gemi 0.91.1 → 0.93.0

package/dist/chunk-6y62ccam.js.map

@@ -1,10 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../orm/context.ts"],
-  "sourcesContent": [
-    "import type { SQL, TransactionSQL } from \"bun\";\nimport { AsyncLocalStorage } from \"node:async_hooks\";\nimport { SLOW_TRANSACTION_THRESHOLD } from \"../database/config\";\nimport {\n  CrossConnectionTransactionError,\n  DEFAULT_CONNECTION,\n} from \"../database/Connection\";\n\n/**\n * The ambient transaction: the ORM's own `AsyncLocalStorage`, holding nothing\n * but the open handle and how deep the nesting is.\n *\n * One store per scope with one owner, which is the pattern the framework\n * already follows — `kernel/context.ts` holds the Application,\n * `http/requestContext.ts` the request and its user. The reasoning for\n * not folding this into the kernel's is written up beside it, and the short\n * version is that a transaction scope has to *nest inside* an Application scope\n * without replacing it, and `foundation/app.ts` must keep reading exactly one\n * shape out of the kernel store or resolving a service becomes a transaction\n * concern.\n *\n * What makes an ALS the right home rather than a field somewhere: two concurrent\n * requests each in their own transaction must never see each other's handle.\n * Anything reachable from the Application — which is one object shared by every\n * in-flight request — fails that by construction, and fails it as silently\n * written data, not as an error. \"two concurrent transactions never see each\n * other's handle\" in `context.test.ts` is the test that would catch it.\n */\nexport interface OrmScope {\n  /**\n   * Bun's transaction handle. Every ORM statement in scope runs on it, which\n   * means they all run on one reserved connection — so nothing here may issue\n   * two statements concurrently. `Model.$exec` already runs its nested writes\n   * and its relation reads sequentially, for exactly this reason.\n   */\n  tx?: TransactionSQL;\n  /** 0 for the outermost transaction, 1+ for each savepoint inside it. */\n  depth: number;\n  /**\n   * Which named connection this subtree's queries run on, and — when `tx` is\n   * set — which connection the open transaction belongs to.\n   *\n   * Ambient rather than an argument threaded through `$exec`, for the same\n   * reason the handle above is: a relation read resolves its target through the\n   * registry and calls that class's `$exec`, so an argument would have to be\n   * carried by every intermediate that has no interest in it, and the one that\n   * forgot would silently read a nested `include` off the *other* pool. There\n   * is no error that shape produces; there are just rows from the wrong place.\n   *\n   * `undefined` means the default connection. Kept as absent-rather-than-\n   * `\"default\"` so that entering a scope on the default connection is\n   * indistinguishable from not entering one, which is what makes the\n   * cross-connection check below cost a comparison of two `undefined`s on every\n   * application that never declares a second connection.\n   */\n  connection?: string;\n  /**\n   * Whether policies are suspended for this scope. Set only by\n   * `Model.asSystem`, and never by anything ambient — the whole point is that\n   * unscoped access is a decision visible at the call site, not the accidental\n   * result of a missing user.\n   */\n  system?: boolean;\n  /**\n   * The user policies should scope to, when there is no request to read one\n   * from. Set only by `Model.asUser`.\n   *\n   * A sentinel wrapper rather than the bare value, so that \"a scope was entered\n   * with `null`\" stays distinguishable from \"no scope was entered\" — the two\n   * mean different things under deny-by-default.\n   */\n  actor?: { user: unknown };\n  /**\n   * Work that must not happen unless this transaction commits — an event whose\n   * `static afterCommit` is set, today, and nothing else.\n   *\n   * **Created by the outermost `withTransaction` and never by a savepoint.** A\n   * savepoint's scope is a spread of its parent's (`{ ...current, tx: nested }`),\n   * so the array arrives here already shared by reference with the transaction\n   * that opened it — which is the behaviour wanted rather than a leak. A\n   * dispatch made inside a savepoint that commits, in a transaction that then\n   * rolls back, must not run: rolling back the outermost transaction discards\n   * the list whole, savepoint entries included, because nothing ever drains it.\n   *\n   * The inverse — a savepoint that rolls back under a transaction that commits\n   * — is the case sharing gets wrong on its own, and `withTransaction`'s\n   * savepoint branch is where it is put right.\n   *\n   * Absent, rather than an empty array, on every scope that is not a\n   * transaction: `runAsSystem`, `runAsUser` and `runOnConnection` spread\n   * whatever they are given, so \"there is a list here\" and \"there is an open\n   * transaction here\" have to stay the same question. `deferUntilCommit`\n   * answers `false` when either half is missing and the caller runs the work\n   * now, which is what keeps a hand-built scope carrying a `tx` — the shape\n   * tests write — from swallowing a dispatch into a list nothing drains.\n   */\n  afterCommit?: AfterCommitCallback[];\n  /**\n   * Statements written on `tx` that the commit must wait for and must not\n   * outlive — today, a job row the database queue driver wrote on the\n   * transaction (#563), and nothing else. See `commitDependsOn`.\n   *\n   * Created and shared exactly as `afterCommit` is, and truncated with it\n   * when a savepoint rolls back.\n   */\n  commitDependsOn?: Promise<unknown>[];\n}\n\n/**\n * Work deferred to a transaction's commit.\n *\n * Awaited when it is drained, and its rejection is caught there: a callback is\n * a side effect that the transaction is not waiting on and cannot be told\n * about, so the only thing left to do with a failure is report it.\n *\n * Not exported: a caller passes a lambda and never names this, and an export\n * nothing outside this file uses is what `orm/architecture.test.ts` is pointed\n * at. The declaration emit carries it along regardless, so `OrmScope` stays\n * readable from a `.d.ts`.\n */\ntype AfterCommitCallback = () => void | Promise<void>;\n\n/**\n * One ambient scope for the ORM, not one per feature.\n *\n * Transactions (iteration 5) and system access (iteration 6) are both\n * \"something is true for this async subtree and every query in it\", so they\n * share a store rather than minting a second `AsyncLocalStorage` each. The\n * inventory note in `kernel/context.ts` sets the bar for adding one; two\n * booleans-worth of ORM state does not clear it.\n */\nexport const ormContext = new AsyncLocalStorage<OrmScope>();\n\n/**\n * The open transaction, or `undefined` outside one. This is what `Model.$exec`\n * consults to decide which connection a statement runs on.\n *\n * Exported as the escape hatch for code that genuinely needs the handle — a raw\n * query that must join the surrounding transaction, say. **Do not store what it\n * returns.** Bun's handle stays callable after its `begin` resolves: queries on\n * it then run on the pooled connection, outside any transaction, and succeed.\n * Verified against both dialects, and it is the reason `Model.transaction`'s\n * callback takes no argument.\n */\nexport function currentTransaction(): TransactionSQL | undefined {\n  return ormContext.getStore()?.tx;\n}\n\n/**\n * The connection every query in this scope runs on unless it names another.\n *\n * `\"default\"` outside any scope, so callers get a name rather than a\n * `string | undefined` to normalise themselves — the store keeps it absent,\n * which is not the same distinction and is nobody else's business.\n */\nexport function currentConnectionName(): string {\n  return ormContext.getStore()?.connection ?? DEFAULT_CONNECTION;\n}\n\n/**\n * Run `fn` with `name` as the ambient connection.\n *\n * Merged into the current scope rather than replacing it, exactly as\n * `runAsSystem` and `runAsUser` are: naming a connection must not drop an open\n * transaction handle or re-enable policies underneath it.\n *\n * Deliberately absent from `orm/index.ts`, so it is not part of what an\n * application can reach — `Model.on(name)` and `DB.connection(name)` are the\n * two doors, and both funnel through here so that a nested relation read,\n * which resolves its own class out of the registry and calls its `$exec`,\n * inherits the connection without anything having to pass it along.\n */\nexport function runOnConnection<T>(\n  name: string,\n  fn: () => Promise<T>,\n): Promise<T> {\n  const current = ormContext.getStore();\n  if (currentConnectionName() === name) return fn();\n\n  // ENTERING A CONNECTION IS WHERE THE CROSS-CONNECTION CHECK BELONGS, not at\n  // each door — and it has to be *here*, before the scope is entered, because\n  // entering it is what makes the check impossible afterwards.\n  //\n  // The scope carries `tx` and `connection` together, so overwriting the name\n  // while an open handle stays in place produces a store that says \"a\n  // transaction on analytics\" while holding the *default* connection's handle.\n  // Every check downstream then agrees with itself and the statement runs on\n  // the wrong connection's transaction. `Model.save` found this: it routes to\n  // the row's own connection, so it is the one caller that switches connections\n  // with a transaction already open.\n  assertConnectionUsable(name);\n\n  return ormContext.run(\n    {\n      ...current,\n      depth: current?.depth ?? 0,\n      connection: name === DEFAULT_CONNECTION ? undefined : name,\n    },\n    fn,\n  );\n}\n\n/**\n * Refuse a statement that names one connection while a transaction is open on\n * another.\n *\n * The check `withTransaction`'s single-connection note asked for, and the\n * reasoning for refusing rather than routing is on\n * `CrossConnectionTransactionError`. Both doors call it — `Model.$exec` for\n * every model operation, `DB` for a raw fragment — because either one alone\n * leaves the other free to straddle the two connections, and a raw `DB.execute`\n * escaping a transaction is the more damaging of the two.\n *\n * Only ever fires on a query that *names* a connection: an unqualified one\n * resolves to the ambient name, which is the transaction's own.\n */\nexport function assertConnectionUsable(name: string): void {\n  const store = ormContext.getStore();\n  if (store?.tx === undefined) return;\n\n  const open = store.connection ?? DEFAULT_CONNECTION;\n  if (open === name) return;\n\n  throw new CrossConnectionTransactionError(open, name);\n}\n\n/**\n * Hold `callback` until the open transaction commits, and say whether that\n * happened.\n *\n * `false` means there was nothing to wait for — no transaction is open, or the\n * scope was entered by hand rather than by `withTransaction` — and the caller\n * must run the work itself, now. That return value is the whole contract: a\n * caller that ignores it turns \"no transaction here\" into a side effect queued\n * on a list nothing will ever drain, which is a dispatch that silently never\n * happens.\n *\n * `true` means the callback is on the outermost scope's list and will run after\n * `begin` resolves, outside the transaction, whatever the caller does next. It\n * will not run at all if the transaction rolls back, or if a savepoint it was\n * registered inside rolls back — both of which are the point.\n *\n * Nothing here is ordered against anything but the other deferred callbacks:\n * they run in registration order, one at a time, after the commit round-trip.\n */\nexport function deferUntilCommit(callback: AfterCommitCallback): boolean {\n  const store = ormContext.getStore();\n  if (store?.tx === undefined || store.afterCommit === undefined) return false;\n\n  store.afterCommit.push(callback);\n  return true;\n}\n\n/**\n * Make the open transaction's commit depend on `write`, a statement issued on\n * its handle: the transaction does not commit until `write` settles, and\n * rolls back — rejecting with `TransactionDependencyError` — if it rejected.\n *\n * For a write the caller may not await. A queued listener's dispatch never is\n * (`EventManager` pushes it and moves on), and on Postgres a statement that\n * fails aborts the whole transaction: every statement after it is refused and\n * Bun's `COMMIT` quietly becomes a rollback. Without this, the callback's\n * promise resolved, `begin` resolved, and the rows the caller wrote were gone\n * with nothing to say so. MySQL does not abort on a failed statement, and is\n * failed here anyway, so that a joined write means the same thing on both:\n * it commits with the transaction or the transaction does not commit.\n *\n * `false` when there is no transaction to depend on, as for\n * `deferUntilCommit`.\n */\nexport function commitDependsOn(write: Promise<unknown>): boolean {\n  const store = ormContext.getStore();\n  if (store?.tx === undefined || store.commitDependsOn === undefined) {\n    return false;\n  }\n  store.commitDependsOn.push(write);\n  return true;\n}\n\n/**\n * A write the transaction's commit depended on failed, so the transaction —\n * or the savepoint the write was made in — rolled back. `cause` is the write's\n * own error.\n */\nexport class TransactionDependencyError extends Error {\n  constructor(cause: unknown) {\n    super(\n      `A statement this transaction depended on failed after being issued on ` +\n        `it, so the transaction rolled back instead of committing: ` +\n        `${cause instanceof Error ? cause.message : String(cause)}`,\n      { cause },\n    );\n    this.name = \"TransactionDependencyError\";\n  }\n}\n\n/**\n * Wait for the writes registered from `mark` on, and throw if one failed.\n *\n * Called at the end of a transaction's or savepoint's callback, *inside*\n * `begin`/`savepoint`, so a throw is what makes Bun roll back rather than\n * commit — after `begin` has resolved it is too late to do anything but\n * report. Every write is settled before throwing, so none is still running on\n * the handle when the rollback is issued.\n */\nasync function awaitDependencies(\n  writes: Promise<unknown>[],\n  mark: number,\n): Promise<void> {\n  if (writes.length === mark) return;\n  const settled = await Promise.allSettled(writes.slice(mark));\n  const failed = settled.find(\n    (outcome): outcome is PromiseRejectedResult => outcome.status === \"rejected\",\n  );\n  if (failed) throw new TransactionDependencyError(failed.reason);\n}\n\n/** How deeply nested the current transaction is; `null` outside one. */\nexport function transactionDepth(): number | null {\n  const store = ormContext.getStore();\n  return store?.tx === undefined ? null : store.depth;\n}\n\n/** Whether policies are suspended for the current async scope. */\nexport function isSystemScope(): boolean {\n  return ormContext.getStore()?.system === true;\n}\n\n/**\n * Run `fn` with policies suspended.\n *\n * The escape hatch the deny-by-default rule needs to be usable: a cron tick, a\n * queue worker or a seed script has no user, and under deny-by-default every\n * policied model would refuse it. This makes that intent explicit *at the call\n * site*, which is the property that matters — unscoped access must never be\n * what happens when a user simply fails to turn up.\n *\n * It nests inside a transaction and a transaction nests inside it: the scope is\n * merged rather than replaced, so `asSystem` does not silently drop an open\n * handle.\n */\nexport function runAsSystem<T>(fn: () => Promise<T>): Promise<T> {\n  const current = ormContext.getStore();\n  return ormContext.run({ ...current, depth: current?.depth ?? 0, system: true }, fn);\n}\n\n/** The explicitly-set actor, or `undefined` when none was. */\nexport function currentActor(): { user: unknown } | undefined {\n  return ormContext.getStore()?.actor;\n}\n\n/**\n * Run `fn` with policies scoped to `user`, for code with no request to read one\n * from.\n *\n * The counterpart to `runAsSystem`, and the reason that one is not the only\n * escape hatch. A queue worker processing \"send the invoice for organisation 7\"\n * genuinely acts *as somebody*; giving it `asSystem` would suspend policies\n * entirely and leave it hand-scoping every query — which is precisely the\n * unscoped-by-accident failure the deny-by-default rule exists to prevent. The\n * narrow tool should be the easy one.\n *\n * It is also what makes policies testable without reaching into\n * `RequestContext`'s internals.\n *\n * Takes precedence over the request store, so a job that says who it is acting\n * as is not quietly overridden by an ambient request that happens to enclose it.\n *\n * It also **clears `system`**, which is the more surprising half. Acting as a\n * user is strictly narrower than acting as the system, so naming one inside an\n * `asSystem` block has to narrow back — and the spread would otherwise carry\n * `system: true` forward, leaving `$exec` to skip policies entirely while\n * `currentUser()` cheerfully returned the actor. Silently unscoped, from the\n * realistic shape: a worker enters `asSystem` to read its job queue, then\n * narrows to the job's owner for the work itself. The reverse nesting —\n * `asSystem` inside `asUser` — suspends policies, which is what it should do.\n */\nexport function runAsUser<T>(user: unknown, fn: () => Promise<T>): Promise<T> {\n  const current = ormContext.getStore();\n  return ormContext.run(\n    {\n      ...current,\n      depth: current?.depth ?? 0,\n      system: false,\n      actor: { user: user ?? null },\n    },\n    fn,\n  );\n}\n\n/**\n * The warning threshold in milliseconds, or `null` when the warning is off.\n *\n * `configured` is `database.slowTransactionThreshold` — see `DatabaseConfig`.\n * It arrives as a value rather than being read from here so that this file\n * keeps knowing nothing about the container: `withTransaction` is reachable\n * with a bare pool, and its tests use one.\n *\n * Exported for its own tests. The behaviour worth pinning is the fallback —\n * that a malformed threshold lands on the default rather than disabling — and\n * that cannot be observed through `withTransaction`: \"no warning fired\" is what\n * a disabled warning looks like too, so a behavioural test of it passes just as\n * happily when the fallback is gone. Asserting the number directly is the only\n * form of that test that can fail.\n */\nexport function slowTransactionThreshold(\n  configured?: number | false,\n): number | null {\n  // Read per call, never cached at module scope. `scripts/build.ts` rewrites\n  // `process.env.NODE_ENV` to `Bun.env.NODE_ENV` precisely so mode stays a\n  // runtime question in the built framework; caching it here would undo that.\n  if (process.env.NODE_ENV !== \"development\") return null;\n\n  // The one way to switch it off, and it has to be spelled. Everything else\n  // falls back, so the warning is never lost to a mistyped value — only to an\n  // explicit `false`.\n  if (configured === false) return null;\n\n  if (configured === undefined) return SLOW_TRANSACTION_THRESHOLD;\n  if (!Number.isFinite(configured) || configured <= 0) {\n    return SLOW_TRANSACTION_THRESHOLD;\n  }\n  return configured;\n}\n\n/**\n * Warn, in development only, about a transaction that has been open too long.\n *\n * The risk is structural rather than occasional: an open transaction holds one\n * reserved connection for as long as its callback runs, and nothing about\n * `Model.transaction(async () => { ... })` stops that callback from awaiting a\n * `fetch`, an S3 upload or a slow queue push. Under concurrency that drains the\n * pool, and the symptom — every unrelated query in the process blocking on\n * connection acquisition — names neither the callback nor the I/O in it.\n *\n * A timer rather than measuring elapsed time on the way out, for one reason:\n * the worst case is the transaction that *never* settles (a hung request, a\n * lock wait, a deadlock). After-the-fact measurement is silent for exactly that\n * case; a timer fires while it is still open and still holding the connection.\n *\n * The `Error` is constructed up front and read only if the timer fires — V8\n * formats `.stack` lazily on first access, so an ordinary fast transaction pays\n * for an object allocation and nothing else.\n *\n * The clock starts at the `begin` call, not at the moment a connection is\n * acquired, and stops when `begin` settles rather than when the callback\n * returns — so it spans the pool wait and the commit round-trip as well as the\n * callback. That is deliberate: all three are time this transaction is in\n * flight, and a warning that only covered the callback would stay silent for a\n * transaction stuck waiting on an exhausted pool, which is the exact situation\n * a long transaction elsewhere creates. Hence \"not settled\" rather than \"open\n * for\" — the message must not claim a connection was held for the whole span.\n */\nfunction watchForSlowTransaction(configured?: number | false): () => void {\n  const threshold = slowTransactionThreshold(configured);\n  if (threshold === null) return () => {};\n\n  const site = new Error(\"transaction opened here\");\n\n  const timer = setTimeout(() => {\n    const stack = site.stack?.split(\"\\n\").slice(1).join(\"\\n\") ?? \"\";\n    console.warn(\n      `[gemi] A database transaction has not settled after ${threshold}ms. It ` +\n        `reserves a pooled connection until it does — check for network or ` +\n        `filesystem I/O inside the callback, and move it outside the ` +\n        `transaction if you find any.\\n${stack}\\n` +\n        `(development only; set database.slowTransactionThreshold to change ` +\n        `the threshold, or false to switch this off)`,\n    );\n  }, threshold);\n\n  // Otherwise the warning timer is itself a reason the process stays alive,\n  // which would turn a diagnostic into a hang in short-lived commands and\n  // scripts.\n  timer.unref?.();\n\n  return () => clearTimeout(timer);\n}\n\n/**\n * Runs what a committed transaction deferred, outside the transaction it was\n * deferred by.\n *\n * `outside` is the scope that was ambient before `begin` — an `asSystem` block,\n * a named connection, or nothing at all — and re-entering it explicitly is the\n * guarantee rather than a tidy-up. The alternative is relying on where a `.then`\n * happens to have captured its context, and the failure that produces is the\n * one the whole feature is about: a listener that runs \"after commit\" while\n * still holding the closed transaction's handle joins nothing, because Bun's\n * handle stays callable and simply runs on the pool. So the scope is rebuilt\n * with `tx` and the drained list cleared, and a listener that opens its own\n * transaction gets a real one.\n *\n * Errors are caught per callback and the next one still runs, for the reason\n * the event subsystem catches per listener: these are independent side effects\n * whose order came from a filesystem walk. And the transaction is not failed by\n * one — it committed, the database kept the rows, and reporting a rejection to\n * the caller would have it roll back or retry work that is already durable.\n * stderr is all that is left, and it is enough: the caller has no decision to\n * make here.\n *\n * The transaction's own promise does not resolve until this has finished, which\n * is the one thing about `afterCommit` that a caller can feel. Deliberate: the\n * alternative is a floating promise whose rejection nobody sees and whose work\n * a short-lived process — a command, a seed — exits out from under.\n */\nasync function drainAfterCommit(\n  callbacks: AfterCommitCallback[],\n  outside: OrmScope | undefined,\n): Promise<void> {\n  if (callbacks.length === 0) return;\n\n  await ormContext.run(\n    {\n      ...outside,\n      tx: undefined,\n      afterCommit: undefined,\n      commitDependsOn: undefined,\n      depth: outside?.depth ?? 0,\n    },\n    async () => {\n      for (const callback of callbacks) {\n        try {\n          await callback();\n        } catch (error) {\n          console.error(\n            `An after-commit callback threw. The transaction it was waiting ` +\n              `on had already committed and stays committed, and the ` +\n              `callbacks after it still ran.`,\n            error,\n          );\n        }\n      }\n    },\n  );\n}\n\n/**\n * Run `fn` inside a transaction, entering the ambient scope for its whole async\n * subtree.\n *\n * The single implementation behind both `Model.transaction` and\n * `DB.transaction`, so the two cannot become transaction systems that ignore\n * each other: a `Model.create` inside a `DB.transaction` joins it, and a raw\n * `DB.sql` inside a `Model.transaction` can join it through\n * `currentTransaction()`.\n *\n * Nesting becomes a savepoint. Not a preference — Bun refuses the alternative\n * outright (`cannot call begin inside a transaction use savepoint() instead`),\n * and a savepoint is the semantics worth having anyway: an inner failure rolls\n * back to it and leaves the outer transaction usable, which a caller that\n * catches can rely on. Verified on SQLite and Postgres.\n *\n * Note Bun hands the savepoint callback the *same* handle object as the outer\n * transaction (`sp === tx`), so the depth counter is the only thing that\n * actually changes on the way in. The callback's argument is still what gets\n * stored, so this keeps working if that ever stops being true. The cast is\n * because Bun types a savepoint handle as plain `SQL` — without `savepoint` on\n * it — while the runtime object does carry the method, which is what makes\n * three levels of nesting work.\n *\n * Anything `deferUntilCommit` queued is drained once `begin` resolves, outside\n * the transaction and only on the outermost call — a savepoint has committed\n * nothing durable, so draining there would run work that a later rollback of\n * the enclosing transaction was meant to have prevented. See `drainAfterCommit`\n * for what that costs the caller.\n *\n * In development, an outermost transaction that stays open past\n * `options.slowTransactionThreshold` (2s by default, `false` to disable) warns\n * — see `watchForSlowTransaction`. Nothing here *prevents* a long transaction;\n * the warning exists because the cost of one is paid by unrelated queries\n * elsewhere in the process, which makes it hard to trace back.\n *\n * The threshold is passed in rather than read from `app(DatabaseManager)` here.\n * Every caller already holds the manager — it is where `pool` came from — and\n * taking it as an argument keeps this file free of the container, so a bare\n * `SQL` is still enough to call it. Its tests rely on that.\n *\n * `options.connection` is the name `pool` belongs to, and follows the same rule\n * for the same reason: the pool cannot be asked what it is called. Passing it\n * is what lets a nested `withTransaction` tell \"the same connection, so take a\n * savepoint\" from \"a different one, so refuse\" — omitting it means the default\n * connection, which is what a two-argument call always meant.\n *\n * The return type is asserted rather than inferred for one reason worth\n * knowing: Bun's `begin` unwraps a callback that resolves to an *array of\n * promises*, awaiting each. So `Model.transaction(async () => [a, b])` where\n * `a` and `b` are promises resolves to their values, not to the promises. That\n * is Bun's behaviour and is left alone; it is only surprising if unmentioned.\n */\nexport function withTransaction<T>(\n  pool: SQL,\n  fn: (tx: TransactionSQL) => Promise<T>,\n  options?: { slowTransactionThreshold?: number | false; connection?: string },\n): Promise<T> {\n  const current = ormContext.getStore();\n\n  // THE SINGLE-CONNECTION ASSUMPTION, WHICH IS NOW CHECKED RATHER THAN PINNED.\n  //\n  // The savepoint branch below ignores `pool` entirely. That was correct while\n  // there was one `DatabaseManager` and one `SQL` — the ambient handle and\n  // whatever pool the caller passed were necessarily the same database — and\n  // the note that stood here said what would happen when a second connection\n  // became configurable (#327): a `DB.transaction` on B inside a\n  // `Model.transaction` on A would savepoint on **A** and hand the callback A's\n  // handle, so statements landed in the wrong database with no error at all.\n  //\n  // So the name is compared before the branch is taken, and a mismatch raises.\n  // Refusing is the whole answer rather than half of one — there is no way to\n  // make one transaction span two pools, and the alternatives are covered on\n  // `CrossConnectionTransactionError`.\n  //\n  // A caller that passes no `connection` is treated as naming the default,\n  // which is what `withTransaction(pool, fn)` meant before this argument\n  // existed.\n  const name = options?.connection ?? DEFAULT_CONNECTION;\n  assertConnectionUsable(name);\n\n  // `current?.tx` rather than `current`: since iteration 6 a scope can exist\n  // with no open transaction — `Model.asSystem` enters one — and a savepoint\n  // needs an actual handle, not merely a store.\n  if (current?.tx) {\n    // WHERE THE SHARED AFTER-COMMIT LIST IS PUT RIGHT.\n    //\n    // The savepoint's scope is a spread of this one, so it appends to the\n    // transaction's list rather than to a list of its own — which is what makes\n    // \"the outer transaction rolled back, so nothing runs\" free. The case that\n    // is not free is this one: the savepoint rolls back and the transaction\n    // goes on to commit. Its entries have to go, or a dispatch made inside a\n    // block the database threw away runs anyway, which is the same wrong answer\n    // as before with an extra step.\n    //\n    // A mark on the way in and a truncate on the way out, rather than tagging\n    // each entry with its depth and dropping everything at or below the failing\n    // one. Depth cannot tell two *siblings* apart: a savepoint that committed\n    // and one that rolled back both left entries at the same depth, adjacent in\n    // the list, and dropping by depth would discard the committed sibling's\n    // work as well. The index is exact because the ORM issues one statement at\n    // a time on a transaction handle — see `OrmScope.tx` — so nothing appends\n    // between the mark and the failure but this savepoint's own subtree.\n    const deferred = current.afterCommit;\n    const mark = deferred?.length ?? 0;\n    // The same mark for the writes the commit depends on. The savepoint waits\n    // for its own before it releases, so one that failed rolls back only the\n    // savepoint — which a caller that catches can survive, exactly as it\n    // survives a statement that threw inside it — and is then forgotten\n    // rather than failing the transaction a second time.\n    const dependencies = current.commitDependsOn;\n    const dependencyMark = dependencies?.length ?? 0;\n\n    return current.tx\n      .savepoint((sp) => {\n        const nested = sp as TransactionSQL;\n        return ormContext.run(\n          { ...current, tx: nested, depth: current.depth + 1 },\n          async () => {\n            const result = await fn(nested);\n            if (dependencies) {\n              await awaitDependencies(dependencies, dependencyMark);\n            }\n            return result;\n          },\n        );\n      })\n      .catch((error: unknown) => {\n        if (deferred) deferred.length = mark;\n        if (dependencies) dependencies.length = dependencyMark;\n        throw error;\n      }) as Promise<T>;\n  }\n\n  // Only the outermost scope is watched. A savepoint reserves no connection of\n  // its own — its lifetime is bounded by the transaction it sits in, which is\n  // already being timed — so warning per depth would report one slow block as\n  // several warnings and point at the innermost frame rather than the one\n  // holding the connection.\n  const stopWatching = watchForSlowTransaction(\n    options?.slowTransactionThreshold,\n  );\n\n  // Built out here rather than inside the `begin` callback, because the drain\n  // below needs it *after* that callback's scope is gone, and reading it off\n  // the store then is exactly what is no longer possible.\n  const deferred: AfterCommitCallback[] = [];\n  const dependencies: Promise<unknown>[] = [];\n\n  // The `try` covers a *synchronous* throw from `begin` — a closed pool, say.\n  // `.finally` alone would not: it is only attached once `begin` has returned a\n  // promise, so a synchronous throw escapes with the timer still armed and\n  // eventually warns about a transaction that never opened. `unref` keeps that\n  // from holding the process, which makes it cosmetic rather than a leak, but\n  // it is the same gap the `.finally` below exists to close.\n  try {\n    // Spread rather than replace: a `Model.transaction` inside a\n    // `Model.asSystem` must not silently re-enable policies for its subtree.\n    //\n    // The connection goes into the scope alongside the handle, and the pair is\n    // what makes the check at the top of this function possible: \"which\n    // connection is this transaction on\" has to be answerable from the store,\n    // because the handle itself does not say. It is also what makes an\n    // unqualified query inside `DB.connection(\"analytics\").transaction(...)`\n    // *join* the transaction instead of being refused by it — the query\n    // inherits the name rather than defaulting to the hot path.\n    return (\n      pool\n        .begin((tx) =>\n          ormContext.run(\n            {\n              ...current,\n              tx,\n              depth: 0,\n              connection: name === DEFAULT_CONNECTION ? undefined : name,\n              // A fresh list per outermost transaction, assigned rather than\n              // left to the spread. `current` holds no list today — the drain\n              // clears the field before it runs anything — and assigning is\n              // what keeps that from being load-bearing: a transaction opened\n              // by a callback during a drain gets its own list either way,\n              // rather than appending to the array it is being run out of.\n              afterCommit: deferred,\n              commitDependsOn: dependencies,\n            },\n            async () => {\n              const result = await fn(tx);\n              await awaitDependencies(dependencies, 0);\n              return result;\n            },\n          ),\n        )\n        // `finally` and not a `then`/`catch` pair: the connection is released on\n        // rollback exactly as it is on commit, so a throwing callback must clear\n        // the timer too or every failed transaction leaves a warning armed\n        // against a connection that has already gone back to the pool.\n        //\n        // Before the drain, so that a slow after-commit listener is not\n        // reported as a transaction that will not settle. The connection went\n        // back to the pool at the commit; the warning is about holding it.\n        .finally(stopWatching)\n        // Only here, on the fulfilled path. A rejected `begin` rolled back, so\n        // the scope and everything queued on it are discarded unread — which is\n        // the whole of what `afterCommit` promises.\n        .then(async (result) => {\n          await drainAfterCommit(deferred, current);\n          return result;\n        }) as Promise<T>\n    );\n  } catch (error) {\n    stopWatching();\n    throw error;\n  }\n}\n"
-  ],
-  "mappings": ";yDACA,4BAAS,oBAkIF,IAAM,EAAa,IAAI,EAavB,SAAS,CAAkB,EAA+B,CAC/D,OAAO,EAAW,SAAS,GAAG,GAUzB,SAAS,CAAqB,EAAW,CAC9C,OAAO,EAAW,SAAS,GAAG,YAAc,EAgBvC,SAAS,CAAkB,CAChC,EACA,EACY,CACZ,IAAM,EAAU,EAAW,SAAS,EACpC,GAAI,EAAsB,IAAM,EAAM,OAAO,EAAG,EAehD,OAFA,EAAuB,CAAI,EAEpB,EAAW,IAChB,IACK,EACH,MAAO,GAAS,OAAS,EACzB,WAAY,IAAS,EAAqB,OAAY,CACxD,EACA,CACF,EAiBK,SAAS,CAAsB,CAAC,EAAoB,CACzD,IAAM,EAAQ,EAAW,SAAS,EAClC,GAAI,GAAO,KAAO,OAAW,OAE7B,IAAM,EAAO,EAAM,YAAc,EACjC,GAAI,IAAS,EAAM,OAEnB,MAAM,IAAI,EAAgC,EAAM,CAAI,EAsB/C,SAAS,CAAgB,CAAC,EAAwC,CACvE,IAAM,EAAQ,EAAW,SAAS,EAClC,GAAI,GAAO,KAAO,QAAa,EAAM,cAAgB,OAAW,MAAO,GAGvE,OADA,EAAM,YAAY,KAAK,CAAQ,EACxB,GAoBF,SAAS,CAAe,CAAC,EAAkC,CAChE,IAAM,EAAQ,EAAW,SAAS,EAClC,GAAI,GAAO,KAAO,QAAa,EAAM,kBAAoB,OACvD,MAAO,GAGT,OADA,EAAM,gBAAgB,KAAK,CAAK,EACzB,GAQF,MAAM,UAAmC,KAAM,CACpD,WAAW,CAAC,EAAgB,CAC1B,MACE,mIAEK,aAAiB,MAAQ,EAAM,QAAU,OAAO,CAAK,IAC1D,CAAE,OAAM,CACV,EACA,KAAK,KAAO,6BAEhB,CAWA,eAAe,CAAiB,CAC9B,EACA,EACe,CACf,GAAI,EAAO,SAAW,EAAM,OAE5B,IAAM,GADU,MAAM,QAAQ,WAAW,EAAO,MAAM,CAAI,CAAC,GACpC,KACrB,CAAC,IAA8C,EAAQ,SAAW,UACpE,EACA,GAAI,EAAQ,MAAM,IAAI,EAA2B,EAAO,MAAM,EAIzD,SAAS,CAAgB,EAAkB,CAChD,IAAM,EAAQ,EAAW,SAAS,EAClC,OAAO,GAAO,KAAO,OAAY,KAAO,EAAM,MAIzC,SAAS,CAAa,EAAY,CACvC,OAAO,EAAW,SAAS,GAAG,SAAW,GAgBpC,SAAS,CAAc,CAAC,EAAkC,CAC/D,IAAM,EAAU,EAAW,SAAS,EACpC,OAAO,EAAW,IAAI,IAAK,EAAS,MAAO,GAAS,OAAS,EAAG,OAAQ,EAAK,EAAG,CAAE,EAI7E,SAAS,CAAY,EAAkC,CAC5D,OAAO,EAAW,SAAS,GAAG,MA6BzB,SAAS,CAAY,CAAC,EAAe,EAAkC,CAC5E,IAAM,EAAU,EAAW,SAAS,EACpC,OAAO,EAAW,IAChB,IACK,EACH,MAAO,GAAS,OAAS,EACzB,OAAQ,GACR,MAAO,CAAE,KAAM,GAAQ,IAAK,CAC9B,EACA,CACF,EAkBK,SAAS,CAAwB,CACtC,EACe,CAIf,GAAI,mBAAyB,cAAe,OAAO,KAKnD,GAAI,IAAe,GAAO,OAAO,KAEjC,GAAI,IAAe,OAAW,OAAO,EACrC,GAAI,CAAC,OAAO,SAAS,CAAU,GAAK,GAAc,EAChD,OAAO,EAET,OAAO,EA+BT,SAAS,CAAuB,CAAC,EAAyC,CACxE,IAAM,EAAY,EAAyB,CAAU,EACrD,GAAI,IAAc,KAAM,MAAO,IAAM,GAErC,IAAM,EAAW,MAAM,yBAAyB,EAE1C,EAAQ,WAAW,IAAM,CAC7B,IAAM,EAAQ,EAAK,OAAO,MAAM;AAAA,CAAI,EAAE,MAAM,CAAC,EAAE,KAAK;AAAA,CAAI,GAAK,GAC7D,QAAQ,KACN,uDAAuD,WACrD,0EACA;AAAA,EACiC;AAAA,+GAGrC,GACC,CAAS,EAOZ,OAFA,EAAM,QAAQ,EAEP,IAAM,aAAa,CAAK,EA8BjC,eAAe,CAAgB,CAC7B,EACA,EACe,CACf,GAAI,EAAU,SAAW,EAAG,OAE5B,MAAM,EAAW,IACf,IACK,EACH,GAAI,OACJ,YAAa,OACb,gBAAiB,OACjB,MAAO,GAAS,OAAS,CAC3B,EACA,SAAY,CACV,QAAW,KAAY,EACrB,GAAI,CACF,MAAM,EAAS,EACf,MAAO,EAAO,CACd,QAAQ,MACN,qJAGA,CACF,GAIR,EAwDK,SAAS,CAAkB,CAChC,EACA,EACA,EACY,CACZ,IAAM,EAAU,EAAW,SAAS,EAoB9B,EAAO,GAAS,YAAc,EAMpC,GALA,EAAuB,CAAI,EAKvB,GAAS,GAAI,CAmBf,IAAM,EAAW,EAAQ,YACnB,EAAO,GAAU,QAAU,EAM3B,EAAe,EAAQ,gBACvB,EAAiB,GAAc,QAAU,EAE/C,OAAO,EAAQ,GACZ,UAAU,CAAC,IAAO,CACjB,IAAM,EAAS,EACf,OAAO,EAAW,IAChB,IAAK,EAAS,GAAI,EAAQ,MAAO,EAAQ,MAAQ,CAAE,EACnD,SAAY,CACV,IAAM,EAAS,MAAM,EAAG,CAAM,EAC9B,GAAI,EACF,MAAM,EAAkB,EAAc,CAAc,EAEtD,OAAO,EAEX,EACD,EACA,MAAM,CAAC,IAAmB,CACzB,GAAI,EAAU,EAAS,OAAS,EAChC,GAAI,EAAc,EAAa,OAAS,EACxC,MAAM,EACP,EAQL,IAAM,EAAe,EACnB,GAAS,wBACX,EAKM,EAAkC,CAAC,EACnC,EAAmC,CAAC,EAQ1C,GAAI,CAWF,OACE,EACG,MAAM,CAAC,IACN,EAAW,IACT,IACK,EACH,KACA,MAAO,EACP,WAAY,IAAS,EAAqB,OAAY,EAOtD,YAAa,EACb,gBAAiB,CACnB,EACA,SAAY,CACV,IAAM,EAAS,MAAM,EAAG,CAAE,EAE1B,OADA,MAAM,EAAkB,EAAc,CAAC,EAChC,EAEX,CACF,EASC,QAAQ,CAAY,EAIpB,KAAK,MAAO,IAAW,CAEtB,OADA,MAAM,EAAiB,EAAU,CAAO,EACjC,EACR,EAEL,MAAO,EAAO,CAEd,MADA,EAAa,EACP",
-  "debugId": "95764462106E29EF64756E2164756E21",
-  "names": []
-}

package/dist/chunk-ddbbxg9m.js

@@ -1,5 +0,0 @@
-// @bun
-import{cc as o}from"./chunk-7bmctvep.js";import{dc as i}from"./chunk-p0px3ym0.js";import{mg as t}from"./chunk-ttckhvew.js";import{ug as r}from"./chunk-cv2sargd.js";class n extends i{register(){this.app.singleton(r,()=>new r(t(o(),this.app.config.get("translation",{}))))}}
-export{n as Wa};
-
-//# debugId=21BFB3AE9893C6BD64756E2164756E21

package/dist/chunk-k5j65f2c.js

@@ -1,54 +0,0 @@
-// @bun
-class I extends Error{argument;model;operation;constructor(z,G,H,V){super(`gemi ORM does not support '${z}' yet (${G}.${H}). `+V);this.argument=z;this.model=G;this.operation=H;this.name="UnsupportedQueryError"}}class R extends I{constructor(z,G,H,V){super(z,G,H,V);this.name="InvalidArgumentError",this.message=`Invalid '${z}' (${G}.${H}). ${V}`}}class D extends I{constructor(z,G,H,V){super(z,G,H,V);this.name="UnsupportedByDesignError",this.message=`gemi ORM does not implement '${z}' (${G}.${H}), and this is a decision rather than a gap. ${V}`}}class E extends Error{field;model;constructor(z,G,H){super(`'${z}' is not a field on model ${G}. Known fields: ${H.join(", ")}.`);this.field=z;this.model=G;this.name="UnknownFieldError"}}class j extends Error{field;value;constructor(z,G){super(`Could not decode the value ${JSON.stringify(String(G))} from column '${z.column}' as ${z.type}. The column's contents do not match `+"the Prisma schema \u2014 was it written by something other than Prisma or "+"the gemi ORM?");this.field=z;this.value=G;this.name="DecodeError"}}class M extends Error{model;operation;constructor(z,G){super(`No ${z} found (${z}.${G}).`);this.model=z;this.operation=G;this.name="RecordNotFoundError"}}function t(z){if(z instanceof M)return!0;return typeof z==="object"&&z!==null&&z.name==="RecordNotFoundError"}class P extends Error{model;operation;fields;constraint;constructor(z,G,H,V,Y){super(`Unique constraint violated on ${z}.${G}`+(H.length>0?` for ${H.join(", ")}`:"")+(V?` (constraint '${V}')`:"")+`. A ${z} with those values already exists.`,Y);this.model=z;this.operation=G;this.fields=H;this.constraint=V;this.name="UniqueConstraintError"}}function a(z){if(z instanceof P)return!0;return typeof z==="object"&&z!==null&&z.name==="UniqueConstraintError"}class w extends Error{model;operation;dialect;constructor(z,G,H){super(`${z}.${G} needs RETURNING to report its result, and the '${H}' dialect does not support it. The fallback \u2014 `+"lastInsertRowid plus a re-select \u2014 is not implemented.");this.model=z;this.operation=G;this.dialect=H;this.name="ReturningUnsupportedError"}}class A extends Error{model;operation;reason;constructor(z,G,H="denied"){super(H==="no-user"?`${z}.${G} is governed by a policy and there is no user in scope. If this is a cron tick, a queue worker or a script, say so at the call site: Model.asSystem(() => ...). Policies are never skipped just because a user failed to turn up.`:`${z}.${G} was denied by ${z}'s policy.`);this.model=z;this.operation=G;this.reason=H;this.name="PolicyDeniedError"}}function e(z){if(z instanceof A)return!0;return typeof z==="object"&&z!==null&&z.name==="PolicyDeniedError"}class y extends Error{model;operation;fields;constructor(z,G,H){let V=H.map((Y)=>`'${Y}'`).join(", ");super(`${z}.${G} writes ${V}, which ${z}'s policy also `+"scopes on \u2014 so this update can move a row outside the scope that "+`selected it, where the caller can no longer read or repair it.
-
-Add an onUpdate to that policy. It may reassert the column (data => ({ ...data, ${H[0]}: ctx.user.${H[0]} })), reject `+"the write, or allow it explicitly with (_ctx, data) => data \u2014 all "+"three are fine, and the point is that the policy says which.");this.model=z;this.operation=G;this.fields=H;this.name="ScopeEscapeError"}}class k extends Error{model;registered;queried;carries;constructor(z,G,H,V="queried"){super(V==="narrowing"?`${H} extends ${G}, which owns the model '${z}', and carries policies of its own on top of it. A class that narrows an existing model is a view, and the registry holds one `+`class per name \u2014 so registering ${H} would apply its narrowing to every nested read of ${z}, and leaving ${G} registered would skip ${H}'s policies entirely. Neither is a thing to choose for you.
-
-Keep the view out of the modules you hand to Kernel.models, and query it directly where you want it:
-
-    ${H}.findMany(\u2026)   // narrowed, at the call site
-
-`+`If it is not a view but the model itself, move the policies onto ${G} \u2014 the class the model's name resolves to \u2014 and `+`${H} inherits them everywhere.
-`:V==="queried"?`${H} carries policies but the registry resolves '${z}' to ${G}. Nested relation reads go through the registry, so they would run on ${G} and skip every policy on ${H} \u2014 scoped at the root, unscoped inside an include. `+`Register the class that carries the policy:
-
-    import { register } from "gemi/orm"
-    export class ${H} extends ${G} { \u2026 }
-`+`    register("${z}", ${H})
-`:`This query goes through ${H}, but the registry resolves '${z}' to ${G}, which carries policies ${H} does not. Nested relation reads would be scoped and this query is `+"not \u2014 the same policy applying to some queries and not others. "+`Query ${G} instead:
-
-    ${G}.findMany(\u2026)
-
-`+"If skipping policies is intended, say so at the call site \u2014 that "+`is what Model.asSystem() is for, and it is the only way to do it that a reader can see.
-`);this.model=z;this.registered=G;this.queried=H;this.carries=V;this.name="UnregisteredPolicyClassError"}}class q extends Error{model;index;reason;found;suggestion;constructor(z,G,H,V,Y,W,B){let J=`${z}.$policies[${G}]`,F=Y.length>1?`${Y.slice(0,-1).join(", ")} or ${Y[Y.length-1]}`:Y[0]??"";super(H==="not-a-policy"?`${J} is ${V}, which is not a policy. An entry is either a `+"policy object \u2014 { scope, onCreate, \u2026 } \u2014 or a class the ORM "+`constructs with no arguments.
-
-A policy that only sometimes applies belongs in the array rather than in the entry:
-
-    static $policies = [...(multiTenant ? [tenantScope] : [])]
-`:H==="not-constructable"?`${J} is ${V}, and a function entry is instantiated with `+"no arguments \u2014 so an arrow function, a plain function, or a "+`factory that was never called cannot be one.
-
-If it is a factory, call it:
-
-    static $policies = [softDeletes({ field: "deletedAt" })]
-`:H==="constructor-threw"?`${J} is ${V}
-
-A class entry is constructed with no arguments. If this one needs some, construct it yourself and put the instance in the array:
-
-    static $policies = [new TenantPolicy({ field: "orgId" })]
-
-If the constructor reaches for something that is not ready yet, note that it runs on the first query through this model, not at boot.
-`:H==="hook-not-callable"?`${J} has a ${V}, and every hook is called \u2014 so this `+`would throw on the first query that reached it rather than doing whatever it was meant to do. Give it a function, or leave the key out.
-`:`${J} has none of ${F}, so it would never run. The model carries a visible $policies array and nothing in it `+"applies to any query \u2014 which for a scope means the model "+`reads unscoped. ${V}`+(W?` Is '${W.key}' meant to be \`${W.hook}\`?`:"")+`
-`,B);this.model=z;this.index=G;this.reason=H;this.found=V;this.suggestion=W;this.name="InvalidPolicyEntryError"}}class h extends Error{model;candidates;constructor(z,G){let H=G.map((V)=>`'${V}'`).join(", ");super(`Two classes in one module claim the model '${z}' \u2014 ${H} \u2014 and `+`neither extends the other, so there is no way to tell which one nested relation reads should run.
-
-Say which, and registerModels will leave it alone:
-
-    import { register } from "gemi/orm"
-    register("${z}", ${G[0]})
-
-A class that is only a typed view over the same rows belongs in a module you do not hand to registerModels.`);this.model=z;this.candidates=G;this.name="AmbiguousModelRegistrationError"}}class _ extends Error{model;operation;required;limit;dialect;constructor(z,G,H,V,Y,W){super(`${z}.${G} would bind ${H} parameters, and the '${Y}' driver accepts at most ${V} in one statement. ${W}`+(G==="createMany"?" A createMany over the ceiling is normally split across statements inside one transaction, so reaching this means splitting cannot help: a single row binds more than the driver accepts.":" Splitting is not something this operation can do for you \u2014 one "+"statement has to carry one answer. Narrow the query."));this.model=z;this.operation=G;this.required=H;this.limit=V;this.dialect=Y;this.name="ParameterLimitError"}}class x extends Error{model;operation;field;constructor(z,G,H){super(`${z}.${G} is missing a value for '${H}', which is required and has no default.`);this.model=z;this.operation=G;this.field=H;this.name="MissingRequiredValueError"}}class g extends Error{relation;model;constructor(z,G,H){super(`'${z}' is not a relation on model ${G}. `+(H.length>0?`Known relations: ${H.join(", ")}.`:`${G} declares no relations.`));this.relation=z;this.model=G;this.name="UnknownRelationError"}}class f extends Error{model;limit;constructor(z,G){super(`The include tree nests more than ${G} relations deep (at model ${z}). Deeply nested includes are legal, so this is a guard against a generated or malformed argument tree rather than a limit on `+"modelling \u2014 every level costs at least one query.");this.model=z;this.limit=G;this.name="RelationDepthExceededError"}}class p extends Error{model;relation;target;constructor(z,G,H,V){super(`${z}.${G} points at model '${H}', which nothing has registered. The generated artifact and the registry disagree: re-run \`prisma generate\`, and check that app/models/generated/index.ts is imported. `+(V.length>0?`Registered models: ${V.join(", ")}.`:"Nothing is registered at all."));this.model=z;this.relation=G;this.target=H;this.name="UnregisteredRelationTargetError"}}class m extends Error{model;relation;constructor(z,G,H){super(`Cannot resolve how ${z}.${G} joins: ${H} This means `+"app/models/generated is stale or hand-edited \u2014 re-run "+"`prisma generate`.");this.model=z;this.relation=G;this.name="MalformedRelationError"}}class c extends Error{constructor(z,G){super(`No model is registered under the name '${z}'. `+(G.length>0?`Registered models: ${G.join(", ")}.`:"Nothing is registered \u2014 is app/models/generated/index.ts imported?"));this.name="ModelNotRegisteredError"}}class v extends Error{constructor(z){super(`${z} has no $schema. Model subclasses must extend a generated base class from app/models/generated/models.ts.`);this.name="MissingModelSchemaError"}}class u extends Error{model;operation;constructor(z,G){super(`${z}.${G} was given 'lock' outside a transaction. A row lock lasts until the transaction that took it ends, so outside one it is released as soon as the row is read and protects nothing. Run the read and the writes it guards inside Model.transaction(async () => { ... }).`);this.model=z;this.operation=G;this.name="LockOutsideTransactionError"}}function Hz(){return{now:new Date,resolved:{}}}var s={now:new Date(0),resolved:{}};function Vz(z){return(G,H=s)=>{let V=[];for(let Y=0;Y<z.length;Y++)V.push(z[Y](G,H));return V}}var Q="\x00";function Z(z){return{text:z,binders:[]}}function X(z,G=""){return{text:Q+G,binders:[z]}}function Wz(z){return z.text.split(Q)}function Yz(z,G){return{text:z.join(Q),binders:G}}function $(...z){return N(z,"")}function N(z,G){let H="",V=[];for(let Y=0;Y<z.length;Y++){if(Y>0)H+=G;H+=z[Y].text;for(let W of z[Y].binders)V.push(W)}return{text:H,binders:V}}function Zz(z,G,H){let V=z.text.split(Q),Y=V.length-1;if(Y!==z.binders.length)throw Error(`Compiled ${Y} parameter placeholders but collected ${z.binders.length} binders.`);if(Y>G.maxBoundParameters)throw new _(H.model,H.operation,Y,G.maxBoundParameters,G.name,G.bindsListAsOneParameter?"That is one parameter per value in the statement.":`That is one parameter per value, and on ${G.name} each element of an 'in' list counts separately.`);let W=V[0];for(let B=0;B<Y;B++)W+=G.placeholder(B)+V[B+1];return{text:W,binders:z.binders}}class O{name="postgres";supportsInsensitiveMode=!0;bindsListAsOneParameter=!0;supportsReturning=!0;maxBoundParameters=65535;typesParametersFromStatement=!0;quoteIdent(z){if(z.includes("\x00"))throw Error(`Refusing to quote the identifier ${JSON.stringify(z)}: it contains a NUL byte, which is reserved as the parameter marker.`);return`"${z.replace(/"/g,'""')}"`}placeholder(z){return`$${z+1}`}inList(z,G,H,V){return $(Z(`${z} ${G?"<> all":"= any"} (`),X((W,B)=>K(V(W,B))),Z(")"))}static COMPOSITE_IN_TYPES={Int:"int",BigInt:"bigint",String:"text",Boolean:"boolean"};canBindCompositeIn(z){return z.length>0&&z.every((G)=>O.COMPOSITE_IN_TYPES[G])}compositeIn(z,G,H){let V=z.map((Y,W)=>$(X((B,J)=>K(H(B,J).map((F)=>F[W]))),Z(`::${O.COMPOSITE_IN_TYPES[G[W]]}[]`)));return $(Z(`(${z.join(", ")}) in (select * from unnest(`),...V.flatMap((Y,W)=>W===0?[Y]:[Z(", "),Y]),Z("))"))}listFilters=new Set(["equals","has","hasEvery","hasSome","isEmpty"]);listHas(z,G){return $(G,Z(` = any(${z})`))}listHasEvery(z,G){return $(Z(`${z} @> `),G)}listHasSome(z,G){return $(Z(`${z} && `),G)}listIsEmpty(z,G){return $(Z(`${z} ${G?"=":"<>"} `),X(()=>K([])))}listPush(z,G){return $(Z(`array_cat(${z}, `),G,Z(")"))}jsonPathSyntax="array";jsonFilters=new Set(["equals","not","string_contains","string_starts_with","string_ends_with","array_contains","lt","lte","gt","gte"]);jsonComparesAsText=!0;jsonExtract(z,G,H){return $(Z(`${z} ${H?"#>>":"#>"} `),X((V,Y)=>K(G(V,Y))))}jsonValueAt(z,G){return $(Z("("),this.jsonExtract(z,G,!1),Z(")::jsonb"))}jsonArrayContains(z,G,H){return $(Z("("),this.jsonExtract(z,G,!1),Z(") @> "),X((V,Y)=>{let W=H(V,Y);if(W===null||W===void 0)return null;return typeof W==="string"||typeof W==="object"?W:JSON.stringify(W)}),Z("::jsonb"))}like(z,G,H){return $(Z(`${z} ${G?"ilike":"like"} `),X(H))}ignoreConflicts(){return Z(" on conflict do nothing")}rowLock(z,G){let H=z.onLocked==="skipLocked"?" skip locked":z.onLocked==="noWait"?" nowait":"";return Z(` for ${z.mode==="share"?"share":"update"} of ${this.quoteIdent(G)}${H}`)}paginate(z,G){let H=[];if(z)H.push($(Z(" limit "),X(z)));if(G)H.push($(Z(" offset "),X(G)));return $(...H)}constraintViolation(z){let G=z;if(!G)return null;if(String(G.errno??G.code??"")!=="23505")return null;let V=typeof G.constraint==="string"&&G.constraint!==""?G.constraint:void 0,Y=typeof G.detail==="string"?G.detail:"",W=/\((.+?)\)=/.exec(Y);return{kind:"unique",columns:W?(W[1].match(/"(?:[^"]|"")*"|[^,]+/g)??[]).map((J)=>J.trim()).filter((J)=>J!=="").map((J)=>/^".*"$/s.test(J)?J.slice(1,-1).replace(/""/g,'"'):J):[],constraint:V}}castParameter(z){if(z.isList)return"";return z.type==="Json"?"::text::jsonb":""}encode(z,G){if(z===null||z===void 0)return null;if(G.isList){if(!Array.isArray(z))throw Error(`gemi ORM bug: a non-array reached the parameter binder for the scalar list '${G.column}' (received ${typeof z}). Every path that binds a list is supposed to have checked its operand.`);return K(G.type==="Json"?z.map((H)=>H===null||H===void 0?null:JSON.stringify(H)):z)}return z}encodeUntyped(z){return z}needsDecode(z){return z.isList===!0||z.type==="BigInt"||z.type==="Bytes"}decode(z,G){if(z===null||z===void 0)return null;if(G.isList)return this.decodeList(z,G);return this.decodeScalar(z,G)}decodeList(z,G){let H=Array.isArray(z)?z:typeof z==="string"?i(z,G):ArrayBuffer.isView(z)?Array.from(z):null;if(H===null)throw new j(G,z);return H.map((V)=>V===null||V===void 0?null:this.decodeScalar(V,G))}decodeScalar(z,G){switch(G.type){case"BigInt":if(typeof z==="bigint")return z;try{return BigInt(z)}catch{throw new j(G,z)}case"Json":return z;case"Bytes":return Buffer.isBuffer(z)?new Uint8Array(z.buffer,z.byteOffset,z.byteLength):z;default:return z}}}function K(z){let G="{";for(let H=0;H<z.length;H++){if(H>0)G+=",";G+=d(z[H])}return G+"}"}function d(z){if(z===null||z===void 0)return"NULL";if(z instanceof Date)return`"${z.toISOString()}"`;if(ArrayBuffer.isView(z)){let H="";for(let V of new Uint8Array(z.buffer,z.byteOffset,z.byteLength))H+=V.toString(16).padStart(2,"0");return`"\\\\x${H}"`}return`"${(typeof z==="string"?z:String(z)).replace(/\\/g,"\\\\").replace(/"/g,"\\\"")}"`}function i(z,G){if(!z.startsWith("{")||!z.endsWith("}"))throw new j(G,z);if(z==="{}")return[];let H=[],V=1,Y=z.length-1;while(V<=Y){let W="",B=!1;if(z[V]==='"'){B=!0,V++;while(V<Y&&z[V]!=='"')W+=z[V]==="\\"?z[++V]:z[V],V++;V++}else while(V<Y&&z[V]!==","){if(z[V]==="{")throw new j(G,z);W+=z[V],V++}if(H.push(!B&&W.toUpperCase()==="NULL"?null:W),V<Y&&z[V]!==",")throw new j(G,z);V++}if(G.type!=="Json")return H;return H.map((W)=>{if(W===null)return null;try{return JSON.parse(W)}catch{throw new j(G,W)}})}var n={"Prisma.DbNull":"db","Prisma.JsonNull":"json","Prisma.AnyNull":"any"};function U(z){return new class{toString(){return z}}}var jz=U("Prisma.DbNull"),o=U("Prisma.JsonNull"),Fz=U("Prisma.AnyNull"),Kz=o;function L(z){if(typeof z!=="object"||z===null)return null;for(let H in z)return null;if(Object.getOwnPropertyNames(z).length>0)return null;let G;try{G=String(z)}catch{return null}return n[G]??null}var r=/^\d{4}-\d{2}-\d{2}[ T]\d{2}:\d{2}:\d{2}(\.\d+)?$/;function l(z,G){if(z instanceof Date)return z;let H;if(typeof z==="number")H=new Date(z);else if(typeof z==="bigint")H=new Date(Number(z));else if(typeof z==="string")H=new Date(r.test(z)?`${z.replace(" ","T")}Z`:z);else throw new j(G,z);if(Number.isNaN(H.getTime()))throw new j(G,z);return H}class S{name="sqlite";supportsInsensitiveMode=!1;bindsListAsOneParameter=!1;supportsReturning=!0;maxBoundParameters=32766;typesParametersFromStatement=!1;quoteIdent(z){if(z.includes("\x00"))throw Error(`Refusing to quote the identifier ${JSON.stringify(z)}: it contains a NUL byte, which is reserved as the parameter marker.`);return`"${z.replace(/"/g,'""')}"`}placeholder(z){return"?"}inList(z,G,H,V){let Y=G?"not in":"in",W=[];for(let B=0;B<H;B++)W.push(X((J,F)=>V(J,F)[B]));return $(Z(`${z} ${Y} (`),N(W,", "),Z(")"))}canBindCompositeIn(){return!1}compositeIn(){throw Error("SQLite cannot bind a composite `in`; `canBindCompositeIn` is the guard.")}listFilters=new Set;listHas(){throw Error(C("has"))}listHasEvery(){throw Error(C("hasEvery"))}listHasSome(){throw Error(C("hasSome"))}listIsEmpty(){throw Error(C("isEmpty"))}listPush(){throw Error(C("push"))}jsonPathSyntax="jsonpath";jsonFilters=new Set(["equals","not","string_contains","string_starts_with","string_ends_with"]);jsonComparesAsText=!1;jsonExtract(z,G,H){return $(Z(`json_extract(${z}, `),X(G),Z(")"))}jsonValueAt(z,G){return $(Z(`(${z} -> `),X(G),Z(")"))}jsonArrayContains(){throw Error("SQLite cannot express array_contains; `jsonFilters` is the guard.")}like(z,G,H){return $(Z(`${z} like `),X(H))}ignoreConflicts(){return null}rowLock(z,G){return Z("")}paginate(z,G){if(!z&&!G)return Z("");if(!G)return $(Z(" limit "),X(z));return $(Z(" limit "),X(z??(()=>-1)),Z(" offset "),X(G))}constraintViolation(z){let G=z?.code;if(G!=="SQLITE_CONSTRAINT_UNIQUE"&&G!=="SQLITE_CONSTRAINT_PRIMARYKEY")return null;let H=String(z.message??""),V=/constraint failed:\s*(.+)$/.exec(H);if(!V)return{kind:"unique",columns:[]};return{kind:"unique",columns:V[1].split(",").map((W)=>W.trim()).map((W)=>{let B=W.indexOf(".");return B===-1?W:W.slice(B+1)}).filter((W)=>W!=="")}}castParameter(z){return""}encode(z,G){if(z===null||z===void 0)return null;switch(G.type){case"DateTime":return z instanceof Date?z.getTime():z;case"Boolean":return typeof z==="boolean"?z?1:0:z;case"Json":{let H=L(z);if(H==="db")return null;if(H==="json")return"null";if(H==="any")throw Error("gemi ORM bug: Prisma.AnyNull reached the SQLite encoder. It is a filter operand only, and both the filter and write paths are supposed to have handled it before this point.")}return JSON.stringify(z);default:return z}}encodeUntyped(z){if(z instanceof Date)return z.getTime();if(typeof z==="boolean")return z?1:0;return z}needsDecode(z){switch(z.type){case"DateTime":case"Boolean":case"BigInt":case"Json":return!0;default:return!1}}decode(z,G){if(z===null||z===void 0)return null;switch(G.type){case"DateTime":return l(z,G);case"Boolean":if(typeof z==="boolean")return z;return Number(z)!==0;case"BigInt":if(typeof z==="bigint")return z;try{return BigInt(z)}catch{throw new j(G,z)}case"Json":try{return typeof z==="string"?JSON.parse(z):z}catch{throw new j(G,z)}default:return z}}}function C(z){return`SQLite has no array type, so it cannot express '${z}' on a scalar list; \`listFilters\` is the guard.`}class b extends Error{constructor(z){super(`The gemi ORM does not support the '${z}' dialect. Only sqlite `+"and postgres are implemented \u2014 see the supported matrix in "+`docs/orm.md.
-
-The *connection* is fine: Bun's client speaks ${z}, so raw SQL through DB.query / DB.sql and transactions all work. It is the query compiler that has no ${z} dialect, so every model operation raises this.
-
-Point DATABASE_URL at Postgres or SQLite to use the ORM, or keep using Prisma's own client for this database.`);this.name="UnsupportedDialectError"}}function Tz(z){return T[z]!==null}function Mz(){return Object.keys(T)}var T={sqlite:new S,postgres:new O,mysql:null,mariadb:null};function Pz(z){let G=T[z];if(G===null)throw new b(z);return G}
-export{I as Rd,R as Sd,D as Td,E as Ud,j as Vd,M as Wd,t as Xd,P as Yd,a as Zd,w as _d,A as $d,e as ae,y as be,k as ce,q as de,h as ee,_ as fe,x as ge,g as he,f as ie,p as je,m as ke,c as le,v as me,u as ne,Hz as oe,Vz as pe,Z as qe,X as re,Wz as se,Yz as te,$ as ue,N as ve,Zz as we,O as xe,jz as ye,o as ze,Fz as Ae,Kz as Be,L as Ce,S as De,b as Ee,Tz as Fe,Mz as Ge,Pz as He};
-
-//# debugId=EC89027FE0B9848B64756E2164756E21