@palbase/backend 17.4.0 → 18.0.0

package/dist/index.js

@@ -2,239 +2,72 @@ import {
   EXTENSION_DEPENDENCIES,
   PALBASE_EXTENSIONS,
   PolicyBuilder,
-  TxPlanBuilder,
-  TxPlanError,
-  TxRefError,
   bigint,
   boolean,
-  dec,
   defineSchema,
   enumType,
-  inc,
   integer,
   isPalbaseExtension,
   jsonb,
   makeTypedDB,
-  now,
   numeric,
   policy,
   raw,
-  runTxPlan,
   text,
   timestamp,
   uuid
-} from "./chunk-AAN642N5.js";
-
-// src/runtime.ts
-import { AsyncLocalStorage } from "async_hooks";
-var __requestALS = new AsyncLocalStorage();
-var runtime = null;
-function __setRuntime(services) {
-  runtime = services;
-}
-function __runWithRuntime(services, fn) {
-  return __requestALS.run({ runtime: services }, fn);
-}
-function __getRuntime() {
-  const scoped = __requestALS.getStore();
-  if (scoped) return scoped.runtime;
-  if (runtime === null) {
-    throw new Error(
-      "Palbase services accessed outside a request scope. The Database/Documents/\u2026 singletons are only available inside an endpoint handler (or after the runtime has called __runWithRuntime / __setRuntime)."
-    );
-  }
-  return runtime;
-}
-function makeServiceProxy(key) {
-  const handler = {
-    get(_target, prop, receiver) {
-      const client = __getRuntime()[key];
-      const value = Reflect.get(client, prop, receiver);
-      return typeof value === "function" ? value.bind(client) : value;
-    }
-  };
-  return new Proxy({}, handler);
-}
-function makeTablesAccessor(ops) {
-  const tablesProxy = new Proxy(
-    {},
-    {
-      get(_t, prop) {
-        if (typeof prop !== "string") return void 0;
-        const name = prop;
-        return {
-          insert: (data) => ops().insert(name, data),
-          update: (id, data) => ops().update(name, id, data),
-          delete: (id) => ops().delete(name, id),
-          findById: (id) => ops().findById(name, id),
-          findMany: (query) => ops().findMany(name, query)
-        };
-      }
-    }
-  );
-  return tablesProxy;
-}
-var rawDatabase = makeServiceProxy("Database");
-function makeTypedSurface(raw2) {
-  const ops = {
-    query: (sql, params) => raw2.query(sql, params),
-    insert: (table, data) => raw2.insert(table, data),
-    update: (table, id, data) => raw2.update(table, id, data),
-    delete: (table, id) => raw2.delete(table, id),
-    findById: (table, id) => raw2.findById(table, id),
-    findMany: (table, query) => raw2.findMany(table, query)
-  };
-  return Object.assign(ops, {
-    tables: makeTablesAccessor(() => raw2),
-    transaction(fn) {
-      const builder = new TxPlanBuilder();
-      return runTxPlan(raw2, makeTxTablesAccessor(builder), builder, fn);
-    }
-  });
-}
-function makeTxTablesAccessor(builder) {
-  const tablesProxy = new Proxy(
-    {},
-    {
-      get(_t, prop) {
-        if (typeof prop !== "string") return void 0;
-        return builder.table(prop);
-      }
-    }
-  );
-  return tablesProxy;
-}
-var Database = Object.assign(makeTypedSurface(rawDatabase), {
-  /**
-   * Lazily resolve the runtime's service-role sibling on each call. We do NOT
-   * cache it: `rawDatabase.asService()` reads the CURRENT request scope through
-   * the runtime proxy, and the per-request runtime injects a service client
-   * bound to that request's identity headers — caching would leak one request's
-   * sibling into another concurrent request.
-   */
-  asService() {
-    return makeTypedSurface(rawDatabase.asService());
-  }
-});
-var Documents = makeServiceProxy("Documents");
-var Storage = makeServiceProxy("Storage");
-var Cache = makeServiceProxy("Cache");
-var Log = makeServiceProxy("Log");
-var Notifications = makeServiceProxy("Notifications");
-var Purchases = makeServiceProxy("Purchases");
-var rawFlags = makeServiceProxy("Flags");
-var Flags = Object.assign(
-  {
-    isEnabled(flagName, context) {
-      return rawFlags.isEnabled(flagName, context);
-    },
-    getVariant(flagName, context) {
-      return rawFlags.getVariant(flagName, context);
-    },
-    getAll(context) {
-      return rawFlags.getAll(context);
-    },
-    setOverride(key, value) {
-      return rawFlags.setOverride(key, value);
-    }
-  },
-  {
-    /**
-     * Lazily resolve the runtime's cross-user sibling on each call. We do NOT
-     * cache it: `rawFlags.asService()` reads the CURRENT request scope through
-     * the runtime proxy, so caching would leak one request's sibling into
-     * another concurrent request. Mirrors `Database.asService()`.
-     */
-    asService() {
-      return rawFlags.asService();
-    }
-  }
-);
-var Realtime = makeServiceProxy("Realtime");
-
-// src/errors.ts
-var HttpError = class extends Error {
-  status;
-  error;
-  errorDescription;
-  data;
-  constructor(status, error, errorDescription, data) {
-    super(errorDescription);
-    this.name = "HttpError";
-    this.status = status;
-    this.error = error;
-    this.errorDescription = errorDescription;
-    if (data !== void 0) {
-      this.data = data;
-    }
-  }
-  /**
-   * Serialize to the standard Palbase error response format.
-   * The `requestId` is injected by the runtime layer from the request context.
-   * When called without arguments (e.g. JSON.stringify), request_id is omitted.
-   * When `data` is set, it is appended as a strict-superset field.
-   */
-  toJSON(requestId) {
-    const result = {
-      error: this.error,
-      error_description: this.errorDescription,
-      status: this.status
-    };
-    if (requestId) {
-      result.request_id = requestId;
-    }
-    if (this.data !== void 0) {
-      result.data = this.data;
-    }
-    return result;
-  }
-};
-var PalError = class extends HttpError {
-  constructor(status, code, description, data) {
-    super(status, code, description, data);
-    this.name = "PalError";
-  }
-};
-var NamedHttpError = class extends HttpError {
-  constructor(status, defaultCode, name, message, code, data) {
-    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);
-    this.name = name;
-  }
-};
-function defaultMessage(name) {
-  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
-  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
-}
-var BadRequest = class extends NamedHttpError {
-  constructor(data, message) {
-    super(400, "bad_request", "BadRequest", message, void 0, data);
-  }
-};
-var Unauthorized = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(401, "unauthorized", "Unauthorized", message, code, data);
-  }
-};
-var Forbidden = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(403, "forbidden", "Forbidden", message, code, data);
-  }
-};
-var NotFound = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(404, "not_found", "NotFound", message, code, data);
-  }
-};
-var Conflict = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(409, "conflict", "Conflict", message, code, data);
-  }
-};
-var TooManyRequests = class extends NamedHttpError {
-  constructor(data, message) {
-    super(429, "too_many_requests", "TooManyRequests", message, void 0, data);
-  }
-};
+} from "./chunk-SSGAMC26.js";
+import {
+  defineError,
+  entitlementFor,
+  getErrorRegistry,
+  recordEntitlement,
+  recordSpend,
+  spendFor
+} from "./chunk-N32VDWKH.js";
+import {
+  Cache,
+  Database,
+  Documents,
+  Flags,
+  Log,
+  Notifications,
+  Purchases,
+  Realtime,
+  Secrets,
+  Storage,
+  __getRuntime,
+  __requestALS,
+  __runWithRuntime,
+  __setRuntime
+} from "./chunk-POYAFBLF.js";
+import {
+  TxPlanError,
+  TxRefError,
+  dec,
+  inc,
+  now
+} from "./chunk-W5ODXPY3.js";
+import {
+  Controller,
+  __resetRegisteredControllers,
+  getRegisteredControllers
+} from "./chunk-YL4C5NRY.js";
+import {
+  BadRequest,
+  Conflict,
+  Forbidden,
+  HttpError,
+  NotFound,
+  PalError,
+  TooManyRequests,
+  Unauthorized,
+  getRoutes,
+  recordParam,
+  recordRoute,
+  recordThrows
+} from "./chunk-QMVK4X3V.js";
+import "./chunk-7D4SUZUM.js";
 
 // src/purchases/errors.ts
 function asPalstoreError(err) {
@@ -262,31 +95,6 @@ function toHttpError(err) {
   }
 }
 
-// src/purchases/registry.ts
-var ENTITLEMENTS = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.entitlements");
-var SPENDS = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.spends");
-function carrierOf(target) {
-  return typeof target === "function" ? target : target.constructor ?? target;
-}
-function own(carrier, slot) {
-  if (!Object.prototype.hasOwnProperty.call(carrier, slot)) {
-    carrier[slot] = {};
-  }
-  return carrier[slot];
-}
-function recordEntitlement(target, fnName, key) {
-  own(carrierOf(target), ENTITLEMENTS)[fnName] = key;
-}
-function recordSpend(target, fnName, meta) {
-  own(carrierOf(target), SPENDS)[fnName] = meta;
-}
-function entitlementFor(ctor, fnName) {
-  return carrierOf(ctor)[ENTITLEMENTS]?.[fnName];
-}
-function spendFor(ctor, fnName) {
-  return carrierOf(ctor)[SPENDS]?.[fnName];
-}
-
 // src/purchases/subject.ts
 var subjectByRequest = /* @__PURE__ */ new WeakMap();
 function storeEnv() {
@@ -393,6 +201,795 @@ function Spend(key) {
   };
 }
 
+// src/clients/http.ts
+var PalbaseModuleError = class extends Error {
+  code;
+  status;
+  details;
+  constructor(code, message, status, details = {}) {
+    super(message);
+    this.name = "PalbaseModuleError";
+    this.code = code;
+    this.status = status;
+    this.details = details;
+  }
+};
+function makeHttpClient(cfg) {
+  async function request(method, path, options = {}) {
+    const headers = {
+      "Content-Type": "application/json",
+      ...options.headers ?? {}
+    };
+    if (cfg.apiKey) headers["apikey"] = cfg.apiKey;
+    const init = { method, headers };
+    if (options.body !== void 0) {
+      if (typeof options.body === "string" || options.body instanceof Uint8Array) {
+        init.body = options.body;
+      } else if (typeof FormData !== "undefined" && options.body instanceof FormData) {
+        delete headers["Content-Type"];
+        init.body = options.body;
+      } else if (typeof Blob !== "undefined" && options.body instanceof Blob) {
+        delete headers["Content-Type"];
+        init.body = options.body;
+      } else {
+        init.body = JSON.stringify(options.body);
+      }
+    }
+    if (options.signal) init.signal = options.signal;
+    const doFetch = cfg.fetchImpl ?? globalThis.fetch;
+    let response;
+    try {
+      response = await doFetch(`${cfg.baseUrl}${path}`, init);
+    } catch (err) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "network_error",
+          err instanceof Error ? err.message : "Network request failed",
+          0
+        ),
+        status: 0
+      };
+    }
+    const contentType = response.headers.get("Content-Type") ?? "";
+    let parsed = null;
+    if (method !== "HEAD" && contentType.includes("json")) {
+      parsed = await response.json().catch(() => null);
+    } else if (method !== "HEAD" && contentType.startsWith("image/")) {
+      parsed = new Uint8Array(await response.arrayBuffer());
+    } else if (method !== "HEAD" && response.body) {
+      parsed = await response.text().catch(() => null);
+    }
+    if (!response.ok) {
+      const body = parsed && typeof parsed === "object" ? parsed : {};
+      const code = typeof body.error === "string" && body.error ? body.error : "unknown_error";
+      const message = typeof body.error_description === "string" && body.error_description || response.statusText || "request failed";
+      return {
+        data: null,
+        error: new PalbaseModuleError(code, message, response.status, body),
+        status: response.status
+      };
+    }
+    return { data: parsed, error: null, status: response.status };
+  }
+  return { baseUrl: cfg.baseUrl, request };
+}
+
+// src/clients/documents.ts
+var SEGMENT_RE = /^[A-Za-z0-9_-]+$/;
+function validateSegment(segment, label) {
+  if (!SEGMENT_RE.test(segment)) {
+    throw new Error(`Invalid ${label}: "${segment}". Must match ${SEGMENT_RE.source}`);
+  }
+}
+function buildDocumentRef(http, path) {
+  return {
+    path,
+    async set(data) {
+      return http.request("PUT", `/v1/docs/${path}`, { body: data });
+    },
+    async get() {
+      const response = await http.request("GET", `/v1/docs/${path}`);
+      if (response.error) return { data: null, error: response.error, status: response.status };
+      const raw2 = response.data ?? {};
+      const exists = raw2.exists !== void 0 ? raw2.exists : Boolean(raw2.data || raw2.id);
+      const segments = path.split("/");
+      const id = raw2.id || segments[segments.length - 1] || "";
+      return {
+        data: { id, exists, data: () => raw2.data, ref: { path } },
+        error: null,
+        status: response.status
+      };
+    },
+    async update(data) {
+      return http.request("PATCH", `/v1/docs/${path}`, { body: data });
+    },
+    async delete() {
+      return http.request("DELETE", `/v1/docs/${path}`);
+    },
+    collection(name) {
+      validateSegment(name, "subcollection name");
+      return buildCollectionRef(http, `${path}/${name}`);
+    }
+  };
+}
+function buildCollectionRef(http, path, state = { where: [], orderBy: [] }) {
+  function snapshot(doc) {
+    return {
+      id: doc.id,
+      exists: true,
+      data: () => doc.data,
+      ref: { path: `${path}/${doc.id}` }
+    };
+  }
+  function querySnapshot(docs) {
+    return {
+      docs,
+      empty: docs.length === 0,
+      size: docs.length,
+      docChanges: () => docs.map((doc) => ({ type: "added", doc }))
+    };
+  }
+  return {
+    path,
+    doc(id) {
+      validateSegment(id, "document ID");
+      return buildDocumentRef(http, `${path}/${id}`);
+    },
+    async add(data) {
+      const resp = await http.request("POST", `/v1/docs/${path}`, { body: data });
+      if (resp.error || !resp.data) {
+        return { data: null, error: resp.error, status: resp.status };
+      }
+      return {
+        data: buildDocumentRef(http, `${path}/${resp.data.id}`),
+        error: null,
+        status: resp.status
+      };
+    },
+    // Each narrowing returns a NEW ref. A builder that mutated in place would
+    // leak one caller's filter into a query another caller had already held.
+    where(field, op, value) {
+      return buildCollectionRef(http, path, {
+        ...state,
+        where: [...state.where, { field, op, value }]
+      });
+    },
+    orderBy(field, direction = "asc") {
+      return buildCollectionRef(http, path, {
+        ...state,
+        orderBy: [...state.orderBy, { field, direction }]
+      });
+    },
+    limit(n) {
+      return buildCollectionRef(http, path, { ...state, limit: n });
+    },
+    async get() {
+      const narrowed = state.where.length > 0 || state.orderBy.length > 0 || state.limit !== void 0;
+      const resp = narrowed ? await http.request(
+        "POST",
+        `/v1/docs/${path}/query`,
+        { body: queryBody(state) }
+      ) : await http.request(
+        "GET",
+        `/v1/docs/${path}`
+      );
+      if (resp.error) return { data: null, error: resp.error, status: resp.status };
+      const docs = (resp.data?.documents ?? []).map(snapshot);
+      return { data: querySnapshot(docs), error: null, status: resp.status };
+    }
+  };
+}
+function queryBody(state) {
+  const body = {};
+  if (state.where.length > 0) {
+    body.where = state.where.map((w) => ({ field: w.field, op: w.op, value: w.value }));
+  }
+  if (state.orderBy.length > 0) {
+    body.orderBy = state.orderBy.map((o) => ({ field: o.field, direction: o.direction }));
+  }
+  if (state.limit !== void 0) body.limit = state.limit;
+  return body;
+}
+var MAX_BATCH = 500;
+function buildDocumentsClient(http) {
+  return {
+    /**
+     * `Documents.doc("users/alice")` — segments are collection/documentId PAIRS,
+     * so an odd count addresses a COLLECTION and is refused. Accepting it would
+     * write a document whose id happens to be a collection's name.
+     */
+    doc(path) {
+      const segments = String(path).split("/").filter((s) => s.length > 0);
+      if (segments.length === 0 || segments.length % 2 !== 0) {
+        throw new Error(
+          `Invalid document path: "${path}". Expected collection/documentId pairs, got ${segments.length} segment(s).`
+        );
+      }
+      segments.forEach((s, i) => validateSegment(s, i % 2 === 0 ? "collection name" : "document ID"));
+      return buildDocumentRef(http, segments.join("/"));
+    },
+    collection(name) {
+      validateSegment(name, "collection name");
+      return buildCollectionRef(http, name);
+    },
+    async batch(operations) {
+      if (operations.length > MAX_BATCH) {
+        return {
+          data: null,
+          error: new PalbaseModuleError(
+            "batch_too_large",
+            `Batch size ${operations.length} exceeds maximum of ${MAX_BATCH}`,
+            400
+          ),
+          status: 400
+        };
+      }
+      if (operations.length === 0) return { data: null, error: null, status: 200 };
+      return http.request("POST", "/v1/docs/batch", {
+        body: operations.map((op) => ({ op: op.op, path: op.ref.path, data: op.data }))
+      });
+    }
+  };
+}
+
+// src/clients/flags.ts
+var FLAG_NAME_RE = /^[A-Za-z0-9_.-]+$/;
+function assertFlagName(flagName) {
+  if (!FLAG_NAME_RE.test(flagName)) {
+    throw new Error(`Invalid flag name: "${flagName}". Flag names must match ${FLAG_NAME_RE.source}`);
+  }
+}
+function flagEnabled(value) {
+  if (typeof value === "boolean") return value;
+  return value != null && value !== 0 && value !== "";
+}
+function flagVariant(value) {
+  return typeof value === "string" ? { name: value } : null;
+}
+function isContextObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v) && ("userId" in v || "properties" in v);
+}
+function buildFlagsClient(http, cfg) {
+  function resolveUserId(context) {
+    if (context && "userId" in context) return context.userId ?? null;
+    return cfg.getCurrentUserId() || void 0;
+  }
+  function mergedPath(context) {
+    const uid = resolveUserId(context);
+    return uid ? `/v1/user-flags/users/${encodeURIComponent(uid)}` : "/v1/user-flags";
+  }
+  function fetchMerged(context) {
+    return http.request("GET", mergedPath(context));
+  }
+  const service = {
+    async setOverrideForUser(userId, key, value) {
+      return http.request(
+        "PUT",
+        `/v1/user-flags/users/${encodeURIComponent(userId)}/${encodeURIComponent(key)}`,
+        { body: { value } }
+      );
+    },
+    async setOverridesForUser(userId, values) {
+      return http.request("PUT", `/v1/user-flags/users/${encodeURIComponent(userId)}`, {
+        body: { values }
+      });
+    },
+    async clearOverrideForUser(userId, key) {
+      return http.request(
+        "DELETE",
+        `/v1/user-flags/users/${encodeURIComponent(userId)}/${encodeURIComponent(key)}`
+      );
+    },
+    async clearAllOverridesForUser(userId) {
+      return http.request("DELETE", `/v1/user-flags/users/${encodeURIComponent(userId)}`);
+    },
+    async batchSetOverrides(operations) {
+      const ops = (operations ?? []).map((op) => {
+        const raw2 = op;
+        return { user_id: raw2.userId ?? raw2.user_id, values: raw2.values };
+      });
+      return http.request("POST", "/v1/user-flags/batch", { body: { operations: ops } });
+    }
+  };
+  return {
+    async isEnabled(flagName, context) {
+      assertFlagName(flagName);
+      const res = await fetchMerged(context);
+      if (res.error || res.data == null) return { data: null, error: res.error, status: res.status };
+      return { data: flagEnabled(res.data.values?.[flagName]), error: null, status: res.status };
+    },
+    async getVariant(flagName, context) {
+      assertFlagName(flagName);
+      const res = await fetchMerged(context);
+      if (res.error || res.data == null) return { data: null, error: res.error, status: res.status };
+      return { data: flagVariant(res.data.values?.[flagName]), error: null, status: res.status };
+    },
+    /**
+     * `get(key)` · `get(key, default)` · `get(key, default, ctx)` · `get(key, ctx)`.
+     *
+     * The default is substituted when the flag is ABSENT or when the flags
+     * service is unreachable — a product that hides a feature because a lookup
+     * timed out is behaving correctly; one that crashes is not.
+     */
+    async get(flagName, defaultOrContext, maybeContext) {
+      assertFlagName(flagName);
+      let defaultValue;
+      let context;
+      let hasDefault = false;
+      if (maybeContext !== void 0) {
+        defaultValue = defaultOrContext;
+        hasDefault = true;
+        context = maybeContext;
+      } else if (isContextObject(defaultOrContext)) {
+        context = defaultOrContext;
+      } else if (defaultOrContext !== void 0) {
+        defaultValue = defaultOrContext;
+        hasDefault = true;
+      }
+      const resp = await fetchMerged(context);
+      if (resp.error !== null) {
+        if (hasDefault) return { data: defaultValue ?? null, error: null, status: resp.status };
+        return { data: null, error: resp.error, status: resp.status };
+      }
+      const values = resp.data?.values ?? {};
+      const value = values[flagName];
+      if (value === void 0) {
+        return { data: hasDefault ? defaultValue ?? null : null, error: null, status: resp.status };
+      }
+      return { data: value, error: null, status: resp.status };
+    },
+    async getAll(context) {
+      const res = await fetchMerged(context);
+      if (res.error || res.data == null) return { data: null, error: res.error, status: res.status };
+      const values = res.data.values ?? {};
+      return {
+        data: Object.keys(values).map((name) => {
+          const value = values[name];
+          const flag2 = {
+            name,
+            enabled: flagEnabled(value)
+          };
+          if (typeof value === "string") flag2.variant = { name: value };
+          return flag2;
+        }),
+        error: null,
+        status: res.status
+      };
+    },
+    /**
+     * Override a flag for the CURRENT request user.
+     *
+     * On an anonymous request this does not silently no-op and does not write
+     * for nobody: it refuses and names the call that does cross-user writes.
+     */
+    async setOverride(key, value) {
+      const uid = cfg.getCurrentUserId();
+      if (!uid) {
+        return {
+          data: null,
+          error: {
+            message: "setOverride requires a signed-in user; use Flags.asService().setOverrideForUser(userId, key, value) for cross-user writes"
+          },
+          status: 400
+        };
+      }
+      return http.request(
+        "PUT",
+        `/v1/user-flags/users/${encodeURIComponent(uid)}/${encodeURIComponent(key)}`,
+        { body: { value } }
+      );
+    },
+    asService() {
+      return service;
+    }
+  };
+}
+
+// src/clients/notifications.ts
+function mapEnvelope(res, map) {
+  if (res.error !== null || res.data === null || res.data === void 0) {
+    return { data: null, error: res.error, status: res.status };
+  }
+  return { data: map(res.data), error: null, status: res.status };
+}
+function toEmailTemplate(wire) {
+  const view = {
+    id: wire.id,
+    slug: wire.slug,
+    locale: wire.locale,
+    subject: wire.subject,
+    htmlBody: wire.html_body,
+    variables: wire.variables ?? [],
+    isDefault: wire.is_default,
+    createdAt: wire.created_at,
+    updatedAt: wire.updated_at
+  };
+  if (wire.text_body !== void 0) view.textBody = wire.text_body;
+  return view;
+}
+function toSmsTemplate(wire) {
+  return {
+    id: wire.id,
+    slug: wire.slug,
+    locale: wire.locale,
+    body: wire.body,
+    variables: wire.variables ?? [],
+    isDefault: wire.is_default,
+    createdAt: wire.created_at,
+    updatedAt: wire.updated_at
+  };
+}
+function buildNotificationsClient(http) {
+  const push = {
+    async send(params) {
+      return http.request("POST", "/v1/notifications/push", { body: params });
+    }
+  };
+  const email = {
+    async send(params) {
+      const { templateSlug, html, text: text2, ...rest } = params;
+      const body = { ...rest };
+      if (templateSlug !== void 0) body.template_slug = templateSlug;
+      if (html !== void 0) body.html_body = html;
+      if (text2 !== void 0) body.text_body = text2;
+      return http.request("POST", "/v1/notifications/email", { body });
+    }
+  };
+  const sms = {
+    async send(params) {
+      const { templateSlug, ...rest } = params;
+      const body = templateSlug !== void 0 ? { ...rest, template_slug: templateSlug } : rest;
+      return http.request("POST", "/v1/notifications/sms", { body });
+    }
+  };
+  const verifications = {
+    async start(params) {
+      return http.request("POST", "/v1/notifications/verifications", { body: params });
+    },
+    async check(params) {
+      return http.request("POST", "/v1/notifications/verifications/check", { body: params });
+    }
+  };
+  const inbox = {
+    async send(params) {
+      return http.request("POST", "/v1/notifications/inbox", { body: params });
+    },
+    async list(options) {
+      const opts = options ?? {};
+      const params = new URLSearchParams();
+      if (opts.cursor) params.set("cursor", opts.cursor);
+      if (opts.limit !== void 0) params.set("limit", String(opts.limit));
+      if (opts.is_read !== void 0) params.set("is_read", opts.is_read ? "true" : "false");
+      if (opts.category) params.set("category", opts.category);
+      if (opts.include_archived) params.set("include_archived", "true");
+      const query = params.toString();
+      return http.request("GET", `/v1/notifications/inbox${query ? `?${query}` : ""}`);
+    },
+    async unreadCount() {
+      return http.request("GET", "/v1/notifications/inbox/unread-count");
+    },
+    async markRead(id) {
+      return http.request("PATCH", `/v1/notifications/inbox/${encodeURIComponent(id)}/read`);
+    },
+    async markAllRead() {
+      return http.request("POST", "/v1/notifications/inbox/read-all");
+    },
+    async archive(id) {
+      return http.request("DELETE", `/v1/notifications/inbox/${encodeURIComponent(id)}`);
+    }
+  };
+  const preferences = {
+    async get() {
+      return http.request("GET", "/v1/notifications/preferences");
+    },
+    async update(params) {
+      return http.request("PUT", "/v1/notifications/preferences", { body: params });
+    }
+  };
+  const emailTemplates = {
+    async list() {
+      const resp = await http.request("GET", "/v1/notifications/templates");
+      return mapEnvelope(resp, (rows) => (rows ?? []).map(toEmailTemplate));
+    },
+    async get(id) {
+      const resp = await http.request(
+        "GET",
+        `/v1/notifications/templates/${encodeURIComponent(id)}`
+      );
+      return mapEnvelope(resp, toEmailTemplate);
+    },
+    async create(input) {
+      const body = {
+        slug: input.slug,
+        subject: input.subject,
+        html_body: input.htmlBody
+      };
+      if (input.textBody !== void 0) body.text_body = input.textBody;
+      if (input.variables !== void 0) body.variables = input.variables;
+      const resp = await http.request("POST", "/v1/notifications/templates", { body });
+      return mapEnvelope(resp, toEmailTemplate);
+    },
+    async update(id, input) {
+      const body = {};
+      if (input.subject !== void 0) body.subject = input.subject;
+      if (input.htmlBody !== void 0) body.html_body = input.htmlBody;
+      if (input.textBody !== void 0) body.text_body = input.textBody;
+      if (input.variables !== void 0) body.variables = input.variables;
+      const resp = await http.request(
+        "PUT",
+        `/v1/notifications/templates/${encodeURIComponent(id)}`,
+        { body }
+      );
+      return mapEnvelope(resp, toEmailTemplate);
+    },
+    async delete(id) {
+      return http.request("DELETE", `/v1/notifications/templates/${encodeURIComponent(id)}`);
+    }
+  };
+  const smsTemplates = {
+    async list() {
+      const resp = await http.request("GET", "/v1/notifications/sms-templates");
+      return mapEnvelope(resp, (rows) => (rows ?? []).map(toSmsTemplate));
+    },
+    async get(id) {
+      const resp = await http.request(
+        "GET",
+        `/v1/notifications/sms-templates/${encodeURIComponent(id)}`
+      );
+      return mapEnvelope(resp, toSmsTemplate);
+    },
+    async create(input) {
+      const body = { slug: input.slug, body: input.body };
+      if (input.variables !== void 0) body.variables = input.variables;
+      const resp = await http.request("POST", "/v1/notifications/sms-templates", { body });
+      return mapEnvelope(resp, toSmsTemplate);
+    },
+    async update(id, input) {
+      const body = {};
+      if (input.body !== void 0) body.body = input.body;
+      if (input.variables !== void 0) body.variables = input.variables;
+      const resp = await http.request(
+        "PUT",
+        `/v1/notifications/sms-templates/${encodeURIComponent(id)}`,
+        { body }
+      );
+      return mapEnvelope(resp, toSmsTemplate);
+    },
+    async delete(id) {
+      return http.request("DELETE", `/v1/notifications/sms-templates/${encodeURIComponent(id)}`);
+    }
+  };
+  return {
+    push,
+    email,
+    sms,
+    verifications,
+    inbox,
+    preferences,
+    templates: { email: emailTemplates, sms: smsTemplates },
+    async registerDevice(params) {
+      return http.request("POST", "/v1/notifications/devices", { body: params });
+    },
+    async unregisterDevice(deviceId) {
+      return http.request("DELETE", `/v1/notifications/devices/${encodeURIComponent(deviceId)}`);
+    }
+  };
+}
+
+// src/clients/realtime.ts
+import { createHmac } from "crypto";
+function mintToken(secret2) {
+  const now2 = Math.floor(Date.now() / 1e3);
+  const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
+  const payload = Buffer.from(
+    JSON.stringify({ iss: "backend-runtime", role: "service_role", iat: now2, exp: now2 + 60 })
+  ).toString("base64url");
+  const sig = createHmac("sha256", secret2).update(`${header}.${payload}`).digest("base64url");
+  return `${header}.${payload}.${sig}`;
+}
+function buildRealtimeClient(cfg) {
+  const url = `${cfg.baseUrl}/realtime/api/broadcast`;
+  return {
+    async broadcast(channel, event, payload) {
+      if (typeof channel !== "string" || channel.length === 0) {
+        return {
+          data: null,
+          error: new PalbaseModuleError("invalid_argument", "channel must be a non-empty string", 400)
+        };
+      }
+      if (typeof event !== "string" || event.length === 0) {
+        return {
+          data: null,
+          error: new PalbaseModuleError("invalid_argument", "event must be a non-empty string", 400)
+        };
+      }
+      if (!cfg.apiJwtSecret) {
+        return {
+          data: null,
+          error: new PalbaseModuleError(
+            "realtime_unconfigured",
+            "Realtime.broadcast is unavailable: realtime is not provisioned for this Environment (PALBASE_REALTIME_API_JWT_SECRET unset).",
+            503
+          )
+        };
+      }
+      let token;
+      try {
+        token = mintToken(cfg.apiJwtSecret);
+      } catch (err) {
+        return {
+          data: null,
+          error: new PalbaseModuleError(
+            "realtime_token_error",
+            err instanceof Error ? err.message : "token mint failed",
+            500
+          )
+        };
+      }
+      const body = JSON.stringify({
+        messages: [{ topic: channel, event, payload: payload ?? {}, private: false }]
+      });
+      const doFetch = cfg.fetchImpl ?? globalThis.fetch;
+      let response;
+      try {
+        response = await doFetch(url, {
+          method: "POST",
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+          body
+        });
+      } catch (err) {
+        return {
+          data: null,
+          error: new PalbaseModuleError(
+            "network_error",
+            err instanceof Error ? err.message : "broadcast request failed",
+            0
+          )
+        };
+      }
+      if (response.status === 202 || response.status === 200) {
+        return { data: void 0, error: null };
+      }
+      const detail = await response.text().catch(() => "");
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "realtime_broadcast_failed",
+          `broadcast returned ${response.status}: ${detail.slice(0, 200)}`,
+          response.status
+        )
+      };
+    }
+  };
+}
+
+// src/clients/storage.ts
+var BUCKET_NAME_RE = /^[a-zA-Z0-9_-]+$/;
+var STORAGE_PATH_RE = /^[a-zA-Z0-9_./-]+$/;
+var STORAGE_TRAVERSAL_RE = /(?:^|\/)\.\.(?:\/|$)/;
+function validateStoragePath(p) {
+  if (!STORAGE_PATH_RE.test(p) || STORAGE_TRAVERSAL_RE.test(p)) {
+    throw new Error(
+      `Invalid file path: "${p}". Paths must not contain traversal sequences and must match ${STORAGE_PATH_RE.source}`
+    );
+  }
+}
+function toFileObject(bucket2, row) {
+  return {
+    name: row.path ?? "",
+    path: row.path ?? "",
+    bucket: row.bucket ?? bucket2,
+    size: typeof row.size === "number" ? row.size : 0,
+    contentType: row.contentType ?? "",
+    checksum: row.checksum ?? "",
+    width: row.width,
+    height: row.height,
+    thumbhash: row.thumbhash,
+    variants: row.variants ?? {}
+  };
+}
+function mapResponse(res, map) {
+  if (res.error || res.data === null || res.data === void 0) {
+    return { data: null, error: res.error, status: res.status };
+  }
+  return { data: map(res.data), error: null, status: res.status };
+}
+function buildBucketClient(http, bucketName) {
+  const objectPath = (path) => `/v1/storage/object/${bucketName}/${path}`;
+  return {
+    async upload(path, file, options) {
+      validateStoragePath(path);
+      const headers = {
+        "Content-Type": options?.contentType ?? "application/octet-stream"
+      };
+      if (options?.upsert) headers["x-upsert"] = "true";
+      const body = file instanceof ArrayBuffer ? new Uint8Array(file) : file;
+      const res = await http.request("PUT", objectPath(path), {
+        body,
+        headers
+      });
+      return mapResponse(res, (r) => toFileObject(bucketName, r ?? {}));
+    },
+    async download(path) {
+      validateStoragePath(path);
+      return http.request("GET", objectPath(path), { headers: { Accept: "*/*" } });
+    },
+    getPublicUrl(path, options) {
+      validateStoragePath(path);
+      const variant = options?.variant ? `?variant=${encodeURIComponent(options.variant)}` : "";
+      return `/v1/files/${bucketName}/${path}${variant}`;
+    },
+    async createSignedUrl(path, options) {
+      validateStoragePath(path);
+      return http.request("POST", `/v1/storage/sign/${bucketName}/${path}`, {
+        body: { expiresIn: options.expiresIn }
+      });
+    },
+    async list(prefix, options) {
+      if (prefix) validateStoragePath(prefix);
+      const params = new URLSearchParams();
+      if (prefix) params.set("prefix", prefix);
+      if (options?.limit !== void 0) params.set("limit", String(options.limit));
+      const query = params.toString();
+      const res = await http.request(
+        "GET",
+        `/v1/storage/bucket/${bucketName}${query ? `?${query}` : ""}`
+      );
+      return mapResponse(res, (body) => (body?.objects ?? []).map((row) => toFileObject(bucketName, row)));
+    },
+    async remove(paths) {
+      for (const p of paths) validateStoragePath(p);
+      const removed = [];
+      for (const p of paths) {
+        const res = await http.request("DELETE", objectPath(p));
+        if (res.error) return { data: null, error: res.error, status: res.status };
+        removed.push(toFileObject(bucketName, { path: p }));
+      }
+      return { data: removed, error: null, status: 200 };
+    },
+    async move(from, to) {
+      validateStoragePath(from);
+      validateStoragePath(to);
+      return http.request("POST", `/v1/storage/move/${bucketName}`, { body: { from, to } });
+    },
+    async copy(from, to) {
+      validateStoragePath(from);
+      validateStoragePath(to);
+      return http.request("POST", `/v1/storage/copy/${bucketName}`, { body: { from, to } });
+    }
+  };
+}
+function buildStorageClient(http) {
+  return {
+    bucket(name) {
+      if (!BUCKET_NAME_RE.test(name)) {
+        throw new Error(`Invalid bucket name: "${name}". Bucket names must match ${BUCKET_NAME_RE.source}`);
+      }
+      return buildBucketClient(http, name);
+    }
+  };
+}
+
+// src/clients/index.ts
+function buildModuleClients(cfg) {
+  const baseUrl = (cfg.baseUrl || "").replace(/\/+$/, "");
+  if (!baseUrl) return {};
+  const apiKey = cfg.serviceRoleKey || cfg.apiKey || "";
+  const http = makeHttpClient({ baseUrl, apiKey, fetchImpl: cfg.fetchImpl });
+  return {
+    Documents: buildDocumentsClient(http),
+    Storage: buildStorageClient(http),
+    Notifications: buildNotificationsClient(http),
+    Flags: buildFlagsClient(http, { getCurrentUserId: cfg.getCurrentUserId }),
+    Realtime: buildRealtimeClient({
+      baseUrl,
+      apiJwtSecret: cfg.realtimeApiJwtSecret,
+      fetchImpl: cfg.fetchImpl
+    })
+  };
+}
+
 // src/purchases/keys-gen.ts
 function liveKeys(entries) {
   return Object.entries(entries ?? {}).filter(([, def]) => def?.removed !== true).map(([key]) => key).sort();
@@ -422,6 +1019,89 @@ export {};
 `;
 }
 
+// src/db/schema-json.ts
+function defOf(column) {
+  return "_def" in column ? column._def : column;
+}
+function columnToJSON(column) {
+  const def = defOf(column);
+  const out = {
+    type: def.type,
+    nullable: def.nullable,
+    primaryKey: def.primaryKey
+  };
+  if (def.defaultValue !== void 0) out.defaultValue = def.defaultValue;
+  if (def.defaultRandom === true) out.defaultRandom = true;
+  if (def.defaultNow === true) out.defaultNow = true;
+  if (def.renamedFrom !== void 0) out.renamedFrom = def.renamedFrom;
+  if (def.references !== void 0) {
+    out.references = { table: def.references.table, column: def.references.column };
+  }
+  if (def.onDeleteAction !== void 0) out.onDeleteAction = def.onDeleteAction;
+  if (def.enumName !== void 0) out.enumName = def.enumName;
+  if (def.enumValues !== void 0) out.enumValues = [...def.enumValues];
+  if (def.unique === true) out.unique = true;
+  return out;
+}
+function policyToJSON(policy2) {
+  return {
+    name: policy2.name,
+    command: policy2.command ?? "all",
+    roles: policy2.roles ? [...policy2.roles] : [],
+    // null rather than omitted: a policy with no USING clause is a different
+    // thing from one whose clause the emitter forgot, and Go reads the
+    // difference.
+    using: policy2.using ?? null,
+    withCheck: policy2.withCheck ?? null,
+    permissive: policy2.permissive !== false
+  };
+}
+function tableToJSON(table) {
+  const columns = {};
+  for (const [name, column] of Object.entries(table.columns)) {
+    columns[name] = columnToJSON(column);
+  }
+  const out = {
+    name: table.name,
+    columns,
+    // Read, not re-derived. `defineSchema` already resolves the fail-closed
+    // default (RLS on unless the author wrote `rls: false`, and forced on by any
+    // policy), and a second copy of a SECURITY default is exactly the thing that
+    // drifts — the direction it drifted last time was "expose everything", and
+    // the live proof was one user reading another's rows.
+    rls: table.rls,
+    policies: (table.policies ?? []).map(policyToJSON)
+  };
+  if (table.primaryKey !== void 0 && table.primaryKey.length > 0) {
+    out.primaryKey = [...table.primaryKey];
+  }
+  if (table.unique !== void 0 && table.unique.length > 0) {
+    out.uniqueConstraints = table.unique.map((u) => ({ name: u.name, columns: [...u.columns] }));
+  }
+  if (table.raw !== void 0 && table.raw.length > 0) {
+    out.rawConstraints = table.raw.map((r) => ({
+      name: r.name,
+      up: r.up,
+      down: r.down ?? null
+    }));
+  }
+  if (table.checks !== void 0 && table.checks.length > 0) {
+    out.checks = table.checks.map((c) => ({ name: c.name, expr: c.expr }));
+  }
+  if (table.indexes !== void 0 && table.indexes.length > 0) {
+    out.indexes = table.indexes.map((i) => ({ name: i.name, columns: [...i.columns] }));
+  }
+  return out;
+}
+function toSchemaJSON(schema) {
+  const tables = {};
+  for (const table of Object.values(schema.tables)) {
+    const json = tableToJSON(table);
+    tables[json.name] = json;
+  }
+  return { tables, extensions: [...new Set(schema.extensions ?? [])] };
+}
+
 // src/db/env-gen.ts
 function baseTsType(def) {
   switch (def.type) {
@@ -552,6 +1232,7 @@ export {};
 // src/config/storage.ts
 var STORAGE_CONFIG_KIND = "storage";
 var VARIANT_FORMATS = ["webp", "avif", "jpeg", "png"];
+var VARIANT_FITS = ["cover", "contain", "inside"];
 function normalizeVariants(input) {
   if (input === null || typeof input !== "object" || Array.isArray(input)) {
     throw new Error("bucket variants must be an object of { <name>: { width?, height?, format? } }");
@@ -581,10 +1262,26 @@ function normalizeVariants(input) {
         `bucket variant "${name}" format must be one of ${VARIANT_FORMATS.join(", ")}, got "${String(spec.format)}"`
       );
     }
+    if (spec.fit !== void 0 && !VARIANT_FITS.includes(spec.fit)) {
+      throw new Error(
+        `bucket variant "${name}" fit must be one of ${VARIANT_FITS.join(", ")}, got "${String(spec.fit)}"`
+      );
+    }
+    if (spec.quality !== void 0) {
+      const q = spec.quality;
+      if (typeof q !== "number" || !Number.isInteger(q) || q < 1 || q > 100) {
+        throw new Error(`bucket variant "${name}" quality must be an integer 1\u2013100, got ${String(q)}`);
+      }
+    }
+    if (spec.fit === "cover" && (spec.width === void 0 || spec.height === void 0)) {
+      throw new Error(`bucket variant "${name}" uses fit "cover", which needs BOTH width and height`);
+    }
     out[name] = {
       ...spec.width !== void 0 ? { width: spec.width } : {},
       ...spec.height !== void 0 ? { height: spec.height } : {},
-      ...spec.format !== void 0 ? { format: spec.format } : {}
+      ...spec.fit !== void 0 ? { fit: spec.fit } : {},
+      ...spec.format !== void 0 ? { format: spec.format } : {},
+      ...spec.quality !== void 0 ? { quality: spec.quality } : {}
     };
   }
   return out;
@@ -1115,138 +1812,55 @@ function defineFlags(input) {
   return { __config: FLAGS_CONFIG_KIND, flags };
 }
 
-// src/decorators/registry.ts
-var ROUTES = /* @__PURE__ */ Symbol.for("palbase.backend.routes");
-var PARAM_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.paramBuffer");
-var RETURN_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.returnBuffer");
-var THROWS_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.throwsBuffer");
-function carrierOf2(target) {
-  const ctor = typeof target === "function" ? target : target.constructor ?? target;
-  return ctor;
-}
-function ownRoutes(carrier) {
-  if (!Object.prototype.hasOwnProperty.call(carrier, ROUTES)) {
-    carrier[ROUTES] = [];
-  }
-  return carrier[ROUTES];
-}
-function ownParamBuffer(carrier) {
-  if (!Object.prototype.hasOwnProperty.call(carrier, PARAM_BUFFER)) {
-    carrier[PARAM_BUFFER] = {};
-  }
-  return carrier[PARAM_BUFFER];
-}
-function recordRoute(target, fnName, method, subpath, options) {
-  const carrier = carrierOf2(target);
-  const routes = ownRoutes(carrier);
-  const buffer = ownParamBuffer(carrier);
-  const params = (buffer[fnName] ?? []).slice().sort((a, b) => a.index - b.index);
-  const route = { method, subpath, fnName, options, params };
-  const returnBuffer = carrier[RETURN_BUFFER];
-  if (returnBuffer && returnBuffer[fnName] !== void 0) {
-    route.returnSchema = returnBuffer[fnName];
-  }
-  const throwsBuffer = carrier[THROWS_BUFFER];
-  if (throwsBuffer && throwsBuffer[fnName] !== void 0) {
-    route.throws = throwsBuffer[fnName];
-  }
-  routes.push(route);
-}
-function recordParam(target, fnName, meta) {
-  const carrier = carrierOf2(target);
-  const buffer = ownParamBuffer(carrier);
-  (buffer[fnName] ??= []).push(meta);
-  const routes = carrier[ROUTES];
-  if (routes) {
-    const route = routes.find((r) => r.fnName === fnName);
-    if (route) {
-      route.params.push(meta);
-      route.params.sort((a, b) => a.index - b.index);
-    }
-  }
-}
-function recordThrows(target, fnName, throws) {
-  const carrier = carrierOf2(target);
-  const routes = carrier[ROUTES];
-  const route = routes?.find((r) => r.fnName === fnName);
-  if (route) {
-    route.throws = throws;
-    return;
-  }
-  if (!Object.prototype.hasOwnProperty.call(carrier, THROWS_BUFFER)) {
-    carrier[THROWS_BUFFER] = {};
-  }
-  const throwsBuffer = carrier[THROWS_BUFFER];
-  if (throwsBuffer) throwsBuffer[fnName] = throws;
-}
-function getRoutes(ctor) {
-  const carrier = carrierOf2(ctor);
-  const routes = carrier[ROUTES] ?? [];
-  const returnBuffer = carrier[RETURN_BUFFER];
-  if (returnBuffer) {
-    for (const route of routes) {
-      const buffered = returnBuffer[route.fnName];
-      if (buffered && route.returnSchema === void 0) {
-        route.returnSchema = buffered;
-      }
+// src/config/secrets.ts
+var SECRETS_CONFIG_KIND = "secrets";
+var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
+function secret(name, opts = {}) {
+  if (typeof name !== "string" || !SECRET_NAME_RE.test(name)) {
+    throw new Error(
+      `secret name ${JSON.stringify(name)} is invalid \u2014 must be an environment-variable name: an uppercase letter, then uppercase letters, digits, and underscores (e.g. "NEO4J_PASSWORD")`
+    );
+  }
+  if (opts === null || typeof opts !== "object") {
+    throw new Error(`secret("${name}") expects { required?, description? }`);
+  }
+  let required = true;
+  if (opts.required !== void 0) {
+    if (typeof opts.required !== "boolean") {
+      throw new Error(`secret("${name}") required must be a boolean`);
     }
+    required = opts.required;
   }
-  const throwsBuffer = carrier[THROWS_BUFFER];
-  if (throwsBuffer) {
-    for (const route of routes) {
-      const buffered = throwsBuffer[route.fnName];
-      if (buffered && route.throws === void 0) {
-        route.throws = buffered;
-      }
+  let description = null;
+  if (opts.description !== void 0) {
+    if (typeof opts.description !== "string") {
+      throw new Error(`secret("${name}") description must be a string`);
     }
+    const trimmed = opts.description.trim();
+    description = trimmed.length > 0 ? trimmed : null;
   }
-  return routes.map((r) => ({
-    ...r,
-    params: r.params.slice(),
-    ...r.throws !== void 0 ? { throws: r.throws.slice() } : {}
-  }));
+  return { name, required, description };
 }
-
-// src/decorators/controller.ts
-var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta");
-var RESERVED_FIRST_SEGMENT = "webhooks";
-function assertNotReserved(path, subject) {
-  const [first] = path.split("/").filter(Boolean);
-  if (first === RESERVED_FIRST_SEGMENT) {
-    throw new Error(
-      `${subject} resolves under the reserved /${RESERVED_FIRST_SEGMENT} path \u2014 inbound webhooks are served there and would shadow this route`
-    );
+function defineSecrets(input) {
+  if (input === null || typeof input !== "object" || !Array.isArray(input.secrets)) {
+    throw new Error('defineSecrets expects { secrets: [secret("NAME"), ...] }');
   }
-}
-function Controller(basePath, options = {}) {
-  return function(ctor) {
-    assertNotReserved(basePath, `@Controller("${basePath}")`);
-    for (const route of getRoutes(ctor)) {
-      assertNotReserved(
-        `${basePath}${route.subpath}`,
-        `@${route.method}("${route.subpath}") in @Controller("${basePath}")`
+  const byName = /* @__PURE__ */ new Map();
+  for (const def of input.secrets) {
+    if (def === null || typeof def !== "object" || typeof def.name !== "string" || typeof def.required !== "boolean") {
+      throw new Error(
+        `defineSecrets: every entry must come from secret() \u2014 got ${JSON.stringify(def)}`
       );
     }
-    const carrier = ctor;
-    const meta = {
-      __palbase: "controller",
-      basePath,
-      ...options.auth !== void 0 ? { defaultAuth: options.auth } : {}
-    };
-    Object.defineProperty(carrier, CONTROLLER_META, {
-      value: meta,
-      enumerable: false,
-      configurable: true,
-      writable: false
-    });
-    Object.defineProperty(carrier, "__palbase", {
-      value: "controller",
-      enumerable: false,
-      configurable: true,
-      writable: false
-    });
-    return ctor;
-  };
+    if (byName.has(def.name)) {
+      throw new Error(
+        `secret "${def.name}" is declared twice in config/secrets.ts \u2014 remove one; a name has exactly one requirement`
+      );
+    }
+    byName.set(def.name, def);
+  }
+  const secrets = [...byName.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return { __config: SECRETS_CONFIG_KIND, secrets };
 }
 
 // src/decorators/methods.ts
@@ -1358,149 +1972,15 @@ function defineMiddleware(fn) {
   return fn;
 }
 
-// src/error-registry.ts
-import {
-  OpenAPIRegistry,
-  OpenApiGeneratorV31,
-  extendZodWithOpenApi
-} from "@asteasolutions/zod-to-openapi";
-import { z } from "zod";
-extendZodWithOpenApi(z);
-var ERROR_REGISTRY = /* @__PURE__ */ Symbol.for("palbase.backend.errorRegistry");
-var BUILTIN_DATA_SCHEMAS = {
-  bad_request: z.object({
-    fields: z.array(z.object({ field: z.string(), message: z.string() }))
-  }),
-  too_many_requests: z.object({ retryAfter: z.number().int() }),
-  // Purchases (@RequireEntitlement / @Spend). Their payloads are what make a
-  // paywall renderable on the client: WHICH entitlement was missing, and for a
-  // spend the real ceiling and reset time rather than a guessed retry delay.
-  entitlement_required: z.object({ entitlement: z.string().nullable() }),
-  quota_exceeded: z.object({
-    key: z.string(),
-    scope: z.string(),
-    window: z.string(),
-    used: z.number().int(),
-    reserved: z.number().int(),
-    max: z.number().int(),
-    remaining: z.number().int(),
-    resetAt: z.string()
-  }),
-  credit_insufficient: z.object({
-    key: z.string(),
-    balance: z.number().int(),
-    reserved: z.number().int(),
-    remaining: z.number().int()
-  })
-};
-function getErrorRegistry() {
-  const g = globalThis;
-  if (!g[ERROR_REGISTRY]) {
-    const m = /* @__PURE__ */ new Map();
-    for (const [code, status, className] of [
-      ["bad_request", 400, "BadRequest"],
-      ["unauthorized", 401, "Unauthorized"],
-      ["forbidden", 403, "Forbidden"],
-      ["not_found", 404, "NotFound"],
-      ["conflict", 409, "Conflict"],
-      ["too_many_requests", 429, "TooManyRequests"],
-      // Thrown by the purchases decorators, so they are pre-seeded like the
-      // other built-ins: a project never declares them, but every gated or
-      // metered route must surface them as TYPED errors on the client.
-      ["entitlement_required", 403, "EntitlementRequired"],
-      ["quota_exceeded", 429, "QuotaExceeded"],
-      ["credit_insufficient", 429, "CreditInsufficient"]
-    ]) {
-      const dataSchema = BUILTIN_DATA_SCHEMAS[code];
-      m.set(code, {
-        code,
-        status,
-        className,
-        builtin: true,
-        ...dataSchema ? { dataSchema, dataDigest: digestOf(code, dataSchema) } : {}
-      });
-    }
-    g[ERROR_REGISTRY] = m;
-  }
-  return g[ERROR_REGISTRY];
-}
-function defineError(code, status, dataSchema) {
-  if (!Number.isInteger(status) || status < 400 || status > 599) {
-    throw new Error(
-      `defineError: status for "${code}" must be a 4xx/5xx integer, got ${status} \u2014 error responses must not clobber success responses in the project spec.`
-    );
-  }
-  const registry2 = getErrorRegistry();
-  const existing = registry2.get(code);
-  const className = defaultClassName(code);
-  const dataDigest = dataSchema ? digestOf(code, dataSchema) : void 0;
-  if (existing) {
-    const sameShape = existing.status === status && !existing.builtin && existing.dataDigest === dataDigest;
-    if (!sameShape) {
-      throw new Error(
-        `defineError: duplicate error code "${code}" with a different shape (existing: status ${existing.status}${existing.builtin ? ", built-in" : ""}${existing.status === status && !existing.builtin ? ", different data schema" : ""}). Error codes are project-unique.`
-      );
-    }
-  }
-  const makeWithData = (schema) => class extends HttpError {
-    static code = code;
-    static status = status;
-    constructor(data, message) {
-      super(status, code, message ?? humanize(code), schema.parse(data));
-      this.name = className;
-    }
-  };
-  const makeWithoutData = () => class extends HttpError {
-    static code = code;
-    static status = status;
-    constructor(message) {
-      super(status, code, message ?? humanize(code));
-      this.name = className;
-    }
-  };
-  const cls = dataSchema ? makeWithData(dataSchema) : makeWithoutData();
-  Object.defineProperty(cls, "name", { value: className });
-  registry2.set(code, {
-    code,
-    status,
-    className,
-    builtin: false,
-    ...dataSchema ? { dataSchema } : {},
-    ...dataDigest !== void 0 ? { dataDigest } : {}
-  });
-  return cls;
-}
-function digestOf(code, dataSchema) {
-  const TMP_REF = "__PalbaseErrorDataDigest";
-  const tmpRegistry = new OpenAPIRegistry();
-  tmpRegistry.register(TMP_REF, z.object({ data: dataSchema }).openapi(TMP_REF));
-  const generated = new OpenApiGeneratorV31(tmpRegistry.definitions).generateComponents();
-  const out = generated.components?.schemas?.[TMP_REF];
-  const digest = JSON.stringify(out ?? null);
-  if (digest.includes('"$ref"')) {
-    throw new Error(
-      `defineError: dataSchema for "${code}" carries .openapi(refId) metadata \u2014 it would emit dangling $ref pointers in the project spec. Use a plain zod schema (z.object({...})) without .openapi(...).`
-    );
-  }
-  return digest;
-}
-function defaultClassName(code) {
-  return code.split("_").map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join("");
-}
-function humanize(code) {
-  const s = code.replace(/_/g, " ");
-  return s.charAt(0).toUpperCase() + s.slice(1);
-}
-
 // src/decorators/webhook.ts
 var WEBHOOK_META = /* @__PURE__ */ Symbol.for("palbase.backend.webhookMeta");
 var WEBHOOK_EVENTS = /* @__PURE__ */ Symbol.for("palbase.backend.webhookEvents");
-function carrierOf3(ctor) {
+function carrierOf(ctor) {
   return ctor;
 }
 function Webhook(options) {
   return function(ctor) {
-    const carrier = carrierOf3(ctor);
+    const carrier = carrierOf(ctor);
     Object.defineProperty(carrier, WEBHOOK_META, {
       value: options,
       enumerable: false,
@@ -1518,7 +1998,7 @@ function Webhook(options) {
 }
 function On(event) {
   return function(target, fnName) {
-    const carrier = carrierOf3(target.constructor);
+    const carrier = carrierOf(target.constructor);
     const existing = carrier[WEBHOOK_EVENTS];
     const entries = existing ? [...existing] : [];
     entries.push({ event, fnName: String(fnName) });
@@ -1531,7 +2011,7 @@ function On(event) {
   };
 }
 function getWebhookConfig(ctor) {
-  const carrier = carrierOf3(ctor);
+  const carrier = carrierOf(ctor);
   const meta = carrier[WEBHOOK_META];
   const entries = carrier[WEBHOOK_EVENTS] ?? [];
   if (!meta) {
@@ -1789,7 +2269,7 @@ var documents = {
 };
 
 // src/index.ts
-import { z as z2 } from "zod";
+import { z } from "zod";
 export {
   BadRequest,
   Body,
@@ -1822,6 +2302,7 @@ export {
   PALBASE_EXTENSIONS,
   PROVIDER_CATALOG,
   PalError,
+  PalbaseModuleError,
   Param,
   Patch,
   PolicyBuilder,
@@ -1836,7 +2317,9 @@ export {
   RequestId,
   RequireEntitlement,
   Resource,
+  SECRETS_CONFIG_KIND,
   STORAGE_CONFIG_KIND,
+  Secrets,
   Spend,
   Storage,
   TEST_USERS_CONFIG_KIND,
@@ -1852,6 +2335,7 @@ export {
   __getRuntime,
   __registerResource,
   __requestALS,
+  __resetRegisteredControllers,
   __runResourceBoot,
   __runWithRuntime,
   __setRuntime,
@@ -1860,6 +2344,7 @@ export {
   bigint,
   boolean,
   bucket,
+  buildModuleClients,
   buildProvider,
   dec,
   defineEgress,
@@ -1868,6 +2353,7 @@ export {
   defineMiddleware,
   defineNotifications,
   defineSchema,
+  defineSecrets,
   defineStorage,
   defineTestUsers,
   documents,
@@ -1877,6 +2363,7 @@ export {
   flag,
   getErrorRegistry,
   getJobConfig,
+  getRegisteredControllers,
   getRoutes,
   getWebhookConfig,
   inc,
@@ -1884,6 +2371,7 @@ export {
   isPalbaseExtension,
   jsonb,
   makeEnvDts,
+  makeHttpClient,
   makePurchasesDts,
   makeTypedDB,
   now,
@@ -1893,13 +2381,15 @@ export {
   raw,
   recordThrows,
   reservedSecretKey,
+  secret,
   spendFor,
   storage,
   testUser,
   text,
   timestamp,
+  toSchemaJSON,
   uuid,
   validateUploadAgainstStorage,
-  z2 as z
+  z
 };
 //# sourceMappingURL=index.js.map