@palbase/backend 22.1.0 → 23.1.0

package/dist/index.js

@@ -18,15 +18,11 @@ import {
   timestamp,
   uuid,
   vector
-} from "./chunk-I3ON7MYF.js";
+} from "./chunk-PY7YJDCT.js";
 import {
   defineError,
-  entitlementFor,
-  getErrorRegistry,
-  recordEntitlement,
-  recordSpend,
-  spendFor
-} from "./chunk-N32VDWKH.js";
+  getErrorRegistry
+} from "./chunk-R3KN6RHD.js";
 import {
   Cache,
   Database,
@@ -34,7 +30,6 @@ import {
   Flags,
   Log,
   Notifications,
-  Purchases,
   Realtime,
   Secrets,
   Storage,
@@ -42,19 +37,19 @@ import {
   __requestALS,
   __runWithRuntime,
   __setRuntime
-} from "./chunk-SQC5EIWY.js";
+} from "./chunk-OHALWEOG.js";
 import {
   TxPlanError,
   TxRefError,
   dec,
   inc,
   now
-} from "./chunk-W5ODXPY3.js";
+} from "./chunk-NS5V43YQ.js";
 import {
   Controller,
   __resetRegisteredControllers,
   getRegisteredControllers
-} from "./chunk-YL4C5NRY.js";
+} from "./chunk-HQRJDARQ.js";
 import {
   BadRequest,
   Conflict,
@@ -68,141 +63,9 @@ import {
   recordParam,
   recordRoute,
   recordThrows
-} from "./chunk-QMVK4X3V.js";
+} from "./chunk-RCLNBJCM.js";
 import "./chunk-7D4SUZUM.js";
 
-// src/purchases/errors.ts
-function asPalstoreError(err) {
-  if (!(err instanceof Error)) return null;
-  const e = err;
-  if (typeof e.code !== "string" || typeof e.status !== "number") return null;
-  return { code: e.code, status: e.status, message: e.message };
-}
-function toHttpError(err) {
-  if (err instanceof HttpError) return err;
-  const p = asPalstoreError(err);
-  if (!p) return err;
-  switch (p.code) {
-    case "entitlement_required": {
-      const entitlement = err.entitlement ?? null;
-      return new PalError(403, "entitlement_required", p.message, { entitlement });
-    }
-    case "quota_exceeded":
-    case "credit_insufficient": {
-      const state = err.state;
-      return new PalError(429, p.code, p.message, state);
-    }
-    default:
-      return err;
-  }
-}
-
-// src/purchases/subject.ts
-var subjectByRequest = /* @__PURE__ */ new WeakMap();
-function storeEnv() {
-  return process.env.PALSTORE_STORE_ENV === "sandbox" ? "sandbox" : "production";
-}
-async function currentSubjectId() {
-  const store = __requestALS.getStore();
-  if (!store) {
-    throw new Error(
-      "Purchases decorators used outside a request scope. @RequireEntitlement/@Spend resolve the subject from the request's authenticated user, so they only work inside an endpoint handler."
-    );
-  }
-  const memoized = subjectByRequest.get(store);
-  if (memoized) return memoized;
-  const userId = store.userId;
-  if (!userId) {
-    throw new Unauthorized(
-      "This endpoint requires an authenticated user: purchases entitlements and quota are per-user, and the subject is resolved from the request's identity."
-    );
-  }
-  const resolving = Purchases.resolveSubject({ userRef: userId, storeEnv: storeEnv() }).then(
-    (r) => r.subjectId
-  );
-  subjectByRequest.set(store, resolving);
-  resolving.catch(() => subjectByRequest.delete(store));
-  return resolving;
-}
-
-// src/purchases/decorators.ts
-var WRAPPED = /* @__PURE__ */ Symbol.for("palbase.backend.purchases.wrapped");
-function idempotencyKeyFor(key) {
-  const store = __requestALS.getStore();
-  const base = store?.idempotencyKey || store?.requestId;
-  if (!base) {
-    throw new Error(
-      "@Spend needs a request-scoped idempotency key, and the runtime supplied neither an Idempotency-Key header nor a request id. Spending without one would let a retried request charge the user twice."
-    );
-  }
-  return `${base}:${key}`;
-}
-function ensureWrapper(target, fnName, descriptor) {
-  const original = descriptor.value;
-  if (typeof original !== "function") {
-    throw new Error(
-      `@RequireEntitlement/@Spend can only decorate a method; "${fnName}" is not one.`
-    );
-  }
-  if (original[WRAPPED]) return;
-  const wrapper = async function(...args) {
-    const ctor = this.constructor;
-    const entitlement = entitlementFor(ctor, fnName);
-    const spend = spendFor(ctor, fnName);
-    let subjectId;
-    try {
-      subjectId = await currentSubjectId();
-    } catch (err) {
-      throw toHttpError(err);
-    }
-    if (entitlement !== void 0) {
-      try {
-        await Purchases.require(subjectId, entitlement);
-      } catch (err) {
-        throw toHttpError(err);
-      }
-    }
-    if (spend === void 0) {
-      return original.apply(this, args);
-    }
-    let handlerFailure;
-    try {
-      return await Purchases.withSpend(
-        subjectId,
-        spend.key,
-        { count: spend.count, idempotencyKey: idempotencyKeyFor(spend.key) },
-        async () => {
-          try {
-            return await original.apply(this, args);
-          } catch (err) {
-            handlerFailure = { err };
-            throw err;
-          }
-        }
-      );
-    } catch (err) {
-      if (handlerFailure !== void 0 && handlerFailure.err === err) throw err;
-      throw toHttpError(err);
-    }
-  };
-  wrapper[WRAPPED] = true;
-  descriptor.value = wrapper;
-}
-function RequireEntitlement(key) {
-  return function(target, propertyKey, descriptor) {
-    const fnName = String(propertyKey);
-    recordEntitlement(target, fnName, key);
-    ensureWrapper(target, fnName, descriptor);
-  };
-}
-function Spend(key) {
-  return function(target, propertyKey, descriptor) {
-    const fnName = String(propertyKey);
-    recordSpend(target, fnName, { key, count: 1 });
-    ensureWrapper(target, fnName, descriptor);
-  };
-}
-
 // src/clients/http.ts
 var PalbaseModuleError = class extends Error {
   code;
@@ -548,12 +411,12 @@ function buildFlagsClient(http, cfg) {
       return {
         data: Object.keys(values).map((name) => {
           const value = values[name];
-          const flag2 = {
+          const flag = {
             name,
             enabled: flagEnabled(value)
           };
-          if (typeof value === "string") flag2.variant = { name: value };
-          return flag2;
+          if (typeof value === "string") flag.variant = { name: value };
+          return flag;
         }),
         error: null,
         status: res.status
@@ -781,13 +644,13 @@ function buildNotificationsClient(http) {
 
 // src/clients/realtime.ts
 import { createHmac } from "crypto";
-function mintToken(secret2) {
+function mintToken(secret) {
   const now2 = Math.floor(Date.now() / 1e3);
   const header = Buffer.from(JSON.stringify({ alg: "HS256", typ: "JWT" })).toString("base64url");
   const payload = Buffer.from(
     JSON.stringify({ iss: "backend-runtime", role: "service_role", iat: now2, exp: now2 + 60 })
   ).toString("base64url");
-  const sig = createHmac("sha256", secret2).update(`${header}.${payload}`).digest("base64url");
+  const sig = createHmac("sha256", secret).update(`${header}.${payload}`).digest("base64url");
   return `${header}.${payload}.${sig}`;
 }
 function buildRealtimeClient(cfg) {
@@ -958,11 +821,11 @@ function validateStoragePath(p) {
     );
   }
 }
-function toFileObject(bucket2, row) {
+function toFileObject(bucket, row) {
   return {
     name: row.path ?? "",
     path: row.path ?? "",
-    bucket: row.bucket ?? bucket2,
+    bucket: row.bucket ?? bucket,
     size: typeof row.size === "number" ? row.size : 0,
     contentType: row.contentType ?? "",
     checksum: row.checksum ?? "",
@@ -1078,35 +941,6 @@ function buildModuleClients(cfg) {
   };
 }
 
-// src/purchases/keys-gen.ts
-function liveKeys(entries) {
-  return Object.entries(entries ?? {}).filter(([, def]) => def?.removed !== true).map(([key]) => key).sort();
-}
-function memberName(key) {
-  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(key) ? key : JSON.stringify(key);
-}
-function members(keys) {
-  if (keys.length === 0) return "";
-  return `
-${keys.map((k) => `    ${memberName(k)}: true;`).join("\n")}
-  `;
-}
-function makePurchasesDts(manifest) {
-  const entitlements = liveKeys(manifest.entitlements);
-  const limits = liveKeys({ ...manifest.limits, ...manifest.credits });
-  return `// palbase-purchases.d.ts \u2014 GENERATED by @palbase/backend. Do not edit.
-// Source: the project's palstore catalog revision.
-
-declare module "@palbase/backend/purchases" {
-  interface Entitlements {${members(entitlements)}}
-
-  interface Limits {${members(limits)}}
-}
-
-export {};
-`;
-}
-
 // src/db/schema-json.ts
 function defOf(column) {
   return "_def" in column ? column._def : column;
@@ -1145,9 +979,45 @@ function policyToJSON(policy2) {
     permissive: policy2.permissive !== false
   };
 }
-function searchToJSON(search) {
+function commonSearchFields(search, out) {
+  if (search.synonyms !== void 0 && Object.keys(search.synonyms).length > 0) {
+    out.synonyms = Object.fromEntries(
+      Object.entries(search.synonyms).map(([word, alts]) => [word, [...alts]])
+    );
+  }
+  if (search.validity === true) out.validity = true;
+}
+function searchToJSON(search, vectorColumn) {
+  if (search.from !== void 0 && search.model !== void 0) {
+    const out2 = {};
+    const textCols = search.text === false ? void 0 : Array.isArray(search.text) && search.text.length > 0 ? search.text : search.from;
+    if (textCols !== void 0) out2.text = { columns: [...textCols] };
+    const v = { metric: search.metric ?? "cosine" };
+    if (vectorColumn !== void 0) v.column = vectorColumn;
+    v.embed = {
+      provider: search.model.provider,
+      model: search.model.model,
+      from: [...search.from],
+      ...search.model.apiKeyName !== void 0 ? { apiKeyName: search.model.apiKeyName } : {},
+      ...search.model.dimensions !== void 0 ? { dimensions: search.model.dimensions } : {},
+      ...search.model.baseURL !== void 0 ? { baseURL: search.model.baseURL } : {}
+    };
+    if (search.staleness !== void 0) v.staleness = search.staleness;
+    if (vectorColumn === void 0) {
+      v.mode = "chunks";
+      if (search.chunks !== void 0) {
+        const c = {};
+        if (search.chunks.size !== void 0 && search.chunks.size > 0) c.sizeChars = search.chunks.size;
+        if (search.chunks.overlap !== void 0 && search.chunks.overlap > 0) c.overlapChars = search.chunks.overlap;
+        if (Object.keys(c).length > 0) v.chunks = c;
+      }
+    }
+    out2.vector = [v];
+    commonSearchFields(search, out2);
+    return out2;
+  }
   const out = {};
-  if (search.text !== void 0 && search.text.length > 0) out.text = { columns: [...search.text] };
+  if (Array.isArray(search.text) && search.text.length > 0) out.text = { columns: [...search.text] };
   const legs = search.vector === void 0 ? [] : Array.isArray(search.vector) ? search.vector : [search.vector];
   if (legs.length > 0) {
     out.vector = legs.map((leg) => {
@@ -1167,8 +1037,17 @@ function searchToJSON(search) {
       return v;
     });
   }
+  commonSearchFields(search, out);
   return out;
 }
+function memoryToJSON(m) {
+  return {
+    from: [...m.from],
+    into: m.into,
+    ...m.subject !== void 0 ? { subject: m.subject } : {},
+    extract: { provider: m.extract.provider, model: m.extract.model }
+  };
+}
 function tableToJSON(table) {
   const columns = {};
   for (const [name, column] of Object.entries(table.columns)) {
@@ -1205,9 +1084,13 @@ function tableToJSON(table) {
     out.indexes = table.indexes.map((i) => ({ name: i.name, columns: [...i.columns] }));
   }
   if (table.search !== void 0) {
-    const sj = searchToJSON(table.search);
+    const vectorColumn = Object.entries(columns).find(([, c]) => c.dimensions !== void 0)?.[0];
+    const sj = searchToJSON(table.search, vectorColumn);
     if (sj.text !== void 0 || sj.vector !== void 0) out.search = sj;
   }
+  if (table.memory !== void 0) {
+    out.memory = memoryToJSON(table.memory);
+  }
   return out;
 }
 function toSchemaJSON(schema) {
@@ -1335,10 +1218,10 @@ function buildChildEdges(schema) {
       const ref = builder._def.references;
       if (ref === void 0) continue;
       if (ref.table === childName) continue;
-      const bucket2 = edges.get(ref.table);
-      if (bucket2 === void 0) continue;
-      if (bucket2.some((e) => e.child === childName)) continue;
-      bucket2.push({ child: childName, column: col });
+      const bucket = edges.get(ref.table);
+      if (bucket === void 0) continue;
+      if (bucket.some((e) => e.child === childName)) continue;
+      bucket.push({ child: childName, column: col });
     }
   }
   return edges;
@@ -1412,638 +1295,50 @@ export {};
 `;
 }
 
-// src/config/storage.ts
-var STORAGE_CONFIG_KIND = "storage";
-var VARIANT_FORMATS = ["webp", "avif", "jpeg", "png"];
-var VARIANT_FITS = ["cover", "contain", "inside"];
-function normalizeVariants(input) {
-  if (input === null || typeof input !== "object" || Array.isArray(input)) {
-    throw new Error("bucket variants must be an object of { <name>: { width?, height?, format? } }");
-  }
-  const out = {};
-  for (const [name, spec] of Object.entries(input)) {
-    if (!/^[a-z0-9][a-z0-9_-]*$/i.test(name)) {
-      throw new Error(
-        `bucket variant name "${name}" must be alphanumeric with optional - or _ (e.g. "thumb", "card_2x")`
-      );
-    }
-    if (spec === null || typeof spec !== "object" || Array.isArray(spec)) {
-      throw new Error(`bucket variant "${name}" must be an object like { width: 100, height: 100 }`);
-    }
-    for (const dim of ["width", "height"]) {
-      const value = spec[dim];
-      if (value === void 0) continue;
-      if (typeof value !== "number" || !Number.isInteger(value) || value <= 0) {
-        throw new Error(`bucket variant "${name}" ${dim} must be a positive integer, got ${String(value)}`);
-      }
-    }
-    if (spec.width === void 0 && spec.height === void 0) {
-      throw new Error(`bucket variant "${name}" must set width and/or height`);
-    }
-    if (spec.format !== void 0 && !VARIANT_FORMATS.includes(spec.format)) {
-      throw new Error(
-        `bucket variant "${name}" format must be one of ${VARIANT_FORMATS.join(", ")}, got "${String(spec.format)}"`
-      );
-    }
-    if (spec.fit !== void 0 && !VARIANT_FITS.includes(spec.fit)) {
-      throw new Error(
-        `bucket variant "${name}" fit must be one of ${VARIANT_FITS.join(", ")}, got "${String(spec.fit)}"`
-      );
-    }
-    if (spec.quality !== void 0) {
-      const q = spec.quality;
-      if (typeof q !== "number" || !Number.isInteger(q) || q < 1 || q > 100) {
-        throw new Error(`bucket variant "${name}" quality must be an integer 1\u2013100, got ${String(q)}`);
-      }
-    }
-    if (spec.fit === "cover" && (spec.width === void 0 || spec.height === void 0)) {
-      throw new Error(`bucket variant "${name}" uses fit "cover", which needs BOTH width and height`);
-    }
-    out[name] = {
-      ...spec.width !== void 0 ? { width: spec.width } : {},
-      ...spec.height !== void 0 ? { height: spec.height } : {},
-      ...spec.fit !== void 0 ? { fit: spec.fit } : {},
-      ...spec.format !== void 0 ? { format: spec.format } : {},
-      ...spec.quality !== void 0 ? { quality: spec.quality } : {}
-    };
-  }
-  return out;
+// src/stack-gen.ts
+function liveNames(names) {
+  return [...new Set(names)].sort();
 }
-var UNIT_BYTES = {
-  b: 1,
-  kb: 1024,
-  mb: 1024 ** 2,
-  gb: 1024 ** 3,
-  tb: 1024 ** 4
-};
-function parseFileSizeLimit(input) {
-  if (typeof input === "number") {
-    if (!Number.isFinite(input) || input < 0 || !Number.isInteger(input)) {
-      throw new Error(
-        `bucket fileSizeLimit must be a non-negative integer number of bytes, got ${input}`
-      );
-    }
-    return input;
-  }
-  const trimmed = input.trim();
-  const match = /^(\d+(?:\.\d+)?)\s*([a-zA-Z]+)?$/.exec(trimmed);
-  if (!match) {
-    throw new Error(
-      `bucket fileSizeLimit string must be "<number><unit>" like "5MB" or "1GB", got "${input}"`
-    );
-  }
-  const value = Number.parseFloat(match[1]);
-  const unit = (match[2] ?? "b").toLowerCase();
-  const multiplier = UNIT_BYTES[unit];
-  if (multiplier === void 0) {
-    throw new Error(
-      `bucket fileSizeLimit has an unknown unit "${match[2]}" \u2014 use B, KB, MB, GB, or TB (e.g. "5MB")`
-    );
-  }
-  const bytes = value * multiplier;
-  if (!Number.isFinite(bytes) || bytes < 0) {
-    throw new Error(`bucket fileSizeLimit resolved to an invalid byte count: ${bytes}`);
-  }
-  return Math.round(bytes);
-}
-var MIME_RE = /^[a-zA-Z0-9][a-zA-Z0-9!#$&^_.+-]*\/(?:\*|[a-zA-Z0-9][a-zA-Z0-9!#$&^_.+-]*)$/;
-function bucket(opts = {}) {
-  const fileSizeLimit = opts.fileSizeLimit === void 0 ? null : parseFileSizeLimit(opts.fileSizeLimit);
-  let allowedMimeTypes = null;
-  if (opts.allowedMimeTypes !== void 0) {
-    if (!Array.isArray(opts.allowedMimeTypes)) {
-      throw new Error("bucket allowedMimeTypes must be an array of MIME-type strings");
-    }
-    for (const mime of opts.allowedMimeTypes) {
-      if (typeof mime !== "string" || !MIME_RE.test(mime.trim())) {
-        throw new Error(
-          `bucket allowedMimeTypes entry "${mime}" is not a valid MIME type (expected "type/subtype", e.g. "image/png")`
-        );
-      }
-    }
-    allowedMimeTypes = [...new Set(opts.allowedMimeTypes.map((m) => m.trim()))];
-  }
-  return {
-    public: opts.public ?? false,
-    fileSizeLimit,
-    allowedMimeTypes,
-    variants: opts.variants === void 0 ? null : normalizeVariants(opts.variants)
-  };
+function memberName(name) {
+  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
 }
-function defineStorage(input) {
-  if (input === null || typeof input !== "object" || typeof input.buckets !== "object") {
-    throw new Error("defineStorage expects { buckets: { <name>: bucket({...}) } }");
-  }
-  const buckets = {};
-  for (const name of Object.keys(input.buckets)) {
-    if (name.length === 0) {
-      throw new Error("bucket name must be a non-empty string");
-    }
-    const def = input.buckets[name];
-    if (def === void 0) continue;
-    buckets[name] = def;
-  }
-  return { __config: STORAGE_CONFIG_KIND, buckets };
+function members(names) {
+  if (names.length === 0) return "";
+  return `
+${names.map((n) => `    ${memberName(n)}: true;`).join("\n")}
+  `;
 }
-
-// src/config/egress.ts
-var EGRESS_CONFIG_KIND = "egress";
-var EGRESS_TIMEOUT_MIN_MS = 1e3;
-var EGRESS_TIMEOUT_MAX_MS = 3e5;
-var EGRESS_TIMEOUT_DEFAULT_MS = 3e4;
-function defineEgress(input) {
-  if (input === null || typeof input !== "object" || !Array.isArray(input.hosts)) {
-    throw new Error("defineEgress expects { hosts: string[] }");
-  }
-  const hosts = [];
-  for (const h of input.hosts) {
-    if (typeof h !== "string" || h.trim().length === 0) {
-      throw new Error("defineEgress: every host must be a non-empty string");
-    }
-    hosts.push(h.trim().toLowerCase());
-  }
-  if (input.timeoutMs === void 0) {
-    return { __config: EGRESS_CONFIG_KIND, hosts };
-  }
-  const timeoutMs = input.timeoutMs;
-  if (typeof timeoutMs !== "number" || !Number.isInteger(timeoutMs)) {
-    throw new Error("defineEgress: timeoutMs must be an integer number of milliseconds");
-  }
-  if (timeoutMs < EGRESS_TIMEOUT_MIN_MS || timeoutMs > EGRESS_TIMEOUT_MAX_MS) {
-    throw new Error(
-      `defineEgress: timeoutMs must be between ${EGRESS_TIMEOUT_MIN_MS} and ${EGRESS_TIMEOUT_MAX_MS} (got ${timeoutMs})`
-    );
-  }
-  return { __config: EGRESS_CONFIG_KIND, hosts, timeoutMs };
+function bucketMembers(buckets) {
+  const normalized = buckets.map((b) => typeof b === "string" ? { name: b, variants: [] } : b);
+  const byName = /* @__PURE__ */ new Map();
+  for (const b of normalized) byName.set(b.name, b.variants);
+  const names = [...byName.keys()].sort();
+  if (names.length === 0) return "";
+  const rows = names.map((name) => {
+    const variants = [...new Set(byName.get(name) ?? [])].sort();
+    const union = variants.length === 0 ? "never" : variants.map((v) => JSON.stringify(v)).join(" | ");
+    return `    ${memberName(name)}: { variants: ${union} };`;
+  });
+  return `
+${rows.join("\n")}
+  `;
 }
+function makeStackDts(names) {
+  const secrets = liveNames(names.secrets);
+  const flags = liveNames(names.flags);
+  return `// palbase-stack.d.ts \u2014 GENERATED by @palbase/backend. Do not edit.
+// Source: the linked environment's stack.
 
-// src/config/notifications.ts
-var NOTIFICATIONS_CONFIG_KIND = "notifications";
-var RESERVED_SECRET_PREFIX = "PB_NOTIFICATIONS";
-var PROVIDER_CATALOG = {
-  apns: {
-    channel: "push",
-    required: ["teamId", "keyId", "bundleId"],
-    optional: ["isProduction"],
-    secrets: ["p8"]
-  },
-  fcm: {
-    channel: "push",
-    required: [],
-    optional: [],
-    secrets: ["serviceAccount"]
-  },
-  sendgrid: {
-    channel: "email",
-    required: ["fromDomain"],
-    optional: [],
-    secrets: ["apiKey"]
-  },
-  ses: {
-    channel: "email",
-    required: ["region", "accessKeyId", "fromDomain"],
-    optional: [],
-    secrets: ["secretAccessKey"]
-  },
-  smtp: {
-    channel: "email",
-    required: ["host", "port", "fromEmail"],
-    optional: ["username", "useStarttls"],
-    secrets: ["password"]
-  },
-  acs: {
-    channel: "email",
-    required: ["fromEmail"],
-    optional: ["fromName"],
-    secrets: ["connectionString"]
-  },
-  twilio: {
-    channel: "sms",
-    // account_sid required; one of from_number / messaging_service_sid required
-    // (enforced by the refine in buildProvider, not by the flat `required` list).
-    required: ["accountSid"],
-    optional: ["fromNumber", "messagingServiceSid"],
-    secrets: ["authToken"]
-  }
-};
-var DEFAULT_TEMPLATE_LOCALE = "en";
-function extractVariables(...sources) {
-  const found = /* @__PURE__ */ new Set();
-  for (const src of sources) {
-    if (!src) continue;
-    for (const match of src.matchAll(/\{\{\{?\s*([^{}]+?)\s*\}?\}\}/g)) {
-      const token = (match[1] ?? "").trim();
-      if (token === "" || "#/^!>&".includes(token.charAt(0)) || token === "else") continue;
-      if (/\s/.test(token)) continue;
-      const root = token.split(".")[0] ?? "";
-      if (root === "" || root === "this" || root.startsWith("@")) continue;
-      found.add(root);
-    }
-  }
-  return [...found].sort();
-}
-function buildEmailTemplate(slug, opts) {
-  const row = (locale, c) => {
-    if (!c.subject) throw new Error(`notifications: email template "${slug}" (${locale}) needs a subject`);
-    if (!c.html) throw new Error(`notifications: email template "${slug}" (${locale}) needs an html body`);
-    const def = {
-      slug,
-      locale,
-      subject: c.subject,
-      html_body: c.html,
-      variables: c.variables ? [...c.variables] : extractVariables(c.subject, c.html, c.text)
-    };
-    if (c.text !== void 0) def.text_body = c.text;
-    return def;
-  };
-  const rows = [row(opts.locale ?? DEFAULT_TEMPLATE_LOCALE, opts)];
-  for (const [locale, content] of Object.entries(opts.locales ?? {})) {
-    rows.push(row(locale, content));
-  }
-  return rows;
-}
-function buildSmsTemplate(slug, opts) {
-  const row = (locale, c) => {
-    if (!c.body) throw new Error(`notifications: sms template "${slug}" (${locale}) needs a body`);
-    return {
-      slug,
-      locale,
-      body: c.body,
-      variables: c.variables ? [...c.variables] : extractVariables(c.body)
-    };
-  };
-  const rows = [row(opts.locale ?? DEFAULT_TEMPLATE_LOCALE, opts)];
-  for (const [locale, content] of Object.entries(opts.locales ?? {})) {
-    rows.push(row(locale, content));
-  }
-  return rows;
-}
-function buildTemplates(input) {
-  const out = { email: [], sms: [] };
-  const seen = /* @__PURE__ */ new Set();
-  const claim = (channel, slug, locale) => {
-    const key = `${channel}/${slug}/${locale}`;
-    if (seen.has(key)) {
-      throw new Error(`notifications: ${channel} template "${slug}" declares locale "${locale}" twice`);
-    }
-    seen.add(key);
-  };
-  for (const [slug, opts] of Object.entries(input.email ?? {})) {
-    for (const row of buildEmailTemplate(slug, opts)) {
-      claim("email", row.slug, row.locale);
-      out.email.push(row);
-    }
-  }
-  for (const [slug, opts] of Object.entries(input.sms ?? {})) {
-    for (const row of buildSmsTemplate(slug, opts)) {
-      claim("sms", row.slug, row.locale);
-      out.sms.push(row);
-    }
-  }
-  return out;
-}
-function buildProvider(name, opts) {
-  const entry = PROVIDER_CATALOG[name];
-  const src = { ...opts };
-  const enabled = src.enabled === void 0 ? false : Boolean(src.enabled);
-  if (!enabled) {
-    return { enabled: false };
-  }
-  const def = { enabled: true };
-  for (const field of entry.required) {
-    const value = src[field];
-    if (value === void 0 || value === null || value === "") {
-      throw new Error(
-        `notifications: provider "${name}" is enabled but missing required field "${field}"`
-      );
-    }
-    def[field] = value;
-  }
-  for (const field of entry.optional) {
-    if (src[field] !== void 0) {
-      def[field] = src[field];
-    }
-  }
-  if (name === "twilio") {
-    const hasFrom = Boolean(def.fromNumber);
-    const hasMsg = Boolean(def.messagingServiceSid);
-    if (!hasFrom && !hasMsg) {
-      throw new Error(
-        'notifications: provider "twilio" requires one of "fromNumber" or "messagingServiceSid"'
-      );
-    }
-  }
-  return def;
-}
-function defineNotifications(input) {
-  if (input === null || typeof input !== "object") {
-    throw new Error("defineNotifications expects { push?, email?, sms? }");
-  }
-  const config = {
-    __config: NOTIFICATIONS_CONFIG_KIND,
-    push: {},
-    email: {},
-    sms: {},
-    templates: buildTemplates(input.templates ?? {})
-  };
-  const push = input.push ?? {};
-  if (push.apns !== void 0) config.push.apns = buildProvider("apns", push.apns);
-  if (push.fcm !== void 0) config.push.fcm = buildProvider("fcm", push.fcm);
-  const email = input.email ?? {};
-  if (email.sendgrid !== void 0) config.email.sendgrid = buildProvider("sendgrid", email.sendgrid);
-  if (email.ses !== void 0) config.email.ses = buildProvider("ses", email.ses);
-  if (email.smtp !== void 0) config.email.smtp = buildProvider("smtp", email.smtp);
-  if (email.acs !== void 0) config.email.acs = buildProvider("acs", email.acs);
-  const sms = input.sms ?? {};
-  if (sms.twilio !== void 0) config.sms.twilio = buildProvider("twilio", sms.twilio);
-  return config;
-}
-function reservedSecretKey(provider, secretField) {
-  return `${RESERVED_SECRET_PREFIX}_${camelToUpperSnake(provider)}_${camelToUpperSnake(secretField)}`;
-}
-function camelToUpperSnake(s) {
-  return s.replace(/([a-z0-9])([A-Z])/g, "$1_$2").toUpperCase();
-}
+declare module "@palbase/backend/stack" {
+  interface Secrets {${members(secrets)}}
 
-// src/config/test-users.ts
-var TEST_USERS_CONFIG_KIND = "test-users";
-var TEST_USER_NAME_RE = /^[a-zA-Z][a-zA-Z0-9_]*$/;
-var EMAIL_RE = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
-var E164_RE = /^\+[1-9]\d{1,14}$/;
-var OTP_LENGTH = 6;
-var OTP_RE = /^\d{6}$/;
-var MIN_PASSWORD_LENGTH = 8;
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-function normalizeSeed(seed, userName) {
-  if (seed === void 0) return {};
-  if (!isPlainObject(seed)) {
-    throw new Error(`testUser ${JSON.stringify(userName)}: seed must be { <table>: [ {...} ] }`);
-  }
-  const out = {};
-  for (const [table, rows] of Object.entries(seed)) {
-    if (!Array.isArray(rows)) {
-      throw new Error(
-        `testUser ${JSON.stringify(userName)}: seed.${table} must be an array of rows`
-      );
-    }
-    if (rows.length === 0) {
-      throw new Error(
-        `testUser ${JSON.stringify(userName)}: seed.${table} is empty \u2014 remove it or add a row`
-      );
-    }
-    for (const row of rows) {
-      if (!isPlainObject(row)) {
-        throw new Error(
-          `testUser ${JSON.stringify(userName)}: every row in seed.${table} must be an object`
-        );
-      }
-    }
-    out[table] = rows;
-  }
-  return out;
-}
-function testUser(opts = {}) {
-  if (!isPlainObject(opts)) {
-    throw new Error("testUser() expects { email?, password?, phone?, otp?, seed? }");
-  }
-  const hasEmail = opts.email !== void 0;
-  const hasPassword = opts.password !== void 0;
-  if (hasEmail !== hasPassword) {
-    throw new Error(
-      "testUser() needs email AND password together (a fixture with stable credentials) or neither (a template the server generates credentials for)"
-    );
-  }
-  let email = null;
-  let password = null;
-  if (hasEmail) {
-    if (typeof opts.email !== "string" || !EMAIL_RE.test(opts.email)) {
-      throw new Error(`testUser email ${JSON.stringify(opts.email)} is not a valid address`);
-    }
-    if (typeof opts.password !== "string" || opts.password.length < MIN_PASSWORD_LENGTH) {
-      throw new Error(
-        `testUser password must be at least ${MIN_PASSWORD_LENGTH} characters (got ${typeof opts.password === "string" ? opts.password.length : 0})`
-      );
-    }
-    email = opts.email;
-    password = opts.password;
-  }
-  const hasPhone = opts.phone !== void 0;
-  const hasOTP = opts.otp !== void 0;
-  if (hasPhone !== hasOTP) {
-    throw new Error(
-      "testUser() needs phone AND otp together \u2014 nothing can receive an SMS at a fabricated number, so a phone fixture without its fixed code can never be signed in as"
-    );
-  }
-  let phone = null;
-  let otp = null;
-  if (hasPhone) {
-    if (typeof opts.phone !== "string" || !E164_RE.test(opts.phone)) {
-      throw new Error(
-        `testUser phone ${JSON.stringify(opts.phone)} must be E.164, e.g. "+905551112233"`
-      );
-    }
-    if (typeof opts.otp !== "string" || !OTP_RE.test(opts.otp)) {
-      throw new Error(
-        `testUser otp ${JSON.stringify(opts.otp)} must be ${OTP_LENGTH} digits`
-      );
-    }
-    phone = opts.phone;
-    otp = opts.otp;
-  }
-  return { email, password, phone, otp, seed: normalizeSeed(opts.seed, email ?? "<template>") };
-}
-function defineTestUsers(input) {
-  if (!isPlainObject(input) || !isPlainObject(input.users)) {
-    throw new Error("defineTestUsers expects { users: { <name>: testUser({...}) } }");
-  }
-  const users = {};
-  const emails = /* @__PURE__ */ new Map();
-  for (const name of Object.keys(input.users)) {
-    if (!TEST_USER_NAME_RE.test(name)) {
-      throw new Error(
-        `test user name ${JSON.stringify(name)} is invalid \u2014 must start with a letter and contain only letters, digits, and underscores`
-      );
-    }
-    const def = input.users[name];
-    if (def === void 0) continue;
-    if (def.email !== null) {
-      const lower = def.email.toLowerCase();
-      const already = emails.get(lower);
-      if (already !== void 0) {
-        throw new Error(
-          `test users ${JSON.stringify(already)} and ${JSON.stringify(name)} declare the same e-mail ${JSON.stringify(def.email)}`
-        );
-      }
-      emails.set(lower, name);
-    }
-    users[name] = def;
-  }
-  return { __config: TEST_USERS_CONFIG_KIND, users };
-}
+  interface Flags {${members(flags)}}
 
-// src/config/flags.ts
-var FLAGS_CONFIG_KIND = "flags";
-var FLAG_KEY_RE = /^[a-zA-Z][a-zA-Z0-9_]*$/;
-function valueMatchesType(type, value) {
-  switch (type) {
-    case "boolean":
-      return typeof value === "boolean";
-    case "number":
-      return typeof value === "number" && Number.isFinite(value);
-    case "string":
-      return typeof value === "string";
-    case "json":
-      return typeof value === "object" && value !== null && !Array.isArray(value);
-  }
-}
-function flag(opts) {
-  if (opts === null || typeof opts !== "object") {
-    throw new Error("flag() expects { type, default, variants?, description? }");
-  }
-  const { type } = opts;
-  if (type !== "boolean" && type !== "number" && type !== "string" && type !== "json") {
-    throw new Error(`flag type must be "boolean", "number", "string", or "json", got ${JSON.stringify(type)}`);
-  }
-  if (!valueMatchesType(type, opts.default)) {
-    throw new Error(
-      `flag default ${JSON.stringify(opts.default)} does not match type "${type}"`
-    );
-  }
-  let variants = null;
-  if (opts.variants !== void 0) {
-    if (opts.type !== "string") {
-      throw new Error(`flag variants are only valid for type "string" (got type "${type}")`);
-    }
-    if (!Array.isArray(opts.variants)) {
-      throw new Error("flag variants must be an array of strings");
-    }
-    for (const v of opts.variants) {
-      if (typeof v !== "string" || v.length === 0) {
-        throw new Error(`flag variant ${JSON.stringify(v)} must be a non-empty string`);
-      }
-    }
-    variants = [...new Set(opts.variants)];
-    if (variants.length === 0) {
-      throw new Error("flag variants must be a non-empty list when supplied");
-    }
-    if (!variants.includes(opts.default)) {
-      throw new Error(
-        `flag default ${JSON.stringify(opts.default)} is not one of its variants [${variants.map((v) => JSON.stringify(v)).join(", ")}]`
-      );
-    }
-  }
-  let conditions = null;
-  if (opts.conditions !== void 0) {
-    if (!Array.isArray(opts.conditions)) {
-      throw new Error("flag conditions must be an array of { when, value }");
-    }
-    const compiled = [];
-    for (const [i, branch] of opts.conditions.entries()) {
-      if (branch === null || typeof branch !== "object") {
-        throw new Error(`flag condition ${i} must be an object { when, value }`);
-      }
-      if (typeof branch.when !== "string" || branch.when.trim().length === 0) {
-        throw new Error(`flag condition ${i} needs a non-empty "when" expression`);
-      }
-      if (!valueMatchesType(type, branch.value)) {
-        throw new Error(
-          `flag condition ${i} value ${JSON.stringify(branch.value)} does not match type "${type}"`
-        );
-      }
-      if (variants !== null && !variants.includes(branch.value)) {
-        throw new Error(
-          `flag condition ${i} value ${JSON.stringify(branch.value)} is not one of its variants [${variants.map((v) => JSON.stringify(v)).join(", ")}]`
-        );
-      }
-      compiled.push({ when: branch.when.trim(), value: branch.value });
-    }
-    conditions = compiled.length > 0 ? compiled : null;
-  }
-  let description = null;
-  if (opts.description !== void 0) {
-    if (typeof opts.description !== "string") {
-      throw new Error("flag description must be a string");
-    }
-    const trimmed = opts.description.trim();
-    description = trimmed.length > 0 ? trimmed : null;
-  }
-  return {
-    type,
-    default: opts.default,
-    variants,
-    conditions,
-    description
-  };
-}
-function defineFlags(input) {
-  if (input === null || typeof input !== "object" || typeof input.flags !== "object") {
-    throw new Error("defineFlags expects { flags: { <key>: flag({...}) } }");
-  }
-  const flags = {};
-  for (const key of Object.keys(input.flags)) {
-    if (!FLAG_KEY_RE.test(key)) {
-      throw new Error(
-        `flag key ${JSON.stringify(key)} is invalid \u2014 must start with a letter and contain only letters, digits, and underscores`
-      );
-    }
-    const def = input.flags[key];
-    if (def === void 0) continue;
-    flags[key] = def;
-  }
-  return { __config: FLAGS_CONFIG_KIND, flags };
+  interface Buckets {${bucketMembers(names.buckets)}}
 }
 
-// src/config/secrets.ts
-var SECRETS_CONFIG_KIND = "secrets";
-var SECRET_NAME_RE = /^[A-Z][A-Z0-9_]*$/;
-function secret(name, opts = {}) {
-  if (typeof name !== "string" || !SECRET_NAME_RE.test(name)) {
-    throw new Error(
-      `secret name ${JSON.stringify(name)} is invalid \u2014 must be an environment-variable name: an uppercase letter, then uppercase letters, digits, and underscores (e.g. "NEO4J_PASSWORD")`
-    );
-  }
-  if (opts === null || typeof opts !== "object") {
-    throw new Error(`secret("${name}") expects { required?, description? }`);
-  }
-  let required = true;
-  if (opts.required !== void 0) {
-    if (typeof opts.required !== "boolean") {
-      throw new Error(`secret("${name}") required must be a boolean`);
-    }
-    required = opts.required;
-  }
-  let description = null;
-  if (opts.description !== void 0) {
-    if (typeof opts.description !== "string") {
-      throw new Error(`secret("${name}") description must be a string`);
-    }
-    const trimmed = opts.description.trim();
-    description = trimmed.length > 0 ? trimmed : null;
-  }
-  return { name, required, description };
-}
-function defineSecrets(input) {
-  if (input === null || typeof input !== "object" || !Array.isArray(input.secrets)) {
-    throw new Error('defineSecrets expects { secrets: [secret("NAME"), ...] }');
-  }
-  const byName = /* @__PURE__ */ new Map();
-  for (const def of input.secrets) {
-    if (def === null || typeof def !== "object" || typeof def.name !== "string" || typeof def.required !== "boolean") {
-      throw new Error(
-        `defineSecrets: every entry must come from secret() \u2014 got ${JSON.stringify(def)}`
-      );
-    }
-    if (byName.has(def.name)) {
-      throw new Error(
-        `secret "${def.name}" is declared twice in config/secrets.ts \u2014 remove one; a name has exactly one requirement`
-      );
-    }
-    byName.set(def.name, def);
-  }
-  const secrets = [...byName.values()].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-  return { __config: SECRETS_CONFIG_KIND, secrets };
+export {};
+`;
 }
 
 // src/decorators/methods.ts
@@ -2240,21 +1535,36 @@ function validateUploadConfigShape(c) {
   if (c === null || typeof c !== "object") {
     throw new Error("@Upload config must be an object { bucket, pathTemplate, ... }");
   }
-  if (typeof c.bucket !== "string" || c.bucket.length === 0) {
+  const bucket = c.bucket;
+  if (typeof bucket !== "string" || bucket.length === 0) {
     throw new Error("@Upload config.bucket must be a non-empty bucket name");
   }
   if (typeof c.pathTemplate !== "string" || c.pathTemplate.length === 0) {
     throw new Error("@Upload config.pathTemplate must be a non-empty key template");
   }
 }
-function validateUploadAgainstStorage(uploadConfig, storage, routeLabel) {
-  const def = storage.buckets[uploadConfig.bucket];
-  if (def === void 0) {
-    const known = Object.keys(storage.buckets);
-    throw new Error(
-      `@Upload route ${routeLabel} targets bucket "${uploadConfig.bucket}" which is not declared in defineStorage(...). ` + (known.length ? `Known buckets: ${known.join(", ")}.` : "No buckets are declared.")
-    );
-  }
+
+// src/decorators/sse.ts
+function Sse(subpath = "", config) {
+  const { auth, rateLimit, ...sseConfig } = config;
+  const options = {
+    sseConfig,
+    ...auth !== void 0 ? { auth } : {},
+    ...rateLimit !== void 0 ? { rateLimit } : {}
+  };
+  return function(target, propertyKey) {
+    recordRoute(target, String(propertyKey), "POST", subpath, options);
+  };
+}
+function SseOut() {
+  return function(target, propertyKey, parameterIndex) {
+    recordParam(target, String(propertyKey), { index: parameterIndex, kind: "sseOut" });
+  };
+}
+function Signal() {
+  return function(target, propertyKey, parameterIndex) {
+    recordParam(target, String(propertyKey), { index: parameterIndex, kind: "signal" });
+  };
 }
 
 // src/decorators/params.ts
@@ -2431,52 +1741,6 @@ function getJobConfig(ctor) {
   return { schedule: meta.schedule, timeout, retry, handler: run };
 }
 
-// src/resource.ts
-var Resource = class {
-  /** The env-var names this resource needs. Optional; omit for none. */
-  static secrets;
-};
-function hasSecrets(value) {
-  if (typeof value !== "object" && typeof value !== "function") return false;
-  const secrets = value.secrets;
-  return secrets === void 0 || Array.isArray(secrets);
-}
-var registry = [];
-function __registerResource(resource) {
-  registry.push({ resource, booted: false });
-}
-function declaredSecrets(resource) {
-  const ctor = resource.constructor;
-  return hasSecrets(ctor) ? ctor.secrets ?? [] : [];
-}
-async function __runResourceBoot(envMap) {
-  for (const entry of registry) {
-    if (entry.booted) continue;
-    const secrets = declaredSecrets(entry.resource);
-    const env = {};
-    for (const name of secrets) {
-      const value = envMap[name];
-      if (value === void 0) {
-        throw new Error(
-          `Resource ${entry.resource.constructor.name} requires secret "${name}" but it is not set. Set it with \`palbase secret set ${name} ...\` (or in Studio) and redeploy.`
-        );
-      }
-      env[name] = value;
-    }
-    await entry.resource.init(env);
-    entry.booted = true;
-  }
-}
-async function __shutdownResources() {
-  for (let i = registry.length - 1; i >= 0; i -= 1) {
-    const entry = registry[i];
-    if (entry.booted && entry.resource.shutdown) {
-      await entry.resource.shutdown();
-    }
-  }
-  registry.length = 0;
-}
-
 // src/index.ts
 import { z } from "zod";
 export {
@@ -2486,17 +1750,11 @@ export {
   Client,
   Conflict,
   Controller,
-  DEFAULT_TEMPLATE_LOCALE,
   Database,
   Delete,
   Deny,
   Documents,
-  EGRESS_CONFIG_KIND,
-  EGRESS_TIMEOUT_DEFAULT_MS,
-  EGRESS_TIMEOUT_MAX_MS,
-  EGRESS_TIMEOUT_MIN_MS,
   EXTENSION_DEPENDENCIES,
-  FLAGS_CONFIG_KIND,
   Flags,
   Forbidden,
   Get,
@@ -2505,35 +1763,28 @@ export {
   HttpError,
   Job,
   Log,
-  NOTIFICATIONS_CONFIG_KIND,
   NotFound,
   Notifications,
   On,
   OptionalUser,
   PALBASE_EXTENSIONS,
-  PROVIDER_CATALOG,
   PalError,
   PalbaseModuleError,
   Param,
   Patch,
   PolicyBuilder,
   Post,
-  Purchases,
   Put,
   Query,
   QueryParams,
-  RESERVED_SECRET_PREFIX,
   Realtime,
   Req,
   RequestId,
-  RequireEntitlement,
-  Resource,
-  SECRETS_CONFIG_KIND,
-  STORAGE_CONFIG_KIND,
   Secrets,
-  Spend,
+  Signal,
+  Sse,
+  SseOut,
   Storage,
-  TEST_USERS_CONFIG_KIND,
   TooManyRequests,
   TraceId,
   TxPlanError,
@@ -2544,33 +1795,19 @@ export {
   User,
   Webhook,
   __getRuntime,
-  __registerResource,
   __requestALS,
   __resetRegisteredControllers,
-  __runResourceBoot,
   __runWithRuntime,
   __setRuntime,
-  __shutdownResources,
   bigint,
   boolean,
-  bucket,
   buildModuleClients,
-  buildProvider,
   dec,
   defineChannels,
-  defineEgress,
   defineError,
-  defineFlags,
   defineMiddleware,
-  defineNotifications,
   defineSchema,
-  defineSecrets,
-  defineStorage,
-  defineTestUsers,
-  entitlementFor,
   enumType,
-  extractVariables,
-  flag,
   getErrorRegistry,
   getHookConfig,
   getJobConfig,
@@ -2583,26 +1820,20 @@ export {
   jsonb,
   makeEnvDts,
   makeHttpClient,
-  makePurchasesDts,
+  makeStackDts,
   makeTypedDB,
   now,
   numeric,
   openai,
   ownerOnly,
-  parseFileSizeLimit,
   policy,
   publicChannel,
   raw,
   recordThrows,
-  reservedSecretKey,
-  secret,
-  spendFor,
-  testUser,
   text,
   timestamp,
   toSchemaJSON,
   uuid,
-  validateUploadAgainstStorage,
   vector,
   z
 };