@palbase/backend 18.0.0 → 20.0.0

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { g as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-B0LpZixz.cjs';
 export { h as AuthConfig, B as BadRequest, C as CacheClient, i as ClientInfo, j as Conflict, D as DBClient, k as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, f as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-B0LpZixz.cjs';
-import { M as ModuleClients } from './index-B46CGNvx.cjs';
-export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-B46CGNvx.cjs';
+import { M as ModuleClients } from './index-Br9P7yRu.cjs';
+export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-Br9P7yRu.cjs';
 import { EntitlementKey, LimitKey } from './purchases/keys.cjs';
 import { S as SchemaDef } from './index-BGSCWlUa.cjs';
 export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, E as EnvTypedDatabase, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-BGSCWlUa.cjs';
@@ -299,7 +299,7 @@ declare function toSchemaJSON(schema: SchemaDef): SchemaJSON;
  * env-gen.ts — generate the `palbase-env.d.ts` text from a `defineSchema()`
  * result.
  *
- * The CLI (`palbase db types` / codegen) and the deploy pipeline call
+ * The CLI (`palbase build`) and the deploy pipeline call
  * {@link makeEnvDts} with the project's schema and write the returned string to
  * `palbase-env.d.ts` at the project root. That file AUGMENTS the
  * `@palbase/backend/env` `Tables` interface (controlled global augmentation,
@@ -1293,6 +1293,181 @@ declare const Delete: (subpath: string, options?: RouteOptions) => MethodDecorat
  * safe + idempotent like GET, body-carrying like POST. Input rides `@Body`. */
 declare const Query: (subpath: string, options?: RouteOptions) => MethodDecorator;
 
+/**
+ * The payloads a hook handler receives, and nothing else.
+ *
+ * There is ONE way to declare a hook: `@Hook` (blocking) or `@On` (listener) on
+ * a method of a default-exported class in `hooks/*.ts`. The bundler discovers
+ * those, the deploy registers the events, and the stack calls them.
+ *
+ * This file used to also export `auth`, `storage` and `documents` helper
+ * objects — `storage.onFileUploaded(handler)` and friends — which returned a
+ * tidy `{module, event, handler}` record. Nothing in the runtime or the bundler
+ * ever read that record (measured 2026-08-22: `grep -rn "ResolvedHook"` across
+ * the runtime returned nothing). A project that wrote one got a handler that was
+ * never called, and no error said so. They are gone, so that upgrading turns
+ * that silence into a build failure.
+ *
+ * The event types they carried are gone with them, because they were wrong in
+ * the same silent way: `UserCreatedEvent` promised `user.role`, `user.metadata`
+ * and `user.createdAt`, and the auth engine sends none of the three. What is
+ * here now is the wire, each type citing the struct it mirrors.
+ */
+/**
+ * Per-invocation data for hook handlers.
+ *
+ * Services (Database, Log, …) are imported as singletons, not passed here.
+ *
+ * Mirrors `hookMeta()` in the runtime (v2/runtime/src/server.ts). `requestId`
+ * was on the wire long before it was in this type, which made `meta.requestId`
+ * in a handler an error the compiler should have caught and did not.
+ */
+interface HookMeta {
+    /** Environment-scoped env vars, including every secret in your vault. */
+    env: Record<string, string>;
+    /** The globally unique Environment runtime identifier. */
+    environmentId: string;
+    /** Correlation id, so one signup's gate can be found in the log. */
+    requestId: string;
+}
+/**
+ * What an auth hook receives — `before.*` and `after.*` alike.
+ *
+ * Mirrors `hook.Payload` (internal/modules/auth/internal/hook/engine.go:183),
+ * `hook.UserInfo` (:160) and `hook.ContextInfo` (:176). Everything but `event`
+ * is `omitempty` on the Go side and therefore optional here: a `before.login`
+ * for an unknown address really does arrive carrying only the event name.
+ */
+interface AuthHookEvent {
+    /** The event this handler is registered for, e.g. `before.user.create`. */
+    event: string;
+    user?: {
+        id: string;
+        /** Absent for phone-only users, who never had one. */
+        email?: string;
+        email_verified?: boolean;
+    };
+    context?: {
+        ip?: string;
+        user_agent?: string;
+        risk_score?: number;
+    };
+    client_metadata?: Record<string, unknown>;
+}
+/**
+ * What a document listener receives.
+ *
+ * Mirrors `model.WebhookPayload`
+ * (internal/modules/documents/internal/model/webhook.go:52). The field is
+ * `documentId`, camelCase, because that is the JSON tag — `document_id` is the
+ * guess that made this project's own verification fixture log `id=unknown` for
+ * every document it ever saw.
+ *
+ * `event` is the name you registered for (`document.created`), not the database
+ * trigger's word: the runtime resolves it before your handler is found, and
+ * normalises the payload to match.
+ */
+interface DocumentHookEvent {
+    event: string;
+    collection: string;
+    documentId: string;
+    path: string;
+    version: number;
+    /** The document itself. Absent on a delete. */
+    data?: Record<string, unknown>;
+    timestamp: string;
+}
+/**
+ * What `@On("file.uploaded")` receives.
+ *
+ * Mirrors the emit call in
+ * internal/modules/storage/internal/handler/handler.go, which fires AFTER the
+ * object is stored. To refuse an upload, use `@Upload` — this one cannot.
+ */
+interface FileUploadedEvent {
+    bucket: string;
+    path: string;
+    size: number;
+    contentType: string;
+}
+/**
+ * What `@On("file.deleted")` receives.
+ *
+ * No size and no content type: the object is gone by the time this fires, and a
+ * type that offered them would be inviting a read of something that is not
+ * there.
+ */
+interface FileDeletedEvent {
+    bucket: string;
+    path: string;
+}
+/** The record the removed helpers returned. Nothing ever read it.
+ * @deprecated Declare hooks with `@Hook` / `@On` in `hooks/*.ts`. Removed in the next major. */
+interface ResolvedHook<TEvent = unknown> {
+    module: string;
+    event: string;
+    handler: (event: TEvent, meta: HookMeta) => Promise<void>;
+}
+/** @deprecated Declare hooks with `@Hook` / `@On` in `hooks/*.ts`. Removed in the next major. */
+type HookHandler<TEvent> = (event: TEvent, meta: HookMeta) => Promise<void>;
+/** @deprecated Use {@link AuthHookEvent} — this shape was never on the wire. */
+type UserCreatedEvent = AuthHookEvent;
+/** @deprecated Use {@link AuthHookEvent} — this shape was never on the wire. */
+type SignInEvent = AuthHookEvent;
+/** @deprecated Use {@link AuthHookEvent} — this shape was never on the wire. */
+type SignOutEvent = AuthHookEvent;
+/** @deprecated Use {@link AuthHookEvent} — this shape was never on the wire. */
+type PasswordResetEvent = AuthHookEvent;
+/** @deprecated Use {@link DocumentHookEvent} — this shape was never on the wire. */
+type DocumentCreatedEvent = DocumentHookEvent;
+/** @deprecated Use {@link DocumentHookEvent} — this shape was never on the wire. */
+type DocumentUpdatedEvent = DocumentHookEvent;
+/** @deprecated Use {@link DocumentHookEvent} — this shape was never on the wire. */
+type DocumentDeletedEvent = DocumentHookEvent;
+/** @deprecated Declare auth hooks with `@Hook("before.…")` or `@On("after.…")` in `hooks/*.ts`. */
+declare const auth: {
+    onUserCreated: (_h: HookHandler<AuthHookEvent>) => ResolvedHook<AuthHookEvent>;
+    onSignIn: (_h: HookHandler<AuthHookEvent>) => ResolvedHook<AuthHookEvent>;
+    onSignOut: (_h: HookHandler<AuthHookEvent>) => ResolvedHook<AuthHookEvent>;
+    onPasswordReset: (_h: HookHandler<AuthHookEvent>) => ResolvedHook<AuthHookEvent>;
+};
+/** @deprecated Declare file hooks with `@On("file.uploaded")` / `@On("file.deleted")` in `hooks/*.ts`. */
+declare const storage: {
+    onFileUploaded: (_h: HookHandler<FileUploadedEvent>) => ResolvedHook<FileUploadedEvent>;
+    onFileDeleted: (_h: HookHandler<FileDeletedEvent>) => ResolvedHook<FileDeletedEvent>;
+};
+/** @deprecated Declare document hooks with `@On("document.…")` in `hooks/*.ts`. */
+declare const documents: {
+    onDocumentCreated: (_h: HookHandler<DocumentHookEvent>) => ResolvedHook<DocumentHookEvent>;
+    onDocumentUpdated: (_h: HookHandler<DocumentHookEvent>) => ResolvedHook<DocumentHookEvent>;
+    onDocumentDeleted: (_h: HookHandler<DocumentHookEvent>) => ResolvedHook<DocumentHookEvent>;
+};
+
+/** A hook handler. Returning quietly ALLOWS; throwing DENIES (blocking hooks). */
+type HookFn = (event: unknown, meta: HookMeta) => Promise<unknown>;
+interface ResolvedHookClass {
+    /** `@Hook` handlers, by event. A throw here cancels the operation. */
+    blocking: Record<string, HookFn>;
+    /** `@On` handlers, by event. A throw here reaches nobody but the log. */
+    listeners: Record<string, HookFn>;
+}
+/** A hook's refusal, with the reason the caller will see.
+ *
+ * Any thrown error denies — this class exists so the REASON travels as a
+ * deliberate message rather than as whatever a stray TypeError happened to say.
+ * The engine is fail-closed by design (an unreachable hook denies), so a hook
+ * body should stay narrow: an accidental throw refuses a real user. */
+declare class Deny extends Error {
+    constructor(reason: string);
+}
+/** `@Hook("before.user.create")` — a blocking handler for one stack event. */
+declare function Hook(event: string): (target: object, fnName: string | symbol) => void;
+/** Resolves a hook class into the two maps the runtime dispatches from.
+ *
+ * Every misuse throws HERE, at build time, rather than becoming a hook that is
+ * silently never called — the failure mode this whole change exists to end. */
+declare function getHookConfig(ctor: object): ResolvedHookClass;
+
 /** A legacy parameter decorator. */
 type ParameterDecorator = (target: object, propertyKey: string | symbol, parameterIndex: number) => void;
 /** `@Body(schema)` — inject the request body, validated against `schema`. The
@@ -1438,10 +1613,21 @@ interface JobOptions {
     schedule: string;
     /** Execution timeout in seconds. Defaults to 30, ceiling 300 (sandbox limit). */
     timeout?: number;
+    /**
+     * How many times a FAILED run is retried before the run is recorded failed.
+     * Defaults to 5, ceiling 10; 0 disables retrying entirely.
+     *
+     * Retries exist for the transient half of the failure space — the runtime
+     * still waking, a network blip — not for a job that is wrong. A permanent
+     * failure still lands in the run history, it just lands after the retries
+     * are spent rather than instead of them.
+     */
+    retry?: number;
 }
 interface ResolvedJob {
     schedule: string;
     timeout: number;
+    retry: number;
     handler: (meta: JobMeta) => Promise<void>;
 }
 declare function Job(options: JobOptions): <T extends abstract new (...args: never[]) => object>(ctor: T) => T;
@@ -1539,121 +1725,4 @@ declare function __runResourceBoot(envMap: Record<string, string>): Promise<void
  */
 declare function __shutdownResources(): Promise<void>;
 
-/** Non-service, per-invocation data for hook handlers.
- * Services (Database, Log, …) are imported as singletons, not passed here. */
-interface HookMeta {
-    /** Environment-scoped env vars. */
-    env: Record<string, string>;
-    /** The globally unique Environment runtime identifier. */
-    environmentId: string;
-}
-/** Payload for auth.onUserCreated hook. */
-interface UserCreatedEvent {
-    user: {
-        id: string;
-        /** User's email, if they signed up with one (absent for phone-only users). */
-        email?: string;
-        role: string;
-        metadata: Record<string, unknown>;
-        createdAt: string;
-    };
-}
-/** Payload for auth.onSignIn hook. */
-interface SignInEvent {
-    user: {
-        id: string;
-        /** User's email, if they have one (absent for phone-only users). */
-        email?: string;
-        role: string;
-    };
-    provider: string;
-    timestamp: string;
-}
-/** Payload for auth.onSignOut hook. */
-interface SignOutEvent {
-    user: {
-        id: string;
-        /** User's email, if they have one (absent for phone-only users). */
-        email?: string;
-    };
-    timestamp: string;
-}
-/** Payload for auth.onPasswordReset hook.
- * Password reset is inherently email-based, so `email` is always present here
- * (a phone-only passwordless user cannot trigger this event). */
-interface PasswordResetEvent {
-    user: {
-        id: string;
-        email: string;
-    };
-    timestamp: string;
-}
-/** Payload for storage.onFileUploaded hook. */
-interface FileUploadedEvent {
-    file: {
-        id: string;
-        name: string;
-        bucket: string;
-        path: string;
-        size: number;
-        contentType: string;
-    };
-}
-/** Payload for storage.onFileDeleted hook. */
-interface FileDeletedEvent {
-    file: {
-        id: string;
-        name: string;
-        bucket: string;
-        path: string;
-    };
-}
-/** Payload for documents.onDocumentCreated hook. */
-interface DocumentCreatedEvent {
-    document: {
-        id: string;
-        collection: string;
-        data: Record<string, unknown>;
-    };
-}
-/** Payload for documents.onDocumentUpdated hook. */
-interface DocumentUpdatedEvent {
-    document: {
-        id: string;
-        collection: string;
-        data: Record<string, unknown>;
-        previousData: Record<string, unknown>;
-    };
-}
-/** Payload for documents.onDocumentDeleted hook. */
-interface DocumentDeletedEvent {
-    document: {
-        id: string;
-        collection: string;
-        data: Record<string, unknown>;
-    };
-}
-type HookHandler<TEvent> = (event: TEvent, meta: HookMeta) => Promise<void>;
-/** Resolved hook configuration (internal). */
-interface ResolvedHook<TEvent = unknown> {
-    module: string;
-    event: string;
-    handler: HookHandler<TEvent>;
-}
-declare const auth: {
-    onUserCreated(handler: HookHandler<UserCreatedEvent>): ResolvedHook<UserCreatedEvent>;
-    onSignIn(handler: HookHandler<SignInEvent>): ResolvedHook<SignInEvent>;
-    onSignOut(handler: HookHandler<SignOutEvent>): ResolvedHook<SignOutEvent>;
-    onPasswordReset(handler: HookHandler<PasswordResetEvent>): ResolvedHook<PasswordResetEvent>;
-};
-declare const storage: {
-    onFileUploaded(handler: HookHandler<FileUploadedEvent>): ResolvedHook<FileUploadedEvent>;
-    onFileDeleted(handler: HookHandler<FileDeletedEvent>): ResolvedHook<FileDeletedEvent>;
-};
-declare const documents: {
-    onDocumentCreated(handler: HookHandler<DocumentCreatedEvent>): ResolvedHook<DocumentCreatedEvent>;
-    onDocumentUpdated(handler: HookHandler<DocumentUpdatedEvent>): ResolvedHook<DocumentUpdatedEvent>;
-    onDocumentDeleted(handler: HookHandler<DocumentDeletedEvent>): ResolvedHook<DocumentDeletedEvent>;
-};
-
-export { type AcsOptions, type ApnsOptions, Body, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, type DocumentCreatedEvent, type DocumentDeletedEvent, type DocumentUpdatedEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, type HookHandler, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, type PasswordResetEvent, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHook, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignInEvent, type SignOutEvent, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, type UserCreatedEvent, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, auth, buildModuleClients, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, documents, entitlementFor, extractVariables, flag, getErrorRegistry, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, reservedSecretKey, secret, spendFor, storage, testUser, toSchemaJSON };
+export { type AcsOptions, type ApnsOptions, type AuthHookEvent, Body, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentCreatedEvent, type DocumentDeletedEvent, type DocumentHookEvent, type DocumentUpdatedEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, Hook, type HookFn, type HookHandler, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, type PasswordResetEvent, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHook, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignInEvent, type SignOutEvent, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, type UserCreatedEvent, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, auth, buildModuleClients, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, documents, entitlementFor, extractVariables, flag, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, reservedSecretKey, secret, spendFor, storage, testUser, toSchemaJSON };