_URL",
+        "DATA_API_URL is not set. Ensure this service has declared a --uses edge to a database block so Vantis injects the runtime env vars."
+      )
+    };
+  }
+  if (!apiToken) {
+    return {
+      configError: makeConfigError(
+        "MISSING_DATA_API_TOKEN",
+        "DATA_API_TOKEN is not set. Ensure this service has declared a --uses edge to a database block so Vantis injects the runtime env vars."
+      )
+    };
+  }
+  return { apiUrl, apiToken };
+}
+function translateWildcard(pattern) {
+  return pattern.replace(/%/g, "*");
+}
+function quoteInElement(v) {
+  const s = String(v);
+  if (/[,()"\\]/.test(s)) {
+    return `"${s.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+  }
+  return s;
+}
+function encodeIn(values) {
+  return `(${values.map(quoteInElement).join(",")})`;
+}
+function defaultState(tableName) {
+  return {
+    table: tableName,
+    filters: [],
+    selectCols: "*",
+    orderParts: [],
+    limitVal: null,
+    limitReferencedTable: null,
+    offsetVal: null,
+    countMode: null,
+    headMode: false,
+    singleMode: false,
+    maybeSingleMode: false,
+    writeOp: null,
+    writeBody: null,
+    writeSelect: false,
+    writeSelectCols: "*",
+    onConflict: null,
+    ignoreDuplicates: false,
+    embeds: [],
+    searchQuery: null,
+    searchLimit: null
+  };
+}
+var QueryBuilder = class {
+  _state;
+  constructor(tableName, state) {
+    this._state = state ?? defaultState(tableName);
+  }
+  // ─── Filters ────────────────────────────────────────────────────────────
+  /**
+   * Equality filter: column = value.
+   *
+   * The value is emitted raw (not quoted). URLSearchParams URL-encodes it, which
+   * is correct and sufficient for scalar operators — PostgREST takes the whole
+   * value after `eq.` and does NOT strip double-quotes for scalar ops (quoting
+   * would cause a literal string mismatch, e.g. `email=eq."a@b.com"` → 0 rows).
+   */
+  eq(col, val) {
+    this._assertNotSearch("eq");
+    this._state.filters.push(`${col}=eq.${String(val)}`);
+    return this;
+  }
+  /**
+   * Inequality filter: column != value.
+   *
+   * Value emitted raw — see eq() for the scalar-quoting rationale.
+   */
+  neq(col, val) {
+    this._assertNotSearch("neq");
+    this._state.filters.push(`${col}=neq.${String(val)}`);
+    return this;
+  }
+  /**
+   * Greater-than filter: column > value.
+   *
+   * Value emitted raw — see eq() for the scalar-quoting rationale.
+   */
+  gt(col, val) {
+    this._assertNotSearch("gt");
+    this._state.filters.push(`${col}=gt.${String(val)}`);
+    return this;
+  }
+  /**
+   * Greater-than-or-equal filter: column >= value.
+   *
+   * Value emitted raw — see eq() for the scalar-quoting rationale.
+   */
+  gte(col, val) {
+    this._assertNotSearch("gte");
+    this._state.filters.push(`${col}=gte.${String(val)}`);
+    return this;
+  }
+  /**
+   * Less-than filter: column < value.
+   *
+   * Value emitted raw — see eq() for the scalar-quoting rationale.
+   */
+  lt(col, val) {
+    this._assertNotSearch("lt");
+    this._state.filters.push(`${col}=lt.${String(val)}`);
+    return this;
+  }
+  /**
+   * Less-than-or-equal filter: column <= value.
+   *
+   * Value emitted raw — see eq() for the scalar-quoting rationale.
+   */
+  lte(col, val) {
+    this._assertNotSearch("lte");
+    this._state.filters.push(`${col}=lte.${String(val)}`);
+    return this;
+  }
+  /**
+   * LIKE filter. Pattern uses `%` (translated to PostgREST `*` on the wire)
+   * or `*` directly. Example: `.like('email', '%@example.com')`.
+   *
+   * The wildcard-translated pattern is emitted raw. URLSearchParams URL-encodes
+   * it, which is correct and sufficient — PostgREST takes the whole value after
+   * `like.` as the pattern. Do NOT quote like patterns: PostgREST does NOT strip
+   * double-quotes for scalar operators, so `like."a.b*"` would match a literal
+   * value containing `"` rather than performing `LIKE 'a.b%'`.
+   *
+   * NOTE: a LITERAL `*` in a user-supplied substring cannot be escaped —
+   * PostgREST has no like-escape mechanism and `*` is always the wildcard.
+   * Strip or reject literal `*` from user input at the call site if needed.
+   */
+  like(col, pattern) {
+    this._assertNotSearch("like");
+    this._state.filters.push(`${col}=like.${translateWildcard(pattern)}`);
+    return this;
+  }
+  /**
+   * Case-insensitive LIKE filter. Pattern uses `%` or `*`.
+   *
+   * Pattern emitted raw after wildcard translation — see like() for the
+   * scalar-quoting rationale.
+   */
+  ilike(col, pattern) {
+    this._assertNotSearch("ilike");
+    this._state.filters.push(`${col}=ilike.${translateWildcard(pattern)}`);
+    return this;
+  }
+  /**
+   * IN filter: column IN (values).
+   * Each element is quoted per the PostgREST URL grammar.
+   */
+  in(col, values) {
+    this._assertNotSearch("in");
+    this._state.filters.push(`${col}=in.${encodeIn(values)}`);
+    return this;
+  }
+  /**
+   * IS filter: column IS true/false/null.
+   * PostgREST wire: `?col=is.true` / `?col=is.false` / `?col=is.null`.
+   * Values are fixed keywords — NOT subject to quoteFilterValue.
+   */
+  is(col, val) {
+    this._assertNotSearch("is");
+    const wire = val === null ? "null" : val ? "true" : "false";
+    this._state.filters.push(`${col}=is.${wire}`);
+    return this;
+  }
+  select(columns, options) {
+    this._assertNotSearch("select");
+    if (this._state.writeOp !== null) {
+      this._state.writeSelect = true;
+      this._state.writeSelectCols = columns ?? "*";
+    } else {
+      this._state.selectCols = columns ?? "*";
+    }
+    if (options?.head) this._state.headMode = true;
+    if (options?.count) this._state.countMode = options.count;
+    return this;
+  }
+  // ─── FK embedding ────────────────────────────────────────────────────────
+  /**
+   * Embed a related table by FK.
+   *
+   * Adds the related table to the PostgREST select: `?select=*,<relatedTable>(*)`.
+   * PostgREST resolves the FK automatically (requires a schema-cache reload after
+   * FK changes — https://postgrest.org/en/v14/references/api/resource_embedding.html).
+   *
+   * The result row type gains `{ <relatedTable>: EmbedResult<TTableName, TEmbedTable> }`.
+   * The cardinality is resolved from the `Embeds` registry populated by `vantis data build`:
+   *   - `'one'` (FK column is the referencing table's PK) → single object `Schema[TEmbedTable]`.
+   *   - `'many'` (all other FKs — one-to-many inverse) → array `Schema[TEmbedTable][]`.
+   *   - Unregistered relationships default to the array form.
+   *
+   * @example
+   * ```ts
+   * // posts.user_id FK → users (many-to-one; Embeds says 'one')
+   * const result = await data.from('posts').embed('users');
+   * // result.data[0].users — Schema['users'] (object, not array)
+   *
+   * // users.id → posts (one-to-many; Embeds says 'many')
+   * const result2 = await data.from('users').embed('posts');
+   * // result2.data[0].posts — Schema['posts'][] (array)
+   * ```
+   */
+  embed(relatedTable) {
+    this._assertNotSearch("embed");
+    const name = relatedTable;
+    if (!this._state.embeds.includes(name)) {
+      this._state.embeds.push(name);
+    }
+    return this;
+  }
+  // ─── Modifiers ───────────────────────────────────────────────────────────
+  /**
+   * Order results by a column.
+   * @param col Column name.
+   * @param options ascending (default true), nullsFirst (default undefined), referencedTable.
+   */
+  order(col, options) {
+    this._assertNotSearch("order");
+    const asc = options?.ascending !== false;
+    const dir = asc ? "asc" : "desc";
+    const nulls = options?.nullsFirst === true ? ".nullsfirst" : options?.nullsFirst === false ? ".nullslast" : "";
+    const prefix = options?.referencedTable ? `${options.referencedTable}.` : "";
+    this._state.orderParts.push(`${prefix}${col}.${dir}${nulls}`);
+    return this;
+  }
+  /**
+   * Limit the number of rows returned.
+   *
+   * When `referencedTable` is set, emits `?<referencedTable>.limit=n` to limit
+   * an embedded resource (PostgREST embedded-resource limiting). Without
+   * `referencedTable`, emits the top-level `?limit=n`.
+   */
+  limit(n, options) {
+    this._assertNotSearch("limit");
+    this._state.limitVal = n;
+    if (options?.referencedTable) {
+      this._state.limitReferencedTable = options.referencedTable;
+    }
+    return this;
+  }
+  /**
+   * Return a range of rows by offset.
+   * @param from Start offset (0-indexed).
+   * @param to End offset (inclusive).
+   */
+  range(from, to) {
+    this._assertNotSearch("range");
+    this._state.offsetVal = from;
+    this._state.limitVal = to - from + 1;
+    return this;
+  }
+  // ─── Writes ──────────────────────────────────────────────────────────────
+  /**
+   * Insert one or more rows.
+   *
+   * By default returns `data: null` (PostgREST `return=minimal`).
+   * Chain `.select()` to get the inserted rows back (`return=representation`).
+   *
+   * When the Go emitter (`vantis data build`) has registered the table in
+   * `SchemaInsert`, the payload enforces required NOT-NULL-no-default columns
+   * at compile time. Tables not yet registered fall back to `Partial<Row>`.
+   */
+  insert(values) {
+    this._assertNotSearch("insert");
+    this._state.writeOp = "insert";
+    this._state.writeBody = values;
+    return this;
+  }
+  /**
+   * Update rows matching the current filters.
+   *
+   * By default returns `data: null`. Chain `.select()` for the updated rows.
+   *
+   * `values` is always `Partial<Row>` — you send only the columns to change.
+   * For insert/upsert, see `.insert()` and `.upsert()` (strict SchemaInsert typing).
+   */
+  update(values) {
+    this._assertNotSearch("update");
+    this._state.writeOp = "update";
+    this._state.writeBody = values;
+    return this;
+  }
+  /**
+   * Delete rows matching the current filters.
+   *
+   * By default returns `data: null`. Chain `.select()` for the deleted rows.
+   */
+  delete() {
+    this._assertNotSearch("delete");
+    this._state.writeOp = "delete";
+    this._state.writeBody = null;
+    return this;
+  }
+  /**
+   * Upsert one or more rows.
+   *
+   * Uses `POST + Prefer: resolution=merge-duplicates` (or `ignore-duplicates`).
+   * By default returns `data: null`. Chain `.select()` for the upserted rows.
+   */
+  upsert(values, options) {
+    this._assertNotSearch("upsert");
+    this._state.writeOp = "upsert";
+    this._state.writeBody = values;
+    if (options?.onConflict !== void 0) this._state.onConflict = options.onConflict;
+    if (options?.ignoreDuplicates === true) this._state.ignoreDuplicates = true;
+    return this;
+  }
+  // ─── Result narrowers ────────────────────────────────────────────────────
+  /**
+   * Expect exactly one row. Returns `data: TRow` (not an array).
+   * If zero or more than one row is returned, PostgREST returns a 406 and this
+   * resolves to an error.
+   *
+   * Sets `Accept: application/vnd.pgrst.object+json`.
+   */
+  single() {
+    this._assertNotSearch("single");
+    this._state.singleMode = true;
+    return this;
+  }
+  /**
+   * Expect zero or one row. Returns `data: TRow | null`.
+   *
+   * Client-side normalization (mirrors postgrest-js):
+   * - 0 rows → `{ data: null, error: null }` (no error)
+   * - 1 row → `{ data: <row>, error: null }`
+   * - >1 rows → `{ data: null, error: { code: 'PGRST116', ... } }`
+   *
+   * Uses the normal array `Accept: application/json` — PostgREST returns the
+   * array, and normalization happens client-side. This avoids the 406 that
+   * `vnd.pgrst.object+json` would return for 0 rows.
+   */
+  maybeSingle() {
+    this._assertNotSearch("maybeSingle");
+    this._state.maybeSingleMode = true;
+    return this;
+  }
+  // ─── Full-text search ────────────────────────────────────────────────────
+  /**
+   * Full-text search via the engine-provisioned rank RPC.
+   *
+   * Routes to `GET /rpc/search_<table>?query=<text>` (the PostgREST `/rpc`
+   * path, not the table path). Results are pre-sorted most-relevant-first by
+   * the server (`ts_rank_cd` ordering inside the function). Each result row
+   * carries a `rank` field — an OPAQUE ordering-only relevance score.
+   *
+   * The four swap invariants (VAN-830 / ADR-0044):
+   * (i)  One entry point — `.search(query, opts)`. Engine specifics never exposed.
+   * (ii) Text query in — engine-specific parsing is internal.
+   * (iii) Opaque `rank` — ordering-only, never normalized. A future BM25/rerank
+   *       swap changes the scale, not the contract.
+   * (iv) Pluggable transport — currently PostgREST `/rpc`; semantic search goes
+   *      to the AI gateway (opt-in, reserved).
+   *
+   * Security (INV-01/INV-02):
+   * - The query text is passed via URLSearchParams (URL-encoded by the browser
+   *   URLSearchParams API) — NOT double-quoted (no PostgREST scalar-op quoting
+   *   applies to RPC function arguments).
+   * - The DATA_API_TOKEN is in the Authorization header ONLY, never in the URL.
+   * - Filters/select/order from any previously chained methods are NOT emitted
+   *   in search mode — the RPC returns the full row shape + rank, ordered by
+   *   the server.
+   *
+   * Requires the table to have at least one `searchable: true` column in
+   * `vantis.schema.json` and a `vantis data apply` that provisions the search function.
+   *
+   * @example
+   * ```ts
+   * const result = await data.from('articles').search('hello world');
+   * if (result.error) { ... }
+   * for (const row of result.data) {
+   *   console.log(row.title, row.rank); // rank: opaque ordering-only score
+   * }
+   * ```
+   *
+   * With a limit:
+   * ```ts
+   * const result = await data.from('articles').search('typescript', { limit: 10 });
+   * ```
+   */
+  search(query, opts) {
+    const _s = this._state;
+    if (_s.filters.length > 0 || _s.embeds.length > 0 || _s.orderParts.length > 0 || _s.limitVal !== null || _s.offsetVal !== null || _s.selectCols !== "*" || _s.writeOp !== null || _s.singleMode || _s.headMode || _s.countMode !== null || _s.maybeSingleMode) {
+      throw new Error(
+        `@vantis/data: .search() must be called directly on data.from('${_s.table}') in v0 \u2014 it cannot be combined with .eq()/.select()/.order()/.embed()/.limit() or a write. Apply those before search is not yet supported; remove them or filter the returned results in code.`
+      );
+    }
+    this._state.searchQuery = query;
+    this._state.searchLimit = opts?.limit ?? null;
+    return this;
+  }
+  // ─── Atomic verb modifier ─────────────────────────────────────────────────
+  /**
+   * Atomically modify a single row via the server-side verb RPC
+   * (`__vantis_modify_<table>`). Each value in `ops` must be a VerbEnvelope
+   * returned by one of the verb helpers (increment, decrement, multiply, divide,
+   * min, max, toggle, serverTimestamp, concat, merge, jsonSet, setOnInsert).
+   * Bare objects or plain values are rejected synchronously.
+   *
+   * Wire: `POST /rpc/__vantis_modify_<table>`  `Content-Profile: api`
+   *   ```json
+   *   { "__vantis_match": {...}, "__vantis_ops": {...},
+   *     "__vantis_row"?: {...}, "__vantis_guard"?: {...} }
+   *   ```
+   *
+   * Returns:
+   * - `{ data: [row], error: null }` — applied (UPDATE path).
+   * - `{ data: [],   error: null }` — guard miss or row absent (not-applied).
+   *   Check `result.data?.length === 0` in your application logic.
+   * - `{ data: null, error }` — a DataError from PostgREST or the engine.
+   *
+   * Security: token in Authorization header only (INV-01/INV-02). Lazy env
+   * read (INV-11). Browser guard (secondary; browser.ts export condition is
+   * primary).
+   *
+   * @example
+   * ```ts
+   * const result = await data.from('orders').modify(
+   *   { total: increment(10) },
+   *   { id: orderId },
+   *   { guard: { total: { gte: 0 } } },
+   * );
+   * if (!result.error && result.data?.length === 0) {
+   *   // guard miss — row unchanged
+   * }
+   * ```
+   */
+  async modify(ops, match, opts) {
+    const _s = this._state;
+    if (_s.filters.length > 0 || _s.embeds.length > 0 || _s.orderParts.length > 0 || _s.limitVal !== null || _s.offsetVal !== null || _s.selectCols !== "*" || _s.writeOp !== null || _s.singleMode || _s.headMode || _s.countMode !== null || _s.maybeSingleMode || _s.searchQuery !== null) {
+      throw new Error(
+        `@vantis/data: .modify() must be called directly on data.from('${_s.table}') \u2014 it cannot be combined with filters, .select(), .order(), .embed(), .limit(), writes, or .search().`
+      );
+    }
+    const serializedOps = /* @__PURE__ */ Object.create(null);
+    for (const [col, envelope] of Object.entries(
+      ops
+    )) {
+      if (!isVerbEnvelope(envelope)) {
+        throw new Error(
+          `@vantis/data: .modify() ops['${col}'] is not a VerbEnvelope. Use a verb helper: increment(), decrement(), toggle(), serverTimestamp(), etc.`
+        );
+      }
+      const entry = { op: envelope.op };
+      if (envelope.v !== void 0) entry.v = envelope.v;
+      if (envelope.path !== void 0) entry.path = envelope.path;
+      serializedOps[col] = entry;
+    }
+    const body = /* @__PURE__ */ Object.create(null);
+    body["__vantis_match"] = match;
+    body["__vantis_ops"] = serializedOps;
+    if (opts?.upsert !== void 0) body["__vantis_row"] = opts.upsert;
+    if (opts?.guard !== void 0) body["__vantis_guard"] = opts.guard;
+    const rpcName = `__vantis_modify_${_s.table}`;
+    const rpcResult = await executeRpc(rpcName, body);
+    if (rpcResult.error) {
+      return {
+        data: null,
+        error: rpcResult.error,
+        count: null,
+        status: rpcResult.status,
+        statusText: rpcResult.statusText
+      };
+    }
+    if (rpcResult.data !== null) {
+      if (!Array.isArray(rpcResult.data)) {
+        return {
+          data: null,
+          error: makeConfigError(
+            "INVALID_RESPONSE",
+            `__vantis_modify_${_s.table} returned a non-array response body. Expected a JSON array (SETOF api.${_s.table}).`
+          ),
+          count: null,
+          status: rpcResult.status,
+          statusText: rpcResult.statusText
+        };
+      }
+      return {
+        data: rpcResult.data,
+        error: null,
+        count: null,
+        status: rpcResult.status,
+        statusText: rpcResult.statusText
+      };
+    }
+    return {
+      data: null,
+      error: makeConfigError(
+        "INVALID_RESPONSE",
+        `__vantis_modify_${_s.table} returned an unreadable response. Expected a JSON array (SETOF api.${_s.table}).`
+      ),
+      count: null,
+      status: rpcResult.status,
+      statusText: rpcResult.statusText
+    };
+  }
+  // ─── Private helpers ─────────────────────────────────────────────────────
+  /**
+   * Guard: throws synchronously if `.search()` has already been called on this
+   * builder. `.search()` is terminal in v0 — no mutator may be chained after it.
+   *
+   * Without this guard, a trailing mutator (e.g. `.eq()`) would modify `_state`
+   * fields that `_buildRequest`'s search branch silently ignores, producing an
+   * unscoped query that returns rows the caller did not intend to receive.
+   *
+   * Called at the top of every state-mutating method.
+   */
+  _assertNotSearch(method) {
+    if (this._state.searchQuery !== null) {
+      throw new Error(
+        `@vantis/data: .search() is terminal \u2014 ${method}() cannot be chained after .search() on '${this._state.table}'. Build filters/projection before .search() is not supported in v0.`
+      );
+    }
+  }
+  // ─── Thenable ────────────────────────────────────────────────────────────
+  then(onfulfilled, onrejected) {
+    return this._execute().then(onfulfilled, onrejected);
+  }
+  // ─── Execution ───────────────────────────────────────────────────────────
+  async _execute() {
+    const env = resolveDataApiEnv();
+    if ("configError" in env) {
+      return { data: null, error: env.configError, count: null, status: 0, statusText: "" };
+    }
+    const apiUrl = env.apiUrl;
+    const { url, method, headers, body } = this._buildRequest(apiUrl, env.apiToken);
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
+    try {
+      const res = await fetch(url, {
+        method,
+        headers,
+        body: body !== void 0 ? JSON.stringify(body, bigintReplacer) : void 0,
+        signal: controller.signal
+      });
+      return await this._parseResponse(res);
+    } catch (err) {
+      if (err instanceof Error && err.name === "AbortError") {
+        const dataErr2 = makeConfigError(
+          "TIMEOUT",
+          `Data API request timed out after ${DEFAULT_TIMEOUT_MS}ms.`
+        );
+        return { data: null, error: dataErr2, count: null, status: 0, statusText: "Timeout" };
+      }
+      const errName = err instanceof Error ? err.name : "UnknownError";
+      const dataErr = makeConfigError(
+        "NETWORK_ERROR",
+        `Data API request failed (${errName}). Check network connectivity and DATA_API_URL.`
+      );
+      return { data: null, error: dataErr, count: null, status: 0, statusText: "Network Error" };
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  _buildRequest(baseUrl, apiToken) {
+    const s = this._state;
+    const isWrite = s.writeOp !== null;
+    const isDelete = s.writeOp === "delete";
+    const isUpsert = s.writeOp === "upsert";
+    let method;
+    if (!isWrite) {
+      method = s.headMode ? "HEAD" : "GET";
+    } else {
+      switch (s.writeOp) {
+        case "insert":
+          method = "POST";
+          break;
+        case "upsert":
+          method = "POST";
+          break;
+        case "update":
+          method = "PATCH";
+          break;
+        case "delete":
+          method = "DELETE";
+          break;
+        default:
+          method = "GET";
+      }
+    }
+    const headers = {
+      // token is in Authorization header ONLY — never in URL, never in errors.
+      "Authorization": `Bearer ${apiToken}`
+    };
+    if (!isWrite) {
+      headers["Accept-Profile"] = "api";
+      headers["Accept"] = "application/json";
+    } else {
+      headers["Content-Profile"] = "api";
+      if (!isDelete) {
+        headers["Content-Type"] = "application/json";
+      }
+    }
+    const preferParts = [];
+    if (isWrite) {
+      if (s.writeSelect) {
+        preferParts.push("return=representation");
+      } else {
+        preferParts.push("return=minimal");
+      }
+    }
+    if (isUpsert) {
+      if (s.ignoreDuplicates) {
+        preferParts.push("resolution=ignore-duplicates");
+      } else {
+        preferParts.push("resolution=merge-duplicates");
+      }
+    }
+    if (!isWrite && s.countMode !== null) {
+      preferParts.push(`count=${s.countMode}`);
+    }
+    if (preferParts.length > 0) {
+      headers["Prefer"] = preferParts.join(",");
+    }
+    if (s.singleMode) {
+      headers["Accept"] = "application/vnd.pgrst.object+json";
+    }
+    if (s.searchQuery !== null) {
+      const rpcUrl = `${baseUrl.replace(/\/$/, "")}/rpc/search_${encodeURIComponent(s.table)}`;
+      const rpcParams = new URLSearchParams();
+      rpcParams.set("query", s.searchQuery);
+      if (s.searchLimit !== null) {
+        rpcParams.set("limit", String(s.searchLimit));
+      }
+      const rpcQs = rpcParams.toString();
+      return {
+        url: rpcQs ? `${rpcUrl}?${rpcQs}` : rpcUrl,
+        method: "GET",
+        // invariant: .search() guard ensures headMode=false + writeOp=null
+        headers,
+        // invariant: read-only headers only (Accept-Profile:api, Authorization)
+        body: void 0
+      };
+    }
+    const tableUrl = `${baseUrl.replace(/\/$/, "")}/${encodeURIComponent(s.table)}`;
+    const params = new URLSearchParams();
+    for (const f of s.filters) {
+      const eqIdx = f.indexOf("=");
+      if (eqIdx !== -1) {
+        params.append(f.slice(0, eqIdx), f.slice(eqIdx + 1));
+      }
+    }
+    let selectStr;
+    if (isWrite && s.writeSelect) {
+      selectStr = s.writeSelectCols;
+    } else {
+      selectStr = s.selectCols;
+    }
+    if (s.embeds.length > 0) {
+      const embedParts = s.embeds.map((e) => `${e}(*)`).join(",");
+      selectStr = `${selectStr},${embedParts}`;
+    }
+    if (selectStr !== "*" || s.embeds.length > 0) {
+      params.set("select", selectStr);
+    }
+    if (s.orderParts.length > 0) {
+      params.set("order", s.orderParts.join(","));
+    }
+    if (s.limitVal !== null) {
+      const limitKey = s.limitReferencedTable ? `${s.limitReferencedTable}.limit` : "limit";
+      params.set(limitKey, String(s.limitVal));
+    }
+    if (s.offsetVal !== null) params.set("offset", String(s.offsetVal));
+    if (isUpsert && s.onConflict !== null) {
+      params.set("on_conflict", s.onConflict);
+    }
+    const qs = params.toString();
+    const url = qs ? `${tableUrl}?${qs}` : tableUrl;
+    const body = !isWrite || isDelete ? void 0 : s.writeBody;
+    return { url, method, headers, body };
+  }
+  async _parseResponse(res) {
+    const s = this._state;
+    if (!res.ok) {
+      const error = await parsePostgRESTError(res);
+      return { data: null, error, count: null, status: res.status, statusText: res.statusText };
+    }
+    let count = null;
+    if (s.countMode !== null) {
+      const contentRange = res.headers.get("Content-Range");
+      if (contentRange) {
+        const slash = contentRange.indexOf("/");
+        if (slash !== -1) {
+          const totalStr = contentRange.slice(slash + 1);
+          if (totalStr !== "*") {
+            const parsed = parseInt(totalStr, 10);
+            if (!isNaN(parsed)) count = parsed;
+          }
+        }
+      }
+    }
+    let data2 = null;
+    const isMinimalWrite = s.writeOp !== null && !s.writeSelect;
+    if (!s.headMode && !isMinimalWrite) {
+      const text = await res.text();
+      if (text) {
+        try {
+          data2 = JSON.parse(text);
+        } catch {
+        }
+      }
+    }
+    if (isMinimalWrite) {
+      return { data: null, error: null, count, status: res.status, statusText: res.statusText };
+    }
+    if (s.headMode) {
+      return { data: null, error: null, count, status: res.status, statusText: res.statusText };
+    }
+    if (s.maybeSingleMode) {
+      if (!Array.isArray(data2)) {
+        return { data: null, error: null, count, status: res.status, statusText: res.statusText };
+      }
+      if (data2.length === 0) {
+        return { data: null, error: null, count, status: res.status, statusText: res.statusText };
+      }
+      if (data2.length > 1) {
+        const err = {
+          kind: "postgrest",
+          code: "PGRST116",
+          message: "The result contains 0 or more than 1 rows.",
+          details: null,
+          hint: null
+        };
+        return { data: null, error: err, count: null, status: res.status, statusText: res.statusText };
+      }
+      return { data: data2[0], error: null, count, status: res.status, statusText: res.statusText };
+    }
+    if (s.singleMode) {
+      return { data: data2, error: null, count, status: res.status, statusText: res.statusText };
+    }
+    return { data: data2, error: null, count, status: res.status, statusText: res.statusText };
+  }
+};
+async function executeRpc(name, args) {
+  const env = resolveDataApiEnv();
+  if ("configError" in env) {
+    return { data: null, error: env.configError, count: null, status: 0, statusText: "" };
+  }
+  const apiUrl = env.apiUrl;
+  const apiToken = env.apiToken;
+  const url = `${apiUrl.replace(/\/$/, "")}/rpc/${encodeURIComponent(name)}`;
+  const headers = {
+    "Authorization": `Bearer ${apiToken}`,
+    "Content-Profile": "api",
+    "Content-Type": "application/json",
+    "Accept": "application/json"
+  };
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DEFAULT_RPC_TIMEOUT_MS);
+  try {
+    const res = await fetch(url, {
+      method: "POST",
+      headers,
+      body: JSON.stringify(args ?? {}, bigintReplacer),
+      signal: controller.signal
+    });
+    if (!res.ok) {
+      const error = await parsePostgRESTError(res);
+      return { data: null, error, count: null, status: res.status, statusText: res.statusText };
+    }
+    let data2 = null;
+    if (res.status !== 204) {
+      const text = await res.text();
+      if (text) {
+        try {
+          data2 = JSON.parse(text);
+        } catch {
+          data2 = null;
+        }
+      }
+    }
+    return { data: data2, error: null, count: null, status: res.status, statusText: res.statusText };
+  } catch (err) {
+    if (err instanceof Error && err.name === "AbortError") {
+      return {
+        data: null,
+        error: makeConfigError("TIMEOUT", `Data API request timed out after ${DEFAULT_RPC_TIMEOUT_MS}ms.`),
+        count: null,
+        status: 0,
+        statusText: "Timeout"
+      };
+    }
+    const errName = err instanceof Error ? err.name : "UnknownError";
+    return {
+      data: null,
+      error: makeConfigError(
+        "NETWORK_ERROR",
+        `Data API request failed (${errName}). Check network connectivity and DATA_API_URL.`
+      ),
+      count: null,
+      status: 0,
+      statusText: "Network Error"
+    };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+var data = {
+  /**
+   * Start a query against the given table.
+   *
+   * `tableName` is typed as `keyof Schema` — the augmented Schema interface
+   * populated by `vantis data build`.
+   *
+   * Returns a `QueryBuilder` that is also PromiseLike — `await` it directly.
+   */
+  from(tableName) {
+    return new QueryBuilder(tableName);
+  },
+  /**
+   * Call a typed RPC (VAN-832). `data.run.<name>(args)` POSTs to /rpc/<name>
+   * and returns the typed result. Names + arg/return types come from the
+   * generated Rpc registry (`vantis data build`).
+   *
+   * @example
+   * ```ts
+   * const r = await data.run.place_order({ product_id: id, qty: 2 });
+   * if (r.error) { ... }
+   * const orderId = r.data; // typed from the fn() declaration
+   * ```
+   */
+  run: new Proxy({}, {
+    get(_target, prop) {
+      if (typeof prop !== "string") return void 0;
+      if (prop === "then" || prop === "catch" || prop === "finally") return void 0;
+      return (args) => executeRpc(prop, args);
+    }
+  })
+};
+export {
+  concat,
+  data,
+  decrement,
+  divide,
+  increment,
+  jsonSet,
+  max,
+  merge,
+  min,
+  multiply,
+  serverTimestamp,
+  setOnInsert,
+  toggle
+};
+//# sourceMappingURL=index.mjs.map