@palbase/backend 22.0.1 → 22.1.0

package/dist/index.d.cts

@@ -1,13 +1,13 @@
-import { g as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-B0LpZixz.cjs';
-export { h as AuthConfig, B as BadRequest, C as CacheClient, i as ClientInfo, j as Conflict, D as DBClient, k as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, f as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-B0LpZixz.cjs';
-import { M as ModuleClients } from './index-B4W6d2VJ.cjs';
-export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-B4W6d2VJ.cjs';
+import { g as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-BVT6jcVW.cjs';
+export { h as AuthConfig, B as BadRequest, C as CacheClient, i as ClientInfo, j as Conflict, D as DBClient, k as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, f as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-BVT6jcVW.cjs';
+import { M as ModuleClients } from './index-BS1gW4nV.cjs';
+export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-BS1gW4nV.cjs';
 import { EntitlementKey, LimitKey } from './purchases/keys.cjs';
-import { S as SchemaDef } from './index-BGSCWlUa.cjs';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, E as EnvTypedDatabase, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-BGSCWlUa.cjs';
+import { S as SchemaDef } from './index-BqCiHao8.cjs';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EmbeddingModelRef, f as EnvServiceDatabase, g as EnvTables, E as EnvTypedDatabase, h as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, i as PalbaseExtension, j as PolicyBuilder, k as PolicyCommand, l as PolicyDef, m as PolicyMode, R as RawConstraintDef, n as RowShape, o as SchemaInput, T as TableDef, p as TableInput, q as TxPlan, r as TxTables, s as TypedDB, t as TypedTable, u as TypedTx, v as bigint, w as boolean, x as defineSchema, y as enumType, z as integer, A as isPalbaseExtension, B as jsonb, D as makeTypedDB, F as numeric, G as openai, H as policy, J as raw, K as text, L as timestamp, M as uuid, N as vector } from './index-BqCiHao8.cjs';
 import { TableTypes, Tables } from './db/env.cjs';
-import { a as RouteOptions } from './registry-Cw0YEYCg.cjs';
-export { B as BucketDef, b as BucketOptions, H as HttpMethodUpper, I as ImageVariant, c as ParamKind, P as ParamMeta, R as RouteMeta, S as STORAGE_CONFIG_KIND, d as StorageConfig, e as StorageInput, T as ThrowDescriptor, f as Upload, U as UploadConfig, g as UploadedObject, h as bucket, i as defineStorage, j as getRoutes, p as parseFileSizeLimit, r as recordThrows, v as validateUploadAgainstStorage } from './registry-Cw0YEYCg.cjs';
+import { a as RouteOptions } from './registry-BWttGlaT.cjs';
+export { B as BucketDef, b as BucketOptions, H as HttpMethodUpper, I as ImageVariant, c as ParamKind, P as ParamMeta, R as RouteMeta, S as STORAGE_CONFIG_KIND, d as StorageConfig, e as StorageInput, T as ThrowDescriptor, f as Upload, U as UploadConfig, g as UploadedObject, h as bucket, i as defineStorage, j as getRoutes, p as parseFileSizeLimit, r as recordThrows, v as validateUploadAgainstStorage } from './registry-BWttGlaT.cjs';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import 'node:async_hooks';
@@ -251,6 +251,7 @@ interface ColumnJSON {
     enumName?: string;
     enumValues?: string[];
     unique?: boolean;
+    dimensions?: number;
 }
 /** One RLS policy. Mirrors Go's `schema.PolicyJSON`. */
 interface PolicyJSON {
@@ -285,12 +286,32 @@ interface TableJSON {
         name: string;
         columns: string[];
     }[];
+    search?: SearchJSON;
 }
 /** A whole declaration. Mirrors Go's `schema.SchemaJSON`. */
 interface SchemaJSON {
     tables: Record<string, TableJSON>;
     extensions: string[];
 }
+/** C-4 wire şekli — Go'nun SearchJSON'ıyla ALAN ADI sözleşmesi (C-5). */
+interface SearchJSON {
+    text?: {
+        columns: string[];
+    };
+    vector?: {
+        column?: string;
+        metric: string;
+        embed?: {
+            provider: string;
+            model: string;
+            from: string[];
+            apiKeyName?: string;
+            dimensions?: number;
+            baseURL?: string;
+        };
+        staleness?: "null" | "keep";
+    }[];
+}
 /**
  * Serialize a `defineSchema(...)` result into the JSON the deploy applies.
  *
@@ -300,6 +321,100 @@ interface SchemaJSON {
  */
 declare function toSchemaJSON(schema: SchemaDef): SchemaJSON;
 
+/**
+ * channels.ts — the realtime channel authorization DSL (spec C-5).
+ *
+ * `defineChannels({...})` is evaluated at bundle load; the declaration is
+ * anchored on globalThis under Symbol.for (the error-registry.ts pattern) so
+ * the runtime — a separate module instance — reads the SAME object. The runtime
+ * empties that slot before each bundle import and puts it back afterwards, so
+ * the declaration belongs to the bundle that made it and not to the process.
+ * Entry ORDER is the object's key order and is semantic: first match wins.
+ *
+ * Undeclared channels are DENIED by the server (fail-closed). ownerOnly()
+ * patterns resolve with ZERO server hops; custom entries' authorize() runs
+ * in the customer's own runtime with the request scope a controller gets.
+ */
+interface ChannelGrant {
+    subscribe: boolean;
+    publish?: boolean;
+    state?: {
+        read?: boolean;
+        write?: boolean;
+    };
+}
+interface ChannelAuthorizeCtx {
+    user: {
+        id: string;
+    };
+    params: Record<string, string>;
+}
+interface OwnerEntry {
+    kind: "owner";
+}
+interface PublicEntry {
+    kind: "public";
+    publish?: boolean;
+    state?: {
+        read?: boolean;
+        write?: boolean;
+    };
+}
+/** What a handler receives: who published, on which channel, and what. */
+interface ChannelHandlerCtx {
+    user: {
+        id: string;
+    };
+    params: Record<string, string>;
+    channel: string;
+    event: string;
+    payload: Record<string, unknown>;
+}
+interface CustomEntry {
+    authorize: (ctx: ChannelAuthorizeCtx) => ChannelGrant | null | Promise<ChannelGrant | null>;
+    /**
+     * Take over publishes on this channel instead of fanning them out.
+     *
+     * Without it, `channel.send(...)` is relayed to the other subscribers
+     * verbatim — fine for a chat message, wrong for anything the client should
+     * not be trusted to assert. A bid, a vote, a game move is a REQUEST, and the
+     * result is whatever this function decides and then publishes (through
+     * `Realtime.broadcast` or `Realtime.state.set`).
+     *
+     * A function rather than the name of a route: `authorize` is already one and
+     * runs in this same scope, so naming an endpoint would mean inventing a
+     * resolution step for no gain.
+     */
+    handler?: (ctx: ChannelHandlerCtx) => void | Promise<void>;
+}
+type ChannelEntry = OwnerEntry | PublicEntry | CustomEntry;
+type ChannelsInput = Record<string, ChannelEntry>;
+interface ChannelsDef {
+    entries: Array<{
+        pattern: string;
+        kind: "owner" | "public" | "custom";
+        publish?: boolean;
+        state?: {
+            read?: boolean;
+            write?: boolean;
+        };
+        authorize?: CustomEntry["authorize"];
+        handler?: CustomEntry["handler"];
+    }>;
+}
+/** Full-access-to-the-owner pattern: the pattern must carry EXACTLY one {param};
+ * the server compares its value to the verified token subject with zero hops. */
+declare function ownerOnly(): OwnerEntry;
+/** Anyone with a valid token may subscribe; publish/state are explicit opt-ins. */
+declare function publicChannel(opts?: {
+    publish?: boolean;
+    state?: {
+        read?: boolean;
+        write?: boolean;
+    };
+}): PublicEntry;
+declare function defineChannels(map: ChannelsInput): ChannelsDef;
+
 /**
  * env-gen.ts — generate the `palbase-env.d.ts` text from a `defineSchema()`
  * result.
@@ -1689,4 +1804,4 @@ declare function __runResourceBoot(envMap: Record<string, string>): Promise<void
  */
 declare function __shutdownResources(): Promise<void>;
 
-export { type AcsOptions, type ApnsOptions, type AuthHookEvent, Body, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, buildModuleClients, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, entitlementFor, extractVariables, flag, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, reservedSecretKey, secret, spendFor, testUser, toSchemaJSON };
+export { type AcsOptions, type ApnsOptions, type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, buildModuleClients, buildProvider, defineChannels, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, entitlementFor, extractVariables, flag, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, ownerOnly, publicChannel, reservedSecretKey, secret, spendFor, testUser, toSchemaJSON };

package/dist/index.d.ts

@@ -1,13 +1,13 @@
-import { g as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-B0LpZixz.js';
-export { h as AuthConfig, B as BadRequest, C as CacheClient, i as ClientInfo, j as Conflict, D as DBClient, k as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, f as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-B0LpZixz.js';
-import { M as ModuleClients } from './index-BCNtlG1w.js';
-export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-BCNtlG1w.js';
+import { g as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-BVT6jcVW.js';
+export { h as AuthConfig, B as BadRequest, C as CacheClient, i as ClientInfo, j as Conflict, D as DBClient, k as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, f as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-BVT6jcVW.js';
+import { M as ModuleClients } from './index-CCZqzych.js';
+export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-CCZqzych.js';
 import { EntitlementKey, LimitKey } from './purchases/keys.js';
-import { S as SchemaDef } from './index-g-EzitI-.js';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, E as EnvTypedDatabase, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-g-EzitI-.js';
+import { S as SchemaDef } from './index-vwHoS0l2.js';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EmbeddingModelRef, f as EnvServiceDatabase, g as EnvTables, E as EnvTypedDatabase, h as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, i as PalbaseExtension, j as PolicyBuilder, k as PolicyCommand, l as PolicyDef, m as PolicyMode, R as RawConstraintDef, n as RowShape, o as SchemaInput, T as TableDef, p as TableInput, q as TxPlan, r as TxTables, s as TypedDB, t as TypedTable, u as TypedTx, v as bigint, w as boolean, x as defineSchema, y as enumType, z as integer, A as isPalbaseExtension, B as jsonb, D as makeTypedDB, F as numeric, G as openai, H as policy, J as raw, K as text, L as timestamp, M as uuid, N as vector } from './index-vwHoS0l2.js';
 import { TableTypes, Tables } from './db/env.js';
-import { a as RouteOptions } from './registry-3BLYv4si.js';
-export { B as BucketDef, b as BucketOptions, H as HttpMethodUpper, I as ImageVariant, c as ParamKind, P as ParamMeta, R as RouteMeta, S as STORAGE_CONFIG_KIND, d as StorageConfig, e as StorageInput, T as ThrowDescriptor, f as Upload, U as UploadConfig, g as UploadedObject, h as bucket, i as defineStorage, j as getRoutes, p as parseFileSizeLimit, r as recordThrows, v as validateUploadAgainstStorage } from './registry-3BLYv4si.js';
+import { a as RouteOptions } from './registry-Bsuf-orT.js';
+export { B as BucketDef, b as BucketOptions, H as HttpMethodUpper, I as ImageVariant, c as ParamKind, P as ParamMeta, R as RouteMeta, S as STORAGE_CONFIG_KIND, d as StorageConfig, e as StorageInput, T as ThrowDescriptor, f as Upload, U as UploadConfig, g as UploadedObject, h as bucket, i as defineStorage, j as getRoutes, p as parseFileSizeLimit, r as recordThrows, v as validateUploadAgainstStorage } from './registry-Bsuf-orT.js';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import 'node:async_hooks';
@@ -251,6 +251,7 @@ interface ColumnJSON {
     enumName?: string;
     enumValues?: string[];
     unique?: boolean;
+    dimensions?: number;
 }
 /** One RLS policy. Mirrors Go's `schema.PolicyJSON`. */
 interface PolicyJSON {
@@ -285,12 +286,32 @@ interface TableJSON {
         name: string;
         columns: string[];
     }[];
+    search?: SearchJSON;
 }
 /** A whole declaration. Mirrors Go's `schema.SchemaJSON`. */
 interface SchemaJSON {
     tables: Record<string, TableJSON>;
     extensions: string[];
 }
+/** C-4 wire şekli — Go'nun SearchJSON'ıyla ALAN ADI sözleşmesi (C-5). */
+interface SearchJSON {
+    text?: {
+        columns: string[];
+    };
+    vector?: {
+        column?: string;
+        metric: string;
+        embed?: {
+            provider: string;
+            model: string;
+            from: string[];
+            apiKeyName?: string;
+            dimensions?: number;
+            baseURL?: string;
+        };
+        staleness?: "null" | "keep";
+    }[];
+}
 /**
  * Serialize a `defineSchema(...)` result into the JSON the deploy applies.
  *
@@ -300,6 +321,100 @@ interface SchemaJSON {
  */
 declare function toSchemaJSON(schema: SchemaDef): SchemaJSON;
 
+/**
+ * channels.ts — the realtime channel authorization DSL (spec C-5).
+ *
+ * `defineChannels({...})` is evaluated at bundle load; the declaration is
+ * anchored on globalThis under Symbol.for (the error-registry.ts pattern) so
+ * the runtime — a separate module instance — reads the SAME object. The runtime
+ * empties that slot before each bundle import and puts it back afterwards, so
+ * the declaration belongs to the bundle that made it and not to the process.
+ * Entry ORDER is the object's key order and is semantic: first match wins.
+ *
+ * Undeclared channels are DENIED by the server (fail-closed). ownerOnly()
+ * patterns resolve with ZERO server hops; custom entries' authorize() runs
+ * in the customer's own runtime with the request scope a controller gets.
+ */
+interface ChannelGrant {
+    subscribe: boolean;
+    publish?: boolean;
+    state?: {
+        read?: boolean;
+        write?: boolean;
+    };
+}
+interface ChannelAuthorizeCtx {
+    user: {
+        id: string;
+    };
+    params: Record<string, string>;
+}
+interface OwnerEntry {
+    kind: "owner";
+}
+interface PublicEntry {
+    kind: "public";
+    publish?: boolean;
+    state?: {
+        read?: boolean;
+        write?: boolean;
+    };
+}
+/** What a handler receives: who published, on which channel, and what. */
+interface ChannelHandlerCtx {
+    user: {
+        id: string;
+    };
+    params: Record<string, string>;
+    channel: string;
+    event: string;
+    payload: Record<string, unknown>;
+}
+interface CustomEntry {
+    authorize: (ctx: ChannelAuthorizeCtx) => ChannelGrant | null | Promise<ChannelGrant | null>;
+    /**
+     * Take over publishes on this channel instead of fanning them out.
+     *
+     * Without it, `channel.send(...)` is relayed to the other subscribers
+     * verbatim — fine for a chat message, wrong for anything the client should
+     * not be trusted to assert. A bid, a vote, a game move is a REQUEST, and the
+     * result is whatever this function decides and then publishes (through
+     * `Realtime.broadcast` or `Realtime.state.set`).
+     *
+     * A function rather than the name of a route: `authorize` is already one and
+     * runs in this same scope, so naming an endpoint would mean inventing a
+     * resolution step for no gain.
+     */
+    handler?: (ctx: ChannelHandlerCtx) => void | Promise<void>;
+}
+type ChannelEntry = OwnerEntry | PublicEntry | CustomEntry;
+type ChannelsInput = Record<string, ChannelEntry>;
+interface ChannelsDef {
+    entries: Array<{
+        pattern: string;
+        kind: "owner" | "public" | "custom";
+        publish?: boolean;
+        state?: {
+            read?: boolean;
+            write?: boolean;
+        };
+        authorize?: CustomEntry["authorize"];
+        handler?: CustomEntry["handler"];
+    }>;
+}
+/** Full-access-to-the-owner pattern: the pattern must carry EXACTLY one {param};
+ * the server compares its value to the verified token subject with zero hops. */
+declare function ownerOnly(): OwnerEntry;
+/** Anyone with a valid token may subscribe; publish/state are explicit opt-ins. */
+declare function publicChannel(opts?: {
+    publish?: boolean;
+    state?: {
+        read?: boolean;
+        write?: boolean;
+    };
+}): PublicEntry;
+declare function defineChannels(map: ChannelsInput): ChannelsDef;
+
 /**
  * env-gen.ts — generate the `palbase-env.d.ts` text from a `defineSchema()`
  * result.
@@ -1689,4 +1804,4 @@ declare function __runResourceBoot(envMap: Record<string, string>): Promise<void
  */
 declare function __shutdownResources(): Promise<void>;
 
-export { type AcsOptions, type ApnsOptions, type AuthHookEvent, Body, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, buildModuleClients, buildProvider, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, entitlementFor, extractVariables, flag, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, reservedSecretKey, secret, spendFor, testUser, toSchemaJSON };
+export { type AcsOptions, type ApnsOptions, type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, buildModuleClients, buildProvider, defineChannels, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, entitlementFor, extractVariables, flag, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, ownerOnly, publicChannel, reservedSecretKey, secret, spendFor, testUser, toSchemaJSON };

package/dist/index.js

@@ -11,12 +11,14 @@ import {
   jsonb,
   makeTypedDB,
   numeric,
+  openai,
   policy,
   raw,
   text,
   timestamp,
-  uuid
-} from "./chunk-SSGAMC26.js";
+  uuid,
+  vector
+} from "./chunk-I3ON7MYF.js";
 import {
   defineError,
   entitlementFor,
@@ -40,7 +42,7 @@ import {
   __requestALS,
   __runWithRuntime,
   __setRuntime
-} from "./chunk-POYAFBLF.js";
+} from "./chunk-SQC5EIWY.js";
 import {
   TxPlanError,
   TxRefError,
@@ -790,7 +792,88 @@ function mintToken(secret2) {
 }
 function buildRealtimeClient(cfg) {
   const url = `${cfg.baseUrl}/realtime/api/broadcast`;
+  const stateUrl = `${cfg.baseUrl}/realtime/api/state`;
+  async function writeState(topic, key, value, del) {
+    if (typeof topic !== "string" || topic.length === 0) {
+      return {
+        data: null,
+        error: new PalbaseModuleError("invalid_argument", "topic must be a non-empty string", 400)
+      };
+    }
+    if (typeof key !== "string" || key.length === 0) {
+      return {
+        data: null,
+        error: new PalbaseModuleError("invalid_argument", "key must be a non-empty string", 400)
+      };
+    }
+    if (!cfg.apiJwtSecret) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "realtime_unconfigured",
+          "Realtime.state is unavailable: realtime is not provisioned for this Environment (PALBASE_REALTIME_API_JWT_SECRET unset).",
+          503
+        )
+      };
+    }
+    let token;
+    try {
+      token = mintToken(cfg.apiJwtSecret);
+    } catch (err) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "realtime_token_error",
+          err instanceof Error ? err.message : "token mint failed",
+          500
+        )
+      };
+    }
+    const op = del ? { topic, key, del: true } : { topic, key, value: value ?? {} };
+    const doFetch = cfg.fetchImpl ?? globalThis.fetch;
+    let response;
+    try {
+      response = await doFetch(stateUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+        body: JSON.stringify({ ops: [op] })
+      });
+    } catch (err) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "network_error",
+          err instanceof Error ? err.message : "state request failed",
+          0
+        )
+      };
+    }
+    if (response.status === 202 || response.status === 200) {
+      return { data: void 0, error: null };
+    }
+    const detail = await response.text().catch(() => "");
+    return {
+      data: null,
+      error: new PalbaseModuleError(
+        "realtime_state_failed",
+        `realtime state write returned ${response.status}${detail ? `: ${detail}` : ""}`,
+        response.status
+      )
+    };
+  }
   return {
+    state: {
+      /** Write one DURABLE entry on a channel's shared state.
+       *
+       * The difference from broadcast is WHO it reaches: a broadcast reaches
+       * whoever is listening at that instant, while state is also handed to
+       * whoever joins afterwards. "This value is now X" wants the second — a
+       * client connecting a second later should not have to wait for the next
+       * change to learn X. */
+      set: (topic, key, value) => writeState(topic, key, value, false),
+      /** Remove one entry. */
+      clear: (topic, key) => writeState(topic, key, void 0, true)
+    },
     async broadcast(channel, event, payload) {
       if (typeof channel !== "string" || channel.length === 0) {
         return {
@@ -1046,6 +1129,7 @@ function columnToJSON(column) {
   if (def.enumName !== void 0) out.enumName = def.enumName;
   if (def.enumValues !== void 0) out.enumValues = [...def.enumValues];
   if (def.unique === true) out.unique = true;
+  if (def.dimensions !== void 0) out.dimensions = def.dimensions;
   return out;
 }
 function policyToJSON(policy2) {
@@ -1061,6 +1145,30 @@ function policyToJSON(policy2) {
     permissive: policy2.permissive !== false
   };
 }
+function searchToJSON(search) {
+  const out = {};
+  if (search.text !== void 0 && search.text.length > 0) out.text = { columns: [...search.text] };
+  const legs = search.vector === void 0 ? [] : Array.isArray(search.vector) ? search.vector : [search.vector];
+  if (legs.length > 0) {
+    out.vector = legs.map((leg) => {
+      const v = { metric: leg.metric ?? "cosine" };
+      if (leg.column !== void 0) v.column = leg.column;
+      if (leg.staleness !== void 0) v.staleness = leg.staleness;
+      if (leg.model !== void 0) {
+        v.embed = {
+          provider: leg.model.provider,
+          model: leg.model.model,
+          from: [...leg.from ?? []],
+          ...leg.model.apiKeyName !== void 0 ? { apiKeyName: leg.model.apiKeyName } : {},
+          ...leg.model.dimensions !== void 0 ? { dimensions: leg.model.dimensions } : {},
+          ...leg.model.baseURL !== void 0 ? { baseURL: leg.model.baseURL } : {}
+        };
+      }
+      return v;
+    });
+  }
+  return out;
+}
 function tableToJSON(table) {
   const columns = {};
   for (const [name, column] of Object.entries(table.columns)) {
@@ -1096,6 +1204,10 @@ function tableToJSON(table) {
   if (table.indexes !== void 0 && table.indexes.length > 0) {
     out.indexes = table.indexes.map((i) => ({ name: i.name, columns: [...i.columns] }));
   }
+  if (table.search !== void 0) {
+    const sj = searchToJSON(table.search);
+    if (sj.text !== void 0 || sj.vector !== void 0) out.search = sj;
+  }
   return out;
 }
 function toSchemaJSON(schema) {
@@ -1107,6 +1219,63 @@ function toSchemaJSON(schema) {
   return { tables, extensions: [...new Set(schema.extensions ?? [])] };
 }
 
+// src/channels.ts
+var CHANNELS = /* @__PURE__ */ Symbol.for("palbase.backend.channels");
+function ownerOnly() {
+  return { kind: "owner" };
+}
+function publicChannel(opts = {}) {
+  return { kind: "public", publish: opts.publish ?? false, state: opts.state };
+}
+function paramCount(pattern) {
+  return pattern.split(":").filter((s) => s.startsWith("{") && s.endsWith("}")).length;
+}
+function defineChannels(map) {
+  const entries = [];
+  for (const [pattern, entry] of Object.entries(map)) {
+    if ("kind" in entry && entry.kind === "owner") {
+      if (paramCount(pattern) !== 1) {
+        throw new Error(
+          `defineChannels: ownerOnly() pattern "${pattern}" must carry exactly one {param} (its value is compared to the token subject)`
+        );
+      }
+      entries.push({ pattern, kind: "owner" });
+    } else if ("kind" in entry && entry.kind === "public") {
+      entries.push({ pattern, kind: "public", publish: entry.publish, state: entry.state });
+    } else {
+      const c = entry;
+      entries.push({ pattern, kind: "custom", authorize: c.authorize, handler: c.handler });
+    }
+  }
+  const def = { entries };
+  const carrier = globalThis;
+  const existing = carrier[CHANNELS];
+  if (existing && !sameDeclaration(existing, def)) {
+    throw new Error(
+      `defineChannels: channels were already declared (${existing.entries.length} pattern(s): ${existing.entries.map((e) => e.pattern).join(", ")}). A project declares its channels ONCE \u2014 a second call would overwrite the first, and channels nobody declared are refused.`
+    );
+  }
+  carrier[CHANNELS] = def;
+  return def;
+}
+function wireRow(e) {
+  return JSON.stringify([
+    e.pattern,
+    e.kind,
+    e.publish ?? false,
+    e.state?.read ?? false,
+    e.state?.write ?? false,
+    // The handler is compared by SOURCE, like authorize: two evaluations of one
+    // module give the same text, while different logic gives different text.
+    e.handler ? e.handler.toString() : "",
+    e.authorize ? e.authorize.toString() : ""
+  ]);
+}
+function sameDeclaration(a, b) {
+  if (a.entries.length !== b.entries.length) return false;
+  return a.entries.every((x, i) => wireRow(x) === wireRow(b.entries[i]));
+}
+
 // src/db/env-gen.ts
 function baseTsType(def) {
   switch (def.type) {
@@ -1128,6 +1297,11 @@ function baseTsType(def) {
       return "boolean";
     case "jsonb":
       return "unknown";
+    // FR-008: the authoring type of a pgvector column. The default `unknown`
+    // branch below STAYS — an unknown wire type is refused on the Go side
+    // (FR-005), never papered over here.
+    case "vector":
+      return "number[]";
     case "enum": {
       const values = def.enumValues ?? [];
       if (values.length === 0) return "string";
@@ -1209,6 +1383,10 @@ function tableBlock(table, children, indent) {
     `${indent}  };`,
     `${indent}  owner: ${owner === null ? "null" : JSON.stringify(owner)};`,
     `${indent}  children: {${childEntries === "" ? "" : ` ${childEntries} `}};`,
+    // searchable: vector kolonu YA DA search beyanı → EnvTypedTable'da search()
+    // üyesini açan yapısal bayrak (FR-013). Yokken satır hiç üretilmez ki
+    // mevcut şemaların d.ts'i bayt-aynı kalsın.
+    ...cols.some(([, b]) => b._def.type === "vector") || table.search !== void 0 ? [`${indent}  searchable: true;`] : [],
     `${indent}};`
   ].join("\n");
 }
@@ -2379,6 +2557,7 @@ export {
   buildModuleClients,
   buildProvider,
   dec,
+  defineChannels,
   defineEgress,
   defineError,
   defineFlags,
@@ -2408,8 +2587,11 @@ export {
   makeTypedDB,
   now,
   numeric,
+  openai,
+  ownerOnly,
   parseFileSizeLimit,
   policy,
+  publicChannel,
   raw,
   recordThrows,
   reservedSecretKey,
@@ -2421,6 +2603,7 @@ export {
   toSchemaJSON,
   uuid,
   validateUploadAgainstStorage,
+  vector,
   z
 };
 //# sourceMappingURL=index.js.map