@palbase/backend 25.1.0 → 27.1.0

package/dist/endpoint-DYHMo6cC.d.cts

@@ -1,2386 +0,0 @@
-import { ZodSchema, z } from 'zod';
-import { PalbaseFlagKey, PalbaseSecretName } from './stack.cjs';
-
-/** Supported HTTP methods for endpoints. */
-type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-/**
- * Verified device claim, minted at the platform attestation boundary (App
- * Attest / Play Integrity). Server-owned and immutable: it is populated ONLY
- * from a successful, request-bound verification — never from a raw client
- * header or from user/JWT metadata.
- */
-interface VerifiedDevice {
-    /** Server-minted `auth.installations` anchor (`ins_…`); may be "" until the installation binding is wired at the verify boundary. */
-    installationId: string;
-    /** Palauth device record (`dev_…`) proven by the App Attest assertion. Absent on the Android integrity path. */
-    authDeviceId?: string;
-    platform: "ios" | "android" | "web";
-    /** Proven verification tier — never a string-matched or header-asserted value. */
-    assurance: "attested" | "app_integrity" | "registered";
-}
-/** Authenticated user attached to the request context. */
-interface User {
-    id: string;
-    /** User's email, if they signed up with one (absent for phone-only users). */
-    email?: string;
-    /**
-     * Whether that email address has been confirmed.
-     *
-     * Server-resolved from the verified user profile, not read from the JWT: a
-     * token claim is only true as of when the token was minted, so a user who
-     * verifies mid-session would keep reporting `false` until it expired.
-     *
-     * `false` for a phone-only user (no address to confirm) and for any user who
-     * has not clicked through yet. Before this field existed, answering "is this
-     * address confirmed" in a handler cost an extra network round-trip PER
-     * REQUEST for one boolean the runtime already had.
-     */
-    emailVerified: boolean;
-    role: string;
-    metadata: Record<string, unknown>;
-    /**
-     * Reserved, server-owned verified device claim. `null` on an authenticated
-     * request with no verified device. The context assembler is the sole writer;
-     * user/JWT metadata can never populate it.
-     */
-    device: VerifiedDevice | null;
-}
-/** Authentication configuration for an endpoint. */
-interface AuthConfig {
-    /** Whether authentication is required. Defaults to true. */
-    required: boolean;
-    /** Required role for access. If undefined, any authenticated user is allowed.
-     *
-     * Matched against the caller's `metadata.role` — NOT `user.role`, which is the
-     * database role RLS reads and is always "authenticated" for a signed-in user.
-     * Not signed in → 401; signed in with a different or missing role → 403. */
-    role?: string;
-    /** Require a confirmed email address. An unverified caller gets 403
-     * `email_not_verified`. Fences a whole controller; for a partial rule read
-     * `user.emailVerified` in the handler instead. */
-    verifiedEmail?: boolean;
-}
-
-/** Middleware context — subset of EndpointContext without input (not yet validated). */
-interface MiddlewareContext extends PalbaseModuleClients {
-    params: Record<string, string>;
-    query: Record<string, string>;
-    headers: Record<string, string>;
-    user: User | null;
-    db: DBClient;
-    env: Record<string, string>;
-    log: Logger;
-    cache: CacheClient;
-    requestId: string;
-    environmentId: string;
-}
-/** Middleware function signature — receives context and next function. */
-type MiddlewareHandler = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise<void>;
-/**
- * REMOVED IN BEHAVIOUR, KEPT IN NAME.
- *
- * There is no middleware pipeline in this runtime. No bundler reads a
- * `middleware/` directory, the engine never calls a handler defined here, and
- * measured on 2026-08-31 this function had no caller anywhere in the runtime or
- * the CLI. It returned its argument unchanged, so code written against it
- * compiled, deployed, and then never ran — with nothing reporting that.
- *
- * A silent shell is the worst version of a retired feature: it lets a user (or a
- * coding assistant, which is how this surfaced) ship a request logger, an auth
- * check or a rate limiter that simply does not exist in production. So the call
- * refuses, and says where the work belongs.
- *
- * The SYMBOL survives because removing a published export costs a major and
- * 25.0.1 had just shipped. Deleting it is a proposal for the next one; the types
- * below stay either way, so a file that only annotates with them still compiles.
- *
- * This is the shape the SDK already uses for a retired surface: `@Query(schema)`
- * on a parameter throws at decoration time with a message naming its
- * replacement.
- */
-declare function defineMiddleware(_fn: MiddlewareHandler): never;
-
-/**
- * tx-plan.ts — `Database.transaction()` as a PLAN, not a pinned session.
- *
- * A transaction used to be a conversation: BEGIN, then one network round trip
- * per operation, then COMMIT. Each of those round trips cost ~4 ms and, because
- * the pooler runs in transaction mode, an open transaction pinned a Postgres
- * backend for the whole conversation. A 121-operation statement upload pinned
- * one backend for ~490 ms.
- *
- * So the callback no longer TALKS to the database. It DESCRIBES what should
- * happen; the description is serialised and sent once; the broker runs the whole
- * thing inside one transaction and answers once. Committing on return and
- * rolling back on throw is unchanged — that is the only property tenant code
- * actually asked for.
- *
- * The consequences, stated plainly, because they are the whole design:
- *
- *   - The callback is SYNCHRONOUS. There is nothing to await: no statement has
- *     run yet when it returns. `async` on the callback and `await` inside it are
- *     both compile errors (see {@link TxPlan} and {@link NotAwaitable}).
- *   - `insert()` does not hand back a row, it hands back {@link TxRows}. Reading
- *     a field requires `.expectOne(err)` first, which makes "what if the row
- *     isn't there" a question you cannot route around: it is the argument.
- *   - A field read from a row is a {@link Ref} — a PROMISE OF A VALUE THE SERVER
- *     WILL PRODUCE, not the value. It can be written into a later operation and
- *     it can be returned from the callback (it is substituted for the real value
- *     before `transaction()` resolves). It cannot be branched on. See the
- *     "Truthiness" note below — this is the sharp edge of the whole design.
- *   - Control flow that needs a real value must move OUT of the callback: read
- *     before the transaction, or express the condition as a guard
- *     (`updateWhere({ id, accepted_at: null }, …).expectOne(new Conflict(…))`)
- *     which the server evaluates and which rolls the whole plan back.
- *
- * # Truthiness — the hole this file CANNOT close
- *
- * JavaScript does not let a Proxy trap truthiness. `if (ref)` takes the true
- * branch, always, for every Ref, and no `get` handler ever runs. `tsc` is silent
- * because a Ref is a perfectly good object. So:
- *
- *     const pot = tx.tables.pots.select({ id }, { limit: 1 }).expectOne(e);
- *     if (!pot.balance) { … }        // ← ALWAYS false. Silently wrong data.
- *
- * What this file does close: coercion (`Symbol.toPrimitive`/`valueOf`/
- * `toString`), awaiting (`then` is a callable member with a non-thenable
- * signature, which is a *compile* error), serialisation (`toJSON`), and nesting
- * a Ref inside a literal value where the server would store it as data. What it
- * cannot close is a bare truthiness test. The real defence is the build-time
- * static analysis (`tx_analysis.js`, phase P4); until that ships, this hole is
- * open and this comment is the only warning.
- *
- * # Wire contract
- *
- * The JSON this file emits is consumed by
- * the plan executor in `engine/db.ts`. That executor rejects
- * unknown fields at every level, so an op carries EXACTLY the fields its kind
- * takes. Everything here that looks like a needless restriction is one of the
- * server's rules made visible early:
- *
- *   - `$ref` only points BACKWARDS, and only at an op statically known to yield
- *     at most one row (insert, or a `one`/`atMost 1` guard, or `select limit 1`).
- *     `.expectOne()` is what this file uses to satisfy that, always.
- *   - `$expr` is a closed set: `inc`/`dec` (update only — they read the column's
- *     current value) and `now()`.
- *   - `update`/`delete` require a `where`; `insert` refuses one.
- *   - `insertMany` rows must all set the same columns.
- *   - ≤1000 ops, ≤5000 rows per insertMany, ≤8 MiB of JSON.
- *
- * Column keys are emitted SORTED, so the same callback always produces byte-
- * identical JSON. That is what lets the Go decoder be locked to golden files
- * this SDK emits (`testdata/tx_plan_golden/`).
- */
-/**
- * A plan handle was used as if it were a value: awaited, coerced to a string or
- * number, serialised, or nested inside another value.
- *
- * Thrown while the callback is still BUILDING the plan, so nothing has been sent
- * and nothing has been written.
- */
-declare class TxRefError extends Error {
-    constructor(message: string);
-}
-/**
- * The plan the callback described cannot be sent: it breaks a rule the server
- * would reject, and rejecting it here names the line that wrote it instead of
- * returning a 400 about an op index.
- */
-declare class TxPlanError extends Error {
-    constructor(message: string);
-}
-/** A backwards reference to an earlier op's single-row result. */
-interface TxWireRef {
-    $ref: {
-        op: number;
-        field: string;
-    };
-}
-/** A call from the server's closed function set. */
-interface TxWireExpr {
-    $expr: {
-        fn: "inc" | "dec";
-        by: number;
-    } | {
-        fn: "now";
-    };
-}
-/** One value in a `values`/`set`/`where` map: a literal, a `$ref` or a `$expr`. */
-type TxWireValue = TxWireRef | TxWireExpr | unknown;
-/** The tenant's declared expectation about an op's row count. `slot` indexes the
- * client-side error table — the error OBJECT never travels. */
-interface TxWireGuard {
-    kind: "one" | "none" | "atLeast" | "atMost";
-    n: number;
-    slot: number;
-}
-/** One operation in the wire plan. Fields are omitted, never null: the decoder
- * rejects a field that does not belong to the op's kind. */
-interface TxWireOp {
-    /** upsert and insertMany: the columns Postgres matches on. */
-    onConflict?: readonly string[];
-    /** insertMany only: what a collision does. Absent means no ON CONFLICT clause
-     * at all, which is what every insertMany did before this option existed. */
-    action?: "ignore" | "update";
-    op: "insert" | "insertMany" | "upsert" | "update" | "delete" | "select";
-    table: string;
-    values?: Record<string, TxWireValue>;
-    rows?: Record<string, TxWireValue>[];
-    set?: Record<string, TxWireValue>;
-    where?: Record<string, TxWireValue>;
-    limit?: number;
-    lock?: "update";
-    guard?: TxWireGuard;
-}
-/** The plan the engine executes on the request's own transaction. */
-interface TxPlanBody {
-    ops: TxWireOp[];
-}
-/** One op's outcome, positionally matched to the plan's ops. */
-interface TxPlanOpResult {
-    rows: Record<string, unknown>[];
-    rows_affected: number;
-}
-/** One result per op, in plan order. */
-interface TxPlanResponse {
-    results: TxPlanOpResult[];
-}
-/**
- * The fields the runtime must copy from the broker's error envelope onto the
- * rejection it throws out of {@link DBClient.txPlan}.
- *
- * `slot` is the whole point: on a guard failure the server answers with the
- * INDEX of the expectation that did not hold, never with an error message of its
- * own, and this SDK maps that index back to the `Error` the callback handed to
- * `.expectOne(…)`. Without `slot` a guard failure degrades to a generic 409.
- */
-interface TxPlanRejection {
-    status?: number;
-    /** `tx_plan_invalid` | `tx_guard_failed` | `tx_ref_unresolved` | a pg class. */
-    error_code?: string;
-    /** Present only for `tx_guard_failed`: the client-side error table index. */
-    slot?: number;
-    /** Present on a database error: which op failed. */
-    op?: number;
-}
-declare const refBrand: unique symbol;
-declare const rowBrand: unique symbol;
-declare const rowsBrand: unique symbol;
-/**
- * Makes a handle a compile error to `await`.
- *
- * `then` is declared as a CALLABLE member whose signature is not `PromiseLike`,
- * which is precisely the shape TypeScript rejects: `await handle` is TS1320 and
- * `async () => handle` is TS1058. A non-callable `then` would not do it — the
- * compiler simply ignores those.
- */
-interface NotAwaitable {
-    /** Not a promise. Nothing here has run yet; there is nothing to await. */
-    then(doNotAwaitAPlanHandle: "a transaction plan is built synchronously"): never;
-}
-/**
- * A value the SERVER will produce, standing in for a column of a row this plan
- * writes or reads.
- *
- * Legal uses: write it into a later operation's `values`/`set`/`where`, or
- * return it from the callback (it is replaced by the real value before
- * `transaction()` resolves).
- *
- * Illegal, and caught: `await`, `String(ref)`, `` `${ref}` ``, `ref + 1`,
- * `JSON.stringify(ref)`, burying it inside a jsonb object.
- *
- * Illegal, and NOT caught: `if (ref)`. See the truthiness note at the top.
- */
-interface Ref<T> extends NotAwaitable {
-    readonly [refBrand]: T;
-}
-/** The brand carried by a single-row handle, and the seam `Materialized` reads
- * to turn `return st` into the whole row. */
-interface TxRowHandle<Row> extends NotAwaitable {
-    readonly [rowBrand]: Row;
-}
-/**
- * A row this plan is known to produce exactly one of. Every property is a
- * {@link Ref}; returning the handle itself yields the whole row.
- *
- * Only `.expectOne(err)` produces one — which is the design: a row you can read
- * fields from is a row whose absence you have already answered for.
- */
-type TxRow<Row> = {
-    readonly [K in keyof Row]: Ref<Row[K]>;
-} & TxRowHandle<Row>;
-/**
- * The result of one operation, before any expectation is declared about it.
- *
- * Deliberately not a row and not a list: an operation's row count is not known
- * until the server runs it, so the only thing that can be said about it here is
- * an EXPECTATION. Declaring one is also the only way to get a readable row.
- *
- * At most one expectation per operation — the wire carries one guard per op, and
- * a second call throws rather than silently dropping the first.
- */
-interface TxRows<Row> extends NotAwaitable {
-    readonly [rowsBrand]: Row;
-    /**
-     * Require exactly one row, and read it. On any other count the server rolls
-     * the whole transaction back and this `error` is thrown to the caller.
-     *
-     * This is the only way to reach a row's fields, and the only shape a `$ref`
-     * may point at.
-     */
-    expectOne(error: Error): TxRow<Row>;
-    /** Require zero rows (e.g. "this membership must not already exist"). */
-    expectNone(error: Error): void;
-    /** Require at least `n` rows. */
-    expectAtLeast(n: number, error: Error): void;
-    /** Require at most `n` rows. */
-    expectAtMost(n: number, error: Error): void;
-}
-/** `now()` — the server's clock, usable wherever a value is. */
-interface TxNow extends NotAwaitable {
-    readonly $expr: {
-        fn: "now";
-    };
-}
-/** `inc(n)` / `dec(n)` — read the column's CURRENT value and write it back
- * changed. Only meaningful in an update's `set`, which is where the types allow
- * it and where the server allows it. */
-interface TxColumnExpr extends NotAwaitable {
-    readonly $expr: {
-        fn: "inc" | "dec";
-        by: number;
-    };
-}
-/**
- * Resolve a callback's return type against what actually comes back: every
- * {@link Ref} becomes its value, every {@link TxRow} becomes its row, and
- * anything else keeps its shape.
- *
- * A {@link TxRows} resolves to an explanatory string type rather than a row
- * list: it has no single answer to give, and saying so in the type is louder
- * than a runtime throw.
- */
-type Materialized<T> = T extends Ref<infer U> ? U : T extends TxRowHandle<infer R> ? R : T extends TxRows<unknown> ? "a TxRows cannot leave the transaction callback — read a row with .expectOne(err) first" : T extends Date ? T : T extends object ? {
-    [K in keyof T]: Materialized<T[K]>;
-} : T;
-/** A value written by an INSERT: a literal, an earlier row's field, or `now()`.
- * `inc`/`dec` are absent on purpose — they read a current value, and an inserted
- * row has none. */
-type TxInsertValue<V> = V | Ref<V> | TxNow;
-/** A value written by an UPDATE's `set`: everything an insert takes, plus the
- * read-modify-write expressions. */
-type TxSetValue<V> = V | Ref<V> | TxNow | TxColumnExpr;
-/** An insert payload: the table's insert shape, with refs and `now()` allowed. */
-type TxInsertShape<Insert> = {
-    [K in keyof Insert]: TxInsertValue<Insert[K]>;
-};
-/** An update's `set`: any subset of the insert shape, with expressions allowed. */
-type TxSetShape<Insert> = {
-    [K in keyof Insert]?: TxSetValue<Insert[K]>;
-};
-/**
- * A filter. Every entry is an equality test and they are AND-ed; a `null`
- * becomes `IS NULL`, which is what makes `{ accepted_at: null }` a usable
- * "not yet accepted" guard rather than a clause that matches nothing.
- */
-type TxWhere<Row> = {
-    [K in keyof Row]?: Row[K] | Ref<Row[K]>;
-};
-/** Options for a plan `select`. */
-interface TxSelectOptions {
-    /** Cap the rows read. */
-    limit?: number;
-    /** Take a real `FOR UPDATE` row lock for the rest of the transaction. */
-    lock?: "update";
-}
-/** One table, as the plan sees it. */
-interface TxTable<Row, Insert> {
-    /** Insert one row. Returns a handle — call `.expectOne(err)` to read fields. */
-    insert(values: TxInsertShape<Insert>): TxRows<Row>;
-    /**
-     * Insert many rows in ONE statement. Every row must set the same columns
-     * (a row that omits one would silently take the column's default).
-     *
-     * An empty list writes nothing and sends nothing.
-     */
-    /**
-     * Insert many rows in ONE statement, optionally choosing what a collision does.
-     *
-     * Without `opts` this is a plain multi-row INSERT and a collision aborts the
-     * transaction — the behaviour every call had before the option existed.
-     *
-     * `action: "ignore"` emits `ON CONFLICT DO NOTHING`, which is how "insert the
-     * ones that are new" becomes one round-trip instead of one per row with a
-     * 23505 caught around each. **The returned rows are the ones actually
-     * INSERTED**: a row that collided is skipped, so it is absent from the result
-     * — Postgres does not return what it did not write.
-     *
-     * `action: "update"` emits `ON CONFLICT DO UPDATE`, setting every non-conflict
-     * column from the incoming row, and every row comes back.
-     */
-    insertMany(rows: readonly TxInsertShape<Insert>[], opts?: {
-        onConflict: readonly Extract<keyof Row, string>[];
-        action?: "ignore" | "update";
-    }): TxRows<Row>;
-    /**
-     * Insert the row, or update it when it collides on `onConflict` — inside the
-     * plan's savepoint, with the same meaning `tables.<t>.upsert()` has outside it.
-     *
-     * It is an operation because the alternative is not writable here: a failed
-     * insert aborts the whole transaction, so "try, then fall back" cannot be two
-     * plan steps.
-     */
-    upsert(values: TxInsertShape<Insert>, options: {
-        onConflict: readonly Extract<keyof Row, string>[];
-    }): TxRows<Row>;
-    /**
-     * Update every row matching `where`. The filter comes first because it is the
-     * dangerous half: an update whose `where` you got wrong rewrites rows you
-     * never looked at. The server refuses an update with no `where` at all.
-     */
-    updateWhere(where: TxWhere<Row>, set: TxSetShape<Insert>): TxRows<Row>;
-    /** Delete every row matching `where`. The server refuses an unfiltered delete. */
-    deleteWhere(where: TxWhere<Row>): TxRows<Row>;
-    /** Read rows, optionally locking them for the rest of the transaction. */
-    select(where?: TxWhere<Row>, options?: TxSelectOptions): TxRows<Row>;
-}
-/**
- * The handle a transaction callback receives.
- *
- * It carries tables and nothing else: no `query`, no `findById`, no `asService`.
- * A read whose value the plan does not write belongs OUTSIDE the transaction,
- * where it costs one round trip and can be branched on like an ordinary value.
- */
-interface TxPlanHandle<TTables> {
-    tables: TTables;
-}
-/** The server's `now()`. */
-declare function now(): TxNow;
-/** Add `by` to the column's current value. Only valid in an update's `set`. */
-declare function inc(by: number): TxColumnExpr;
-/** Subtract `by` from the column's current value. Only valid in an update's `set`. */
-declare function dec(by: number): TxColumnExpr;
-
-/**
- * The brand that identifies an HttpError ACROSS SDK instances.
- *
- * A process legitimately holds more than one copy of this SDK — the runtime
- * loads the engine from its own node_modules while the tenant's bundle carries
- * an inlined copy, which is why the controller registry and the error registry
- * are both anchored on `Symbol.for`. The one place that did not follow the
- * pattern was the engine's catch: `err instanceof HttpError` compares CLASS
- * IDENTITY, so a `throw new NotFound()` from the bundle's copy did not match
- * the engine's copy and every typed error in every deployed backend degraded to
- * `500 internal_error`. Measured through the edge on a real deploy: a route
- * throwing `NotFound` answered 500 while the runtime's own log printed the
- * error object with `status: 404` right beside it.
- *
- * `Symbol.for` puts this in the cross-realm registry, so every copy of the SDK
- * agrees on it by VALUE rather than by identity.
- */
-declare const HTTP_ERROR_BRAND: unique symbol;
-/** HTTP error with structured error response format.
- *
- * The base class for the throwable error classes (`PalError`, `Conflict`,
- * `NotFound`, …). Construct one directly with `throw new HttpError(404,
- * "todo_not_found", "No such todo")`, or throw a named subclass
- * (`throw new NotFound("todo not found")`). The runtime catches any `HttpError`
- * and emits the standard envelope; on the wire (and to iOS) it surfaces as
- * `BackendError.server(code, status, message, requestId)`.
- *
- * The optional `data` field carries a structured payload alongside the
- * standard envelope — for errors that need to ship extra context
- * (e.g. `new Conflict("locked", "title_locked", { retryAfter: 30 })`). It rides
- * through to the iOS typed enum's associated value.
- */
-declare class HttpError extends Error {
-    readonly status: number;
-    readonly error: string;
-    readonly errorDescription: string;
-    readonly data?: unknown;
-    /** See {@link HTTP_ERROR_BRAND} — how the engine recognises this across SDK copies. */
-    readonly [HTTP_ERROR_BRAND] = true;
-    constructor(status: number, error: string, errorDescription: string, data?: unknown);
-    /**
-     * Serialize to the standard Palbase error response format.
-     * The `requestId` is injected by the runtime layer from the request context.
-     * When called without arguments (e.g. JSON.stringify), request_id is omitted.
-     * When `data` is set, it is appended as a strict-superset field.
-     */
-    toJSON(requestId?: string): {
-        error: string;
-        error_description: string;
-        status: number;
-        request_id?: string;
-        data?: unknown;
-    };
-}
-/**
- * Throw with a custom HTTP status + wire code. The general-purpose escape hatch
- * when none of the named classes (`Conflict`/`NotFound`/…) fits.
- *
- * @example
- * throw new PalError(418, "teapot", "I'm a teapot");
- */
-declare class PalError extends HttpError {
-    constructor(status: number, code: string, description: string, data?: unknown);
-}
-/** Base for the named status classes. Each subclass fixes its HTTP status; the
- * `code` defaults to the class's canonical wire code (overridable), and the
- * `message` defaults to a human-readable label (overridable). */
-declare abstract class NamedHttpError extends HttpError {
-    protected constructor(status: number, defaultCode: string, name: string, message?: string, code?: string, data?: unknown);
-}
-/**
- * 400 — the request was malformed or failed validation. Carries a fixed typed
- * payload: `new BadRequest({ fields: [{ field: "email", message: "invalid" }] })`.
- * The shape is declared once in the SDK so codegen surfaces `error.data.fields`
- * typed on the client.
- */
-declare class BadRequest extends NamedHttpError {
-    readonly data: BadRequestData;
-    constructor(data: BadRequestData, message?: string);
-}
-/** 401 — the caller is not authenticated. */
-declare class Unauthorized extends NamedHttpError {
-    constructor(message?: string, code?: string, data?: unknown);
-}
-/** 403 — the caller is authenticated but not allowed. */
-declare class Forbidden extends NamedHttpError {
-    constructor(message?: string, code?: string, data?: unknown);
-}
-/** 404 — the requested resource does not exist. */
-declare class NotFound extends NamedHttpError {
-    constructor(message?: string, code?: string, data?: unknown);
-}
-/** 409 — the request conflicts with the current state. */
-declare class Conflict extends NamedHttpError {
-    constructor(message?: string, code?: string, data?: unknown);
-}
-/**
- * 409 — a write was refused because it would duplicate an existing row.
- * Carries the NAME of the unique constraint Postgres named (`users_email_key`).
- *
- * The engine produces it: a statement rejected with SQLSTATE `23505` is
- * converted here rather than surfacing as an opaque driver error (see
- * `engine/db.ts`, `diagnosingDriver`). What that removes is the string match —
- * before this, the only way to act on a duplicate was to test the driver
- * message for "duplicate key value violates unique constraint", a contract
- * nobody signed that breaks on a Postgres upgrade, a locale, or a constraint
- * rename, silently and in production.
- *
- * THE NAME IS A FIELD AND STAYS OUT OF THE DEFAULT MESSAGE. The two are not
- * the same audience. `constraint` is read by the code that catches this — the
- * developer, who already knows the schema. `errorDescription` is the HTTP
- * response body, and an UNCAUGHT duplicate puts it in front of the
- * application's end user: `users_email_key` there discloses how the schema is
- * built to whoever sent the request. The platform's own data API took the same
- * decision one surface over and wrote down why —
- * `v2/internal/modules/database/internal/handler/pgerror.go:83-87` collapses
- * every 23xxx to a generic conflict, "never disclose the constraint/column
- * name". A thrower who WANTS the name on the wire passes it deliberately
- * (`new UniqueViolation(c, \`\${c} already exists\`)`, or through `data`).
- *
- * @example
- * try {
- *   await Database.tables.users.insert({ email });
- * } catch (e) {
- *   if (UniqueViolation.is(e) && e.constraint === "users_email_key") {
- *     throw new Conflict("That email is taken", "email_taken");
- *   }
- *   throw e;
- * }
- */
-declare class UniqueViolation extends Conflict {
-    /**
-     * Whether `e` is a unique violation — REGARDLESS of which copy of this SDK
-     * constructed it.
-     *
-     * Use this instead of `instanceof`. Measured on a live stack: a controller
-     * bundle INLINES its own copy of `@palbase/backend`, and the engine that
-     * raises this error is the runtime's copy. Two copies, two class identities,
-     * and `e instanceof UniqueViolation` is false in the one place a caller
-     * writes it — a check that reads as correct and silently never matches.
-     */
-    static is(e: unknown): e is UniqueViolation;
-    /** The unique constraint the statement violated, as Postgres named it.
-     * `""` when the driver did not say which — see `engine/db.ts`. */
-    readonly constraint: string;
-    constructor(constraint: string, message?: string, code?: string, data?: unknown);
-}
-/** A single field-level validation failure carried by {@link BadRequest}. */
-interface FieldError {
-    /** The offending field's name (dotted path for nested fields). */
-    field: string;
-    /** Human-readable reason the field failed. */
-    message: string;
-}
-/** The fixed, typed payload {@link BadRequest} ships. */
-interface BadRequestData {
-    /** The fields that failed validation. */
-    fields: FieldError[];
-}
-/** The fixed, typed payload {@link TooManyRequests} ships. */
-interface TooManyRequestsData {
-    /** Seconds the caller should wait before retrying. */
-    retryAfter: number;
-}
-/**
- * 429 — the caller has exceeded the rate limit. Carries a fixed typed payload:
- * `new TooManyRequests({ retryAfter: 30 })`. The shape is declared once in the
- * SDK (error-registry pre-seed) so codegen surfaces `error.data.retryAfter`
- * typed on the client — no per-project definition needed.
- */
-declare class TooManyRequests extends NamedHttpError {
-    readonly data: TooManyRequestsData;
-    constructor(data: TooManyRequestsData, message?: string);
-}
-
-/**
- * Local typed interfaces for the 9 Palbase module clients injected into
- * every endpoint context via `ctx.auth`, `ctx.storage`, etc.
- *
- * Design intent
- * ─────────────
- * • @palbase/backend owns this contract — no runtime or type dependency on
- *   @palbase/server or any module package.
- * • These interfaces are STRUCTURALLY compatible with the runtime's
- *   ServerClient module objects so assignment is valid without a cast.
- * • All parameter and return types are defined LOCALLY here (not imported
- *   from modules/) to keep the package self-contained.
- *
- * Privilege note
- * ──────────────
- * These clients run with the project's managed-runtime (privileged) key —
- * they bypass end-user RLS; intentional for server handlers. Treat every
- * call as if it has admin access to the project's data.
- */
-
-/** A user as returned by auth verifyUserToken. */
-interface PalbaseUser {
-    id: string;
-    email: string;
-    emailVerified?: boolean;
-    createdAt?: string;
-    updatedAt?: string;
-    metadata?: Record<string, unknown>;
-}
-/** A session as returned by auth.getSession(). */
-interface PalbaseSession {
-    accessToken: string;
-    refreshToken: string;
-    expiresAt: number;
-}
-/** MFA enroll result. */
-interface PalbaseMFAEnrollResult {
-    enrollment_id?: string;
-    secret?: string;
-    otp_url?: string;
-    qr_code?: string;
-    recovery_codes?: string[];
-    status?: string;
-}
-/** MFA token response. */
-interface PalbaseTokenResponse {
-    access_token: string;
-    refresh_token: string;
-    token_type: string;
-    expires_in: number;
-}
-/** MFA factor. */
-interface PalbaseMFAFactor {
-    id: string;
-    type: string;
-    verified: boolean;
-    created_at: string;
-}
-/** Device token view returned by registerDevice. */
-interface PalbaseDeviceTokenView {
-    id: string;
-    device_id: string;
-    platform: "android" | "ios" | "web";
-    status: "active" | "inactive";
-    created_at: string;
-    updated_at: string;
-}
-/** Device info item returned by device.list(). */
-interface PalbaseDeviceInfo {
-    id: string;
-    platform: string;
-    attestation_status: string;
-    bound: boolean;
-    created_at: string;
-}
-/** Params for device.attestAndroid(). */
-interface PalbaseAttestAndroidParams {
-    verdict_token: string;
-}
-/** Result of device.attestAndroid(). */
-interface PalbaseAttestAndroidResult {
-    device_id: string;
-    attestation_status: string;
-    device_integrity?: string;
-}
-/** Params for device.attestiOS(). */
-interface PalbaseAttestiOSParams {
-    attestation_object: string;
-    key_id: string;
-    challenge: string;
-}
-/** Result of device.attestiOS(). */
-interface PalbaseAttestiOSResult {
-    device_id: string;
-    attestation_status: string;
-}
-/** Params for device.bind(). */
-interface PalbaseBindDeviceParams {
-    device_id: string;
-    public_key: string;
-    platform_attestation?: string;
-}
-/** Params for device.verifyRequestSignature() (server-only). */
-interface PalbaseVerifyRequestSignatureParams {
-    payload: string;
-    signature: string;
-}
-/** Flag context (user targeting). */
-interface PalbaseFlagContext {
-    userId?: string;
-    properties?: Record<string, unknown>;
-}
-/** Feature flag variant. */
-interface PalbaseFlagVariant {
-    name: string;
-    payload?: unknown;
-}
-/** Feature flag (getAll result item). */
-interface PalbaseFlag {
-    name: string;
-    enabled: boolean;
-    variant?: PalbaseFlagVariant;
-}
-/**
- * Any JSON value a feature flag (or per-user override) can hold once resolved.
- * Mirrors the wire shape the user-flags module stores and returns.
- */
-type PalbaseFlagValue = boolean | number | string | null | PalbaseFlagValue[] | {
-    [key: string]: PalbaseFlagValue;
-};
-/** Where a resolved flag value came from. */
-type PalbaseFlagSource = "system" | "user";
-/** Result of {@link PalbaseFlagsClient.setOverride} /
- * {@link PalbaseFlagsServiceClient.setOverrideForUser}. */
-interface PalbaseSetOverrideResult {
-    key: string;
-    value: PalbaseFlagValue;
-    source: PalbaseFlagSource;
-}
-/** Result of {@link PalbaseFlagsServiceClient.setOverridesForUser}. */
-interface PalbaseSetOverridesResult {
-    values: Record<string, PalbaseFlagValue>;
-}
-/** Result of {@link PalbaseFlagsServiceClient.clearOverrideForUser} — `value`
- * is the system default the user falls back to. */
-interface PalbaseClearOverrideResult {
-    key: string;
-    value: PalbaseFlagValue;
-    source: PalbaseFlagSource;
-}
-/** Result of {@link PalbaseFlagsServiceClient.clearAllOverridesForUser}. */
-interface PalbaseClearAllOverridesResult {
-    deleted: number;
-}
-/** One cross-user operation for {@link PalbaseFlagsServiceClient.batchSetOverrides}. */
-interface PalbaseBatchOverrideOperation {
-    userId: string;
-    values: Record<string, PalbaseFlagValue>;
-}
-/** Result of {@link PalbaseFlagsServiceClient.batchSetOverrides}. */
-interface PalbaseBatchSetOverridesResult {
-    applied: number;
-}
-/** File object returned by storage operations. */
-interface PalbaseFileObject {
-    /** The object's path inside its bucket. `name` is the same value. */
-    path: string;
-    name: string;
-    bucket: string;
-    size: number;
-    contentType: string;
-    /** SHA-256 of the stored bytes, computed as they were written. */
-    checksum: string;
-    /** Present for images: the decoded dimensions of the ORIGINAL. */
-    width?: number;
-    height?: number;
-    /**
-     * A ThumbHash — a few dozen bytes that render as a blurred preview while the
-     * real image loads, with no second request to fetch it.
-     */
-    thumbhash?: string;
-    /**
-     * Declared rendition name → the URL that serves it. Produced at upload from
-     * what `config/storage.ts` declared, so this is a lookup rather than a
-     * transform anyone pays for per request.
-     */
-    variants: Record<string, string>;
-}
-/** Storage signed URL response. */
-interface PalbaseSignedUrlResponse {
-    signedUrl: string;
-}
-/** Storage upload options. */
-interface PalbaseUploadOptions {
-    contentType?: string;
-    upsert?: boolean;
-}
-/** Storage transform options for public URLs. */
-interface PalbaseTransformOptions {
-    width?: number;
-    height?: number;
-    format?: "webp" | "avif" | "jpeg" | "png";
-}
-/** Storage list options. */
-interface PalbaseListOptions {
-    limit?: number;
-    offset?: number;
-    sortBy?: {
-        column: string;
-        order: "asc" | "desc";
-    };
-}
-/** Edge-function invoke options. */
-interface PalbaseInvokeOptions {
-    body?: unknown;
-    headers?: Record<string, string>;
-    method?: "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
-}
-/** Push recipient — user ID, array of user IDs, or a topic. */
-type PalbasePushRecipient = string | string[] | {
-    topic: string;
-};
-/** Localized text (plain or locale map). */
-type PalbaseLocalizedText = string | Record<string, string>;
-/** Push send params. */
-interface PalbasePushSendParams {
-    to: PalbasePushRecipient;
-    title?: PalbaseLocalizedText;
-    body?: PalbaseLocalizedText;
-    variables?: Record<string, string>;
-    default_locale?: string;
-    data?: Record<string, string>;
-    image?: string;
-    badge?: number;
-    sound?: string;
-    deep_link?: string;
-    collapse_key?: string;
-    priority?: "high" | "normal";
-    ttl?: number;
-    silent?: boolean;
-    content_available?: boolean;
-    category?: string;
-    metadata?: unknown;
-    channels?: Array<"push" | "inbox">;
-    inbox_action_url?: string;
-}
-/** Push send response. */
-interface PalbasePushSendResponse {
-    message_id?: string;
-    message_ids?: string[];
-    recipients: number;
-}
-/** Email send params. */
-interface PalbaseEmailSendParams {
-    to: string | string[];
-    subject?: string;
-    /**
-     * @deprecated The server reads `template_slug`, not `template` — this
-     * field is forwarded as-is and ignored by palnotify. Use `templateSlug`
-     * instead. Retained for source-compat with older callers.
-     */
-    template?: string;
-    /**
-     * Server email-template slug. The notifications client maps this to the
-     * wire field `template_slug` (mutually exclusive with `subject` + body
-     * fields when not overriding template output).
-     */
-    templateSlug?: string;
-    /**
-     * Which locale of `templateSlug` to render — a BCP47 short tag ("tr").
-     * Falls back to "en" when the slug has no row for it. Declaring a locale in
-     * config/notifications.ts is only half the feature: without this the extra
-     * rows exist and are unreachable.
-     */
-    locale?: string;
-    variables?: Record<string, unknown>;
-    html?: string;
-    text?: string;
-    from?: {
-        email: string;
-        name?: string;
-    };
-    reply_to?: string;
-    category?: string;
-}
-/** Email send response. */
-interface PalbaseEmailSendResponse {
-    message_id?: string;
-    message_ids?: string[];
-}
-/** SMS send params. */
-interface PalbaseSmsSendParams {
-    to: string | string[];
-    /**
-     * SMS body text. Either `body` OR `templateSlug` must be supplied —
-     * the two are mutually exclusive at the server.
-     */
-    body?: string;
-    /**
-     * Server SMS-template slug. The notifications client maps this to the
-     * wire field `template_slug`. When provided, palnotify renders the
-     * template with `variables` and uses the result as the SMS body.
-     */
-    templateSlug?: string;
-    /** Which locale of `templateSlug` to render — see PalbaseEmailSendParams.locale. */
-    locale?: string;
-    variables?: Record<string, unknown>;
-    category?: string;
-}
-/**
- * Phone-verification start parameters.
- *
- * There is no body field, by construction: the provider generates the code AND
- * the message text from its own template. A caller-supplied body would be
- * silently dropped — a send that reports success while delivering something the
- * caller never wrote.
- */
-interface PalbaseVerificationStartParams {
-    /** E.164 recipient, e.g. "+14155551212". */
-    to: string;
-    /** Template language (e.g. "tr", "en"). Empty uses the service default. */
-    locale?: string;
-    /** Optional user attribution for the message log. */
-    user_id?: string;
-}
-/** Phone-verification start response. The code is never included. */
-interface PalbaseVerificationStartResponse {
-    /** Provider-side handle for this attempt. Not a secret, and not the code. */
-    verification_sid: string;
-    /** Provider lifecycle value, typically "pending". */
-    status: string;
-    to: string;
-    /** palnotify message-log row id, so the send appears in message history. */
-    message_id?: string;
-}
-/** Phone-verification check parameters. */
-interface PalbaseVerificationCheckParams {
-    to: string;
-    code: string;
-}
-/**
- * Phone-verification verdict. A wrong or expired code is `approved: false` with
- * a successful HTTP status — a mismatch is a normal outcome, not an error.
- */
-interface PalbaseVerificationCheckResponse {
-    approved: boolean;
-}
-/** SMS send response. */
-interface PalbaseSmsSendResponse {
-    message_id?: string;
-    message_ids?: string[];
-}
-/** Inbox send params (managed-runtime: create inbox row for a user). */
-interface PalbaseInboxSendParams {
-    to: string;
-    title?: string;
-    body: string;
-    data?: unknown;
-    action_url?: string;
-    category?: string;
-    channels?: Array<"push" | "inbox">;
-    push_deep_link?: string;
-}
-/** Inbox send response. */
-interface PalbaseInboxSendResponse {
-    message_id?: string;
-    skipped?: boolean;
-}
-/** A per-channel status entry in a multi-channel response. */
-interface PalbaseChannelOutcome {
-    status: "queued" | "sent" | "skipped" | "failed";
-    message_id?: string;
-    message_ids?: string[];
-    recipients?: number;
-    error?: string;
-}
-/** Multi-channel fan-out response. */
-interface PalbaseMultiChannelResponse {
-    channels: Record<string, PalbaseChannelOutcome>;
-}
-/** An inbox message as returned by inbox.list. */
-interface PalbaseInboxMessage {
-    id: string;
-    user_id?: string;
-    title?: string;
-    body: string;
-    data?: unknown;
-    action_url?: string;
-    category?: string;
-    is_read: boolean;
-    read_at?: string;
-    created_at: string;
-}
-/** Inbox list options. */
-interface PalbaseInboxListOptions {
-    cursor?: string;
-    limit?: number;
-    is_read?: boolean;
-    category?: string;
-    include_archived?: boolean;
-}
-/** Inbox list result. */
-interface PalbaseInboxListResult {
-    messages: PalbaseInboxMessage[];
-    next_cursor?: string;
-}
-/** Notification preferences (channel × category opt-in/out). */
-type PalbasePreferences = Partial<Record<"push" | "email" | "sms" | "inbox", Record<string, boolean>>>;
-/** Register device params. */
-interface PalbaseRegisterDeviceParams {
-    device_id: string;
-    token: string;
-    platform: "android" | "ios" | "web";
-    app_version?: string;
-    locale?: string;
-}
-/** Email template view (camelCase). */
-interface PalbaseEmailTemplate {
-    id: string;
-    slug: string;
-    locale: string;
-    subject: string;
-    htmlBody: string;
-    textBody?: string;
-    variables: string[];
-    isDefault: boolean;
-    createdAt: string;
-    updatedAt: string;
-}
-/** Payload for templates.email.create. */
-interface PalbaseCreateEmailTemplateInput {
-    slug: string;
-    locale?: string;
-    subject: string;
-    htmlBody: string;
-    textBody?: string;
-    variables?: string[];
-}
-/** Payload for templates.email.update — patch semantics. */
-interface PalbaseUpdateEmailTemplateInput {
-    subject?: string;
-    htmlBody?: string;
-    textBody?: string;
-    variables?: string[];
-}
-/** SMS template view (camelCase). No subject / html / text distinction. */
-interface PalbaseSMSTemplate {
-    id: string;
-    slug: string;
-    locale: string;
-    body: string;
-    variables: string[];
-    isDefault: boolean;
-    createdAt: string;
-    updatedAt: string;
-}
-/** Payload for templates.sms.create. */
-interface PalbaseCreateSMSTemplateInput {
-    slug: string;
-    locale?: string;
-    body: string;
-    variables?: string[];
-}
-/** Payload for templates.sms.update — patch semantics. */
-interface PalbaseUpdateSMSTemplateInput {
-    body?: string;
-    variables?: string[];
-}
-/** Analytics event properties. */
-type PalbaseAnalyticsProperties = Record<string, unknown>;
-/** Analytics identify traits. */
-type PalbaseIdentifyTraits = Record<string, unknown>;
-/** Analytics count query input. */
-interface PalbaseCountQueryInput {
-    eventName?: string;
-    eventNames?: string[];
-    from: number;
-    to: number;
-    interval?: "hour" | "day";
-    filters?: Record<string, string>;
-    breakdown?: string;
-}
-/** A single time-bucket in a count result. */
-interface PalbaseCountBucket {
-    t: number;
-    count: number;
-    breakdown?: string;
-}
-/** Count query result. */
-interface PalbaseCountResult {
-    series: PalbaseCountBucket[];
-    from_mv: boolean;
-}
-/** Events query input. */
-interface PalbaseEventsQueryInput {
-    from: number;
-    to: number;
-    eventName?: string;
-    distinctId?: string;
-    limit?: number;
-    cursor?: string;
-}
-/** A single event row. */
-interface PalbaseEventRow {
-    event_id: string;
-    timestamp: number;
-    event_name: string;
-    distinct_id: string;
-    properties: Record<string, unknown>;
-}
-/** Events query result. */
-interface PalbaseEventsResult {
-    events: PalbaseEventRow[];
-    next_cursor?: string;
-}
-/** Properties query input. */
-interface PalbasePropertiesQueryInput {
-    eventName?: string;
-    from?: number;
-    to?: number;
-}
-/** Property descriptor (from /query/properties). */
-interface PalbasePropertyDescriptor {
-    name: string;
-    value_count: number;
-}
-/** Users query input. */
-interface PalbaseUsersQueryInput {
-    from: number;
-    to: number;
-    filters?: Record<string, string>;
-    limit?: number;
-    cursor?: string;
-}
-/** A single user row. */
-interface PalbaseUserRow {
-    distinct_id: string;
-    first_seen: number;
-    last_seen: number;
-    event_count: number;
-    properties?: Record<string, unknown>;
-}
-/** Users query result. */
-interface PalbaseUsersResult {
-    users: PalbaseUserRow[];
-    next_cursor?: string;
-}
-/** Funnel query input. */
-interface PalbaseFunnelQueryInput {
-    steps: Array<{
-        event_name: string;
-        filters?: Record<string, string>;
-    }>;
-    from: number;
-    to: number;
-    conversionWindowSeconds?: number;
-    breakdown?: string;
-}
-/** Funnel step result. */
-interface PalbaseFunnelStepResult {
-    event_name: string;
-    count: number;
-    conversion_rate: number;
-}
-/** Funnel query result. */
-interface PalbaseFunnelResult {
-    steps: PalbaseFunnelStepResult[];
-    overall_conversion_rate: number;
-}
-/** Retention query input. */
-interface PalbaseRetentionQueryInput {
-    firstEvent: string;
-    returnEvent: string;
-    from: number;
-    to: number;
-    periodDays?: number;
-    periods?: number;
-}
-/** Retention cohort result item. */
-interface PalbaseRetentionCohort {
-    cohort_start: number;
-    size: number;
-    periods: number[];
-}
-/** Retention query result. */
-interface PalbaseRetentionResult {
-    cohorts: PalbaseRetentionCohort[];
-}
-/** Cohort query input. */
-interface PalbaseCohortQueryInput {
-    name: string;
-    rules: Array<{
-        event_name: string;
-        filters?: Record<string, string>;
-    }>;
-    from: number;
-    to: number;
-}
-/** Cohort query result. */
-interface PalbaseCohortResult {
-    size: number;
-    distinct_ids_sample: string[];
-}
-/** Analytics overview result. */
-interface PalbaseOverviewResult {
-    dau: number;
-    wau: number;
-    mau: number;
-    total_events: number;
-    top_events: Array<{
-        event_name: string;
-        count: number;
-    }>;
-}
-/** Event names result. */
-interface PalbaseEventNamesResult {
-    names: string[];
-}
-/** User detail result. */
-interface PalbaseUserDetailResult {
-    distinct_id: string;
-    first_seen: number;
-    last_seen: number;
-    event_count: number;
-    properties: Record<string, unknown>;
-    recent_events: PalbaseEventRow[];
-}
-/** Create link params. */
-interface PalbaseCreateLinkParams {
-    url: string;
-    title?: string;
-    description?: string;
-    imageUrl?: string;
-    ios?: {
-        bundleId: string;
-        appStoreId?: string;
-        fallbackUrl?: string;
-        minimumVersion?: string;
-    };
-    android?: {
-        packageName: string;
-        fallbackUrl?: string;
-        minimumVersion?: number;
-    };
-    web?: {
-        fallbackUrl?: string;
-    };
-    social?: {
-        title?: string;
-        description?: string;
-        imageUrl?: string;
-    };
-    expiresAt?: string;
-    customShortCode?: string;
-}
-/** Update link params. */
-interface PalbaseUpdateLinkParams {
-    url?: string;
-    title?: string;
-    description?: string;
-    imageUrl?: string;
-    ios?: {
-        bundleId?: string;
-        appStoreId?: string;
-        fallbackUrl?: string;
-        minimumVersion?: string;
-    };
-    android?: {
-        packageName?: string;
-        fallbackUrl?: string;
-        minimumVersion?: number;
-    };
-    web?: {
-        fallbackUrl?: string;
-    };
-    social?: {
-        title?: string;
-        description?: string;
-        imageUrl?: string;
-    };
-    expiresAt?: string;
-}
-/** A link object. */
-interface PalbaseLink {
-    id: string;
-    shortCode: string;
-    shortUrl: string;
-    url: string;
-    title?: string;
-    clickCount: number;
-    createdAt: string;
-}
-/** Link details (extended link). */
-interface PalbaseLinkDetails extends PalbaseLink {
-    description?: string;
-    imageUrl?: string;
-    ios?: Record<string, unknown>;
-    android?: Record<string, unknown>;
-    web?: Record<string, unknown>;
-    social?: Record<string, unknown>;
-    expiresAt?: string;
-}
-/** Link analytics. */
-interface PalbaseLinkAnalytics {
-    totalClicks: number;
-    clicksByPlatform: Record<string, number>;
-    clicksByCountry: Record<string, number>;
-    clicksByDay: Array<{
-        date: string;
-        clicks: number;
-    }>;
-}
-/** QR code options. */
-interface PalbaseQrCodeOptions {
-    size?: number;
-    format?: "png" | "svg";
-}
-/** Match params for deferred deep link resolution. */
-interface PalbaseMatchParams {
-    fingerprintHash: string;
-}
-/** Initial deep link. */
-interface PalbaseInitialLink {
-    url: string;
-    params?: Record<string, string>;
-}
-/** List links options. */
-interface PalbaseListLinksOptions {
-    limit?: number;
-    offset?: number;
-}
-/** List links result. */
-interface PalbaseListLinksResult {
-    links: PalbaseLink[];
-    total: number;
-}
-/**
- * Auth client surface available on `ctx.auth`.
- * Exposes server-relevant methods only. Browser-only patterns are omitted:
- * — signUp / signIn / signOut / refresh / requestPasswordReset / confirmPasswordReset
- *   / changePassword / resendVerification / verifyEmail (client flow helpers)
- * — onAuthStateChange / onTokenChange (subscription callbacks)
- * — getOAuthURL / signInWithCredential (OAuth browser redirects)
- * — requestMagicLink / verifyMagicLink (client flow helpers)
- * — setTokens / getAccessToken (internal token management)
- * — listSessions / revokeSession / revokeAllSessions (user-self management)
- * — listIdentities / linkIdentity / unlinkIdentity (user-self management)
- * — listTrustedDevices / registerTrustedDevice / revokeTrustedDevice (user-self management)
- */
-interface PalbaseAuthClient {
-    /**
-     * Verify a user's JWT by calling GET /auth/user. Returns the user if the
-     * token is valid; error otherwise. Service-role privileged.
-     */
-    verifyUserToken(jwt: string): Promise<PalbaseResult<PalbaseUser>>;
-    /**
-     * Get the current session held by the client (synchronous — no network
-     * call). On the server the managed-runtime client does not hold a user
-     * session; this always returns `{ data: null, error: null }`.
-     */
-    getSession(): {
-        data: PalbaseSession | null;
-        error: null;
-    };
-    /** MFA admin surface — enroll/verify/manage factors on behalf of users. */
-    mfa: {
-        /** Enroll a new MFA factor (TOTP or email). */
-        enroll(params: {
-            type: "totp" | "email";
-        }): Promise<PalbaseResult<PalbaseMFAEnrollResult>>;
-        /** Verify an enrollment code. */
-        verifyEnrollment(code: string): Promise<PalbaseResult<{
-            status: string;
-        }>>;
-        /** Challenge an MFA factor (verify code, obtain token). */
-        challenge(params: {
-            mfa_token: string;
-            type: "totp" | "email";
-            code: string;
-        }): Promise<PalbaseResult<PalbaseTokenResponse>>;
-        /** Recover via backup code. */
-        recovery(params: {
-            mfa_token: string;
-            code: string;
-        }): Promise<PalbaseResult<PalbaseTokenResponse>>;
-        /** List enrolled factors. */
-        listFactors(): Promise<PalbaseResult<{
-            factors: PalbaseMFAFactor[];
-        }>>;
-        /** Remove a factor. Requires current password. */
-        removeFactor(factorId: string, currentPassword: string): Promise<PalbaseResult<{
-            status: string;
-        }>>;
-        /** Regenerate recovery codes. */
-        regenerateRecoveryCodes(): Promise<PalbaseResult<{
-            recovery_codes: string[];
-        }>>;
-        /** Email MFA: start enrollment. */
-        emailEnroll(): Promise<PalbaseResult<{
-            status: string;
-        }>>;
-        /** Email MFA: send challenge. */
-        emailChallenge(params: {
-            mfa_token: string;
-        }): Promise<PalbaseResult<{
-            status: string;
-        }>>;
-        /** Email MFA: verify code. */
-        emailVerify(params: {
-            mfa_token: string;
-            code: string;
-        }): Promise<PalbaseResult<PalbaseTokenResponse>>;
-    };
-    /** Device attestation surface (App Attest / Play Integrity). */
-    device: {
-        /** Generate a device attestation challenge. */
-        generateChallenge(): Promise<PalbaseResult<{
-            challenge: string;
-        }>>;
-        /** Attest an Android device with a Play Integrity verdict token. */
-        attestAndroid(params: PalbaseAttestAndroidParams): Promise<PalbaseResult<PalbaseAttestAndroidResult>>;
-        /** Attest an iOS device with App Attest attestation data. */
-        attestiOS(params: PalbaseAttestiOSParams): Promise<PalbaseResult<PalbaseAttestiOSResult>>;
-        /** Bind a verified device with a public key for request signing. */
-        bind(params: PalbaseBindDeviceParams): Promise<PalbaseResult<{
-            success: boolean;
-        }>>;
-        /** List all devices for the current user. */
-        list(): Promise<PalbaseResult<{
-            devices: PalbaseDeviceInfo[];
-        }>>;
-        /** Delete a device by ID. */
-        delete(deviceId: string): Promise<PalbaseResult<{
-            success: boolean;
-        }>>;
-        /**
-         * Verify a request signature from a device (server-only).
-         * Not exposed in the client SDK.
-         */
-        verifyRequestSignature(deviceId: string, params: PalbaseVerifyRequestSignatureParams): Promise<PalbaseResult<{
-            verified: boolean;
-        }>>;
-        /** Get the cached App Check token, or null if not available / expired. */
-        getToken(): string | null;
-        /** Whether App Check is active (token cached and not expired). */
-        readonly isActive: boolean;
-        /** Set a cached App Check token manually (e.g. after attest flow). */
-        setCachedToken(token: string, expiresInMs: number): void;
-        /** Clean up timers and cached state. */
-        dispose(): void;
-    };
-}
-/**
- * Bucket-level file operations available via `ctx.storage.bucket(name)`.
- * `getPublicUrl` is synchronous (no network call — constructs URL locally).
- */
-interface PalbaseBucketClient {
-    /** Upload a file. */
-    upload(path: string, file: Blob | ArrayBuffer | ReadableStream, options?: PalbaseUploadOptions): Promise<PalbaseResult<PalbaseFileObject>>;
-    /** Download a file as a Blob. */
-    download(path: string): Promise<PalbaseResult<Blob>>;
-    /**
-     * The public URL for an object, or for one of its declared renditions.
-     *
-     * `variant` names a rendition from `config/storage.ts` — NOT arbitrary
-     * dimensions. Renditions are produced at upload and served as immutable
-     * objects, so a URL here costs nothing to serve and caches forever; an
-     * arbitrary size would be a transform on the request path, one public URL
-     * away from a CPU amplification attack.
-     *
-     * Asking for a variant the bucket does not declare is an error rather than a
-     * silent fall back to the original: an app that requested a 200px thumbnail
-     * and quietly received a 5 MB photograph works, looks right, and is found
-     * months later on a bandwidth bill.
-     */
-    getPublicUrl(path: string, options?: {
-        variant?: string;
-    }): string;
-    /**
-     * A time-limited URL for a private object.
-     *
-     * The duration is NAMED (`{ expiresIn: "1h" }`) rather than a bare number,
-     * because "3600" reads as seconds to whoever wrote it and as minutes to
-     * whoever maintains it. Same human spelling `fileSizeLimit` takes.
-     */
-    createSignedUrl(path: string, options: {
-        expiresIn: string;
-    }): Promise<PalbaseResult<PalbaseSignedUrlResponse>>;
-    /** List objects in the bucket (optionally filtered by prefix). */
-    list(prefix?: string, options?: PalbaseListOptions): Promise<PalbaseResult<PalbaseFileObject[]>>;
-    /** Delete one or more objects. */
-    remove(paths: string[]): Promise<PalbaseResult<PalbaseFileObject[]>>;
-    /** Move / rename an object. */
-    move(from: string, to: string): Promise<PalbaseResult<void>>;
-    /** Copy an object. */
-    copy(from: string, to: string): Promise<PalbaseResult<void>>;
-}
-/**
- * Storage client available on `ctx.storage`.
- * Only `bucket()` is exposed — managed-runtime callers select a bucket first.
- */
-interface PalbaseStorageClient {
-    /** Get a bucket-scoped client for file operations. */
-    bucket(name: string): PalbaseBucketClient;
-}
-/**
- * Functions client available on `ctx.functions`.
- * Invoke edge functions from a backend endpoint.
- */
-interface PalbaseFunctionsClient {
-    /** Invoke a named edge function. */
-    invoke<T = unknown>(fnName: string, options?: PalbaseInvokeOptions): Promise<PalbaseResult<T>>;
-}
-/**
- * Cross-user admin write surface, reached via `Flags.asService()`.
- *
- * These five methods set/clear overrides for an ARBITRARY user (named
- * explicitly), so they bypass the current-request-user scope that `Flags.*`
- * reads and `Flags.setOverride(...)` are bound to. Mirrors the
- * `Database` / `Database.asService()` split: the privileged, cross-user path
- * is moved OFF the default surface so it is greppable and intentional — a
- * handler that calls `Flags.setOverrideForUser(...)` on the default surface is
- * a compile error and must reach for `Flags.asService()` first.
- *
- * @example
- * await Flags.asService().setOverrideForUser("user_123", "new_checkout", true);
- */
-interface PalbaseFlagsServiceClient {
-    /**
-     * Set (or replace) a single feature-flag override for one user. The override
-     * shadows the project (system) default for that user until cleared.
-     */
-    setOverrideForUser(userId: string, key: PalbaseFlagKey, value: PalbaseFlagValue): Promise<PalbaseResult<PalbaseSetOverrideResult>>;
-    /** Set multiple overrides for one user in a single call. */
-    setOverridesForUser(userId: string, values: Record<string, PalbaseFlagValue>): Promise<PalbaseResult<PalbaseSetOverridesResult>>;
-    /** Clear one override for a user, restoring the project (system) default. */
-    clearOverrideForUser(userId: string, key: PalbaseFlagKey): Promise<PalbaseResult<PalbaseClearOverrideResult>>;
-    /** Clear all overrides for a user, restoring project (system) defaults. */
-    clearAllOverridesForUser(userId: string): Promise<PalbaseResult<PalbaseClearAllOverridesResult>>;
-    /** Apply override writes across many users in one request (max 1000 ops). */
-    batchSetOverrides(operations: ReadonlyArray<PalbaseBatchOverrideOperation>): Promise<PalbaseResult<PalbaseBatchSetOverridesResult>>;
-}
-/**
- * Flags client available as the `Flags` singleton (and on `ctx.flags`).
- * Evaluate feature flags server-side (managed-runtime key — user targeting
- * is optional via context).
- *
- * Writes follow the `Database` model:
- * — `setOverride(key, value)` (default) overrides the flag for the CURRENT
- *   request user; no userId argument, no admin power required. It errors when
- *   there is no signed-in user (an anonymous request).
- * — `asService()` returns the {@link PalbaseFlagsServiceClient} carrying the
- *   cross-user admin writes (`setOverrideForUser`, …) for an arbitrary target
- *   user. Greppable + explicit, exactly like `Database.asService()`.
- *
- * Reads (`isEnabled`/`getVariant`/`get`/`getAll`) stay on this default surface
- * and are already current-user-scoped via the request identity.
- */
-interface PalbaseFlagsClient {
-    /** Is a flag enabled for the given context? */
-    isEnabled(flagName: PalbaseFlagKey, context?: PalbaseFlagContext): Promise<PalbaseResult<boolean>>;
-    /** Get the active variant of a multivariate flag. */
-    getVariant(flagName: PalbaseFlagKey, context?: PalbaseFlagContext): Promise<PalbaseResult<PalbaseFlagVariant>>;
-    /** Get all flags for the project. */
-    getAll(context?: PalbaseFlagContext): Promise<PalbaseResult<PalbaseFlag[]>>;
-    /**
-     * Resolve a flag's value, with an optional fallback.
-     *
-     * `get(key)` · `get(key, default)` · `get(key, ctx)` · `get(key, default, ctx)`.
-     * The default is substituted when the flag is absent AND when the flags
-     * service is unreachable — a product that hides a feature because a lookup
-     * timed out is behaving correctly.
-     *
-     * Declared here as of 2026-08-15. The client has always had it and its tests
-     * have always covered it, but the interface did not: `Flags.get("x")` was a
-     * type error in a handler and worked at runtime. That is the same gap as
-     * `Documents.doc(...)` — declared and never implemented — seen from the other
-     * side, and moving the implementation into this package is what surfaced it.
-     */
-    get(flagName: PalbaseFlagKey, defaultOrContext?: PalbaseFlagValue | PalbaseFlagContext, maybeContext?: PalbaseFlagContext): Promise<PalbaseResult<PalbaseFlagValue>>;
-    /**
-     * Set (or replace) a single feature-flag override for the CURRENT REQUEST
-     * USER. No userId argument — the override is bound to the signed-in user the
-     * handler is serving, so a handler can flip a flag for that user without
-     * admin power. The override shadows the project (system) default for that
-     * user until cleared.
-     *
-     * Errors when there is no signed-in user (an anonymous request); reach for
-     * `Flags.asService().setOverrideForUser(userId, key, value)` to write a flag
-     * for an arbitrary (cross-user) target.
-     *
-     * @example
-     * await Flags.setOverride("new_checkout", true);
-     */
-    setOverride(key: PalbaseFlagKey, value: PalbaseFlagValue): Promise<PalbaseResult<PalbaseSetOverrideResult>>;
-    /**
-     * Return the cross-user admin write surface ({@link PalbaseFlagsServiceClient}).
-     * Use sparingly and explicitly — the default `Flags.setOverride(...)` path is
-     * bound to the current request user; `asService()` is how you write a flag
-     * override for an ARBITRARY user. Mirrors `Database.asService()`.
-     */
-    asService(): PalbaseFlagsServiceClient;
-}
-/**
- * Realtime broadcast surface (backend handler → subscribed clients).
- *
- * **Every channel must be DECLARED, or the join is refused.** Channel names are
- * not free text: `channels.ts` at the project root publishes which names exist
- * and who may subscribe, publish, or write state, and a client joining a name no
- * declaration matches is rejected without ever reaching your code. Declare with
- * `ownerOnly()`, `publicChannel()`, or a custom `authorize(ctx)` — see
- * {@link defineChannels}. Broadcasting to an undeclared channel reaches nobody.
- *
- * Backend-side this is BROADCAST-ONLY: a handler pushes an event to a channel
- * and every client subscribed to that channel (via the client SDK's
- * `pb.realtime.channel(...).on(...)`) receives it. There is no `subscribe()` on
- * the backend — a stateless request handler can't hold a socket; it fires an
- * HTTP broadcast and returns. Delivery is fire-and-forget: `broadcast` resolves
- * once the broadcast is accepted (or with an `error` if it could not be sent),
- * but it never blocks the handler waiting on subscribers.
- *
- * Channel names are yours to choose (e.g. `"room:42"`, `"orders"`) but not yours
- * to leave undeclared: each must match a pattern in `channels.ts`, which is where
- * `"room:{roomId}"` is authorized. The Palbase-managed `flags:<ref>` channels are
- * internal — author channels for your own features.
- *
- * @example
- * // Notify everyone in a chat room that a message landed:
- * await Realtime.broadcast("room:42", "message", { text, from: user.id });
- */
-interface PalbaseRealtimeClient {
-    /**
-     * A channel's SHARED STATE — a keyed map every subscriber sees, including
-     * the ones that join later.
-     *
-     * That is the whole difference from `broadcast`: a broadcast reaches whoever
-     * is listening at that instant, and a client connecting a second afterwards
-     * learns nothing until the next one. State is handed to every joiner in the
-     * snapshot they get, so "the score is 3-1" or "this flag is now on" arrives
-     * even for a client that was not there when it changed.
-     */
-    state: {
-        /** Write one entry. Fire-and-forget, like `broadcast`. */
-        set(topic: string, key: string, value: Record<string, unknown>): Promise<PalbaseResult<void>>;
-        /** Remove one entry. */
-        clear(topic: string, key: string): Promise<PalbaseResult<void>>;
-    };
-    /**
-     * Broadcast `event` with `payload` to everyone subscribed to `channel`.
-     *
-     * Fire-and-forget: resolves `{ data: undefined, error: null }` when the
-     * broadcast was accepted, or `{ data: null, error }` when it could not be
-     * sent (e.g. realtime not provisioned). A failed broadcast never throws and
-     * never fails the handler.
-     *
-     * @param channel App-defined channel name (e.g. `"room:42"`). Do NOT prefix
-     *   with `"realtime:"` — that prefix is internal to the transport.
-     * @param event  Event name subscribers filter on (e.g. `"message"`).
-     * @param payload JSON-serializable event body.
-     */
-    broadcast(channel: string, event: string, payload?: Record<string, unknown>): Promise<PalbaseResult<void>>;
-}
-/**
- * Push sub-client surface (server-only: fan-out to users / topics).
- */
-interface PalbasePushClient {
-    /** Send a push notification to one or more users, or a topic. */
-    send(params: PalbasePushSendParams): Promise<PalbaseResult<PalbasePushSendResponse | PalbaseMultiChannelResponse>>;
-}
-/**
- * Email sub-client surface (managed-runtime).
- */
-interface PalbaseEmailClient {
-    /** Send a transactional email. */
-    send(params: PalbaseEmailSendParams): Promise<PalbaseResult<PalbaseEmailSendResponse>>;
-}
-/**
- * SMS sub-client surface (managed-runtime).
- */
-interface PalbaseSmsClient {
-    /** Send an SMS message. */
-    send(params: PalbaseSmsSendParams): Promise<PalbaseResult<PalbaseSmsSendResponse>>;
-}
-/**
- * Phone-verification (OTP) sub-client surface (managed-runtime).
- *
- * Separate from `sms` because a verification carries no caller-authored text.
- * It is also the rail that works without a registered sender: a verification
- * service owns its own sender identity, which plain SMS requires you to
- * provision (and, in many countries, register) yourself.
- */
-interface PalbaseVerificationsClient {
-    /** Send a verification code over SMS. */
-    start(params: PalbaseVerificationStartParams): Promise<PalbaseResult<PalbaseVerificationStartResponse>>;
-    /** Check a submitted code. A wrong code resolves to `approved: false`. */
-    check(params: PalbaseVerificationCheckParams): Promise<PalbaseResult<PalbaseVerificationCheckResponse>>;
-}
-/**
- * Inbox sub-client surface (managed-runtime send + user read operations).
- */
-interface PalbaseInboxClient {
-    /** Service-role: create an inbox notification row for a user. */
-    send(params: PalbaseInboxSendParams): Promise<PalbaseResult<PalbaseInboxSendResponse | PalbaseMultiChannelResponse>>;
-    /** List inbox messages (user-scoped or admin). */
-    list(options?: PalbaseInboxListOptions): Promise<PalbaseResult<PalbaseInboxListResult>>;
-    /** Count unread messages. */
-    unreadCount(): Promise<PalbaseResult<{
-        count: number;
-    }>>;
-    /** Mark a message as read. */
-    markRead(id: string): Promise<PalbaseResult<void>>;
-    /** Mark all messages read. */
-    markAllRead(): Promise<PalbaseResult<void>>;
-    /** Archive (soft-delete) a message. */
-    archive(id: string): Promise<PalbaseResult<void>>;
-}
-/**
- * Preferences sub-client surface.
- */
-interface PalbasePreferencesClient {
-    /** Get notification preferences. */
-    get(): Promise<PalbaseResult<PalbasePreferences>>;
-    /** Update notification preferences. */
-    update(params: PalbasePreferences): Promise<PalbaseResult<PalbasePreferences>>;
-}
-/**
- * Email-template CRUD sub-client (managed-runtime gated server-side).
- */
-interface PalbaseEmailTemplatesClient {
-    /** List all email templates. */
-    list(): Promise<PalbaseResult<PalbaseEmailTemplate[]>>;
-    /** Get one email template by ID. */
-    get(id: string): Promise<PalbaseResult<PalbaseEmailTemplate>>;
-    /** Create an email template. */
-    create(input: PalbaseCreateEmailTemplateInput): Promise<PalbaseResult<PalbaseEmailTemplate>>;
-    /** Update an email template (patch semantics). */
-    update(id: string, input: PalbaseUpdateEmailTemplateInput): Promise<PalbaseResult<PalbaseEmailTemplate>>;
-    /** Delete an email template. */
-    delete(id: string): Promise<PalbaseResult<void>>;
-}
-/**
- * SMS-template CRUD sub-client (managed-runtime gated server-side).
- */
-interface PalbaseSMSTemplatesClient {
-    /** List all SMS templates. */
-    list(): Promise<PalbaseResult<PalbaseSMSTemplate[]>>;
-    /** Get one SMS template by ID. */
-    get(id: string): Promise<PalbaseResult<PalbaseSMSTemplate>>;
-    /** Create an SMS template. */
-    create(input: PalbaseCreateSMSTemplateInput): Promise<PalbaseResult<PalbaseSMSTemplate>>;
-    /** Update an SMS template (patch semantics). */
-    update(id: string, input: PalbaseUpdateSMSTemplateInput): Promise<PalbaseResult<PalbaseSMSTemplate>>;
-    /** Delete an SMS template. */
-    delete(id: string): Promise<PalbaseResult<void>>;
-}
-/**
- * Templates sub-client — parallel CRUD for email and SMS templates.
- * Service-role gated server-side; both surfaces map TS camelCase to
- * wire snake_case in the runtime client.
- */
-interface PalbaseTemplatesClient {
-    /** Email template CRUD. */
-    email: PalbaseEmailTemplatesClient;
-    /** SMS template CRUD. */
-    sms: PalbaseSMSTemplatesClient;
-}
-/**
- * Notifications client available on `ctx.notifications`.
- * Service-role: all send operations require privileged access.
- * Omits ClientNotificationsClient (browser-only narrowed surface).
- */
-interface PalbaseNotificationsClient {
-    /** Push notification sender. */
-    push: PalbasePushClient;
-    /** Email sender. */
-    email: PalbaseEmailClient;
-    /** SMS sender. */
-    sms: PalbaseSmsClient;
-    /** Phone verification (OTP) sender and checker. */
-    verifications: PalbaseVerificationsClient;
-    /** Inbox (in-app) message sender and reader. */
-    inbox: PalbaseInboxClient;
-    /** Notification preferences manager. */
-    preferences: PalbasePreferencesClient;
-    /** Email + SMS template CRUD (managed-runtime). */
-    templates: PalbaseTemplatesClient;
-    /** Register a device for push notifications. */
-    registerDevice(params: PalbaseRegisterDeviceParams): Promise<PalbaseResult<PalbaseDeviceTokenView>>;
-    /** Remove a device registration. */
-    unregisterDevice(deviceId: string): Promise<PalbaseResult<void>>;
-}
-/**
- * Analytics query namespace (read-side endpoints).
- */
-interface PalbaseAnalyticsQueryNamespace {
-    /** Count events over time. */
-    count(input: PalbaseCountQueryInput): Promise<PalbaseResult<PalbaseCountResult>>;
-    /** List raw events. */
-    events(input: PalbaseEventsQueryInput): Promise<PalbaseResult<PalbaseEventsResult>>;
-    /** List event property descriptors. */
-    properties(input?: PalbasePropertiesQueryInput): Promise<PalbaseResult<PalbasePropertyDescriptor[]>>;
-    /** Query users by filters. */
-    users(input: PalbaseUsersQueryInput): Promise<PalbaseResult<PalbaseUsersResult>>;
-    /** Run a funnel query. */
-    funnel(input: PalbaseFunnelQueryInput): Promise<PalbaseResult<PalbaseFunnelResult>>;
-    /** Run a retention query. */
-    retention(input: PalbaseRetentionQueryInput): Promise<PalbaseResult<PalbaseRetentionResult>>;
-    /** Run a cohort query. */
-    cohort(input: PalbaseCohortQueryInput): Promise<PalbaseResult<PalbaseCohortResult>>;
-}
-/**
- * Analytics management namespace (meta-level endpoints).
- */
-interface PalbaseAnalyticsManagementNamespace {
-    /** Get project-level overview stats. */
-    overview(): Promise<PalbaseResult<PalbaseOverviewResult>>;
-    /** Get all event names seen by the project. */
-    eventNames(): Promise<PalbaseResult<PalbaseEventNamesResult>>;
-    /** Get details for a specific user. */
-    userDetail(distinctId: string): Promise<PalbaseResult<PalbaseUserDetailResult>>;
-    /** Delete all data for a user (GDPR erasure). */
-    deleteUser(distinctId: string): Promise<PalbaseResult<void>>;
-}
-/**
- * Analytics client available on `ctx.analytics`.
- * Capture events server-side and run analytical queries.
- */
-interface PalbaseAnalyticsClient {
-    /** Capture a custom event. */
-    capture(event: string, properties?: PalbaseAnalyticsProperties, distinctId?: string): Promise<PalbaseResult<void>>;
-    /** Identify a user with traits. */
-    identify(distinctId: string, traits?: PalbaseIdentifyTraits): Promise<PalbaseResult<void>>;
-    /** Track a screen view. */
-    screen(screenName: string, properties?: PalbaseAnalyticsProperties, distinctId?: string): Promise<PalbaseResult<void>>;
-    /** Query namespace for analytics read operations. */
-    query: PalbaseAnalyticsQueryNamespace;
-    /** Management namespace for meta-level operations. */
-    management: PalbaseAnalyticsManagementNamespace;
-}
-/**
- * Deep-links client available on `ctx.links`.
- * Create, manage, and resolve deep links from server endpoints.
- * Omits `getInitialLink()` (client SDK convenience — browser/app only).
- */
-interface PalbaseLinksClient {
-    /** Create a short link. */
-    create(params: PalbaseCreateLinkParams): Promise<PalbaseResult<PalbaseLink>>;
-    /** List links (paginated). */
-    list(options?: PalbaseListLinksOptions): Promise<PalbaseResult<PalbaseListLinksResult>>;
-    /** Get link details + analytics summary. */
-    get(linkId: string): Promise<PalbaseResult<PalbaseLinkDetails>>;
-    /** Update a link. */
-    update(linkId: string, params: PalbaseUpdateLinkParams): Promise<PalbaseResult<PalbaseLink>>;
-    /** Delete a link. */
-    delete(linkId: string): Promise<PalbaseResult<{
-        success: boolean;
-    }>>;
-    /** Get click analytics for a link. */
-    analytics(linkId: string): Promise<PalbaseResult<PalbaseLinkAnalytics>>;
-    /** Generate a QR code for a link (returns PNG or SVG Blob). */
-    qrCode(linkId: string, options?: PalbaseQrCodeOptions): Promise<PalbaseResult<Blob>>;
-    /** Match a deferred deep link by device fingerprint. */
-    match(params: PalbaseMatchParams): Promise<PalbaseResult<PalbaseInitialLink | null>>;
-}
-
-/** Uploaded file metadata injected into endpoint context when a file is present.
- * `data` is typed as `Uint8Array` for SDK portability (Buffer extends Uint8Array in Node).
- */
-interface FileContext {
-    filename: string;
-    contentType: string;
-    size: number;
-    data: Uint8Array;
-}
-/** Rate limit configuration for an endpoint. */
-interface RateLimitConfig {
-    /** Maximum number of requests in the window. */
-    max: number;
-    /** Window duration in seconds. */
-    window: number;
-}
-/** The six raw string-keyed DB operations shared by `DBClient` and the
- * transaction-scoped client. */
-interface DBOps {
-    /**
-     * Run SQL on the REQUEST'S OWN transaction.
-     *
-     * This is **not** read-only. Nothing marks that transaction `READ ONLY`, so a
-     * write passed here executes and commits with the request — a plain `UPDATE`, a
-     * write hidden in a CTE, or a function that writes. What stands between a
-     * statement and your data is RLS and the role the request runs as, exactly as
-     * for every other operation on this client.
-     *
-     * `INSERT … ON CONFLICT DO UPDATE` therefore works here; `tables.<t>.upsert()`
-     * is the same thing with types. Array parameters are encoded as Postgres array
-     * literals, so `= ANY($1::uuid[])` takes a plain JS array.
-     *
-     * This comment used to claim a `READ ONLY` transaction. It was wrong, and the
-     * cost was measured: a tenant read it, concluded an upsert was impossible from
-     * here, abandoned `ON CONFLICT` and wrote a database trigger instead.
-     */
-    query(sql: string, params?: unknown[]): Promise<Record<string, unknown>[]>;
-    insert(table: string, data: Record<string, unknown>): Promise<Record<string, unknown>>;
-    /**
-     * Insert the row, or update it when it collides on `onConflict` — one
-     * statement, so two concurrent callers cannot both lose.
-     *
-     * Read-then-write cannot be made safe here by catching the unique violation: a
-     * request runs in one transaction, so the failed insert aborts it and every
-     * later statement answers `current transaction is aborted`.
-     */
-    upsert(table: string, data: Record<string, unknown>, opts: {
-        onConflict: readonly string[];
-    }): Promise<Record<string, unknown>>;
-    /**
-     * Update the row with the given id and resolve to the updated row, or `null`
-     * if no row matched (the id is absent, or the row is hidden by RLS). This is
-     * an idempotent outcome, not an error — it mirrors `findById`. Map `null` to
-     * a 404 in your service if a missing row should be a client error.
-     */
-    update(table: string, id: string, data: Record<string, unknown>): Promise<Record<string, unknown> | null>;
-    delete(table: string, id: string): Promise<void>;
-    findById(table: string, id: string): Promise<Record<string, unknown> | null>;
-    /** Hibrit arama (FR-013/014) — tek SQL, RRF; engine implement eder (T017). */
-    search(table: string, params?: {
-        query?: string;
-        vector?: number[];
-        where?: Record<string, unknown>;
-        limit?: number;
-        using?: string;
-        mode?: "hybrid" | "text" | "vector";
-        /** Nihai (RRF-sonrası) skor alt eşiği (FR-001). */
-        minScore?: number;
-        /** RRF-sonrası üstel tazelik çürümesi (FR-004; feed/haber düğmesi). */
-        recency?: {
-            field: string;
-            halfLife: string;
-        };
-        /** Chunk-modunda satır başına en iyi blok sayısı (FR-015). */
-        blocksPerRow?: number;
-        /** Kolon başına top-20 değer sayacı — dönüş dizisinin `_facets` özelliği (FR-027). */
-        facets?: string[];
-        /** Satır-modunda ts_headline vurgusu: satırlara `_highlight` (FR-025; chunk-modda no-op). */
-        highlight?: boolean;
-        /** Validity'li tabloda zaman penceresi: vars. yalnız güncel; "all" tümü; {asOf} o an (FR-029). */
-        validity?: "all" | {
-            asOf: string;
-        };
-        /** Alan-boost (FR-030): skor * (1 + w·x/(1+x)) — sınırlı çarpan, dış servissiz. */
-        boost?: {
-            field: string;
-            weight: number;
-        };
-    }): Promise<Record<string, unknown>[]>;
-    /** Validity'li tabloda satırın yeni versiyonu — eski kapanır (valid_to/superseded_by),
-     * yenisi eklenir; TEK savepoint, dönüş yeni satır (FR-029, C-9). */
-    supersede(table: string, id: string, row: Record<string, unknown>): Promise<Record<string, unknown>>;
-    /** Update every row the filter matches, in one statement; resolves to them.
-     * An EMPTY filter is refused — a whole-table write is not something to reach
-     * by accident. */
-    updateMany(table: string, where: Record<string, unknown>, set: Record<string, unknown>): Promise<Record<string, unknown>[]>;
-    /** Delete every row the filter matches; resolves to how many. Empty filter
-     * refused, for the same reason and more so. */
-    deleteMany(table: string, where: Record<string, unknown>): Promise<number>;
-    /** How many rows match — the half of pagination limit/offset cannot supply.
-     * An empty filter is legitimate here: counting is a read. */
-    count(table: string, where?: Record<string, unknown>): Promise<number>;
-    /** Filtre + sıralama + sayfa. `offset` yalnız `limit` ile birlikte geçerlidir
-     * (limitsiz offset sayfa değildir; motor adıyla reddeder — FR-004). */
-    findMany(table: string, query?: Record<string, unknown>, opts?: {
-        orderBy?: {
-            column: string;
-            direction?: "asc" | "desc";
-        };
-        limit?: number;
-        offset?: number;
-    }): Promise<Record<string, unknown>[]>;
-    /** "Bu satıra benzer satırlar" (FR-022) — satır-modunda kolon vektörüyle,
-     * chunk-modunda chunk-ortalamasıyla; kendisi hariç. */
-    similar(table: string, id: string, opts?: {
-        limit?: number;
-        where?: Record<string, unknown>;
-        minScore?: number;
-        blocksPerRow?: number;
-        validity?: "all" | {
-            asOf: string;
-        };
-        boost?: {
-            field: string;
-            weight: number;
-        };
-    }): Promise<Record<string, unknown>[]>;
-    /** D-021 (FR-027): kolon sayaçları bağımsız dönüşle — search'ün dizi-üstü
-     * `_facets` özelliği serileşmede kaybolur; ciddi sözleşme budur. */
-    facets(table: string, params: {
-        facets: string[];
-        where?: Record<string, unknown>;
-        validity?: "all" | {
-            asOf: string;
-        };
-    }): Promise<Record<string, {
-        value: string | null;
-        count: number;
-    }[]>>;
-    /** Çok-örnekli öneri (FR-023): avg(pos) + (avg(pos) − avg(neg)); positive'ler sonuç dışı. */
-    recommend(table: string, opts: {
-        positive: string[];
-        negative?: string[];
-        limit?: number;
-        where?: Record<string, unknown>;
-        minScore?: number;
-        blocksPerRow?: number;
-        validity?: "all" | {
-            asOf: string;
-        };
-        boost?: {
-            field: string;
-            weight: number;
-        };
-    }): Promise<Record<string, unknown>[]>;
-}
-/** Database client interface injected into endpoint context. */
-interface DBClient extends DBOps {
-    /**
-     * Run a whole transaction as ONE plan, executed on the request's own
-     * transaction inside a savepoint.
-     *
-     * The low-level seam behind `Database.transaction(plan)`: the SDK builds the
-     * plan, this sends it, and the broker executes every operation inside a single
-     * transaction that commits or rolls back before the response is written.
-     * Nothing pins a Postgres backend across round trips, because there is only
-     * one round trip.
-     *
-     * On failure the runtime must reject with an error carrying the broker's
-     * envelope fields — see {@link TxPlanRejection}. `slot` in particular is what
-     * turns a `tx_guard_failed` back into the `Error` the tenant handed to
-     * `.expectOne(…)`; without it a declared expectation degrades to a generic 409.
-     */
-    txPlan(plan: TxPlanBody): Promise<TxPlanResponse>;
-    /**
-     * Run `fn` inside a SAVEPOINT on this request's transaction, so a failure in
-     * it rolls back only what `fn`'s handle wrote.
-     *
-     * The handle is a PARAMETER on purpose: an ambient swap would capture writes
-     * a concurrent `Promise.all` branch made outside the boundary.
-     */
-    attempt<T>(fn: (tx: DBOps) => Promise<T>): Promise<T>;
-    /**
-     * Return a sibling DB client that bypasses Row-Level Security by running as
-     * the `service_role` (BYPASSRLS). Use sparingly and explicitly — the default
-     * `Database.*` path is RLS-enforced. The returned client exposes the same op
-     * surface (`query`/`insert`/.../`txPlan`) but never re-exposes `asService`
-     * (no double-bypass).
-     */
-    asService(): Omit<DBClient, "asService">;
-}
-/** Logger interface injected into endpoint context. */
-interface Logger {
-    info(message: string, ...args: unknown[]): void;
-    warn(message: string, ...args: unknown[]): void;
-    error(message: string, ...args: unknown[]): void;
-    debug(message: string, ...args: unknown[]): void;
-}
-/**
- * Cache client interface injected into endpoint context.
- *
- * The cache is JSON-typed: values are serialized to/from JSON, so any JSON
- * value (objects, arrays, numbers, booleans, strings) round-trips. `get<T>`
- * therefore returns `T | null` rather than `string | null`.
- */
-/**
- * The tenant's secrets, as a controller sees them.
- *
- * `get` answers null for a name this tenant has not set — including every name
- * the STACK holds, which is not an accident of storage but the shape of the
- * surface: the runtime is handed a tenant client, and there is no route that
- * returns a platform secret's value at all. Tenant code cannot read the keys
- * the stack signs with, by mistake or on purpose.
- *
- * Reads are cheap. The value is held in the process and dropped when the deploy
- * pointer reports a new secrets generation, so a rotated secret arrives without
- * a restart and a hot path pays a map lookup.
- */
-interface SecretsService {
-    /**
-     * A secret's value, or `null` when this backend's vault holds no value under
-     * that name.
-     *
-     * The name is a `PalbaseSecretName`, not a `string`: it comes from the
-     * generated `palbase-stack.d.ts`, so a secret the stack does not hold cannot
-     * be spelled here at all. THE GATE IS THE COMPILER.
-     *
-     * That gate replaced a declaration. `config/secrets.ts` used to restate, in
-     * the repo, names the vault already held, and the push compared the two lists
-     * — a check that only ran at deploy, and only if the author remembered to
-     * declare. The type runs on every keystroke and cannot be forgotten.
-     */
-    get(name: PalbaseSecretName): Promise<string | null>;
-}
-interface CacheClient {
-    /** Read a value. Returns `null` on a cache miss. */
-    get<T = unknown>(key: string): Promise<T | null>;
-    /** Write a JSON-serializable value with an optional TTL (seconds). */
-    set(key: string, value: unknown, ttl?: number): Promise<void>;
-    /** Delete a key. */
-    del(key: string): Promise<void>;
-    /** Atomically increment an integer counter, returning the new value. */
-    incr(key: string): Promise<number>;
-    /**
-     * Stampede-safe read-through cache fill. On a hit, returns the cached value.
-     * On a miss, a single caller (across all pod replicas, coordinated by a
-     * distributed lock) runs `fn`, caches the result for `ttl` seconds, and
-     * returns it; concurrent callers wait for that result instead of also
-     * running `fn`. If no value lands within the lock's TTL, the call rejects —
-     * it does NOT run `fn` on timeout (that would reintroduce the stampede).
-     *
-     * @param ttl value TTL in seconds.
-     */
-    getOrSet<T>(key: string, ttl: number, fn: () => Promise<T> | T): Promise<T>;
-}
-/** Result envelope used across the Palbase Server SDK clients. */
-interface PalbaseResult<T> {
-    data: T | null;
-    error: {
-        message?: string;
-        code?: string;
-    } | null;
-    status?: number;
-}
-/** Document snapshot returned by docs.get(). */
-interface PalbaseDocumentSnapshot<T = Record<string, unknown>> {
-    id: string;
-    exists: boolean;
-    data(): T | undefined;
-    ref: {
-        path: string;
-    };
-}
-/** Collection query snapshot returned by collection.get(). */
-interface PalbaseQuerySnapshot<T = Record<string, unknown>> {
-    docs: PalbaseDocumentSnapshot<T>[];
-    empty: boolean;
-    size: number;
-    /** Firestore-shaped change list. Every document of a one-shot read is "added". */
-    docChanges(): Array<{
-        type: "added";
-        doc: PalbaseDocumentSnapshot<T>;
-    }>;
-}
-/** Comparison operators supported by docs.where(). */
-type PalbaseWhereOperator = "==" | "!=" | "<" | "<=" | ">" | ">=" | "in" | "array-contains";
-/** Document reference exposed by Documents.collection(...).doc(...). */
-interface PalbaseDocumentRef<T = Record<string, unknown>> {
-    readonly path: string;
-    set(data: T): Promise<PalbaseResult<void>>;
-    get(): Promise<PalbaseResult<PalbaseDocumentSnapshot<T>>>;
-    update(data: Partial<T>): Promise<PalbaseResult<void>>;
-    delete(): Promise<PalbaseResult<void>>;
-    /** A subcollection of this document — `rooms/1` → `rooms/1/messages`. */
-    collection<C extends Record<string, unknown> = Record<string, unknown>>(name: string): PalbaseCollectionRef<C>;
-}
-/** Collection reference exposed by Documents.collection(...). */
-interface PalbaseCollectionRef<T = Record<string, unknown>> {
-    readonly path: string;
-    doc(id: string): PalbaseDocumentRef<T>;
-    add(data: T): Promise<PalbaseResult<PalbaseDocumentRef<T>>>;
-    where(field: string, op: PalbaseWhereOperator, value: unknown): PalbaseCollectionRef<T>;
-    orderBy(field: string, direction?: "asc" | "desc"): PalbaseCollectionRef<T>;
-    limit(n: number): PalbaseCollectionRef<T>;
-    get(): Promise<PalbaseResult<PalbaseQuerySnapshot<T>>>;
-}
-/** Docs client surface available on the Documents singleton. */
-interface PalbaseDocsClient {
-    collection<T extends Record<string, unknown> = Record<string, unknown>>(path: string): PalbaseCollectionRef<T>;
-    doc<T extends Record<string, unknown> = Record<string, unknown>>(path: string): PalbaseDocumentRef<T>;
-    /**
-     * Apply up to 500 writes in one call.
-     *
-     * Declared here because the client has always offered it: an interface that
-     * described less than the implementation is how `Documents.doc(...)` came to
-     * be declared and never implemented — the gap this whole move exists to close.
-     */
-    batch(operations: Array<{
-        op: "set" | "update" | "delete";
-        ref: {
-            path: string;
-        };
-        data?: unknown;
-    }>): Promise<PalbaseResult<void>>;
-}
-/** Calling-client metadata, derived from request headers.
- *
- * Every header is named here, because the previous version of this comment named
- * only two of the four and the next reader invented `X-Palbase-Platform` for the
- * third. The four are canonical across the platform — the same names the Go
- * side reads in user-flags/internal/middleware/clientcontext.go — and the deploy
- * gate REFUSES an `@Headers` schema that declares an `x-palbase-*` key, which
- * makes `@Client()` the only sanctioned way to read them.
- *
- * All fields are nullable: a request may come from a non-SDK caller (curl,
- * server-to-server) that sends none of them. Note that the web SDK does not
- * send `X-Palbase-Sdk-Version` at all, so `sdkVersion` is null for every browser
- * caller. The semver comparison helpers (`appVersionAtLeast`, …) arrive in
- * Phase 2 — Phase 1 surfaces only the raw data fields. */
-interface ClientInfo {
-    /** Palbase SDK version (`X-Palbase-Sdk-Version`), or null. */
-    sdkVersion: string | null;
-    /** Calling app's own version (`X-Palbase-Client-Version`), or null. */
-    appVersion: string | null;
-    /** Platform identifier (`X-Platform`, e.g. "ios", "android", "web"), or null. */
-    platform: string | null;
-    /** OS version string (`X-OS-Version`), or null. */
-    osVersion: string | null;
-}
-/** Palbase module clients, as a structural bundle.
- *
- * NOT part of the endpoint surface anymore — endpoint handlers reach services
- * via the PascalCase singletons (`Database`, `Documents`, …). This type is
- * retained as an INTERNAL shape for the sibling contexts that still carry a
- * `ctx` (middleware, jobs, workers, hooks, webhooks — out of Phase 1 scope).
- * It is intentionally not re-exported from `index.ts`.
- *
- * Structurally typed against the runtime's `ServerClient`; the runtime injects
- * the real client, so mismatched names would surface as `undefined is not a
- * function` at call time — keep these in sync with `ServerClient`. */
-interface PalbaseModuleClients {
-    auth: PalbaseAuthClient;
-    storage: PalbaseStorageClient;
-    docs: PalbaseDocsClient;
-    realtime: PalbaseRealtimeClient;
-    functions: PalbaseFunctionsClient;
-    flags: PalbaseFlagsClient;
-    notifications: PalbaseNotificationsClient;
-    analytics: PalbaseAnalyticsClient;
-    links: PalbaseLinksClient;
-}
-/** Declared-error definition.
- *
- * `code` is the stable snake_case identifier that lands on the wire envelope's
- * `error` field. `status` is the HTTP status code returned. `data`, if set,
- * is a Zod schema whose value rides on the envelope's `data` field — the CLI
- * codegen lowers it to the typed enum's associated value on iOS.
- *
- * `description` is optional human-readable text; the OpenAPI generator uses it
- * for the response description and the iOS codegen surfaces it in the
- * generated method's doc-comment.
- */
-interface ErrorDef<TData extends ZodSchema = ZodSchema> {
-    status: number;
-    code: string;
-    description?: string;
-    data?: TData;
-}
-/** Map of declared errors keyed by their TypeScript-side names.
- *
- * Keys are the friendly names the handler uses (`req.errors.todoLocked`);
- * `code` on each value is the wire identifier. The TS name is what the iOS
- * codegen lowers to (camelCase enum cases), and the wire `code` is what the
- * envelope's `error` field carries.
- */
-type ErrorMap = Record<string, ErrorDef>;
-/** Throwable proxy projected onto `req.errors` when `errors` is declared.
- *
- * Each entry is a constructor: declared errors with a `data` schema demand
- * the payload as a required argument; declared errors without `data` take
- * none. Throwing the result emits the standard envelope (with `data` when
- * present).
- *
- *   throw req.errors.todoNotFound();
- *   throw req.errors.todoLocked({ retryAfter: 30 });
- */
-type ErrorThrowers<TErrors extends ErrorMap | undefined> = TErrors extends ErrorMap ? {
-    [K in keyof TErrors]: TErrors[K]["data"] extends ZodSchema ? (data: z.infer<NonNullable<TErrors[K]["data"]>>) => HttpError : () => HttpError;
-} : Record<string, never>;
-/** The request-scoped object passed to every endpoint handler.
- *
- * Replaces the old `ctx` god-object. `PBRequest` carries ONLY request-scoped
- * data — the typed `input`, route/query params, headers, the authenticated
- * `user`, calling-client metadata, trace ids, and the endpoint's declared
- * error throwers. Services (`Database`, `Documents`, `Cache`, …) are NOT on
- * the request: import them directly from `@palbase/backend` as singletons.
- *
- *   import { Controller, Get, Req, Database } from "@palbase/backend";
- *
- *   \@Controller("/todos")
- *   export class TodosController {
- *     \@Get("") list(\@Req() req: PBRequest): unknown {
- *       return Database.findMany("todos");
- *     }
- *   }
- *
- * Most controller methods reach individual request slices via their own
- * parameter decorator (`@Body`/`@QueryParams`/`@Param`/`@User`/…); `@Req()` is the
- * escape hatch that injects this whole object.
- *
- * Generic parameters:
- * - `TInput` — the validated `input` type (the `@Body` schema's `z.infer`). The
- *   user-facing form is single-generic: `PBRequest<TodoInput>`.
- * - `TAuthed` — whether `user` is non-null. DEFAULTS to `true` (the common
- *   case; the auth pipeline returns 401 before the handler when auth is
- *   required, so a non-null `user` is runtime-honest). A route whose effective
- *   auth is `false` yields `User | null`.
- * - `TErrors` — RETAINED for back-compat of the `errors` thrower shape; the
- *   class-controller model throws global error classes
- *   (`Conflict`/`NotFound`/…) instead, so `req.errors` is empty in practice.
- */
-interface PBRequest<TInput = unknown, TAuthed extends boolean = true, TErrors extends ErrorMap | undefined = undefined> {
-    /** Validated request input (body for POST/PUT/PATCH; `{}` otherwise). */
-    input: TInput;
-    /** Matched route params (e.g. `{ id }` for `/todos/[id]`). */
-    params: Record<string, string>;
-    /** Parsed query-string params. */
-    query: Record<string, string>;
-    /** Request headers (lowercase keys). */
-    headers: Record<string, string>;
-    /** Authenticated user. Non-null (`User`) by default; `User | null` only when
-     * the route's effective auth disables enforcement (driven by `TAuthed`, which
-     * the runtime resolves from the route/controller `auth` cascade via
-     * {@link IsAuthed}). */
-    user: TAuthed extends true ? User : User | null;
-    /** Calling-client metadata derived from request headers (all nullable). */
-    client: ClientInfo;
-    /** Uploaded file, or null when the request has no file part. */
-    file: FileContext | null;
-    /** HTTP method of the incoming request (e.g. "GET", "POST"). */
-    method: string;
-    /** Per-request id (`req_<…>`), preserved for back-compat correlation. */
-    requestId: string;
-    /** W3C trace id (primary correlation key across modules). */
-    traceId: string;
-    /** W3C span id for this handler invocation. */
-    spanId: string;
-    /** Typed throwers for the endpoint's declared errors. RETAINED for the
-     * `@Req()` escape-hatch shape; the class-controller model throws global error
-     * classes (`Conflict`/`NotFound`/…) instead, so this is empty in practice. */
-    errors: ErrorThrowers<TErrors>;
-}
-/** Middleware function signature — uses MiddlewareContext (no input, not yet validated). */
-type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise<void>;
-/** The shape an endpoint's `auth` config may take.
- *
- * Either a bare boolean (`true`/`false`) or an object form (`{ required?,
- * role? }`). The object form is `Partial<AuthConfig>` so `required` may be
- * omitted — which the runtime treats as `required: true` (see {@link IsAuthed}).
- */
-type AuthSpec = boolean | Partial<AuthConfig>;
-
-export { type PalbaseCreateLinkParams as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type ErrorDef as E, type FileContext as F, type PalbaseAttestiOSParams as G, HttpError as H, type PalbaseAttestiOSResult as I, type PalbaseAuthClient as J, type PalbaseBatchOverrideOperation as K, type Logger as L, type Materialized as M, NotFound as N, type PalbaseBatchSetOverridesResult as O, type PalbaseDocsClient as P, type PalbaseBindDeviceParams as Q, type RateLimitConfig as R, type SecretsService as S, type TxPlanBody as T, type PalbaseClearAllOverridesResult as U, type PalbaseClearOverrideResult as V, type PalbaseCohortQueryInput as W, type PalbaseCohortResult as X, type PalbaseCollectionRef as Y, type PalbaseCountQueryInput as Z, type PalbaseCountResult as _, type PalbaseFlagsClient as a, type PalbaseVerifyRequestSignatureParams as a$, type PalbaseDeviceInfo as a0, type PalbaseDeviceTokenView as a1, type PalbaseDocumentRef as a2, type PalbaseDocumentSnapshot as a3, type PalbaseEmailClient as a4, type PalbaseEmailSendParams as a5, type PalbaseEmailSendResponse as a6, type PalbaseEventNamesResult as a7, type PalbaseEventsQueryInput as a8, type PalbaseEventsResult as a9, type PalbaseMatchParams as aA, type PalbaseMultiChannelResponse as aB, type PalbaseOverviewResult as aC, type PalbasePreferences as aD, type PalbasePreferencesClient as aE, type PalbasePushClient as aF, type PalbasePushSendParams as aG, type PalbasePushSendResponse as aH, type PalbaseQrCodeOptions as aI, type PalbaseQuerySnapshot as aJ, type PalbaseRegisterDeviceParams as aK, type PalbaseRetentionQueryInput as aL, type PalbaseRetentionResult as aM, type PalbaseSession as aN, type PalbaseSetOverrideResult as aO, type PalbaseSetOverridesResult as aP, type PalbaseSignedUrlResponse as aQ, type PalbaseSmsClient as aR, type PalbaseSmsSendParams as aS, type PalbaseSmsSendResponse as aT, type PalbaseTransformOptions as aU, type PalbaseUpdateLinkParams as aV, type PalbaseUploadOptions as aW, type PalbaseUser as aX, type PalbaseUserDetailResult as aY, type PalbaseUsersQueryInput as aZ, type PalbaseUsersResult as a_, type PalbaseFileObject as aa, type PalbaseFlag as ab, type PalbaseFlagContext as ac, type PalbaseFlagSource as ad, type PalbaseFlagValue as ae, type PalbaseFlagVariant as af, type PalbaseFlagsServiceClient as ag, type PalbaseFunctionsClient as ah, type PalbaseFunnelQueryInput as ai, type PalbaseFunnelResult as aj, type PalbaseIdentifyTraits as ak, type PalbaseInboxClient as al, type PalbaseInboxListOptions as am, type PalbaseInboxListResult as an, type PalbaseInboxMessage as ao, type PalbaseInboxSendParams as ap, type PalbaseInboxSendResponse as aq, type PalbaseInitialLink as ar, type PalbaseInvokeOptions as as, type PalbaseLink as at, type PalbaseLinkAnalytics as au, type PalbaseLinkDetails as av, type PalbaseLinksClient as aw, type PalbaseListLinksOptions as ax, type PalbaseListLinksResult as ay, type PalbaseListOptions as az, type PalbaseNotificationsClient as b, type PalbaseWhereOperator as b0, type Ref as b1, TooManyRequests as b2, type TxColumnExpr as b3, type TxInsertShape as b4, type TxInsertValue as b5, type TxNow as b6, TxPlanError as b7, type TxPlanHandle as b8, type TxPlanOpResult as b9, type TxPlanRejection as ba, TxRefError as bb, type TxRow as bc, type TxRows as bd, type TxSelectOptions as be, type TxSetShape as bf, type TxSetValue as bg, type TxTable as bh, type TxWhere as bi, type TxWireExpr as bj, type TxWireGuard as bk, type TxWireOp as bl, type TxWireRef as bm, type TxWireValue as bn, Unauthorized as bo, UniqueViolation as bp, type User as bq, type VerifiedDevice as br, dec as bs, defineMiddleware as bt, inc as bu, now as bv, type PalbaseRealtimeClient as c, type PalbaseStorageClient as d, type PalbaseBucketClient as e, type DBOps as f, type TxPlanResponse as g, type PalbaseResult as h, type AuthConfig as i, type ClientInfo as j, Conflict as k, type ErrorMap as l, type ErrorThrowers as m, Forbidden as n, type HttpMethod as o, type Middleware as p, type MiddlewareContext as q, type MiddlewareHandler as r, type PBRequest as s, PalError as t, type PalbaseAnalyticsClient as u, type PalbaseAnalyticsManagementNamespace as v, type PalbaseAnalyticsProperties as w, type PalbaseAnalyticsQueryNamespace as x, type PalbaseAttestAndroidParams as y, type PalbaseAttestAndroidResult as z };