@palbase/backend 22.1.0 → 23.1.0

package/dist/index.d.cts

@@ -1,59 +1,17 @@
-import { g as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-BVT6jcVW.cjs';
-export { h as AuthConfig, B as BadRequest, C as CacheClient, i as ClientInfo, j as Conflict, D as DBClient, k as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, f as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-BVT6jcVW.cjs';
-import { M as ModuleClients } from './index-BS1gW4nV.cjs';
-export { C as Cache, D as Database, a as Documents, F as Flags, L as LimitState, b as Log, N as Notifications, P as Purchases, c as PurchasesService, R as Realtime, d as RequestStore, e as RuntimeServices, S as Secrets, f as SpendOptions, g as Storage, h as StoreEnv, _ as __getRuntime, i as __requestALS, j as __runWithRuntime, k as __setRuntime } from './index-BS1gW4nV.cjs';
-import { EntitlementKey, LimitKey } from './purchases/keys.cjs';
-import { S as SchemaDef } from './index-BqCiHao8.cjs';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EmbeddingModelRef, f as EnvServiceDatabase, g as EnvTables, E as EnvTypedDatabase, h as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, i as PalbaseExtension, j as PolicyBuilder, k as PolicyCommand, l as PolicyDef, m as PolicyMode, R as RawConstraintDef, n as RowShape, o as SchemaInput, T as TableDef, p as TableInput, q as TxPlan, r as TxTables, s as TypedDB, t as TypedTable, u as TypedTx, v as bigint, w as boolean, x as defineSchema, y as enumType, z as integer, A as isPalbaseExtension, B as jsonb, D as makeTypedDB, F as numeric, G as openai, H as policy, J as raw, K as text, L as timestamp, M as uuid, N as vector } from './index-BqCiHao8.cjs';
-import { TableTypes, Tables } from './db/env.cjs';
-import { a as RouteOptions } from './registry-BWttGlaT.cjs';
-export { B as BucketDef, b as BucketOptions, H as HttpMethodUpper, I as ImageVariant, c as ParamKind, P as ParamMeta, R as RouteMeta, S as STORAGE_CONFIG_KIND, d as StorageConfig, e as StorageInput, T as ThrowDescriptor, f as Upload, U as UploadConfig, g as UploadedObject, h as bucket, i as defineStorage, j as getRoutes, p as parseFileSizeLimit, r as recordThrows, v as validateUploadAgainstStorage } from './registry-BWttGlaT.cjs';
+import { h as PalbaseResult, A as AuthSpec, H as HttpError } from './endpoint-c9h5jriX.cjs';
+export { i as AuthConfig, B as BadRequest, C as CacheClient, j as ClientInfo, k as Conflict, D as DBClient, f as DBOps, E as ErrorDef, l as ErrorMap, m as ErrorThrowers, F as FileContext, n as Forbidden, o as HttpMethod, L as Logger, M as Materialized, p as Middleware, q as MiddlewareContext, r as MiddlewareHandler, N as NotFound, s as PBRequest, t as PalError, u as PalbaseAnalyticsClient, v as PalbaseAnalyticsManagementNamespace, w as PalbaseAnalyticsProperties, x as PalbaseAnalyticsQueryNamespace, y as PalbaseAttestAndroidParams, z as PalbaseAttestAndroidResult, G as PalbaseAttestiOSParams, I as PalbaseAttestiOSResult, J as PalbaseAuthClient, K as PalbaseBatchOverrideOperation, O as PalbaseBatchSetOverridesResult, Q as PalbaseBindDeviceParams, e as PalbaseBucketClient, U as PalbaseClearAllOverridesResult, V as PalbaseClearOverrideResult, W as PalbaseCohortQueryInput, X as PalbaseCohortResult, Y as PalbaseCollectionRef, Z as PalbaseCountQueryInput, _ as PalbaseCountResult, $ as PalbaseCreateLinkParams, a0 as PalbaseDeviceInfo, a1 as PalbaseDeviceTokenView, P as PalbaseDocsClient, a2 as PalbaseDocumentRef, a3 as PalbaseDocumentSnapshot, a4 as PalbaseEmailClient, a5 as PalbaseEmailSendParams, a6 as PalbaseEmailSendResponse, a7 as PalbaseEventNamesResult, a8 as PalbaseEventsQueryInput, a9 as PalbaseEventsResult, aa as PalbaseFileObject, ab as PalbaseFlag, ac as PalbaseFlagContext, ad as PalbaseFlagSource, ae as PalbaseFlagValue, af as PalbaseFlagVariant, a as PalbaseFlagsClient, ag as PalbaseFlagsServiceClient, ah as PalbaseFunctionsClient, ai as PalbaseFunnelQueryInput, aj as PalbaseFunnelResult, ak as PalbaseIdentifyTraits, al as PalbaseInboxClient, am as PalbaseInboxListOptions, an as PalbaseInboxListResult, ao as PalbaseInboxMessage, ap as PalbaseInboxSendParams, aq as PalbaseInboxSendResponse, ar as PalbaseInitialLink, as as PalbaseInvokeOptions, at as PalbaseLink, au as PalbaseLinkAnalytics, av as PalbaseLinkDetails, aw as PalbaseLinksClient, ax as PalbaseListLinksOptions, ay as PalbaseListLinksResult, az as PalbaseListOptions, aA as PalbaseMatchParams, aB as PalbaseMultiChannelResponse, b as PalbaseNotificationsClient, aC as PalbaseOverviewResult, aD as PalbasePreferences, aE as PalbasePreferencesClient, aF as PalbasePushClient, aG as PalbasePushSendParams, aH as PalbasePushSendResponse, aI as PalbaseQrCodeOptions, aJ as PalbaseQuerySnapshot, c as PalbaseRealtimeClient, aK as PalbaseRegisterDeviceParams, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, d as PalbaseStorageClient, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, R as RateLimitConfig, b1 as Ref, S as SecretsService, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, T as TxPlanBody, b7 as TxPlanError, b8 as TxPlanHandle, b9 as TxPlanOpResult, ba as TxPlanRejection, g as TxPlanResponse, bb as TxRefError, bc as TxRow, bd as TxRows, be as TxSelectOptions, bf as TxSetShape, bg as TxSetValue, bh as TxTable, bi as TxWhere, bj as TxWireExpr, bk as TxWireGuard, bl as TxWireOp, bm as TxWireRef, bn as TxWireValue, bo as Unauthorized, bp as UserT, bq as VerifiedDevice, br as dec, bs as defineMiddleware, bt as inc, bu as now } from './endpoint-c9h5jriX.cjs';
+import { M as ModuleClients } from './index-CxeQSfJP.cjs';
+export { C as Cache, D as Database, a as Documents, F as Flags, L as Log, N as Notifications, R as Realtime, b as RequestStore, c as RuntimeServices, S as Secrets, d as Storage, _ as __getRuntime, e as __requestALS, f as __runWithRuntime, g as __setRuntime } from './index-CxeQSfJP.cjs';
+import { S as SchemaDef } from './index-By8Dle5U.cjs';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EmbeddingModelRef, f as EnvServiceDatabase, g as EnvTables, E as EnvTypedDatabase, h as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, i as PalbaseExtension, j as PolicyBuilder, k as PolicyCommand, l as PolicyDef, m as PolicyMode, R as RawConstraintDef, n as RowShape, o as SchemaInput, T as TableDef, p as TableInput, q as TxPlan, r as TxTables, s as TypedDB, t as TypedTable, u as TypedTx, v as bigint, w as boolean, x as defineSchema, y as enumType, z as integer, A as isPalbaseExtension, B as jsonb, D as makeTypedDB, F as numeric, G as openai, H as policy, J as raw, K as text, L as timestamp, M as uuid, N as vector } from './index-By8Dle5U.cjs';
+export { TableTypes, Tables } from './db/env.cjs';
+export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.cjs';
+import { a as RouteOptions } from './registry-CqPK2Qby.cjs';
+export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-CqPK2Qby.cjs';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import 'node:async_hooks';
 
-/**
- * `@RequireEntitlement` and `@Spend` — access and metering at the decorator
- * level, so a controller method says what it costs instead of wiring it.
- *
- * TWO decorators, deliberately, because not every subscription is limit-based.
- * Most products just say "pro users may call this" and consume nothing; a
- * zero-count spend would express that badly and run the whole reserve/commit
- * machine for no reason.
- *
- *   @RequireEntitlement('pro')   pure gate    → 403, consumes nothing
- *   @Spend('bookCreate')         consumption  → 429 when exhausted
- *
- * ORDER IS FIXED, and not by where you wrote them. Both decorators record
- * metadata and share ONE installed wrapper that always runs the entitlement
- * gate before it reserves quota. Reserving for someone who is about to get a
- * 403 is wasted work and a race window, so the source order of the two
- * decorators cannot introduce it.
- */
-
-type MethodDecorator$1 = (target: object, propertyKey: string | symbol, descriptor: PropertyDescriptor) => void;
-/**
- * Require an active entitlement. Answers 403 `entitlement_required` when it is
- * absent and consumes nothing.
- *
- * The key is a member of the generated `EntitlementKey` union, so a typo is a
- * compile error rather than a gate that silently never matches.
- */
-declare function RequireEntitlement(key: EntitlementKey): MethodDecorator$1;
-/**
- * Consume one unit of a limit or credit for the request's subject.
- *
- * Reserves before the handler runs and commits only if it returns; a throw
- * cancels the hold, so a user is never charged for work that did not complete.
- * Answers 429 `quota_exceeded` (carrying the `LimitState`) when exhausted.
- *
- * The count is fixed at 1. A DYNAMIC amount is deliberately not expressible
- * here: it has to be decided inside the handler and spent BEFORE the billable
- * side-effect, which is an explicit `Purchases.withSpend(...)` call, not a
- * decorator.
- */
-declare function Spend(key: LimitKey): MethodDecorator$1;
-
 /**
  * clients/index.ts — the composition root for the module clients.
  *
@@ -66,10 +24,13 @@ declare function Spend(key: LimitKey): MethodDecorator$1;
  *     for any of them (`runtime.ts` exports ten, and these four are not among
  *     them), so no handler could reach them. They were constructed on every
  *     boot and thrown away.
- *   - `Purchases` — its client talks to palstore, and v2 contains no palstore
+ *   - `Purchases` — its client talked to palstore, and v2 contains no palstore
  *     at all. The surface was unbacked before it was untyped. Dropped from v2
- *     by the user's decision on 2026-08-15; the SDK's `src/purchases/` tree is
- *     untouched and that decision is deferred, not silently taken.
+ *     by the user's decision on 2026-08-15, with the SDK's `src/purchases/`
+ *     tree left in place because that decision was "deferred, not silently
+ *     taken". It is taken now: the tree is GONE (2026-08-29), because a
+ *     decorator standing in front of a service nothing serves is the same
+ *     defect as `Resource` and `config/*`, which went with it.
  *   - The V1 host/executor transport — the isolate it existed for was removed
  *     on 2026-08-14. A single-tenant process has nobody to hide its own
  *     tenant's credentials from.
@@ -167,73 +128,6 @@ declare class PalbaseModuleError extends Error {
 }
 declare function makeHttpClient(cfg: TransportConfig): ModuleTransport;
 
-/**
- * keys-gen.ts — generate the `palbase-purchases.d.ts` text from a catalog
- * manifest.
- *
- * The twin of `db/env-gen.ts`: the CLI / deploy pipeline calls
- * {@link makePurchasesDts} with the project's catalog revision and writes the
- * result to `palbase-purchases.d.ts` at the project root. That file augments
- * the `@palbase/backend/purchases` `Entitlements` / `Limits` interfaces, so
- * `@RequireEntitlement(...)` and `@Spend(...)` accept the project's real keys
- * and nothing else.
- *
- * Same catalog, two languages: this is the TypeScript half of what swiftgen
- * already emits for iOS. Neither side is hand-maintained, so the two cannot
- * drift from each other or from the manifest the server validated.
- *
- * The emitted file ends in `export {};` — same as `makeEnvDts`. Without it the
- * `.d.ts` is a global script, and `declare module "…"` there DECLARES an
- * ambient module (shadowing the real one, so every key silently becomes
- * invalid) instead of AUGMENTING it.
- */
-/** A catalog entry that may be tombstoned. */
-interface Removable {
-    removed?: boolean;
-}
-/**
- * The slice of `pur_catalogs.manifest` this generator reads. Deliberately
- * partial and permissive: the server already validated the manifest (its models
- * are `extra="forbid"`), so re-checking here would be a second, weaker copy of
- * that authority.
- */
-interface PurchasesManifest {
-    limits?: Record<string, Removable>;
-    credits?: Record<string, Removable>;
-    entitlements?: Record<string, Removable>;
-}
-/**
- * Render the project's `palbase-purchases.d.ts`.
- *
- * `Limits` carries BOTH limits and credits: `@Spend` consumes either, and the
- * server answers both with a 429 (`quota_exceeded` / `credit_insufficient`), so
- * splitting them into two unions would make the author pick the right decorator
- * for a distinction the spend path does not make.
- */
-declare function makePurchasesDts(manifest: PurchasesManifest): string;
-
-/**
- * Per-method purchases metadata, stored on the controller class the same way
- * `decorators/registry.ts` stores routes: a symbol-keyed static, plain data, no
- * `reflect-metadata`.
- *
- * Its only consumer is the OpenAPI step, which needs to know that a route is
- * gated (declare 403) or metered (declare 429) so the iOS client codegen emits
- * TYPED errors instead of a bare status number. Enforcement does NOT read this
- * — the decorators wrap the method directly — so a stale registry can never
- * cause a missed gate.
- */
-
-/** What `@Spend` recorded for one method. */
-interface SpendMeta {
-    key: LimitKey;
-    count: number;
-}
-/** The entitlement `fnName` is gated on, or undefined when it is not gated. */
-declare function entitlementFor(ctor: object, fnName: string): EntitlementKey | undefined;
-/** What `fnName` spends, or undefined when it spends nothing. */
-declare function spendFor(ctor: object, fnName: string): SpendMeta | undefined;
-
 /** One column, flattened. Mirrors Go's `schema.ColumnJSON`. */
 interface ColumnJSON {
     type: string;
@@ -287,13 +181,27 @@ interface TableJSON {
         columns: string[];
     }[];
     search?: SearchJSON;
+    memory?: MemoryJSON;
+}
+/** C-11 wire şekli — Go'nun MemoryJSON'ıyla alan-adı sözleşmesi (D-019).
+ * Beyansız tablolarda alan OMIT — eski şemalar bayt-aynı (NFR-B1). */
+interface MemoryJSON {
+    from: string[];
+    into: string;
+    subject?: string;
+    extract: {
+        provider: string;
+        model: string;
+    };
 }
 /** A whole declaration. Mirrors Go's `schema.SchemaJSON`. */
 interface SchemaJSON {
     tables: Record<string, TableJSON>;
     extensions: string[];
 }
-/** C-4 wire şekli — Go'nun SearchJSON'ıyla ALAN ADI sözleşmesi (C-5). */
+/** C-4 wire şekli — Go'nun SearchJSON'ıyla ALAN ADI sözleşmesi (C-5).
+ * `mode`/`chunks` yalnız yeni-biçim chunk-modunda emit edilir (D-010);
+ * satır-modu ve eski biçim bayt-aynı kalır (NFR-B1). */
 interface SearchJSON {
     text?: {
         columns: string[];
@@ -310,7 +218,17 @@ interface SearchJSON {
             baseURL?: string;
         };
         staleness?: "null" | "keep";
+        mode?: "row" | "chunks";
+        chunks?: {
+            sizeChars?: number;
+            overlapChars?: number;
+        };
     }[];
+    /** FR-026: sorgu-yeniden-yazımı haritası — beyan yoksa OMIT (NFR-B1). */
+    synonyms?: Record<string, string[]>;
+    /** C-1: sonuç yeniden-sıralama beyanı — beyan yoksa OMIT. */
+    /** FR-029: geçerlilik türevleri — beyan yoksa OMIT. */
+    validity?: boolean;
 }
 /**
  * Serialize a `defineSchema(...)` result into the JSON the deploy applies.
@@ -442,931 +360,60 @@ declare function defineChannels(map: ChannelsInput): ChannelsDef;
 declare function makeEnvDts(schema: SchemaDef): string;
 
 /**
- * egress.ts — the tenant outbound-HTTP allowlist config-as-code DSL.
- *
- * `defineEgress({ hosts, timeoutMs })` declares the external hosts a backend may
- * fetch(), and how long a single call may take. config/egress.ts default-exports
- * it; the deploy evals it to JSON (SchemaExtractor.EvaluateConfigFile →
- * config_extract.js) and bakes both into the artifact manifest → the isolate
- * loader → Tenant.egressAllow / Tenant.egressTimeoutMs. The tenantFetch
- * capability rejects any host NOT on the list. NO config/egress.ts (or an empty
- * list) ⇒ the backend has NO outbound network — fail-closed.
- *
- * @example
- *   // config/egress.ts
- *   import { defineEgress } from "@palbase/backend";
- *   export default defineEgress({
- *     hosts: ["api.openai.com"],
- *     timeoutMs: 90_000, // a slow LLM call; default 30_000
- *   });
- *
- * Each host is a bare hostname (no scheme/port/path/wildcard). A leading dot,
- * `.example.com`, also covers subdomains (Squid dstdomain semantics). Egress is
- * https-only on :443; the deploy REJECTS a malformed / IP-literal / internal host
- * (fail-closed — a security allowlist is never best-effort).
- *
- * `timeoutMs` is a CEILING, not a grant: the call still ends when the INVOCATION
- * ends. A job may run up to its own `@Job({ timeout })` (max 300s), while a
- * request is additionally bounded by the gateway. Setting 300_000 on a route
- * whose request dies earlier buys nothing — size it to the caller.
- *
- * Response bodies are BUFFERED whole (5 MB cap) before your fetch() resolves, so
- * a streaming/SSE upstream gives you no partial output and no earlier
- * first-byte: the entire stream must complete inside `timeoutMs`.
- *
- * Emits: { __config: "egress", hosts: [...], timeoutMs?: number }
- */
-/** The discriminant written under `__config` so the deploy eval knows the kind. */
-declare const EGRESS_CONFIG_KIND: "egress";
-/**
- * Bounds on `timeoutMs`, duplicated (deliberately) in the deploy's
- * ParseEgressConfig. This copy shapes the authoring error; that one is
- * authoritative and fail-closed. They must agree — a value this accepts and the
- * deploy rejects is a broken deploy the author cannot see coming.
- */
-declare const EGRESS_TIMEOUT_MIN_MS = 1000;
-declare const EGRESS_TIMEOUT_MAX_MS = 300000;
-/** Applied when `timeoutMs` is omitted. Also spelled in the isolate capability. */
-declare const EGRESS_TIMEOUT_DEFAULT_MS = 30000;
-/** The author-facing input to defineEgress. */
-interface EgressInput {
-    hosts: string[];
-    /**
-     * Per-call ceiling for an outbound fetch, in milliseconds.
-     * 1_000..300_000; omitted ⇒ 30_000.
-     */
-    timeoutMs?: number;
-}
-/** The evaluated config/egress.ts default export (what the deploy reads). */
-interface EgressConfig {
-    __config: typeof EGRESS_CONFIG_KIND;
-    hosts: string[];
-    timeoutMs?: number;
-}
-/**
- * Declare the backend's outbound-HTTP allowlist. Client-side this only shapes +
- * validates the list; the authoritative fail-closed validation runs at deploy.
- */
-declare function defineEgress(input: EgressInput): EgressConfig;
-
-/**
- * notifications.ts — the notification-providers config-as-code DSL.
- *
- * `defineNotifications({ push, email, sms })` is the second MODULE config-as-code
- * surface (the sibling of `config/storage.ts`'s `defineStorage`). A
- * `config/notifications.ts` file default-exports a `defineNotifications(...)`
- * result; on deploy the br-pod evaluates it to JSON and reconciles the declared
- * providers against the tenant's live providers via the PalNotify admin API
- * (create missing; never auto-delete — dropping a provider is destructive and
- * warned only).
- *
- * SECRETS ARE NEVER IN THE FILE. Each provider's NON-SECRET fields (team id, key
- * id, bundle id, region, host, port, from address, account sid, …) are literals
- * in the config. Each provider's SECRET material (the APNs .p8 key, the FCM
- * service-account JSON, an api_key, an auth token, the SMTP/ACS password, …) is
- * NOT a field here — it is bound BY CONVENTION to a RESERVED encrypted env var
- * and resolved at deploy from control-pg. The env-key convention is:
- *
- *     PB_NOTIFICATIONS_<PROVIDER>_<FIELD>      (UPPER_SNAKE_CASE)
- *
- * e.g. `PB_NOTIFICATIONS_APNS_P8`, `PB_NOTIFICATIONS_FCM_SERVICE_ACCOUNT`,
- * `PB_NOTIFICATIONS_TWILIO_AUTH_TOKEN`. The `PB_` namespace is reserved (the CLI
- * refuses a hand-set `palbase secret set PB_*`); the CLI's `palbase notifications
- * add <provider>` derives the key and uploads the secret for you, so an author
- * never types either the secret or the env-key name into git.
- *
- * @example
- * import { defineNotifications } from "@palbase/backend";
- *
- * export default defineNotifications({
- *   push: {
- *     apns: { enabled: true, teamId: "ABCDE12345", keyId: "KEY1234567", bundleId: "com.acme.app" },
- *     fcm:  { enabled: true },
- *   },
- *   email: {
- *     sendgrid: { enabled: true, fromDomain: "mail.acme.com" },
- *   },
- *   sms: {
- *     twilio: { enabled: true, accountSid: "ACxxxxxxxx", messagingServiceSid: "MGxxxxxxxx" },
- *   },
- * });
- *
- * The returned value is the EXACT JSON shape the runtime's generic config
- * extractor (`config_extract.js`) emits and the Go apply step parses:
- *   { __config: "notifications", push: {...}, email: {...}, sms: {...} }
- * Only ENABLED providers carry their non-secret fields; a disabled (or absent)
- * provider serializes as `{ enabled: false }` so the apply step skips it.
- */
-/** The `__config` discriminant the eval/apply reads to confirm a config/*.ts is
- * a notifications config. Notifications is `"notifications"`. */
-declare const NOTIFICATIONS_CONFIG_KIND: "notifications";
-/** The reserved env-var prefix that backs provider secrets. A `palbase secret
- * set` of a key under this prefix is REFUSED by the CLI (it is managed by
- * `palbase notifications add`). Both the CLI and the br-pod apply step derive a
- * provider's secret env key as `${RESERVED_SECRET_PREFIX}_<PROVIDER>_<FIELD>`. */
-declare const RESERVED_SECRET_PREFIX: "PB_NOTIFICATIONS";
-/** One provider's catalog entry: which non-secret fields are required, which are
- * optional, and which secret field-name(s) bind to reserved env vars. */
-interface ProviderCatalogEntry {
-    /** The channel this provider serves (`push` | `email` | `sms`). */
-    readonly channel: "push" | "email" | "sms";
-    /** Non-secret config fields the author MUST supply (validated eagerly). */
-    readonly required: readonly string[];
-    /** Non-secret config fields the author MAY supply. */
-    readonly optional: readonly string[];
-    /** Secret field name(s) — each backed by `PB_NOTIFICATIONS_<PROVIDER>_<FIELD>`
-     * (FIELD is the UPPER_SNAKE of the name here). NOT a config field. */
-    readonly secrets: readonly string[];
-}
-/**
- * The provider catalog: provider key → fields. The non-secret field names are
- * the camelCase keys an author writes in `config/notifications.ts`; the secret
- * names are the snake-ish tokens that become the reserved env-var suffix.
- *
- * apns:     team_id / key_id / bundle_id (+ optional is_production); secret = p8.
- * fcm:      no non-secret fields; secret = service_account (the full JSON).
- * sendgrid: from_domain; secret = api_key.
- * ses:      region / from_domain / access_key_id; secret = secret_access_key.
- * smtp:     host / port / from_email (+ optional username, use_starttls); secret = password.
- * acs:      from_email (+ optional from_name); secret = connection_string.
- * twilio:   account_sid + (from_number OR messaging_service_sid); secret = auth_token.
- */
-declare const PROVIDER_CATALOG: {
-    readonly apns: {
-        readonly channel: "push";
-        readonly required: readonly ["teamId", "keyId", "bundleId"];
-        readonly optional: readonly ["isProduction"];
-        readonly secrets: readonly ["p8"];
-    };
-    readonly fcm: {
-        readonly channel: "push";
-        readonly required: readonly [];
-        readonly optional: readonly [];
-        readonly secrets: readonly ["serviceAccount"];
-    };
-    readonly sendgrid: {
-        readonly channel: "email";
-        readonly required: readonly ["fromDomain"];
-        readonly optional: readonly [];
-        readonly secrets: readonly ["apiKey"];
-    };
-    readonly ses: {
-        readonly channel: "email";
-        readonly required: readonly ["region", "accessKeyId", "fromDomain"];
-        readonly optional: readonly [];
-        readonly secrets: readonly ["secretAccessKey"];
-    };
-    readonly smtp: {
-        readonly channel: "email";
-        readonly required: readonly ["host", "port", "fromEmail"];
-        readonly optional: readonly ["username", "useStarttls"];
-        readonly secrets: readonly ["password"];
-    };
-    readonly acs: {
-        readonly channel: "email";
-        readonly required: readonly ["fromEmail"];
-        readonly optional: readonly ["fromName"];
-        readonly secrets: readonly ["connectionString"];
-    };
-    readonly twilio: {
-        readonly channel: "sms";
-        readonly required: readonly ["accountSid"];
-        readonly optional: readonly ["fromNumber", "messagingServiceSid"];
-        readonly secrets: readonly ["authToken"];
-    };
-};
-/** A provider key (`"apns" | "fcm" | "sendgrid" | …`). */
-type ProviderName = keyof typeof PROVIDER_CATALOG;
-/** APNs (Apple Push) — non-secret fields. The `.p8` key is the reserved secret
- * `PB_NOTIFICATIONS_APNS_P8` (uploaded via `palbase notifications add apns`). */
-interface ApnsOptions {
-    enabled?: boolean;
-    teamId: string;
-    keyId: string;
-    bundleId: string;
-    /** APNs production gateway vs sandbox. Defaults to true (production). */
-    isProduction?: boolean;
-}
-/** FCM (Firebase Cloud Messaging) — no non-secret fields; the service-account
- * JSON is the reserved secret `PB_NOTIFICATIONS_FCM_SERVICE_ACCOUNT`. */
-interface FcmOptions {
-    enabled?: boolean;
-}
-/** SendGrid email — non-secret `fromDomain`; api_key is the reserved secret. */
-interface SendgridOptions {
-    enabled?: boolean;
-    fromDomain: string;
-}
-/** Amazon SES email — secret_access_key is the reserved secret. */
-interface SesOptions {
-    enabled?: boolean;
-    region: string;
-    accessKeyId: string;
-    fromDomain: string;
-}
-/** SMTP email — password is the reserved secret. */
-interface SmtpOptions {
-    enabled?: boolean;
-    host: string;
-    port: number;
-    fromEmail: string;
-    username?: string;
-    useStarttls?: boolean;
-}
-/** Azure Communication Services email — connection_string is the reserved secret. */
-interface AcsOptions {
-    enabled?: boolean;
-    fromEmail: string;
-    fromName?: string;
-}
-/** Twilio SMS — auth_token is the reserved secret. Exactly one of `fromNumber`
- * or `messagingServiceSid` must be supplied. */
-interface TwilioOptions {
-    enabled?: boolean;
-    accountSid: string;
-    fromNumber?: string;
-    messagingServiceSid?: string;
-}
-/** The union of every provider's author-facing options. `buildProvider` accepts
- * this so each provider's typed options pass without a cast. */
-type ProviderOptions = ApnsOptions | FcmOptions | SendgridOptions | SesOptions | SmtpOptions | AcsOptions | TwilioOptions;
-/** The default locale a template row lands on when the author names none. Must
- * match PalNotify's `model.DefaultLocale`. */
-declare const DEFAULT_TEMPLATE_LOCALE: "en";
-/** One locale's email content. */
-interface EmailTemplateContent {
-    /** Subject line. Handlebars placeholders (`{{name}}`) are rendered at send. */
-    subject: string;
-    /** HTML body. */
-    html: string;
-    /** Plain-text body. Omit and the server derives one from `html` at render. */
-    text?: string;
-    /**
-     * Variables the sender MUST supply. Omit and they are DERIVED from the
-     * `{{placeholders}}` in this locale's content — see {@link extractVariables}.
-     * Supply explicitly to make a placeholder optional (leave it out of the list)
-     * or to require something a conditional references.
-     */
-    variables?: readonly string[];
-}
-/** An email template: base content, plus optional per-locale overrides. */
-interface EmailTemplateOptions extends EmailTemplateContent {
-    /** Locale of the base content. Defaults to `"en"`. */
-    locale?: string;
-    /** Additional locales, keyed by BCP47 short tag (`tr`, `de`, …). */
-    locales?: Record<string, EmailTemplateContent>;
-}
-/** One locale's SMS content. */
-interface SmsTemplateContent {
-    /** Message body. Handlebars placeholders are rendered at send. */
-    body: string;
-    /** Variables the sender must supply. Derived from `body` when omitted. */
-    variables?: readonly string[];
-}
-/** An SMS template: base content, plus optional per-locale overrides. */
-interface SmsTemplateOptions extends SmsTemplateContent {
-    /** Locale of the base content. Defaults to `"en"`. */
-    locale?: string;
-    /** Additional locales, keyed by BCP47 short tag. */
-    locales?: Record<string, SmsTemplateContent>;
-}
-/** Author-facing templates block: slug → template. */
-interface TemplatesInput {
-    email?: Record<string, EmailTemplateOptions>;
-    sms?: Record<string, SmsTemplateOptions>;
-}
-/** A compiled email-template row — one (slug, locale) pair, in the snake_case
- * wire shape PalNotify's templates API takes. */
-interface EmailTemplateDef {
-    slug: string;
-    locale: string;
-    subject: string;
-    html_body: string;
-    text_body?: string;
-    variables: string[];
-}
-/** A compiled SMS-template row — one (slug, locale) pair. */
-interface SmsTemplateDef {
-    slug: string;
-    locale: string;
-    body: string;
-    variables: string[];
-}
-/** The compiled templates block: flat, per-channel row lists. Flat rows (rather
- * than a nested locale map) are what the apply step iterates — one row is one
- * upsert against the (slug, locale) unique key. */
-interface TemplatesConfig {
-    email: EmailTemplateDef[];
-    sms: SmsTemplateDef[];
-}
-/**
- * Pull the variable names out of Handlebars content.
- *
- * Only PLAIN mustaches count: `{{name}}` and `{{{name}}}`. Deliberately skipped:
- * - block/section/partial/comment tokens (`{{#if}}`, `{{/if}}`, `{{else}}`,
- *   `{{> partial}}`, `{{! comment}}`) — structure, not data the sender passes;
- * - helper calls (`{{formatDate at}}`) — the first token is a helper name;
- * - `this` and `@index`-style frame references.
- *
- * A dotted path contributes its ROOT (`{{user.name}}` → `user`), because that is
- * what the sender actually has to hand over.
- *
- * The list is what the server ENFORCES as required at render time, so keeping it
- * to the unambiguous cases is the point: an over-eager derivation would turn an
- * optional conditional into a mandatory argument and 400 real sends.
- */
-declare function extractVariables(...sources: (string | undefined)[]): string[];
-/** The author-facing input to `defineNotifications`. Every provider + every
- * channel is optional — declare only what you use. */
-interface NotificationsInput {
-    push?: {
-        apns?: ApnsOptions;
-        fcm?: FcmOptions;
-    };
-    email?: {
-        sendgrid?: SendgridOptions;
-        ses?: SesOptions;
-        smtp?: SmtpOptions;
-        acs?: AcsOptions;
-    };
-    sms?: {
-        twilio?: TwilioOptions;
-    };
-    /** Email + SMS templates, keyed by slug. Applied on every deploy. */
-    templates?: TemplatesInput;
-}
-/** A compiled provider def. `enabled` is always present; the remaining keys are
- * the provider's non-secret fields (verbatim from the catalog). A disabled
- * provider is `{ enabled: false }` with no other fields. */
-type ProviderDef = {
-    enabled: boolean;
-} & Record<string, unknown>;
-/** The compiled notifications config — the discriminant + per-channel maps of
- * provider name → {@link ProviderDef}. This is what `defineNotifications`
- * returns and the runtime extractor serializes. */
-interface NotificationsConfig {
-    __config: typeof NOTIFICATIONS_CONFIG_KIND;
-    push: Record<string, ProviderDef>;
-    email: Record<string, ProviderDef>;
-    sms: Record<string, ProviderDef>;
-    templates: TemplatesConfig;
-}
-/**
- * Compile + validate one provider's author options into a {@link ProviderDef}.
- *
- * - A provider with `enabled === false` (or omitted) compiles to `{ enabled:
- *   false }` and its required fields are NOT enforced (you can declare a disabled
- *   provider as a placeholder without filling it in).
- * - An ENABLED provider must supply every `required` non-secret field from the
- *   catalog; a missing one throws at config-author time (not silently at deploy).
- * - Only the catalog's non-secret fields (required + optional) are copied into
- *   the def — an unknown extra key is ignored (it would have no effect on the
- *   live provider). Secrets are never read here.
- */
-declare function buildProvider(name: ProviderName, opts: ProviderOptions): ProviderDef;
-/**
- * Define the notification-provider config for a project. Returns the
- * discriminated {@link NotificationsConfig} the runtime config extractor
- * serializes and the Go apply step reconciles. Validates eagerly: an enabled
- * provider missing a required non-secret field throws here (config-author time),
- * not at deploy.
- *
- * @example
- * export default defineNotifications({
- *   push: { apns: { enabled: true, teamId: "T", keyId: "K", bundleId: "com.x" } },
- * });
- */
-declare function defineNotifications(input: NotificationsInput): NotificationsConfig;
-/**
- * Derive the RESERVED env-var key that backs a provider's secret field, e.g.
- * `reservedSecretKey("apns", "p8")` → `"PB_NOTIFICATIONS_APNS_P8"`. The CLI uses
- * this to upload the secret and the br-pod apply step uses the same derivation
- * to resolve it — they never hand-type the key, so they cannot drift.
- */
-declare function reservedSecretKey(provider: ProviderName, secretField: string): string;
-
-/**
- * test-users.ts — the test-user fixtures config-as-code DSL.
- *
- * `defineTestUsers({ users })` is a MODULE config-as-code surface (a sibling of
- * `config/storage.ts`'s `defineStorage` and `config/flags.ts`'s `defineFlags`).
- * A `config/test-users.ts` file default-exports a `defineTestUsers(...)` result;
- * on deploy the runtime evaluates it to JSON and hands it to Studio, which owns
- * the single apply engine (mint + seed). Studio, the CLI and the deploy all go
- * through that one engine — there is no second interpreter of this JSON.
- *
- * TWO SHAPES, ONE DSL:
- *
- *  - `email` GIVEN  → a FIXTURE. Deploy materializes it create-if-missing, so
- *    the app can always be signed into with the same credentials. Deliberately
- *    NOT applied to a production Environment (the password lives in git).
- *  - `email` OMITTED → a TEMPLATE. Deploy creates nothing; Studio and the CLI
- *    mint as many fresh instances from it as you want (random credentials).
- *
- * Every minted user is an `is_test` user: excluded from MAU/billing, carrying
- * `test: true` in its token, and refused by the Test Data write path if it ever
- * turns out not to be one.
- *
- * @example
- * import { defineTestUsers, testUser } from "@palbase/backend";
- *
- * export default defineTestUsers({
- *   users: {
- *     demo: testUser({
- *       email: "demo@test.local",
- *       password: "demo-password-1234",
- *       seed: {
- *         profiles: [{ display_name: "Demo", tier: "pro" }],
- *         lists: [
- *           { title: "Groceries", todos: [{ title: "Milk" }, { title: "Eggs", done: true }] },
- *         ],
- *       },
- *     }),
- *     heavy_user: testUser({ seed: { lists: [{ title: "L", todos: [{ title: "t" }] }] } }),
- *   },
- * });
- *
- * The returned value is the EXACT JSON shape the runtime's generic config
- * extractor emits and the apply engine consumes:
- *   { __config: "test-users", users: { <name>: { email, password, seed } } }
- * `email` / `password` are the string or `null`; `seed` is `{}` when omitted.
- */
-
-/** The `__config` discriminant the eval/apply reads to confirm a config/*.ts is
- * a test-users config. */
-declare const TEST_USERS_CONFIG_KIND: "test-users";
-/**
- * A table graph in the shape the env `Tables` interface carries. The
- * derivations below are parameterized over it (rather than reading the global
- * `Tables` directly) so they can be type-tested against a fixture graph without
- * augmenting the global interface — augmentation is program-wide and would leak
- * into every other type test.
- *
- * The `Record<keyof G, …>` constraint is deliberate: a plain
- * `Record<string, TableTypes>` would reject the `Tables` INTERFACE, which has
- * no index signature.
- */
-type TableGraph = Record<string, TableTypes>;
-/** The user-rooted tables of `G` — the ones a test user owns rows in directly. */
-type OwnedTablesOf<G extends Record<keyof G, TableTypes>> = {
-    [T in keyof G]: G[T]["owner"] extends string ? T : never;
-}[keyof G];
-/**
- * One authored seed row for table `T` of graph `G`.
- *
- * Starts from the table's INSERT shape and removes the two columns the engine
- * owns: the owner column (set to the minted user) and `Via` — the FK column
- * this row hangs off its parent by, when the row is nested under one. What
- * remains is extended with the table's children, each an optional array of
- * their own seed rows.
- *
- * Recursion terminates because `makeEnvDts` drops self-FKs and cycle
- * back-edges when it emits `children`.
- *
- * Name collision note: if a table has a COLUMN whose name equals a CHILD
- * table's name, the intersection makes that key unusable (its type collapses).
- * That is a schema-naming problem the author sees at compile time; the apply
- * engine resolves the same ambiguity live in favour of the column, because it
- * introspects the real table.
- */
-type SeedRowFor<G extends Record<keyof G, TableTypes>, T extends keyof G, Via extends string = never> = Omit<G[T]["insert"], (G[T]["owner"] & string) | Via> & {
-    [C in keyof G[T]["children"]]?: Array<SeedRowFor<G, C & keyof G, G[T]["children"][C] & string>>;
-};
-/** The typed seed over graph `G`: top-level keys are user-rooted tables only;
- * everything else is reached by nesting under its parent. */
-type SeedFor<G extends Record<keyof G, TableTypes>> = {
-    [T in OwnedTablesOf<G>]?: Array<SeedRowFor<G, T>>;
-};
-/** The serialized seed — what travels as JSON and what the engine receives. */
-type SeedJson = Record<string, Array<Record<string, unknown>>>;
-/**
- * The author-facing seed type. Falls back to the loose shape when `Tables` is
- * still empty (no `db/schema.ts`, or `palbase-env.d.ts` not generated yet) so
- * an unseeded project gets a usable DSL instead of an inscrutable `{}` error.
- */
-type Seed = [keyof Tables] extends [never] ? SeedJson : SeedFor<Tables>;
-/**
- * The options for one declared test user.
- *
- * - `email` / `password`: supply BOTH to make this a fixture with stable
- *   credentials (deploy materializes it, the app signs in with them), or
- *   NEITHER to make it a template the server generates credentials for.
- * - `seed`: the user's data tree, derived from `db/schema.ts`. Top-level keys
- *   are user-rooted tables; FK children nest inside their parent's rows.
- */
-interface TestUserOptions {
-    email?: string;
-    password?: string;
-    /**
-     * A verified phone for this fixture, E.164 (`+905551112233`). Requires
-     * {@link TestUserOptions.otp}: nothing can receive an SMS at a fabricated
-     * number, so a phone fixture without a knowable code is one no test could
-     * ever sign in as.
-     */
-    phone?: string;
-    /**
-     * The fixed code this fixture's phone accepts. Honoured ONLY for the
-     * `is_test` user it belongs to — the real rail is untouched, and no
-     * verification is ever sent (or billed) for a fixture.
-     */
-    otp?: string;
-    seed?: Seed;
-}
-/** The compiled, serializable test-user definition — the EXACT shape emitted to
- * JSON and consumed by the apply engine. */
-interface TestUserDef {
-    /** Fixed login e-mail (fixture), or `null` when the server should generate one. */
-    email: string | null;
-    /** Fixed password (fixture), or `null` when the server should generate one. */
-    password: string | null;
-    /** Verified phone in E.164, or `null` for an e-mail-only fixture. */
-    phone: string | null;
-    /** The code that phone accepts, or `null` when there is no phone. */
-    otp: string | null;
-    /** The user's data tree; `{}` when nothing is seeded. */
-    seed: SeedJson;
-}
-/** A test-users config: the discriminant + the declared users by name. */
-interface TestUsersConfig {
-    __config: typeof TEST_USERS_CONFIG_KIND;
-    users: Record<string, TestUserDef>;
-}
-/** The author-facing input to `defineTestUsers`. */
-interface TestUsersInput {
-    users: Record<string, TestUserDef>;
-}
-/**
- * Define a single test user. The NAME is supplied by the object key in
- * `defineTestUsers({ users: { <name>: testUser({...}) } })`, so `testUser()`
- * takes only the options.
- *
- * Validates eagerly (at config-author time):
- *  - `email` and `password` are supplied together or not at all — half a
- *    credential pair would silently degrade a fixture into a template.
- *  - `email` looks like an address; `password` is at least
- *    {@link MIN_PASSWORD_LENGTH} characters.
- *  - `seed` is structurally `{ <table>: [ {...}, ... ] }` with non-empty arrays.
- *
- * The user NAME is validated by `defineTestUsers`, which is where it is known.
- */
-declare function testUser(opts?: TestUserOptions): TestUserDef;
-/**
- * Define a project's test users. The user NAME comes from each object key
- * (authors never repeat it). Returns the discriminated {@link TestUsersConfig}
- * the runtime config extractor serializes and the apply engine consumes.
- *
- * Validates eagerly:
- *  - each name matches `^[a-zA-Z][a-zA-Z0-9_]*$` (the CLI's `--template <name>`
- *    and control-pg's scenario name share this vocabulary).
- *  - no two fixtures declare the SAME e-mail — they would race to
- *    create-if-missing the one account and the second would silently adopt the
- *    first one's data tree.
- *
- * @example
- * export default defineTestUsers({
- *   users: { demo: testUser({ email: "demo@test.local", password: "demo-password-1234" }) },
- * });
- */
-declare function defineTestUsers(input: TestUsersInput): TestUsersConfig;
-
-/**
- * flags.ts — the feature-flag-definitions config-as-code DSL.
- *
- * `defineFlags({ flags })` is the third MODULE config-as-code surface (a sibling
- * of `config/storage.ts`'s `defineStorage` and `config/notifications.ts`'s
- * `defineNotifications`). A `config/flags.ts` file default-exports a
- * `defineFlags(...)` result; on deploy the br-pod evaluates it to JSON and
- * UPSERTS the declared flag DEFINITIONS into PalFlags (the user-flags module's
- * system-flags admin API) — create-or-update, idempotent. A live flag NOT in
- * config is NEVER auto-deleted (an orphan flag is harmless; upsert-only).
- *
- * Flags are DECLARATIVE: a flag is a typed project-wide DEFAULT (its key, type,
- * default value, an optional description, and — for string flags — an optional
- * list of allowed `variants`). The VALUE of a flag for a specific USER (a
- * per-user override / A-B assignment) is runtime state set via the SDK, NEVER in
- * git. `variants` here is part of the DEFINITION (the allowed values a string
- * flag may take), not a per-user assignment.
- *
- * NO SECRETS. Unlike notifications, a flag carries no credentials — this is the
- * simplest module config (pure declarative data).
- *
- * @example
- * import { defineFlags, flag } from "@palbase/backend";
- *
- * export default defineFlags({
- *   flags: {
- *     new_dashboard: flag({ type: "boolean", default: false, description: "Roll out the new dashboard" }),
- *     max_uploads:   flag({ type: "number",  default: 10 }),
- *     theme:         flag({ type: "string",  default: "light", variants: ["light", "dark", "system"] }),
- *     limits:        flag({ type: "json",    default: { daily: 10, burst: 50 } }),
- *   },
- * });
- *
- * The returned value is the EXACT JSON shape the runtime's generic config
- * extractor (`config_extract.js`) emits and the Go apply step parses:
- *   { __config: "flags", flags: { <key>: { type, default, variants, description }, ... } }
- * `variants` is the allowed-values list for a string flag, or `null` (any
- * string). `description` is the doc string, or `null`. The apply step maps the
- * author-facing `type` to PalFlags' `value_type`: "boolean" → "bool" and
- * "json" → "object"; "number"/"string" pass through.
- */
-/** The `__config` discriminant the eval/apply reads to confirm a config/*.ts is
- * a flags config. Flags is `"flags"`. */
-declare const FLAGS_CONFIG_KIND: "flags";
-/**
- * A flag's type. The author-facing vocabulary is `"boolean" | "number" |
- * "string" | "json"`; the apply step maps it to PalFlags' `value_type` enum —
- * `"boolean"` → `"bool"`, `"json"` → `"object"`, the other two pass through. The
- * SDK keeps the JS-natural names so the DSL reads cleanly.
- *
- * `"json"` is a structured (object) flag. It is named for what an author types —
- * a JSON object literal — and matches the `--type json` the CLI's per-user
- * override commands already use for this same server type.
- */
-type FlagType = "boolean" | "number" | "string" | "json";
-/** Any value expressible in JSON — what may appear INSIDE a `"json"` flag's default. */
-type FlagJsonValue = boolean | number | string | null | FlagJsonValue[] | {
-    [key: string]: FlagJsonValue;
-};
-/**
- * The default of a `"json"` flag: a JSON OBJECT. Not an array and not a scalar —
- * PalFlags' `object` value type accepts a JSON object at the top level only
- * (`validate.ValidateValueTypeMatch`), and it caps nesting depth at 3.
- */
-type FlagJsonObject = {
-    [key: string]: FlagJsonValue;
-};
-/** The runtime JSON value a flag's `default` may hold (matches {@link FlagType}). */
-type FlagValue = boolean | number | string | FlagJsonObject;
-/**
- * The author-facing options for a single flag — a UNION keyed on `type`, so
- * `default` is checked against the declared type at compile time and `variants`
- * is only accepted where it means something.
- *
- * - `type`: the flag's type — `"boolean" | "number" | "string" | "json"`.
- * - `default`: the project-wide default value. MUST match `type` (a `number`
- *   default with `type: "boolean"` is a type error, and throws at runtime).
- * - `variants`: ONLY valid for `type: "string"` — the allowed values the string
- *   flag may take (a DEFINITION, not a per-user assignment). When given, the
- *   `default` MUST be one of the variants. Supplying `variants` on any other
- *   type is a type error, and throws at runtime. (PalFlags rejects variants for
- *   every non-string `value_type`, so accepting them here would only produce a
- *   config the server refuses.)
- * - `description`: an optional human description of what the flag controls.
- */
-type FlagOptions = {
-    type: "boolean";
-    default: boolean;
-    variants?: never;
-    conditions?: FlagCondition<boolean>[];
-    description?: string;
-} | {
-    type: "number";
-    default: number;
-    variants?: never;
-    conditions?: FlagCondition<number>[];
-    description?: string;
-} | {
-    type: "string";
-    default: string;
-    variants?: string[];
-    conditions?: FlagCondition<string>[];
-    description?: string;
-} | {
-    type: "json";
-    default: FlagJsonObject;
-    variants?: never;
-    conditions?: FlagCondition<FlagJsonObject>[];
-    description?: string;
-};
-/**
- * One targeting branch: the value this flag resolves to when `when` matches the
- * caller's client context. Branch ORDER is priority — the first match wins, and
- * a flag with no matching branch falls back to its `default`.
- *
- * `when` is a small expression over what the client declares about itself:
- *
- * ```
- * client.platform == 'ios' && client.app_version >= '2.0.0'
- * client.locale startsWith 'tr'
- * client.platform in ['ios', 'android']
- * ```
- *
- * Those are CLAIMS, not proof — the server treats them as attacker-controlled.
- * They select WHICH value a caller sees, never WHETHER they may see it, so a
- * condition must not be the thing standing between a user and something paid.
- */
-/**
- * The variables the server exposes. Mirrors `declaredVars` in
- * `modules/user-flags/internal/conditions/conditions.go`; the server rejects
- * anything it does not know, so the worst a stale copy here does is offer too
- * little.
- *
- * `client.*` is what the SDK reports about the caller. `percentile` and
- * `server.now` are DERIVED server-side and cannot be moved by a lying client,
- * which is what makes a rollout or a time window mean anything.
- */
-type StringVar = "client.platform" | "client.locale";
-type SemverVar = "client.app_version" | "client.os_version";
-type EqualityOp = "==" | "!=";
-/** Ordering only where order exists — a platform string has none. */
-type OrderedOp = EqualityOp | "<" | "<=" | ">" | ">=";
-type TextOp = EqualityOp | "startsWith" | "endsWith" | "contains";
-/** A single-quoted literal. Quoting is the mistake people make most. */
-type Quoted = `'${string}'`;
-type Comparison = `${StringVar} ${TextOp} ${Quoted}` | `${StringVar} in [${string}]` | `${SemverVar} ${OrderedOp} ${Quoted}` | `percentile ${OrderedOp} ${number}` | `server.now ${OrderedOp} ${Quoted}`;
-/**
- * One expression: a comparison, optionally chained with `&&` / `||`, or a
- * parenthesised group.
- *
- * ONE level, and the limit is TypeScript's, not a preference. Unrolling a second
- * level produced `TS2590: union type too complex`, and the failure mode there is
- * the worst possible one: the checker gives up and the type silently degrades to
- * `string`, so NOTHING is checked while the code still compiles. Measured, not
- * assumed — the two-level version accepted `client.app_verison` without
- * complaint.
- *
- * So the FIRST term is fully checked and the rest of a chain is not. That is
- * where the mistakes are: a rule is usually one comparison, and a typo in the
- * first one is the common case. A typo after an `&&` still reaches the server,
- * which parses the real grammar and rejects it.
- *
- * A group's contents go unchecked for the same reason.
- */
-type FlagConditionExpression = Comparison | `${Comparison} && ${string}` | `${Comparison} || ${string}` | `(${string})`;
-interface FlagCondition<V> {
-    when: FlagConditionExpression;
-    value: V;
-}
-/**
- * The COMPILED shape of a condition — the JSON actually emitted and parsed by
- * the Go apply step.
- *
- * `when` widens back to `string` here on purpose. The narrow type is an
- * authoring aid; once the expression has been trimmed and serialised it is just
- * text on the wire, and keeping the template-literal type would force a cast on
- * every string operation without checking anything the author had not already
- * been checked on.
- */
-interface CompiledFlagCondition<V> {
-    when: string;
-    value: V;
-}
-/**
- * The compiled, serializable flag definition — the EXACT shape emitted to JSON
- * and consumed by the Go apply step.
- *
- * - `type`: the author-facing type verbatim (`"boolean" | "number" | "string" |
- *   "json"`) — the apply step maps it to PalFlags' `value_type`.
- * - `default`: the default value (matches `type`).
- * - `variants`: the allowed-values list for a string flag, or `null` (any).
- * - `description`: the doc string, or `null`.
- */
-interface FlagDef {
-    type: FlagType;
-    default: FlagValue;
-    variants: string[] | null;
-    /** Ordered targeting branches, or `null` when the flag is unconditional. */
-    conditions: CompiledFlagCondition<FlagValue>[] | null;
-    description: string | null;
-}
-/** A flags config definition: the discriminant + a map of flag key →
- * {@link FlagDef}. This is the value `defineFlags` returns and the runtime
- * config extractor serializes. */
-interface FlagsConfig {
-    __config: typeof FLAGS_CONFIG_KIND;
-    flags: Record<string, FlagDef>;
-}
-/** The author-facing input to `defineFlags`: a `flags` map whose keys are the
- * flag keys and whose values are `flag({...})` builders. */
-interface FlagsInput {
-    flags: Record<string, FlagDef>;
+ * stack-gen.ts — generate the `palbase-stack.d.ts` text from the names the
+ * linked environment's stack holds.
+ *
+ * The twin of `db/env-gen.ts`: the CLI calls
+ * {@link makeStackDts} with the three name sets it read off the stack and
+ * writes the result to `palbase-stack.d.ts` at the project root. That file
+ * augments the `@palbase/backend/stack` interfaces, so `Secrets.get(...)`, the
+ * Flags client and `@Upload({ bucket })` accept the project's real names and
+ * nothing else.
+ *
+ * The generator does NOT reach the network and does NOT decide what a name is:
+ * it renders what it is handed. The stack is the authority on which names exist
+ * (`GET /v1/management/secrets`, `/flags`, `/storage/buckets`); re-deciding that
+ * here would be a second, weaker copy of it.
+ *
+ * The emitted file ends in `export {};` — same as `makeEnvDts` and
+ * `makePurchasesDts`. Without it the `.d.ts` is a global script, and
+ * `declare module "…"` there DECLARES an ambient module (shadowing the real one,
+ * so every name silently becomes invalid) instead of AUGMENTING it.
+ */
+/** The three name sets read off the stack. Order is irrelevant — each set is
+ * sorted here so the same stack always renders the same bytes and a diff shows
+ * what CHANGED rather than how the API happened to order its answer. */
+/** One bucket and the renditions it declares. */
+interface BucketInput {
+    name: string;
+    variants: readonly string[];
 }
-/**
- * Define a single flag. The flag KEY is supplied by the object key in
- * `defineFlags({ flags: { <key>: flag({...}) } })`, so `flag()` takes only the
- * options.
- *
- * Validates eagerly (at config-author time):
- *  - `type` is one of `"boolean" | "number" | "string" | "json"`.
- *  - `default` matches `type` (e.g. a `number` default with `type: "boolean"`
- *    throws; a `"json"` default must be a plain object, not an array or scalar).
- *  - `variants` is ONLY allowed for a string flag (variants on any other type
- *    throws); each entry is a non-empty string; the `default` must be one of the
- *    variants.
- *
- * Returns a normalized {@link FlagDef}: `variants` deduped-or-null,
- * `description` trimmed-or-null.
- */
-declare function flag(opts: FlagOptions): FlagDef;
-/**
- * Define the feature-flag definitions for a project. The flag KEY comes from
- * each object key (authors never repeat the key). Returns the discriminated
- * {@link FlagsConfig} the runtime config extractor serializes and the Go apply
- * step UPSERTS into PalFlags.
- *
- * @example
- * export default defineFlags({
- *   flags: { dark_mode: flag({ type: "boolean", default: false }) },
- * });
- */
-declare function defineFlags(input: FlagsInput): FlagsConfig;
-
-/**
- * secrets.ts — the tenant SECRET REQUIREMENT config-as-code DSL.
- *
- * `defineSecrets({ secrets: [secret("NEO4J_PASSWORD")] })` declares WHICH secrets
- * a backend needs to run. It declares the requirement, never the value: the value
- * lives only in the vault, and nothing in this file — or in the repo it is
- * committed to — ever holds one.
- *
- * The gap it closes: today a backend's dependence on a secret is written nowhere
- * except inside the code that reads it (`process.env.NEO4J_PASSWORD`). Deploy a
- * project into an environment where that secret was never set and the build
- * passes, the pod starts, and the failure surfaces as a 500 on the first request
- * that touches it — measured on todoapp, whose `/graph/*` routes returned 500 for
- * exactly this reason. With the requirement declared, it travels WITH the code:
- * `push` compares this list against the environment's vault and refuses the
- * deploy, naming the missing secret, before anything ships.
- *
- * @example
- *   // config/secrets.ts
- *   import { defineSecrets, secret } from "@palbase/backend";
- *   export default defineSecrets({
- *     secrets: [
- *       secret("NEO4J_PASSWORD", { description: "graph store password" }),
- *       secret("SENTRY_DSN", { required: false, description: "crash reporting" }),
- *     ],
- *   });
- *
- * `required` defaults to TRUE. A declaration exists to be checked, so the safe
- * default is the checked one; `required: false` says the code has a working path
- * when the secret is absent, and downgrades a missing secret to a warning.
- *
- * Emits: { __config: "secrets", secrets: [{ name, required, description }] }
- * sorted by name, so the same declaration always evaluates to the same bytes and
- * a config diff shows what an author changed rather than how they reordered it.
- */
-/** The discriminant written under `__config` so the deploy eval knows the kind. */
-declare const SECRETS_CONFIG_KIND: "secrets";
-/** The author-facing options for a single `secret()`. */
-interface SecretOptions {
+interface StackNames {
+    /** Secret names from the project's vault. */
+    secrets: readonly string[];
+    /** Flag keys from the project's flag store. */
+    flags: readonly string[];
     /**
-     * Whether the deploy must REFUSE when this secret is absent from the target
-     * environment's vault. Omitted ⇒ `true`.
+     * Buckets from the project's storage — a bare name, or a name with the
+     * renditions it declares.
+     *
+     * A bucket is not only a NAME: `Storage.buckets.docs.getPublicUrl(p, {
+     * variant })` refuses a rendition the bucket does not have, so the variant
+     * union has to travel with it. The bare-string form is shorthand for "no
+     * variants", which renders `never` and accepts none.
      */
-    required?: boolean;
-    /** What the secret is for — shown when the deploy reports it missing. */
-    description?: string;
+    buckets: readonly (string | BucketInput)[];
 }
 /**
- * The compiled, serializable secret declaration — the EXACT shape emitted to
- * JSON and consumed by the Go deploy step.
+ * Render the project's `palbase-stack.d.ts`.
  *
- * - `name`: the environment-variable name the code reads, verbatim.
- * - `required`: always present (defaulted to `true`).
- * - `description`: the doc string, or `null`.
+ * An empty set renders an empty interface, which is a MEANINGFUL value: the
+ * stack holds no such names, so the corresponding union is `never` and every
+ * call spelling one fails to compile. It is not the same as "the file was never
+ * generated" only in that the file exists — both states refuse every name, and
+ * both are correct.
  */
-interface SecretDef {
-    name: string;
-    required: boolean;
-    description: string | null;
-}
-/** A secrets config definition: the discriminant + the name-sorted declarations.
- * This is the value `defineSecrets` returns and the build's config extractor
- * serializes into `.palbase/config.json`. */
-interface SecretsConfig {
-    __config: typeof SECRETS_CONFIG_KIND;
-    secrets: SecretDef[];
-}
-/** The author-facing input to `defineSecrets`: a list of `secret(...)` builders. */
-interface SecretsInput {
-    secrets: SecretDef[];
-}
-/**
- * Declare a single required (or optional) secret. Unlike `flag()` / `bucket()`,
- * the NAME is an argument rather than an object key: a secret's name is not a
- * label an author chooses, it is the exact env-var identifier the code already
- * reads, so it belongs where it can be validated as one.
- *
- * Validates eagerly (at config-author time):
- *  - `name` is `[A-Z][A-Z0-9_]*` — anything else throws.
- *  - `required` is a boolean; `description` is a string.
- *
- * Returns a normalized {@link SecretDef}: `required` defaulted to `true`,
- * `description` trimmed-or-null.
- */
-declare function secret(name: string, opts?: SecretOptions): SecretDef;
-/**
- * Define the secrets a backend needs. Returns the discriminated
- * {@link SecretsConfig} the build's config extractor serializes and the deploy
- * checks against the target environment's vault BEFORE shipping anything.
- *
- * A name declared twice throws: two declarations of one name disagree about
- * something (usually `required`), and silently keeping either one is how a
- * secret stops being checked without anybody editing the check.
- */
-declare function defineSecrets(input: SecretsInput): SecretsConfig;
+declare function makeStackDts(names: StackNames): string;
 
 /** Options accepted by `@Controller`. */
 interface ControllerOptions {
@@ -1712,96 +759,4 @@ interface ResolvedJob {
 declare function Job(options: JobOptions): <T extends abstract new (...args: never[]) => object>(ctor: T) => T;
 declare function getJobConfig(ctor: object): ResolvedJob;
 
-/**
- * resource.ts — external connections as lifecycle-managed classes.
- *
- * A `Resource` subclass models one external connection (a pooled datastore, a
- * stateless API client, or a per-user factory). The framework discovers each
- * instance, calls `init(env)` ONCE at boot with the declared secret subset, and
- * `shutdown()` (reverse order) on SIGTERM. On top of that lifecycle the author
- * exposes their own clean facade methods.
- *
- *   // resources/neo4j.ts
- *   import { Resource } from "@palbase/backend";
- *   import neo4j, { type Driver, type Session } from "neo4j-driver";
- *
- *   export class Neo4jResource extends Resource {
- *     static secrets = ["NEO4J_URL", "NEO4J_USER", "NEO4J_PASSWORD"] as const;
- *     private driver!: Driver;
- *     async init(env: { NEO4J_URL: string; NEO4J_USER: string; NEO4J_PASSWORD: string }) {
- *       this.driver = neo4j.driver(env.NEO4J_URL, neo4j.auth.basic(env.NEO4J_USER, env.NEO4J_PASSWORD));
- *     }
- *     async shutdown() { await this.driver.close(); }
- *     session(): Session { return this.driver.session(); }
- *   }
- *   export const neo4j = new Neo4jResource();  // framework finds + manages it
- *
- * # Boot scope (NOT request-ALS)
- *
- * Resources are instantiated once at process boot. This is deliberately NOT the
- * per-request {@link AsyncLocalStorage} scope used for `Database`/`Cache`/… — a
- * connection pool must outlive a single request. The runtime discovers
- * resources from the project's `resources/` directory, registers each via
- * {@link __registerResource}, then calls {@link __runResourceBoot} before
- * serving and {@link __shutdownResources} on SIGTERM. Discovery is a runtime
- * concern; the SDK provides the base class + registry + boot/shutdown hooks.
- */
-/** Map a declared `secrets` tuple to the `init(env)` argument type — a record
- * over the secret names, each `string`. An empty tuple maps to an empty
- * record. */
-type ResourceEnv<Secrets extends readonly string[]> = {
-    [K in Secrets[number]]: string;
-};
-/**
- * Base class for external connections.
- *
- * - `static secrets` — OPTIONAL readonly tuple of env-var names this resource
- *   needs. Drives (a) the `env` type passed to `init` and (b) the
- *   missing-secret check at boot (deploy fails naming the absent secret).
- * - `init(env)` — called ONCE at boot with the declared secret subset. May be
- *   sync (`void`) or async (`Promise<void>`).
- * - `shutdown()` — OPTIONAL drain hook, called on SIGTERM in reverse boot
- *   order.
- *
- * @example
- * import { Resource } from "@palbase/backend";
- * import { Client } from "@googlemaps/google-maps-services-js";
- *
- * export class GoogleResource extends Resource {
- *   static secrets = ["GOOGLE_MAPS_KEY"] as const;
- *   private client = new Client();
- *   private key = "";
- *   init(env: { GOOGLE_MAPS_KEY: string }) { this.key = env.GOOGLE_MAPS_KEY; }
- * }
- * export const google = new GoogleResource();
- */
-declare abstract class Resource {
-    /** The env-var names this resource needs. Optional; omit for none. */
-    static secrets?: readonly string[];
-    /** Set up the connection from the declared secrets. Called once at boot. */
-    abstract init(env: Record<string, string>): void | Promise<void>;
-    /** Drain/close the connection on SIGTERM. Optional. */
-    shutdown?(): void | Promise<void>;
-}
-/**
- * Register a resource instance with the boot registry. The runtime calls this
- * for each instance discovered under the project's `resources/` directory.
- * NOT part of the public author-facing API (prefixed `__`).
- */
-declare function __registerResource(resource: Resource): void;
-/**
- * Boot every registered resource that has not yet been booted: resolve its
- * declared secret subset from `envMap`, then await its `init(env)`. Idempotent
- * — an already-booted resource is skipped. Throws (failing deploy/boot) when a
- * declared secret is absent, naming the missing secret. NOT part of the public
- * author-facing API.
- */
-declare function __runResourceBoot(envMap: Record<string, string>): Promise<void>;
-/**
- * Shut down every booted resource in REVERSE registration order, awaiting each
- * `shutdown()` (a no-op when undefined). Clears the registry afterwards so a
- * second call is a no-op. NOT part of the public author-facing API.
- */
-declare function __shutdownResources(): Promise<void>;
-
-export { type AcsOptions, type ApnsOptions, type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Controller, type ControllerOptions, DEFAULT_TEMPLATE_LOCALE, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, EGRESS_CONFIG_KIND, EGRESS_TIMEOUT_DEFAULT_MS, EGRESS_TIMEOUT_MAX_MS, EGRESS_TIMEOUT_MIN_MS, type EgressConfig, type EgressInput, type EmailTemplateContent, type EmailTemplateDef, type EmailTemplateOptions, EntitlementKey, FLAGS_CONFIG_KIND, type FcmOptions, type FileDeletedEvent, type FileUploadedEvent, type FlagDef, type FlagJsonObject, type FlagJsonValue, type FlagOptions, type FlagType, type FlagValue, type FlagsConfig, type FlagsInput, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, LimitKey, type ModuleClientsConfig, type ModuleTransport, NOTIFICATIONS_CONFIG_KIND, type NotificationsConfig, type NotificationsInput, On, OptionalUser, type OwnedTablesOf, PROVIDER_CATALOG, PalbaseModuleError, PalbaseResult, Param, Patch, type PolicyJSON, Post, type ProviderCatalogEntry, type ProviderDef, type ProviderName, type ProviderOptions, type PurchasesManifest, Put, Query, QueryParams, RESERVED_SECRET_PREFIX, type RegisteredError, Req, RequestId, type RequestOptions, RequireEntitlement, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Resource, type ResourceEnv, RouteOptions, SECRETS_CONFIG_KIND, SchemaDef, type SchemaJSON, type SecretDef, type SecretOptions, type SecretsConfig, type SecretsInput, type Seed, type SeedFor, type SeedJson, type SeedRowFor, type SendgridOptions, type SesOptions, type SignatureSpec, type SmsTemplateContent, type SmsTemplateDef, type SmsTemplateOptions, type SmtpOptions, Spend, type SpendMeta, TEST_USERS_CONFIG_KIND, type TableGraph, type TableJSON, TableTypes, Tables, type TemplatesConfig, type TemplatesInput, type TestUserDef, type TestUserOptions, type TestUsersConfig, type TestUsersInput, TraceId, type TransportConfig, type TwilioOptions, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __registerResource, __resetRegisteredControllers, __runResourceBoot, __shutdownResources, buildModuleClients, buildProvider, defineChannels, defineEgress, defineError, defineFlags, defineNotifications, defineSecrets, defineTestUsers, entitlementFor, extractVariables, flag, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makePurchasesDts, ownerOnly, publicChannel, reservedSecretKey, secret, spendFor, testUser, toSchemaJSON };
+export { type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Controller, type ControllerOptions, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, type FileDeletedEvent, type FileUploadedEvent, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Job, type JobMeta, type JobOptions, type ModuleClientsConfig, type ModuleTransport, On, OptionalUser, PalbaseModuleError, PalbaseResult, Param, Patch, type PolicyJSON, Post, Put, Query, QueryParams, type RegisteredError, Req, RequestId, type RequestOptions, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, RouteOptions, SchemaDef, type SchemaJSON, type SignatureSpec, type StackNames, type TableJSON, TraceId, type TransportConfig, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __resetRegisteredControllers, buildModuleClients, defineChannels, defineError, getErrorRegistry, getHookConfig, getJobConfig, getRegisteredControllers, getWebhookConfig, makeEnvDts, makeHttpClient, makeStackDts, ownerOnly, publicChannel, toSchemaJSON };