@vibeorm/schema 4.2.0 → 4.3.0

package/dist/index.js

@@ -144,6 +144,1262 @@ class ReadOnlyClientError extends VibeError {
   }
 }
 
+// packages/schema/src/local-date.ts
+function isLocalDateField(params) {
+  const { field } = params;
+  return field.type === "String" && field.isUnsupported !== true && field.nativeType?.trim().toLowerCase() === "date";
+}
+function isCanonicalLocalDate(params) {
+  const { value } = params;
+  if (typeof value !== "string" || value.length !== 10 || !/^\d{4}-\d{2}-\d{2}$/.test(value))
+    return false;
+  const year = Number(value.slice(0, 4));
+  const month = Number(value.slice(5, 7));
+  const day = Number(value.slice(8, 10));
+  if (year === 0 || month < 1 || month > 12 || day < 1)
+    return false;
+  const leapYear = year % 4 === 0 && (year % 100 !== 0 || year % 400 === 0);
+  const daysInMonth = month === 2 ? leapYear ? 29 : 28 : [4, 6, 9, 11].includes(month) ? 30 : 31;
+  return day <= daysInMonth;
+}
+function localDateCheckName(params) {
+  return `${params.table}_${params.column}_localDate_check`;
+}
+
+// packages/schema/src/ir.ts
+var DIALECTS = ["postgres", "sqlite", "mysql"];
+function providerToDialect(params) {
+  const { provider } = params;
+  switch (provider) {
+    case "postgresql":
+    case "pglite":
+      return "postgres";
+    case "sqlite":
+      return "sqlite";
+    case "mysql":
+      return "mysql";
+  }
+}
+function isEnumType(fieldType) {
+  return typeof fieldType === "object" && "enum" in fieldType;
+}
+function fieldTypeIdentity(params) {
+  if (isLocalDateField({ field: params }))
+    return "localDate";
+  const { type } = params;
+  return isEnumType(type) ? type.namespace === undefined || type.namespace === "public" ? `enum:${type.enum}` : JSON.stringify(["enum", type.namespace, type.enum]) : type;
+}
+var ENUM_STORAGES = ["database", "string"];
+function enumStorageOf(params) {
+  return params.enumDef.storage ?? "database";
+}
+
+// packages/schema/src/reserved.ts
+var RESERVED_DELEGATE_NAMES = [
+  "findMany",
+  "findPage",
+  "findFirst",
+  "findUnique",
+  "findFirstOrThrow",
+  "findUniqueOrThrow",
+  "create",
+  "createMany",
+  "createManyAndReturn",
+  "update",
+  "updateMany",
+  "updateManyAndReturn",
+  "upsert",
+  "upsertMany",
+  "delete",
+  "deleteMany",
+  "count",
+  "aggregate",
+  "groupBy",
+  "fields"
+];
+var RESERVED_CLIENT_NAMES = [
+  "$connect",
+  "$disconnect",
+  "$transaction",
+  "$all",
+  "$querySql",
+  "$querySqlResult",
+  "$executeSql",
+  "$queryRaw",
+  "$queryRawUnsafe",
+  "$executeRaw",
+  "$executeRawUnsafe",
+  "$on",
+  "$extends",
+  "$defineView",
+  "$withPolicy",
+  "$bypassPolicy",
+  "$scoped",
+  "$readOnly",
+  "$models",
+  "$withContext",
+  "$advisoryLock",
+  "$tryAdvisoryLock"
+];
+var RESERVED_COLUMN_PREFIX = "__vibe_";
+function isReservedDelegateName(params) {
+  return RESERVED_DELEGATE_NAMES.includes(params.name);
+}
+function isReservedClientName(params) {
+  const withPrefix = params.name.startsWith("$") ? params.name : `$${params.name}`;
+  return RESERVED_CLIENT_NAMES.includes(withPrefix);
+}
+
+// packages/schema/src/extension.ts
+function stableSerialize(value) {
+  if (value === null || typeof value !== "object")
+    return JSON.stringify(value) ?? "undefined";
+  if (Array.isArray(value))
+    return `[${value.map(stableSerialize).join(",")}]`;
+  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`);
+  return `{${entries.join(",")}}`;
+}
+function extensionOptionsHash(params) {
+  const text = stableSerialize(params.options);
+  let hash = 2166136261;
+  for (let index = 0;index < text.length; index += 1) {
+    hash ^= text.charCodeAt(index);
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+}
+function extensionManifestEntry(params) {
+  const { extension } = params;
+  return {
+    name: extension.name,
+    version: extension.version,
+    optionsHash: extensionOptionsHash({ options: extension.options })
+  };
+}
+var EXTENSION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
+function defineExtension(extension) {
+  const { name } = extension;
+  if (!EXTENSION_NAME_PATTERN.test(name)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" is invalid \u2014 must match ${EXTENSION_NAME_PATTERN} (it becomes a client identifier)`,
+      meta: { name }
+    });
+  }
+  if (RESERVED_DELEGATE_NAMES.includes(name)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" collides with a core delegate method`,
+      meta: { name }
+    });
+  }
+  if (RESERVED_CLIENT_NAMES.includes(`$${name}`)) {
+    throw new VibeError({
+      code: "VIBE_CONFIG",
+      message: `extension name "${name}" collides with the core client method "$${name}"`,
+      meta: { name }
+    });
+  }
+  return Object.freeze(extension);
+}
+function buildExtensionRegistry(params) {
+  const byName = new Map;
+  const modelAttributes = new Map;
+  const fieldTypes = new Map;
+  for (const extension of params.extensions) {
+    if (byName.has(extension.name)) {
+      throw new VibeError({
+        code: "VIBE_CONFIG",
+        message: `duplicate extension name "${extension.name}" in the configured extension list`,
+        meta: { name: extension.name }
+      });
+    }
+    byName.set(extension.name, extension);
+    for (const attribute of extension.schema?.modelAttributes ?? []) {
+      if (["appendOnly", "fixed", "rowFixed", "frozen"].includes(attribute.name))
+        throw new VibeError({
+          code: "VIBE_SCHEMA_INVALID",
+          message: `Model attribute @@${attribute.name} is reserved for core row rules; choose a different extension attribute name`,
+          meta: { rule: "reserved-row-rule-attribute", attribute: attribute.name, extension: extension.name }
+        });
+      const existing = modelAttributes.get(attribute.name);
+      if (existing !== undefined) {
+        throw new VibeError({
+          code: "VIBE_CONFIG",
+          message: `model attribute "@@${attribute.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
+          meta: { attribute: attribute.name }
+        });
+      }
+      modelAttributes.set(attribute.name, { extension, attribute });
+    }
+    for (const fieldType of extension.schema?.fieldTypes ?? []) {
+      const existing = fieldTypes.get(fieldType.name);
+      if (existing !== undefined) {
+        throw new VibeError({
+          code: "VIBE_CONFIG",
+          message: `field type "${fieldType.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
+          meta: { fieldType: fieldType.name }
+        });
+      }
+      fieldTypes.set(fieldType.name, { extension, fieldType });
+    }
+  }
+  return { extensions: params.extensions, byName, modelAttributes, fieldTypes };
+}
+var EMPTY_EXTENSION_REGISTRY = buildExtensionRegistry({
+  extensions: []
+});
+var PUBLIC_ONLY_EXTENSIONS = ["search", "vector", "trgm"];
+function hasPublicExtensionDeclaration(params) {
+  return PUBLIC_ONLY_EXTENSIONS.some((name) => Object.hasOwn(extensionDeclarations({ schema: params.schema, name }), params.model));
+}
+function assertExtensionModelPlacement(params) {
+  if (params.namespace !== undefined && params.namespace !== "public") {
+    throw unsupportedCapability({ dialect: params.dialect ?? "postgres", feature: "fixedNamespaceExtensions", hint: "Search, vector and trigram extensions currently require public table placement" });
+  }
+}
+function assertExtensionPlacement(params) {
+  const dialect = params.dialect ?? providerToDialect({ provider: params.schema.datasource.provider });
+  for (const extension of params.schema.extensions) {
+    if (!PUBLIC_ONLY_EXTENSIONS.includes(extension.name))
+      continue;
+    const declarations = extensionDeclarations({ schema: params.schema, name: extension.name });
+    for (const model of params.schema.models) {
+      if (Object.hasOwn(declarations, model.name))
+        assertExtensionModelPlacement({ namespace: model.namespace, dialect });
+    }
+  }
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function mergeExtensionDeclarations(params) {
+  if (params.extension !== undefined && PUBLIC_ONLY_EXTENSIONS.includes(params.extension) && Array.isArray(params.base.fields) && Array.isArray(params.next.fields)) {
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: `Repeated index-bearing ${params.extension} declarations are unsupported; use one common-configuration multi-field declaration`, meta: { rule: "repeated-extension-declaration", extension: params.extension } });
+  }
+  const out = { ...params.base };
+  for (const [key, value] of Object.entries(params.next)) {
+    const existing = out[key];
+    out[key] = isPlainObject(existing) && isPlainObject(value) ? { ...existing, ...value } : value;
+  }
+  return out;
+}
+function extensionDeclarations(params) {
+  const decl = params.schema.extensions.find((entry) => entry.name === params.name);
+  if (decl === undefined)
+    return {};
+  const models = decl.options["models"];
+  if (models === null || typeof models !== "object" || Array.isArray(models))
+    return {};
+  return models;
+}
+
+// packages/schema/src/capabilities.ts
+var scalarUsages = Object.freeze(["check", "indexPredicate", "exclusionPredicate", "indexExpression"]);
+var booleanUsages = Object.freeze(["check", "indexPredicate", "exclusionPredicate"]);
+var checkUsage = Object.freeze(["check"]);
+var noUsages = Object.freeze([]);
+function predicateExpressions(params) {
+  return Object.freeze({
+    field: scalarUsages,
+    value: scalarUsages,
+    compare: booleanUsages,
+    inList: booleanUsages,
+    isNull: booleanUsages,
+    and: booleanUsages,
+    or: booleanUsages,
+    not: booleanUsages,
+    jsonText: params.legacy,
+    length: params.legacy,
+    isTrue: params.legacy,
+    add: scalarUsages,
+    sub: scalarUsages,
+    mul: scalarUsages,
+    lower: scalarUsages,
+    upper: scalarUsages
+  });
+}
+var POSTGRES_CAPABILITIES = Object.freeze({
+  rowRuleAppendOnly: true,
+  rowRuleFixed: true,
+  rowRuleRowFixed: true,
+  rowRuleFrozen: true,
+  fixedNamespaces: true,
+  externalObjects: true,
+  indexOperatorClasses: true,
+  exclusionConstraints: true,
+  exclusionExtensions: Object.freeze(["btree_gist"]),
+  checkNormalization: "rollback",
+  expressionIndexes: true,
+  generatedColumns: true,
+  generatedColumnNormalization: "rollback",
+  schemaCheckExpressions: true,
+  predicateExpressions: predicateExpressions({ legacy: checkUsage }),
+  predicateArithmeticTypes: Object.freeze(["Int", "BigInt", "Float", "Decimal"]),
+  nativeRowLevelSecurity: true,
+  returning: true,
+  scalarArrays: true,
+  nativeEnums: true,
+  ilike: true,
+  lateralJoin: true,
+  distinctOn: true,
+  partialIndexes: true,
+  conflictTargetConstraint: true,
+  transactionalDdl: true,
+  createManyAndReturn: true,
+  jsonColumnType: true,
+  orderByNulls: true,
+  fullTextEngines: Object.freeze(["bm25", "tsvector"]),
+  rowLockStrengths: Object.freeze(["update", "noKeyUpdate", "share", "keyShare"]),
+  rowLockWaitPolicies: Object.freeze(["wait", "nowait", "skipLocked"]),
+  advisoryLocks: true,
+  timeOfDayTypes: Object.freeze(["time", "timetz"]),
+  uuidColumns: "native",
+  localDateColumns: true
+});
+var SQLITE_CAPABILITIES = Object.freeze({
+  rowRuleAppendOnly: true,
+  rowRuleFixed: true,
+  rowRuleRowFixed: true,
+  rowRuleFrozen: true,
+  fixedNamespaces: false,
+  externalObjects: false,
+  indexOperatorClasses: false,
+  exclusionConstraints: false,
+  exclusionExtensions: Object.freeze([]),
+  checkNormalization: "sourceText",
+  expressionIndexes: true,
+  generatedColumns: true,
+  generatedColumnNormalization: "sourceText",
+  schemaCheckExpressions: false,
+  predicateExpressions: predicateExpressions({ legacy: noUsages }),
+  predicateArithmeticTypes: Object.freeze(["Int", "BigInt", "Float"]),
+  nativeRowLevelSecurity: false,
+  returning: true,
+  scalarArrays: false,
+  nativeEnums: false,
+  ilike: false,
+  lateralJoin: false,
+  distinctOn: false,
+  partialIndexes: true,
+  conflictTargetConstraint: false,
+  transactionalDdl: true,
+  createManyAndReturn: true,
+  jsonColumnType: false,
+  orderByNulls: true,
+  fullTextEngines: Object.freeze(["fts5"]),
+  rowLockStrengths: Object.freeze([]),
+  rowLockWaitPolicies: Object.freeze([]),
+  advisoryLocks: false,
+  timeOfDayTypes: Object.freeze([]),
+  uuidColumns: "text",
+  localDateColumns: true
+});
+var MYSQL_CAPABILITIES = Object.freeze({
+  rowRuleAppendOnly: true,
+  rowRuleFixed: true,
+  rowRuleRowFixed: true,
+  rowRuleFrozen: true,
+  fixedNamespaces: false,
+  externalObjects: false,
+  indexOperatorClasses: false,
+  exclusionConstraints: false,
+  exclusionExtensions: Object.freeze([]),
+  checkNormalization: "temporary",
+  expressionIndexes: true,
+  generatedColumns: true,
+  generatedColumnNormalization: "temporary",
+  schemaCheckExpressions: false,
+  predicateExpressions: predicateExpressions({ legacy: noUsages }),
+  predicateArithmeticTypes: Object.freeze(["Int", "BigInt", "Float", "Decimal"]),
+  nativeRowLevelSecurity: false,
+  returning: false,
+  scalarArrays: false,
+  nativeEnums: true,
+  ilike: false,
+  lateralJoin: false,
+  distinctOn: false,
+  partialIndexes: false,
+  conflictTargetConstraint: false,
+  transactionalDdl: false,
+  createManyAndReturn: false,
+  jsonColumnType: true,
+  orderByNulls: false,
+  fullTextEngines: Object.freeze(["fulltext"]),
+  rowLockStrengths: Object.freeze(["update", "share"]),
+  rowLockWaitPolicies: Object.freeze(["wait", "nowait", "skipLocked"]),
+  advisoryLocks: false,
+  timeOfDayTypes: Object.freeze(["time"]),
+  uuidColumns: "unsupported",
+  localDateColumns: true
+});
+var DIALECT_CAPABILITIES = Object.freeze({
+  postgres: POSTGRES_CAPABILITIES,
+  sqlite: SQLITE_CAPABILITIES,
+  mysql: MYSQL_CAPABILITIES
+});
+
+// packages/schema/src/predicate.ts
+var PREDICATE_COMPARISON_OPS = [
+  "eq",
+  "ne",
+  "gt",
+  "gte",
+  "lt",
+  "lte"
+];
+function isPredicateFieldRef(operand) {
+  return operand.kind === "field";
+}
+function predicateFieldNames(params) {
+  return [...new Set(inspectPredicate(params).expressions.flatMap((expression) => expression.kind === "field" ? [expression.name] : []))];
+}
+function inspectPredicate(params) {
+  return inspectInput(params);
+}
+function inspectPredicateExpression(params) {
+  return inspectInput(params);
+}
+function inspectInput(params) {
+  if (params.predicate === undefined === (params.expression === undefined))
+    throw invalidOperand();
+  const expressions = [];
+  const kinds = new Set;
+  const object = (node) => {
+    if (typeof node !== "object" || node === null || Array.isArray(node))
+      throw invalidOperand();
+  };
+  const value = (node) => {
+    object(node);
+    if (node.kind !== "value" || !["string", "number", "boolean"].includes(typeof node.value))
+      throw invalidOperand();
+    kinds.add("value");
+  };
+  const operand = (node) => {
+    object(node);
+    if (node.kind === "value")
+      value(node);
+    else
+      expression(node);
+  };
+  const field = (node) => {
+    object(node);
+    if (node.kind !== "field")
+      throw invalidOperand();
+    expression(node);
+  };
+  const expression = (node) => {
+    object(node);
+    switch (node.kind) {
+      case "field":
+        if (typeof node.name !== "string")
+          throw invalidOperand();
+        expressions.push(node);
+        kinds.add(node.kind);
+        return;
+      case "jsonText":
+        expressions.push(node);
+        kinds.add(node.kind);
+        field(node.field);
+        return;
+      case "length":
+      case "lower":
+      case "upper":
+        expressions.push(node);
+        kinds.add(node.kind);
+        expression(node.expression);
+        return;
+      case "add":
+      case "sub":
+      case "mul":
+        expressions.push(node);
+        kinds.add(node.kind);
+        expression(node.left);
+        operand(node.right);
+        return;
+      default:
+        throw invalidOperand();
+    }
+  };
+  const walk = (node) => {
+    object(node);
+    switch (node.kind) {
+      case "compare":
+        if (!PREDICATE_COMPARISON_OPS.includes(node.op))
+          throw invalidOperand();
+        kinds.add(node.kind);
+        expression(node.left);
+        operand(node.right);
+        return;
+      case "inList":
+        if (!Array.isArray(node.values) || node.negate !== undefined && node.negate !== true)
+          throw invalidOperand();
+        kinds.add(node.kind);
+        field(node.field);
+        for (const entry of node.values)
+          value(entry);
+        return;
+      case "isNull":
+        if (node.negate !== undefined && node.negate !== true)
+          throw invalidOperand();
+        kinds.add(node.kind);
+        field(node.field);
+        return;
+      case "and":
+      case "or":
+        if (!Array.isArray(node.operands))
+          throw invalidOperand();
+        kinds.add(node.kind);
+        for (const child of node.operands)
+          walk(child);
+        return;
+      case "not":
+      case "isTrue":
+        kinds.add(node.kind);
+        walk(node.operand);
+        return;
+      default:
+        throw invalidOperand();
+    }
+  };
+  if (params.predicate !== undefined)
+    walk(params.predicate);
+  else
+    expression(params.expression);
+  return { expressions, nodeKinds: [...kinds] };
+}
+function invalidOperand() {
+  return new VibeError({
+    code: "VIBE_SCHEMA_INVALID",
+    message: "A schema predicate requires valid Boolean nodes, scalar expression children and JSON-safe literals only on operand right sides",
+    meta: { rule: "predicate-operand-invalid" }
+  });
+}
+var POSTGRES_PREDICATE_NATIVE_TYPES = Object.freeze({
+  String: Object.freeze(["text", "varchar", "charactervarying", "char", "character", "bpchar", "citext"]),
+  Int: Object.freeze(["integer", "int", "int4", "smallint", "int2"]),
+  BigInt: Object.freeze(["bigint", "int8"]),
+  Float: Object.freeze(["real", "float4", "doubleprecision", "float8"]),
+  Decimal: Object.freeze(["decimal", "numeric"])
+});
+function postgresNativeOperandIssue(params) {
+  for (const expression of params.expressions) {
+    let operands;
+    switch (expression.kind) {
+      case "lower":
+      case "upper":
+        operands = [expression.expression];
+        break;
+      case "add":
+      case "sub":
+      case "mul":
+        operands = [expression.left, expression.right];
+        break;
+      default:
+        continue;
+    }
+    for (const operand of operands) {
+      if (operand.kind !== "field")
+        continue;
+      const field = params.model.fields.find((candidate) => candidate.name === operand.name);
+      if (field === undefined || field.nativeType === undefined || field.isList || field.isUnsupported === true || isLocalDateField({ field }))
+        continue;
+      const text = expression.kind === "lower" || expression.kind === "upper";
+      const numeric = field.type === "Int" || field.type === "BigInt" || field.type === "Float" || field.type === "Decimal";
+      const family = text ? field.type === "String" ? "String" : undefined : numeric ? field.type : undefined;
+      if (family === undefined)
+        continue;
+      const base = field.nativeType.trim().toLowerCase().replace(/\(.*$/s, "").replace(/[\s_]+/g, "");
+      if (POSTGRES_PREDICATE_NATIVE_TYPES[family].includes(base))
+        continue;
+      return {
+        node: expression.kind,
+        feature: `predicateNativeTypes.${family}.${base}`,
+        hint: `${params.model.name}.${field.name} is PostgreSQL ${field.nativeType.trim()}, which has no ${text ? `${expression.kind}()` : `same-family ${expression.kind} operator`}; use a standard ${family} native type or reviewed raw SQL`
+      };
+    }
+  }
+  return;
+}
+function predicateCapabilityIssue(params) {
+  const inspection = inspectInput(params);
+  const capabilities = DIALECT_CAPABILITIES[params.dialect];
+  for (const node of inspection.nodeKinds) {
+    if (capabilities.predicateExpressions[node].includes(params.usage))
+      continue;
+    const legacy = node === "jsonText" || node === "length" || node === "isTrue";
+    return { node, feature: legacy ? params.usage === "check" ? "schemaCheckExpressions" : "schema CHECK expressions outside CHECK constraints" : `predicateExpressions.${node}.${params.usage}` };
+  }
+  if (params.model === undefined)
+    return;
+  if (params.dialect === "postgres") {
+    const native = postgresNativeOperandIssue({ expressions: inspection.expressions, model: params.model });
+    if (native !== undefined)
+      return native;
+  }
+  const type = (expression) => {
+    switch (expression.kind) {
+      case "field": {
+        const field = params.model?.fields.find((candidate) => candidate.name === expression.name);
+        return field === undefined || field.isList || field.isUnsupported ? undefined : field.type;
+      }
+      case "jsonText":
+      case "lower":
+      case "upper":
+        return "String";
+      case "length":
+        return "Int";
+      case "add":
+      case "sub":
+      case "mul": {
+        const left = type(expression.left);
+        if (left !== "Int" && left !== "BigInt" && left !== "Float" && left !== "Decimal")
+          return;
+        return expression.right.kind === "value" || type(expression.right) === left ? left : undefined;
+      }
+    }
+  };
+  for (const expression of inspection.expressions) {
+    if (expression.kind !== "add" && expression.kind !== "sub" && expression.kind !== "mul")
+      continue;
+    const family = type(expression);
+    if (family === "Int" || family === "BigInt" || family === "Float" || family === "Decimal") {
+      if (!capabilities.predicateArithmeticTypes.includes(family))
+        return { node: expression.kind, feature: `predicateArithmeticTypes.${family}` };
+    }
+  }
+  return;
+}
+function assertPredicateCapabilities(params) {
+  const issue = predicateCapabilityIssue(params);
+  if (issue !== undefined)
+    throw unsupportedCapability({ dialect: params.dialect, feature: issue.feature, ...issue.hint === undefined ? {} : { hint: issue.hint } });
+}
+function predicateKey(params) {
+  const structuredKinds = ["jsonText", "length", "isTrue", "add", "sub", "mul", "lower", "upper"];
+  if (inspectPredicate(params).nodeKinds.some((kind) => structuredKinds.includes(kind))) {
+    const scalar = (node) => {
+      switch (node.kind) {
+        case "field":
+          return ["field", node.name];
+        case "jsonText":
+          return ["jsonText", node.field.name, node.path];
+        case "length":
+        case "lower":
+        case "upper":
+          return [node.kind, scalar(node.expression)];
+        case "add":
+        case "sub":
+        case "mul":
+          return [node.kind, scalar(node.left), node.right.kind === "value" ? ["value", node.right.value] : scalar(node.right)];
+      }
+    };
+    const key = (node) => {
+      switch (node.kind) {
+        case "compare":
+          return [node.kind, node.op, scalar(node.left), node.right.kind === "value" ? ["value", node.right.value] : scalar(node.right)];
+        case "inList":
+          return [node.kind, node.field.name, node.negate === true, node.values.map((value) => value.value)];
+        case "isNull":
+          return [node.kind, node.field.name, node.negate === true];
+        case "and":
+        case "or":
+          return [node.kind, node.operands.map(key)];
+        case "not":
+        case "isTrue":
+          return [node.kind, key(node.operand)];
+      }
+    };
+    return `check:${JSON.stringify(key(params.predicate))}`;
+  }
+  const expression = (node) => {
+    switch (node.kind) {
+      case "field":
+        return `f:${node.name}`;
+      case "jsonText":
+        return `jsonText(${JSON.stringify([node.field.name, node.path])})`;
+      case "length":
+      case "lower":
+      case "upper":
+        return `${node.kind}(${expression(node.expression)})`;
+      case "add":
+      case "sub":
+      case "mul":
+        return `${node.kind}(${expression(node.left)},${node.right.kind === "value" ? `v:${typeof node.right.value}:${String(node.right.value)}` : expression(node.right)})`;
+    }
+  };
+  const encode = (node) => {
+    switch (node.kind) {
+      case "compare":
+        return `cmp(${node.op},${node.left.kind === "field" ? node.left.name : expression(node.left)},${node.right.kind === "value" ? `v:${typeof node.right.value}:${String(node.right.value)}` : expression(node.right)})`;
+      case "inList":
+        return `in${node.negate === true ? "!" : ""}(${node.field.name},[${node.values.map((entry) => `${typeof entry.value}:${String(entry.value)}`).join("|")}])`;
+      case "isNull":
+        return `null${node.negate === true ? "!" : ""}(${node.field.name})`;
+      case "and":
+      case "or":
+        return `${node.kind}(${node.operands.map(encode).join(",")})`;
+      case "not":
+        return `not(${encode(node.operand)})`;
+      case "isTrue":
+        return `isTrue(${encode(node.operand)})`;
+    }
+  };
+  return encode(params.predicate);
+}
+
+// packages/schema/src/prisma-literal.ts
+var STRING_ESCAPES = {
+  '"': '"',
+  "'": "'",
+  "\\": "\\",
+  "/": "/",
+  n: `
+`,
+  r: "\r",
+  t: "\t",
+  b: "\b",
+  f: "\f"
+};
+function malformed(params) {
+  return new VibeError({
+    code: "VIBE_SCHEMA_INVALID",
+    message: `Malformed string literal ${JSON.stringify(params.raw)}: ${params.detail}`,
+    meta: { issues: [{ rule: "malformed-string-literal", message: params.detail }], literal: params.raw }
+  });
+}
+function decodePrismaString(params) {
+  const { raw } = params;
+  const quoted = raw.length >= 2 && raw.startsWith('"') && raw.endsWith('"');
+  const body = quoted ? raw.slice(1, -1) : raw;
+  if (!body.includes("\\"))
+    return body;
+  let out = "";
+  for (let index = 0;index < body.length; index += 1) {
+    const char = body[index];
+    if (char !== "\\") {
+      out += char;
+      continue;
+    }
+    const next = body[index + 1];
+    if (next === undefined)
+      throw malformed({ raw, detail: "it ends with a lone backslash" });
+    if (next === "u") {
+      const digits = body.slice(index + 2, index + 6);
+      if (!/^[0-9a-fA-F]{4}$/.test(digits)) {
+        throw malformed({ raw, detail: `\\u must be followed by four hex digits, found "${digits}"` });
+      }
+      out += String.fromCharCode(Number.parseInt(digits, 16));
+      index += 5;
+      continue;
+    }
+    const decoded = STRING_ESCAPES[next];
+    if (decoded === undefined)
+      throw malformed({ raw, detail: `unknown escape "\\${next}"` });
+    out += decoded;
+    index += 1;
+  }
+  return out;
+}
+function unicodeEscape(params) {
+  return `\\u${params.char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
+function encodePrismaString(params) {
+  const { value } = params;
+  let out = '"';
+  for (const char of value) {
+    if (char === "\\")
+      out += "\\\\";
+    else if (char === '"')
+      out += "\\\"";
+    else if (char === `
+`)
+      out += "\\n";
+    else if (char === "\r")
+      out += "\\r";
+    else if (char === "\t")
+      out += "\\t";
+    else if (char < " " || char === "\x7F")
+      out += unicodeEscape({ char });
+    else
+      out += char;
+  }
+  return `${out}"`;
+}
+var INTEGER_LITERAL = /^-?\d+$/;
+function exactIntegerLiteral(params) {
+  const { text } = params;
+  if (!INTEGER_LITERAL.test(text)) {
+    throw new VibeError({
+      code: "VIBE_SCHEMA_INVALID",
+      message: `Not an integer literal: ${JSON.stringify(text)}`,
+      meta: { issues: [{ rule: "malformed-integer-literal", message: text }], literal: text }
+    });
+  }
+  const asNumber = Number(text);
+  if (Number.isSafeInteger(asNumber))
+    return asNumber;
+  return BigInt(text).toString();
+}
+var DECIMAL_LITERAL = /^-?\d+(\.\d+)?([eE][+-]?\d+)?$/;
+function exactDecimalLiteral(params) {
+  const { text } = params;
+  if (!DECIMAL_LITERAL.test(text)) {
+    throw new VibeError({
+      code: "VIBE_SCHEMA_INVALID",
+      message: `Not a numeric literal: ${JSON.stringify(text)}`,
+      meta: { issues: [{ rule: "malformed-numeric-literal", message: text }], literal: text }
+    });
+  }
+  if (INTEGER_LITERAL.test(text))
+    return exactIntegerLiteral({ text });
+  const mantissa = text.replace(/[eE].*$/, "").replace("-", "").replace(".", "").replace(/^0+/, "");
+  return mantissa.length <= 15 ? Number(text) : text;
+}
+
+// packages/schema/src/index-expressions.ts
+function isExpressionIndex(params) {
+  return "expressions" in params.index;
+}
+function indexKeyTerms(params) {
+  if (isExpressionIndex(params)) {
+    const descriptor = Object.getOwnPropertyDescriptor(params.index, "expressions");
+    if (descriptor?.enumerable !== true || !("value" in descriptor) || !Array.isArray(descriptor.value))
+      throw invalid({ message: "Expression keys must be an enumerable data array" });
+    return descriptor.value;
+  }
+  return params.index.fields.map((field) => ({ kind: "field", field }));
+}
+function invalid(params) {
+  return new VibeError({ code: "VIBE_SCHEMA_INVALID", message: params.message, meta: { rule: "expression-index-shape" } });
+}
+function record(params) {
+  const { value, required, optional = [] } = params;
+  if (value === null || typeof value !== "object" || Array.isArray(value) || ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    return false;
+  const keys = Reflect.ownKeys(value);
+  if (required.some((key) => !Object.hasOwn(value, key)) || keys.some((key) => typeof key !== "string" || !required.includes(key) && !optional.includes(key)))
+    return false;
+  return keys.every((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return descriptor?.enumerable === true && "value" in descriptor;
+  });
+}
+function text(params) {
+  return typeof params.value === "string" && params.value.trim().length > 0 && !params.value.includes("\x00");
+}
+function sort(params) {
+  return params.value === undefined || params.value === "asc" || params.value === "desc";
+}
+function expressionShape(params) {
+  const { value, parents = new Set, operand = false } = params;
+  if (!record({ value, required: ["kind"], optional: ["name", "expression", "left", "right", "value", "field", "path"] }))
+    return false;
+  const node = value;
+  if (parents.has(node))
+    return false;
+  const next = new Set(parents).add(node);
+  const child = (value, operand = false) => expressionShape({ value, parents: next, operand });
+  switch (node.kind) {
+    case "field":
+      return record({ value, required: ["kind", "name"] }) && text({ value: node.name });
+    case "value":
+      return operand && record({ value, required: ["kind", "value"] }) && (typeof node.value === "string" && !node.value.includes("\x00") || typeof node.value === "number" && Number.isFinite(node.value) || typeof node.value === "boolean");
+    case "lower":
+    case "upper":
+    case "length":
+      return record({ value, required: ["kind", "expression"] }) && child(node.expression);
+    case "add":
+    case "sub":
+    case "mul":
+      return record({ value, required: ["kind", "left", "right"] }) && child(node.left) && child(node.right, true);
+    case "jsonText":
+      return record({ value, required: ["kind", "field", "path"] }) && child(node.field) && node.field.kind === "field" && Array.isArray(node.path) && node.path.every((part) => typeof part === "string" && !part.includes("\x00"));
+    default:
+      return false;
+  }
+}
+function dataOnly(params) {
+  const { value, parents = new Set } = params;
+  if (value === null || value === undefined || typeof value === "string" || typeof value === "boolean")
+    return true;
+  if (typeof value === "number")
+    return Number.isFinite(value);
+  if (typeof value !== "object" || parents.has(value))
+    return false;
+  if (!Array.isArray(value) && ![Object.prototype, null].includes(Object.getPrototypeOf(value)))
+    return false;
+  const next = new Set(parents).add(value);
+  for (const key of Reflect.ownKeys(value)) {
+    if (Array.isArray(value) && key === "length")
+      continue;
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (typeof key !== "string" || descriptor?.enumerable !== true || !("value" in descriptor) || !dataOnly({ value: descriptor.value, parents: next }))
+      return false;
+  }
+  return !Array.isArray(value) || Object.keys(value).length === value.length;
+}
+function shapeIssue(params) {
+  const { index } = params;
+  if (!dataOnly({ value: index }))
+    return "Expression indexes accept JSON-safe plain data only, not accessors, callbacks or cycles";
+  if (!record({ value: index, required: ["kind", "fields", "expressions"], optional: ["name", "clientName", "constraintName", "where", "wherePredicate", "nullsNotDistinct"] }))
+    return "Expression indexes require canonical index data properties";
+  if (typeof index.kind !== "string")
+    return "Index kind must be a string";
+  if (index.nullsNotDistinct !== undefined && typeof index.nullsNotDistinct !== "boolean" || index.name !== undefined && !text({ value: index.name }) || index.where !== undefined && !text({ value: index.where }))
+    return "Expression index names, predicates and flags must have their canonical data types";
+  const descriptor = Object.getOwnPropertyDescriptor(index, "expressions");
+  if (descriptor?.enumerable !== true || !("value" in descriptor) || !Array.isArray(descriptor.value) || descriptor.value.length === 0)
+    return "Expression keys require a nonempty enumerable data array";
+  if (!Array.isArray(index.fields) || index.fields.length !== 0)
+    return "Expression keys must stay outside fields; fields must be empty";
+  const terms = descriptor.value;
+  let computed = false;
+  for (let ordinal = 0;ordinal < terms.length; ordinal++) {
+    const entry = Object.getOwnPropertyDescriptor(terms, String(ordinal));
+    if (entry?.enumerable !== true || !("value" in entry))
+      return "Expression key arrays cannot contain holes or accessors";
+    const term = entry.value;
+    if (!record({ value: term, required: ["kind"], optional: ["field", "expression", "sql", "sort"] }))
+      return "Index key terms must be plain enumerable data objects";
+    const key = term;
+    if (key.kind === "field") {
+      if (!record({ value: key, required: ["kind", "field"] }) || !record({ value: key.field, required: ["name"], optional: ["sort", "operatorClass"] }) || !text({ value: key.field.name }) || !sort({ value: key.field.sort }))
+        return "Malformed named field in expression keys";
+    } else if (key.kind === "expression") {
+      if (!record({ value: key, required: ["kind", "expression"], optional: ["sort"] }) || !sort({ value: key.sort }) || !expressionShape({ value: key.expression }))
+        return "Malformed scalar expression key";
+      if (!["lower", "upper", "add", "sub", "mul", "length", "jsonText"].includes(key.expression.kind))
+        return "A typed index root must be a computed scalar node, not a wrapped field";
+      computed = true;
+    } else if (key.kind === "raw") {
+      if (!record({ value: key, required: ["kind", "sql"], optional: ["sort"] }) || !text({ value: key.sql }) || !sort({ value: key.sort }))
+        return "A raw key requires nonempty NUL-free scalar SQL and a valid direction";
+      if (!text({ value: index.name }))
+        return "A raw expression index requires an explicit physical name (map)";
+      computed = true;
+    } else
+      return "Unknown index key term kind";
+  }
+  return computed ? undefined : "Plain-only indexes use fields and omit expressions";
+}
+function expressionFields(params) {
+  return inspectPredicateExpression(params).expressions.flatMap((node) => node.kind === "field" ? [node.name] : []);
+}
+function indexKeyFieldNames(params) {
+  const terms = indexKeyTerms(params);
+  if (terms.some((term) => term.kind === "raw"))
+    return;
+  return [...new Set(terms.flatMap((term) => term.kind === "field" ? [term.field.name] : term.kind === "expression" ? expressionFields(term) : []))];
+}
+function structuralData(params) {
+  const { value, model } = params;
+  if (Array.isArray(value))
+    return value.map((child) => structuralData({ value: child, model }));
+  if (value === null || typeof value !== "object")
+    return value;
+  const node = value;
+  const result = {};
+  for (const key of Object.keys(node).sort()) {
+    const child = node[key];
+    if (key === "name" && (node.kind === "field" || node.kind === undefined && ("name" in node) && !("namespace" in node)))
+      result[key] = model?.fields.find((field) => field.name === child)?.dbName ?? child;
+    else
+      result[key] = structuralData({ value: child, model });
+  }
+  return result;
+}
+function indexKeyDefinitionKey(params) {
+  const { index, model } = params;
+  if (!isExpressionIndex({ index })) {
+    const columns = index.fields.map((field) => [model?.fields.find((entry) => entry.name === field.name)?.dbName ?? field.name, field.sort === "desc", field.operatorClass === undefined ? null : [field.operatorClass.namespace, field.operatorClass.name]]);
+    return JSON.stringify([index.kind === "unique", index.nullsNotDistinct === true, index.kind === "unique" ? "btree" : index.kind, columns, index.where?.trim() ?? ""]);
+  }
+  const issue = shapeIssue({ index });
+  if (issue !== undefined)
+    throw invalid({ message: issue });
+  return JSON.stringify(["expression", index.kind, structuralData({ value: index.expressions, model }), index.nullsNotDistinct === true, index.where?.trim() ?? "", structuralData({ value: index.wherePredicate, model }) ?? null]);
+}
+function scalarType(params) {
+  const { expression, model, dialect, add } = params;
+  const recurse = (expression) => scalarType({ ...params, expression });
+  switch (expression.kind) {
+    case "field": {
+      const field = model.fields.find((entry) => entry.name === expression.name);
+      if (field === undefined || field.isList || field.isUnsupported === true) {
+        add({ rule: "expression-index-field", message: `${expression.name} must be a declared scalar, supported column` });
+        return;
+      }
+      if (isLocalDateField({ field })) {
+        add({ rule: "expression-index-type", message: "Local dates are not text or arithmetic operands" });
+        return;
+      }
+      if (dialect === "mysql" && field.default?.kind === "autoincrement")
+        add({ rule: "expression-index-mysql-autoincrement", feature: "expressionIndexAutoIncrement", message: "MySQL functional keys cannot reference an auto-increment column" });
+      return field.type;
+    }
+    case "lower":
+    case "upper": {
+      const type = recurse(expression.expression);
+      if (type !== undefined && type !== "String")
+        add({ rule: "expression-index-type", message: `${expression.kind} requires a text operand` });
+      if (dialect === "mysql")
+        for (const name of expressionFields({ expression })) {
+          const field = model.fields.find((entry) => entry.name === name);
+          if (field?.nativeType !== undefined && /^(tinytext|text|mediumtext|longtext)\b/i.test(field.nativeType.trim()))
+            add({ rule: "expression-index-mysql-text", feature: "expressionIndexTextResult", message: "MySQL lower/upper over unbounded TEXT requires a bounded VARCHAR source or an explicit raw cast; no automatic width is chosen" });
+        }
+      return "String";
+    }
+    case "add":
+    case "sub":
+    case "mul": {
+      const left = recurse(expression.left);
+      const right = expression.right.kind === "value" ? undefined : recurse(expression.right);
+      if (left !== "Int" && left !== "BigInt" && left !== "Float" && left !== "Decimal") {
+        if (left !== undefined)
+          add({ rule: "expression-index-type", message: "Arithmetic requires a numeric scalar family" });
+        return;
+      }
+      if (right !== undefined && right !== left)
+        add({ rule: "expression-index-type", message: "Arithmetic operands require the same numeric family" });
+      if (expression.right.kind === "value") {
+        const value = expression.right.value;
+        if (left === "Int" || left === "BigInt") {
+          if (!(typeof value === "number" && Number.isSafeInteger(value) || typeof value === "string" && /^-?(0|[1-9]\d*)$/.test(value)))
+            add({ rule: "expression-index-literal", message: "Integer arithmetic requires exact integer literals" });
+          else {
+            const number = BigInt(value);
+            const min = left === "Int" ? -2147483648n : -(2n ** 63n);
+            const max = left === "Int" ? 2147483647n : 2n ** 63n - 1n;
+            if (number < min || number > max)
+              add({ rule: "expression-index-literal", message: "Integer literal is outside the scalar's signed range" });
+          }
+        } else if (left === "Float" ? typeof value !== "number" || !Number.isFinite(value) : typeof value !== "string" || !/^-?(0|[1-9]\d*)(\.\d+)?$/.test(value))
+          add({ rule: "expression-index-literal", message: `${left} literal has the wrong carrier or numeric format` });
+      }
+      return left;
+    }
+    case "length":
+      return "Int";
+    case "jsonText":
+      return "String";
+  }
+}
+var MYSQL_FUNCTIONAL_KEY_LIMITS = Object.freeze({ bytes: 3072, bytesPerCharacter: 4, defaultStringLength: 191, arithmeticBytes: 8, intBytes: 4, wideBytes: 8, decimalBytes: 32, enumBytes: 2, booleanBytes: 1 });
+function mysqlIndexKeyWidth(params) {
+  const limits = MYSQL_FUNCTIONAL_KEY_LIMITS;
+  let refusal;
+  const refuse = (params) => {
+    refusal ??= params;
+    return 0;
+  };
+  const width = ({ name, functional }) => {
+    const field = params.model.fields.find((candidate) => candidate.name === name);
+    if (field === undefined)
+      return 0;
+    if (functional && field.default?.kind === "autoincrement")
+      return refuse({ field: name, feature: "mysqlFunctionalAutoIncrementSource" });
+    if (field.type === "String") {
+      const native = field.nativeType?.trim();
+      const length = native === undefined ? limits.defaultStringLength : Number(/^(?:varchar|char)\s*\(\s*(\d+)\s*\)$/i.exec(native)?.[1]);
+      if (!Number.isSafeInteger(length) || length <= 0)
+        return refuse({ field: name, feature: "mysqlFunctionalTextResult" });
+      return length * limits.bytesPerCharacter;
+    }
+    if (functional && field.nativeType !== undefined) {
+      const base = field.nativeType.toLowerCase().replace(/\(.*$/s, "").replace(/\s+/g, "");
+      const allowed = field.type === "Int" ? ["tinyint", "smallint", "mediumint", "int", "integer"] : field.type === "BigInt" ? ["bigint"] : field.type === "Float" ? ["float", "double", "real"] : field.type === "Decimal" ? ["decimal", "numeric", "dec"] : [];
+      if (!allowed.includes(base))
+        return refuse({ field: name, feature: "mysqlFunctionalNativeType" });
+    }
+    return isEnumType(field.type) ? limits.enumBytes : field.type === "Int" ? limits.intBytes : field.type === "Boolean" ? limits.booleanBytes : field.type === "Decimal" ? limits.decimalBytes : limits.wideBytes;
+  };
+  let bytes = 0;
+  let raw = false;
+  for (const term of params.terms) {
+    if (term.kind === "field")
+      bytes += width({ name: term.field.name, functional: false });
+    else if (term.kind === "expression") {
+      const widths = (indexKeyFieldNames({ index: { fields: [], expressions: [term] } }) ?? []).map((name) => width({ name, functional: true }));
+      bytes += Math.max(term.expression.kind === "lower" || term.expression.kind === "upper" ? 0 : limits.arithmeticBytes, ...widths);
+    } else
+      raw = true;
+    if (refusal !== undefined)
+      return { kind: "refused", ...refusal };
+  }
+  return raw ? { kind: "raw" } : { kind: "bytes", bytes };
+}
+function validateIndexExpressions(params) {
+  const issues = [];
+  let expressionUniquesByModel;
+  for (const model of params.schema.models)
+    for (const index of model.indexes) {
+      if (!isExpressionIndex({ index }))
+        continue;
+      const add = (issue) => {
+        issues.push({ ...issue, model: model.name });
+      };
+      const before = issues.length;
+      const shape = shapeIssue({ index });
+      if (shape !== undefined) {
+        add({ rule: "expression-index-shape", message: shape });
+        continue;
+      }
+      if (index.kind === "unique") {
+        expressionUniquesByModel ??= new Map;
+        const indexes = expressionUniquesByModel.get(model);
+        if (indexes === undefined)
+          expressionUniquesByModel.set(model, [index]);
+        else
+          indexes.push(index);
+      }
+      if (index.clientName !== undefined || index.constraintName !== undefined)
+        add({ rule: "expression-index-selector", message: "Expression indexes cannot name a client selector or a unique constraint; use map for the physical index" });
+      if ((index.where !== undefined || index.wherePredicate !== undefined) && !DIALECT_CAPABILITIES[params.dialect].partialIndexes)
+        add({ rule: "expression-index-partial", feature: "partialIndexes", message: "This dialect cannot admit a partial expression index" });
+      if (index.nullsNotDistinct === true && index.kind !== "unique")
+        add({ rule: "expression-index-null-semantics", message: "NULLS NOT DISTINCT only applies to a unique expression index" });
+      if (index.nullsNotDistinct === true && params.dialect !== "postgres")
+        add({ rule: "expression-index-null-semantics", feature: "nullsNotDistinct", message: "NULLS NOT DISTINCT expression indexes require PostgreSQL/PGlite" });
+      if (!DIALECT_CAPABILITIES[params.dialect].expressionIndexes)
+        add({ rule: "expression-index-capability", feature: "expressionIndexes", message: "Expression indexes are unsupported on this dialect" });
+      if (index.kind !== "unique" && index.kind !== "btree")
+        add({ rule: "expression-index-capability", feature: "expressionIndexAccessMethod", message: "Expression keys admit ordinary BTree indexes only" });
+      for (const term of indexKeyTerms({ index })) {
+        if (term.kind === "raw")
+          continue;
+        if (term.kind === "field") {
+          const field = model.fields.find((entry) => entry.name === term.field.name);
+          if (field === undefined || field.isList || field.isUnsupported === true)
+            add({ rule: "expression-index-field", message: `${term.field.name} must be a declared scalar supported column` });
+          if (term.field.operatorClass !== undefined)
+            add({ rule: "expression-index-capability", feature: "expressionIndexOperatorClasses", message: "Custom operator classes are not admitted on expression-bearing keys" });
+          continue;
+        }
+        const capability = predicateCapabilityIssue({ expression: term.expression, model, dialect: params.dialect, usage: "indexExpression" });
+        if (capability !== undefined)
+          add({ rule: "expression-index-capability", feature: capability.feature, message: capability.hint ?? `Scalar node ${capability.node} is not admitted in an index key` });
+        scalarType({ expression: term.expression, model, dialect: params.dialect, add });
+      }
+      if (params.dialect === "mysql" && issues.length === before) {
+        const width = mysqlIndexKeyWidth({ terms: indexKeyTerms({ index }), model });
+        if (width.kind === "refused")
+          add({ rule: "expression-index-mysql-storage", feature: width.feature, message: `${model.name}.${width.field}: use bounded VARCHAR/CHAR, an explicit raw cast with intentional width/collation, or a generated column; no automatic cast is inserted` });
+        else if (width.kind === "bytes" && width.bytes > MYSQL_FUNCTIONAL_KEY_LIMITS.bytes)
+          add({ rule: "expression-index-mysql-width", feature: "mysqlFunctionalKeyWidth", message: `The complete utf8mb4 key requires up to ${width.bytes} bytes; modern InnoDB admits at most ${MYSQL_FUNCTIONAL_KEY_LIMITS.bytes}. Use narrower storage or an explicit reviewed raw key` });
+      }
+    }
+  if (expressionUniquesByModel === undefined || issues.some((issue) => issue.rule === "expression-index-shape"))
+    return issues;
+  const targets = new Map;
+  for (const [target, indexes] of expressionUniquesByModel) {
+    const sources = indexes.map((index) => {
+      const names = indexKeyFieldNames({ index });
+      return names === undefined ? undefined : new Set(names);
+    });
+    const plain = [
+      ...target.fields.filter((field) => field.isId || field.isUnique).map((field) => [field.name]),
+      ...target.primaryKey === undefined ? [] : [target.primaryKey.fields],
+      ...target.indexes.filter((index) => index.kind === "unique" && !isExpressionIndex({ index }) && index.where === undefined && index.wherePredicate === undefined).map((index) => index.fields.map((field) => field.name))
+    ];
+    const distinctPlainKeys = new Set;
+    const repeatedPlainKeys = [];
+    for (const key of plain) {
+      if (new Set(key).size === key.length)
+        distinctPlainKeys.add(JSON.stringify([...key].sort()));
+      else
+        repeatedPlainKeys.push(key);
+    }
+    targets.set(target.name, { sources, distinctPlainKeys, repeatedPlainKeys });
+  }
+  for (const model of params.schema.models)
+    for (const relation of model.relations) {
+      if (relation.references === undefined || relation.fields === undefined || relation.fields.length === 0)
+        continue;
+      const target = targets.get(relation.targetModel);
+      if (target === undefined)
+        continue;
+      const references = relation.references;
+      if (!target.sources.some((names) => names === undefined || references.every((name) => names.has(name))))
+        continue;
+      const plain = target.distinctPlainKeys.has(JSON.stringify([...references].sort())) || target.repeatedPlainKeys.some((key) => key.length === references.length && key.every((name) => references.includes(name)));
+      if (!plain)
+        issues.push({ rule: "expression-index-foreign-key", model: model.name, message: `Relation ${model.name}.${relation.name} cannot reference expression-index source fields without a separate plain unique key` });
+    }
+  return issues;
+}
+function assertIndexExpressions(params) {
+  const issues = validateIndexExpressions(params);
+  const structural = issues.filter((issue) => issue.feature === undefined);
+  if (structural.length > 0)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: structural.map((issue) => `${issue.model}: ${issue.message}`).join("; "), meta: { issues: structural } });
+  const denied = issues.find((issue) => issue.feature !== undefined);
+  if (denied !== undefined) {
+    const error = unsupportedCapability({ dialect: params.dialect, feature: denied.feature, hint: denied.message });
+    throw new VibeError({ code: error.code, message: error.message, meta: { ...error.meta, rule: denied.rule, model: denied.model, issues: [denied] } });
+  }
+}
+function scalarPrisma(params) {
+  const { operand, compact = false } = params;
+  switch (operand.kind) {
+    case "field":
+      return compact ? operand.name : `field(${encodePrismaString({ value: operand.name })})`;
+    case "value":
+      return `value(${typeof operand.value === "string" ? encodePrismaString({ value: operand.value }) : String(operand.value)})`;
+    case "lower":
+    case "upper":
+    case "length":
+      return `${operand.kind}(${scalarPrisma({ operand: operand.expression, compact: operand.expression.kind === "field" })})`;
+    case "add":
+    case "sub":
+    case "mul":
+      return `${operand.kind}(${scalarPrisma({ operand: operand.left })}, ${scalarPrisma({ operand: operand.right })})`;
+    case "jsonText":
+      throw invalid({ message: "CHECK-only JSON expressions cannot be spelled as index keys" });
+  }
+}
+function scalarDsl(params) {
+  const { expression, model } = params;
+  const family = (node) => node.kind === "field" ? model.fields.find((field) => field.name === node.name)?.type : node.kind === "lower" || node.kind === "upper" ? "String" : node.kind === "add" || node.kind === "sub" || node.kind === "mul" ? family(node.left) : undefined;
+  const render = (node) => scalarDsl({ expression: node, model });
+  switch (expression.kind) {
+    case "field":
+      return `i.field(${JSON.stringify(expression.name)})`;
+    case "lower":
+    case "upper":
+      return `i.${expression.kind}(${expression.expression.kind === "field" ? JSON.stringify(expression.expression.name) : render(expression.expression)})`;
+    case "add":
+    case "sub":
+    case "mul": {
+      const type = family(expression);
+      if (expression.right.kind === "value" && typeof expression.right.value === "string" && (type === "Int" || type === "BigInt" && expression.right.value === "-0"))
+        return JSON.stringify({ ...expression, __kind: type });
+      const right = expression.right.kind !== "value" ? render(expression.right) : typeof expression.right.value === "string" && type === "BigInt" ? `${expression.right.value}n` : JSON.stringify(expression.right.value);
+      return `i.${expression.kind}({ left: ${render(expression.left)}, right: ${right} })`;
+    }
+    case "jsonText":
+    case "length":
+      throw invalid({ message: "CHECK-only scalar helpers cannot be printed as index keys" });
+  }
+}
+function indexKeyDsl(params) {
+  const { term, model } = params;
+  const source = term.kind === "field" ? JSON.stringify(term.field.name) : term.kind === "raw" ? `i.sql({ text: ${JSON.stringify(term.sql)} })` : scalarDsl({ expression: term.expression, model });
+  const direction = term.kind === "field" ? term.field.sort : term.sort;
+  return direction === undefined ? source : `i.${direction}(${source})`;
+}
+function indexKeyPrisma(params) {
+  const { term } = params;
+  const direction = term.kind === "field" ? term.field.sort : term.sort;
+  const suffix = direction === undefined ? "" : `sort: ${direction === "desc" ? "Desc" : "Asc"}`;
+  if (term.kind === "field")
+    return `${term.field.name}${suffix === "" ? "" : `(${suffix})`}`;
+  const source = term.kind === "raw" ? `sql(${encodePrismaString({ value: term.sql })})` : scalarPrisma({ operand: term.expression });
+  return suffix === "" ? source : `${source.slice(0, -1)}, ${suffix})`;
+}
+
 // packages/schema/src/physical-names.ts
 var IDENTIFIER_LIMITS = Object.freeze({
   postgres: { max: 63, unit: "bytes" },
@@ -196,6 +1452,18 @@ function defaultIndexName(params) {
     dialect: params.dialect
   });
 }
+function defaultExpressionIndexName(params) {
+  const { table, model, index, dialect } = params;
+  if (!isExpressionIndex({ index }))
+    return defaultIndexName({ table, columns: index.fields.map((entry) => model.fields.find((field) => field.name === entry.name)?.dbName ?? entry.name), unique: index.kind === "unique", dialect });
+  const names = indexKeyFieldNames({ index });
+  if (names === undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "A raw expression index requires an explicit physical name (map)", meta: { rule: "expression-index-raw-name" } });
+  const columns = names.map((name) => model.fields.find((field) => field.name === name)?.dbName ?? name);
+  const keyIndex = { kind: index.kind, fields: [], expressions: index.expressions };
+  const digest = extensionOptionsHash({ options: { key: indexKeyDefinitionKey({ index: keyIndex, model }) } });
+  return fitDefaultName({ prefix: `${table}_${columns.join("_")}`, suffix: `_expr_${digest}${index.kind === "unique" ? "_key" : "_idx"}`, dialect });
+}
 function defaultForeignKeyName(params) {
   return fitDefaultName({ prefix: `${params.table}_${params.columns.join("_")}`, suffix: "_fkey", dialect: params.dialect });
 }
@@ -253,123 +1521,6 @@ function assertSqlNamespace(params) {
 function qualifiedSqlName(params) {
   return { namespace: params.namespace ?? params.defaultNamespace ?? SQL_NAMESPACES.postgres, name: params.name };
 }
-// packages/schema/src/capabilities.ts
-var POSTGRES_CAPABILITIES = Object.freeze({
-  fixedNamespaces: true,
-  externalObjects: true,
-  indexOperatorClasses: true,
-  exclusionConstraints: true,
-  exclusionExtensions: Object.freeze(["btree_gist"]),
-  checkNormalization: "rollback",
-  schemaCheckExpressions: true,
-  nativeRowLevelSecurity: true,
-  returning: true,
-  scalarArrays: true,
-  nativeEnums: true,
-  ilike: true,
-  lateralJoin: true,
-  distinctOn: true,
-  partialIndexes: true,
-  conflictTargetConstraint: true,
-  transactionalDdl: true,
-  createManyAndReturn: true,
-  jsonColumnType: true,
-  orderByNulls: true,
-  fullTextEngines: Object.freeze(["bm25", "tsvector"]),
-  rowLockStrengths: Object.freeze(["update", "noKeyUpdate", "share", "keyShare"]),
-  rowLockWaitPolicies: Object.freeze(["wait", "nowait", "skipLocked"]),
-  advisoryLocks: true,
-  timeOfDayTypes: Object.freeze(["time", "timetz"]),
-  uuidColumns: "native"
-});
-var SQLITE_CAPABILITIES = Object.freeze({
-  fixedNamespaces: false,
-  externalObjects: false,
-  indexOperatorClasses: false,
-  exclusionConstraints: false,
-  exclusionExtensions: Object.freeze([]),
-  checkNormalization: "sourceText",
-  schemaCheckExpressions: false,
-  nativeRowLevelSecurity: false,
-  returning: true,
-  scalarArrays: false,
-  nativeEnums: false,
-  ilike: false,
-  lateralJoin: false,
-  distinctOn: false,
-  partialIndexes: true,
-  conflictTargetConstraint: false,
-  transactionalDdl: true,
-  createManyAndReturn: true,
-  jsonColumnType: false,
-  orderByNulls: true,
-  fullTextEngines: Object.freeze(["fts5"]),
-  rowLockStrengths: Object.freeze([]),
-  rowLockWaitPolicies: Object.freeze([]),
-  advisoryLocks: false,
-  timeOfDayTypes: Object.freeze([]),
-  uuidColumns: "text"
-});
-var MYSQL_CAPABILITIES = Object.freeze({
-  fixedNamespaces: false,
-  externalObjects: false,
-  indexOperatorClasses: false,
-  exclusionConstraints: false,
-  exclusionExtensions: Object.freeze([]),
-  checkNormalization: "temporary",
-  schemaCheckExpressions: false,
-  nativeRowLevelSecurity: false,
-  returning: false,
-  scalarArrays: false,
-  nativeEnums: true,
-  ilike: false,
-  lateralJoin: false,
-  distinctOn: false,
-  partialIndexes: false,
-  conflictTargetConstraint: false,
-  transactionalDdl: false,
-  createManyAndReturn: false,
-  jsonColumnType: true,
-  orderByNulls: false,
-  fullTextEngines: Object.freeze(["fulltext"]),
-  rowLockStrengths: Object.freeze(["update", "share"]),
-  rowLockWaitPolicies: Object.freeze(["wait", "nowait", "skipLocked"]),
-  advisoryLocks: false,
-  timeOfDayTypes: Object.freeze(["time"]),
-  uuidColumns: "unsupported"
-});
-var DIALECT_CAPABILITIES = Object.freeze({
-  postgres: POSTGRES_CAPABILITIES,
-  sqlite: SQLITE_CAPABILITIES,
-  mysql: MYSQL_CAPABILITIES
-});
-
-// packages/schema/src/ir.ts
-var DIALECTS = ["postgres", "sqlite", "mysql"];
-function providerToDialect(params) {
-  const { provider } = params;
-  switch (provider) {
-    case "postgresql":
-    case "pglite":
-      return "postgres";
-    case "sqlite":
-      return "sqlite";
-    case "mysql":
-      return "mysql";
-  }
-}
-function isEnumType(fieldType) {
-  return typeof fieldType === "object" && "enum" in fieldType;
-}
-function fieldTypeIdentity(params) {
-  const { type } = params;
-  return isEnumType(type) ? type.namespace === undefined || type.namespace === "public" ? `enum:${type.enum}` : JSON.stringify(["enum", type.namespace, type.enum]) : type;
-}
-var ENUM_STORAGES = ["database", "string"];
-function enumStorageOf(params) {
-  return params.enumDef.storage ?? "database";
-}
-
 // packages/schema/src/native-rls-admission.ts
 function assertNativeRlsAdmission(params) {
   const { schema } = params;
@@ -394,210 +1545,552 @@ function assertNativeRlsAdmission(params) {
     }
   }
 }
-// packages/schema/src/reserved.ts
-var RESERVED_DELEGATE_NAMES = [
-  "findMany",
-  "findPage",
-  "findFirst",
-  "findUnique",
-  "findFirstOrThrow",
-  "findUniqueOrThrow",
-  "create",
-  "createMany",
-  "createManyAndReturn",
-  "update",
-  "updateMany",
-  "updateManyAndReturn",
-  "upsert",
-  "upsertMany",
-  "delete",
-  "deleteMany",
-  "count",
-  "aggregate",
-  "groupBy",
-  "fields"
-];
-var RESERVED_CLIENT_NAMES = [
-  "$connect",
-  "$disconnect",
-  "$transaction",
-  "$querySql",
-  "$querySqlResult",
-  "$executeSql",
-  "$queryRaw",
-  "$queryRawUnsafe",
-  "$executeRaw",
-  "$executeRawUnsafe",
-  "$on",
-  "$extends",
-  "$defineView",
-  "$withPolicy",
-  "$bypassPolicy",
-  "$scoped",
-  "$readOnly",
-  "$models",
-  "$withContext",
-  "$advisoryLock",
-  "$tryAdvisoryLock"
-];
-var RESERVED_COLUMN_PREFIX = "__vibe_";
-function isReservedDelegateName(params) {
-  return RESERVED_DELEGATE_NAMES.includes(params.name);
+// packages/schema/src/model-sql-namespace.ts
+function modelSqlNamespace(params) {
+  const { schema, model } = params;
+  if (model.namespace !== undefined || (params.dialect ?? providerToDialect({ provider: schema.datasource.provider })) !== "postgres")
+    return model.namespace;
+  const protectedModel = model.rls !== undefined && model.rls !== "unprotected";
+  const throughParent = schema.models.some((child) => {
+    const rule = child.rls;
+    return rule !== null && typeof rule === "object" && "through" in rule && child.relations.some((relation) => relation.name === rule.through && relation.targetModel === model.name);
+  });
+  return protectedModel || throughParent || hasPublicExtensionDeclaration({ schema, model: model.name }) ? SQL_NAMESPACES.postgres : undefined;
 }
-function isReservedClientName(params) {
-  const withPrefix = params.name.startsWith("$") ? params.name : `$${params.name}`;
-  return RESERVED_CLIENT_NAMES.includes(withPrefix);
+// packages/schema/src/referential-actions.ts
+function resolveOnDelete(params) {
+  if (params.explicit !== undefined)
+    return params.explicit;
+  return params.required ? "Restrict" : "SetNull";
+}
+function resolveOnUpdate(params) {
+  return params.explicit ?? "Cascade";
+}
+function resolveReferentialActions(params) {
+  const { relation } = params;
+  const required = (relation.fields ?? []).every((name) => params.field(name)?.isOptional !== true);
+  return { onDelete: resolveOnDelete({ explicit: relation.onDelete, required }), onUpdate: resolveOnUpdate({ explicit: relation.onUpdate }) };
+}
+
+// packages/schema/src/generated-columns.ts
+function declarationIssue(params) {
+  const { value, authoring } = params;
+  if (value === null || typeof value !== "object" || Array.isArray(value) || Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null)
+    return "A generated column requires a plain data object";
+  const expected = authoring ? ["sql"] : ["expression", "storage"];
+  const keys = Reflect.ownKeys(value);
+  if (keys.length !== expected.length || keys.some((key) => typeof key !== "string" || !expected.includes(key)))
+    return authoring ? "generated accepts exactly sql; storage is always stored" : "A generated declaration accepts exactly expression and storage";
+  for (const key of expected) {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    if (descriptor?.enumerable !== true || !("value" in descriptor))
+      return "A generated declaration requires enumerable data properties";
+  }
+  const expression = Object.getOwnPropertyDescriptor(value, authoring ? "sql" : "expression")?.value;
+  if (typeof expression !== "string" || expression.trim().length === 0 || expression.includes("\x00"))
+    return "A generated expression must be a nonempty, NUL-free SQL string";
+  if (!authoring && Object.getOwnPropertyDescriptor(value, "storage")?.value !== "stored")
+    return "Generated storage must be stored; virtual columns are not supported";
+  return;
+}
+function generatedColumnShapeIssue(params) {
+  return declarationIssue({ ...params, authoring: false });
+}
+function assertGeneratedColumn(params) {
+  const issue = generatedColumnShapeIssue(params);
+  if (issue !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issue, meta: { issues: [{ rule: "generated-column-shape", message: issue }] } });
+  const value = params.value;
+  return Object.freeze({ expression: value.expression, storage: "stored" });
+}
+function generatedColumnFromSql(params) {
+  const issue = declarationIssue({ ...params, authoring: true });
+  if (issue !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issue, meta: { issues: [{ rule: "generated-column-shape", message: issue }] } });
+  const value = params.value;
+  return assertGeneratedColumn({ value: { expression: value.sql, storage: "stored" } });
+}
+function validateGeneratedColumns(params) {
+  const issues = [];
+  for (const model of params.schema.models) {
+    const owning = new Set(model.relations.flatMap((relation) => relation.fields ?? []));
+    for (const field of model.fields) {
+      if (!("generated" in field))
+        continue;
+      const add = ({ rule, message }) => {
+        issues.push({ rule, message, model: model.name, field: field.name });
+      };
+      const shape = generatedColumnShapeIssue({ value: field.generated });
+      if (shape !== undefined) {
+        add({ rule: "generated-column-shape", message: shape });
+        continue;
+      }
+      if (field.default !== undefined)
+        add({ rule: "generated-column-default", message: "A generated field cannot have a default" });
+      if (field.isUpdatedAt)
+        add({ rule: "generated-column-updated-at", message: "A generated field cannot use @updatedAt" });
+      if (field.isId || model.primaryKey?.fields.includes(field.name))
+        add({ rule: "generated-column-id", message: "A generated field cannot belong to a primary key" });
+      if (field.isList)
+        add({ rule: "generated-column-list", message: "A generated field cannot be a list" });
+      if (owning.has(field.name))
+        add({ rule: "generated-column-foreign-key", message: "A generated field cannot own a foreign key" });
+      if (model.policy?.field === field.name)
+        add({ rule: "generated-column-policy", message: "A generated field cannot be an application-policy context column" });
+      if (model.rls !== null && typeof model.rls === "object" && "where" in model.rls && model.rls.where !== null && typeof model.rls.where === "object" && Object.hasOwn(model.rls.where, field.name))
+        add({ rule: "generated-column-rls", message: "A generated field cannot be a native RLS context column" });
+      if (model.isView)
+        add({ rule: "generated-column-view", message: "A view cannot declare a core-owned generated column" });
+      if (field.validator !== undefined)
+        add({ rule: "generated-column-validator", message: "A generated field cannot carry write validation because the client never writes it" });
+    }
+    for (const relation of model.relations)
+      if ("generated" in relation)
+        issues.push({ rule: "generated-column-relation", message: "Generation belongs on scalar or enum columns, not relation properties", model: model.name, field: relation.name });
+  }
+  return issues;
+}
+function assertGeneratedColumns(params) {
+  const issues = validateGeneratedColumns(params);
+  if (issues.length > 0)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: `Invalid generated columns: ${issues.map((issue) => issue.message).join("; ")}`, meta: { issues } });
+  const dialect = params.dialect ?? providerToDialect({ provider: params.schema.datasource.provider });
+  const generatedModels = new Set(params.schema.models.filter((model) => model.fields.some((field) => field.generated !== undefined)).map((model) => model.name));
+  if (generatedModels.size === 0)
+    return;
+  if (!DIALECT_CAPABILITIES[dialect].generatedColumns)
+    throw unsupportedCapability({ dialect, feature: "generatedColumns" });
+  if (dialect !== "mysql")
+    return;
+  for (const model of params.schema.models)
+    for (const relation of model.relations) {
+      if ((relation.fields?.length ?? 0) === 0)
+        continue;
+      const target = params.schema.models.find((candidate) => candidate.name === relation.targetModel);
+      const referencedGenerated = target?.fields.some((field) => field.generated !== undefined && relation.references?.includes(field.name)) === true;
+      if (!generatedModels.has(model.name) && !referencedGenerated)
+        continue;
+      const actions = resolveReferentialActions({ relation, field: (name) => model.fields.find((field) => field.name === name) });
+      const unsafeUpdate = actions.onUpdate === "Cascade" || actions.onUpdate === "SetNull" || actions.onUpdate === "SetDefault";
+      const unsafeDelete = actions.onDelete === "SetNull" || actions.onDelete === "SetDefault" || generatedModels.has(model.name) && actions.onDelete === "Cascade";
+      if (unsafeUpdate || unsafeDelete)
+        throw new VibeError({ code: "VIBE_UNSUPPORTED_CAPABILITY", message: "MySQL generated-column foreign-key dependencies require safe referential actions; opaque expressions cannot prove a base column is unaffected", meta: { feature: "generatedColumnReferentialActions", dialect, model: model.name, relation: relation.name } });
+    }
 }
 
-// packages/schema/src/extension.ts
-function stableSerialize(value) {
-  if (value === null || typeof value !== "object")
-    return JSON.stringify(value) ?? "undefined";
-  if (Array.isArray(value))
-    return `[${value.map(stableSerialize).join(",")}]`;
-  const entries = Object.entries(value).filter(([, entryValue]) => entryValue !== undefined).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, entryValue]) => `${JSON.stringify(key)}:${stableSerialize(entryValue)}`);
-  return `{${entries.join(",")}}`;
+// packages/schema/src/row-rules.ts
+var SQLITE_ROW_RULE_ERROR_PREFIX = "VIBEORM_ROW_RULE:";
+var MYSQL_ROW_RULE_MESSAGE_MAX_BYTES = 128;
+function mysqlRowRuleMessageByteLength(params) {
+  return new TextEncoder().encode(`Check constraint '${params.triggerName}' is violated.`).length;
 }
-function extensionOptionsHash(params) {
-  const text = stableSerialize(params.options);
-  let hash = 2166136261;
-  for (let index = 0;index < text.length; index += 1) {
-    hash ^= text.charCodeAt(index);
-    hash = Math.imul(hash, 16777619);
+function sqliteRowRuleConstraint(params) {
+  if (!params.message.startsWith(SQLITE_ROW_RULE_ERROR_PREFIX))
+    return;
+  const name = params.message.slice(SQLITE_ROW_RULE_ERROR_PREFIX.length);
+  return name.length === 0 ? undefined : name;
+}
+var CAPABILITIES = Object.freeze({
+  appendOnly: "rowRuleAppendOnly",
+  fixed: "rowRuleFixed",
+  rowFixed: "rowRuleRowFixed",
+  frozen: "rowRuleFrozen"
+});
+function record2(params) {
+  const { value } = params;
+  return value !== null && typeof value === "object" && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Reflect.ownKeys(value).every((key) => {
+    const descriptor = Object.getOwnPropertyDescriptor(value, key);
+    return typeof key === "string" && descriptor?.enumerable === true && "value" in descriptor;
+  });
+}
+function keys(params) {
+  return params.required.every((key) => Object.hasOwn(params.value, key)) && Object.keys(params.value).every((key) => params.required.includes(key) || params.optional?.includes(key));
+}
+function strings(params) {
+  return Array.isArray(params.value) && Object.keys(params.value).length === params.value.length && params.value.every((entry) => typeof entry === "string" && entry.length > 0);
+}
+function shapeIssue2(params) {
+  const candidate = { value: params.value };
+  if (!record2(candidate))
+    return "a row rule must be a plain data object";
+  const rule = candidate.value;
+  const required = params.resolved ? ["kind", "name"] : ["kind"];
+  const optional = params.resolved ? [] : ["name"];
+  if ((params.resolved || rule.name !== undefined) && (typeof rule.name !== "string" || rule.name.trim().length === 0 || rule.name.includes("\x00")))
+    return "name must be a nonempty physical stem without NUL bytes";
+  switch (rule.kind) {
+    case "appendOnly":
+      return keys({ value: rule, required, optional }) ? undefined : "appendOnly accepts only kind and name";
+    case "fixed": {
+      if (!keys({ value: rule, required: [...required, "columns", "when"], optional }) || !strings({ value: rule.columns }))
+        return "fixed requires columns and exactly one when gate; unknown keys are not accepted";
+      const when = { value: rule.when };
+      if (!record2(when) || !(keys({ value: when.value, required: ["fromCreation"] }) && when.value.fromCreation === true || keys({ value: when.value, required: ["onceSet"] }) && typeof when.value.onceSet === "string" && when.value.onceSet.length > 0))
+        return "fixed.when requires exactly fromCreation: true or onceSet: a logical field name";
+      return;
+    }
+    case "rowFixed":
+      return keys({ value: rule, required: [...required, "except"], optional }) && strings({ value: rule.except }) ? undefined : "rowFixed requires an except field array and accepts no unknown keys";
+    case "frozen": {
+      if (!keys({ value: rule, required: [...required, "from", "mutable"], optional }) || !strings({ value: rule.mutable }))
+        return "frozen requires from and a mutable field array; unknown keys are not accepted";
+      const from = { value: rule.from };
+      if (!record2(from) || !(keys({ value: from.value, required: ["create"] }) && from.value.create === true || keys({ value: from.value, required: ["field"] }) && typeof from.value.field === "string" && from.value.field.length > 0))
+        return "frozen.from requires exactly create: true or field: a logical field name";
+      return;
+    }
+    default:
+      return "kind must be appendOnly, fixed, rowFixed or frozen";
   }
-  return (hash >>> 0).toString(16).padStart(8, "0");
 }
-function extensionManifestEntry(params) {
-  const { extension } = params;
+function rowRuleShapeIssue(params) {
+  return shapeIssue2({ ...params, resolved: true });
+}
+function rowRuleCapability(params) {
+  return CAPABILITIES[params.kind];
+}
+function assertRowRuleCapability(params) {
+  const feature = rowRuleCapability({ kind: params.rule.kind });
+  if (!DIALECT_CAPABILITIES[params.dialect][feature])
+    throw new VibeError({
+      code: "VIBE_UNSUPPORTED_CAPABILITY",
+      message: `${params.dialect} does not support declared ${params.rule.kind} row rules on ${params.model}`,
+      meta: { dialect: params.dialect, feature, model: params.model, rule: params.rule.kind, ...params.rule.name === undefined ? {} : { name: params.rule.name } }
+    });
+}
+function defaultRowRuleName(params) {
+  const table = params.model.dbName ?? params.model.name;
+  if (params.rule.kind !== "fixed")
+    return `vibe_rr_${table}_${params.rule.kind}`;
+  const columns = params.rule.columns.map((name) => params.model.fields.find((field) => field.name === name)?.dbName ?? name);
+  return `vibe_rr_${table}_${columns.join("_")}_fixed`;
+}
+function rowRuleObjectNames(params) {
+  return { functionName: `${params.rule.name}_fn`, triggerName: `${params.rule.name}_trigger` };
+}
+function rowRuleTriggerName(params) {
+  return `${params.rule.name}_${params.event}_trigger`;
+}
+function rowRuleGateField(params) {
+  const { rule } = params;
+  if (rule.kind === "fixed" && "onceSet" in rule.when)
+    return rule.when.onceSet;
+  if (rule.kind === "frozen" && "field" in rule.from)
+    return rule.from.field;
+  return;
+}
+function createRowRuleValidationContext(params) {
+  const { schema } = params;
+  const dialect = params.dialect ?? providerToDialect({ provider: schema.datasource.provider });
+  let ownedObjects;
+  let columnsByTable;
+  const fieldsByModel = new Map;
+  const tableKey = (table) => JSON.stringify(dialect === "mysql" ? [table.name] : [table.namespace, table.name]);
+  const objects = () => {
+    if (ownedObjects === undefined)
+      ownedObjects = (schema.migrationObjects ?? []).map((object) => ({ id: object.id, identity: object.identity }));
+    return ownedObjects;
+  };
+  const generatedFields = ({ model }) => {
+    const previous = fieldsByModel.get(model);
+    if (previous !== undefined)
+      return previous;
+    if (columnsByTable === undefined) {
+      const columns = new Map;
+      for (const object of objects()) {
+        const identity = object.identity;
+        if (identity.kind !== "generatedColumn")
+          continue;
+        const key = tableKey(identity.table);
+        const members = columns.get(key) ?? new Set;
+        members.add(identity.column);
+        columns.set(key, members);
+      }
+      columnsByTable = columns;
+    }
+    const namespace = modelSqlNamespace({ schema, model, dialect }) ?? (dialect === "sqlite" ? "main" : "public");
+    const columns = columnsByTable.get(tableKey({ namespace, name: model.dbName ?? model.name }));
+    const fields = new Set(model.fields.filter((field) => field.generated !== undefined || columns?.has(field.dbName ?? field.name)).map((field) => field.name));
+    for (const field of model.fields)
+      if (field.generated !== undefined && generatedColumnShapeIssue({ value: field.generated }) !== undefined && !columns?.has(field.dbName ?? field.name))
+        fields.delete(field.name);
+    fieldsByModel.set(model, fields);
+    return fields;
+  };
   return {
-    name: extension.name,
-    version: extension.version,
-    optionsHash: extensionOptionsHash({ options: extension.options })
+    objects,
+    generatedFields,
+    validate: ({ model }) => validateRowRulesWithLookup({ model, dialect, generatedFields }),
+    assertEquality: ({ model, rule }) => assertRowRuleEqualityWithGenerated({ model, rule, dialect, generated: rule.kind === "appendOnly" ? new Set : generatedFields({ model }) })
   };
 }
-var EXTENSION_NAME_PATTERN = /^[a-z][a-zA-Z0-9]*$/;
-function defineExtension(extension) {
-  const { name } = extension;
-  if (!EXTENSION_NAME_PATTERN.test(name)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" is invalid \u2014 must match ${EXTENSION_NAME_PATTERN} (it becomes a client identifier)`,
-      meta: { name }
+function rowRuleGeneratedFields(params) {
+  const generated = createRowRuleValidationContext(params).generatedFields({ model: params.model });
+  return params.model.fields.filter((field) => generated.has(field.name)).map((field) => field.name);
+}
+function rowRuleProtectedFields(params) {
+  if (params.rule.kind === "appendOnly")
+    return [];
+  const generated = createRowRuleValidationContext(params).generatedFields({ model: params.model });
+  return protectedFieldsWithGenerated({ model: params.model, rule: params.rule, generated });
+}
+function protectedFieldsWithGenerated(params) {
+  const { model, rule, generated } = params;
+  if (rule.kind === "appendOnly")
+    return [];
+  const gate = rowRuleGateField({ rule });
+  if (rule.kind === "fixed") {
+    const names = [...rule.columns, ...gate === undefined || rule.columns.includes(gate) ? [] : [gate]];
+    return names.flatMap((name) => {
+      const field = model.fields.find((field) => field.name === name);
+      return field === undefined || generated.has(name) ? [] : [field];
     });
   }
-  if (RESERVED_DELEGATE_NAMES.includes(name)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" collides with a core delegate method`,
-      meta: { name }
-    });
+  return model.fields.filter((field) => {
+    if (generated.has(field.name))
+      return false;
+    const except = rule.kind === "rowFixed" ? rule.except : rule.mutable;
+    return !except.includes(field.name);
+  });
+}
+function rowRuleNamespace(params) {
+  const declared = modelSqlNamespace(params);
+  if (declared !== undefined)
+    assertSqlNamespace({ namespace: declared, dialect: params.dialect });
+  const canonical = declared ?? (params.dialect === "sqlite" ? "main" : "public");
+  if (params.namespace === undefined)
+    return canonical;
+  const namespace = params.namespace;
+  if (params.dialect === "sqlite" && namespace !== "main")
+    throw new VibeError({ code: "VIBE_UNSUPPORTED_CAPABILITY", message: "SQLite row rules require the main database; attached-schema placement is not supported", meta: { dialect: params.dialect, feature: "fixedNamespaces", namespace } });
+  if (params.dialect === "postgres") {
+    assertSqlNamespace({ namespace, dialect: params.dialect });
+    if (namespace !== canonical)
+      throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "A row-rule namespace binding cannot override PostgreSQL model placement", meta: { namespace, expected: canonical, model: params.model.name } });
   }
-  if (RESERVED_CLIENT_NAMES.includes(`$${name}`)) {
-    throw new VibeError({
-      code: "VIBE_CONFIG",
-      message: `extension name "${name}" collides with the core client method "$${name}"`,
-      meta: { name }
-    });
+  if (namespace.trim().length === 0 || namespace.includes("\x00") || !wellFormedName({ name: namespace }) || params.dialect === "mysql" && (identifierLength({ name: namespace, dialect: "mysql" }) > 64 || /[\u{10000}-\u{10FFFF}]/u.test(namespace) || namespace.endsWith(" ")))
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "A row-rule executor database binding requires a valid database identifier", meta: { dialect: params.dialect, namespace } });
+  return namespace;
+}
+function rowRuleIdentities(params) {
+  const dialect = params.dialect ?? providerToDialect({ provider: params.schema.datasource.provider });
+  assertRowRuleCapability({ dialect, model: params.model.name, rule: params.rule });
+  const namespace = rowRuleNamespace({ ...params, dialect });
+  const table = { namespace, name: params.model.dbName ?? params.model.name };
+  const { functionName, triggerName } = rowRuleObjectNames(params);
+  const objects = dialect === "postgres" ? [
+    { role: "function", identity: { kind: "function", name: { namespace, name: functionName }, argumentTypes: [] } },
+    { role: "trigger", identity: { kind: "trigger", table, name: triggerName } }
+  ] : (params.rule.kind === "appendOnly" ? ["update", "delete"] : ["update"]).map((event) => ({ role: "trigger", identity: { kind: "trigger", table, name: rowRuleTriggerName({ rule: params.rule, event }) } }));
+  return Object.freeze(objects.map((object) => Object.freeze(object)));
+}
+function schemaRowRuleIdentities(params) {
+  return params.schema.models.flatMap((model) => (model.rowRules ?? []).flatMap((rule) => rowRuleIdentities({ ...params, model, rule }).map((object) => object.identity)));
+}
+var NATIVE_EQUALITY = Object.freeze({
+  String: ["text", "varchar", "character varying", "char", "character", "bpchar", "uuid", "bit", "varbit", "bit varying", "inet"],
+  Boolean: ["boolean", "bool"],
+  Int: ["smallint", "integer", "int", "int2", "int4", "oid", "serial", "smallserial", "serial2", "serial4"],
+  BigInt: ["bigint", "int8", "bigserial", "serial8"],
+  Float: ["real", "float", "float4", "float8", "double precision"],
+  Decimal: ["decimal", "numeric", "money"],
+  DateTime: ["timestamp", "timestamptz", "timestamp with time zone", "timestamp without time zone", "date", "time", "timetz", "time with time zone", "time without time zone"],
+  Json: ["json", "jsonb"],
+  Bytes: ["bytea"]
+});
+var MYSQL_NATIVE_EQUALITY = Object.freeze({
+  String: ["text", "tinytext", "mediumtext", "longtext", "varchar", "char", "character", "date"],
+  Boolean: ["boolean", "bool", "tinyint"],
+  Int: ["tinyint", "smallint", "mediumint", "int", "integer"],
+  BigInt: ["bigint"],
+  Float: ["float", "double", "double precision", "real"],
+  Decimal: ["decimal", "dec", "numeric", "fixed"],
+  DateTime: ["datetime", "timestamp", "date", "time"],
+  Json: ["json"],
+  Bytes: ["binary", "varbinary", "tinyblob", "blob", "mediumblob", "longblob"]
+});
+function equalitySupported(params) {
+  const { field } = params;
+  if (field.isUnsupported === true)
+    return false;
+  if (params.dialect === "sqlite")
+    return true;
+  if (field.nativeType === undefined)
+    return true;
+  const native = field.nativeType.trim().toLowerCase().replace(/\(\s*\d+(?:\s*,\s*\d+)*\s*\)/g, "").replace(/\s+/g, "");
+  if (params.dialect === "mysql") {
+    const base = native.replace(/(?:unsigned|zerofill)+$/, "");
+    if (isEnumType(field.type))
+      return ["text", "tinytext", "mediumtext", "longtext", "varchar", "char", "character"].includes(base);
+    return MYSQL_NATIVE_EQUALITY[field.type]?.some((type) => type.replace(/\s+/g, "") === base) === true;
   }
-  return Object.freeze(extension);
+  if (isEnumType(field.type))
+    return ["text", "varchar", "char"].includes(native);
+  return NATIVE_EQUALITY[field.type]?.some((type) => type.replace(/\s+/g, "") === native) === true || field.type === "String" && native === "date" && !field.isList;
 }
-function buildExtensionRegistry(params) {
-  const byName = new Map;
-  const modelAttributes = new Map;
-  const fieldTypes = new Map;
-  for (const extension of params.extensions) {
-    if (byName.has(extension.name)) {
-      throw new VibeError({
-        code: "VIBE_CONFIG",
-        message: `duplicate extension name "${extension.name}" in the configured extension list`,
-        meta: { name: extension.name }
-      });
+function validateRowRules(params) {
+  return createRowRuleValidationContext(params).validate({ model: params.model });
+}
+function wellFormedName(params) {
+  return [...params.name].every((character) => character.length !== 1 || character.charCodeAt(0) < 55296 || character.charCodeAt(0) > 57343);
+}
+function validateRowRulesWithLookup(params) {
+  const { model, dialect } = params;
+  const rules = model.rowRules;
+  if (rules === undefined)
+    return [];
+  if (!Array.isArray(rules))
+    return [{ rule: "row-rule-shape", model: model.name, message: "rowRules must be an array of canonical declarations" }];
+  const issues = [];
+  const add = (params) => {
+    issues.push({ rule: params.rule ?? "row-rule-invalid", model: model.name, ...params });
+  };
+  const seenKinds = new Set;
+  const seenDefinitions = new Set;
+  const seenNames = new Set;
+  for (const value of rules) {
+    const shape = rowRuleShapeIssue({ value });
+    if (shape !== undefined) {
+      add({ rule: "row-rule-shape", message: shape });
+      continue;
     }
-    byName.set(extension.name, extension);
-    for (const attribute of extension.schema?.modelAttributes ?? []) {
-      const existing = modelAttributes.get(attribute.name);
-      if (existing !== undefined) {
-        throw new VibeError({
-          code: "VIBE_CONFIG",
-          message: `model attribute "@@${attribute.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
-          meta: { attribute: attribute.name }
-        });
-      }
-      modelAttributes.set(attribute.name, { extension, attribute });
+    const rule = value;
+    const generated = rule.kind === "appendOnly" ? new Set : params.generatedFields({ model });
+    if (seenNames.has(rule.name))
+      add({ rule: "row-rule-name-collision", message: `Row rules share the physical stem ${rule.name}; supply an explicit, distinct name stem` });
+    seenNames.add(rule.name);
+    if (model.isView)
+      add({ message: "Row rules require a stored table, not a view" });
+    if (rule.kind !== "fixed" && seenKinds.has(rule.kind))
+      add({ message: `Only one ${rule.kind} row rule is allowed per model` });
+    seenKinds.add(rule.kind);
+    const definition = rule.kind === "fixed" ? JSON.stringify([rule.kind, [...rule.columns].sort(), rule.when]) : rule.kind;
+    if (seenDefinitions.has(definition))
+      add({ message: `Duplicate ${rule.kind} row-rule declaration` });
+    seenDefinitions.add(definition);
+    const pair = rowRuleObjectNames({ rule });
+    const names = dialect === "postgres" ? [pair.functionName, pair.triggerName] : (rule.kind === "appendOnly" ? ["update", "delete"] : ["update"]).map((event) => rowRuleTriggerName({ rule, event }));
+    for (const name of names) {
+      const limit = IDENTIFIER_LIMITS[dialect];
+      if (limit !== undefined && identifierLength({ name, dialect }) > limit.max)
+        add({ rule: "row-rule-name-length", message: `Row-rule object ${name} exceeds ${limit.max} ${limit.unit}; supply a shorter name stem` });
+      if (!wellFormedName({ name }))
+        add({ rule: "row-rule-name-encoding", message: "Row-rule names require valid Unicode without unpaired surrogates" });
+      if (dialect === "mysql" && /[^\x00-\x7F]/.test(name))
+        add({ rule: "row-rule-name-collation", message: "MySQL row-rule stems require ASCII for exact trigger-name collision admission; supply an explicit ASCII name stem" });
+      if (dialect === "mysql" && mysqlRowRuleMessageByteLength({ triggerName: name }) > MYSQL_ROW_RULE_MESSAGE_MAX_BYTES)
+        add({ rule: "row-rule-diagnostic-length", message: `MySQL row-rule MESSAGE_TEXT exceeds ${MYSQL_ROW_RULE_MESSAGE_MAX_BYTES} UTF-8 bytes; supply a shorter name stem` });
     }
-    for (const fieldType of extension.schema?.fieldTypes ?? []) {
-      const existing = fieldTypes.get(fieldType.name);
-      if (existing !== undefined) {
-        throw new VibeError({
-          code: "VIBE_CONFIG",
-          message: `field type "${fieldType.name}" is claimed by both "${existing.extension.name}" and "${extension.name}"`,
-          meta: { fieldType: fieldType.name }
-        });
-      }
-      fieldTypes.set(fieldType.name, { extension, fieldType });
+    const references = rule.kind === "fixed" ? rule.columns : rule.kind === "rowFixed" ? rule.except : rule.kind === "frozen" ? rule.mutable : [];
+    if (new Set(references).size !== references.length)
+      add({ message: `${rule.kind} field arrays require distinct members` });
+    for (const name of references) {
+      const field = model.fields.find((field) => field.name === name);
+      if (field === undefined)
+        add({ message: `Unknown or relation field ${name} in ${rule.kind}; use stored logical field names`, field: name });
+      else if (generated.has(name))
+        add({ message: `Generated field ${name} cannot be listed in ${rule.kind}; generated values are already excluded`, field: name });
+    }
+    const gate = rowRuleGateField({ rule });
+    if (gate !== undefined) {
+      const field = model.fields.find((field) => field.name === gate);
+      if (field === undefined || field.isList || !field.isOptional || generated.has(gate))
+        add({ message: `${rule.kind} gate ${gate} must be a nullable, non-generated scalar field`, field: gate });
+      if (rule.kind === "frozen" && rule.mutable.includes(gate))
+        add({ message: `Frozen gate ${gate} cannot be mutable; it cannot be cleared after activation`, field: gate });
     }
+    if (rule.kind !== "appendOnly" && (rule.kind === "fixed" && rule.columns.length === 0 || protectedFieldsWithGenerated({ model, rule, generated }).length === 0))
+      add({ message: `${rule.kind} requires at least one protected stored field` });
   }
-  return { extensions: params.extensions, byName, modelAttributes, fieldTypes };
+  if (seenKinds.has("appendOnly") && rules.length > 1)
+    add({ message: "appendOnly cannot combine with other row rules; it already refuses every UPDATE and DELETE" });
+  return issues;
 }
-var EMPTY_EXTENSION_REGISTRY = buildExtensionRegistry({
-  extensions: []
-});
-var PUBLIC_ONLY_EXTENSIONS = ["search", "vector", "trgm"];
-function hasPublicExtensionDeclaration(params) {
-  return PUBLIC_ONLY_EXTENSIONS.some((name) => Object.hasOwn(extensionDeclarations({ schema: params.schema, name }), params.model));
+function normalizeRowRules(params) {
+  if (!Array.isArray(params.rules))
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "rowRules must produce an array of declarations", meta: { model: params.model.name } });
+  const modelOrder = (fields) => [...fields].sort((a, b) => params.model.fields.findIndex((field) => field.name === a) - params.model.fields.findIndex((field) => field.name === b));
+  const rules = params.rules.map((value) => {
+    const issue = shapeIssue2({ value, resolved: false });
+    if (issue !== undefined)
+      throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issue, meta: { model: params.model.name } });
+    const rule = value;
+    const name = rule.name ?? defaultRowRuleName({ model: params.model, rule });
+    switch (rule.kind) {
+      case "appendOnly":
+        return Object.freeze({ kind: rule.kind, name });
+      case "fixed":
+        return Object.freeze({ kind: rule.kind, name, columns: Object.freeze([...rule.columns]), when: Object.freeze({ ...rule.when }) });
+      case "rowFixed":
+        return Object.freeze({ kind: rule.kind, name, except: Object.freeze(modelOrder(rule.except)) });
+      case "frozen":
+        return Object.freeze({ kind: rule.kind, name, from: Object.freeze({ ...rule.from }), mutable: Object.freeze(modelOrder(rule.mutable)) });
+    }
+  });
+  const model = { ...params.model, rowRules: rules };
+  const schema = params.schema ?? { datasource: { provider: params.dialect === "postgres" ? "postgresql" : params.dialect }, models: [model], enums: [], extensions: [] };
+  const context = createRowRuleValidationContext({ schema, dialect: params.dialect });
+  const issues = context.validate({ model });
+  if (issues.length > 0)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issues.map((issue) => issue.message).join("; "), meta: { issues } });
+  for (const rule of rules) {
+    assertRowRuleCapability({ dialect: params.dialect, model: model.name, rule });
+    context.assertEquality({ model, rule });
+  }
+  assertRowRuleReferentialActions({ schema: { ...schema, models: [...schema.models.filter((entry) => entry.name !== model.name), model] }, dialect: params.dialect });
+  return Object.freeze(rules);
 }
-function assertExtensionModelPlacement(params) {
-  if (params.namespace !== undefined && params.namespace !== "public") {
-    throw unsupportedCapability({ dialect: params.dialect ?? "postgres", feature: "fixedNamespaceExtensions", hint: "Search, vector and trigram extensions currently require public table placement" });
+function assertRowRuleEquality(params) {
+  createRowRuleValidationContext(params).assertEquality({ model: params.model, rule: params.rule });
+}
+function assertRowRuleEqualityWithGenerated(params) {
+  for (const field of protectedFieldsWithGenerated(params)) {
+    if (!equalitySupported({ field, dialect: params.dialect }))
+      throw new VibeError({ code: "VIBE_UNSUPPORTED_CAPABILITY", message: `Row rule ${params.rule.name} cannot compare ${params.model.name}.${field.name}; exempt it explicitly or use an admitted built-in type`, meta: { dialect: params.dialect, feature: "rowRuleEquality", model: params.model.name, field: field.name, rule: params.rule.kind, nativeType: field.nativeType } });
   }
 }
-function assertExtensionPlacement(params) {
+function assertRowRuleReferentialActions(params) {
   const dialect = params.dialect ?? providerToDialect({ provider: params.schema.datasource.provider });
-  for (const extension of params.schema.extensions) {
-    if (!PUBLIC_ONLY_EXTENSIONS.includes(extension.name))
+  if (dialect !== "mysql")
+    return;
+  const context = createRowRuleValidationContext({ schema: params.schema, dialect });
+  const mutates = (action) => action === "Cascade" || action === "SetNull" || action === "SetDefault";
+  for (const model of params.schema.models) {
+    if (!Array.isArray(model.rowRules) || model.rowRules.length === 0)
       continue;
-    const declarations = extensionDeclarations({ schema: params.schema, name: extension.name });
-    for (const model of params.schema.models) {
-      if (Object.hasOwn(declarations, model.name))
-        assertExtensionModelPlacement({ namespace: model.namespace, dialect });
+    for (const relation of model.relations) {
+      const columns = relation.fields;
+      if (columns === undefined || columns.length === 0 || params.schema.models.some((target) => target.name === relation.targetModel && target.isView))
+        continue;
+      const actions = resolveReferentialActions({ relation, field: (name) => model.fields.find((field) => field.name === name) });
+      for (const rule of model.rowRules) {
+        if (rowRuleShapeIssue({ value: rule }) !== undefined)
+          continue;
+        const protectedColumns = rule.kind === "appendOnly" ? [] : protectedFieldsWithGenerated({ model, rule, generated: context.generatedFields({ model }) }).map((field) => field.name);
+        const field = columns.find((name) => protectedColumns.includes(name));
+        const conservative = rule.kind === "appendOnly" || rule.kind === "fixed" && (actions.onUpdate === "Cascade" || actions.onDelete === "Cascade");
+        const unsafeUpdate = mutates(actions.onUpdate) && (conservative || field !== undefined);
+        const unsafeDelete = (rule.kind === "appendOnly" || rule.kind === "fixed") && actions.onDelete === "Cascade" || (actions.onDelete === "SetNull" || actions.onDelete === "SetDefault") && (rule.kind === "appendOnly" || field !== undefined);
+        if (!unsafeUpdate && !unsafeDelete)
+          continue;
+        throw new VibeError({ code: "VIBE_UNSUPPORTED_CAPABILITY", message: `MySQL relation ${model.name}.${relation.name} can bypass row rule ${rule.name} through a foreign-key action; declare safe Restrict/NoAction actions or change the protected fields`, meta: { feature: "rowRuleReferentialActions", dialect, model: model.name, relation: relation.name, rule: rule.kind, name: rule.name, onUpdate: actions.onUpdate, onDelete: actions.onDelete, action: unsafeUpdate ? "onUpdate" : "onDelete", ...field === undefined ? {} : { field } } });
+      }
     }
   }
 }
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function mergeExtensionDeclarations(params) {
-  if (params.extension !== undefined && PUBLIC_ONLY_EXTENSIONS.includes(params.extension) && Array.isArray(params.base.fields) && Array.isArray(params.next.fields)) {
-    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: `Repeated index-bearing ${params.extension} declarations are unsupported; use one common-configuration multi-field declaration`, meta: { rule: "repeated-extension-declaration", extension: params.extension } });
-  }
-  const out = { ...params.base };
-  for (const [key, value] of Object.entries(params.next)) {
-    const existing = out[key];
-    out[key] = isPlainObject(existing) && isPlainObject(value) ? { ...existing, ...value } : value;
+function rowRulePrismaAttribute(params) {
+  const { rule } = params;
+  const name = `name: ${encodePrismaString({ value: rule.name })}`;
+  switch (rule.kind) {
+    case "appendOnly":
+      return `@@appendOnly(${name})`;
+    case "fixed":
+      return `@@fixed([${rule.columns.join(", ")}], ${"fromCreation" in rule.when ? "fromCreation: true" : `onceSet: ${rule.when.onceSet}`}, ${name})`;
+    case "rowFixed":
+      return `@@rowFixed(except: [${rule.except.join(", ")}], ${name})`;
+    case "frozen":
+      return `@@frozen(${"create" in rule.from ? "fromCreation: true" : `from: ${rule.from.field}`}, mutable: [${rule.mutable.join(", ")}], ${name})`;
   }
-  return out;
-}
-function extensionDeclarations(params) {
-  const decl = params.schema.extensions.find((entry) => entry.name === params.name);
-  if (decl === undefined)
-    return {};
-  const models = decl.options["models"];
-  if (models === null || typeof models !== "object" || Array.isArray(models))
-    return {};
-  return models;
-}
-
-// packages/schema/src/model-sql-namespace.ts
-function modelSqlNamespace(params) {
-  const { schema, model } = params;
-  if (model.namespace !== undefined || (params.dialect ?? providerToDialect({ provider: schema.datasource.provider })) !== "postgres")
-    return model.namespace;
-  const protectedModel = model.rls !== undefined && model.rls !== "unprotected";
-  const throughParent = schema.models.some((child) => {
-    const rule = child.rls;
-    return rule !== null && typeof rule === "object" && "through" in rule && child.relations.some((relation) => relation.name === rule.through && relation.targetModel === model.name);
-  });
-  return protectedModel || throughParent || hasPublicExtensionDeclaration({ schema, model: model.name }) ? SQL_NAMESPACES.postgres : undefined;
 }
 // packages/schema/src/migration-objects.ts
 function sqlObjectKey(params) {
@@ -630,14 +2123,14 @@ function sqlObjectNamespace(params) {
     return identity.name;
   return "table" in identity ? identity.table.namespace : identity.name.namespace;
 }
-function record(value) {
+function record3(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
 function name(value) {
-  return record(value) && typeof value.namespace === "string" && value.namespace.length > 0 && typeof value.name === "string" && value.name.length > 0;
+  return record3(value) && typeof value.namespace === "string" && value.namespace.length > 0 && typeof value.name === "string" && value.name.length > 0;
 }
 function isSqlObjectIdentity(value) {
-  if (!record(value))
+  if (!record3(value))
     return false;
   switch (value.kind) {
     case "namespace":
@@ -664,17 +2157,17 @@ function isSqlObjectIdentity(value) {
   }
 }
 function isSqlObjectDefinition(value) {
-  return record(value) && (value.format === "catalog-v1" || value.format === "catalog-v2") && isSqlObjectIdentity(value.identity) && record(value.facts) && Object.keys(value.facts).length > 0 && Object.values(value.facts).every((fact) => fact === null || typeof fact === "string" || typeof fact === "boolean" || typeof fact === "number" && Number.isFinite(fact) || Array.isArray(fact) && fact.every((entry) => typeof entry === "string")) && Array.isArray(value.dependencies) && value.dependencies.every(isSqlObjectIdentity);
+  return record3(value) && (value.format === "catalog-v1" || value.format === "catalog-v2") && isSqlObjectIdentity(value.identity) && record3(value.facts) && Object.keys(value.facts).length > 0 && Object.values(value.facts).every((fact) => fact === null || typeof fact === "string" || typeof fact === "boolean" || typeof fact === "number" && Number.isFinite(fact) || Array.isArray(fact) && fact.every((entry) => typeof entry === "string")) && Array.isArray(value.dependencies) && value.dependencies.every(isSqlObjectIdentity);
 }
 function qualifiedNameIssue(params) {
-  if (!record(params.value))
+  if (!record3(params.value))
     return { path: params.path, expected: "qualified SQL name { namespace, name }" };
   const member = typeof params.value.namespace !== "string" || params.value.namespace.length === 0 ? "namespace" : "name";
   return { path: `${params.path}.${member}`, expected: "non-empty string" };
 }
 function identityIssue(params) {
   const { value, path } = params;
-  if (!record(value))
+  if (!record3(value))
     return { path, expected: "SQL object identity" };
   switch (value.kind) {
     case "namespace":
@@ -713,13 +2206,13 @@ function identityIssue(params) {
 }
 function definitionIssue(params) {
   const { value, path } = params;
-  if (!record(value))
+  if (!record3(value))
     return { path, expected: "independent SQL object definition" };
   if (value.format !== "catalog-v1" && value.format !== "catalog-v2")
     return { path: `${path}.format`, expected: ["catalog-v1", "catalog-v2"] };
   if (!isSqlObjectIdentity(value.identity))
     return identityIssue({ value: value.identity, path: `${path}.identity` });
-  if (!record(value.facts) || Object.keys(value.facts).length === 0)
+  if (!record3(value.facts) || Object.keys(value.facts).length === 0)
     return { path: `${path}.facts`, expected: "non-empty serializable catalog facts" };
   for (const [key, fact] of Object.entries(value.facts)) {
     if (!(fact === null || typeof fact === "string" || typeof fact === "boolean" || typeof fact === "number" && Number.isFinite(fact) || Array.isArray(fact) && fact.every((entry) => typeof entry === "string")))
@@ -746,7 +2239,7 @@ function assertMigrationObjects(params) {
   for (const [index, value] of params.objects.entries()) {
     const object = value;
     const path = `migrationObjects[${index}]`;
-    if (!record(object))
+    if (!record3(object))
       invalidDeclaration({ path, expected: "object" });
     if (typeof object.id !== "string" || object.id.length === 0)
       invalidDeclaration({ path: `${path}.id`, expected: "non-empty string" });
@@ -787,9 +2280,14 @@ function assertMigrationObjects(params) {
 function assertIndexOperatorClasses(params) {
   for (const model of params.schema.models)
     for (const index of model.indexes)
-      for (const field of index.fields) {
+      for (const term of indexKeyTerms({ index })) {
+        if (term.kind !== "field")
+          continue;
+        const field = term.field;
         if (field.operatorClass === undefined)
           continue;
+        if (isExpressionIndex({ index }))
+          throw unsupportedCapability({ dialect: params.dialect, feature: "expressionIndexOperatorClasses" });
         if (!DIALECT_CAPABILITIES[params.dialect].indexOperatorClasses)
           throw unsupportedCapability({ dialect: params.dialect, feature: "indexOperatorClasses" });
         if (index.kind === "unique" && params.physical !== true)
@@ -833,148 +2331,72 @@ function prepareDatabaseModuleSchema(params) {
     enums: schema.enums.map((entry) => enumStorageOf({ enumDef: entry }) === "database" ? { ...entry, namespace } : entry)
   };
 }
-// packages/schema/src/predicate.ts
-var PREDICATE_COMPARISON_OPS = [
-  "eq",
-  "ne",
-  "gt",
-  "gte",
-  "lt",
-  "lte"
-];
-function isPredicateFieldRef(operand) {
-  return operand.kind === "field";
-}
-function predicateFieldNames(params) {
-  return [...new Set(inspectPredicate(params).expressions.flatMap((expression) => expression.kind === "field" ? [expression.name] : []))];
-}
-function inspectPredicate(params) {
-  const expressions = [];
-  let checkOnly = false;
-  const expression = (node) => {
-    if (typeof node !== "object" || node === null)
-      throw invalidOperand();
-    switch (node.kind) {
-      case "field":
-        expressions.push(node);
-        return;
-      case "jsonText":
-        if (typeof node.field !== "object" || node.field === null || node.field.kind !== "field")
-          throw invalidOperand();
-        expressions.push(node);
-        checkOnly = true;
-        expression(node.field);
-        return;
-      case "length":
-        expressions.push(node);
-        checkOnly = true;
-        expression(node.expression);
-        return;
-      default:
-        throw invalidOperand();
-    }
-  };
-  const walk = (node) => {
-    switch (node.kind) {
-      case "compare":
-        expression(node.left);
-        if (typeof node.right !== "object" || node.right === null || node.right.kind !== "value")
-          expression(node.right);
-        return;
-      case "inList":
-      case "isNull":
-        expression(node.field);
-        return;
-      case "and":
-      case "or":
-        for (const operand of node.operands)
-          walk(operand);
-        return;
-      case "isTrue":
-        checkOnly = true;
-        walk(node.operand);
-        return;
-      case "not":
-        walk(node.operand);
-        return;
-    }
-  };
-  walk(params.predicate);
-  return { expressions, checkOnly };
-}
-function invalidOperand() {
-  return new VibeError({
-    code: "VIBE_SCHEMA_INVALID",
-    message: "A schema predicate operand must be a field, jsonText or length expression, or a literal on the right of a comparison",
-    meta: { rule: "predicate-operand-invalid" }
-  });
-}
-function assertPredicateCapabilities(params) {
-  if (!inspectPredicate(params).checkOnly)
-    return;
-  if (params.usage !== "check")
-    throw unsupportedCapability({ dialect: params.dialect, feature: "schema CHECK expressions outside CHECK constraints" });
-  if (!DIALECT_CAPABILITIES[params.dialect].schemaCheckExpressions)
-    throw unsupportedCapability({ dialect: params.dialect, feature: "schemaCheckExpressions" });
+// packages/schema/src/check-rules.ts
+var CHECK_RULE_GROUP_MAX = 8;
+var field = (name) => ({ kind: "field", name });
+var value = (literal) => ({ kind: "value", value: literal });
+var isNull = (name) => ({ kind: "isNull", field: field(name) });
+var isNotNull = (name) => ({ kind: "isNull", field: field(name), negate: true });
+var and = (operands) => operands.length === 1 ? operands[0] : { kind: "and", operands };
+var or = (operands) => operands.length === 1 ? operands[0] : { kind: "or", operands };
+function notMember(params) {
+  const { by, members } = params;
+  return members.length === 1 ? { kind: "compare", op: "ne", left: field(by), right: value(members[0]) } : { kind: "inList", field: field(by), values: members.map((member) => value(member)), negate: true };
 }
-function predicateKey(params) {
-  if (inspectPredicate(params).checkOnly) {
-    const scalar = (node) => {
-      switch (node.kind) {
-        case "field":
-          return ["field", node.name];
-        case "jsonText":
-          return ["jsonText", node.field.name, node.path];
-        case "length":
-          return ["length", scalar(node.expression)];
-      }
-    };
-    const key = (node) => {
-      switch (node.kind) {
-        case "compare":
-          return [node.kind, node.op, scalar(node.left), node.right.kind === "value" ? ["value", node.right.value] : scalar(node.right)];
-        case "inList":
-          return [node.kind, node.field.name, node.negate === true, node.values.map((value) => value.value)];
-        case "isNull":
-          return [node.kind, node.field.name, node.negate === true];
-        case "and":
-        case "or":
-          return [node.kind, node.operands.map(key)];
-        case "not":
-        case "isTrue":
-          return [node.kind, key(node.operand)];
-      }
-    };
-    return `check:${JSON.stringify(key(params.predicate))}`;
+function invalid2(params) {
+  return new VibeError({ code: "VIBE_SCHEMA_INVALID", message: params.message, meta: { rule: params.rule, ...params.meta ?? {} } });
+}
+function assertGroup(params) {
+  const { kind, fields } = params;
+  if (fields.length < 2 || fields.length > CHECK_RULE_GROUP_MAX) {
+    throw invalid2({ rule: "check-rule-group-arity", message: `${kind}() takes 2 to ${CHECK_RULE_GROUP_MAX} columns, not ${fields.length}`, meta: { kind, fields: [...fields] } });
   }
-  const expression = (node) => {
-    switch (node.kind) {
-      case "field":
-        return `f:${node.name}`;
-      case "jsonText":
-        return `jsonText(${JSON.stringify([node.field.name, node.path])})`;
-      case "length":
-        return `length(${expression(node.expression)})`;
+  if (new Set(fields).size !== fields.length) {
+    throw invalid2({ rule: "check-rule-duplicate-field", message: `${kind}() names a column twice (${fields.join(", ")}) \u2014 the expansion would contradict itself`, meta: { kind, fields: [...fields] } });
+  }
+}
+function checkRulePredicate(params) {
+  const { rule } = params;
+  switch (rule.kind) {
+    case "compare":
+      return { kind: "compare", op: rule.op, left: field(rule.field), right: value(rule.value) };
+    case "range":
+      return and([
+        { kind: "compare", op: "gte", left: field(rule.field), right: value(rule.min) },
+        { kind: "compare", op: "lte", left: field(rule.field), right: value(rule.max) }
+      ]);
+    case "oneOf":
+      if (rule.values.length === 0)
+        throw invalid2({ rule: "check-rule-empty", message: `oneOf() on "${rule.field}" has no values \u2014 an empty IN list is never what an author means`, meta: { field: rule.field } });
+      return { kind: "inList", field: field(rule.field), values: rule.values.map((entry) => value(entry)) };
+    case "lengthAtMost":
+      return { kind: "compare", op: "lte", left: { kind: "length", expression: field(rule.field) }, right: value(rule.max) };
+    case "order":
+      return { kind: "compare", op: rule.op, left: field(rule.left), right: field(rule.right) };
+    case "allOrNone":
+      assertGroup({ kind: rule.kind, fields: rule.fields });
+      return or([and(rule.fields.map(isNull)), and(rule.fields.map(isNotNull))]);
+    case "exactlyOne":
+    case "atMostOne": {
+      assertGroup({ kind: rule.kind, fields: rule.fields });
+      const one = rule.fields.map((name) => and([isNotNull(name), ...rule.fields.filter((other) => other !== name).map(isNull)]));
+      return or(rule.kind === "exactlyOne" ? one : [...one, and(rule.fields.map(isNull))]);
     }
-  };
-  const encode = (node) => {
-    switch (node.kind) {
-      case "compare":
-        return `cmp(${node.op},${node.left.kind === "field" ? node.left.name : expression(node.left)},${node.right.kind === "value" ? `v:${typeof node.right.value}:${String(node.right.value)}` : expression(node.right)})`;
-      case "inList":
-        return `in${node.negate === true ? "!" : ""}(${node.field.name},[${node.values.map((entry) => `${typeof entry.value}:${String(entry.value)}`).join("|")}])`;
-      case "isNull":
-        return `null${node.negate === true ? "!" : ""}(${node.field.name})`;
-      case "and":
-      case "or":
-        return `${node.kind}(${node.operands.map(encode).join(",")})`;
-      case "not":
-        return `not(${encode(node.operand)})`;
-      case "isTrue":
-        return `isTrue(${encode(node.operand)})`;
+    case "anySet":
+      assertGroup({ kind: rule.kind, fields: rule.fields });
+      return or(rule.fields.map(isNotNull));
+    case "presence": {
+      if (rule.set.length === 0 && rule.unset.length === 0) {
+        throw invalid2({ rule: "presence-empty", message: `presence rule for "${rule.field}" names no member \u2014 it would hold nothing`, meta: { field: rule.field, by: rule.by } });
+      }
+      const halves = [];
+      if (rule.set.length > 0)
+        halves.push(or([notMember({ by: rule.by, members: rule.set }), isNotNull(rule.field)]));
+      if (rule.unset.length > 0)
+        halves.push(or([notMember({ by: rule.by, members: rule.unset }), isNull(rule.field)]));
+      return and(halves);
     }
-  };
-  return encode(params.predicate);
+  }
 }
 // packages/schema/src/time-of-day.ts
 var TIME_OF_DAY_NATIVE_TYPE = /^time(tz)?(?:\(\d+\))?$|^time(?:\(\d+\))?with(out)?timezone$/;
@@ -990,114 +2412,6 @@ function timeOfDayType(params) {
     return "timetz";
   return "time";
 }
-// packages/schema/src/prisma-literal.ts
-var STRING_ESCAPES = {
-  '"': '"',
-  "'": "'",
-  "\\": "\\",
-  "/": "/",
-  n: `
-`,
-  r: "\r",
-  t: "\t",
-  b: "\b",
-  f: "\f"
-};
-function malformed(params) {
-  return new VibeError({
-    code: "VIBE_SCHEMA_INVALID",
-    message: `Malformed string literal ${JSON.stringify(params.raw)}: ${params.detail}`,
-    meta: { issues: [{ rule: "malformed-string-literal", message: params.detail }], literal: params.raw }
-  });
-}
-function decodePrismaString(params) {
-  const { raw } = params;
-  const quoted = raw.length >= 2 && raw.startsWith('"') && raw.endsWith('"');
-  const body = quoted ? raw.slice(1, -1) : raw;
-  if (!body.includes("\\"))
-    return body;
-  let out = "";
-  for (let index = 0;index < body.length; index += 1) {
-    const char = body[index];
-    if (char !== "\\") {
-      out += char;
-      continue;
-    }
-    const next = body[index + 1];
-    if (next === undefined)
-      throw malformed({ raw, detail: "it ends with a lone backslash" });
-    if (next === "u") {
-      const digits = body.slice(index + 2, index + 6);
-      if (!/^[0-9a-fA-F]{4}$/.test(digits)) {
-        throw malformed({ raw, detail: `\\u must be followed by four hex digits, found "${digits}"` });
-      }
-      out += String.fromCharCode(Number.parseInt(digits, 16));
-      index += 5;
-      continue;
-    }
-    const decoded = STRING_ESCAPES[next];
-    if (decoded === undefined)
-      throw malformed({ raw, detail: `unknown escape "\\${next}"` });
-    out += decoded;
-    index += 1;
-  }
-  return out;
-}
-function unicodeEscape(params) {
-  return `\\u${params.char.charCodeAt(0).toString(16).padStart(4, "0")}`;
-}
-function encodePrismaString(params) {
-  const { value } = params;
-  let out = '"';
-  for (const char of value) {
-    if (char === "\\")
-      out += "\\\\";
-    else if (char === '"')
-      out += "\\\"";
-    else if (char === `
-`)
-      out += "\\n";
-    else if (char === "\r")
-      out += "\\r";
-    else if (char === "\t")
-      out += "\\t";
-    else if (char < " " || char === "\x7F")
-      out += unicodeEscape({ char });
-    else
-      out += char;
-  }
-  return `${out}"`;
-}
-var INTEGER_LITERAL = /^-?\d+$/;
-function exactIntegerLiteral(params) {
-  const { text } = params;
-  if (!INTEGER_LITERAL.test(text)) {
-    throw new VibeError({
-      code: "VIBE_SCHEMA_INVALID",
-      message: `Not an integer literal: ${JSON.stringify(text)}`,
-      meta: { issues: [{ rule: "malformed-integer-literal", message: text }], literal: text }
-    });
-  }
-  const asNumber = Number(text);
-  if (Number.isSafeInteger(asNumber))
-    return asNumber;
-  return BigInt(text).toString();
-}
-var DECIMAL_LITERAL = /^-?\d+(\.\d+)?([eE][+-]?\d+)?$/;
-function exactDecimalLiteral(params) {
-  const { text } = params;
-  if (!DECIMAL_LITERAL.test(text)) {
-    throw new VibeError({
-      code: "VIBE_SCHEMA_INVALID",
-      message: `Not a numeric literal: ${JSON.stringify(text)}`,
-      meta: { issues: [{ rule: "malformed-numeric-literal", message: text }], literal: text }
-    });
-  }
-  if (INTEGER_LITERAL.test(text))
-    return exactIntegerLiteral({ text });
-  const mantissa = text.replace(/[eE].*$/, "").replace("-", "").replace(".", "").replace(/^0+/, "");
-  return mantissa.length <= 15 ? Number(text) : text;
-}
 // packages/schema/src/computed.ts
 function buildComputedManifest(params) {
   const { computed } = params;
@@ -1328,6 +2642,61 @@ function normalizeJsonSchemaRef(params) {
   return { ...remaining === undefined ? {} : { documentation: remaining }, ...jsonSchema === undefined ? {} : { jsonSchema } };
 }
 
+// packages/schema/src/validator-ref.ts
+var EXPORT_NAME2 = /^[$_\p{ID_Start}][$_\u200c\u200d\p{ID_Continue}]*$/u;
+var ANNOTATION_START = /^@validate\s*\(/u;
+var ANNOTATION_LINE = /^@validate\(\s*([$_\p{ID_Start}][$_\u200c\u200d\p{ID_Continue}]*)\s+from\s+("(?:[^"\\\r\n]|\\.)*")\s*\)$/u;
+function annotations2(params) {
+  const lines = params.documentation.split(`
+`);
+  return { lines, indexes: lines.flatMap((line, index) => ANNOTATION_START.test(line.trim()) ? [index] : []) };
+}
+function validatorRefIssue(params) {
+  const { value } = params;
+  if (typeof value !== "object" || value === null || Array.isArray(value))
+    return "Validator reference must be { name, from }; validators belong in the referenced export";
+  const keys = Reflect.ownKeys(value);
+  if (keys.length !== 2 || !keys.includes("name") || !keys.includes("from"))
+    return "Validator reference accepts only name and from";
+  const name = Object.getOwnPropertyDescriptor(value, "name");
+  const from = Object.getOwnPropertyDescriptor(value, "from");
+  if (name?.enumerable !== true || !("value" in name) || typeof name.value !== "string" || !EXPORT_NAME2.test(name.value) || name.value === "default")
+    return "Validator name must be a valid named export, not default";
+  if (from?.enumerable !== true || !("value" in from) || typeof from.value !== "string" || from.value.trim().length === 0 || /[\u0000-\u001f\u007f]/u.test(from.value))
+    return "Validator from must be a non-empty import specifier without control characters";
+  return;
+}
+function assertValidatorRef(params) {
+  const issue = validatorRefIssue(params);
+  if (issue !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: issue, meta: { issues: [{ rule: "invalid-validator-ref", message: issue }] } });
+  const value = params.value;
+  return Object.freeze({ name: value.name, from: value.from });
+}
+function hasValidatorAnnotation(params) {
+  return annotations2({ documentation: params.documentation ?? "" }).indexes.length > 0;
+}
+function normalizeValidatorRef(params) {
+  const { documentation, reference } = params;
+  const refs = annotations2({ documentation: documentation ?? "" });
+  let validator = reference === undefined ? undefined : assertValidatorRef({ value: reference });
+  let remaining = documentation;
+  if (refs.indexes.length > 1 || refs.indexes.length > 0 && validator !== undefined)
+    throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "A field may declare only one validator reference", meta: { issues: [{ rule: "duplicate-validator-ref" }] } });
+  const index = refs.indexes[0];
+  if (index !== undefined) {
+    const match = ANNOTATION_LINE.exec(refs.lines[index].trim());
+    if (match === null)
+      throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: 'Expected a documentation line @validate(Name from "specifier")', meta: { issues: [{ rule: "invalid-validator-ref" }] } });
+    validator = assertValidatorRef({ value: { name: match[1], from: decodePrismaString({ raw: match[2] }) } });
+    remaining = refs.lines.map((line, position) => position === index ? "" : line).join(`
+`).trim();
+    if (remaining === "")
+      remaining = undefined;
+  }
+  return { ...remaining === undefined ? {} : { documentation: remaining }, ...validator === undefined ? {} : { validator } };
+}
+
 // packages/schema/src/m2m.ts
 function implicitJoinTable(params) {
   const sorted = [params.modelA, params.modelB].sort();
@@ -1471,6 +2840,7 @@ var GENERATED_TYPE_NAMES = {
     "WhereInput",
     "WhereUniqueInput",
     "OrderByInput",
+    "KeyRow",
     "ScalarOrderByInput",
     "RelationOrderByInput",
     "RelationFindManyArgs",
@@ -1629,6 +2999,10 @@ function validateGeneratedNames(params) {
     owners.set("BoundVibeClientInstance", "native RLS client");
     owners.set("BoundVibeTransactionClientInstance", "native RLS client");
   }
+  if (schema.models.some((model) => model.fields.some((field) => isLocalDateField({ field })))) {
+    for (const name of ["LocalDate", "LocalDateFilter", "LocalDateNullableFilter"])
+      owners.set(name, "local-date filters");
+  }
   const register = (params) => {
     if (!/^[$_\p{ID_Start}][$_\u200c\u200d\p{ID_Continue}]*$/u.test(params.name) || INVALID_BINDING_NAMES.has(params.name)) {
       issues.push({ rule: "invalid-generated-identifier", message: `Generated name "${params.name}" from ${params.owner} is not a legal TypeScript identifier` });
@@ -1687,7 +3061,7 @@ function referencesPartialOnly(params) {
   const { target, references, schema, lookups } = params;
   let partial = lookups.partialKeys.get(target);
   if (partial === undefined) {
-    partial = foreignKeyKeys({ keys: target.indexes.filter((index) => index.kind === "unique" && (index.where !== undefined || index.wherePredicate !== undefined)).map((index) => index.fields.map((field) => field.name)) });
+    partial = foreignKeyKeys({ keys: target.indexes.filter((index) => index.kind === "unique" && !isExpressionIndex({ index }) && (index.where !== undefined || index.wherePredicate !== undefined)).map((index) => index.fields.map((field) => field.name)) });
     lookups.partialKeys.set(target, partial);
   }
   if (partial.distinct.size === 0 && partial.repeated.length === 0)
@@ -1699,7 +3073,7 @@ function referencesPartialOnly(params) {
     total = foreignKeyKeys({ keys: [
       ...target.fields.filter((field) => field.isId || field.isUnique).map((field) => [field.name]),
       ...target.primaryKey === undefined ? [] : [target.primaryKey.fields],
-      ...target.indexes.filter((index) => index.kind === "unique" && index.where === undefined && index.wherePredicate === undefined).map((index) => index.fields.map((field) => field.name))
+      ...target.indexes.filter((index) => index.kind === "unique" && !isExpressionIndex({ index }) && index.where === undefined && index.wherePredicate === undefined).map((index) => index.fields.map((field) => field.name))
     ] });
     lookups.totalKeys.set(target, total);
   }
@@ -1719,8 +3093,16 @@ function referencesPartialOnly(params) {
   return !lookups.independentTables.has(JSON.stringify([placement.namespace, placement.name]));
 }
 function validateSchemaIR(params) {
-  const { schema } = params;
-  const issues = [];
+  return validateSchemaWithRowRules({ ...params, rowRules: createRowRuleValidationContext(params) });
+}
+function validateSchemaWithRowRules(params) {
+  const { schema, rowRules } = params;
+  const issues = [...validateGeneratedColumns({ schema })];
+  const expressionIssues = validateIndexExpressions({ schema, dialect: providerToDialect({ provider: schema.datasource.provider }) });
+  if (expressionIssues.length > 0)
+    return [...issues, ...expressionIssues];
+  for (const model of schema.models)
+    issues.push(...rowRules.validate({ model }));
   for (const entry of [...schema.models, ...schema.enums]) {
     if (entry.namespace === undefined)
       continue;
@@ -1894,6 +3276,8 @@ function validateSchemaIR(params) {
       });
     }
     for (const index of model.indexes) {
+      if (isExpressionIndex({ index }))
+        continue;
       if (index.clientName === undefined && (index.kind !== "unique" || index.where !== undefined || index.fields.length < 2 || !addressable(index.fields.map((field) => field.name))))
         continue;
       checkSelectorName({
@@ -1906,7 +3290,7 @@ function validateSchemaIR(params) {
     }
   }
   validateIdentifierLengths({ schema, issues });
-  validatePhysicalNameUniqueness({ schema, issues, modelByName, fieldsByModel });
+  validatePhysicalNameUniqueness({ schema, issues, modelByName, fieldsByModel, rowRules });
   validateGeneratedNames({ schema, issues });
   validateNativeRls({ schema, issues });
   return issues;
@@ -1915,8 +3299,14 @@ function validatePhysicalNameUniqueness(params) {
   const { schema, issues, modelByName, fieldsByModel } = params;
   const dialect = providerToDialect({ provider: schema.datasource.provider });
   const owners = new Map;
+  let hasRowRuleClaims = false;
+  const ruleDiagnostics = new Set;
+  const triggerNamespace = (table) => dialect === "postgres" ? `trigger:${table}` : "trigger";
+  const collisionName = (name) => dialect === "postgres" ? name : dialect === "sqlite" ? name.replace(/[A-Z]/g, (character) => character.toLowerCase()) : name.toLowerCase();
+  const diagnosticKey = (entry) => JSON.stringify([entry.namespace, entry.table, collisionName(entry.name)]);
   const claim = (entry) => {
-    const key = JSON.stringify([entry.physicalNamespace ?? "public", entry.namespace, entry.name]);
+    const rowRuleScope = entry.namespace === "trigger" || entry.namespace.startsWith("row-rule-diagnostic:");
+    const key = JSON.stringify([entry.physicalNamespace ?? "public", entry.namespace, rowRuleScope ? collisionName(entry.name) : entry.name]);
     const previous = owners.get(key);
     if (previous === undefined) {
       owners.set(key, `${entry.what} of ${entry.owner}`);
@@ -1924,7 +3314,7 @@ function validatePhysicalNameUniqueness(params) {
     }
     issues.push({
       rule: "duplicate-physical-name",
-      message: `${entry.what} "${entry.name}" of ${entry.owner} collides with the ${previous} \u2014 both resolve to one physical ${entry.namespace === "relation" ? "object" : "name"}, and only one can exist`,
+      message: `${entry.what} "${entry.name}" of ${entry.owner} collides with the ${previous} \u2014 both resolve to one physical ${entry.namespace === "relation" ? "object" : "name"}, and only one can exist${entry.remedy ?? (previous.includes("expression index") ? "; set an explicit map on the expression index to choose a distinct physical name" : "")}`,
       ...entry.model === undefined ? {} : { model: entry.model },
       ...entry.field === undefined ? {} : { field: entry.field }
     });
@@ -1952,12 +3342,12 @@ function validatePhysicalNameUniqueness(params) {
     for (const { index, site } of declarations) {
       const unique = index.kind === "unique";
       const columns = index.fields.map((entry) => [columnOf(entry.name), entry.sort === "desc", entry.operatorClass === undefined ? null : [entry.operatorClass.namespace, entry.operatorClass.name]]);
-      const key = JSON.stringify([unique, index.nullsNotDistinct === true, unique ? "btree" : index.kind, columns, index.where?.trim() ?? ""]);
+      const key = isExpressionIndex({ index }) ? indexKeyDefinitionKey({ index, model }) : JSON.stringify([unique, index.nullsNotDistinct === true, unique ? "btree" : index.kind, columns, index.where?.trim() ?? ""]);
       if (seenIndexKeys.has(key))
         continue;
       seenIndexKeys.add(key);
-      const name = index.name ?? defaultIndexName({ table, columns: index.fields.map((entry) => columnOf(entry.name)), unique, dialect });
-      claim({ namespace: indexNamespace(table), physicalNamespace, name, what: unique ? "unique index" : "index", owner: `${site} on "${model.name}"`, model: model.name });
+      const name = index.name ?? (isExpressionIndex({ index }) ? defaultExpressionIndexName({ table, model, index, dialect }) : defaultIndexName({ table, columns: index.fields.map((entry) => columnOf(entry.name)), unique, dialect }));
+      claim({ namespace: indexNamespace(table), physicalNamespace, name, what: isExpressionIndex({ index }) ? unique ? "unique expression index" : "expression index" : unique ? "unique index" : "index", owner: `${site} on "${model.name}"`, model: model.name, ...isExpressionIndex({ index }) ? { remedy: "; set an explicit map on the expression index to choose a distinct physical name" } : {} });
       if (index.constraintName !== undefined) {
         claim({ namespace: constraintNamespace(table), physicalNamespace, name: index.constraintName, what: "unique constraint", owner: `${site} on "${model.name}"`, model: model.name });
       }
@@ -1976,15 +3366,64 @@ function validatePhysicalNameUniqueness(params) {
       const name = relation.constraintName ?? defaultForeignKeyName({ table, columns: relation.fields.map((entry) => columnOf(entry)), dialect });
       claim({ namespace: constraintNamespace(table), physicalNamespace, name, what: "foreign key", owner: `relation "${model.name}.${relation.name}"`, model: model.name });
     }
+    if (dialect === "sqlite") {
+      for (const field of model.fields) {
+        if (!isLocalDateField({ field }))
+          continue;
+        claim({ namespace: constraintNamespace(table), physicalNamespace, name: localDateCheckName({ table, column: field.dbName ?? field.name }), what: "owned local-date CHECK", owner: `field "${model.name}.${field.name}"`, model: model.name, field: field.name });
+      }
+    }
     for (const checkIR of model.checks ?? []) {
       claim({ namespace: constraintNamespace(table), physicalNamespace, name: checkIR.name, what: "CHECK constraint", owner: `model "${model.name}"`, model: model.name });
     }
+    if (Array.isArray(model.rowRules))
+      for (const rule of model.rowRules) {
+        if (rowRuleShapeIssue({ value: rule }) !== undefined)
+          continue;
+        hasRowRuleClaims = true;
+        const pair = rowRuleObjectNames({ rule });
+        const owner = `row rule "${model.name}.${rule.name}" (supply an explicit, distinct name stem)`;
+        const ruleNamespace = dialect === "sqlite" ? "main" : physicalNamespace;
+        if (dialect === "postgres")
+          claim({ namespace: "function:[]", physicalNamespace, name: pair.functionName, what: "row-rule function", owner, model: model.name });
+        const names = dialect === "postgres" ? [pair.triggerName] : (rule.kind === "appendOnly" ? ["update", "delete"] : ["update"]).map((event) => rowRuleTriggerName({ rule, event }));
+        for (const name of names) {
+          claim({ namespace: triggerNamespace(table), physicalNamespace: ruleNamespace, name, what: "row-rule trigger", owner, model: model.name });
+          if (dialect === "postgres")
+            claim({ namespace: constraintNamespace(table), physicalNamespace, name, what: "row-rule diagnostic name", owner, model: model.name });
+          else {
+            claim({ namespace: `row-rule-diagnostic:${table}`, physicalNamespace: ruleNamespace, name, what: "row-rule diagnostic name", owner, model: model.name });
+            const constraints = [
+              ...(model.checks ?? []).map((check) => check.name),
+              ...model.indexes.flatMap((index) => index.constraintName === undefined ? [] : [index.constraintName]),
+              ...model.relations.filter((relation) => (relation.fields?.length ?? 0) > 0).map((relation) => relation.constraintName ?? defaultForeignKeyName({ table, columns: relation.fields.map(columnOf), dialect })),
+              ...dialect === "sqlite" ? model.fields.filter((field) => isLocalDateField({ field })).map((field) => localDateCheckName({ table, column: field.dbName ?? field.name })) : []
+            ];
+            for (const constraint of constraints)
+              if (collisionName(constraint) === collisionName(name))
+                claim({ namespace: `row-rule-diagnostic:${table}`, physicalNamespace: ruleNamespace, name: constraint, what: "constraint diagnostic name", owner: `model "${model.name}"`, model: model.name });
+          }
+          ruleDiagnostics.add(diagnosticKey({ namespace: ruleNamespace, table, name }));
+        }
+      }
     for (const exclusion of model.exclusions ?? []) {
       claim({ namespace: constraintNamespace(table), physicalNamespace, name: exclusion.name, what: "exclusion constraint", owner: `model "${model.name}"`, model: model.name });
       if (dialect === "postgres")
         claim({ namespace: "relation", physicalNamespace, name: exclusion.name, what: "exclusion constraint", owner: `model "${model.name}"`, model: model.name });
     }
   }
+  for (const object of hasRowRuleClaims ? params.rowRules.objects() : []) {
+    const identity = object.identity;
+    if (dialect === "postgres" && identity.kind === "function")
+      claim({ namespace: `function:${JSON.stringify(identity.argumentTypes.map((type) => [type.namespace, type.name]))}`, physicalNamespace: identity.name.namespace, name: identity.name.name, what: "migration function", owner: object.id });
+    if (identity.kind === "trigger") {
+      if (dialect === "mysql" && /[^\x00-\x7F]/.test(identity.name))
+        issues.push({ rule: "row-rule-name-collation", message: `MySQL migration trigger ${identity.name} cannot be qualified against declared row rules without engine trigger-name collation evidence; use an ASCII name` });
+      claim({ namespace: triggerNamespace(identity.table.name), physicalNamespace: identity.table.namespace, name: identity.name, what: "migration trigger", owner: object.id });
+    }
+    if (identity.kind === "constraint" && ruleDiagnostics.has(diagnosticKey({ namespace: identity.table.namespace, table: identity.table.name, name: identity.name })))
+      claim({ namespace: dialect === "postgres" ? constraintNamespace(identity.table.name) : `row-rule-diagnostic:${identity.table.name}`, physicalNamespace: identity.table.namespace, name: identity.name, what: "migration constraint", owner: object.id });
+  }
   if (dialect === "postgres") {
     for (const enumDef of schema.enums) {
       if (enumStorageOf({ enumDef }) !== "database")
@@ -2127,11 +3566,31 @@ function validateModel(params) {
     }
     if (hasJsonSchemaAnnotation({ documentation: field.documentation }))
       issues.push({ rule: "unnormalized-json-schema-ref", message: "Normalize @schema documentation into FieldIR.jsonSchema before consuming SchemaIR", model: model.name, field: field.name });
+    if (field.validator !== undefined) {
+      const issue = validatorRefIssue({ value: field.validator });
+      if (issue !== undefined)
+        issues.push({ rule: "invalid-validator-ref", message: issue, model: model.name, field: field.name });
+      if (field.type === "Json" || field.isUnsupported === true)
+        issues.push({ rule: "validator-non-scalar", message: "Validators are only valid on queryable non-JSON scalar or enum fields; use .schema() for Json", model: model.name, field: field.name });
+      if (field.jsonSchema !== undefined || hasType)
+        issues.push({ rule: "conflicting-validator-ref", message: "A field cannot combine a scalar validator with a JSON schema or type assertion", model: model.name, field: field.name });
+    }
+    if (hasValidatorAnnotation({ documentation: field.documentation }))
+      issues.push({ rule: "unnormalized-validator-ref", message: "Normalize @validate documentation into FieldIR.validator before consuming SchemaIR", model: model.name, field: field.name });
     const typeIdentity = field.nativeTypeIdentity;
     if (typeIdentity !== undefined && (typeIdentity === null || typeof typeIdentity !== "object" || field.isUnsupported !== true || typeof typeIdentity.source !== "string" || typeIdentity.source !== field.nativeType || typeof typeIdentity.namespace !== "string" || typeIdentity.namespace.length === 0 || typeIdentity.namespace.includes("\x00"))) {
       issues.push({ rule: "invalid-native-type-identity", message: `PostgreSQL type identity on "${model.name}.${field.name}" must be bound to its unsupported declaration`, model: model.name, field: field.name });
     }
     const defaultValue = field.default;
+    if (isLocalDateField({ field })) {
+      if (field.isList)
+        issues.push({ rule: "local-date-list", message: `Local-date field "${model.name}.${field.name}" cannot be a list`, model: model.name, field: field.name });
+      if (field.isUpdatedAt)
+        issues.push({ rule: "local-date-updated-at", message: `Local-date field "${model.name}.${field.name}" cannot use @updatedAt`, model: model.name, field: field.name });
+      if (defaultValue !== undefined && (defaultValue.kind !== "literal" || !isCanonicalLocalDate({ value: defaultValue.value }))) {
+        issues.push({ rule: "local-date-default", message: `Default on "${model.name}.${field.name}" must be a canonical YYYY-MM-DD calendar-day literal in years 0001\u20139999; generated defaults are not supported`, model: model.name, field: field.name });
+      }
+    }
     if (defaultValue !== undefined && defaultValue.kind !== "dbgenerated" && defaultValue.kind !== "list") {
       let valid = !field.isList;
       if (defaultValue.kind === "now")
@@ -2254,6 +3713,8 @@ function validateModel(params) {
     }
   }
   for (const relation of model.relations) {
+    if ("validator" in relation || "documentation" in relation && typeof relation.documentation === "string" && hasValidatorAnnotation({ documentation: relation.documentation }))
+      issues.push({ rule: "validator-non-scalar", message: "Validators cannot be declared on relations", model: model.name, field: relation.name });
     const target = modelByName.get(relation.targetModel);
     if (target === undefined) {
       issues.push({
@@ -2300,6 +3761,13 @@ function validateModel(params) {
           issues.push({ rule: "relation-partial-only-target", message: `Relation "${model.name}.${relation.name}" references only a partial unique key`, model: model.name, field: relation.name });
         }
         const targetFieldNames = lookups.fieldsByModel.get(target);
+        for (const [index, fkName] of relation.fields.entries()) {
+          const own = lookups.fieldsByModel.get(model)?.get(fkName);
+          const referenced = targetFieldNames.get(relation.references[index] ?? "");
+          if (own !== undefined && referenced !== undefined && (isLocalDateField({ field: own }) || isLocalDateField({ field: referenced })) && fieldTypeIdentity(own) !== fieldTypeIdentity(referenced)) {
+            issues.push({ rule: "relation-type-mismatch", message: `Relation "${model.name}.${relation.name}" pairs a local date with a different logical type; both foreign-key columns must be local dates`, model: model.name, field: fkName });
+          }
+        }
         for (const refField of relation.references) {
           if (!targetFieldNames.has(refField)) {
             issues.push({
@@ -2314,10 +3782,10 @@ function validateModel(params) {
     }
   }
   for (const field of model.fields) {
-    if (field.collation !== undefined && field.type !== "String") {
+    if (field.collation !== undefined && (field.type !== "String" || isLocalDateField({ field }))) {
       issues.push({
         rule: "collation-non-string",
-        message: `@collation on "${model.name}.${field.name}" \u2014 collation is only valid on String fields`,
+        message: `@collation on "${model.name}.${field.name}" \u2014 collation is only valid on text String fields, not local dates`,
         model: model.name,
         field: field.name
       });
@@ -2371,6 +3839,7 @@ function validateModel(params) {
         fieldNames,
         site: `CHECK "${check.name}"`,
         usage: "check",
+        enums: params.schema.enums,
         dialect: providerToDialect({ provider: params.schema.datasource.provider }),
         issues
       });
@@ -2394,6 +3863,7 @@ function validateModel(params) {
         fieldNames,
         site: `partial index on [${index.fields.map((entry) => entry.name).join(", ")}]`,
         usage: "indexPredicate",
+        enums: params.schema.enums,
         dialect: providerToDialect({ provider: params.schema.datasource.provider }),
         issues
       });
@@ -2402,40 +3872,129 @@ function validateModel(params) {
   for (const exclusion of model.exclusions ?? []) {
     const predicate = exclusion.source?.where;
     if (predicate !== undefined)
-      validatePredicateFields({ predicate, model, fieldNames, site: `exclusion "${exclusion.name}"`, usage: "exclusionPredicate", dialect: providerToDialect({ provider: params.schema.datasource.provider }), issues });
+      validatePredicateFields({ predicate, model, fieldNames, site: `exclusion "${exclusion.name}"`, usage: "exclusionPredicate", enums: params.schema.enums, dialect: providerToDialect({ provider: params.schema.datasource.provider }), issues });
   }
 }
 function validatePredicateFields(params) {
-  const { predicate, model, fieldNames, site, issues } = params;
-  const inspection = inspectPredicate({ predicate });
-  if (inspection.checkOnly && (params.usage !== "check" || !DIALECT_CAPABILITIES[params.dialect].schemaCheckExpressions)) {
-    issues.push({ rule: "predicate-check-capability", message: `${site}: computed schema predicates require a PostgreSQL CHECK`, model: model.name });
+  const { predicate, model, fieldNames, site, issues, enums } = params;
+  const capability = predicateCapabilityIssue({ predicate, model, dialect: params.dialect, usage: params.usage });
+  if (capability !== undefined) {
+    issues.push({ rule: "predicate-check-capability", message: `${site}: ${capability.feature} is not supported for ${params.usage} on ${params.dialect}${capability.hint === undefined ? "" : ` (${capability.hint})`}`, model: model.name });
   }
+  const issue = (params) => {
+    issues.push({ ...params, message: `${site}: ${params.message}`, model: model.name });
+  };
+  const identity = (params) => fieldTypeIdentity({ type: params.result.type, nativeType: params.result.refinement === "localDate" ? "Date" : undefined });
+  const literal = (params) => {
+    const { value } = params.value;
+    const { type, refinement } = params.result;
+    if (refinement === "localDate") {
+      if (!isCanonicalLocalDate({ value }))
+        issue({ rule: "predicate-local-date-literal", message: "a local-date predicate requires a canonical YYYY-MM-DD calendar-day literal" });
+      return;
+    }
+    if (isEnumType(type)) {
+      const declared = enums.find((entry) => entry.name === type.enum);
+      if (typeof value !== "string")
+        issue({ rule: "predicate-type-mismatch", message: "an enum predicate requires a member name as a string" });
+      else if (declared !== undefined && !declared.values.includes(value))
+        issue({ rule: "predicate-enum-member", message: `literal ${JSON.stringify(value)} is not a member of enum ${type.enum}` });
+      return;
+    }
+    if (type === "Int" || type === "BigInt") {
+      if (typeof value !== "number" && typeof value !== "string") {
+        issue({ rule: "predicate-type-mismatch", message: `${type} requires an exact integer literal` });
+        return;
+      }
+      if (typeof value === "number" ? !Number.isSafeInteger(value) : !/^-?(0|[1-9]\d*)$/.test(value)) {
+        issue({ rule: "predicate-literal-invalid", message: `${type} requires an exact integer literal without rounding or exponent notation` });
+        return;
+      }
+      const parsed = BigInt(value);
+      const min = type === "Int" ? -2147483648n : -(2n ** 63n);
+      const max = type === "Int" ? 2147483647n : 2n ** 63n - 1n;
+      if (parsed < min || parsed > max)
+        issue({ rule: "predicate-literal-invalid", message: `${type} literal is outside its signed integer range` });
+      return;
+    }
+    if (type === "Float") {
+      if (typeof value !== "number")
+        issue({ rule: "predicate-type-mismatch", message: "Float requires a number literal" });
+      else if (!Number.isFinite(value))
+        issue({ rule: "predicate-literal-invalid", message: "Float requires a finite number literal" });
+      return;
+    }
+    if (type === "Decimal") {
+      if (typeof value !== "string")
+        issue({ rule: "predicate-type-mismatch", message: "Decimal requires exact fixed-point text, not a JavaScript number" });
+      else if (!/^-?(0|[1-9]\d*)(\.\d+)?$/.test(value))
+        issue({ rule: "predicate-literal-invalid", message: "Decimal requires exact fixed-point text without exponent notation" });
+      return;
+    }
+    if (type === "String") {
+      if (typeof value !== "string")
+        issue({ rule: "predicate-type-mismatch", message: "a text expression requires a string literal" });
+      else if (value.includes("\x00"))
+        issue({ rule: "predicate-literal-invalid", message: "a text literal cannot contain NUL bytes" });
+    } else if (type === "Boolean" && typeof value !== "boolean")
+      issue({ rule: "predicate-type-mismatch", message: "Boolean requires true or false" });
+  };
   const expressionType = (expression) => {
-    if (expression.kind === "field")
-      return model.fields.find((field) => field.name === expression.name)?.type;
-    if (expression.kind === "jsonText") {
-      const field = model.fields.find((candidate) => candidate.name === expression.field.name);
-      if (field !== undefined && (field.type !== "Json" || field.isUnsupported === true))
-        issues.push({ rule: "predicate-type-mismatch", message: `${site}: jsonText requires a Json field`, model: model.name, field: field.name });
-      if (!Array.isArray(expression.path) || Array.from(expression.path).some((segment) => typeof segment !== "string" || segment.includes("\x00")))
-        issues.push({ rule: "predicate-json-path", message: `${site}: jsonText requires a string-only path without NUL bytes`, model: model.name });
-      return "String";
+    switch (expression.kind) {
+      case "field": {
+        const field = model.fields.find((candidate) => candidate.name === expression.name);
+        if (field === undefined || field.isList || field.isUnsupported)
+          return;
+        return isLocalDateField({ field }) ? { type: field.type, refinement: "localDate" } : { type: field.type };
+      }
+      case "jsonText": {
+        const field = model.fields.find((candidate) => candidate.name === expression.field.name);
+        if (field !== undefined && (field.type !== "Json" || field.isUnsupported === true))
+          issue({ rule: "predicate-type-mismatch", message: "jsonText requires a Json field", field: field.name });
+        if (!Array.isArray(expression.path) || Array.from(expression.path).some((segment) => typeof segment !== "string" || segment.includes("\x00")))
+          issue({ rule: "predicate-json-path", message: "jsonText requires a string-only path without NUL bytes" });
+        return { type: "String" };
+      }
+      case "length":
+      case "lower":
+      case "upper": {
+        const child = expressionType(expression.expression);
+        if (child !== undefined && (child.type !== "String" || child.refinement === "localDate"))
+          issue({ rule: "predicate-type-mismatch", message: `${expression.kind} requires a text expression, not a local date or another scalar` });
+        return { type: expression.kind === "length" ? "Int" : "String" };
+      }
+      case "add":
+      case "sub":
+      case "mul": {
+        const left = expressionType(expression.left);
+        const right = expression.right.kind === "value" ? undefined : expressionType(expression.right);
+        if (left === undefined)
+          return;
+        if (left.type !== "Int" && left.type !== "BigInt" && left.type !== "Float" && left.type !== "Decimal") {
+          issue({ rule: "predicate-type-mismatch", message: `${expression.kind} requires Int, BigInt, Float or Decimal operands` });
+          return;
+        }
+        if (right !== undefined && right.type !== left.type)
+          issue({ rule: "predicate-type-mismatch", message: `${expression.kind} operands must have the same numeric family` });
+        if (expression.right.kind === "value")
+          literal({ value: expression.right, result: left });
+        return { type: left.type };
+      }
     }
-    if (expressionType(expression.expression) !== "String")
-      issues.push({ rule: "predicate-type-mismatch", message: `${site}: length requires a text expression`, model: model.name });
-    return "Int";
   };
   const validateComputedComparisons = (node) => {
     if (node.kind === "compare") {
-      if (node.left.kind !== "field" || node.right.kind !== "value" && node.right.kind !== "field") {
-        const left = expressionType(node.left);
-        const right = node.right.kind === "value" ? undefined : expressionType(node.right);
-        if (left !== undefined && right !== undefined && left !== right)
-          issues.push({ rule: "predicate-type-mismatch", message: `${site}: computed comparison operands must have the same scalar type`, model: model.name });
-        if (node.right.kind === "value" && left === "String" && typeof node.right.value !== "string")
-          issues.push({ rule: "predicate-type-mismatch", message: `${site}: a text expression requires a string literal`, model: model.name });
-      }
+      const left = expressionType(node.left);
+      const right = node.right.kind === "value" ? undefined : expressionType(node.right);
+      if (left !== undefined && right !== undefined && identity({ result: left }) !== identity({ result: right }))
+        issue({ rule: "predicate-type-mismatch", message: "comparison operands must have the same logical type" });
+      if (node.right.kind === "value" && left !== undefined)
+        literal({ value: node.right, result: left });
+    } else if (node.kind === "inList") {
+      const result = expressionType(node.field);
+      if (result !== undefined)
+        for (const value of node.values)
+          literal({ value, result });
     } else if (node.kind === "and" || node.kind === "or")
       node.operands.forEach(validateComputedComparisons);
     else if (node.kind === "not" || node.kind === "isTrue")
@@ -2453,8 +4012,8 @@ function validatePredicateFields(params) {
       continue;
     }
     const referenced = model.fields.find((field) => field.name === name);
-    if (inspection.checkOnly && referenced?.isUnsupported === true)
-      issues.push({ rule: "predicate-unsupported-type", message: `${site}: computed predicates cannot reference unsupported fields`, model: model.name, field: name });
+    if (referenced?.isUnsupported === true)
+      issues.push({ rule: "predicate-unsupported-type", message: `${site}: predicates cannot reference unsupported fields`, model: model.name, field: name });
     if (referenced?.isList === true) {
       issues.push({
         rule: "predicate-list-field",
@@ -2465,9 +4024,49 @@ function validatePredicateFields(params) {
     }
   }
 }
+function assertMysqlCheckReferentialActions(params) {
+  const views = new Set(params.schema.models.filter((model) => model.isView).map((model) => model.name));
+  for (const model of params.schema.models) {
+    const typed = (model.checks ?? []).filter((check) => check.predicate !== undefined);
+    if (typed.length === 0)
+      continue;
+    for (const relation of model.relations) {
+      const columns = relation.fields;
+      if (columns === undefined || columns.length === 0 || views.has(relation.targetModel))
+        continue;
+      const { onDelete, onUpdate } = resolveReferentialActions({ relation, field: (name) => model.fields.find((field) => field.name === name) });
+      const writes = (action) => action === "Cascade" || action === "SetNull" || action === "SetDefault";
+      if (!writes(onUpdate) && onDelete !== "SetNull" && onDelete !== "SetDefault")
+        continue;
+      for (const check of typed) {
+        const column = predicateFieldNames({ predicate: check.predicate }).find((name) => columns.includes(name));
+        if (column === undefined)
+          continue;
+        const error = unsupportedCapability({
+          dialect: "mysql",
+          feature: "CHECK constraint on a foreign-key column that a referential action writes",
+          hint: `CHECK "${check.name}" reads "${model.name}.${column}", which relation "${model.name}.${relation.name}" writes through ON DELETE ${onDelete} / ON UPDATE ${onUpdate}; MySQL refuses this (error 3823). Declare onUpdate "NoAction" (or "Restrict") and an onDelete of "Restrict", "NoAction" or "Cascade" on the relation, or remove the CHECK`
+        });
+        throw new VibeError({ code: error.code, message: error.message, meta: { ...error.meta, model: model.name, check: check.name, field: column, relation: relation.name, onDelete, onUpdate } });
+      }
+    }
+  }
+}
 function assertValidSchemaIR(params) {
+  const rowRules = createRowRuleValidationContext(params);
   const dialect = providerToDialect({ provider: params.schema.datasource.provider });
+  assertIndexExpressions({ schema: params.schema, dialect });
+  assertGeneratedColumns({ schema: params.schema, dialect });
   assertNativeRlsAdmission({ schema: params.schema, dialect });
+  for (const model of params.schema.models) {
+    const rule = model.rls;
+    if (rule === undefined || rule === null || typeof rule !== "object" || !("where" in rule) || rule.where === null || typeof rule.where !== "object")
+      continue;
+    for (const field of model.fields) {
+      if (Object.hasOwn(rule.where, field.name) && isLocalDateField({ field }))
+        throw unsupportedCapability({ dialect, feature: "local-date native RLS ownership", hint: `${model.name}.${field.name} is a calendar day, not a supported RLS identity column` });
+    }
+  }
   assertExtensionPlacement({ schema: params.schema, dialect });
   assertIndexOperatorClasses({ schema: params.schema, dialect });
   for (const entry of [...params.schema.models, ...params.schema.enums])
@@ -2483,13 +4082,15 @@ function assertValidSchemaIR(params) {
       if (declared !== undefined && (declared.namespace ?? "public") !== enumType.namespace)
         throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Enum reference namespace differs from its declared native type", meta: { rule: "enum-namespace", model: model.name, field: field.name } });
     }
+  if (dialect === "mysql")
+    assertMysqlCheckReferentialActions({ schema: params.schema });
   for (const model of params.schema.models) {
     for (const check of model.checks ?? [])
       if (check.predicate !== undefined)
-        assertPredicateCapabilities({ predicate: check.predicate, dialect, usage: "check" });
+        assertPredicateCapabilities({ predicate: check.predicate, model, dialect, usage: "check" });
     for (const index of model.indexes)
       if (index.wherePredicate !== undefined)
-        assertPredicateCapabilities({ predicate: index.wherePredicate, dialect, usage: "indexPredicate" });
+        assertPredicateCapabilities({ predicate: index.wherePredicate, model, dialect, usage: "indexPredicate" });
     if (model.exclusions !== undefined && !Array.isArray(model.exclusions))
       throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Exclusions must be an array", meta: { rule: "exclusion-definition" } });
     if ((model.exclusions?.length ?? 0) === 0)
@@ -2504,7 +4105,7 @@ function assertValidSchemaIR(params) {
       const source = exclusion.source;
       if (source !== undefined) {
         if (source.where !== undefined)
-          assertPredicateCapabilities({ predicate: source.where, dialect, usage: "exclusionPredicate" });
+          assertPredicateCapabilities({ predicate: source.where, model, dialect, usage: "exclusionPredicate" });
         const references = [...source.keys.flatMap((key) => ("field" in key) ? [key.field] : key.fields), ...[source.range.lower, source.range.upper].flatMap((endpoint) => ("field" in endpoint) ? [endpoint.field] : []), ...source.where === undefined ? [] : predicateFieldNames({ predicate: source.where })];
         if (references.some((name) => !model.fields.some((field) => field.name === name && !field.isList)))
           throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: "Exclusion references an unknown or list field", meta: { rule: "exclusion-field", model: model.name } });
@@ -2521,6 +4122,13 @@ function assertValidSchemaIR(params) {
     if (dialect === "mysql" && counters.length > 1)
       throw unsupportedCapability({ dialect, feature: "multiple auto-increment columns" });
     for (const field of model.fields) {
+      if (isLocalDateField({ field })) {
+        if (!DIALECT_CAPABILITIES[dialect].localDateColumns)
+          throw unsupportedCapability({ dialect, feature: "localDateColumns", hint: `${model.name}.${field.name}` });
+        if (field.isList || field.isUpdatedAt || field.default !== undefined && (field.default.kind !== "literal" || !isCanonicalLocalDate({ value: field.default.value }))) {
+          throw new VibeError({ code: "VIBE_SCHEMA_INVALID", message: `Local-date field ${model.name}.${field.name} requires a scalar calendar day and an optional canonical YYYY-MM-DD literal default; lists, @updatedAt and generated defaults are not supported`, meta: { issues: [{ rule: "local-date-declaration", model: model.name, field: field.name }] } });
+        }
+      }
       const timeOfDay = field.isUnsupported === true || field.type !== "DateTime" ? undefined : timeOfDayType({ nativeType: field.nativeType });
       if (timeOfDay !== undefined && !DIALECT_CAPABILITIES[dialect].timeOfDayTypes.includes(timeOfDay)) {
         const instead = dialect === "sqlite" ? "sqlite has no time-of-day column type; store a plain DateTime or a String" : "there is no time-with-offset type here; use @db.Time(n), which stores the UTC time of day";
@@ -2555,11 +4163,14 @@ function assertValidSchemaIR(params) {
       const pk = model.primaryKey?.fields ?? model.fields.filter((entry) => entry.isId).map((entry) => entry.name);
       if (dialect === "sqlite" && (pk.length !== 1 || pk[0] !== field.name))
         throw unsupportedCapability({ dialect, feature: `non-primary auto-increment column ${model.name}.${field.name}` });
-      if (dialect === "mysql" && pk[0] !== field.name && !field.isUnique && !model.indexes.some((index) => index.fields[0]?.name === field.name))
+      if (dialect === "mysql" && pk[0] !== field.name && !field.isUnique && !model.indexes.some((index) => {
+        const first = indexKeyTerms({ index })[0];
+        return first?.kind === "field" && first.field.name === field.name;
+      }))
         throw unsupportedCapability({ dialect, feature: `unindexed auto-increment column ${model.name}.${field.name}` });
     }
   }
-  const issues = validateSchemaIR(params);
+  const issues = validateSchemaWithRowRules({ ...params, rowRules });
   if (issues.length > 0) {
     throw new VibeError({
       code: "VIBE_SCHEMA_INVALID",
@@ -2567,6 +4178,12 @@ function assertValidSchemaIR(params) {
       meta: { issues }
     });
   }
+  for (const model of params.schema.models)
+    for (const rule of model.rowRules ?? []) {
+      assertRowRuleCapability({ dialect, model: model.name, rule });
+      rowRules.assertEquality({ model, rule });
+    }
+  assertRowRuleReferentialActions(params);
 }
 function rlsRecord(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value) && (Object.getPrototypeOf(value) === Object.prototype || Object.getPrototypeOf(value) === null) && Reflect.ownKeys(value).every((key) => {
@@ -2680,7 +4297,7 @@ function validateNativeRls(params) {
         const field = model.fields.find((f) => f.name === fieldName);
         if (field === undefined) {
           add({ rule: "rls-unknown-field", message: `Native RLS requires a direct scalar field, not path ${String(fieldName)}` });
-        } else if (field.isList || field.isUnsupported || isEnumType(field.type) || field.type === "Json" || field.type === "Bytes") {
+        } else if (field.isList || field.isUnsupported || isLocalDateField({ field }) || isEnumType(field.type) || field.type === "Json" || field.type === "Bytes") {
           add({ rule: "rls-unsupported-field", message: "Native RLS ownership requires a supported non-list scalar", field: field.name });
         } else if (context !== undefined) {
           const slot = Object.hasOwn(context, ref.context) ? context[ref.context] : undefined;
@@ -2734,22 +4351,25 @@ function validRlsForeignKey(params) {
   const validFields = fields.every((name, index) => {
     const field = model.fields.find((f) => f.name === name);
     const ref = target.fields.find((f) => f.name === refs[index]);
-    return field !== undefined && ref !== undefined && !field.isList && !ref.isList && !field.isUnsupported && !ref.isUnsupported && (field.type === ref.type || isEnumType(field.type) && isEnumType(ref.type) && field.type.enum === ref.type.enum);
+    return field !== undefined && ref !== undefined && !field.isList && !ref.isList && !field.isUnsupported && !ref.isUnsupported && fieldTypeIdentity(field) === fieldTypeIdentity(ref);
   });
   const uniqueSets = [
     ...target.fields.filter((f) => f.isId || f.isUnique).map((f) => [f.name]),
     ...target.primaryKey === undefined ? [] : [target.primaryKey.fields],
-    ...target.indexes.filter((index) => index.kind === "unique" && index.where === undefined).map((index) => index.fields.map((f) => f.name))
+    ...target.indexes.filter((index) => index.kind === "unique" && !isExpressionIndex({ index }) && index.where === undefined).map((index) => index.fields.map((f) => f.name))
   ];
   return validFields && uniqueSets.some((set) => set.length === refs.length && set.every((name) => refs.includes(name)));
 }
 export {
+  CHECK_RULE_GROUP_MAX,
   DIALECTS,
   DIALECT_CAPABILITIES,
   EMPTY_EXTENSION_REGISTRY,
   ENUM_STORAGES,
   IDENTIFIER_LIMITS,
   MYSQL_CAPABILITIES,
+  MYSQL_FUNCTIONAL_KEY_LIMITS,
+  MYSQL_ROW_RULE_MESSAGE_MAX_BYTES,
   POSTGRES_CAPABILITIES,
   PREDICATE_COMPARISON_OPS,
   READ_ONLY_REFUSAL_REASONS,
@@ -2761,26 +4381,37 @@ export {
   RlsContextError,
   SCOPED_REFUSAL_REASONS,
   SQLITE_CAPABILITIES,
+  SQLITE_ROW_RULE_ERROR_PREFIX,
   SQL_NAMESPACES,
   ScopedQueryError,
   VIBE_ERROR_CODES,
   VibeError,
   assertExtensionModelPlacement,
   assertExtensionPlacement,
+  assertGeneratedColumn,
+  assertGeneratedColumns,
   assertIdentifierFits,
+  assertIndexExpressions,
   assertIndexOperatorClasses,
   assertJsonSchemaRef,
   assertMigrationObjects,
   assertNativeRlsAdmission,
   assertPredicateCapabilities,
+  assertRowRuleCapability,
+  assertRowRuleEquality,
+  assertRowRuleReferentialActions,
   assertSqlNamespace,
   assertValidSchemaIR,
+  assertValidatorRef,
   buildComputedManifest,
   buildExtensionRegistry,
+  checkRulePredicate,
   decodePrismaString,
+  defaultExpressionIndexName,
   defaultForeignKeyName,
   defaultIndexName,
   defaultPrimaryKeyName,
+  defaultRowRuleName,
   defineExtension,
   encodePrismaString,
   enumStorageOf,
@@ -2791,15 +4422,27 @@ export {
   extensionOptionsHash,
   fieldTypeIdentity,
   fitDefaultName,
+  generatedColumnFromSql,
+  generatedColumnShapeIssue,
   hasJsonSchemaAnnotation,
+  hasValidatorAnnotation,
   identifierLength,
   implicitJoinTable,
   implicitJoinTableObjectNames,
+  indexKeyDefinitionKey,
+  indexKeyDsl,
+  indexKeyFieldNames,
+  indexKeyPrisma,
+  indexKeyTerms,
   inspectPredicate,
+  inspectPredicateExpression,
   internalError,
   invalidStoredData,
+  isCanonicalLocalDate,
   isEnumType,
+  isExpressionIndex,
   isImplicitManyToManyRelation,
+  isLocalDateField,
   isPredicateFieldRef,
   isReservedClientName,
   isReservedDelegateName,
@@ -2808,25 +4451,49 @@ export {
   jsonSchemaRefIssue,
   jsonTypeAnnotationIssue,
   jsonTypeAnnotationRef,
+  localDateCheckName,
   mergeExtensionDeclarations,
   modelSqlNamespace,
+  mysqlIndexKeyWidth,
+  mysqlRowRuleMessageByteLength,
   normalizeJsonSchemaRef,
+  normalizeRowRules,
+  normalizeValidatorRef,
   postgresGeneratedObjectName,
+  predicateCapabilityIssue,
   predicateFieldNames,
   predicateKey,
   prepareDatabaseModuleSchema,
   providerToDialect,
   qualifiedSqlName,
+  resolveOnDelete,
+  resolveOnUpdate,
+  resolveReferentialActions,
+  rowRuleCapability,
+  rowRuleGateField,
+  rowRuleGeneratedFields,
+  rowRuleIdentities,
+  rowRuleObjectNames,
+  rowRulePrismaAttribute,
+  rowRuleProtectedFields,
+  rowRuleShapeIssue,
+  rowRuleTriggerName,
   scalarListDefault,
+  schemaRowRuleIdentities,
   serializeJsonDefault,
   sqlNamespaceIssue,
   sqlObjectKey,
   sqlObjectNamespace,
+  sqliteRowRuleConstraint,
   timeOfDayType,
   unsupportedCapability,
   validateComputedConfig,
+  validateGeneratedColumns,
+  validateIndexExpressions,
   validateRlsContextIR,
-  validateSchemaIR
+  validateRowRules,
+  validateSchemaIR,
+  validatorRefIssue
 };
 
-//# debugId=315C4C10E208512464756E2164756E21
+//# debugId=2B926380FFCA323B64756E2164756E21