@vibeorm/schema 4.0.0 → 4.2.0

package/dist/capabilities.d.ts

@@ -105,6 +105,14 @@ export type DialectCapabilities = {
      * the `Date` is written, and a read returns that time at `1970-01-01` UTC.
      */
     readonly timeOfDayTypes: readonly TimeOfDayType[];
+    /**
+     * How a `String @db.Uuid` field is stored. `"native"`: the engine's 128-bit
+     * uuid type, which refuses malformed input and compares case-insensitively.
+     * `"text"`: TEXT, like every native string type on that dialect — no format
+     * check, and comparison is byte-wise. `"unsupported"`: the field is refused
+     * when the schema is validated. Values are strings in JavaScript everywhere.
+     */
+    readonly uuidColumns: "native" | "text" | "unsupported";
 };
 export declare const POSTGRES_CAPABILITIES: DialectCapabilities;
 export declare const SQLITE_CAPABILITIES: DialectCapabilities;

package/dist/errors.d.ts

@@ -58,6 +58,14 @@ export declare const VIBE_ERROR_CODES: readonly [
 "VIBE_RLS_CONTEXT", 
 /** SQLSTATE 42501: insufficient privilege, including policy WITH CHECK failure. */
 "VIBE_PERMISSION_DENIED", 
+/**
+ * A known read was cancelled by its caller. Fixed metadata: reason:
+ * "caller-aborted", stage: "before-dispatch" | "waiting-for-connection" |
+ * "running", databaseCancelled: boolean. True requires the original
+ * statement's server cancellation failure, not just a signal being sent.
+ * Unrelated driver failures retain their original mapped codes.
+ */
+"VIBE_CANCELLED", 
 /** Driver/connection failure not mapped to a more specific code. */
 "VIBE_ADAPTER", 
 /**

package/dist/extension.d.ts

@@ -324,15 +324,32 @@ export declare function buildExtensionRegistry(params: {
 }): ExtensionRegistry;
 /** An empty registry — the default when no extensions are configured. */
 export declare const EMPTY_EXTENSION_REGISTRY: ExtensionRegistry;
+/** Whether built-in declarations establish public-only physical ownership for this model. */
+export declare function hasPublicExtensionDeclaration(params: {
+    schema: SchemaIR;
+    model: string;
+}): boolean;
+/** Refuse placement that built-in extension SQL and ownership cannot preserve. */
+export declare function assertExtensionModelPlacement(params: {
+    namespace?: string;
+    dialect?: Dialect;
+}): void;
+/** Admit built-in extension declarations before generation, migration or runtime work. */
+export declare function assertExtensionPlacement(params: {
+    schema: SchemaIR;
+    dialect?: Dialect;
+}): void;
 /**
  * Merge two declaration fragments for the same (extension, model) — e.g. a
  * field-type lowering plus a model attribute. One level deep: object values
- * merge shallowly, everything else is last-wins. Used identically by the
- * .prisma parser and the TS DSL so both sources produce byte-identical IR.
+ * merge shallowly. Built-in index-bearing declarations cannot repeat their
+ * field list; custom extension merging retains its existing last-wins behavior.
+ * Used identically by the parser and TS DSL.
  */
 export declare function mergeExtensionDeclarations(params: {
     base: Readonly<Record<string, unknown>>;
     next: Readonly<Record<string, unknown>>;
+    extension?: string;
 }): Record<string, unknown>;
 /**
  * Per-model declarations one extension gathered from schema attributes,

package/dist/index.d.ts

@@ -3,6 +3,8 @@
  * and the VibeError contract for VibeORM v2.
  */
 export { SQL_NAMESPACES, assertSqlNamespace, qualifiedSqlName, sqlNamespaceIssue } from "./namespaces.ts";
+export { assertNativeRlsAdmission } from "./native-rls-admission.ts";
+export { modelSqlNamespace } from "./model-sql-namespace.ts";
 export { assertIndexOperatorClasses } from "./index-operator-classes.ts";
 export type { DatabaseModuleOptions, DatabaseModuleManifest, DatabaseModuleArtifact } from "./database-module.ts";
 export { prepareDatabaseModuleSchema } from "./module-schema.ts";
@@ -19,7 +21,7 @@ export { READ_ONLY_REFUSAL_REASONS, ReadOnlyClientError, SCOPED_REFUSAL_REASONS,
 export type { ReadOnlyRefusalReason, ScopedRefusalReason, VibeErrorCode } from "./errors.ts";
 export { decodePrismaString, encodePrismaString, exactDecimalLiteral, exactIntegerLiteral } from "./prisma-literal.ts";
 export { RESERVED_CLIENT_NAMES, RESERVED_DELEGATE_NAMES, isReservedClientName, isReservedDelegateName, } from "./reserved.ts";
-export { EMPTY_EXTENSION_REGISTRY, buildExtensionRegistry, defineExtension, extensionDeclarations, extensionManifestEntry, extensionOptionsHash, mergeExtensionDeclarations, } from "./extension.ts";
+export { assertExtensionModelPlacement, assertExtensionPlacement, EMPTY_EXTENSION_REGISTRY, buildExtensionRegistry, defineExtension, extensionDeclarations, extensionManifestEntry, extensionOptionsHash, mergeExtensionDeclarations, } from "./extension.ts";
 export type { ExtensionArtifact, ExtensionArtifactOwner, ExtensionAttributeArgs, ExtensionAttributeValue, ExtensionClientContribution, ExtensionClientPlane, ExtensionDoctorCheck, ExtensionDoctorHook, ExtensionDoctorReport, ExtensionFieldType, ExtensionImportSpec, ExtensionManifestEntry, ExtensionMigratePlane, ExtensionModelAttribute, ExtensionModelTypeNames, ExtensionRegistry, ExtensionRuntimePlane, ExtensionSchemaContext, ExtensionSqlExecutor, ExtensionSqlPlane, ExtensionWhereOperator, SqlFragmentPart, SqlFragmentSpec, VibeExtension, } from "./extension.ts";
 export { buildComputedManifest, validateComputedConfig } from "./computed.ts";
 export type { ComputedConfig, ComputedFieldSpec, ComputedManifestEntry } from "./computed.ts";

package/dist/index.js

@@ -18,6 +18,7 @@ var VIBE_ERROR_CODES = [
   "VIBE_READ_ONLY",
   "VIBE_RLS_CONTEXT",
   "VIBE_PERMISSION_DENIED",
+  "VIBE_CANCELLED",
   "VIBE_ADAPTER",
   "VIBE_ADAPTER_CLOSED",
   "VIBE_INTERNAL"
@@ -278,7 +279,8 @@ var POSTGRES_CAPABILITIES = Object.freeze({
   rowLockStrengths: Object.freeze(["update", "noKeyUpdate", "share", "keyShare"]),
   rowLockWaitPolicies: Object.freeze(["wait", "nowait", "skipLocked"]),
   advisoryLocks: true,
-  timeOfDayTypes: Object.freeze(["time", "timetz"])
+  timeOfDayTypes: Object.freeze(["time", "timetz"]),
+  uuidColumns: "native"
 });
 var SQLITE_CAPABILITIES = Object.freeze({
   fixedNamespaces: false,
@@ -305,7 +307,8 @@ var SQLITE_CAPABILITIES = Object.freeze({
   rowLockStrengths: Object.freeze([]),
   rowLockWaitPolicies: Object.freeze([]),
   advisoryLocks: false,
-  timeOfDayTypes: Object.freeze([])
+  timeOfDayTypes: Object.freeze([]),
+  uuidColumns: "text"
 });
 var MYSQL_CAPABILITIES = Object.freeze({
   fixedNamespaces: false,
@@ -332,7 +335,8 @@ var MYSQL_CAPABILITIES = Object.freeze({
   rowLockStrengths: Object.freeze(["update", "share"]),
   rowLockWaitPolicies: Object.freeze(["wait", "nowait", "skipLocked"]),
   advisoryLocks: false,
-  timeOfDayTypes: Object.freeze(["time"])
+  timeOfDayTypes: Object.freeze(["time"]),
+  uuidColumns: "unsupported"
 });
 var DIALECT_CAPABILITIES = Object.freeze({
   postgres: POSTGRES_CAPABILITIES,
@@ -340,6 +344,261 @@ var DIALECT_CAPABILITIES = Object.freeze({
   mysql: MYSQL_CAPABILITIES
 });
 
+// packages/schema/src/ir.ts
+var DIALECTS = ["postgres", "sqlite", "mysql"];
+function providerToDialect(params) {
+  const { provider } = params;
+  switch (provider) {
+    case "postgresql":
+    case "pglite":
+      return "postgres";
+    case "sqlite":
+      return "sqlite";
+    case "mysql":
+      return "mysql";
+  }
+}
+function isEnumType(fieldType) {
+  return typeof fieldType === "object" && "enum" in fieldType;
+}
+function fieldTypeIdentity(params) {
+  const { type } = params;
+  return isEnumType(type) ? type.namespace === undefined || type.namespace === "public" ? `enum:${type.enum}` : JSON.stringify(["enum", type.namespace, type.enum]) : type;
+}
+var ENUM_STORAGES = ["database", "string"];
+function enumStorageOf(params) {
+  return params.enumDef.storage ?? "database";
+}
+
+// packages/schema/src/native-rls-admission.ts
+function assertNativeRlsAdmission(params) {
+  const { schema } = params;
+  if (schema.rls === undefined && !schema.models.some((model) => model.rls !== undefined))
+    return;
+  const dialect = params.dialect ?? providerToDialect({ provider: schema.datasource.provider });
+  if (!DIALECT_CAPABILITIES[dialect].nativeRowLevelSecurity) {
+    throw unsupportedCapability({ dialect, feature: "nativeRowLevelSecurity" });
+  }
+  for (const model of schema.models) {
+    const rule = model.rls;
+    if (rule === undefined || rule === "unprotected")
+      continue;
+    const parentName = rule !== null && typeof rule === "object" && "through" in rule ? model.relations.find((relation) => relation.name === rule.through)?.targetModel : undefined;
+    const parent = parentName === undefined ? undefined : schema.models.find((entry) => entry.name === parentName);
+    if (model.namespace !== undefined && model.namespace !== "public" || parent?.namespace !== undefined && parent.namespace !== "public") {
+      throw unsupportedCapability({
+        dialect,
+        feature: "fixedNamespaceNativeRls",
+        hint: "Native RLS protects public tables only, including deny-protected models and through-policy parents"
+      });
+    }
+  }
+}
+// packages/schema/src/reserved.ts
+var RESERVED_DELEGATE_NAMES = [
+  "findMany",
+  "findPage",
+  "findFirst",
+  "findUnique",
+  "findFirstOrThrow",
+  "findUniqueOrThrow",
+  "create",
+  "createMany",
+  "createManyAndReturn",
+  "update",
+  "updateMany",
+  "updateManyAndReturn",
+  "upsert",
+  "upsertMany",
+  "delete",
+  "deleteMany",
+  "count",
+  "aggregate",
+  "groupBy",
+  "fields"
+];
+var RESERVED_CLIENT_NAMES = [
+  "$connect",
+  "$disconnect",
+  "$transaction",
+  "$querySql",
+  "$querySqlResult",
+  "$executeSql",
+  "$queryRaw",
+  "$queryRawUnsafe",
+  "$executeRaw",
+  "$executeRawUnsafe",
+  "$on",
+  "$extends",
+  "$defineView",
+  "$withPolicy",
+  "$bypassPolicy",
+  "$scoped",
+  "$readOnly",
+  "$models",
+  "$withContext",
+  "$advisoryLock",
+  "$tryAdvisoryLock"
+];
+var RESERVED_COLUMN_PREFIX = "__vibe_";
+function isReservedDelegateName(params) {
+  return RESERVED_DELEGATE_NAMES.includes(params.name);
+}
+function isReservedClientName(params) {
+  const withPrefix = params.name.startsWith("$") ? params.name : `$${params.name}`;
+  return RESERVED_CLIENT_NAMES.includes(withPrefix);
+}
+
+// packages/schema/src/extension.ts
+function stableSerialize(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "undefined";
+  if (Array.isArray(value))
+    return `[${value.map(stableSerialize).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function extensionOptionsHash(params) {
+  const text = stableSerialize(params.options);
+  let hash = 2166136261;
+  for (let index = 0;index < text.length; index += 1) {
+    hash ^= text.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function extensionManifestEntry(params) {
+  const { extension } = params;
+  return {
+    name: extension.name,
+    version: extension.version,
+    optionsHash: extensionOptionsHash({ options: extension.options })
+  };
+}
+var EXTENSION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+function defineExtension(extension) {
+  const { name } = extension;
+  if (!EXTENSION_NAME_PATTERN.test(name)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" is invalid \u2014 must match ${EXTENSION_NAME_PATTERN} (it becomes a client identifier)`,
+      meta: { name }
+    });
+  }
+  if (RESERVED_DELEGATE_NAMES.includes(name)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" collides with a core delegate method`,
+      meta: { name }
+    });
+  }
+  if (RESERVED_CLIENT_NAMES.includes(`$${name}`)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" collides with the core client method "$${name}"`,
+      meta: { name }
+    });
+  }
+  return Object.freeze(extension);
+}
+function buildExtensionRegistry(params) {
+  const byName = new Map;
+  const modelAttributes = new Map;
+  const fieldTypes = new Map;
+  for (const extension of params.extensions) {
+    if (byName.has(extension.name)) {
+      throw new VibeError({
+        code: "VIBE_CONFIG",
+        message: `duplicate extension name "${extension.name}" in the configured extension list`,
+        meta: { name: extension.name }
+      });
+    }
+    byName.set(extension.name, extension);
+    for (const attribute of extension.schema?.modelAttributes ?? []) {
+      const existing = modelAttributes.get(attribute.name);
+      if (existing !== undefined) {
+        throw new VibeError({
+          code: "VIBE_CONFIG",
+          message: `model attribute "@@${attribute.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
+          meta: { attribute: attribute.name }
+        });
+      }
+      modelAttributes.set(attribute.name, { extension, attribute });
+    }
+    for (const fieldType of extension.schema?.fieldTypes ?? []) {
+      const existing = fieldTypes.get(fieldType.name);
+      if (existing !== undefined) {
+        throw new VibeError({
+          code: "VIBE_CONFIG",
+          message: `field type "${fieldType.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
+          meta: { fieldType: fieldType.name }
+        });
+      }
+      fieldTypes.set(fieldType.name, { extension, fieldType });
+    }
+  }
+  return { extensions: params.extensions, byName, modelAttributes, fieldTypes };
+}
+var EMPTY_EXTENSION_REGISTRY = buildExtensionRegistry({
+  extensions: []
+});
+var PUBLIC_ONLY_EXTENSIONS = ["search", "vector", "trgm"];
+function hasPublicExtensionDeclaration(params) {
+  return PUBLIC_ONLY_EXTENSIONS.some((name) => Object.hasOwn(extensionDeclarations({ schema: params.schema, name }), params.model));
+}
+function assertExtensionModelPlacement(params) {
+  if (params.namespace !== undefined && params.namespace !== "public") {
+    throw unsupportedCapability({ dialect: params.dialect ?? "postgres", feature: "fixedNamespaceExtensions", hint: "Search, vector and trigram extensions currently require public table placement" });
+  }
+}
+function assertExtensionPlacement(params) {
+  const dialect = params.dialect ?? providerToDialect({ provider: params.schema.datasource.provider });
+  for (const extension of params.schema.extensions) {
+    if (!PUBLIC_ONLY_EXTENSIONS.includes(extension.name))
+      continue;
+    const declarations = extensionDeclarations({ schema: params.schema, name: extension.name });
+    for (const model of params.schema.models) {
+      if (Object.hasOwn(declarations, model.name))
+        assertExtensionModelPlacement({ namespace: model.namespace, dialect });
+    }
+  }
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeExtensionDeclarations(params) {
+  if (params.extension !== undefined && PUBLIC_ONLY_EXTENSIONS.includes(params.extension) && Array.isArray(params.base.fields) && Array.isArray(params.next.fields)) {
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: `Repeated index-bearing ${params.extension} declarations are unsupported; use one common-configuration multi-field declaration`, meta: { rule: "repeated-extension-declaration", extension: params.extension } });
+  }
+  const out = { ...params.base };
+  for (const [key, value] of Object.entries(params.next)) {
+    const existing = out[key];
+    out[key] = isPlainObject(existing) && isPlainObject(value) ? { ...existing, ...value } : value;
+  }
+  return out;
+}
+function extensionDeclarations(params) {
+  const decl = params.schema.extensions.find((entry) => entry.name === params.name);
+  if (decl === undefined)
+    return {};
+  const models = decl.options["models"];
+  if (models === null || typeof models !== "object" || Array.isArray(models))
+    return {};
+  return models;
+}
+
+// packages/schema/src/model-sql-namespace.ts
+function modelSqlNamespace(params) {
+  const { schema, model } = params;
+  if (model.namespace !== undefined || (params.dialect ?? providerToDialect({ provider: schema.datasource.provider })) !== "postgres")
+    return model.namespace;
+  const protectedModel = model.rls !== undefined && model.rls !== "unprotected";
+  const throughParent = schema.models.some((child) => {
+    const rule = child.rls;
+    return rule !== null && typeof rule === "object" && "through" in rule && child.relations.some((relation) => relation.name === rule.through && relation.targetModel === model.name);
+  });
+  return protectedModel || throughParent || hasPublicExtensionDeclaration({ schema, model: model.name }) ? SQL_NAMESPACES.postgres : undefined;
+}
 // packages/schema/src/migration-objects.ts
 function sqlObjectKey(params) {
   const object = params.identity;
@@ -539,32 +798,6 @@ function assertIndexOperatorClasses(params) {
           throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Index operator class must be a qualified SQL name { namespace, name }", meta: { rule: "index-operator-class-identity", model: model.name, field: field.name } });
       }
 }
-// packages/schema/src/ir.ts
-var DIALECTS = ["postgres", "sqlite", "mysql"];
-function providerToDialect(params) {
-  const { provider } = params;
-  switch (provider) {
-    case "postgresql":
-    case "pglite":
-      return "postgres";
-    case "sqlite":
-      return "sqlite";
-    case "mysql":
-      return "mysql";
-  }
-}
-function isEnumType(fieldType) {
-  return typeof fieldType === "object" && "enum" in fieldType;
-}
-function fieldTypeIdentity(params) {
-  const { type } = params;
-  return isEnumType(type) ? type.namespace === undefined || type.namespace === "public" ? `enum:${type.enum}` : JSON.stringify(["enum", type.namespace, type.enum]) : type;
-}
-var ENUM_STORAGES = ["database", "string"];
-function enumStorageOf(params) {
-  return params.enumDef.storage ?? "database";
-}
-
 // packages/schema/src/module-schema.ts
 function prepareDatabaseModuleSchema(params) {
   const { schema, module } = params;
@@ -865,173 +1098,6 @@ function exactDecimalLiteral(params) {
   const mantissa = text.replace(/[eE].*$/, "").replace("-", "").replace(".", "").replace(/^0+/, "");
   return mantissa.length <= 15 ? Number(text) : text;
 }
-// packages/schema/src/reserved.ts
-var RESERVED_DELEGATE_NAMES = [
-  "findMany",
-  "findPage",
-  "findFirst",
-  "findUnique",
-  "findFirstOrThrow",
-  "findUniqueOrThrow",
-  "create",
-  "createMany",
-  "createManyAndReturn",
-  "update",
-  "updateMany",
-  "updateManyAndReturn",
-  "upsert",
-  "upsertMany",
-  "delete",
-  "deleteMany",
-  "count",
-  "aggregate",
-  "groupBy",
-  "fields"
-];
-var RESERVED_CLIENT_NAMES = [
-  "$connect",
-  "$disconnect",
-  "$transaction",
-  "$querySql",
-  "$querySqlResult",
-  "$executeSql",
-  "$queryRaw",
-  "$queryRawUnsafe",
-  "$executeRaw",
-  "$executeRawUnsafe",
-  "$on",
-  "$extends",
-  "$defineView",
-  "$withPolicy",
-  "$bypassPolicy",
-  "$scoped",
-  "$readOnly",
-  "$models",
-  "$withContext",
-  "$advisoryLock",
-  "$tryAdvisoryLock"
-];
-var RESERVED_COLUMN_PREFIX = "__vibe_";
-function isReservedDelegateName(params) {
-  return RESERVED_DELEGATE_NAMES.includes(params.name);
-}
-function isReservedClientName(params) {
-  const withPrefix = params.name.startsWith("$") ? params.name : `$${params.name}`;
-  return RESERVED_CLIENT_NAMES.includes(withPrefix);
-}
-// packages/schema/src/extension.ts
-function stableSerialize(value) {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value) ?? "undefined";
-  if (Array.isArray(value))
-    return `[${value.map(stableSerialize).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`);
-  return `{${entries.join(",")}}`;
-}
-function extensionOptionsHash(params) {
-  const text = stableSerialize(params.options);
-  let hash = 2166136261;
-  for (let index = 0;index < text.length; index += 1) {
-    hash ^= text.charCodeAt(index);
-    hash = Math.imul(hash, 16777619);
-  }
-  return (hash >>> 0).toString(16).padStart(8, "0");
-}
-function extensionManifestEntry(params) {
-  const { extension } = params;
-  return {
-    name: extension.name,
-    version: extension.version,
-    optionsHash: extensionOptionsHash({ options: extension.options })
-  };
-}
-var EXTENSION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
-function defineExtension(extension) {
-  const { name } = extension;
-  if (!EXTENSION_NAME_PATTERN.test(name)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" is invalid \u2014 must match ${EXTENSION_NAME_PATTERN} (it becomes a client identifier)`,
-      meta: { name }
-    });
-  }
-  if (RESERVED_DELEGATE_NAMES.includes(name)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" collides with a core delegate method`,
-      meta: { name }
-    });
-  }
-  if (RESERVED_CLIENT_NAMES.includes(`$${name}`)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" collides with the core client method "$${name}"`,
-      meta: { name }
-    });
-  }
-  return Object.freeze(extension);
-}
-function buildExtensionRegistry(params) {
-  const byName = new Map;
-  const modelAttributes = new Map;
-  const fieldTypes = new Map;
-  for (const extension of params.extensions) {
-    if (byName.has(extension.name)) {
-      throw new VibeError({
-        code: "VIBE_CONFIG",
-        message: `duplicate extension name "${extension.name}" in the configured extension list`,
-        meta: { name: extension.name }
-      });
-    }
-    byName.set(extension.name, extension);
-    for (const attribute of extension.schema?.modelAttributes ?? []) {
-      const existing = modelAttributes.get(attribute.name);
-      if (existing !== undefined) {
-        throw new VibeError({
-          code: "VIBE_CONFIG",
-          message: `model attribute "@@${attribute.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
-          meta: { attribute: attribute.name }
-        });
-      }
-      modelAttributes.set(attribute.name, { extension, attribute });
-    }
-    for (const fieldType of extension.schema?.fieldTypes ?? []) {
-      const existing = fieldTypes.get(fieldType.name);
-      if (existing !== undefined) {
-        throw new VibeError({
-          code: "VIBE_CONFIG",
-          message: `field type "${fieldType.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
-          meta: { fieldType: fieldType.name }
-        });
-      }
-      fieldTypes.set(fieldType.name, { extension, fieldType });
-    }
-  }
-  return { extensions: params.extensions, byName, modelAttributes, fieldTypes };
-}
-var EMPTY_EXTENSION_REGISTRY = buildExtensionRegistry({
-  extensions: []
-});
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function mergeExtensionDeclarations(params) {
-  const out = { ...params.base };
-  for (const [key, value] of Object.entries(params.next)) {
-    const existing = out[key];
-    out[key] = isPlainObject(existing) && isPlainObject(value) ? { ...existing, ...value } : value;
-  }
-  return out;
-}
-function extensionDeclarations(params) {
-  const decl = params.schema.extensions.find((entry) => entry.name === params.name);
-  if (decl === undefined)
-    return {};
-  const models = decl.options["models"];
-  if (models === null || typeof models !== "object" || Array.isArray(models))
-    return {};
-  return models;
-}
 // packages/schema/src/computed.ts
 function buildComputedManifest(params) {
   const { computed } = params;
@@ -2401,6 +2467,8 @@ function validatePredicateFields(params) {
 }
 function assertValidSchemaIR(params) {
   const dialect = providerToDialect({ provider: params.schema.datasource.provider });
+  assertNativeRlsAdmission({ schema: params.schema, dialect });
+  assertExtensionPlacement({ schema: params.schema, dialect });
   assertIndexOperatorClasses({ schema: params.schema, dialect });
   for (const entry of [...params.schema.models, ...params.schema.enums])
     if (entry.namespace !== undefined)
@@ -2448,9 +2516,6 @@ function assertValidSchemaIR(params) {
   }
   if (params.schema.migrationObjects !== undefined)
     assertMigrationObjects({ objects: params.schema.migrationObjects });
-  if (params.schema.rls !== undefined && !DIALECT_CAPABILITIES[dialect].nativeRowLevelSecurity) {
-    throw unsupportedCapability({ dialect, feature: "nativeRowLevelSecurity" });
-  }
   for (const model of params.schema.models) {
     const counters = model.fields.filter((field) => field.default?.kind === "autoincrement");
     if (dialect === "mysql" && counters.length > 1)
@@ -2462,6 +2527,10 @@ function assertValidSchemaIR(params) {
         const error = unsupportedCapability({ dialect, feature: "timeOfDayTypes", hint: `${model.name}.${field.name} declares @db.${field.nativeType ?? ""} (${timeOfDay}) \u2014 ${instead}` });
         throw new VibeError({ code: error.code, message: error.message, meta: { ...error.meta, model: model.name, field: field.name, nativeType: field.nativeType } });
       }
+      if (field.type === "String" && field.isUnsupported !== true && field.nativeType?.trim().toLowerCase() === "uuid" && DIALECT_CAPABILITIES[dialect].uuidColumns === "unsupported") {
+        const error = unsupportedCapability({ dialect, feature: "uuidColumns", hint: `${model.name}.${field.name} declares @db.Uuid \u2014 ${dialect} has no uuid column type; store it as a plain String (or @db.Char(36))` });
+        throw new VibeError({ code: error.code, message: error.message, meta: { ...error.meta, model: model.name, field: field.name, nativeType: field.nativeType } });
+      }
       if (timeOfDay !== undefined && dialect === "mysql" && field.default?.kind === "now") {
         const error = unsupportedCapability({ dialect, feature: "@default(now()) on a TIME column", hint: `${model.name}.${field.name} \u2014 MySQL has no current-time default for TIME; drop the default and write the value (or use @updatedAt)` });
         throw new VibeError({ code: error.code, message: error.message, meta: { ...error.meta, model: model.name, field: field.name, nativeType: field.nativeType } });
@@ -2696,10 +2765,13 @@ export {
   ScopedQueryError,
   VIBE_ERROR_CODES,
   VibeError,
+  assertExtensionModelPlacement,
+  assertExtensionPlacement,
   assertIdentifierFits,
   assertIndexOperatorClasses,
   assertJsonSchemaRef,
   assertMigrationObjects,
+  assertNativeRlsAdmission,
   assertPredicateCapabilities,
   assertSqlNamespace,
   assertValidSchemaIR,
@@ -2737,6 +2809,7 @@ export {
   jsonTypeAnnotationIssue,
   jsonTypeAnnotationRef,
   mergeExtensionDeclarations,
+  modelSqlNamespace,
   normalizeJsonSchemaRef,
   postgresGeneratedObjectName,
   predicateFieldNames,
@@ -2756,4 +2829,4 @@ export {
   validateSchemaIR
 };
 
-//# debugId=6D288D6F1DD93E5864756E2164756E21
+//# debugId=315C4C10E208512464756E2164756E21