@palbase/backend 22.0.1 → 23.0.0

package/dist/index.cjs

@@ -26,17 +26,11 @@ __export(src_exports, {
   Client: () => Client,
   Conflict: () => Conflict,
   Controller: () => Controller,
-  DEFAULT_TEMPLATE_LOCALE: () => DEFAULT_TEMPLATE_LOCALE,
   Database: () => Database,
   Delete: () => Delete,
   Deny: () => Deny,
   Documents: () => Documents,
-  EGRESS_CONFIG_KIND: () => EGRESS_CONFIG_KIND,
-  EGRESS_TIMEOUT_DEFAULT_MS: () => EGRESS_TIMEOUT_DEFAULT_MS,
-  EGRESS_TIMEOUT_MAX_MS: () => EGRESS_TIMEOUT_MAX_MS,
-  EGRESS_TIMEOUT_MIN_MS: () => EGRESS_TIMEOUT_MIN_MS,
   EXTENSION_DEPENDENCIES: () => EXTENSION_DEPENDENCIES,
-  FLAGS_CONFIG_KIND: () => FLAGS_CONFIG_KIND,
   Flags: () => Flags,
   Forbidden: () => Forbidden,
   Get: () => Get,
@@ -45,35 +39,25 @@ __export(src_exports, {
   HttpError: () => HttpError,
   Job: () => Job,
   Log: () => Log,
-  NOTIFICATIONS_CONFIG_KIND: () => NOTIFICATIONS_CONFIG_KIND,
   NotFound: () => NotFound,
   Notifications: () => Notifications,
   On: () => On,
   OptionalUser: () => OptionalUser,
   PALBASE_EXTENSIONS: () => PALBASE_EXTENSIONS,
-  PROVIDER_CATALOG: () => PROVIDER_CATALOG,
   PalError: () => PalError,
   PalbaseModuleError: () => PalbaseModuleError,
   Param: () => Param,
   Patch: () => Patch,
   PolicyBuilder: () => PolicyBuilder,
   Post: () => Post,
-  Purchases: () => Purchases,
   Put: () => Put,
   Query: () => Query,
   QueryParams: () => QueryParams,
-  RESERVED_SECRET_PREFIX: () => RESERVED_SECRET_PREFIX,
   Realtime: () => Realtime,
   Req: () => Req,
   RequestId: () => RequestId,
-  RequireEntitlement: () => RequireEntitlement,
-  Resource: () => Resource,
-  SECRETS_CONFIG_KIND: () => SECRETS_CONFIG_KIND,
-  STORAGE_CONFIG_KIND: () => STORAGE_CONFIG_KIND,
   Secrets: () => Secrets,
-  Spend: () => Spend,
   Storage: () => Storage,
-  TEST_USERS_CONFIG_KIND: () => TEST_USERS_CONFIG_KIND,
   TooManyRequests: () => TooManyRequests,
   TraceId: () => TraceId,
   TxPlanError: () => TxPlanError,
@@ -84,32 +68,19 @@ __export(src_exports, {
   User: () => User,
   Webhook: () => Webhook,
   __getRuntime: () => __getRuntime,
-  __registerResource: () => __registerResource,
   __requestALS: () => __requestALS,
   __resetRegisteredControllers: () => __resetRegisteredControllers,
-  __runResourceBoot: () => __runResourceBoot,
   __runWithRuntime: () => __runWithRuntime,
   __setRuntime: () => __setRuntime,
-  __shutdownResources: () => __shutdownResources,
   bigint: () => bigint,
   boolean: () => boolean,
-  bucket: () => bucket,
   buildModuleClients: () => buildModuleClients,
-  buildProvider: () => buildProvider,
   dec: () => dec,
-  defineEgress: () => defineEgress,
+  defineChannels: () => defineChannels,
   defineError: () => defineError,
-  defineFlags: () => defineFlags,
   defineMiddleware: () => defineMiddleware,
-  defineNotifications: () => defineNotifications,
   defineSchema: () => defineSchema,
-  defineSecrets: () => defineSecrets,
-  defineStorage: () => defineStorage,
-  defineTestUsers: () => defineTestUsers,
-  entitlementFor: () => entitlementFor,
   enumType: () => enumType,
-  extractVariables: () => extractVariables,
-  flag: () => flag,
   getErrorRegistry: () => getErrorRegistry,
   getHookConfig: () => getHookConfig,
   getJobConfig: () => getJobConfig,
@@ -122,23 +93,21 @@ __export(src_exports, {
   jsonb: () => jsonb,
   makeEnvDts: () => makeEnvDts,
   makeHttpClient: () => makeHttpClient,
-  makePurchasesDts: () => makePurchasesDts,
+  makeStackDts: () => makeStackDts,
   makeTypedDB: () => makeTypedDB,
   now: () => now,
   numeric: () => numeric,
-  parseFileSizeLimit: () => parseFileSizeLimit,
+  openai: () => openai,
+  ownerOnly: () => ownerOnly,
   policy: () => policy,
+  publicChannel: () => publicChannel,
   raw: () => raw,
   recordThrows: () => recordThrows,
-  reservedSecretKey: () => reservedSecretKey,
-  secret: () => secret,
-  spendFor: () => spendFor,
-  testUser: () => testUser,
   text: () => text,
   timestamp: () => timestamp,
   toSchemaJSON: () => toSchemaJSON,
   uuid: () => uuid,
-  validateUploadAgainstStorage: () => validateUploadAgainstStorage,
+  vector: () => vector,
   z: () => import_zod2.z
 });
 module.exports = __toCommonJS(src_exports);
@@ -595,7 +564,11 @@ function makeTablesAccessor(ops) {
           update: (id, data) => ops().update(name, id, data),
           delete: (id) => ops().delete(name, id),
           findById: (id) => ops().findById(name, id),
-          findMany: (query) => ops().findMany(name, query)
+          findMany: (query) => ops().findMany(name, query),
+          search: (params) => ops().search(name, params),
+          similar: (id, params) => ops().similar(name, id, params),
+          recommend: (params) => ops().recommend(name, params),
+          supersede: (id, row) => ops().supersede(name, id, row)
         };
       }
     }
@@ -604,16 +577,21 @@ function makeTablesAccessor(ops) {
 }
 var rawDatabase = makeServiceProxy("Database");
 function makeTypedSurface(raw2) {
+  const reco = raw2;
   const ops = {
     query: (sql, params) => raw2.query(sql, params),
     insert: (table, data) => raw2.insert(table, data),
     update: (table, id, data) => raw2.update(table, id, data),
     delete: (table, id) => raw2.delete(table, id),
     findById: (table, id) => raw2.findById(table, id),
-    findMany: (table, query) => raw2.findMany(table, query)
+    findMany: (table, query) => raw2.findMany(table, query),
+    search: (table, params) => raw2.search(table, params),
+    similar: (table, id, params) => reco.similar(table, id, params),
+    recommend: (table, params) => reco.recommend(table, params),
+    supersede: (table, id, row) => raw2.supersede(table, id, row)
   };
   return Object.assign(ops, {
-    tables: makeTablesAccessor(() => raw2),
+    tables: makeTablesAccessor(() => reco),
     transaction(fn) {
       const builder = new TxPlanBuilder();
       return runTxPlan(raw2, makeTxTablesAccessor(builder), builder, fn);
@@ -676,7 +654,6 @@ var Cache = makeServiceProxy("Cache");
 var Secrets = makeServiceProxy("Secrets");
 var Log = makeServiceProxy("Log");
 var Notifications = makeServiceProxy("Notifications");
-var Purchases = makeServiceProxy("Purchases");
 var rawFlags = makeServiceProxy("Flags");
 var Flags = Object.assign(
   {
@@ -720,250 +697,6 @@ var Flags = Object.assign(
 );
 var Realtime = makeServiceProxy("Realtime");
 
-// src/errors.ts
-var HTTP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("palbase.backend.httpError");
-var HttpError = class extends Error {
-  status;
-  error;
-  errorDescription;
-  data;
-  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */
-  [HTTP_ERROR_BRAND] = true;
-  constructor(status, error, errorDescription, data) {
-    super(errorDescription);
-    this.name = "HttpError";
-    this.status = status;
-    this.error = error;
-    this.errorDescription = errorDescription;
-    if (data !== void 0) {
-      this.data = data;
-    }
-  }
-  /**
-   * Serialize to the standard Palbase error response format.
-   * The `requestId` is injected by the runtime layer from the request context.
-   * When called without arguments (e.g. JSON.stringify), request_id is omitted.
-   * When `data` is set, it is appended as a strict-superset field.
-   */
-  toJSON(requestId) {
-    const result = {
-      error: this.error,
-      error_description: this.errorDescription,
-      status: this.status
-    };
-    if (requestId) {
-      result.request_id = requestId;
-    }
-    if (this.data !== void 0) {
-      result.data = this.data;
-    }
-    return result;
-  }
-};
-var PalError = class extends HttpError {
-  constructor(status, code, description, data) {
-    super(status, code, description, data);
-    this.name = "PalError";
-  }
-};
-var NamedHttpError = class extends HttpError {
-  constructor(status, defaultCode, name, message, code, data) {
-    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);
-    this.name = name;
-  }
-};
-function defaultMessage(name) {
-  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
-  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
-}
-var BadRequest = class extends NamedHttpError {
-  constructor(data, message) {
-    super(400, "bad_request", "BadRequest", message, void 0, data);
-  }
-};
-var Unauthorized = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(401, "unauthorized", "Unauthorized", message, code, data);
-  }
-};
-var Forbidden = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(403, "forbidden", "Forbidden", message, code, data);
-  }
-};
-var NotFound = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(404, "not_found", "NotFound", message, code, data);
-  }
-};
-var Conflict = class extends NamedHttpError {
-  constructor(message, code, data) {
-    super(409, "conflict", "Conflict", message, code, data);
-  }
-};
-var TooManyRequests = class extends NamedHttpError {
-  constructor(data, message) {
-    super(429, "too_many_requests", "TooManyRequests", message, void 0, data);
-  }
-};
-
-// src/purchases/errors.ts
-function asPalstoreError(err) {
-  if (!(err instanceof Error)) return null;
-  const e = err;
-  if (typeof e.code !== "string" || typeof e.status !== "number") return null;
-  return { code: e.code, status: e.status, message: e.message };
-}
-function toHttpError(err) {
-  if (err instanceof HttpError) return err;
-  const p = asPalstoreError(err);
-  if (!p) return err;
-  switch (p.code) {
-    case "entitlement_required": {
-      const entitlement = err.entitlement ?? null;
-      return new PalError(403, "entitlement_required", p.message, { entitlement });
-    }
-    case "quota_exceeded":
-    case "credit_insufficient": {
-      const state = err.state;
-      return new PalError(429, p.code, p.message, state);
-    }
-    default:
-      return err;
-  }
-}
-
-// src/purchases/registry.ts
-var ENTITLEMENTS = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.entitlements");
-var SPENDS = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.spends");
-function carrierOf(target) {
-  return typeof target === "function" ? target : target.constructor ?? target;
-}
-function own(carrier, slot) {
-  if (!Object.prototype.hasOwnProperty.call(carrier, slot)) {
-    carrier[slot] = {};
-  }
-  return carrier[slot];
-}
-function recordEntitlement(target, fnName, key) {
-  own(carrierOf(target), ENTITLEMENTS)[fnName] = key;
-}
-function recordSpend(target, fnName, meta) {
-  own(carrierOf(target), SPENDS)[fnName] = meta;
-}
-function entitlementFor(ctor, fnName) {
-  return carrierOf(ctor)[ENTITLEMENTS]?.[fnName];
-}
-function spendFor(ctor, fnName) {
-  return carrierOf(ctor)[SPENDS]?.[fnName];
-}
-
-// src/purchases/subject.ts
-var subjectByRequest = /* @__PURE__ */ new WeakMap();
-function storeEnv() {
-  return process.env.PALSTORE_STORE_ENV === "sandbox" ? "sandbox" : "production";
-}
-async function currentSubjectId() {
-  const store = __requestALS.getStore();
-  if (!store) {
-    throw new Error(
-      "Purchases decorators used outside a request scope. @RequireEntitlement/@Spend resolve the subject from the request's authenticated user, so they only work inside an endpoint handler."
-    );
-  }
-  const memoized = subjectByRequest.get(store);
-  if (memoized) return memoized;
-  const userId = store.userId;
-  if (!userId) {
-    throw new Unauthorized(
-      "This endpoint requires an authenticated user: purchases entitlements and quota are per-user, and the subject is resolved from the request's identity."
-    );
-  }
-  const resolving = Purchases.resolveSubject({ userRef: userId, storeEnv: storeEnv() }).then(
-    (r) => r.subjectId
-  );
-  subjectByRequest.set(store, resolving);
-  resolving.catch(() => subjectByRequest.delete(store));
-  return resolving;
-}
-
-// src/purchases/decorators.ts
-var WRAPPED = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.wrapped");
-function idempotencyKeyFor(key) {
-  const store = __requestALS.getStore();
-  const base = store?.idempotencyKey || store?.requestId;
-  if (!base) {
-    throw new Error(
-      "@Spend needs a request-scoped idempotency key, and the runtime supplied neither an Idempotency-Key header nor a request id. Spending without one would let a retried request charge the user twice."
-    );
-  }
-  return `${base}:${key}`;
-}
-function ensureWrapper(target, fnName, descriptor) {
-  const original = descriptor.value;
-  if (typeof original !== "function") {
-    throw new Error(
-      `@RequireEntitlement/@Spend can only decorate a method; "${fnName}" is not one.`
-    );
-  }
-  if (original[WRAPPED]) return;
-  const wrapper = async function(...args) {
-    const ctor = this.constructor;
-    const entitlement = entitlementFor(ctor, fnName);
-    const spend = spendFor(ctor, fnName);
-    let subjectId;
-    try {
-      subjectId = await currentSubjectId();
-    } catch (err) {
-      throw toHttpError(err);
-    }
-    if (entitlement !== void 0) {
-      try {
-        await Purchases.require(subjectId, entitlement);
-      } catch (err) {
-        throw toHttpError(err);
-      }
-    }
-    if (spend === void 0) {
-      return original.apply(this, args);
-    }
-    let handlerFailure;
-    try {
-      return await Purchases.withSpend(
-        subjectId,
-        spend.key,
-        { count: spend.count, idempotencyKey: idempotencyKeyFor(spend.key) },
-        async () => {
-          try {
-            return await original.apply(this, args);
-          } catch (err) {
-            handlerFailure = { err };
-            throw err;
-          }
-        }
-      );
-    } catch (err) {
-      if (handlerFailure !== void 0 && handlerFailure.err === err) throw err;
-      throw toHttpError(err);
-    }
-  };
-  wrapper[WRAPPED] = true;
-  descriptor.value = wrapper;
-}
-function RequireEntitlement(key) {
-  return function(target, propertyKey, descriptor) {
-    const fnName = String(propertyKey);
-    recordEntitlement(target, fnName, key);
-    ensureWrapper(target, fnName, descriptor);
-  };
-}
-function Spend(key) {
-  return function(target, propertyKey, descriptor) {
-    const fnName = String(propertyKey);
-    recordSpend(target, fnName, { key, count: 1 });
-    ensureWrapper(target, fnName, descriptor);
-  };
-}
-
 // src/clients/http.ts
 var PalbaseModuleError = class extends Error {
   code;
@@ -1309,12 +1042,12 @@ function buildFlagsClient(http, cfg) {
       return {
         data: Object.keys(values).map((name) => {
           const value = values[name];
-          const flag2 = {
+          const flag = {
             name,
             enabled: flagEnabled(value)
           };
-          if (typeof value === "string") flag2.variant = { name: value };
-          return flag2;
+          if (typeof value === "string") flag.variant = { name: value };
+          return flag;
         }),
         error: null,
         status: res.status
@@ -1542,18 +1275,99 @@ function buildNotificationsClient(http) {
 
 // src/clients/realtime.ts
 var import_node_crypto = require("crypto");
-function mintToken(secret2) {
+function mintToken(secret) {
   const now2 = Math.floor(Date.now() / 1e3);
   const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
   const payload = Buffer.from(
     JSON.stringify({ iss: "backend-runtime", role: "service_role", iat: now2, exp: now2 + 60 })
   ).toString("base64url");
-  const sig = (0, import_node_crypto.createHmac)("sha256", secret2).update(`${header}.${payload}`).digest("base64url");
+  const sig = (0, import_node_crypto.createHmac)("sha256", secret).update(`${header}.${payload}`).digest("base64url");
   return `${header}.${payload}.${sig}`;
 }
 function buildRealtimeClient(cfg) {
   const url = `${cfg.baseUrl}/realtime/api/broadcast`;
+  const stateUrl = `${cfg.baseUrl}/realtime/api/state`;
+  async function writeState(topic, key, value, del) {
+    if (typeof topic !== "string" || topic.length === 0) {
+      return {
+        data: null,
+        error: new PalbaseModuleError("invalid_argument", "topic must be a non-empty string", 400)
+      };
+    }
+    if (typeof key !== "string" || key.length === 0) {
+      return {
+        data: null,
+        error: new PalbaseModuleError("invalid_argument", "key must be a non-empty string", 400)
+      };
+    }
+    if (!cfg.apiJwtSecret) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "realtime_unconfigured",
+          "Realtime.state is unavailable: realtime is not provisioned for this Environment (PALBASE_REALTIME_API_JWT_SECRET unset).",
+          503
+        )
+      };
+    }
+    let token;
+    try {
+      token = mintToken(cfg.apiJwtSecret);
+    } catch (err) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "realtime_token_error",
+          err instanceof Error ? err.message : "token mint failed",
+          500
+        )
+      };
+    }
+    const op = del ? { topic, key, del: true } : { topic, key, value: value ?? {} };
+    const doFetch = cfg.fetchImpl ?? globalThis.fetch;
+    let response;
+    try {
+      response = await doFetch(stateUrl, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
+        body: JSON.stringify({ ops: [op] })
+      });
+    } catch (err) {
+      return {
+        data: null,
+        error: new PalbaseModuleError(
+          "network_error",
+          err instanceof Error ? err.message : "state request failed",
+          0
+        )
+      };
+    }
+    if (response.status === 202 || response.status === 200) {
+      return { data: void 0, error: null };
+    }
+    const detail = await response.text().catch(() => "");
+    return {
+      data: null,
+      error: new PalbaseModuleError(
+        "realtime_state_failed",
+        `realtime state write returned ${response.status}${detail ? `: ${detail}` : ""}`,
+        response.status
+      )
+    };
+  }
   return {
+    state: {
+      /** Write one DURABLE entry on a channel's shared state.
+       *
+       * The difference from broadcast is WHO it reaches: a broadcast reaches
+       * whoever is listening at that instant, while state is also handed to
+       * whoever joins afterwards. "This value is now X" wants the second — a
+       * client connecting a second later should not have to wait for the next
+       * change to learn X. */
+      set: (topic, key, value) => writeState(topic, key, value, false),
+      /** Remove one entry. */
+      clear: (topic, key) => writeState(topic, key, void 0, true)
+    },
     async broadcast(channel, event, payload) {
       if (typeof channel !== "string" || channel.length === 0) {
         return {
@@ -1638,11 +1452,11 @@ function validateStoragePath(p) {
     );
   }
 }
-function toFileObject(bucket2, row) {
+function toFileObject(bucket, row) {
   return {
     name: row.path ?? "",
     path: row.path ?? "",
-    bucket: row.bucket ?? bucket2,
+    bucket: row.bucket ?? bucket,
     size: typeof row.size === "number" ? row.size : 0,
     contentType: row.contentType ?? "",
     checksum: row.checksum ?? "",
@@ -1758,35 +1572,6 @@ function buildModuleClients(cfg) {
   };
 }
 
-// src/purchases/keys-gen.ts
-function liveKeys(entries) {
-  return Object.entries(entries ?? {}).filter(([, def]) => def?.removed !== true).map(([key]) => key).sort();
-}
-function memberName(key) {
-  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
-}
-function members(keys) {
-  if (keys.length === 0) return "";
-  return `
-${keys.map((k) => `    ${memberName(k)}: true;`).join("\n")}
-  `;
-}
-function makePurchasesDts(manifest) {
-  const entitlements = liveKeys(manifest.entitlements);
-  const limits = liveKeys({ ...manifest.limits, ...manifest.credits });
-  return `// palbase-purchases.d.ts \u2014 GENERATED by @palbase/backend. Do not edit.
-// Source: the project's palstore catalog revision.
-
-declare module "@palbase/backend/purchases" {
-  interface Entitlements {${members(entitlements)}}
-
-  interface Limits {${members(limits)}}
-}
-
-export {};
-`;
-}
-
 // src/db/policy.ts
 var PolicyBuilder = class {
   _def;
@@ -1861,8 +1646,82 @@ function defineSchema(input) {
     if (table.raw !== void 0 && table.raw.length > 0) tableDef.raw = table.raw.slice();
     if (table.checks !== void 0 && table.checks.length > 0) tableDef.checks = table.checks.slice();
     if (table.indexes !== void 0 && table.indexes.length > 0) tableDef.indexes = table.indexes.slice();
+    if (table.search !== void 0) {
+      const s = table.search;
+      if (s.from !== void 0) {
+        if (s.vector !== void 0) {
+          throw new Error(
+            `table ${String(name)}: search beyan\u0131nda tek bi\xE7im kullan\u0131n \u2014 'from' (yeni) ile 'vector' (eski) birlikte olamaz`
+          );
+        }
+        if (s.from.length === 0) {
+          throw new Error(`table ${String(name)}: search.from bo\u015F olamaz`);
+        }
+        if (s.model === void 0) {
+          throw new Error(
+            `table ${String(name)}: search.from model'siz anlams\u0131z \u2014 auto-embed i\xE7in model verin (BYO i\xE7in eski 'vector' bi\xE7imini kullan\u0131n)`
+          );
+        }
+        if (Array.isArray(s.text) && s.text.length === 0) {
+          throw new Error(`table ${String(name)}: search.text bo\u015F dizi olamaz \u2014 FTS istemiyorsan text: false yaz\u0131n`);
+        }
+      } else {
+        if (typeof s.text === "boolean") {
+          throw new Error(`table ${String(name)}: text:${String(s.text)} yaln\u0131z yeni bi\xE7imde ('from' ile) ge\xE7erli`);
+        }
+        if (s.text === void 0 && s.vector === void 0) {
+          throw new Error(
+            `table ${String(name)}: search beyan\u0131 bo\u015F \u2014 en az bir kol (text ya da vector) verin, yoksa alan\u0131 hi\xE7 yazmay\u0131n`
+          );
+        }
+        if (s.text !== void 0 && s.text.length === 0) {
+          throw new Error(`table ${String(name)}: search.text bo\u015F olamaz \u2014 FTS kolu istemiyorsan alan\u0131 hi\xE7 yazma`);
+        }
+        const legs = s.vector === void 0 ? [] : Array.isArray(s.vector) ? s.vector : [s.vector];
+        for (const leg of legs) {
+          if (leg.model !== void 0 && (leg.from === void 0 || leg.from.length === 0)) {
+            throw new Error(`table ${String(name)}: search.vector.model beyan edildi ama 'from' yok \u2014 embed kayna\u011F\u0131 kolonlar zorunlu (C-2)`);
+          }
+          if (leg.model === void 0 && leg.from !== void 0) {
+            throw new Error(`table ${String(name)}: search.vector.from model'siz anlams\u0131z \u2014 auto-embed i\xE7in model verin`);
+          }
+        }
+      }
+      tableDef.search = s;
+    }
+    if (table.memory !== void 0) {
+      if (table.memory.from.length === 0) {
+        throw new Error(`table ${String(name)}: memory.from bo\u015F olamaz`);
+      }
+      tableDef.memory = table.memory;
+    }
     tables[name] = tableDef;
   }
+  for (const [name, def] of Object.entries(tables)) {
+    const m = def.memory;
+    if (m === void 0) continue;
+    const target = Object.values(tables).find((t) => t.name === m.into);
+    if (target === void 0) {
+      throw new Error(`table ${name}: memory.into "${m.into}" \u015Femada declared de\u011Fil`);
+    }
+    const subject = m.subject ?? "owner";
+    if (!(subject in def.columns)) {
+      throw new Error(`table ${name}: memory.subject "${subject}" kolonu kaynak tabloda yok`);
+    }
+    if (!(subject in target.columns)) {
+      throw new Error(`table ${name}: memory.subject "${subject}" kolonu hedef "${m.into}" tablosunda yok`);
+    }
+    const factCol = target.columns["fact"];
+    const factDef = factCol !== void 0 && "_def" in factCol ? factCol._def : factCol;
+    if (factDef === void 0 || factDef.type !== "text") {
+      throw new Error(`table ${name}: memory.into "${m.into}" tablosunda "fact" (text) kolonu zorunlu`);
+    }
+    for (const c of m.from) {
+      if (!(c in def.columns)) {
+        throw new Error(`table ${name}: memory.from kolonu "${c}" kaynak tabloda yok`);
+      }
+    }
+  }
   const extensions = [...new Set(input.extensions ?? [])];
   return { tables, extensions };
 }
@@ -1889,6 +1748,7 @@ function columnToJSON(column) {
   if (def.enumName !== void 0) out.enumName = def.enumName;
   if (def.enumValues !== void 0) out.enumValues = [...def.enumValues];
   if (def.unique === true) out.unique = true;
+  if (def.dimensions !== void 0) out.dimensions = def.dimensions;
   return out;
 }
 function policyToJSON(policy2) {
@@ -1904,6 +1764,75 @@ function policyToJSON(policy2) {
     permissive: policy2.permissive !== false
   };
 }
+function commonSearchFields(search, out) {
+  if (search.synonyms !== void 0 && Object.keys(search.synonyms).length > 0) {
+    out.synonyms = Object.fromEntries(
+      Object.entries(search.synonyms).map(([word, alts]) => [word, [...alts]])
+    );
+  }
+  if (search.validity === true) out.validity = true;
+}
+function searchToJSON(search, vectorColumn) {
+  if (search.from !== void 0 && search.model !== void 0) {
+    const out2 = {};
+    const textCols = search.text === false ? void 0 : Array.isArray(search.text) && search.text.length > 0 ? search.text : search.from;
+    if (textCols !== void 0) out2.text = { columns: [...textCols] };
+    const v = { metric: search.metric ?? "cosine" };
+    if (vectorColumn !== void 0) v.column = vectorColumn;
+    v.embed = {
+      provider: search.model.provider,
+      model: search.model.model,
+      from: [...search.from],
+      ...search.model.apiKeyName !== void 0 ? { apiKeyName: search.model.apiKeyName } : {},
+      ...search.model.dimensions !== void 0 ? { dimensions: search.model.dimensions } : {},
+      ...search.model.baseURL !== void 0 ? { baseURL: search.model.baseURL } : {}
+    };
+    if (search.staleness !== void 0) v.staleness = search.staleness;
+    if (vectorColumn === void 0) {
+      v.mode = "chunks";
+      if (search.chunks !== void 0) {
+        const c = {};
+        if (search.chunks.size !== void 0 && search.chunks.size > 0) c.sizeChars = search.chunks.size;
+        if (search.chunks.overlap !== void 0 && search.chunks.overlap > 0) c.overlapChars = search.chunks.overlap;
+        if (Object.keys(c).length > 0) v.chunks = c;
+      }
+    }
+    out2.vector = [v];
+    commonSearchFields(search, out2);
+    return out2;
+  }
+  const out = {};
+  if (Array.isArray(search.text) && search.text.length > 0) out.text = { columns: [...search.text] };
+  const legs = search.vector === void 0 ? [] : Array.isArray(search.vector) ? search.vector : [search.vector];
+  if (legs.length > 0) {
+    out.vector = legs.map((leg) => {
+      const v = { metric: leg.metric ?? "cosine" };
+      if (leg.column !== void 0) v.column = leg.column;
+      if (leg.staleness !== void 0) v.staleness = leg.staleness;
+      if (leg.model !== void 0) {
+        v.embed = {
+          provider: leg.model.provider,
+          model: leg.model.model,
+          from: [...leg.from ?? []],
+          ...leg.model.apiKeyName !== void 0 ? { apiKeyName: leg.model.apiKeyName } : {},
+          ...leg.model.dimensions !== void 0 ? { dimensions: leg.model.dimensions } : {},
+          ...leg.model.baseURL !== void 0 ? { baseURL: leg.model.baseURL } : {}
+        };
+      }
+      return v;
+    });
+  }
+  commonSearchFields(search, out);
+  return out;
+}
+function memoryToJSON(m) {
+  return {
+    from: [...m.from],
+    into: m.into,
+    ...m.subject !== void 0 ? { subject: m.subject } : {},
+    extract: { provider: m.extract.provider, model: m.extract.model }
+  };
+}
 function tableToJSON(table) {
   const columns = {};
   for (const [name, column] of Object.entries(table.columns)) {
@@ -1939,6 +1868,14 @@ function tableToJSON(table) {
   if (table.indexes !== void 0 && table.indexes.length > 0) {
     out.indexes = table.indexes.map((i) => ({ name: i.name, columns: [...i.columns] }));
   }
+  if (table.search !== void 0) {
+    const vectorColumn = Object.entries(columns).find(([, c]) => c.dimensions !== void 0)?.[0];
+    const sj = searchToJSON(table.search, vectorColumn);
+    if (sj.text !== void 0 || sj.vector !== void 0) out.search = sj;
+  }
+  if (table.memory !== void 0) {
+    out.memory = memoryToJSON(table.memory);
+  }
   return out;
 }
 function toSchemaJSON(schema) {
@@ -1950,6 +1887,63 @@ function toSchemaJSON(schema) {
   return { tables, extensions: [...new Set(schema.extensions ?? [])] };
 }
 
+// src/channels.ts
+var CHANNELS = /* @__PURE__ */ Symbol.for("palbase.backend.channels");
+function ownerOnly() {
+  return { kind: "owner" };
+}
+function publicChannel(opts = {}) {
+  return { kind: "public", publish: opts.publish ?? false, state: opts.state };
+}
+function paramCount(pattern) {
+  return pattern.split(":").filter((s) => s.startsWith("{") && s.endsWith("}")).length;
+}
+function defineChannels(map) {
+  const entries = [];
+  for (const [pattern, entry] of Object.entries(map)) {
+    if ("kind" in entry && entry.kind === "owner") {
+      if (paramCount(pattern) !== 1) {
+        throw new Error(
+          `defineChannels: ownerOnly() pattern "${pattern}" must carry exactly one {param} (its value is compared to the token subject)`
+        );
+      }
+      entries.push({ pattern, kind: "owner" });
+    } else if ("kind" in entry && entry.kind === "public") {
+      entries.push({ pattern, kind: "public", publish: entry.publish, state: entry.state });
+    } else {
+      const c = entry;
+      entries.push({ pattern, kind: "custom", authorize: c.authorize, handler: c.handler });
+    }
+  }
+  const def = { entries };
+  const carrier = globalThis;
+  const existing = carrier[CHANNELS];
+  if (existing && !sameDeclaration(existing, def)) {
+    throw new Error(
+      `defineChannels: channels were already declared (${existing.entries.length} pattern(s): ${existing.entries.map((e) => e.pattern).join(", ")}). A project declares its channels ONCE \u2014 a second call would overwrite the first, and channels nobody declared are refused.`
+    );
+  }
+  carrier[CHANNELS] = def;
+  return def;
+}
+function wireRow(e) {
+  return JSON.stringify([
+    e.pattern,
+    e.kind,
+    e.publish ?? false,
+    e.state?.read ?? false,
+    e.state?.write ?? false,
+    // The handler is compared by SOURCE, like authorize: two evaluations of one
+    // module give the same text, while different logic gives different text.
+    e.handler ? e.handler.toString() : "",
+    e.authorize ? e.authorize.toString() : ""
+  ]);
+}
+function sameDeclaration(a, b) {
+  if (a.entries.length !== b.entries.length) return false;
+  return a.entries.every((x, i) => wireRow(x) === wireRow(b.entries[i]));
+}
+
 // src/db/extensions.ts
 var PALBASE_EXTENSIONS = [
   // Search & text
@@ -1963,8 +1957,6 @@ var PALBASE_EXTENSIONS = [
   "citext",
   // case-insensitive text type
   // Geospatial / location
-  "postgis",
-  // geospatial types + queries (maps, "near me")
   "cube",
   // multi-dimensional cubes (dependency of earthdistance)
   "earthdistance",
@@ -1979,8 +1971,6 @@ var PALBASE_EXTENSIONS = [
   // GiST operator classes for scalar types — needed for EXCLUDE
   // constraints that mix "=" with a range/&& overlap (e.g. no-double-booking).
   // Scheduling
-  "pg_cron",
-  // schedule jobs inside the database
   // Crypto / ids (also installed by default; listable for explicitness)
   "pgcrypto",
   // cryptographic functions (hashing, encryption)
@@ -1995,6 +1985,11 @@ function isPalbaseExtension(name) {
 }
 
 // src/db/columns.ts
+function refuseOnVector(def, modifier) {
+  if (def.type === "vector") {
+    throw new Error(`vector column: .${modifier}() is not supported (FR-002 \u2014 allowed: nullable()/notNull())`);
+  }
+}
 var ColumnBuilder = class _ColumnBuilder {
   _def;
   constructor(type, existingDef) {
@@ -2006,6 +2001,7 @@ var ColumnBuilder = class _ColumnBuilder {
   }
   /** Mark this column as the primary key. */
   primaryKey() {
+    refuseOnVector(this._def, "primaryKey");
     this._def.primaryKey = true;
     return new _ColumnBuilder(this._def.type, this._def);
   }
@@ -2021,16 +2017,19 @@ var ColumnBuilder = class _ColumnBuilder {
   }
   /** Set a default value. */
   default(value) {
+    refuseOnVector(this._def, "default");
     this._def.defaultValue = value;
     return new _ColumnBuilder(this._def.type, this._def);
   }
   /** UUID: generate a random default (gen_random_uuid()). */
   defaultRandom() {
+    refuseOnVector(this._def, "defaultRandom");
     this._def.defaultRandom = true;
     return new _ColumnBuilder(this._def.type, this._def);
   }
   /** Timestamp: default to now(). */
   defaultNow() {
+    refuseOnVector(this._def, "defaultNow");
     this._def.defaultNow = true;
     return new _ColumnBuilder(this._def.type, this._def);
   }
@@ -2051,6 +2050,7 @@ var ColumnBuilder = class _ColumnBuilder {
     return this;
   }
   references(table, column) {
+    refuseOnVector(this._def, "references");
     this._def.references = { table, column };
     return new _ColumnBuilder(this._def.type, this._def);
   }
@@ -2075,6 +2075,7 @@ var ColumnBuilder = class _ColumnBuilder {
    * as the real boundary; this signature is the compile-time DX mirror.
    */
   referencesAuthUser(onDelete) {
+    refuseOnVector(this._def, "referencesAuthUser");
     this._def.references = { table: "auth.users", column: "id" };
     this._def.onDeleteAction = onDelete;
     return new _ColumnBuilder(this._def.type, this._def);
@@ -2098,6 +2099,7 @@ var ColumnBuilder = class _ColumnBuilder {
    * boundary; this signature is the compile-time DX mirror.
    */
   referencesInstallation(onDelete) {
+    refuseOnVector(this._def, "referencesInstallation");
     this._def.references = { table: "auth.installations", column: "id" };
     this._def.onDeleteAction = onDelete;
     return new _ColumnBuilder(this._def.type, this._def);
@@ -2109,6 +2111,7 @@ var ColumnBuilder = class _ColumnBuilder {
   }
   /** Add a single-column UNIQUE constraint. */
   unique() {
+    refuseOnVector(this._def, "unique");
     this._def.unique = true;
     return new _ColumnBuilder(this._def.type, this._def);
   }
@@ -2143,12 +2146,36 @@ function enumType(name, values) {
   builder._def.enumValues = [...values];
   return builder;
 }
+function vector(dimensions) {
+  if (!Number.isInteger(dimensions) || dimensions < 1 || dimensions > 2e3) {
+    throw new Error(`vector(): dimensions must be an integer in [1, 2000], got ${String(dimensions)}`);
+  }
+  const b = new ColumnBuilder("vector");
+  b._def.dimensions = dimensions;
+  return b;
+}
 
 // src/db/raw.ts
 function raw(name, up, opts) {
   return { name, up, ...opts?.down != null ? { down: opts.down } : {} };
 }
 
+// src/db/embedding.ts
+var openai = {
+  embedding(model, opts) {
+    return {
+      provider: "openai",
+      model,
+      apiKeyName: opts?.apiKeyName ?? "OPENAI_API_KEY",
+      ...opts?.dimensions !== void 0 ? { dimensions: opts.dimensions } : {},
+      ...opts?.baseURL !== void 0 ? { baseURL: opts.baseURL } : {}
+    };
+  },
+  chat(model) {
+    return { provider: "openai", model };
+  }
+};
+
 // src/db/typed-db.ts
 function makeTypedTable(name, raw2) {
   return {
@@ -2208,6 +2235,11 @@ function baseTsType(def) {
       return "boolean";
     case "jsonb":
       return "unknown";
+    // FR-008: the authoring type of a pgvector column. The default `unknown`
+    // branch below STAYS — an unknown wire type is refused on the Go side
+    // (FR-005), never papered over here.
+    case "vector":
+      return "number[]";
     case "enum": {
       const values = def.enumValues ?? [];
       if (values.length === 0) return "string";
@@ -2241,10 +2273,10 @@ function buildChildEdges(schema) {
       const ref = builder._def.references;
       if (ref === void 0) continue;
       if (ref.table === childName) continue;
-      const bucket2 = edges.get(ref.table);
-      if (bucket2 === void 0) continue;
-      if (bucket2.some((e) => e.child === childName)) continue;
-      bucket2.push({ child: childName, column: col });
+      const bucket = edges.get(ref.table);
+      if (bucket === void 0) continue;
+      if (bucket.some((e) => e.child === childName)) continue;
+      bucket.push({ child: childName, column: col });
     }
   }
   return edges;
@@ -2289,6 +2321,10 @@ function tableBlock(table, children, indent) {
     `${indent}  };`,
     `${indent}  owner: ${owner === null ? "null" : JSON.stringify(owner)};`,
     `${indent}  children: {${childEntries === "" ? "" : ` ${childEntries} `}};`,
+    // searchable: vector kolonu YA DA search beyanı → EnvTypedTable'da search()
+    // üyesini açan yapısal bayrak (FR-013). Yokken satır hiç üretilmez ki
+    // mevcut şemaların d.ts'i bayt-aynı kalsın.
+    ...cols.some(([, b]) => b._def.type === "vector") || table.search !== void 0 ? [`${indent}  searchable: true;`] : [],
     `${indent}};`
   ].join("\n");
 }
@@ -2314,638 +2350,50 @@ export {};
 `;
 }
 
-// src/config/storage.ts
-var STORAGE_CONFIG_KIND = "storage";
-var VARIANT_FORMATS = ["webp", "avif", "jpeg", "png"];
-var VARIANT_FITS = ["cover", "contain", "inside"];
-function normalizeVariants(input) {
-  if (input === null || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("bucket variants must be an object of { <name>: { width?, height?, format? } }");
-  }
-  const out = {};
-  for (const [name, spec] of Object.entries(input)) {
-    if (!/^[a-z0-9][a-z0-9_-]*$/i.test(name)) {
-      throw new Error(
-        `bucket variant name "${name}" must be alphanumeric with optional - or _ (e.g. "thumb", "card_2x")`
-      );
-    }
-    if (spec === null || typeof spec !== "object" || Array.isArray(spec)) {
-      throw new Error(`bucket variant "${name}" must be an object like { width: 100, height: 100 }`);
-    }
-    for (const dim of ["width", "height"]) {
-      const value = spec[dim];
-      if (value === void 0) continue;
-      if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-        throw new Error(`bucket variant "${name}" ${dim} must be a positive integer, got ${String(value)}`);
-      }
-    }
-    if (spec.width === void 0 && spec.height === void 0) {
-      throw new Error(`bucket variant "${name}" must set width and/or height`);
-    }
-    if (spec.format !== void 0 && !VARIANT_FORMATS.includes(spec.format)) {
-      throw new Error(
-        `bucket variant "${name}" format must be one of ${VARIANT_FORMATS.join(", ")}, got "${String(spec.format)}"`
-      );
-    }
-    if (spec.fit !== void 0 && !VARIANT_FITS.includes(spec.fit)) {
-      throw new Error(
-        `bucket variant "${name}" fit must be one of ${VARIANT_FITS.join(", ")}, got "${String(spec.fit)}"`
-      );
-    }
-    if (spec.quality !== void 0) {
-      const q = spec.quality;
-      if (typeof q !== "number" || !Number.isInteger(q) || q < 1 || q > 100) {
-        throw new Error(`bucket variant "${name}" quality must be an integer 1\u2013100, got ${String(q)}`);
-      }
-    }
-    if (spec.fit === "cover" && (spec.width === void 0 || spec.height === void 0)) {
-      throw new Error(`bucket variant "${name}" uses fit "cover", which needs BOTH width and height`);
-    }
-    out[name] = {
-      ...spec.width !== void 0 ? { width: spec.width } : {},
-      ...spec.height !== void 0 ? { height: spec.height } : {},
-      ...spec.fit !== void 0 ? { fit: spec.fit } : {},
-      ...spec.format !== void 0 ? { format: spec.format } : {},
-      ...spec.quality !== void 0 ? { quality: spec.quality } : {}
-    };
-  }
-  return out;
+// src/stack-gen.ts
+function liveNames(names) {
+  return [...new Set(names)].sort();
 }
-var UNIT_BYTES = {
-  b: 1,
-  kb: 1024,
-  mb: 1024 ** 2,
-  gb: 1024 ** 3,
-  tb: 1024 ** 4
-};
-function parseFileSizeLimit(input) {
-  if (typeof input === "number") {
-    if (!Number.isFinite(input) || input < 0 || !Number.isInteger(input)) {
-      throw new Error(
-        `bucket fileSizeLimit must be a non-negative integer number of bytes, got ${input}`
-      );
-    }
-    return input;
-  }
-  const trimmed = input.trim();
-  const match = /^(\d+(?:\.\d+)?)\s*([a-zA-Z]+)?$/.exec(trimmed);
-  if (!match) {
-    throw new Error(
-      `bucket fileSizeLimit string must be "<number><unit>" like "5MB" or "1GB", got "${input}"`
-    );
-  }
-  const value = Number.parseFloat(match[1]);
-  const unit = (match[2] ?? "b").toLowerCase();
-  const multiplier = UNIT_BYTES[unit];
-  if (multiplier === void 0) {
-    throw new Error(
-      `bucket fileSizeLimit has an unknown unit "${match[2]}" \u2014 use B, KB, MB, GB, or TB (e.g. "5MB")`
-    );
-  }
-  const bytes = value * multiplier;
-  if (!Number.isFinite(bytes) || bytes < 0) {
-    throw new Error(`bucket fileSizeLimit resolved to an invalid byte count: ${bytes}`);
-  }
-  return Math.round(bytes);
+function memberName(name) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
 }
-var MIME_RE = /^[a-zA-Z0-9][a-zA-Z0-9!#$&^_.+-]*\/(?:\*|[a-zA-Z0-9][a-zA-Z0-9!#$&^_.+-]*)$/;
-function bucket(opts = {}) {
-  const fileSizeLimit = opts.fileSizeLimit === void 0 ? null : parseFileSizeLimit(opts.fileSizeLimit);
-  let allowedMimeTypes = null;
-  if (opts.allowedMimeTypes !== void 0) {
-    if (!Array.isArray(opts.allowedMimeTypes)) {
-      throw new Error("bucket allowedMimeTypes must be an array of MIME-type strings");
-    }
-    for (const mime of opts.allowedMimeTypes) {
-      if (typeof mime !== "string" || !MIME_RE.test(mime.trim())) {
-        throw new Error(
-          `bucket allowedMimeTypes entry "${mime}" is not a valid MIME type (expected "type/subtype", e.g. "image/png")`
-        );
-      }
-    }
-    allowedMimeTypes = [...new Set(opts.allowedMimeTypes.map((m) => m.trim()))];
-  }
-  return {
-    public: opts.public ?? false,
-    fileSizeLimit,
-    allowedMimeTypes,
-    variants: opts.variants === void 0 ? null : normalizeVariants(opts.variants)
-  };
+function members(names) {
+  if (names.length === 0) return "";
+  return `
+${names.map((n) => `    ${memberName(n)}: true;`).join("\n")}
+  `;
 }
-function defineStorage(input) {
-  if (input === null || typeof input !== "object" || typeof input.buckets !== "object") {
-    throw new Error("defineStorage expects { buckets: { <name>: bucket({...}) } }");
-  }
-  const buckets = {};
-  for (const name of Object.keys(input.buckets)) {
-    if (name.length === 0) {
-      throw new Error("bucket name must be a non-empty string");
-    }
-    const def = input.buckets[name];
-    if (def === void 0) continue;
-    buckets[name] = def;
-  }
-  return { __config: STORAGE_CONFIG_KIND, buckets };
+function bucketMembers(buckets) {
+  const normalized = buckets.map((b) => typeof b === "string" ? { name: b, variants: [] } : b);
+  const byName = /* @__PURE__ */ new Map();
+  for (const b of normalized) byName.set(b.name, b.variants);
+  const names = [...byName.keys()].sort();
+  if (names.length === 0) return "";
+  const rows = names.map((name) => {
+    const variants = [...new Set(byName.get(name) ?? [])].sort();
+    const union = variants.length === 0 ? "never" : variants.map((v) => JSON.stringify(v)).join(" | ");
+    return `    ${memberName(name)}: { variants: ${union} };`;
+  });
+  return `
+${rows.join("\n")}
+  `;
 }
+function makeStackDts(names) {
+  const secrets = liveNames(names.secrets);
+  const flags = liveNames(names.flags);
+  return `// palbase-stack.d.ts \u2014 GENERATED by @palbase/backend. Do not edit.
+// Source: the linked environment's stack.
 
-// src/config/egress.ts
-var EGRESS_CONFIG_KIND = "egress";
-var EGRESS_TIMEOUT_MIN_MS = 1e3;
-var EGRESS_TIMEOUT_MAX_MS = 3e5;
-var EGRESS_TIMEOUT_DEFAULT_MS = 3e4;
-function defineEgress(input) {
-  if (input === null || typeof input !== "object" || !Array.isArray(input.hosts)) {
-    throw new Error("defineEgress expects { hosts: string[] }");
-  }
-  const hosts = [];
-  for (const h of input.hosts) {
-    if (typeof h !== "string" || h.trim().length === 0) {
-      throw new Error("defineEgress: every host must be a non-empty string");
-    }
-    hosts.push(h.trim().toLowerCase());
-  }
-  if (input.timeoutMs === void 0) {
-    return { __config: EGRESS_CONFIG_KIND, hosts };
-  }
-  const timeoutMs = input.timeoutMs;
-  if (typeof timeoutMs !== "number" || !Number.isInteger(timeoutMs)) {
-    throw new Error("defineEgress: timeoutMs must be an integer number of milliseconds");
-  }
-  if (timeoutMs < EGRESS_TIMEOUT_MIN_MS || timeoutMs > EGRESS_TIMEOUT_MAX_MS) {
-    throw new Error(
-      `defineEgress: timeoutMs must be between ${EGRESS_TIMEOUT_MIN_MS} and ${EGRESS_TIMEOUT_MAX_MS} (got ${timeoutMs})`
-    );
-  }
-  return { __config: EGRESS_CONFIG_KIND, hosts, timeoutMs };
-}
+declare module "@palbase/backend/stack" {
+  interface Secrets {${members(secrets)}}
 
-// src/config/notifications.ts
-var NOTIFICATIONS_CONFIG_KIND = "notifications";
-var RESERVED_SECRET_PREFIX = "PB_NOTIFICATIONS";
-var PROVIDER_CATALOG = {
-  apns: {
-    channel: "push",
-    required: ["teamId", "keyId", "bundleId"],
-    optional: ["isProduction"],
-    secrets: ["p8"]
-  },
-  fcm: {
-    channel: "push",
-    required: [],
-    optional: [],
-    secrets: ["serviceAccount"]
-  },
-  sendgrid: {
-    channel: "email",
-    required: ["fromDomain"],
-    optional: [],
-    secrets: ["apiKey"]
-  },
-  ses: {
-    channel: "email",
-    required: ["region", "accessKeyId", "fromDomain"],
-    optional: [],
-    secrets: ["secretAccessKey"]
-  },
-  smtp: {
-    channel: "email",
-    required: ["host", "port", "fromEmail"],
-    optional: ["username", "useStarttls"],
-    secrets: ["password"]
-  },
-  acs: {
-    channel: "email",
-    required: ["fromEmail"],
-    optional: ["fromName"],
-    secrets: ["connectionString"]
-  },
-  twilio: {
-    channel: "sms",
-    // account_sid required; one of from_number / messaging_service_sid required
-    // (enforced by the refine in buildProvider, not by the flat `required` list).
-    required: ["accountSid"],
-    optional: ["fromNumber", "messagingServiceSid"],
-    secrets: ["authToken"]
-  }
-};
-var DEFAULT_TEMPLATE_LOCALE = "en";
-function extractVariables(...sources) {
-  const found = /* @__PURE__ */ new Set();
-  for (const src of sources) {
-    if (!src) continue;
-    for (const match of src.matchAll(/\{\{\{?\s*([^{}]+?)\s*\}?\}\}/g)) {
-      const token = (match[1] ?? "").trim();
-      if (token === "" || "#/^!>&".includes(token.charAt(0)) || token === "else") continue;
-      if (/\s/.test(token)) continue;
-      const root = token.split(".")[0] ?? "";
-      if (root === "" || root === "this" || root.startsWith("@")) continue;
-      found.add(root);
-    }
-  }
-  return [...found].sort();
-}
-function buildEmailTemplate(slug, opts) {
-  const row = (locale, c) => {
-    if (!c.subject) throw new Error(`notifications: email template "${slug}" (${locale}) needs a subject`);
-    if (!c.html) throw new Error(`notifications: email template "${slug}" (${locale}) needs an html body`);
-    const def = {
-      slug,
-      locale,
-      subject: c.subject,
-      html_body: c.html,
-      variables: c.variables ? [...c.variables] : extractVariables(c.subject, c.html, c.text)
-    };
-    if (c.text !== void 0) def.text_body = c.text;
-    return def;
-  };
-  const rows = [row(opts.locale ?? DEFAULT_TEMPLATE_LOCALE, opts)];
-  for (const [locale, content] of Object.entries(opts.locales ?? {})) {
-    rows.push(row(locale, content));
-  }
-  return rows;
-}
-function buildSmsTemplate(slug, opts) {
-  const row = (locale, c) => {
-    if (!c.body) throw new Error(`notifications: sms template "${slug}" (${locale}) needs a body`);
-    return {
-      slug,
-      locale,
-      body: c.body,
-      variables: c.variables ? [...c.variables] : extractVariables(c.body)
-    };
-  };
-  const rows = [row(opts.locale ?? DEFAULT_TEMPLATE_LOCALE, opts)];
-  for (const [locale, content] of Object.entries(opts.locales ?? {})) {
-    rows.push(row(locale, content));
-  }
-  return rows;
-}
-function buildTemplates(input) {
-  const out = { email: [], sms: [] };
-  const seen = /* @__PURE__ */ new Set();
-  const claim = (channel, slug, locale) => {
-    const key = `${channel}/${slug}/${locale}`;
-    if (seen.has(key)) {
-      throw new Error(`notifications: ${channel} template "${slug}" declares locale "${locale}" twice`);
-    }
-    seen.add(key);
-  };
-  for (const [slug, opts] of Object.entries(input.email ?? {})) {
-    for (const row of buildEmailTemplate(slug, opts)) {
-      claim("email", row.slug, row.locale);
-      out.email.push(row);
-    }
-  }
-  for (const [slug, opts] of Object.entries(input.sms ?? {})) {
-    for (const row of buildSmsTemplate(slug, opts)) {
-      claim("sms", row.slug, row.locale);
-      out.sms.push(row);
-    }
-  }
-  return out;
-}
-function buildProvider(name, opts) {
-  const entry = PROVIDER_CATALOG[name];
-  const src = { ...opts };
-  const enabled = src.enabled === void 0 ? false : Boolean(src.enabled);
-  if (!enabled) {
-    return { enabled: false };
-  }
-  const def = { enabled: true };
-  for (const field of entry.required) {
-    const value = src[field];
-    if (value === void 0 || value === null || value === "") {
-      throw new Error(
-        `notifications: provider "${name}" is enabled but missing required field "${field}"`
-      );
-    }
-    def[field] = value;
-  }
-  for (const field of entry.optional) {
-    if (src[field] !== void 0) {
-      def[field] = src[field];
-    }
-  }
-  if (name === "twilio") {
-    const hasFrom = Boolean(def.fromNumber);
-    const hasMsg = Boolean(def.messagingServiceSid);
-    if (!hasFrom && !hasMsg) {
-      throw new Error(
-        'notifications: provider "twilio" requires one of "fromNumber" or "messagingServiceSid"'
-      );
-    }
-  }
-  return def;
-}
-function defineNotifications(input) {
-  if (input === null || typeof input !== "object") {
-    throw new Error("defineNotifications expects { push?, email?, sms? }");
-  }
-  const config = {
-    __config: NOTIFICATIONS_CONFIG_KIND,
-    push: {},
-    email: {},
-    sms: {},
-    templates: buildTemplates(input.templates ?? {})
-  };
-  const push = input.push ?? {};
-  if (push.apns !== void 0) config.push.apns = buildProvider("apns", push.apns);
-  if (push.fcm !== void 0) config.push.fcm = buildProvider("fcm", push.fcm);
-  const email = input.email ?? {};
-  if (email.sendgrid !== void 0) config.email.sendgrid = buildProvider("sendgrid", email.sendgrid);
-  if (email.ses !== void 0) config.email.ses = buildProvider("ses", email.ses);
-  if (email.smtp !== void 0) config.email.smtp = buildProvider("smtp", email.smtp);
-  if (email.acs !== void 0) config.email.acs = buildProvider("acs", email.acs);
-  const sms = input.sms ?? {};
-  if (sms.twilio !== void 0) config.sms.twilio = buildProvider("twilio", sms.twilio);
-  return config;
-}
-function reservedSecretKey(provider, secretField) {
-  return `${RESERVED_SECRET_PREFIX}_${camelToUpperSnake(provider)}_${camelToUpperSnake(secretField)}`;
-}
-function camelToUpperSnake(s) {
-  return s.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase();
-}
+  interface Flags {${members(flags)}}
 
-// src/config/test-users.ts
-var TEST_USERS_CONFIG_KIND = "test-users";
-var TEST_USER_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_]*$/;
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var E164_RE = /^\+[1-9]\d{1,14}$/;
-var OTP_LENGTH = 6;
-var OTP_RE = /^\d{6}$/;
-var MIN_PASSWORD_LENGTH = 8;
-function isPlainObject2(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function normalizeSeed(seed, userName) {
-  if (seed === void 0) return {};
-  if (!isPlainObject2(seed)) {
-    throw new Error(`testUser ${JSON.stringify(userName)}: seed must be { <table>: [ {...} ] }`);
-  }
-  const out = {};
-  for (const [table, rows] of Object.entries(seed)) {
-    if (!Array.isArray(rows)) {
-      throw new Error(
-        `testUser ${JSON.stringify(userName)}: seed.${table} must be an array of rows`
-      );
-    }
-    if (rows.length === 0) {
-      throw new Error(
-        `testUser ${JSON.stringify(userName)}: seed.${table} is empty \u2014 remove it or add a row`
-      );
-    }
-    for (const row of rows) {
-      if (!isPlainObject2(row)) {
-        throw new Error(
-          `testUser ${JSON.stringify(userName)}: every row in seed.${table} must be an object`
-        );
-      }
-    }
-    out[table] = rows;
-  }
-  return out;
-}
-function testUser(opts = {}) {
-  if (!isPlainObject2(opts)) {
-    throw new Error("testUser() expects { email?, password?, phone?, otp?, seed? }");
-  }
-  const hasEmail = opts.email !== void 0;
-  const hasPassword = opts.password !== void 0;
-  if (hasEmail !== hasPassword) {
-    throw new Error(
-      "testUser() needs email AND password together (a fixture with stable credentials) or neither (a template the server generates credentials for)"
-    );
-  }
-  let email = null;
-  let password = null;
-  if (hasEmail) {
-    if (typeof opts.email !== "string" || !EMAIL_RE.test(opts.email)) {
-      throw new Error(`testUser email ${JSON.stringify(opts.email)} is not a valid address`);
-    }
-    if (typeof opts.password !== "string" || opts.password.length < MIN_PASSWORD_LENGTH) {
-      throw new Error(
-        `testUser password must be at least ${MIN_PASSWORD_LENGTH} characters (got ${typeof opts.password === "string" ? opts.password.length : 0})`
-      );
-    }
-    email = opts.email;
-    password = opts.password;
-  }
-  const hasPhone = opts.phone !== void 0;
-  const hasOTP = opts.otp !== void 0;
-  if (hasPhone !== hasOTP) {
-    throw new Error(
-      "testUser() needs phone AND otp together \u2014 nothing can receive an SMS at a fabricated number, so a phone fixture without its fixed code can never be signed in as"
-    );
-  }
-  let phone = null;
-  let otp = null;
-  if (hasPhone) {
-    if (typeof opts.phone !== "string" || !E164_RE.test(opts.phone)) {
-      throw new Error(
-        `testUser phone ${JSON.stringify(opts.phone)} must be E.164, e.g. "+905551112233"`
-      );
-    }
-    if (typeof opts.otp !== "string" || !OTP_RE.test(opts.otp)) {
-      throw new Error(
-        `testUser otp ${JSON.stringify(opts.otp)} must be ${OTP_LENGTH} digits`
-      );
-    }
-    phone = opts.phone;
-    otp = opts.otp;
-  }
-  return { email, password, phone, otp, seed: normalizeSeed(opts.seed, email ?? "<template>") };
-}
-function defineTestUsers(input) {
-  if (!isPlainObject2(input) || !isPlainObject2(input.users)) {
-    throw new Error("defineTestUsers expects { users: { <name>: testUser({...}) } }");
-  }
-  const users = {};
-  const emails = /* @__PURE__ */ new Map();
-  for (const name of Object.keys(input.users)) {
-    if (!TEST_USER_NAME_RE.test(name)) {
-      throw new Error(
-        `test user name ${JSON.stringify(name)} is invalid \u2014 must start with a letter and contain only letters, digits, and underscores`
-      );
-    }
-    const def = input.users[name];
-    if (def === void 0) continue;
-    if (def.email !== null) {
-      const lower = def.email.toLowerCase();
-      const already = emails.get(lower);
-      if (already !== void 0) {
-        throw new Error(
-          `test users ${JSON.stringify(already)} and ${JSON.stringify(name)} declare the same e-mail ${JSON.stringify(def.email)}`
-        );
-      }
-      emails.set(lower, name);
-    }
-    users[name] = def;
-  }
-  return { __config: TEST_USERS_CONFIG_KIND, users };
+  interface Buckets {${bucketMembers(names.buckets)}}
 }
 
-// src/config/flags.ts
-var FLAGS_CONFIG_KIND = "flags";
-var FLAG_KEY_RE = /^[a-zA-Z][a-zA-Z0-9_]*$/;
-function valueMatchesType(type, value) {
-  switch (type) {
-    case "boolean":
-      return typeof value === "boolean";
-    case "number":
-      return typeof value === "number" && Number.isFinite(value);
-    case "string":
-      return typeof value === "string";
-    case "json":
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-  }
-}
-function flag(opts) {
-  if (opts === null || typeof opts !== "object") {
-    throw new Error("flag() expects { type, default, variants?, description? }");
-  }
-  const { type } = opts;
-  if (type !== "boolean" && type !== "number" && type !== "string" && type !== "json") {
-    throw new Error(`flag type must be "boolean", "number", "string", or "json", got ${JSON.stringify(type)}`);
-  }
-  if (!valueMatchesType(type, opts.default)) {
-    throw new Error(
-      `flag default ${JSON.stringify(opts.default)} does not match type "${type}"`
-    );
-  }
-  let variants = null;
-  if (opts.variants !== void 0) {
-    if (opts.type !== "string") {
-      throw new Error(`flag variants are only valid for type "string" (got type "${type}")`);
-    }
-    if (!Array.isArray(opts.variants)) {
-      throw new Error("flag variants must be an array of strings");
-    }
-    for (const v of opts.variants) {
-      if (typeof v !== "string" || v.length === 0) {
-        throw new Error(`flag variant ${JSON.stringify(v)} must be a non-empty string`);
-      }
-    }
-    variants = [...new Set(opts.variants)];
-    if (variants.length === 0) {
-      throw new Error("flag variants must be a non-empty list when supplied");
-    }
-    if (!variants.includes(opts.default)) {
-      throw new Error(
-        `flag default ${JSON.stringify(opts.default)} is not one of its variants [${variants.map((v) => JSON.stringify(v)).join(", ")}]`
-      );
-    }
-  }
-  let conditions = null;
-  if (opts.conditions !== void 0) {
-    if (!Array.isArray(opts.conditions)) {
-      throw new Error("flag conditions must be an array of { when, value }");
-    }
-    const compiled = [];
-    for (const [i, branch] of opts.conditions.entries()) {
-      if (branch === null || typeof branch !== "object") {
-        throw new Error(`flag condition ${i} must be an object { when, value }`);
-      }
-      if (typeof branch.when !== "string" || branch.when.trim().length === 0) {
-        throw new Error(`flag condition ${i} needs a non-empty "when" expression`);
-      }
-      if (!valueMatchesType(type, branch.value)) {
-        throw new Error(
-          `flag condition ${i} value ${JSON.stringify(branch.value)} does not match type "${type}"`
-        );
-      }
-      if (variants !== null && !variants.includes(branch.value)) {
-        throw new Error(
-          `flag condition ${i} value ${JSON.stringify(branch.value)} is not one of its variants [${variants.map((v) => JSON.stringify(v)).join(", ")}]`
-        );
-      }
-      compiled.push({ when: branch.when.trim(), value: branch.value });
-    }
-    conditions = compiled.length > 0 ? compiled : null;
-  }
-  let description = null;
-  if (opts.description !== void 0) {
-    if (typeof opts.description !== "string") {
-      throw new Error("flag description must be a string");
-    }
-    const trimmed = opts.description.trim();
-    description = trimmed.length > 0 ? trimmed : null;
-  }
-  return {
-    type,
-    default: opts.default,
-    variants,
-    conditions,
-    description
-  };
-}
-function defineFlags(input) {
-  if (input === null || typeof input !== "object" || typeof input.flags !== "object") {
-    throw new Error("defineFlags expects { flags: { <key>: flag({...}) } }");
-  }
-  const flags = {};
-  for (const key of Object.keys(input.flags)) {
-    if (!FLAG_KEY_RE.test(key)) {
-      throw new Error(
-        `flag key ${JSON.stringify(key)} is invalid \u2014 must start with a letter and contain only letters, digits, and underscores`
-      );
-    }
-    const def = input.flags[key];
-    if (def === void 0) continue;
-    flags[key] = def;
-  }
-  return { __config: FLAGS_CONFIG_KIND, flags };
-}
-
-// src/config/secrets.ts
-var SECRETS_CONFIG_KIND = "secrets";
-var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
-function secret(name, opts = {}) {
-  if (typeof name !== "string" || !SECRET_NAME_RE.test(name)) {
-    throw new Error(
-      `secret name ${JSON.stringify(name)} is invalid \u2014 must be an environment-variable name: an uppercase letter, then uppercase letters, digits, and underscores (e.g. "NEO4J_PASSWORD")`
-    );
-  }
-  if (opts === null || typeof opts !== "object") {
-    throw new Error(`secret("${name}") expects { required?, description? }`);
-  }
-  let required = true;
-  if (opts.required !== void 0) {
-    if (typeof opts.required !== "boolean") {
-      throw new Error(`secret("${name}") required must be a boolean`);
-    }
-    required = opts.required;
-  }
-  let description = null;
-  if (opts.description !== void 0) {
-    if (typeof opts.description !== "string") {
-      throw new Error(`secret("${name}") description must be a string`);
-    }
-    const trimmed = opts.description.trim();
-    description = trimmed.length > 0 ? trimmed : null;
-  }
-  return { name, required, description };
-}
-function defineSecrets(input) {
-  if (input === null || typeof input !== "object" || !Array.isArray(input.secrets)) {
-    throw new Error('defineSecrets expects { secrets: [secret("NAME"), ...] }');
-  }
-  const byName = /* @__PURE__ */ new Map();
-  for (const def of input.secrets) {
-    if (def === null || typeof def !== "object" || typeof def.name !== "string" || typeof def.required !== "boolean") {
-      throw new Error(
-        `defineSecrets: every entry must come from secret() \u2014 got ${JSON.stringify(def)}`
-      );
-    }
-    if (byName.has(def.name)) {
-      throw new Error(
-        `secret "${def.name}" is declared twice in config/secrets.ts \u2014 remove one; a name has exactly one requirement`
-      );
-    }
-    byName.set(def.name, def);
-  }
-  const secrets = [...byName.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-  return { __config: SECRETS_CONFIG_KIND, secrets };
+export {};
+`;
 }
 
 // src/decorators/registry.ts
@@ -2953,7 +2401,7 @@ var ROUTES = /* @__PURE__ */ Symbol.for("palbase.backend.routes");
 var PARAM_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.paramBuffer");
 var RETURN_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.returnBuffer");
 var THROWS_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.throwsBuffer");
-function carrierOf2(target) {
+function carrierOf(target) {
   const ctor = typeof target === "function" ? target : target.constructor ?? target;
   return ctor;
 }
@@ -2970,7 +2418,7 @@ function ownParamBuffer(carrier) {
   return carrier[PARAM_BUFFER];
 }
 function recordRoute(target, fnName, method, subpath, options) {
-  const carrier = carrierOf2(target);
+  const carrier = carrierOf(target);
   const routes = ownRoutes(carrier);
   const buffer = ownParamBuffer(carrier);
   const params = (buffer[fnName] ?? []).slice().sort((a, b) => a.index - b.index);
@@ -2986,7 +2434,7 @@ function recordRoute(target, fnName, method, subpath, options) {
   routes.push(route);
 }
 function recordParam(target, fnName, meta) {
-  const carrier = carrierOf2(target);
+  const carrier = carrierOf(target);
   const buffer = ownParamBuffer(carrier);
   (buffer[fnName] ??= []).push(meta);
   const routes = carrier[ROUTES];
@@ -2999,7 +2447,7 @@ function recordParam(target, fnName, meta) {
   }
 }
 function recordThrows(target, fnName, throws) {
-  const carrier = carrierOf2(target);
+  const carrier = carrierOf(target);
   const routes = carrier[ROUTES];
   const route = routes?.find((r) => r.fnName === fnName);
   if (route) {
@@ -3013,7 +2461,7 @@ function recordThrows(target, fnName, throws) {
   if (throwsBuffer) throwsBuffer[fnName] = throws;
 }
 function getRoutes(ctor) {
-  const carrier = carrierOf2(ctor);
+  const carrier = carrierOf(ctor);
   const routes = carrier[ROUTES] ?? [];
   const returnBuffer = carrier[RETURN_BUFFER];
   if (returnBuffer) {
@@ -3122,12 +2570,12 @@ var Query = makeMethodDecorator("QUERY");
 // src/decorators/webhook.ts
 var WEBHOOK_META = /* @__PURE__ */ Symbol.for("palbase.backend.webhookMeta");
 var WEBHOOK_EVENTS = /* @__PURE__ */ Symbol.for("palbase.backend.webhookEvents");
-function carrierOf3(ctor) {
+function carrierOf2(ctor) {
   return ctor;
 }
 function Webhook(options) {
   return function(ctor) {
-    const carrier = carrierOf3(ctor);
+    const carrier = carrierOf2(ctor);
     Object.defineProperty(carrier, WEBHOOK_META, {
       value: options,
       enumerable: false,
@@ -3145,7 +2593,7 @@ function Webhook(options) {
 }
 function On(event) {
   return function(target, fnName) {
-    const carrier = carrierOf3(target.constructor);
+    const carrier = carrierOf2(target.constructor);
     const existing = carrier[WEBHOOK_EVENTS];
     const entries = existing ? [...existing] : [];
     entries.push({ event, fnName: String(fnName) });
@@ -3158,7 +2606,7 @@ function On(event) {
   };
 }
 function getWebhookConfig(ctor) {
-  const carrier = carrierOf3(ctor);
+  const carrier = carrierOf2(ctor);
   const meta = carrier[WEBHOOK_META];
   const entries = carrier[WEBHOOK_EVENTS] ?? [];
   if (!meta) {
@@ -3293,22 +2741,14 @@ function validateUploadConfigShape(c) {
   if (c === null || typeof c !== "object") {
     throw new Error("@Upload config must be an object { bucket, pathTemplate, ... }");
   }
-  if (typeof c.bucket !== "string" || c.bucket.length === 0) {
+  const bucket = c.bucket;
+  if (typeof bucket !== "string" || bucket.length === 0) {
     throw new Error("@Upload config.bucket must be a non-empty bucket name");
   }
   if (typeof c.pathTemplate !== "string" || c.pathTemplate.length === 0) {
     throw new Error("@Upload config.pathTemplate must be a non-empty key template");
   }
 }
-function validateUploadAgainstStorage(uploadConfig, storage, routeLabel) {
-  const def = storage.buckets[uploadConfig.bucket];
-  if (def === void 0) {
-    const known = Object.keys(storage.buckets);
-    throw new Error(
-      `@Upload route ${routeLabel} targets bucket "${uploadConfig.bucket}" which is not declared in defineStorage(...). ` + (known.length ? `Known buckets: ${known.join(", ")}.` : "No buckets are declared.")
-    );
-  }
-}
 
 // src/decorators/params.ts
 function makeParamDecorator(kind, extra) {
@@ -3357,6 +2797,93 @@ function defineMiddleware(fn) {
   return fn;
 }
 
+// src/errors.ts
+var HTTP_ERROR_BRAND = /* @__PURE__ */ Symbol.for("palbase.backend.httpError");
+var HttpError = class extends Error {
+  status;
+  error;
+  errorDescription;
+  data;
+  /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */
+  [HTTP_ERROR_BRAND] = true;
+  constructor(status, error, errorDescription, data) {
+    super(errorDescription);
+    this.name = "HttpError";
+    this.status = status;
+    this.error = error;
+    this.errorDescription = errorDescription;
+    if (data !== void 0) {
+      this.data = data;
+    }
+  }
+  /**
+   * Serialize to the standard Palbase error response format.
+   * The `requestId` is injected by the runtime layer from the request context.
+   * When called without arguments (e.g. JSON.stringify), request_id is omitted.
+   * When `data` is set, it is appended as a strict-superset field.
+   */
+  toJSON(requestId) {
+    const result = {
+      error: this.error,
+      error_description: this.errorDescription,
+      status: this.status
+    };
+    if (requestId) {
+      result.request_id = requestId;
+    }
+    if (this.data !== void 0) {
+      result.data = this.data;
+    }
+    return result;
+  }
+};
+var PalError = class extends HttpError {
+  constructor(status, code, description, data) {
+    super(status, code, description, data);
+    this.name = "PalError";
+  }
+};
+var NamedHttpError = class extends HttpError {
+  constructor(status, defaultCode, name, message, code, data) {
+    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);
+    this.name = name;
+  }
+};
+function defaultMessage(name) {
+  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
+  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+}
+var BadRequest = class extends NamedHttpError {
+  constructor(data, message) {
+    super(400, "bad_request", "BadRequest", message, void 0, data);
+  }
+};
+var Unauthorized = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(401, "unauthorized", "Unauthorized", message, code, data);
+  }
+};
+var Forbidden = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(403, "forbidden", "Forbidden", message, code, data);
+  }
+};
+var NotFound = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(404, "not_found", "NotFound", message, code, data);
+  }
+};
+var Conflict = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(409, "conflict", "Conflict", message, code, data);
+  }
+};
+var TooManyRequests = class extends NamedHttpError {
+  constructor(data, message) {
+    super(429, "too_many_requests", "TooManyRequests", message, void 0, data);
+  }
+};
+
 // src/error-registry.ts
 var import_zod_to_openapi = require("@asteasolutions/zod-to-openapi");
 var import_zod = require("zod");
@@ -3366,27 +2893,7 @@ var BUILTIN_DATA_SCHEMAS = {
   bad_request: import_zod.z.object({
     fields: import_zod.z.array(import_zod.z.object({ field: import_zod.z.string(), message: import_zod.z.string() }))
   }),
-  too_many_requests: import_zod.z.object({ retryAfter: import_zod.z.number().int() }),
-  // Purchases (@RequireEntitlement / @Spend). Their payloads are what make a
-  // paywall renderable on the client: WHICH entitlement was missing, and for a
-  // spend the real ceiling and reset time rather than a guessed retry delay.
-  entitlement_required: import_zod.z.object({ entitlement: import_zod.z.string().nullable() }),
-  quota_exceeded: import_zod.z.object({
-    key: import_zod.z.string(),
-    scope: import_zod.z.string(),
-    window: import_zod.z.string(),
-    used: import_zod.z.number().int(),
-    reserved: import_zod.z.number().int(),
-    max: import_zod.z.number().int(),
-    remaining: import_zod.z.number().int(),
-    resetAt: import_zod.z.string()
-  }),
-  credit_insufficient: import_zod.z.object({
-    key: import_zod.z.string(),
-    balance: import_zod.z.number().int(),
-    reserved: import_zod.z.number().int(),
-    remaining: import_zod.z.number().int()
-  })
+  too_many_requests: import_zod.z.object({ retryAfter: import_zod.z.number().int() })
 };
 function getErrorRegistry() {
   const g = globalThis;
@@ -3398,13 +2905,7 @@ function getErrorRegistry() {
       ["forbidden", 403, "Forbidden"],
       ["not_found", 404, "NotFound"],
       ["conflict", 409, "Conflict"],
-      ["too_many_requests", 429, "TooManyRequests"],
-      // Thrown by the purchases decorators, so they are pre-seeded like the
-      // other built-ins: a project never declares them, but every gated or
-      // metered route must surface them as TYPED errors on the client.
-      ["entitlement_required", 403, "EntitlementRequired"],
-      ["quota_exceeded", 429, "QuotaExceeded"],
-      ["credit_insufficient", 429, "CreditInsufficient"]
+      ["too_many_requests", 429, "TooManyRequests"]
     ]) {
       const dataSchema = BUILTIN_DATA_SCHEMAS[code];
       m.set(code, {
@@ -3425,8 +2926,8 @@ function defineError(code, status, dataSchema) {
       `defineError: status for "${code}" must be a 4xx/5xx integer, got ${status} \u2014 error responses must not clobber success responses in the project spec.`
     );
   }
-  const registry3 = getErrorRegistry();
-  const existing = registry3.get(code);
+  const registry2 = getErrorRegistry();
+  const existing = registry2.get(code);
   const className = defaultClassName(code);
   const dataDigest = dataSchema ? digestOf(code, dataSchema) : void 0;
   if (existing) {
@@ -3455,7 +2956,7 @@ function defineError(code, status, dataSchema) {
   };
   const cls = dataSchema ? makeWithData(dataSchema) : makeWithoutData();
   Object.defineProperty(cls, "name", { value: className });
-  registry3.set(code, {
+  registry2.set(code, {
     code,
     status,
     className,
@@ -3614,52 +3115,6 @@ function getJobConfig(ctor) {
   return { schedule: meta.schedule, timeout, retry, handler: run };
 }
 
-// src/resource.ts
-var Resource = class {
-  /** The env-var names this resource needs. Optional; omit for none. */
-  static secrets;
-};
-function hasSecrets(value) {
-  if (typeof value !== "object" && typeof value !== "function") return false;
-  const secrets = value.secrets;
-  return secrets === void 0 || Array.isArray(secrets);
-}
-var registry2 = [];
-function __registerResource(resource) {
-  registry2.push({ resource, booted: false });
-}
-function declaredSecrets(resource) {
-  const ctor = resource.constructor;
-  return hasSecrets(ctor) ? ctor.secrets ?? [] : [];
-}
-async function __runResourceBoot(envMap) {
-  for (const entry of registry2) {
-    if (entry.booted) continue;
-    const secrets = declaredSecrets(entry.resource);
-    const env = {};
-    for (const name of secrets) {
-      const value = envMap[name];
-      if (value === void 0) {
-        throw new Error(
-          `Resource ${entry.resource.constructor.name} requires secret "${name}" but it is not set. Set it with \`palbase secret set ${name} ...\` (or in Studio) and redeploy.`
-        );
-      }
-      env[name] = value;
-    }
-    await entry.resource.init(env);
-    entry.booted = true;
-  }
-}
-async function __shutdownResources() {
-  for (let i = registry2.length - 1; i >= 0; i -= 1) {
-    const entry = registry2[i];
-    if (entry.booted && entry.resource.shutdown) {
-      await entry.resource.shutdown();
-    }
-  }
-  registry2.length = 0;
-}
-
 // src/index.ts
 var import_zod2 = require("zod");
 // Annotate the CommonJS export names for ESM import in node:
@@ -3670,17 +3125,11 @@ var import_zod2 = require("zod");
   Client,
   Conflict,
   Controller,
-  DEFAULT_TEMPLATE_LOCALE,
   Database,
   Delete,
   Deny,
   Documents,
-  EGRESS_CONFIG_KIND,
-  EGRESS_TIMEOUT_DEFAULT_MS,
-  EGRESS_TIMEOUT_MAX_MS,
-  EGRESS_TIMEOUT_MIN_MS,
   EXTENSION_DEPENDENCIES,
-  FLAGS_CONFIG_KIND,
   Flags,
   Forbidden,
   Get,
@@ -3689,35 +3138,25 @@ var import_zod2 = require("zod");
   HttpError,
   Job,
   Log,
-  NOTIFICATIONS_CONFIG_KIND,
   NotFound,
   Notifications,
   On,
   OptionalUser,
   PALBASE_EXTENSIONS,
-  PROVIDER_CATALOG,
   PalError,
   PalbaseModuleError,
   Param,
   Patch,
   PolicyBuilder,
   Post,
-  Purchases,
   Put,
   Query,
   QueryParams,
-  RESERVED_SECRET_PREFIX,
   Realtime,
   Req,
   RequestId,
-  RequireEntitlement,
-  Resource,
-  SECRETS_CONFIG_KIND,
-  STORAGE_CONFIG_KIND,
   Secrets,
-  Spend,
   Storage,
-  TEST_USERS_CONFIG_KIND,
   TooManyRequests,
   TraceId,
   TxPlanError,
@@ -3728,32 +3167,19 @@ var import_zod2 = require("zod");
   User,
   Webhook,
   __getRuntime,
-  __registerResource,
   __requestALS,
   __resetRegisteredControllers,
-  __runResourceBoot,
   __runWithRuntime,
   __setRuntime,
-  __shutdownResources,
   bigint,
   boolean,
-  bucket,
   buildModuleClients,
-  buildProvider,
   dec,
-  defineEgress,
+  defineChannels,
   defineError,
-  defineFlags,
   defineMiddleware,
-  defineNotifications,
   defineSchema,
-  defineSecrets,
-  defineStorage,
-  defineTestUsers,
-  entitlementFor,
   enumType,
-  extractVariables,
-  flag,
   getErrorRegistry,
   getHookConfig,
   getJobConfig,
@@ -3766,23 +3192,21 @@ var import_zod2 = require("zod");
   jsonb,
   makeEnvDts,
   makeHttpClient,
-  makePurchasesDts,
+  makeStackDts,
   makeTypedDB,
   now,
   numeric,
-  parseFileSizeLimit,
+  openai,
+  ownerOnly,
   policy,
+  publicChannel,
   raw,
   recordThrows,
-  reservedSecretKey,
-  secret,
-  spendFor,
-  testUser,
   text,
   timestamp,
   toSchemaJSON,
   uuid,
-  validateUploadAgainstStorage,
+  vector,
   z
 });
 //# sourceMappingURL=index.cjs.map