@palbase/backend 17.4.0 → 18.0.0

package/dist/chunk-VYH4U7ZQ.js

@@ -0,0 +1,1138 @@
+import {
+  __requestALS,
+  __runWithRuntime
+} from "./chunk-POYAFBLF.js";
+import {
+  getRoutes,
+  isHttpError
+} from "./chunk-QMVK4X3V.js";
+
+// src/engine/config.ts
+var BootRefused = class extends Error {
+  missing;
+  constructor(missing, message) {
+    super(message);
+    this.name = "BootRefused";
+    this.missing = missing;
+  }
+};
+var MANDATORY = [
+  { key: "DATABASE_URL", what: "the stack's Postgres (Database module)" },
+  { key: "AUTH_JWKS_URL", what: "where this stack publishes its token signing keys (Auth module)" }
+];
+function loadConfig(env) {
+  const missing = MANDATORY.filter((m) => !env[m.key]?.trim()).map((m) => m.key);
+  if (missing.length > 0) {
+    const detail = MANDATORY.filter((m) => missing.includes(m.key)).map((m) => `  ${m.key.padEnd(16)}${m.what}`).join("\n");
+    throw new BootRefused(
+      missing,
+      `boot refused: mandatory module not configured \u2014 missing ${missing.join(", ")}.
+${detail}`
+    );
+  }
+  const port = Number(env.PORT ?? 3e3);
+  if (!Number.isInteger(port) || port < 0 || port > 65535) {
+    throw new BootRefused([], `boot refused: PORT is not a valid port number (got ${env.PORT}).`);
+  }
+  const poolMax = Number(env.DB_POOL_MAX ?? 10);
+  if (!Number.isInteger(poolMax) || poolMax < 1) {
+    throw new BootRefused([], `boot refused: DB_POOL_MAX must be a positive integer (got ${env.DB_POOL_MAX}).`);
+  }
+  return {
+    databaseUrl: env.DATABASE_URL.trim(),
+    authJwksUrl: env.AUTH_JWKS_URL.trim(),
+    authIssuer: env.AUTH_ISSUER?.trim() || void 0,
+    moduleBaseUrl: (env.MODULE_BASE_URL ?? "").replace(/\/+$/, ""),
+    // The secret storage signs its two internal calls with (authorize, and the
+    // completion that runs an @Upload handler). Empty means uploads are not
+    // wired, and both calls REFUSE — an unsigned completion would let anyone
+    // who knows a route path invent an upload that never happened.
+    uploadSecret: env.PALBASE_UPLOAD_SECRET ?? "",
+    anonKey: env.PALBASE_ANON_KEY ?? "",
+    serviceRoleKey: env.PALBASE_SERVICE_ROLE_KEY ?? "",
+    realtimeSecret: env.REALTIME_INGESTION_SECRET ?? "",
+    port,
+    dbRole: env.DB_ROLE ?? "backend_authenticated",
+    // Verified against the stack that provisions them, not from memory: the six
+    // roles and their attributes are declared in v2/internal/migrate/provision.go
+    // (`roleBackendServiceRole = "backend_service_role"`, NOLOGIN BYPASSRLS),
+    // and the live database agrees (pg_roles.rolbypassrls = true).
+    dbServiceRole: env.DB_SERVICE_ROLE ?? "backend_service_role",
+    poolMax
+  };
+}
+
+// src/engine/auth.ts
+function b64urlToBytes(s) {
+  const pad = s.replace(/-/g, "+").replace(/_/g, "/");
+  const full = pad.padEnd(Math.ceil(pad.length / 4) * 4, "=");
+  const bin = atob(full);
+  const out = new Uint8Array(new ArrayBuffer(bin.length));
+  for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+  return out;
+}
+var AuthVerifier = class {
+  keys = /* @__PURE__ */ new Map();
+  fetchedAt = 0;
+  inflight = null;
+  jwksUrl;
+  issuer;
+  fetchImpl;
+  ttl;
+  constructor(opts) {
+    this.jwksUrl = opts.jwksUrl;
+    this.issuer = opts.issuer;
+    this.fetchImpl = opts.fetchImpl ?? ((...a) => fetch(...a));
+    this.ttl = opts.keysetTtlMs ?? 5 * 6e4;
+  }
+  /** Fetch the keyset at most once per TTL, and at most once concurrently. */
+  async refresh() {
+    if (this.inflight) return this.inflight;
+    this.inflight = (async () => {
+      try {
+        const res = await this.fetchImpl(this.jwksUrl);
+        if (!res.ok) return;
+        const body = await res.json();
+        const next = /* @__PURE__ */ new Map();
+        for (const jwk of body.keys ?? []) {
+          if (jwk.kty !== "EC" || jwk.crv !== "P-256") continue;
+          try {
+            next.set(
+              jwk.kid,
+              await crypto.subtle.importKey(
+                "jwk",
+                { kty: "EC", crv: jwk.crv, x: jwk.x, y: jwk.y, ext: true },
+                { name: "ECDSA", namedCurve: "P-256" },
+                true,
+                ["verify"]
+              )
+            );
+          } catch {
+          }
+        }
+        if (next.size > 0) {
+          this.keys = next;
+          this.fetchedAt = Date.now();
+        }
+      } finally {
+        this.inflight = null;
+      }
+    })();
+    return this.inflight;
+  }
+  async key(kid) {
+    const stale = Date.now() - this.fetchedAt > this.ttl;
+    if (!this.keys.has(kid) || stale) await this.refresh();
+    return this.keys.get(kid) ?? null;
+  }
+  /**
+   * Verify an `Authorization` header value.
+   *
+   * @returns the verified claims, or `null` for absent / malformed / expired /
+   *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
+   *   the caller answers 401 either way, and a detailed reason is an oracle.
+   */
+  async verify(authorization) {
+    if (!authorization || !authorization.startsWith("Bearer ")) return null;
+    const parts = authorization.slice(7).trim().split(".");
+    if (parts.length !== 3) return null;
+    const h = parts[0];
+    const p = parts[1];
+    const sig = parts[2];
+    if (h === void 0 || p === void 0 || sig === void 0) return null;
+    let header;
+    let claims;
+    try {
+      header = JSON.parse(new TextDecoder().decode(b64urlToBytes(h)));
+      claims = JSON.parse(new TextDecoder().decode(b64urlToBytes(p)));
+    } catch {
+      return null;
+    }
+    if (header.alg !== "ES256" || !header.kid) return null;
+    const key = await this.key(header.kid);
+    if (!key) return null;
+    let ok = false;
+    try {
+      ok = await crypto.subtle.verify(
+        { name: "ECDSA", hash: "SHA-256" },
+        key,
+        b64urlToBytes(sig),
+        new TextEncoder().encode(`${h}.${p}`)
+      );
+    } catch {
+      return null;
+    }
+    if (!ok) return null;
+    if (typeof claims.exp === "number" && claims.exp * 1e3 <= Date.now()) return null;
+    if (this.issuer && claims.iss !== this.issuer) return null;
+    return claims;
+  }
+};
+function effectiveAuth(routeAuth, controllerAuth) {
+  const spec = routeAuth !== void 0 ? routeAuth : controllerAuth;
+  if (spec === false) return { required: false, verifiedEmail: false };
+  if (spec === true || spec === void 0 || spec === null) return { required: true, verifiedEmail: false };
+  if (typeof spec !== "object") return { required: true, verifiedEmail: false };
+  const o = spec;
+  const role = typeof o.role === "string" && o.role.trim() !== "" ? o.role.trim() : void 0;
+  return {
+    required: o.required !== false,
+    role,
+    verifiedEmail: o.verifiedEmail === true
+  };
+}
+
+// src/engine/ratelimit.ts
+var RateLimiter = class {
+  /** Bound on distinct keys held, so an attacker cycling identities cannot
+   * grow this map without limit. On overflow the oldest windows are dropped —
+   * forgiving, consistent with the restart behaviour above. */
+  constructor(maxKeys = 1e5) {
+    this.maxKeys = maxKeys;
+  }
+  maxKeys;
+  buckets = /* @__PURE__ */ new Map();
+  /**
+   * Identify the caller: the signed-in user when the route resolved one,
+   * otherwise the address the edge forwarded. Callers the edge did not
+   * identify share one bucket — deliberately conservative, since the
+   * alternative is a limit anyone resets by omitting a header.
+   */
+  static key(routeId, userId, headers) {
+    if (userId) return `${routeId}\0u:${userId}`;
+    const fwd = headers.get("x-forwarded-for");
+    const addr = (fwd ? fwd.split(",")[0] ?? "" : headers.get("x-real-ip") ?? "").trim();
+    return `${routeId}\0a:${addr || "anonymous"}`;
+  }
+  /**
+   * @returns `null` when the request may proceed, or the number of seconds to
+   *   wait (never 0 — a caller told to wait 0 comes straight back to the same
+   *   refusal).
+   */
+  check(rule, key, now) {
+    if (!rule || !(rule.max > 0) || !(rule.window > 0)) return null;
+    const bucket = this.buckets.get(key);
+    if (!bucket || now >= bucket.resetAt) {
+      if (this.buckets.size >= this.maxKeys) this.evict(now);
+      this.buckets.set(key, { count: 1, resetAt: now + rule.window * 1e3 });
+      return null;
+    }
+    if (bucket.count < rule.max) {
+      bucket.count++;
+      return null;
+    }
+    return Math.max(1, Math.ceil((bucket.resetAt - now) / 1e3));
+  }
+  /** Drop expired windows; if none are expired, drop the earliest-resetting
+   * quarter so the map cannot wedge at the ceiling. */
+  evict(now) {
+    let dropped = 0;
+    for (const [k, b] of this.buckets) {
+      if (now >= b.resetAt) {
+        this.buckets.delete(k);
+        dropped++;
+      }
+    }
+    if (dropped > 0) return;
+    const byReset = [...this.buckets.entries()].sort((a, b) => a[1].resetAt - b[1].resetAt);
+    for (let i = 0; i < Math.ceil(byReset.length / 4); i++) {
+      const victim = byReset[i];
+      if (victim) this.buckets.delete(victim[0]);
+    }
+  }
+  /** Test seam. */
+  get size() {
+    return this.buckets.size;
+  }
+};
+
+// src/engine/cache.ts
+function makeMemoryCache(opts = {}) {
+  const maxEntries = opts.maxEntries ?? 5e4;
+  const now = opts.now ?? (() => Date.now());
+  const store = /* @__PURE__ */ new Map();
+  const inflight = /* @__PURE__ */ new Map();
+  const live = (key) => {
+    const e = store.get(key);
+    if (!e) return void 0;
+    if (e.expiresAt !== 0 && e.expiresAt <= now()) {
+      store.delete(key);
+      return void 0;
+    }
+    return e;
+  };
+  const evict = () => {
+    const t = now();
+    let dropped = 0;
+    for (const [k, e] of store) {
+      if (e.expiresAt !== 0 && e.expiresAt <= t) {
+        store.delete(k);
+        dropped++;
+      }
+    }
+    if (dropped > 0) return;
+    const order = [...store.entries()].sort(
+      (a, b) => (a[1].expiresAt || Infinity) - (b[1].expiresAt || Infinity)
+    );
+    for (let i = 0; i < Math.ceil(order.length / 4); i++) {
+      const victim = order[i];
+      if (victim) store.delete(victim[0]);
+    }
+  };
+  const set = async (key, value, ttl) => {
+    if (store.size >= maxEntries && !store.has(key)) evict();
+    store.set(key, { value, expiresAt: ttl && ttl > 0 ? now() + ttl * 1e3 : 0 });
+  };
+  return {
+    async get(key) {
+      const e = live(key);
+      return e ? e.value : null;
+    },
+    set,
+    async del(key) {
+      store.delete(key);
+    },
+    async incr(key) {
+      const e = live(key);
+      const next = (typeof e?.value === "number" ? e.value : 0) + 1;
+      store.set(key, { value: next, expiresAt: e?.expiresAt ?? 0 });
+      return next;
+    },
+    async getOrSet(key, ttl, fn) {
+      const hit = live(key);
+      if (hit) return hit.value;
+      const running = inflight.get(key);
+      if (running) return running;
+      const fill = (async () => {
+        try {
+          const value = await fn();
+          await set(key, value, ttl);
+          return value;
+        } finally {
+          inflight.delete(key);
+        }
+      })();
+      inflight.set(key, fill);
+      return fill;
+    }
+  };
+}
+
+// src/engine/db.ts
+function quoteIdent(name) {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+var BIND_SQL = "select set_config('role',$1,true), set_config('search_path','public',true), set_config('request.jwt.claims',$2,true)";
+function createLazyTransaction(sql, role, claimsJson, options = {}) {
+  const { lockTimeout } = options;
+  const bindSql = lockTimeout ? `${BIND_SQL}, set_config('lock_timeout',$3,true)` : BIND_SQL;
+  const bindParams = lockTimeout ? [role, claimsJson, lockTimeout] : [role, claimsJson];
+  let opening = null;
+  let release = null;
+  let fail = null;
+  let settled = null;
+  const ensure = () => {
+    if (opening) return opening;
+    opening = new Promise((resolveTx2, rejectTx) => {
+      const parked = new Promise((res, rej) => {
+        release = res;
+        fail = rej;
+      });
+      settled = sql.begin(async (tx) => {
+        await tx.unsafe(bindSql, bindParams);
+        resolveTx2(tx);
+        await parked;
+      }).catch((e) => {
+        rejectTx(e);
+        throw e;
+      });
+    });
+    return opening;
+  };
+  return {
+    ensure,
+    get opened() {
+      return opening !== null;
+    },
+    async commit() {
+      if (!opening) return;
+      release();
+      await settled;
+    },
+    async rollback(reason) {
+      if (!opening) return;
+      fail(reason);
+      await settled?.catch(() => void 0);
+    }
+  };
+}
+var resolveTx = async (tx) => typeof tx.ensure === "function" ? await tx.ensure() : tx;
+function asWireValue(value) {
+  if (value instanceof Date) return value.toISOString();
+  if (Array.isArray(value)) return value.map(asWireValue);
+  return value;
+}
+function asWireRow(row) {
+  if (row === null || typeof row !== "object") return row;
+  const out = {};
+  for (const [key, value] of Object.entries(row)) out[key] = asWireValue(value);
+  return out;
+}
+function asWireRows(rows) {
+  return rows.map((row) => asWireRow(row));
+}
+function createOps(tx) {
+  const at = () => resolveTx(tx);
+  const ops = {
+    async query(sql, params = []) {
+      return asWireRows(await (await at()).unsafe(sql, params));
+    },
+    async insert(table, data) {
+      const cols = Object.keys(data);
+      if (cols.length === 0) throw new Error(`insert into ${table}: no columns given`);
+      const placeholders = cols.map((_, i) => `$${i + 1}`).join(", ");
+      const sql = `INSERT INTO ${quoteIdent(table)} (${cols.map(quoteIdent).join(", ")}) VALUES (${placeholders}) RETURNING *`;
+      const rows = await (await at()).unsafe(sql, cols.map((c) => data[c]));
+      const inserted = rows[0];
+      if (!inserted) {
+        throw new Error(
+          `insert into ${table} returned no row \u2014 the write was rejected (an RLS policy, most likely).`
+        );
+      }
+      return asWireRow(inserted);
+    },
+    async update(table, id, data) {
+      const cols = Object.keys(data);
+      if (cols.length === 0) return ops.findById(table, id);
+      const assignments = cols.map((c, i) => `${quoteIdent(c)} = $${i + 1}`).join(", ");
+      const sql = `UPDATE ${quoteIdent(table)} SET ${assignments} WHERE id = $${cols.length + 1} RETURNING *`;
+      const rows = await (await at()).unsafe(sql, [...cols.map((c) => data[c]), id]);
+      return rows[0] ? asWireRow(rows[0]) : null;
+    },
+    async delete(table, id) {
+      await (await at()).unsafe(`DELETE FROM ${quoteIdent(table)} WHERE id = $1`, [id]);
+    },
+    async findById(table, id) {
+      const rows = await (await at()).unsafe(
+        `SELECT * FROM ${quoteIdent(table)} WHERE id = $1`,
+        [id]
+      );
+      return rows[0] ? asWireRow(rows[0]) : null;
+    },
+    async findMany(table, query = {}) {
+      const cols = Object.keys(query);
+      const where = cols.length ? ` WHERE ${cols.map((c, i) => `${quoteIdent(c)} = $${i + 1}`).join(" AND ")}` : "";
+      return asWireRows(await (await at()).unsafe(
+        `SELECT * FROM ${quoteIdent(table)}${where}`,
+        cols.map((c) => query[c])
+      ));
+    },
+    /** A real SAVEPOINT inside the request's transaction. */
+    async transaction(cb) {
+      const live = await at();
+      return live.savepoint(async (sp) => cb(withTables(createOps(sp), currentSchema)));
+    },
+    /**
+     * Execute a whole transaction plan — what `Database.transaction(fn)` builds.
+     *
+     * WHY IT RUNS HERE. The platform used to carry a complete implementation
+     * of this at `/internal-api/db/tx`, for tenant code that ran in an isolate
+     * with no connection of its own. Running the plan there means running it on
+     * a DIFFERENT connection: a transaction would not see the uncommitted
+     * writes of the request that started it, and the two would hold separate
+     * RLS bindings of the same identity. In this stack the tenant's code and
+     * the connection share a process, so the plan runs on the request's own
+     * transaction inside one SAVEPOINT — and that surface was removed on
+     * 2026-08-15, once this was the last thing that could have called it.
+     *
+     * Until 2026-08-15 it ran NOWHERE: `runTxPlan` called `transport.txPlan` and
+     * nothing here implemented it, so a live handler answered
+     * "transport.txPlan is not a function" while every test that covered
+     * transactions passed against a mock that did implement it.
+     */
+    async txPlan(plan) {
+      const live = await at();
+      return live.savepoint(async (sp) => {
+        const results = [];
+        for (const op of plan.ops) {
+          const rows = await runPlanOp(sp, op, results);
+          const result = { rows, rows_affected: rows.length };
+          results.push(result);
+          assertGuard(op, result);
+        }
+        return { results };
+      });
+    }
+  };
+  return ops;
+}
+var currentSchema = {};
+function setSchema(schema) {
+  const s = schema;
+  currentSchema = (s && "default" in s ? s.default : s) ?? {};
+}
+function withTables(ops, schema = currentSchema) {
+  const tables = {};
+  for (const key of Object.keys(schema.tables ?? {})) {
+    const name = schema.tables?.[key]?.name ?? key;
+    tables[key] = {
+      insert: (data) => ops.insert(name, data),
+      update: (id, data) => ops.update(name, id, data),
+      delete: (id) => ops.delete(name, id),
+      findById: (id) => ops.findById(name, id),
+      findMany: (query) => ops.findMany(name, query ?? {})
+    };
+  }
+  const base = /* @__PURE__ */ Object.create(null);
+  return Object.assign(base, ops, { tables });
+}
+var SERVICE_LOCK_TIMEOUT = "5s";
+function isLockTimeout(e) {
+  const code = e?.code;
+  const message = String(e?.message ?? "");
+  return code === "55P03" || /lock timeout/i.test(message);
+}
+function diagnosingDriver(sql) {
+  const explain = (e) => isLockTimeout(e) ? new Error(
+    `Database.asService() waited too long for a row lock. It runs in its OWN transaction, so a row this request already wrote through Database.* is locked against it until the request commits \u2014 a wait that cannot end. Do that row's work on one surface or the other. (${String(e?.message ?? e)})`
+  ) : e;
+  const wrapTx = (tx) => ({
+    async unsafe(text, params) {
+      try {
+        return await tx.unsafe(text, params);
+      } catch (e) {
+        throw explain(e);
+      }
+    },
+    savepoint(cb) {
+      return tx.savepoint((sp) => cb(wrapTx(sp)));
+    }
+  });
+  return {
+    unsafe: (text, params) => sql.unsafe(text, params),
+    begin: (cb) => sql.begin((tx) => cb(wrapTx(tx)))
+  };
+}
+function createRequestDatabase(sql, identity) {
+  const tx = createLazyTransaction(sql, identity.role, identity.claimsJson);
+  let serviceTx = null;
+  let serviceClient = null;
+  const asService = () => {
+    if (serviceClient === null) {
+      serviceTx = createLazyTransaction(
+        diagnosingDriver(sql),
+        identity.serviceRole,
+        identity.claimsJson,
+        { lockTimeout: SERVICE_LOCK_TIMEOUT }
+      );
+      serviceClient = withTables(createOps(serviceTx));
+    }
+    return serviceClient;
+  };
+  return {
+    client: Object.assign(withTables(createOps(tx)), { asService }),
+    async commit() {
+      await tx.commit();
+      await serviceTx?.commit();
+    },
+    async rollback(reason) {
+      await tx.rollback(reason);
+      await serviceTx?.rollback(reason);
+    }
+  };
+}
+var Args = class {
+  values = [];
+  bind(value) {
+    this.values.push(value);
+    return `$${this.values.length}`;
+  }
+};
+function isRef(v) {
+  return typeof v === "object" && v !== null && "$ref" in v;
+}
+function isExpr(v) {
+  return typeof v === "object" && v !== null && "$expr" in v;
+}
+function renderValue(value, column, args, results) {
+  if (isRef(value)) {
+    const source = results[value.$ref.op];
+    const row = source?.rows[0];
+    if (!row || !(value.$ref.field in row)) {
+      throw Object.assign(new Error(`op ${value.$ref.op} has no column "${value.$ref.field}" to reference`), {
+        error_code: "tx_ref_unresolved"
+      });
+    }
+    return args.bind(row[value.$ref.field]);
+  }
+  if (isExpr(value)) {
+    const fn = value.$expr;
+    if (fn.fn === "now") return "now()";
+    const operator = fn.fn === "inc" ? "+" : "-";
+    return `${quoteIdent(column)} ${operator} ${args.bind(fn.by)}`;
+  }
+  return args.bind(value);
+}
+function renderWhere(where, args, results) {
+  const cols = Object.keys(where ?? {});
+  if (cols.length === 0) return "";
+  const terms = cols.map((c) => {
+    const v = where[c];
+    if (v === null) return `${quoteIdent(c)} IS NULL`;
+    return `${quoteIdent(c)} = ${renderValue(v, c, args, results)}`;
+  });
+  return ` WHERE ${terms.join(" AND ")}`;
+}
+async function runPlanOp(sp, op, results) {
+  const args = new Args();
+  const table = quoteIdent(op.table);
+  let sql;
+  switch (op.op) {
+    case "insert": {
+      const cols = Object.keys(op.values ?? {});
+      const rendered = cols.map((c) => renderValue(op.values[c], c, args, results));
+      sql = cols.length ? `INSERT INTO ${table} (${cols.map(quoteIdent).join(", ")}) VALUES (${rendered.join(", ")}) RETURNING *` : `INSERT INTO ${table} DEFAULT VALUES RETURNING *`;
+      break;
+    }
+    case "insertMany": {
+      const rows = op.rows ?? [];
+      if (rows.length === 0 || !rows[0]) return [];
+      const cols = Object.keys(rows[0]);
+      const tuples = rows.map(
+        (r) => `(${cols.map((c) => renderValue(r[c], c, args, results)).join(", ")})`
+      );
+      sql = `INSERT INTO ${table} (${cols.map(quoteIdent).join(", ")}) VALUES ${tuples.join(", ")} RETURNING *`;
+      break;
+    }
+    case "update": {
+      const cols = Object.keys(op.set ?? {});
+      if (cols.length === 0) throw new Error(`update ${op.table}: nothing to set`);
+      const assignments = cols.map(
+        (c) => `${quoteIdent(c)} = ${renderValue(op.set[c], c, args, results)}`
+      );
+      sql = `UPDATE ${table} SET ${assignments.join(", ")}${renderWhere(op.where, args, results)} RETURNING *`;
+      break;
+    }
+    case "delete": {
+      sql = `DELETE FROM ${table}${renderWhere(op.where, args, results)} RETURNING *`;
+      break;
+    }
+    case "select": {
+      const limit = op.limit !== void 0 ? ` LIMIT ${Number(op.limit)}` : "";
+      const lock = op.lock === "update" ? " FOR UPDATE" : "";
+      sql = `SELECT * FROM ${table}${renderWhere(op.where, args, results)}${limit}${lock}`;
+      break;
+    }
+    default:
+      throw new Error(`unknown operation "${String(op.op)}" in a transaction plan`);
+  }
+  return await sp.unsafe(sql, args.values);
+}
+function assertGuard(op, result) {
+  const guard = op.guard;
+  if (!guard) return;
+  const n = result.rows.length;
+  const ok = guard.kind === "one" ? n === 1 : guard.kind === "none" ? n === 0 : guard.kind === "atLeast" ? n >= guard.n : n <= guard.n;
+  if (ok) return;
+  throw Object.assign(new Error(`transaction expectation failed: ${guard.kind} (${n} row(s))`), {
+    error_code: "tx_guard_failed",
+    slot: guard.slot
+  });
+}
+
+// src/engine/router.ts
+var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta");
+function toSegments(path) {
+  return path.split("/").filter(Boolean).map((s) => s.startsWith("{") && s.endsWith("}") ? `:${s.slice(1, -1)}` : s);
+}
+function buildRouteTable(controllers) {
+  const table = [];
+  for (const Ctrl of controllers) {
+    const ctor = Ctrl;
+    const meta = ctor[CONTROLLER_META];
+    const basePath = meta?.basePath ?? "";
+    const routes = getRoutes(Ctrl);
+    if (routes.length === 0) {
+      const name = Ctrl.name ?? "<anonymous>";
+      throw new Error(
+        `controller ${name} collected zero routes. Either it declares no @Get/@Post/\u2026 , or its decorator metadata was erased at build time \u2014 check that the bundle was compiled with experimentalDecorators enabled.`
+      );
+    }
+    const instance = new ctor();
+    for (const r of routes) {
+      const full = `${basePath}${r.subpath ?? ""}` || "/";
+      table.push({
+        method: r.method,
+        segments: toSegments(full),
+        meta: r,
+        instance,
+        id: `${r.method} ${full}`,
+        controllerAuth: meta?.defaultAuth
+      });
+    }
+  }
+  return table;
+}
+function matchRoute(table, method, pathname) {
+  const parts = pathname.split("/").filter(Boolean);
+  for (const entry of table) {
+    if (entry.method !== method || entry.segments.length !== parts.length) continue;
+    const params = {};
+    let ok = true;
+    for (let i = 0; i < entry.segments.length; i++) {
+      const seg = entry.segments[i];
+      const got = parts[i];
+      if (seg === void 0 || got === void 0) {
+        ok = false;
+        break;
+      }
+      if (seg.charCodeAt(0) === 58) {
+        params[seg.slice(1)] = decodeURIComponent(got);
+      } else if (seg !== got) {
+        ok = false;
+        break;
+      }
+    }
+    if (ok) return { entry, params };
+  }
+  return null;
+}
+
+// src/engine/upload.ts
+var AUTHORIZE_PATH = "/__palbase/upload/authorize";
+var SIGNATURE_HEADER = "x-palbase-upload-signature";
+function renderPath(template, tokens) {
+  return template.replaceAll("{userId}", sanitizeSegment(tokens.userId ?? "anonymous")).replaceAll("{uploadId}", sanitizeSegment(tokens.uploadId)).replaceAll("{filename}", sanitizeSegment(tokens.filename ?? "file"));
+}
+function sanitizeSegment(raw) {
+  const cleaned = raw.replace(/[-]/g, "").replace(/[/\\]/g, "-").replace(/\.{2,}/g, ".").replace(/^\.+/, "").trim();
+  return cleaned === "" ? "file" : cleaned.slice(0, 200);
+}
+function grantFor(entry, ctx, bucketLimits) {
+  const cfg = entry?.meta?.options?.uploadConfig;
+  if (!cfg) return null;
+  return {
+    bucket: cfg.bucket,
+    path: renderPath(cfg.pathTemplate, {
+      userId: ctx.userId,
+      uploadId: ctx.uploadId,
+      filename: ctx.filename
+    }),
+    maxBytes: bucketLimits?.maxBytes ?? null,
+    mimeTypes: bucketLimits?.mimeTypes ?? null
+  };
+}
+var CompletionLedger = class {
+  constructor(capacity = 1024) {
+    this.capacity = capacity;
+  }
+  capacity;
+  seen = /* @__PURE__ */ new Map();
+  recall(uploadId) {
+    return this.seen.get(uploadId);
+  }
+  remember(uploadId, response) {
+    this.seen.delete(uploadId);
+    this.seen.set(uploadId, response);
+    while (this.seen.size > this.capacity) {
+      const oldest = this.seen.keys().next();
+      if (oldest.done) break;
+      this.seen.delete(oldest.value);
+    }
+  }
+  get size() {
+    return this.seen.size;
+  }
+};
+function verifySignature(presented, expected) {
+  if (presented.length !== expected.length) return false;
+  let diff = 0;
+  for (let i = 0; i < presented.length; i++) {
+    diff |= presented.charCodeAt(i) ^ expected.charCodeAt(i);
+  }
+  return diff === 0;
+}
+
+// src/engine/fence.ts
+var SECRET_ENV = [
+  "DATABASE_URL",
+  "PALBASE_SERVICE_ROLE_KEY",
+  "REALTIME_INGESTION_SECRET",
+  "INTERNAL_API_SECRET",
+  "STACK_ROOT_KEY",
+  "PEPPER",
+  "LOCAL_JWT_PEM"
+];
+function scrubSecrets(env) {
+  const removed = [];
+  const kept = [];
+  for (const name of SECRET_ENV) {
+    if (env[name] === void 0) continue;
+    delete env[name];
+    removed.push(name);
+  }
+  for (const name of Object.keys(env)) if (name.startsWith("PALBASE_VAR_")) kept.push(name);
+  return { removed, kept };
+}
+function hostAllowed(host, allow) {
+  const h = host.toLowerCase();
+  for (const raw of allow) {
+    const pattern = raw.trim().toLowerCase();
+    if (!pattern) continue;
+    if (pattern === h) return true;
+    if (pattern.startsWith("*.") && h.endsWith(pattern.slice(1)) && h.length > pattern.length - 1) {
+      return true;
+    }
+  }
+  return false;
+}
+function installEgressFence(policy) {
+  const original = globalThis.fetch.bind(globalThis);
+  const declared = policy.allow.length > 0;
+  const platform = (policy.alwaysAllow ?? []).map((h) => h.toLowerCase()).filter(Boolean);
+  if (!declared && policy.whenUndeclared === "allow") return original;
+  const fenced = async (input, init) => {
+    const url = typeof input === "string" ? new URL(input) : input instanceof URL ? input : new URL(input.url);
+    if (platform.includes(url.hostname.toLowerCase())) return original(input, init);
+    if (!declared || !hostAllowed(url.hostname, policy.allow)) {
+      throw new Error(
+        `egress denied: ${url.hostname} is not in this backend's declared allowlist. Add it to config/egress.ts and deploy.`
+      );
+    }
+    if (policy.timeoutMs > 0) {
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), policy.timeoutMs);
+      try {
+        return await original(input, { ...init, signal: init?.signal ?? controller.signal });
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+    return original(input, init);
+  };
+  globalThis.fetch = fenced;
+  return original;
+}
+
+// src/engine/index.ts
+var JSON_HEADERS = { "content-type": "application/json" };
+function envelope(error, description, status, requestId, extra) {
+  return new Response(
+    JSON.stringify({ error, error_description: description, status, request_id: requestId, ...extra }),
+    { status, headers: JSON_HEADERS }
+  );
+}
+function unavailable(name) {
+  throw new Error(
+    `${name} is unavailable. Either this backend was started without module clients (set MODULE_BASE_URL and the API keys so the engine can reach the module surface), or ${name} is not one of the modules this backend provides.`
+  );
+}
+function stubModule(name) {
+  return new Proxy(
+    {},
+    {
+      get: () => unavailable(name),
+      apply: () => unavailable(name)
+    }
+  );
+}
+async function defaultSqlDriver(config) {
+  const g = globalThis;
+  if (!g.Bun?.SQL) {
+    throw new BootRefused(
+      [],
+      "boot refused: no SQL driver. Running outside Bun means the driver must be supplied \u2014 pass `sql` to createApp()."
+    );
+  }
+  return new g.Bun.SQL({ url: config.databaseUrl, max: config.poolMax });
+}
+async function createApp(opts) {
+  const { config, controllers } = opts;
+  setSchema(opts.schema ?? {});
+  const routes = buildRouteTable(controllers);
+  if (routes.length === 0) {
+    throw new BootRefused([], "boot refused: zero endpoints collected \u2014 nothing would answer.");
+  }
+  const sql = opts.sql ?? await defaultSqlDriver(config);
+  await sql.unsafe("select 1");
+  const auth = new AuthVerifier({ jwksUrl: config.authJwksUrl, issuer: config.authIssuer });
+  const limiter = new RateLimiter();
+  const cache = opts.cache ?? makeMemoryCache();
+  const log = opts.logger ?? console;
+  const modules = opts.modules ?? {};
+  const runWithRuntime = opts.runtimeHooks?.__runWithRuntime ?? __runWithRuntime;
+  const requestALS = opts.runtimeHooks?.__requestALS ?? __requestALS;
+  const uploadSecret = config.uploadSecret ?? "";
+  const completions = new CompletionLedger();
+  async function handleAuthorize(req, requestId) {
+    if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
+      return envelope("unauthorized", "This endpoint is not callable directly", 401, requestId);
+    }
+    const body = await req.json().catch(() => null);
+    if (!body?.path || !body.uploadId) {
+      return envelope("bad_request", "authorize needs a path and an uploadId", 400, requestId);
+    }
+    const target = matchRoute(routes, body.method ?? "POST", body.path);
+    const spec = effectiveAuth(target?.entry.meta.options?.auth, target?.entry.controllerAuth);
+    const callerClaims = await auth.verify(req.headers.get("authorization"));
+    if (spec.required && !callerClaims) {
+      return envelope("unauthorized", "A valid access token is required", 401, requestId);
+    }
+    if (callerClaims && spec.role && callerClaims.role !== spec.role) {
+      return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
+    }
+    const grant = grantFor(target?.entry, {
+      userId: typeof callerClaims?.sub === "string" ? callerClaims.sub : null,
+      uploadId: body.uploadId,
+      filename: body.filename
+    });
+    if (!grant) {
+      return envelope(
+        "not_an_upload_route",
+        `${body.method ?? "POST"} ${body.path} does not declare @Upload`,
+        400,
+        requestId
+      );
+    }
+    return new Response(JSON.stringify(grant), { status: 200, headers: JSON_HEADERS });
+  }
+  async function handle(req) {
+    const requestId = `req_${crypto.randomUUID()}`;
+    const url = new URL(req.url);
+    if (url.pathname === AUTHORIZE_PATH) {
+      return handleAuthorize(req, requestId);
+    }
+    const hit = matchRoute(routes, req.method, url.pathname);
+    if (!hit) return envelope("not_found", "No route matches this method and path", 404, requestId);
+    const { meta } = hit.entry;
+    const spec = effectiveAuth(meta.options?.auth, hit.entry.controllerAuth);
+    const claims = await auth.verify(req.headers.get("authorization"));
+    if (spec.required && !claims) {
+      return envelope("unauthorized", "A valid access token is required", 401, requestId);
+    }
+    const userId = typeof claims?.sub === "string" ? claims.sub : void 0;
+    if (claims && spec.role && claims.role !== spec.role) {
+      return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
+    }
+    if (claims && spec.verifiedEmail && claims.email_verified !== true) {
+      return envelope("email_not_verified", "A verified email address is required", 403, requestId);
+    }
+    const retryAfter = limiter.check(
+      meta.options?.rateLimit,
+      RateLimiter.key(hit.entry.id, userId, req.headers),
+      Date.now()
+    );
+    if (retryAfter !== null) {
+      return new Response(
+        JSON.stringify({
+          error: "too_many_requests",
+          error_description: "Rate limit exceeded for this endpoint",
+          status: 429,
+          request_id: requestId
+        }),
+        { status: 429, headers: { ...JSON_HEADERS, "retry-after": String(retryAfter) } }
+      );
+    }
+    let completionUploadId = null;
+    const args = [];
+    let parsedBody;
+    let bodyRead = false;
+    for (const p of meta.params ?? []) {
+      switch (p.kind) {
+        case "body": {
+          if (!bodyRead) {
+            parsedBody = await req.json().catch(() => ({}));
+            bodyRead = true;
+          }
+          const r = p.schema.safeParse(parsedBody);
+          if (!r.success) {
+            return envelope("bad_request", "Request body failed validation", 400, requestId, {
+              fields: r.error.issues.map((i) => ({ field: i.path.join("."), message: i.message }))
+            });
+          }
+          args[p.index] = r.data;
+          break;
+        }
+        case "query": {
+          const r = p.schema.safeParse(Object.fromEntries(url.searchParams));
+          if (!r.success) {
+            return envelope("bad_request", "Query parameters failed validation", 400, requestId, {
+              fields: r.error.issues.map((i) => ({ field: i.path.join("."), message: i.message }))
+            });
+          }
+          args[p.index] = r.data;
+          break;
+        }
+        case "param":
+          args[p.index] = hit.params[p.name];
+          break;
+        case "headers":
+          args[p.index] = Object.fromEntries(req.headers);
+          break;
+        case "user":
+        case "optionalUser":
+          args[p.index] = claims ? {
+            id: userId,
+            email: claims.email,
+            role: claims.role,
+            emailVerified: claims.email_verified === true,
+            metadata: claims.metadata ?? {}
+          } : null;
+          break;
+        case "uploadedObject": {
+          if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
+            return envelope(
+              "unauthorized",
+              "This endpoint accepts uploads through storage, not directly",
+              401,
+              requestId
+            );
+          }
+          if (!bodyRead) {
+            parsedBody = await req.json().catch(() => ({}));
+            bodyRead = true;
+          }
+          const envelopeIn = parsedBody;
+          if (!envelopeIn?.uploadedObject) {
+            return envelope("bad_request", "the completion call carried no uploaded object", 400, requestId);
+          }
+          const uploadId = envelopeIn.uploadedObject.uploadId;
+          if (typeof uploadId === "string" && uploadId !== "") {
+            const already = completions.recall(uploadId);
+            if (already) {
+              return new Response(already.body, {
+                status: already.status,
+                headers: already.contentType ? { "content-type": already.contentType } : void 0
+              });
+            }
+            completionUploadId = uploadId;
+          }
+          args[p.index] = envelopeIn.uploadedObject;
+          parsedBody = envelopeIn.body ?? {};
+          break;
+        }
+        case "requestId":
+          args[p.index] = requestId;
+          break;
+        case "traceId":
+          args[p.index] = requestId;
+          break;
+        case "req":
+          args[p.index] = req;
+          break;
+        default:
+          args[p.index] = void 0;
+      }
+    }
+    const db = createRequestDatabase(sql, {
+      role: config.dbRole,
+      serviceRole: config.dbServiceRole,
+      claimsJson: JSON.stringify(claims ?? {})
+    });
+    try {
+      const services = {
+        Database: db.client,
+        Cache: cache,
+        Log: log,
+        Documents: modules.Documents ?? stubModule("Documents"),
+        Storage: modules.Storage ?? stubModule("Storage"),
+        Notifications: modules.Notifications ?? stubModule("Notifications"),
+        Flags: modules.Flags ?? stubModule("Flags"),
+        Realtime: modules.Realtime ?? stubModule("Realtime"),
+        Purchases: modules.Purchases ?? stubModule("Purchases"),
+        // Named, never undefined. A backend started without a secrets client
+        // that returned `undefined` here would fail inside the handler as
+        // "Cannot read properties of undefined", which says nothing about what
+        // to configure — the stub says the name and the variable.
+        Secrets: modules.Secrets ?? stubModule("Secrets")
+      };
+      const result = await runWithRuntime(services, () => {
+        const box = requestALS.getStore();
+        if (box) {
+          box.userId = userId ?? null;
+          box.requestId = requestId;
+          box.idempotencyKey = req.headers.get("idempotency-key");
+        }
+        const method = hit.entry.instance[meta.fnName];
+        if (typeof method !== "function") {
+          throw new Error(
+            `route ${hit.entry.id} names method ${meta.fnName}, which the controller does not define`
+          );
+        }
+        return method.apply(hit.entry.instance, args);
+      });
+      await db.commit();
+      if (meta.returnSchema) {
+        const v = meta.returnSchema.safeParse(result);
+        if (!v.success) {
+          log.error(`[engine] ${hit.entry.id} returned a value its declared type rejects`, v.error.issues);
+          return envelope(
+            "output_invalid",
+            "The handler returned a value its declared return type rejects",
+            500,
+            requestId
+          );
+        }
+      }
+      if (result === void 0 || result === null) {
+        if (completionUploadId) {
+          completions.remember(completionUploadId, { status: 204, body: null, contentType: null });
+        }
+        return new Response(null, { status: 204 });
+      }
+      const payload = JSON.stringify(result);
+      if (completionUploadId) {
+        completions.remember(completionUploadId, {
+          status: 200,
+          body: payload,
+          contentType: JSON_HEADERS["content-type"] ?? "application/json"
+        });
+      }
+      return new Response(payload, { status: 200, headers: JSON_HEADERS });
+    } catch (err) {
+      await db.rollback(err);
+      if (isHttpError(err)) {
+        return envelope(
+          err.error,
+          err.errorDescription,
+          err.status,
+          requestId,
+          err.data !== void 0 ? { data: err.data } : void 0
+        );
+      }
+      log.error(`[engine] unhandled error in ${hit.entry.id}`, err);
+      return envelope("internal_error", "The request could not be completed", 500, requestId);
+    }
+  }
+  return {
+    handle,
+    routes,
+    config,
+    async shutdown() {
+      const closable = sql;
+      await closable.close?.();
+      await closable.end?.();
+    }
+  };
+}
+
+export {
+  BootRefused,
+  loadConfig,
+  AuthVerifier,
+  effectiveAuth,
+  RateLimiter,
+  makeMemoryCache,
+  quoteIdent,
+  createLazyTransaction,
+  createOps,
+  withTables,
+  createRequestDatabase,
+  buildRouteTable,
+  matchRoute,
+  scrubSecrets,
+  hostAllowed,
+  installEgressFence,
+  createApp
+};
+//# sourceMappingURL=chunk-VYH4U7ZQ.js.map