@vibeorm/schema 3.0.0 → 4.1.0

package/dist/index.js

@@ -18,6 +18,7 @@ var VIBE_ERROR_CODES = [
   "VIBE_READ_ONLY",
   "VIBE_RLS_CONTEXT",
   "VIBE_PERMISSION_DENIED",
+  "VIBE_CANCELLED",
   "VIBE_ADAPTER",
   "VIBE_ADAPTER_CLOSED",
   "VIBE_INTERNAL"
@@ -260,6 +261,7 @@ var POSTGRES_CAPABILITIES = Object.freeze({
   exclusionConstraints: true,
   exclusionExtensions: Object.freeze(["btree_gist"]),
   checkNormalization: "rollback",
+  schemaCheckExpressions: true,
   nativeRowLevelSecurity: true,
   returning: true,
   scalarArrays: true,
@@ -286,6 +288,7 @@ var SQLITE_CAPABILITIES = Object.freeze({
   exclusionConstraints: false,
   exclusionExtensions: Object.freeze([]),
   checkNormalization: "sourceText",
+  schemaCheckExpressions: false,
   nativeRowLevelSecurity: false,
   returning: true,
   scalarArrays: false,
@@ -312,6 +315,7 @@ var MYSQL_CAPABILITIES = Object.freeze({
   exclusionConstraints: false,
   exclusionExtensions: Object.freeze([]),
   checkNormalization: "temporary",
+  schemaCheckExpressions: false,
   nativeRowLevelSecurity: false,
   returning: false,
   scalarArrays: false,
@@ -337,6 +341,261 @@ var DIALECT_CAPABILITIES = Object.freeze({
   mysql: MYSQL_CAPABILITIES
 });
 
+// packages/schema/src/ir.ts
+var DIALECTS = ["postgres", "sqlite", "mysql"];
+function providerToDialect(params) {
+  const { provider } = params;
+  switch (provider) {
+    case "postgresql":
+    case "pglite":
+      return "postgres";
+    case "sqlite":
+      return "sqlite";
+    case "mysql":
+      return "mysql";
+  }
+}
+function isEnumType(fieldType) {
+  return typeof fieldType === "object" && "enum" in fieldType;
+}
+function fieldTypeIdentity(params) {
+  const { type } = params;
+  return isEnumType(type) ? type.namespace === undefined || type.namespace === "public" ? `enum:${type.enum}` : JSON.stringify(["enum", type.namespace, type.enum]) : type;
+}
+var ENUM_STORAGES = ["database", "string"];
+function enumStorageOf(params) {
+  return params.enumDef.storage ?? "database";
+}
+
+// packages/schema/src/native-rls-admission.ts
+function assertNativeRlsAdmission(params) {
+  const { schema } = params;
+  if (schema.rls === undefined && !schema.models.some((model) => model.rls !== undefined))
+    return;
+  const dialect = params.dialect ?? providerToDialect({ provider: schema.datasource.provider });
+  if (!DIALECT_CAPABILITIES[dialect].nativeRowLevelSecurity) {
+    throw unsupportedCapability({ dialect, feature: "nativeRowLevelSecurity" });
+  }
+  for (const model of schema.models) {
+    const rule = model.rls;
+    if (rule === undefined || rule === "unprotected")
+      continue;
+    const parentName = rule !== null && typeof rule === "object" && "through" in rule ? model.relations.find((relation) => relation.name === rule.through)?.targetModel : undefined;
+    const parent = parentName === undefined ? undefined : schema.models.find((entry) => entry.name === parentName);
+    if (model.namespace !== undefined && model.namespace !== "public" || parent?.namespace !== undefined && parent.namespace !== "public") {
+      throw unsupportedCapability({
+        dialect,
+        feature: "fixedNamespaceNativeRls",
+        hint: "Native RLS protects public tables only, including deny-protected models and through-policy parents"
+      });
+    }
+  }
+}
+// packages/schema/src/reserved.ts
+var RESERVED_DELEGATE_NAMES = [
+  "findMany",
+  "findPage",
+  "findFirst",
+  "findUnique",
+  "findFirstOrThrow",
+  "findUniqueOrThrow",
+  "create",
+  "createMany",
+  "createManyAndReturn",
+  "update",
+  "updateMany",
+  "updateManyAndReturn",
+  "upsert",
+  "upsertMany",
+  "delete",
+  "deleteMany",
+  "count",
+  "aggregate",
+  "groupBy",
+  "fields"
+];
+var RESERVED_CLIENT_NAMES = [
+  "$connect",
+  "$disconnect",
+  "$transaction",
+  "$querySql",
+  "$querySqlResult",
+  "$executeSql",
+  "$queryRaw",
+  "$queryRawUnsafe",
+  "$executeRaw",
+  "$executeRawUnsafe",
+  "$on",
+  "$extends",
+  "$defineView",
+  "$withPolicy",
+  "$bypassPolicy",
+  "$scoped",
+  "$readOnly",
+  "$models",
+  "$withContext",
+  "$advisoryLock",
+  "$tryAdvisoryLock"
+];
+var RESERVED_COLUMN_PREFIX = "__vibe_";
+function isReservedDelegateName(params) {
+  return RESERVED_DELEGATE_NAMES.includes(params.name);
+}
+function isReservedClientName(params) {
+  const withPrefix = params.name.startsWith("$") ? params.name : `$${params.name}`;
+  return RESERVED_CLIENT_NAMES.includes(withPrefix);
+}
+
+// packages/schema/src/extension.ts
+function stableSerialize(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "undefined";
+  if (Array.isArray(value))
+    return `[${value.map(stableSerialize).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function extensionOptionsHash(params) {
+  const text = stableSerialize(params.options);
+  let hash = 2166136261;
+  for (let index = 0;index < text.length; index += 1) {
+    hash ^= text.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function extensionManifestEntry(params) {
+  const { extension } = params;
+  return {
+    name: extension.name,
+    version: extension.version,
+    optionsHash: extensionOptionsHash({ options: extension.options })
+  };
+}
+var EXTENSION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+function defineExtension(extension) {
+  const { name } = extension;
+  if (!EXTENSION_NAME_PATTERN.test(name)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" is invalid \u2014 must match ${EXTENSION_NAME_PATTERN} (it becomes a client identifier)`,
+      meta: { name }
+    });
+  }
+  if (RESERVED_DELEGATE_NAMES.includes(name)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" collides with a core delegate method`,
+      meta: { name }
+    });
+  }
+  if (RESERVED_CLIENT_NAMES.includes(`$${name}`)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" collides with the core client method "$${name}"`,
+      meta: { name }
+    });
+  }
+  return Object.freeze(extension);
+}
+function buildExtensionRegistry(params) {
+  const byName = new Map;
+  const modelAttributes = new Map;
+  const fieldTypes = new Map;
+  for (const extension of params.extensions) {
+    if (byName.has(extension.name)) {
+      throw new VibeError({
+        code: "VIBE_CONFIG",
+        message: `duplicate extension name "${extension.name}" in the configured extension list`,
+        meta: { name: extension.name }
+      });
+    }
+    byName.set(extension.name, extension);
+    for (const attribute of extension.schema?.modelAttributes ?? []) {
+      const existing = modelAttributes.get(attribute.name);
+      if (existing !== undefined) {
+        throw new VibeError({
+          code: "VIBE_CONFIG",
+          message: `model attribute "@@${attribute.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
+          meta: { attribute: attribute.name }
+        });
+      }
+      modelAttributes.set(attribute.name, { extension, attribute });
+    }
+    for (const fieldType of extension.schema?.fieldTypes ?? []) {
+      const existing = fieldTypes.get(fieldType.name);
+      if (existing !== undefined) {
+        throw new VibeError({
+          code: "VIBE_CONFIG",
+          message: `field type "${fieldType.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
+          meta: { fieldType: fieldType.name }
+        });
+      }
+      fieldTypes.set(fieldType.name, { extension, fieldType });
+    }
+  }
+  return { extensions: params.extensions, byName, modelAttributes, fieldTypes };
+}
+var EMPTY_EXTENSION_REGISTRY = buildExtensionRegistry({
+  extensions: []
+});
+var PUBLIC_ONLY_EXTENSIONS = ["search", "vector", "trgm"];
+function hasPublicExtensionDeclaration(params) {
+  return PUBLIC_ONLY_EXTENSIONS.some((name) => Object.hasOwn(extensionDeclarations({ schema: params.schema, name }), params.model));
+}
+function assertExtensionModelPlacement(params) {
+  if (params.namespace !== undefined && params.namespace !== "public") {
+    throw unsupportedCapability({ dialect: params.dialect ?? "postgres", feature: "fixedNamespaceExtensions", hint: "Search, vector and trigram extensions currently require public table placement" });
+  }
+}
+function assertExtensionPlacement(params) {
+  const dialect = params.dialect ?? providerToDialect({ provider: params.schema.datasource.provider });
+  for (const extension of params.schema.extensions) {
+    if (!PUBLIC_ONLY_EXTENSIONS.includes(extension.name))
+      continue;
+    const declarations = extensionDeclarations({ schema: params.schema, name: extension.name });
+    for (const model of params.schema.models) {
+      if (Object.hasOwn(declarations, model.name))
+        assertExtensionModelPlacement({ namespace: model.namespace, dialect });
+    }
+  }
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeExtensionDeclarations(params) {
+  if (params.extension !== undefined && PUBLIC_ONLY_EXTENSIONS.includes(params.extension) && Array.isArray(params.base.fields) && Array.isArray(params.next.fields)) {
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: `Repeated index-bearing ${params.extension} declarations are unsupported; use one common-configuration multi-field declaration`, meta: { rule: "repeated-extension-declaration", extension: params.extension } });
+  }
+  const out = { ...params.base };
+  for (const [key, value] of Object.entries(params.next)) {
+    const existing = out[key];
+    out[key] = isPlainObject(existing) && isPlainObject(value) ? { ...existing, ...value } : value;
+  }
+  return out;
+}
+function extensionDeclarations(params) {
+  const decl = params.schema.extensions.find((entry) => entry.name === params.name);
+  if (decl === undefined)
+    return {};
+  const models = decl.options["models"];
+  if (models === null || typeof models !== "object" || Array.isArray(models))
+    return {};
+  return models;
+}
+
+// packages/schema/src/model-sql-namespace.ts
+function modelSqlNamespace(params) {
+  const { schema, model } = params;
+  if (model.namespace !== undefined || (params.dialect ?? providerToDialect({ provider: schema.datasource.provider })) !== "postgres")
+    return model.namespace;
+  const protectedModel = model.rls !== undefined && model.rls !== "unprotected";
+  const throughParent = schema.models.some((child) => {
+    const rule = child.rls;
+    return rule !== null && typeof rule === "object" && "through" in rule && child.relations.some((relation) => relation.name === rule.through && relation.targetModel === model.name);
+  });
+  return protectedModel || throughParent || hasPublicExtensionDeclaration({ schema, model: model.name }) ? SQL_NAMESPACES.postgres : undefined;
+}
 // packages/schema/src/migration-objects.ts
 function sqlObjectKey(params) {
   const object = params.identity;
@@ -536,32 +795,6 @@ function assertIndexOperatorClasses(params) {
           throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Index operator class must be a qualified SQL name { namespace, name }", meta: { rule: "index-operator-class-identity", model: model.name, field: field.name } });
       }
 }
-// packages/schema/src/ir.ts
-var DIALECTS = ["postgres", "sqlite", "mysql"];
-function providerToDialect(params) {
-  const { provider } = params;
-  switch (provider) {
-    case "postgresql":
-    case "pglite":
-      return "postgres";
-    case "sqlite":
-      return "sqlite";
-    case "mysql":
-      return "mysql";
-  }
-}
-function isEnumType(fieldType) {
-  return typeof fieldType === "object" && "enum" in fieldType;
-}
-function fieldTypeIdentity(params) {
-  const { type } = params;
-  return isEnumType(type) ? type.namespace === undefined || type.namespace === "public" ? `enum:${type.enum}` : JSON.stringify(["enum", type.namespace, type.enum]) : type;
-}
-var ENUM_STORAGES = ["database", "string"];
-function enumStorageOf(params) {
-  return params.enumDef.storage ?? "database";
-}
-
 // packages/schema/src/module-schema.ts
 function prepareDatabaseModuleSchema(params) {
   const { schema, module } = params;
@@ -610,36 +843,121 @@ function isPredicateFieldRef(operand) {
   return operand.kind === "field";
 }
 function predicateFieldNames(params) {
-  const seen = new Set;
+  return [...new Set(inspectPredicate(params).expressions.flatMap((expression) => expression.kind === "field" ? [expression.name] : []))];
+}
+function inspectPredicate(params) {
+  const expressions = [];
+  let checkOnly = false;
+  const expression = (node) => {
+    if (typeof node !== "object" || node === null)
+      throw invalidOperand();
+    switch (node.kind) {
+      case "field":
+        expressions.push(node);
+        return;
+      case "jsonText":
+        if (typeof node.field !== "object" || node.field === null || node.field.kind !== "field")
+          throw invalidOperand();
+        expressions.push(node);
+        checkOnly = true;
+        expression(node.field);
+        return;
+      case "length":
+        expressions.push(node);
+        checkOnly = true;
+        expression(node.expression);
+        return;
+      default:
+        throw invalidOperand();
+    }
+  };
   const walk = (node) => {
     switch (node.kind) {
       case "compare":
-        seen.add(node.left.name);
-        if (isPredicateFieldRef(node.right))
-          seen.add(node.right.name);
+        expression(node.left);
+        if (typeof node.right !== "object" || node.right === null || node.right.kind !== "value")
+          expression(node.right);
         return;
       case "inList":
       case "isNull":
-        seen.add(node.field.name);
+        expression(node.field);
         return;
       case "and":
       case "or":
         for (const operand of node.operands)
           walk(operand);
         return;
+      case "isTrue":
+        checkOnly = true;
+        walk(node.operand);
+        return;
       case "not":
         walk(node.operand);
         return;
     }
   };
   walk(params.predicate);
-  return [...seen];
+  return { expressions, checkOnly };
+}
+function invalidOperand() {
+  return new VibeError({
+    code: "VIBE_SCHEMA_INVALID",
+    message: "A schema predicate operand must be a field, jsonText or length expression, or a literal on the right of a comparison",
+    meta: { rule: "predicate-operand-invalid" }
+  });
+}
+function assertPredicateCapabilities(params) {
+  if (!inspectPredicate(params).checkOnly)
+    return;
+  if (params.usage !== "check")
+    throw unsupportedCapability({ dialect: params.dialect, feature: "schema CHECK expressions outside CHECK constraints" });
+  if (!DIALECT_CAPABILITIES[params.dialect].schemaCheckExpressions)
+    throw unsupportedCapability({ dialect: params.dialect, feature: "schemaCheckExpressions" });
 }
 function predicateKey(params) {
+  if (inspectPredicate(params).checkOnly) {
+    const scalar = (node) => {
+      switch (node.kind) {
+        case "field":
+          return ["field", node.name];
+        case "jsonText":
+          return ["jsonText", node.field.name, node.path];
+        case "length":
+          return ["length", scalar(node.expression)];
+      }
+    };
+    const key = (node) => {
+      switch (node.kind) {
+        case "compare":
+          return [node.kind, node.op, scalar(node.left), node.right.kind === "value" ? ["value", node.right.value] : scalar(node.right)];
+        case "inList":
+          return [node.kind, node.field.name, node.negate === true, node.values.map((value) => value.value)];
+        case "isNull":
+          return [node.kind, node.field.name, node.negate === true];
+        case "and":
+        case "or":
+          return [node.kind, node.operands.map(key)];
+        case "not":
+        case "isTrue":
+          return [node.kind, key(node.operand)];
+      }
+    };
+    return `check:${JSON.stringify(key(params.predicate))}`;
+  }
+  const expression = (node) => {
+    switch (node.kind) {
+      case "field":
+        return `f:${node.name}`;
+      case "jsonText":
+        return `jsonText(${JSON.stringify([node.field.name, node.path])})`;
+      case "length":
+        return `length(${expression(node.expression)})`;
+    }
+  };
   const encode = (node) => {
     switch (node.kind) {
       case "compare":
-        return `cmp(${node.op},${node.left.name},${isPredicateFieldRef(node.right) ? `f:${node.right.name}` : `v:${typeof node.right.value}:${String(node.right.value)}`})`;
+        return `cmp(${node.op},${node.left.kind === "field" ? node.left.name : expression(node.left)},${node.right.kind === "value" ? `v:${typeof node.right.value}:${String(node.right.value)}` : expression(node.right)})`;
       case "inList":
         return `in${node.negate === true ? "!" : ""}(${node.field.name},[${node.values.map((entry) => `${typeof entry.value}:${String(entry.value)}`).join("|")}])`;
       case "isNull":
@@ -649,6 +967,8 @@ function predicateKey(params) {
         return `${node.kind}(${node.operands.map(encode).join(",")})`;
       case "not":
         return `not(${encode(node.operand)})`;
+      case "isTrue":
+        return `isTrue(${encode(node.operand)})`;
     }
   };
   return encode(params.predicate);
@@ -775,172 +1095,6 @@ function exactDecimalLiteral(params) {
   const mantissa = text.replace(/[eE].*$/, "").replace("-", "").replace(".", "").replace(/^0+/, "");
   return mantissa.length <= 15 ? Number(text) : text;
 }
-// packages/schema/src/reserved.ts
-var RESERVED_DELEGATE_NAMES = [
-  "findMany",
-  "findPage",
-  "findFirst",
-  "findUnique",
-  "findFirstOrThrow",
-  "findUniqueOrThrow",
-  "create",
-  "createMany",
-  "createManyAndReturn",
-  "update",
-  "updateMany",
-  "updateManyAndReturn",
-  "upsert",
-  "upsertMany",
-  "delete",
-  "deleteMany",
-  "count",
-  "aggregate",
-  "groupBy",
-  "fields"
-];
-var RESERVED_CLIENT_NAMES = [
-  "$connect",
-  "$disconnect",
-  "$transaction",
-  "$querySql",
-  "$executeSql",
-  "$queryRaw",
-  "$queryRawUnsafe",
-  "$executeRaw",
-  "$executeRawUnsafe",
-  "$on",
-  "$extends",
-  "$defineView",
-  "$withPolicy",
-  "$bypassPolicy",
-  "$scoped",
-  "$readOnly",
-  "$models",
-  "$withContext",
-  "$advisoryLock",
-  "$tryAdvisoryLock"
-];
-var RESERVED_COLUMN_PREFIX = "__vibe_";
-function isReservedDelegateName(params) {
-  return RESERVED_DELEGATE_NAMES.includes(params.name);
-}
-function isReservedClientName(params) {
-  const withPrefix = params.name.startsWith("$") ? params.name : `$${params.name}`;
-  return RESERVED_CLIENT_NAMES.includes(withPrefix);
-}
-// packages/schema/src/extension.ts
-function stableSerialize(value) {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value) ?? "undefined";
-  if (Array.isArray(value))
-    return `[${value.map(stableSerialize).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`);
-  return `{${entries.join(",")}}`;
-}
-function extensionOptionsHash(params) {
-  const text = stableSerialize(params.options);
-  let hash = 2166136261;
-  for (let index = 0;index < text.length; index += 1) {
-    hash ^= text.charCodeAt(index);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-}
-function extensionManifestEntry(params) {
-  const { extension } = params;
-  return {
-    name: extension.name,
-    version: extension.version,
-    optionsHash: extensionOptionsHash({ options: extension.options })
-  };
-}
-var EXTENSION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
-function defineExtension(extension) {
-  const { name } = extension;
-  if (!EXTENSION_NAME_PATTERN.test(name)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" is invalid \u2014 must match ${EXTENSION_NAME_PATTERN} (it becomes a client identifier)`,
-      meta: { name }
-    });
-  }
-  if (RESERVED_DELEGATE_NAMES.includes(name)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" collides with a core delegate method`,
-      meta: { name }
-    });
-  }
-  if (RESERVED_CLIENT_NAMES.includes(`$${name}`)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" collides with the core client method "$${name}"`,
-      meta: { name }
-    });
-  }
-  return Object.freeze(extension);
-}
-function buildExtensionRegistry(params) {
-  const byName = new Map;
-  const modelAttributes = new Map;
-  const fieldTypes = new Map;
-  for (const extension of params.extensions) {
-    if (byName.has(extension.name)) {
-      throw new VibeError({
-        code: "VIBE_CONFIG",
-        message: `duplicate extension name "${extension.name}" in the configured extension list`,
-        meta: { name: extension.name }
-      });
-    }
-    byName.set(extension.name, extension);
-    for (const attribute of extension.schema?.modelAttributes ?? []) {
-      const existing = modelAttributes.get(attribute.name);
-      if (existing !== undefined) {
-        throw new VibeError({
-          code: "VIBE_CONFIG",
-          message: `model attribute "@@${attribute.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
-          meta: { attribute: attribute.name }
-        });
-      }
-      modelAttributes.set(attribute.name, { extension, attribute });
-    }
-    for (const fieldType of extension.schema?.fieldTypes ?? []) {
-      const existing = fieldTypes.get(fieldType.name);
-      if (existing !== undefined) {
-        throw new VibeError({
-          code: "VIBE_CONFIG",
-          message: `field type "${fieldType.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
-          meta: { fieldType: fieldType.name }
-        });
-      }
-      fieldTypes.set(fieldType.name, { extension, fieldType });
-    }
-  }
-  return { extensions: params.extensions, byName, modelAttributes, fieldTypes };
-}
-var EMPTY_EXTENSION_REGISTRY = buildExtensionRegistry({
-  extensions: []
-});
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function mergeExtensionDeclarations(params) {
-  const out = { ...params.base };
-  for (const [key, value] of Object.entries(params.next)) {
-    const existing = out[key];
-    out[key] = isPlainObject(existing) && isPlainObject(value) ? { ...existing, ...value } : value;
-  }
-  return out;
-}
-function extensionDeclarations(params) {
-  const decl = params.schema.extensions.find((entry) => entry.name === params.name);
-  if (decl === undefined)
-    return {};
-  const models = decl.options["models"];
-  if (models === null || typeof models !== "object" || Array.isArray(models))
-    return {};
-  return models;
-}
 // packages/schema/src/computed.ts
 function buildComputedManifest(params) {
   const { computed } = params;
@@ -1097,6 +1251,80 @@ function scalarListDefault(params) {
   });
 }
 
+// packages/schema/src/json-schema-ref.ts
+var EXPORT_NAME = /^[$_\p{ID_Start}][$_\u200c\u200d\p{ID_Continue}]*$/u;
+var REFERENCE_ANNOTATION = /@(schema|type)\(\s*([$_\p{ID_Start}][$_\u200c\u200d\p{ID_Continue}]*)\s+from\s+("(?:[^"\\\r\n]|\\.)*")\s*\)/gu;
+function annotations(params) {
+  const matches = [...params.documentation.matchAll(REFERENCE_ANNOTATION)].filter((match) => match[1] === params.kind);
+  const remaining = params.documentation.replace(REFERENCE_ANNOTATION, "");
+  const malformed = remaining.match(params.kind === "schema" ? /@schema(?=\s*\(|\s|$)/gu : /@type(?=\s*\(|\s|$)/gu) ?? [];
+  return { matches, count: matches.length + malformed.length };
+}
+function hasJsonSchemaAnnotation(params) {
+  return annotations({ documentation: params.documentation ?? "", kind: "schema" }).count > 0;
+}
+function jsonTypeAnnotationIssue(params) {
+  const refs = annotations({ documentation: params.documentation ?? "", kind: "type" });
+  if (refs.count === 0)
+    return;
+  if (refs.count > 1)
+    return "A field may declare only one assertion-only JSON type";
+  const match = refs.matches[0];
+  if (match === undefined)
+    return 'Expected @type(Name from "specifier")';
+  return jsonSchemaRefIssue({ value: { name: match[2], from: decodePrismaString({ raw: match[3] }) } });
+}
+function jsonTypeAnnotationRef(params) {
+  const issue = jsonTypeAnnotationIssue(params);
+  if (issue !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issue, meta: { issues: [{ rule: "invalid-json-type-ref", message: issue }] } });
+  const match = annotations({ documentation: params.documentation ?? "", kind: "type" }).matches[0];
+  return match === undefined ? undefined : assertJsonSchemaRef({ value: { name: match[2], from: decodePrismaString({ raw: match[3] }) } });
+}
+function jsonSchemaRefIssue(params) {
+  const { value } = params;
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return "JSON schema reference must be { name, from }; validators belong in the referenced export";
+  const keys = Reflect.ownKeys(value);
+  if (keys.length !== 2 || !keys.includes("name") || !keys.includes("from"))
+    return "JSON schema reference accepts only name and from";
+  const name = Object.getOwnPropertyDescriptor(value, "name");
+  const from = Object.getOwnPropertyDescriptor(value, "from");
+  if (name?.enumerable !== true || !("value" in name) || typeof name.value !== "string" || !EXPORT_NAME.test(name.value) || name.value === "default")
+    return "JSON schema name must be a valid named export, not default";
+  if (from?.enumerable !== true || !("value" in from) || typeof from.value !== "string" || from.value.trim().length === 0 || /[\u0000-\u001f\u007f]/u.test(from.value))
+    return "JSON schema from must be a non-empty import specifier without control characters";
+  return;
+}
+function assertJsonSchemaRef(params) {
+  const issue = jsonSchemaRefIssue(params);
+  if (issue !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issue, meta: { issues: [{ rule: "invalid-json-schema-ref", message: issue }] } });
+  const value = params.value;
+  return Object.freeze({ name: value.name, from: value.from });
+}
+function normalizeJsonSchemaRef(params) {
+  const { documentation, reference } = params;
+  const jsonType = jsonTypeAnnotationRef({ documentation });
+  const refs = annotations({ documentation: documentation ?? "", kind: "schema" });
+  let jsonSchema = reference === undefined ? undefined : assertJsonSchemaRef({ value: reference });
+  let remaining = documentation;
+  if (refs.count > 1 || refs.count > 0 && jsonSchema !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "A field may declare only one JSON schema reference", meta: { issues: [{ rule: "duplicate-json-schema-ref" }] } });
+  if (refs.count === 1) {
+    const match = refs.matches[0];
+    if (match === undefined)
+      throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: 'Expected @schema(Name from "specifier")', meta: { issues: [{ rule: "invalid-json-schema-ref" }] } });
+    jsonSchema = assertJsonSchemaRef({ value: { name: match[2], from: decodePrismaString({ raw: match[3] }) } });
+    remaining = documentation?.replace(match[0], "").trim();
+    if (remaining === "")
+      remaining = undefined;
+  }
+  if (jsonSchema !== undefined && jsonType !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "JSON schema validation and assertion-only @type cannot be combined on one field", meta: { issues: [{ rule: "conflicting-json-schema-ref" }] } });
+  return { ...remaining === undefined ? {} : { documentation: remaining }, ...jsonSchema === undefined ? {} : { jsonSchema } };
+}
+
 // packages/schema/src/m2m.ts
 function implicitJoinTable(params) {
   const sorted = [params.modelA, params.modelB].sort();
@@ -1122,6 +1350,8 @@ var RESERVED_ENUM_NAMES = [
   "SqlColumn",
   "SqlFragment",
   "ResultDecoder",
+  "ResultReadDecoder",
+  "SqlQueryResult",
   "ExtendedDateTime",
   "enumValidators",
   "enumValidator",
@@ -1178,6 +1408,9 @@ var RESERVED_ENUM_NAMES = [
   "InputJsonValue",
   "InputJsonArray",
   "InputJsonObject",
+  "BoundJsonFilter",
+  "BoundJsonFilterCommon",
+  "BoundJsonNullableFilter",
   "VibeTelemetryOptions",
   "VibeTelemetryExporter",
   "VibeTelemetryOperationEvent",
@@ -1874,6 +2107,23 @@ function validateModel(params) {
       });
     }
     memberNames.add(field.name);
+    const typedIssue = jsonTypeAnnotationIssue({ documentation: field.documentation });
+    if (typedIssue !== undefined)
+      issues.push({ rule: "invalid-json-type-ref", message: typedIssue, model: model.name, field: field.name });
+    const hasType = typedIssue === undefined && jsonTypeAnnotationRef({ documentation: field.documentation }) !== undefined;
+    if (hasType && field.type !== "Json")
+      issues.push({ rule: "json-type-non-json", message: "JSON type assertions are only valid on Json fields", model: model.name, field: field.name });
+    if (field.jsonSchema !== undefined) {
+      const issue = jsonSchemaRefIssue({ value: field.jsonSchema });
+      if (issue !== undefined)
+        issues.push({ rule: "invalid-json-schema-ref", message: issue, model: model.name, field: field.name });
+      if (field.type !== "Json" || field.isUnsupported === true)
+        issues.push({ rule: "json-schema-non-json", message: "JSON schemas are only valid on queryable Json fields", model: model.name, field: field.name });
+      if (hasType)
+        issues.push({ rule: "conflicting-json-schema-ref", message: "A field cannot declare both @type and a JSON schema", model: model.name, field: field.name });
+    }
+    if (hasJsonSchemaAnnotation({ documentation: field.documentation }))
+      issues.push({ rule: "unnormalized-json-schema-ref", message: "Normalize @schema documentation into FieldIR.jsonSchema before consuming SchemaIR", model: model.name, field: field.name });
     const typeIdentity = field.nativeTypeIdentity;
     if (typeIdentity !== undefined && (typeIdentity === null || typeof typeIdentity !== "object" || field.isUnsupported !== true || typeof typeIdentity.source !== "string" || typeIdentity.source !== field.nativeType || typeof typeIdentity.namespace !== "string" || typeIdentity.namespace.length === 0 || typeIdentity.namespace.includes("\x00"))) {
       issues.push({ rule: "invalid-native-type-identity", message: `PostgreSQL type identity on "${model.name}.${field.name}" must be bound to its unsupported declaration`, model: model.name, field: field.name });
@@ -2117,6 +2367,8 @@ function validateModel(params) {
         model,
         fieldNames,
         site: `CHECK "${check.name}"`,
+        usage: "check",
+        dialect: providerToDialect({ provider: params.schema.datasource.provider }),
         issues
       });
     }
@@ -2138,13 +2390,55 @@ function validateModel(params) {
         model,
         fieldNames,
         site: `partial index on [${index.fields.map((entry) => entry.name).join(", ")}]`,
+        usage: "indexPredicate",
+        dialect: providerToDialect({ provider: params.schema.datasource.provider }),
         issues
       });
     }
   }
+  for (const exclusion of model.exclusions ?? []) {
+    const predicate = exclusion.source?.where;
+    if (predicate !== undefined)
+      validatePredicateFields({ predicate, model, fieldNames, site: `exclusion "${exclusion.name}"`, usage: "exclusionPredicate", dialect: providerToDialect({ provider: params.schema.datasource.provider }), issues });
+  }
 }
 function validatePredicateFields(params) {
   const { predicate, model, fieldNames, site, issues } = params;
+  const inspection = inspectPredicate({ predicate });
+  if (inspection.checkOnly && (params.usage !== "check" || !DIALECT_CAPABILITIES[params.dialect].schemaCheckExpressions)) {
+    issues.push({ rule: "predicate-check-capability", message: `${site}: computed schema predicates require a PostgreSQL CHECK`, model: model.name });
+  }
+  const expressionType = (expression) => {
+    if (expression.kind === "field")
+      return model.fields.find((field) => field.name === expression.name)?.type;
+    if (expression.kind === "jsonText") {
+      const field = model.fields.find((candidate) => candidate.name === expression.field.name);
+      if (field !== undefined && (field.type !== "Json" || field.isUnsupported === true))
+        issues.push({ rule: "predicate-type-mismatch", message: `${site}: jsonText requires a Json field`, model: model.name, field: field.name });
+      if (!Array.isArray(expression.path) || Array.from(expression.path).some((segment) => typeof segment !== "string" || segment.includes("\x00")))
+        issues.push({ rule: "predicate-json-path", message: `${site}: jsonText requires a string-only path without NUL bytes`, model: model.name });
+      return "String";
+    }
+    if (expressionType(expression.expression) !== "String")
+      issues.push({ rule: "predicate-type-mismatch", message: `${site}: length requires a text expression`, model: model.name });
+    return "Int";
+  };
+  const validateComputedComparisons = (node) => {
+    if (node.kind === "compare") {
+      if (node.left.kind !== "field" || node.right.kind !== "value" && node.right.kind !== "field") {
+        const left = expressionType(node.left);
+        const right = node.right.kind === "value" ? undefined : expressionType(node.right);
+        if (left !== undefined && right !== undefined && left !== right)
+          issues.push({ rule: "predicate-type-mismatch", message: `${site}: computed comparison operands must have the same scalar type`, model: model.name });
+        if (node.right.kind === "value" && left === "String" && typeof node.right.value !== "string")
+          issues.push({ rule: "predicate-type-mismatch", message: `${site}: a text expression requires a string literal`, model: model.name });
+      }
+    } else if (node.kind === "and" || node.kind === "or")
+      node.operands.forEach(validateComputedComparisons);
+    else if (node.kind === "not" || node.kind === "isTrue")
+      validateComputedComparisons(node.operand);
+  };
+  validateComputedComparisons(predicate);
   for (const name of predicateFieldNames({ predicate })) {
     if (!fieldNames.has(name)) {
       issues.push({
@@ -2155,7 +2449,10 @@ function validatePredicateFields(params) {
       });
       continue;
     }
-    if (model.fields.find((field) => field.name === name)?.isList === true) {
+    const referenced = model.fields.find((field) => field.name === name);
+    if (inspection.checkOnly && referenced?.isUnsupported === true)
+      issues.push({ rule: "predicate-unsupported-type", message: `${site}: computed predicates cannot reference unsupported fields`, model: model.name, field: name });
+    if (referenced?.isList === true) {
       issues.push({
         rule: "predicate-list-field",
         message: `${site} on "${model.name}" compares scalar list "${name}" \u2014 use a raw expression for array operators`,
@@ -2167,6 +2464,8 @@ function validatePredicateFields(params) {
 }
 function assertValidSchemaIR(params) {
   const dialect = providerToDialect({ provider: params.schema.datasource.provider });
+  assertNativeRlsAdmission({ schema: params.schema, dialect });
+  assertExtensionPlacement({ schema: params.schema, dialect });
   assertIndexOperatorClasses({ schema: params.schema, dialect });
   for (const entry of [...params.schema.models, ...params.schema.enums])
     if (entry.namespace !== undefined)
@@ -2182,6 +2481,12 @@ function assertValidSchemaIR(params) {
         throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Enum reference namespace differs from its declared native type", meta: { rule: "enum-namespace", model: model.name, field: field.name } });
     }
   for (const model of params.schema.models) {
+    for (const check of model.checks ?? [])
+      if (check.predicate !== undefined)
+        assertPredicateCapabilities({ predicate: check.predicate, dialect, usage: "check" });
+    for (const index of model.indexes)
+      if (index.wherePredicate !== undefined)
+        assertPredicateCapabilities({ predicate: index.wherePredicate, dialect, usage: "indexPredicate" });
     if (model.exclusions !== undefined && !Array.isArray(model.exclusions))
       throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Exclusions must be an array", meta: { rule: "exclusion-definition" } });
     if ((model.exclusions?.length ?? 0) === 0)
@@ -2195,6 +2500,8 @@ function assertValidSchemaIR(params) {
         throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Invalid exclusion declaration", meta: { rule: "exclusion-definition" } });
       const source = exclusion.source;
       if (source !== undefined) {
+        if (source.where !== undefined)
+          assertPredicateCapabilities({ predicate: source.where, dialect, usage: "exclusionPredicate" });
         const references = [...source.keys.flatMap((key) => ("field" in key) ? [key.field] : key.fields), ...[source.range.lower, source.range.upper].flatMap((endpoint) => ("field" in endpoint) ? [endpoint.field] : []), ...source.where === undefined ? [] : predicateFieldNames({ predicate: source.where })];
         if (references.some((name) => !model.fields.some((field) => field.name === name && !field.isList)))
           throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Exclusion references an unknown or list field", meta: { rule: "exclusion-field", model: model.name } });
@@ -2206,9 +2513,6 @@ function assertValidSchemaIR(params) {
   }
   if (params.schema.migrationObjects !== undefined)
     assertMigrationObjects({ objects: params.schema.migrationObjects });
-  if (params.schema.rls !== undefined && !DIALECT_CAPABILITIES[dialect].nativeRowLevelSecurity) {
-    throw unsupportedCapability({ dialect, feature: "nativeRowLevelSecurity" });
-  }
   for (const model of params.schema.models) {
     const counters = model.fields.filter((field) => field.default?.kind === "autoincrement");
     if (dialect === "mysql" && counters.length > 1)
@@ -2454,9 +2758,14 @@ export {
   ScopedQueryError,
   VIBE_ERROR_CODES,
   VibeError,
+  assertExtensionModelPlacement,
+  assertExtensionPlacement,
   assertIdentifierFits,
   assertIndexOperatorClasses,
+  assertJsonSchemaRef,
   assertMigrationObjects,
+  assertNativeRlsAdmission,
+  assertPredicateCapabilities,
   assertSqlNamespace,
   assertValidSchemaIR,
   buildComputedManifest,
@@ -2475,9 +2784,11 @@ export {
   extensionOptionsHash,
   fieldTypeIdentity,
   fitDefaultName,
+  hasJsonSchemaAnnotation,
   identifierLength,
   implicitJoinTable,
   implicitJoinTableObjectNames,
+  inspectPredicate,
   internalError,
   invalidStoredData,
   isEnumType,
@@ -2487,7 +2798,12 @@ export {
   isReservedDelegateName,
   isSqlObjectDefinition,
   isSqlObjectIdentity,
+  jsonSchemaRefIssue,
+  jsonTypeAnnotationIssue,
+  jsonTypeAnnotationRef,
   mergeExtensionDeclarations,
+  modelSqlNamespace,
+  normalizeJsonSchemaRef,
   postgresGeneratedObjectName,
   predicateFieldNames,
   predicateKey,
@@ -2506,4 +2822,4 @@ export {
   validateSchemaIR
 };
 
-//# debugId=99BBBD6C3E58D9DD64756E2164756E21
+//# debugId=721E026706902A1F64756E2164756E21