@palbase/backend 3.0.0 → 5.0.0

package/dist/index.js

@@ -11,18 +11,23 @@ import {
   __requestALS,
   __runWithRuntime,
   __setRuntime
-} from "./chunk-PHAFZGHN.js";
+} from "./chunk-WUQO76NW.js";
 import {
+  EXTENSION_DEPENDENCIES,
+  PALBASE_EXTENSIONS,
+  PolicyBuilder,
   boolean,
   defineSchema,
   enumType,
   integer,
+  isPalbaseExtension,
   jsonb,
   makeTypedDB,
+  policy,
   text,
   timestamp,
   uuid
-} from "./chunk-B7EUJP5W.js";
+} from "./chunk-2N4YNN6F.js";
 
 // src/db/env-gen.ts
 function baseTsType(def) {
@@ -93,26 +98,132 @@ export {};
 `;
 }
 
-// src/handler.ts
-function defineHandler(config) {
-  return { __palbase: "handler", ...config };
+// src/decorators/controller.ts
+var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta");
+function Controller(basePath, options = {}) {
+  return function(ctor) {
+    const carrier = ctor;
+    const meta = {
+      __palbase: "controller",
+      basePath,
+      ...options.auth !== void 0 ? { defaultAuth: options.auth } : {}
+    };
+    Object.defineProperty(carrier, CONTROLLER_META, {
+      value: meta,
+      enumerable: false,
+      configurable: true,
+      writable: false
+    });
+    Object.defineProperty(carrier, "__palbase", {
+      value: "controller",
+      enumerable: false,
+      configurable: true,
+      writable: false
+    });
+    return ctor;
+  };
+}
+
+// src/decorators/registry.ts
+var ROUTES = /* @__PURE__ */ Symbol.for("palbase.backend.routes");
+var PARAM_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.paramBuffer");
+var RETURN_BUFFER = /* @__PURE__ */ Symbol.for("palbase.backend.returnBuffer");
+function carrierOf(target) {
+  const ctor = typeof target === "function" ? target : target.constructor ?? target;
+  return ctor;
+}
+function ownRoutes(carrier) {
+  if (!Object.prototype.hasOwnProperty.call(carrier, ROUTES)) {
+    carrier[ROUTES] = [];
+  }
+  return carrier[ROUTES];
+}
+function ownParamBuffer(carrier) {
+  if (!Object.prototype.hasOwnProperty.call(carrier, PARAM_BUFFER)) {
+    carrier[PARAM_BUFFER] = {};
+  }
+  return carrier[PARAM_BUFFER];
+}
+function recordRoute(target, fnName, method, subpath, options) {
+  const carrier = carrierOf(target);
+  const routes = ownRoutes(carrier);
+  const buffer = ownParamBuffer(carrier);
+  const params = (buffer[fnName] ?? []).slice().sort((a, b) => a.index - b.index);
+  const route = { method, subpath, fnName, options, params };
+  const returnBuffer = carrier[RETURN_BUFFER];
+  if (returnBuffer && returnBuffer[fnName] !== void 0) {
+    route.returnSchema = returnBuffer[fnName];
+  }
+  routes.push(route);
+}
+function recordParam(target, fnName, meta) {
+  const carrier = carrierOf(target);
+  const buffer = ownParamBuffer(carrier);
+  (buffer[fnName] ??= []).push(meta);
+  const routes = carrier[ROUTES];
+  if (routes) {
+    const route = routes.find((r) => r.fnName === fnName);
+    if (route) {
+      route.params.push(meta);
+      route.params.sort((a, b) => a.index - b.index);
+    }
+  }
 }
 
-// src/controller.ts
-function makeRoute(method) {
-  return function(path, handler) {
-    return { __palbase: "route", method, path, handler };
+// src/decorators/methods.ts
+function makeMethodDecorator(method) {
+  return function(subpath, options = {}) {
+    return function(target, propertyKey) {
+      recordRoute(target, String(propertyKey), method, subpath, options);
+    };
   };
 }
-var route = {
-  get: makeRoute("GET"),
-  post: makeRoute("POST"),
-  put: makeRoute("PUT"),
-  patch: makeRoute("PATCH"),
-  delete: makeRoute("DELETE")
-};
-function defineController(basePath, routes) {
-  return { __palbase: "controller", basePath, routes };
+var Get = makeMethodDecorator("GET");
+var Post = makeMethodDecorator("POST");
+var Put = makeMethodDecorator("PUT");
+var Patch = makeMethodDecorator("PATCH");
+var Delete = makeMethodDecorator("DELETE");
+
+// src/decorators/params.ts
+function makeParamDecorator(kind, extra) {
+  return function(target, propertyKey, parameterIndex) {
+    recordParam(target, String(propertyKey), {
+      index: parameterIndex,
+      kind,
+      ...extra?.schema !== void 0 ? { schema: extra.schema } : {},
+      ...extra?.name !== void 0 ? { name: extra.name } : {}
+    });
+  };
+}
+function Body(schema) {
+  return makeParamDecorator("body", { schema });
+}
+function Query(schema) {
+  return makeParamDecorator("query", { schema });
+}
+function Headers(schema) {
+  return makeParamDecorator("headers", schema !== void 0 ? { schema } : void 0);
+}
+function Param(name) {
+  return makeParamDecorator("param", { name });
+}
+function User() {
+  return makeParamDecorator("user");
+}
+function OptionalUser() {
+  return makeParamDecorator("optionalUser");
+}
+function Client() {
+  return makeParamDecorator("client");
+}
+function RequestId() {
+  return makeParamDecorator("requestId");
+}
+function TraceId() {
+  return makeParamDecorator("traceId");
+}
+function Req() {
+  return makeParamDecorator("req");
 }
 
 // src/middleware.ts
@@ -157,6 +268,52 @@ var HttpError = class extends Error {
     return result;
   }
 };
+var PalError = class extends HttpError {
+  constructor(status, code, description, data) {
+    super(status, code, description, data);
+    this.name = "PalError";
+  }
+};
+var NamedHttpError = class extends HttpError {
+  constructor(status, defaultCode, name, message, code, data) {
+    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);
+    this.name = name;
+  }
+};
+function defaultMessage(name) {
+  const spaced = name.replace(/([a-z0-9])([A-Z])/g, "$1 $2");
+  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();
+}
+var BadRequest = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(400, "bad_request", "BadRequest", message, code, data);
+  }
+};
+var Unauthorized = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(401, "unauthorized", "Unauthorized", message, code, data);
+  }
+};
+var Forbidden = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(403, "forbidden", "Forbidden", message, code, data);
+  }
+};
+var NotFound = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(404, "not_found", "NotFound", message, code, data);
+  }
+};
+var Conflict = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(409, "conflict", "Conflict", message, code, data);
+  }
+};
+var TooManyRequests = class extends NamedHttpError {
+  constructor(message, code, data) {
+    super(429, "too_many_requests", "TooManyRequests", message, code, data);
+  }
+};
 
 // src/worker.ts
 var VALID_WORKER_NAME = /^[a-zA-Z0-9_-]+$/;
@@ -458,16 +615,42 @@ var documents = {
 // src/index.ts
 import { z } from "zod";
 export {
+  BadRequest,
+  Body,
   Cache,
+  Client,
+  Conflict,
+  Controller,
   Database,
+  Delete,
   Documents,
+  EXTENSION_DEPENDENCIES,
   Flags,
+  Forbidden,
+  Get,
+  Headers,
   HttpError,
   Log,
+  NotFound,
   Notifications,
+  OptionalUser,
+  PALBASE_EXTENSIONS,
+  PalError,
+  Param,
+  Patch,
+  PolicyBuilder,
+  Post,
+  Put,
+  Query,
   Queue,
+  Req,
+  RequestId,
   Resource,
   Storage,
+  TooManyRequests,
+  TraceId,
+  Unauthorized,
+  User,
   __getRuntime,
   __registerResource,
   __requestALS,
@@ -477,8 +660,6 @@ export {
   __shutdownResources,
   auth,
   boolean,
-  defineController,
-  defineHandler,
   defineJob,
   defineMiddleware,
   defineSchema,
@@ -487,10 +668,11 @@ export {
   documents,
   enumType,
   integer,
+  isPalbaseExtension,
   jsonb,
   makeEnvDts,
   makeTypedDB,
-  route,
+  policy,
   storage,
   text,
   timestamp,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/db/env-gen.ts","../src/handler.ts","../src/controller.ts","../src/middleware.ts","../src/errors.ts","../src/worker.ts","../src/job.ts","../src/webhook.ts","../src/resource.ts","../src/hooks.ts","../src/index.ts"],"sourcesContent":["/**\n * env-gen.ts — generate the `palbase-env.d.ts` text from a `defineSchema()`\n * result.\n *\n * The CLI (`palbase serve` / codegen) and the deploy pipeline call\n * {@link makeEnvDts} with the project's schema and write the returned string to\n * `palbase-env.d.ts` at the project root. That file AUGMENTS the\n * `@palbase/backend/env` `Tables` interface (controlled global augmentation,\n * C5) so `Database.tables.<name>` is typed with no import and no generic.\n *\n * The output is FLAT: each table gets a `{ row: {...}; insert: {...} }` entry\n * with plain TypeScript object types. The phantom `ColumnBuilder<...>` type\n * NEVER appears in the generated `.d.ts` — that type only lives at authoring\n * time inside `db/schema.ts`.\n */\n\nimport type { ColumnDef } from \"./columns.js\";\nimport type { SchemaDef, TableDef } from \"./schema.js\";\n\n/** The TypeScript value type for a column, ignoring nullability (added by the\n * caller). Mirrors the `ColValue` mapped type in columns.ts exactly. */\nfunction baseTsType(def: ColumnDef): string {\n  switch (def.type) {\n    case \"uuid\":\n    case \"text\":\n    case \"timestamp\":\n      return \"string\";\n    case \"integer\":\n      return \"number\";\n    case \"boolean\":\n      return \"boolean\";\n    case \"jsonb\":\n      return \"unknown\";\n    case \"enum\": {\n      const values = def.enumValues ?? [];\n      if (values.length === 0) return \"string\";\n      return values.map((v) => JSON.stringify(v)).join(\" | \");\n    }\n    default:\n      return \"unknown\";\n  }\n}\n\n/** The full row type for a column: base type, `| null` when nullable. */\nfunction rowType(def: ColumnDef): string {\n  const base = baseTsType(def);\n  return def.nullable ? `${base} | null` : base;\n}\n\n/** True when a column may be omitted on INSERT — nullable OR has any default.\n * Mirrors `ColIsOptionalOnInsert` in columns.ts. */\nfunction optionalOnInsert(def: ColumnDef): boolean {\n  return (\n    def.nullable === true ||\n    def.defaultRandom === true ||\n    def.defaultNow === true ||\n    def.defaultValue !== undefined\n  );\n}\n\n/** Emit the `row: {...}` and `insert: {...}` blocks for one table at the given\n * base indentation. */\nfunction tableBlock(table: TableDef, indent: string): string {\n  const cols = Object.entries(table.columns);\n  const rowLines = cols.map(([col, builder]) => {\n    return `${indent}    ${col}: ${rowType(builder._def)};`;\n  });\n  const insertLines = cols.map(([col, builder]) => {\n    const def = builder._def;\n    const opt = optionalOnInsert(def) ? \"?\" : \"\";\n    return `${indent}    ${col}${opt}: ${rowType(def)};`;\n  });\n  return [\n    `${indent}${table.name}: {`,\n    `${indent}  row: {`,\n    ...rowLines,\n    `${indent}  };`,\n    `${indent}  insert: {`,\n    ...insertLines,\n    `${indent}  };`,\n    `${indent}};`,\n  ].join(\"\\n\");\n}\n\n/**\n * Generate the full `palbase-env.d.ts` text for a schema.\n *\n * @example\n * import { makeEnvDts } from \"@palbase/backend\";\n * import schema from \"./db/schema.js\";\n * writeFileSync(\"palbase-env.d.ts\", makeEnvDts(schema));\n */\nexport function makeEnvDts(schema: SchemaDef): string {\n  const tableNames = Object.keys(schema.tables);\n  const blocks = tableNames.map((name) => tableBlock(schema.tables[name]!, \"    \"));\n  const body = blocks.length > 0 ? `\\n${blocks.join(\"\\n\")}\\n  ` : \"\";\n  return `// AUTO-GENERATED by @palbase/backend — DO NOT EDIT.\n// Regenerated from db/schema.ts on every \\`palbase serve\\` / deploy.\n// Augments the @palbase/backend/env \\`Tables\\` interface so \\`Database.tables.*\\`\n// is typed with no import and no generic.\n\ndeclare module \"@palbase/backend/env\" {\n  interface Tables {${body}}\n}\n\nexport {};\n`;\n}\n","import type { ZodSchema, z } from \"zod\";\nimport type {\n  AuthSpec,\n  IsAuthed,\n  ErrorMap,\n  Middleware,\n  RateLimitConfig,\n  PBRequest,\n} from \"./endpoint.js\";\n\n/**\n * handler.ts — `defineHandler`: an endpoint UNIT (schema + thin logic), one per\n * file, with NO routing.\n *\n * Everything that types `req` lives here (colocated): `auth` → `req.user`\n * nullability, `input` → `req.input`, `errors` → `req.errors`, `output` → the\n * return type. There is NO `method`/`path` on a handler — the HTTP verb + path\n * are declared in a controller's route map, NOT on the handler. A handler file\n * does:\n *\n *   // handlers/places/import-nearby.ts\n *   export default defineHandler({ auth, input, output, errors, handler });\n *\n * # Runtime-readable shape (read by the Go runtime's extract_meta.js)\n *\n * `defineHandler` returns a {@link HandlerDef}: a plain object marked with\n * `__palbase: \"handler\"` carrying the optional `auth`/`input`/`output`/`errors`\n * and the `handler` function. There is deliberately NO `method`/`path` on it —\n * a handler is route-agnostic.\n */\n\n/** Configuration accepted by {@link defineHandler}. Carries the schema +\n * auth/errors/middleware that type `req`, but NO `method` (routing lives in\n * controllers). */\nexport interface HandlerConfig<\n  TInputSchema extends ZodSchema = ZodSchema,\n  TOutputSchema extends ZodSchema = ZodSchema,\n  TAuth extends AuthSpec | undefined = undefined,\n  TErrors extends ErrorMap | undefined = undefined,\n> {\n  auth?: TAuth;\n  rateLimit?: RateLimitConfig;\n  input?: TInputSchema;\n  output?: TOutputSchema;\n  errors?: TErrors;\n  middleware?: Middleware[];\n  handler: (\n    req: PBRequest<z.infer<TInputSchema>, IsAuthed<TAuth>, TErrors>,\n  ) => Promise<z.infer<TOutputSchema>> | z.infer<TOutputSchema>;\n}\n\n/**\n * The runtime-readable handler descriptor returned by {@link defineHandler}.\n *\n * Shape (the Go runtime's `extract_meta.js` reads this off the default export):\n *\n *   {\n *     __palbase: \"handler\",\n *     auth?:     AuthSpec,\n *     rateLimit?: RateLimitConfig,\n *     input?:    ZodSchema,\n *     output?:   ZodSchema,\n *     errors?:   ErrorMap,\n *     middleware?: Middleware[],\n *     handler:   (req) => result,   // the invoked function\n *   }\n *\n * NOTE: there is NO `method`/`path` — those come from the controller route map.\n */\nexport interface HandlerDef<\n  TInputSchema extends ZodSchema = ZodSchema,\n  TOutputSchema extends ZodSchema = ZodSchema,\n  TAuth extends AuthSpec | undefined = undefined,\n  TErrors extends ErrorMap | undefined = undefined,\n> {\n  /** Discriminant the runtime + a controller route check read. */\n  readonly __palbase: \"handler\";\n  auth?: TAuth;\n  rateLimit?: RateLimitConfig;\n  input?: TInputSchema;\n  output?: TOutputSchema;\n  errors?: TErrors;\n  middleware?: Middleware[];\n  handler: (\n    req: PBRequest<z.infer<TInputSchema>, IsAuthed<TAuth>, TErrors>,\n  ) => Promise<z.infer<TOutputSchema>> | z.infer<TOutputSchema>;\n}\n\n/**\n * A {@link HandlerDef} with its schema/auth/errors type params ERASED — the\n * shape a controller's `route.*` stores. EVERY `defineHandler()` result (any\n * `auth`/`input`/`output`/`errors`) is assignable to this, because `handler` is\n * typed `(req: never) => unknown` (params are contravariant, so a handler taking\n * any concrete `PBRequest` satisfies a `never` param). A controller only needs\n * to route + carry the handler; the handler's own `req` typing is validated\n * where it is defined, so erasing the params here is sound and lets a route\n * accept a handler regardless of its `auth`/`errors` — without `any`.\n */\nexport interface AnyHandlerDef {\n  readonly __palbase: \"handler\";\n  auth?: AuthSpec;\n  rateLimit?: RateLimitConfig;\n  input?: ZodSchema;\n  output?: ZodSchema;\n  errors?: ErrorMap;\n  middleware?: Middleware[];\n  handler: (req: never) => unknown;\n}\n\n/**\n * Define an endpoint handler (schema + thin logic), with full `req` inference\n * and NO routing. Mounted by a controller's `route.*` map.\n *\n * @example\n * import { defineHandler, z, Database } from \"@palbase/backend\";\n *\n * export default defineHandler({\n *   auth:   { required: true },\n *   input:  z.object({ title: z.string() }),\n *   output: z.object({ id: z.string() }),\n *   errors: { titleTaken: { status: 409, code: \"title_taken\" } },\n *   handler: (req) => Database.tables.todos.insert({ title: req.input.title }),\n * });\n */\nexport function defineHandler<\n  TInputSchema extends ZodSchema,\n  TOutputSchema extends ZodSchema,\n  const TAuth extends AuthSpec | undefined = undefined,\n  const TErrors extends ErrorMap | undefined = undefined,\n>(\n  config: HandlerConfig<TInputSchema, TOutputSchema, TAuth, TErrors>,\n): HandlerDef<TInputSchema, TOutputSchema, TAuth, TErrors> {\n  return { __palbase: \"handler\", ...config };\n}\n","import type { AnyHandlerDef } from \"./handler.js\";\n\n/**\n * controller.ts — `defineController` + `route.*`: the ROUTE MAP (method+path →\n * handler). Logic cannot be written here — a controller only wires existing\n * handlers, so the small-blast-radius / no-cross-file-type-sync property holds.\n *\n * ```ts\n * // controllers/places.controller.ts\n * import { defineController, route } from \"@palbase/backend\";\n * import importNearby  from \"../handlers/places/import-nearby.js\";\n * import listFavorites from \"../handlers/places/list-favorites.js\";\n *\n * export default defineController(\"/places\", {\n *   importNearby:  route.post(\"/import\",    importNearby),   // map key = sugar\n *   listFavorites: route.get (\"/favorites\", listFavorites),\n * });\n * ```\n *\n * # Runtime-readable object shapes (read by the Go runtime's extract_meta.js)\n *\n * The default export of a controller file is a `ControllerDef`:\n *\n *   ControllerDef = {\n *     __palbase: \"controller\",\n *     basePath:  string,                      // e.g. \"/places\"\n *     routes:    { [mapKey: string]: RouteDef } // mapKey is AUTHORING SUGAR only\n *   }\n *\n *   RouteDef = {\n *     __palbase: \"route\",\n *     method:    \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\",  // upper-case\n *     path:      string,        // the SUBPATH passed to route.*(…), e.g. \"/import\"\n *     handler:   HandlerDef,    // the imported defineHandler() result\n *   }\n *\n *   HandlerDef = {\n *     __palbase: \"handler\",\n *     auth?, rateLimit?, input?, output?, errors?, middleware?,\n *     handler:   (req) => result,\n *   }\n *\n * The FULL path for a route is `basePath + path` (e.g. \"/places\" + \"/import\" =\n * \"/places/import\"). The operationId is NOT computed here — the runtime\n * `generator.go` derives it FLAT from `(method, full-path)` (e.g.\n * `postPlacesImport`). The map key (`importNearby`) is authoring sugar and is\n * NOT the operationId.\n */\n\n/** The five HTTP verbs a route may declare, upper-cased (matches the runtime\n * router + OpenAPI which lower-cases on its own). */\nexport type HttpMethodUpper = \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n\n/**\n * A single route entry: the HTTP verb, the SUBPATH (relative to the\n * controller's `basePath`), and the handler to invoke. Produced by `route.*`.\n */\nexport interface RouteDef<\n  H extends AnyHandlerDef = AnyHandlerDef,\n  M extends HttpMethodUpper = HttpMethodUpper,\n> {\n  /** Discriminant the runtime + `defineController` read. */\n  readonly __palbase: \"route\";\n  /** Upper-case HTTP verb. */\n  method: M;\n  /** The subpath passed to `route.*(subpath, handler)` (relative to basePath). */\n  path: string;\n  /** The handler (a `defineHandler()` result) this route invokes. */\n  handler: H;\n}\n\n/** The route map a controller declares: keys are authoring sugar, values must\n * each be a `route.*()` result. The mapped-over `Record<string, RouteDef>`\n * constraint is what makes a bare handler (or plain object) a TS error. */\nexport type RouteMap = Record<string, RouteDef>;\n\n/**\n * The controller descriptor returned by {@link defineController}. The default\n * export of a `controllers/*.ts` file.\n */\nexport interface ControllerDef<R extends RouteMap = RouteMap> {\n  /** Discriminant the runtime reads. */\n  readonly __palbase: \"controller\";\n  /** The path every route in this controller is mounted under (e.g. \"/places\"). */\n  basePath: string;\n  /** The route map — keys are authoring sugar, values are RouteDefs. */\n  routes: R;\n}\n\n/** Build a `route.*` factory for one verb. Accepts ANY `defineHandler()` result\n * via {@link AnyHandlerDef} — a handler's `auth`/`input`/`output`/`errors` are\n * validated where it is defined, so a route need not (and must not) re-constrain\n * them, otherwise a handler declaring `auth` would fail the bound. */\nfunction makeRoute<M extends HttpMethodUpper>(method: M) {\n  return function <H extends AnyHandlerDef>(path: string, handler: H): RouteDef<H, M> {\n    return { __palbase: \"route\", method, path, handler };\n  };\n}\n\n/**\n * Route builders — one per HTTP verb. Each takes the SUBPATH (relative to the\n * controller `basePath`) and the handler to mount there.\n *\n * @example\n * import { defineController, route } from \"@palbase/backend\";\n * import create from \"../handlers/todos/create.js\";\n *\n * export default defineController(\"/todos\", {\n *   create: route.post(\"/\", create),\n * });\n */\nexport const route = {\n  get: makeRoute(\"GET\"),\n  post: makeRoute(\"POST\"),\n  put: makeRoute(\"PUT\"),\n  patch: makeRoute(\"PATCH\"),\n  delete: makeRoute(\"DELETE\"),\n} as const;\n\n/**\n * Define a controller: a base path + a route map (method+path → handler). The\n * route-map KEY is authoring sugar only (NOT the operationId). Each route value\n * MUST be a `route.*()` result — a bare handler or plain object is a TS error,\n * which is what keeps logic out of controllers structurally.\n *\n * @example\n * import { defineController, route } from \"@palbase/backend\";\n * import create from \"../handlers/todos/create.js\";\n * import list   from \"../handlers/todos/list.js\";\n *\n * export default defineController(\"/todos\", {\n *   create: route.post(\"/\", create),\n *   list:   route.get(\"/\", list),\n * });\n */\nexport function defineController<const R extends RouteMap>(\n  basePath: string,\n  routes: R,\n): ControllerDef<R> {\n  return { __palbase: \"controller\", basePath, routes };\n}\n","import type { DBClient, Logger, CacheClient, PalbaseModuleClients } from \"./endpoint.js\";\nimport type { User } from \"./types.js\";\n\n/** Middleware context — subset of EndpointContext without input (not yet validated). */\nexport interface MiddlewareContext extends PalbaseModuleClients {\n  params: Record<string, string>;\n  query: Record<string, string>;\n  headers: Record<string, string>;\n  user: User | null;\n  db: DBClient;\n  env: Record<string, string>;\n  log: Logger;\n  cache: CacheClient;\n  requestId: string;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Middleware function signature — receives context and next function. */\nexport type MiddlewareHandler = (\n  ctx: MiddlewareContext,\n  next: () => Promise<void>,\n) => Promise<void>;\n\n/**\n * Define a middleware function for use in the middleware/ directory or\n * as endpoint-specific middleware.\n *\n * Middleware runs before the handler. Call `next()` to pass control\n * to the next middleware or handler. If `next()` is not called, the\n * handler will not execute.\n *\n * Errors thrown in middleware are caught by the pipeline and returned\n * as error responses.\n */\nexport function defineMiddleware(fn: MiddlewareHandler): MiddlewareHandler {\n  return fn;\n}\n","/** HTTP error with structured error response format.\n *\n * Two ways to construct one:\n *\n *   1. Directly: `throw new HttpError(404, \"todo_not_found\", \"No such todo\")`.\n *      Surfaces on the wire (and to iOS) as `BackendError.server(code, status,\n *      message, requestId)`.\n *   2. Via `req.errors.<name>(data?)` for declared errors — see a handler's\n *      `errors` map (`defineHandler`). The endpoint's OpenAPI spec describes\n *      each one, and the CLI codegen emits a typed `<Endpoint>.Error` enum so\n *      iOS callers can `catch <Endpoint>.Error.<case>` directly.\n *\n * The optional `data` field carries a structured payload alongside the\n * standard envelope — used by declared errors that need to ship extra context\n * (e.g. `todoLocked({ retryAfter: 30 })`). It rides through to the iOS typed\n * enum's associated value.\n */\nexport class HttpError extends Error {\n  public readonly status: number;\n  public readonly error: string;\n  public readonly errorDescription: string;\n  public readonly data?: unknown;\n\n  constructor(status: number, error: string, errorDescription: string, data?: unknown) {\n    super(errorDescription);\n    this.name = \"HttpError\";\n    this.status = status;\n    this.error = error;\n    this.errorDescription = errorDescription;\n    if (data !== undefined) {\n      this.data = data;\n    }\n  }\n\n  /**\n   * Serialize to the standard Palbase error response format.\n   * The `requestId` is injected by the runtime layer from the request context.\n   * When called without arguments (e.g. JSON.stringify), request_id is omitted.\n   * When `data` is set, it is appended as a strict-superset field.\n   */\n  toJSON(requestId?: string): {\n    error: string;\n    error_description: string;\n    status: number;\n    request_id?: string;\n    data?: unknown;\n  } {\n    const result: {\n      error: string;\n      error_description: string;\n      status: number;\n      request_id?: string;\n      data?: unknown;\n    } = {\n      error: this.error,\n      error_description: this.errorDescription,\n      status: this.status,\n    };\n    if (requestId) {\n      result.request_id = requestId;\n    }\n    if (this.data !== undefined) {\n      result.data = this.data;\n    }\n    return result;\n  }\n}\n","import type { User } from \"./types.js\";\n\n/** Non-service, per-invocation data for background worker handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface WorkerMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  /** The user that enqueued the job, if any (background jobs are usually system-initiated). */\n  user: User | null;\n  /** Per-invocation id for correlation. */\n  requestId: string;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Backoff strategy for worker retries. */\nexport type BackoffStrategy = \"exponential\" | \"linear\" | \"fixed\";\n\n/** Configuration for a background worker. */\nexport interface WorkerConfig<TPayload = unknown> {\n  /** Worker name — must be unique across the project. */\n  name: string;\n  /** Maximum number of retries before sending to dead letter queue. Defaults to 3. */\n  retry?: number;\n  /** Execution timeout in seconds. Defaults to 30. */\n  timeout?: number;\n  /** Backoff strategy between retries. Defaults to \"exponential\". */\n  backoff?: BackoffStrategy;\n  /** Handler function that processes the job payload. */\n  handler: (\n    payload: TPayload,\n    meta: WorkerMeta,\n  ) => Promise<void>;\n}\n\n/** Resolved worker configuration with defaults applied. */\nexport interface ResolvedWorkerConfig<TPayload = unknown> {\n  name: string;\n  retry: number;\n  timeout: number;\n  backoff: BackoffStrategy;\n  handler: (\n    payload: TPayload,\n    meta: WorkerMeta,\n  ) => Promise<void>;\n}\n\n/** Valid worker name pattern: alphanumeric, underscore, hyphen only.\n * Prevents Redis key injection via colons or path separators. */\nconst VALID_WORKER_NAME = /^[a-zA-Z0-9_-]+$/;\n\n/** Default values for worker configuration. */\nconst WORKER_DEFAULTS = {\n  retry: 3,\n  timeout: 30,\n  backoff: \"exponential\" as BackoffStrategy,\n} as const;\n\n/**\n * Define a background worker that processes jobs from the queue.\n *\n * Workers are placed in the `workers/` directory and auto-discovered at deploy time.\n *\n * @example\n * ```ts\n * export default defineWorker({\n *   name: \"send-email\",\n *   retry: 5,\n *   timeout: 60,\n *   backoff: \"exponential\",\n *   handler: async (payload: { to: string; subject: string }, meta) => {\n *     await sendEmail(payload.to, payload.subject);\n *   },\n * });\n * ```\n */\nexport function defineWorker<TPayload = unknown>(\n  config: WorkerConfig<TPayload>,\n): ResolvedWorkerConfig<TPayload> {\n  if (!config.name || config.name.trim() === \"\") {\n    throw new Error(\"Worker name is required\");\n  }\n\n  if (!VALID_WORKER_NAME.test(config.name)) {\n    throw new Error(\n      `Invalid worker name \"${config.name}\": must match [a-zA-Z0-9_-]+`,\n    );\n  }\n\n  if (config.retry !== undefined && (config.retry < 0 || !Number.isInteger(config.retry))) {\n    throw new Error(\"Worker retry must be a non-negative integer\");\n  }\n\n  if (config.timeout !== undefined && config.timeout <= 0) {\n    throw new Error(\"Worker timeout must be a positive number\");\n  }\n\n  if (\n    config.backoff !== undefined &&\n    ![\"exponential\", \"linear\", \"fixed\"].includes(config.backoff)\n  ) {\n    throw new Error(`Invalid backoff strategy: ${config.backoff}`);\n  }\n\n  return {\n    name: config.name,\n    retry: config.retry ?? WORKER_DEFAULTS.retry,\n    timeout: config.timeout ?? WORKER_DEFAULTS.timeout,\n    backoff: config.backoff ?? WORKER_DEFAULTS.backoff,\n    handler: config.handler,\n  };\n}\n","/** Non-service, per-invocation data for job handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface JobMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Configuration for defining a scheduled job. */\nexport interface JobConfig {\n  /** Unique job name — alphanumeric, underscore, hyphen only. */\n  name: string;\n  /** Cron expression (e.g., \"0 3 * * *\"). */\n  schedule: string;\n  /** Execution timeout in seconds. Defaults to 30. */\n  timeout?: number;\n  /** Job handler function. */\n  handler: (meta: JobMeta) => Promise<void>;\n}\n\n/** Resolved job configuration with defaults applied. */\nexport interface ResolvedJobConfig {\n  name: string;\n  schedule: string;\n  timeout: number;\n  handler: (meta: JobMeta) => Promise<void>;\n}\n\n/** Valid job name pattern: alphanumeric, underscore, hyphen only. */\nconst VALID_JOB_NAME = /^[a-zA-Z0-9_-]+$/;\n\n/** Maximum allowed timeout in seconds (5 minutes, matching sandbox limits). */\nconst MAX_TIMEOUT_SECONDS = 300;\n\n/** Default values for job configuration. */\nconst JOB_DEFAULTS = {\n  timeout: 30,\n} as const;\n\n/**\n * Cron expression validation.\n * Supports standard 5-field cron: minute hour day-of-month month day-of-week.\n * Each field allows: number, *, ranges (1-5), steps (star/2), lists (1,3,5).\n */\nfunction validateCronExpression(expression: string): string | null {\n  const trimmed = expression.trim();\n  if (trimmed === \"\") {\n    return \"Cron expression is required\";\n  }\n\n  const parts = trimmed.split(/\\s+/);\n  if (parts.length !== 5) {\n    return `Invalid cron expression \"${trimmed}\": expected 5 fields (minute hour day month weekday), got ${parts.length}`;\n  }\n\n  const fieldNames = [\"minute\", \"hour\", \"day of month\", \"month\", \"day of week\"];\n  const fieldRanges: [number, number][] = [\n    [0, 59],\n    [0, 23],\n    [1, 31],\n    [1, 12],\n    [0, 7],\n  ];\n\n  for (let i = 0; i < 5; i++) {\n    const field = parts[i]!;\n    const name = fieldNames[i]!;\n    const [min, max] = fieldRanges[i]!;\n\n    const error = validateCronField(field, name, min, max);\n    if (error !== null) {\n      return error;\n    }\n  }\n\n  return null;\n}\n\nfunction validateCronField(\n  field: string,\n  name: string,\n  min: number,\n  max: number,\n): string | null {\n  // Split by comma for lists\n  const listParts = field.split(\",\");\n  for (const part of listParts) {\n    // Check for step: */2, 1-5/2\n    const stepParts = part.split(\"/\");\n    if (stepParts.length > 2) {\n      return `Invalid ${name} field: \"${field}\"`;\n    }\n\n    const base = stepParts[0]!;\n    const step = stepParts[1];\n\n    if (step !== undefined) {\n      const stepNum = Number(step);\n      if (!Number.isInteger(stepNum) || stepNum < 1) {\n        return `Invalid step value in ${name} field: \"${field}\"`;\n      }\n    }\n\n    if (base === \"*\") {\n      continue;\n    }\n\n    // Check for range: 1-5\n    if (base.includes(\"-\")) {\n      const rangeParts = base.split(\"-\");\n      if (rangeParts.length !== 2) {\n        return `Invalid range in ${name} field: \"${field}\"`;\n      }\n      const rangeStart = Number(rangeParts[0]);\n      const rangeEnd = Number(rangeParts[1]);\n      if (\n        !Number.isInteger(rangeStart) ||\n        !Number.isInteger(rangeEnd) ||\n        rangeStart < min ||\n        rangeEnd > max ||\n        rangeStart > rangeEnd\n      ) {\n        return `Invalid range in ${name} field: \"${field}\"`;\n      }\n      continue;\n    }\n\n    // Single number\n    const num = Number(base);\n    if (!Number.isInteger(num) || num < min || num > max) {\n      return `Invalid value in ${name} field: \"${field}\"`;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Define a scheduled cron job.\n *\n * Jobs are placed in the `jobs/` directory and auto-discovered at deploy time.\n *\n * @example\n * ```ts\n * export default defineJob({\n *   name: \"cleanup-expired\",\n *   schedule: \"0 3 * * *\", // every day at 3 AM\n *   timeout: 60,\n *   handler: async (meta) => {\n *     await Database.delete(\"sessions\", \"expired < NOW()\");\n *     Log.info(\"Cleaned up expired sessions\");\n *   },\n * });\n * ```\n */\nexport function defineJob(config: JobConfig): ResolvedJobConfig {\n  if (!config.name || config.name.trim() === \"\") {\n    throw new Error(\"Job name is required\");\n  }\n\n  if (!VALID_JOB_NAME.test(config.name)) {\n    throw new Error(\n      `Invalid job name \"${config.name}\": must match [a-zA-Z0-9_-]+`,\n    );\n  }\n\n  if (!config.schedule || config.schedule.trim() === \"\") {\n    throw new Error(\"Job schedule is required\");\n  }\n\n  const cronError = validateCronExpression(config.schedule);\n  if (cronError !== null) {\n    throw new Error(cronError);\n  }\n\n  if (!config.handler) {\n    throw new Error(\"Job handler is required\");\n  }\n\n  if (config.timeout !== undefined && config.timeout <= 0) {\n    throw new Error(\"Job timeout must be a positive number\");\n  }\n\n  if (config.timeout !== undefined && !Number.isInteger(config.timeout)) {\n    throw new Error(\"Job timeout must be an integer\");\n  }\n\n  if (config.timeout !== undefined && config.timeout > MAX_TIMEOUT_SECONDS) {\n    throw new Error(\n      `Job timeout ${config.timeout}s exceeds maximum ${MAX_TIMEOUT_SECONDS}s`,\n    );\n  }\n\n  return {\n    name: config.name,\n    schedule: config.schedule.trim(),\n    timeout: config.timeout ?? JOB_DEFAULTS.timeout,\n    handler: config.handler,\n  };\n}\n","/** Supported webhook provider types. */\nexport type WebhookProvider =\n  | \"stripe\"\n  | \"github\"\n  | \"twilio\"\n  | \"sendgrid\"\n  | \"slack\"\n  | \"discord\"\n  | \"livekit\";\n\n/** Non-service, per-invocation data for webhook handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface WebhookMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  /** Per-invocation id for correlation. */\n  requestId: string;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Secret reference — resolves from environment variables at runtime. */\nexport interface EnvSecretRef {\n  env: string;\n}\n\n/** Provider-specific event maps for type-safe event handlers. */\nexport interface ProviderEventMap {\n  stripe: {\n    \"checkout.session.completed\": Record<string, unknown>;\n    \"payment_intent.succeeded\": Record<string, unknown>;\n    \"payment_intent.payment_failed\": Record<string, unknown>;\n    \"customer.subscription.created\": Record<string, unknown>;\n    \"customer.subscription.updated\": Record<string, unknown>;\n    \"customer.subscription.deleted\": Record<string, unknown>;\n    \"invoice.paid\": Record<string, unknown>;\n    \"invoice.payment_failed\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  github: {\n    push: Record<string, unknown>;\n    pull_request: Record<string, unknown>;\n    issues: Record<string, unknown>;\n    \"pull_request.opened\": Record<string, unknown>;\n    \"pull_request.closed\": Record<string, unknown>;\n    \"pull_request.merged\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  twilio: {\n    \"message.received\": Record<string, unknown>;\n    \"message.sent\": Record<string, unknown>;\n    \"call.completed\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  sendgrid: {\n    delivered: Record<string, unknown>;\n    bounce: Record<string, unknown>;\n    open: Record<string, unknown>;\n    click: Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  slack: {\n    url_verification: Record<string, unknown>;\n    event_callback: Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  discord: {\n    PING: Record<string, unknown>;\n    MESSAGE_CREATE: Record<string, unknown>;\n    INTERACTION_CREATE: Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  livekit: {\n    \"room.started\": Record<string, unknown>;\n    \"room.finished\": Record<string, unknown>;\n    \"participant.joined\": Record<string, unknown>;\n    \"participant.left\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n}\n\n/** Event handler function type. */\nexport type WebhookEventHandler<TEvent = Record<string, unknown>> = (\n  event: TEvent,\n  meta: WebhookMeta,\n) => Promise<void>;\n\n/** Provider-based webhook configuration. */\nexport interface ProviderWebhookConfig<P extends WebhookProvider = WebhookProvider> {\n  provider: P;\n  secret: EnvSecretRef;\n  events: {\n    [K in keyof ProviderEventMap[P]]?: WebhookEventHandler<ProviderEventMap[P][K]>;\n  };\n}\n\n/** Incoming request representation for custom verify functions. */\nexport interface WebhookRequest {\n  headers: Record<string, string>;\n  body: string;\n  method: string;\n  url: string;\n}\n\n/** Custom webhook configuration. */\nexport interface CustomWebhookConfig {\n  path: string;\n  verify?: (req: WebhookRequest) => Promise<boolean> | boolean;\n  handler: (payload: Record<string, unknown>, meta: WebhookMeta) => Promise<void>;\n}\n\n/** Resolved provider webhook (internal). */\nexport interface ResolvedProviderWebhook<P extends WebhookProvider = WebhookProvider> {\n  type: \"provider\";\n  provider: P;\n  secret: EnvSecretRef;\n  events: Record<string, WebhookEventHandler>;\n}\n\n/** Resolved custom webhook (internal). */\nexport interface ResolvedCustomWebhook {\n  type: \"custom\";\n  path: string;\n  verify?: (req: WebhookRequest) => Promise<boolean> | boolean;\n  handler: (payload: Record<string, unknown>, meta: WebhookMeta) => Promise<void>;\n}\n\n/** Union of resolved webhook types. */\nexport type ResolvedWebhookConfig = ResolvedProviderWebhook | ResolvedCustomWebhook;\n\n/** Valid webhook path pattern: starts with /, alphanumeric + hyphen + slash. */\nconst VALID_WEBHOOK_PATH = /^\\/[a-zA-Z0-9/_-]+$/;\n\n/**\n * Define a provider-based webhook.\n *\n * @example\n * ```ts\n * export default defineWebhook({\n *   provider: \"stripe\",\n *   secret: { env: \"STRIPE_WEBHOOK_SECRET\" },\n *   events: {\n *     \"checkout.session.completed\": async (event, meta) => {\n *       await Database.insert(\"orders\", { status: \"paid\" });\n *     },\n *   },\n * });\n * ```\n */\nexport function defineWebhook<P extends WebhookProvider>(\n  config: ProviderWebhookConfig<P>,\n): ResolvedProviderWebhook<P>;\n\n/**\n * Define a custom webhook with optional verification.\n *\n * @example\n * ```ts\n * export default defineWebhook({\n *   path: \"/webhooks/livekit\",\n *   verify: async (req) => req.headers[\"x-api-key\"] === \"secret\",\n *   handler: async (payload, meta) => {\n *     Log.info(\"Received webhook\", payload);\n *   },\n * });\n * ```\n */\nexport function defineWebhook(config: CustomWebhookConfig): ResolvedCustomWebhook;\n\nexport function defineWebhook(\n  config: ProviderWebhookConfig | CustomWebhookConfig,\n): ResolvedWebhookConfig {\n  if (\"provider\" in config) {\n    return validateProviderWebhook(config);\n  }\n  return validateCustomWebhook(config);\n}\n\nfunction validateProviderWebhook<P extends WebhookProvider>(\n  config: ProviderWebhookConfig<P>,\n): ResolvedProviderWebhook<P> {\n  if (!config.provider) {\n    throw new Error(\"Webhook provider is required\");\n  }\n\n  const validProviders: WebhookProvider[] = [\n    \"stripe\", \"github\", \"twilio\", \"sendgrid\", \"slack\", \"discord\", \"livekit\",\n  ];\n  if (!validProviders.includes(config.provider)) {\n    throw new Error(\n      `Invalid webhook provider \"${config.provider}\": must be one of ${validProviders.join(\", \")}`,\n    );\n  }\n\n  if (!config.secret) {\n    throw new Error(\"Webhook secret is required (use { env: \\\"SECRET_NAME\\\" })\");\n  }\n\n  if (typeof config.secret.env !== \"string\" || config.secret.env.trim() === \"\") {\n    throw new Error(\"Webhook secret env name must be a non-empty string\");\n  }\n\n  if (!config.events || Object.keys(config.events).length === 0) {\n    throw new Error(\"At least one event handler is required\");\n  }\n\n  for (const [eventName, handler] of Object.entries(config.events)) {\n    if (typeof handler !== \"function\") {\n      throw new Error(`Event handler for \"${eventName}\" must be a function`);\n    }\n  }\n\n  return {\n    type: \"provider\",\n    provider: config.provider,\n    secret: config.secret,\n    events: config.events as Record<string, WebhookEventHandler>,\n  };\n}\n\nfunction validateCustomWebhook(config: CustomWebhookConfig): ResolvedCustomWebhook {\n  if (!config.path || config.path.trim() === \"\") {\n    throw new Error(\"Webhook path is required\");\n  }\n\n  if (!VALID_WEBHOOK_PATH.test(config.path)) {\n    throw new Error(\n      `Invalid webhook path \"${config.path}\": must start with / and contain only alphanumeric, hyphen, underscore, slash`,\n    );\n  }\n\n  if (!config.handler) {\n    throw new Error(\"Webhook handler is required\");\n  }\n\n  if (typeof config.handler !== \"function\") {\n    throw new Error(\"Webhook handler must be a function\");\n  }\n\n  if (config.verify !== undefined && typeof config.verify !== \"function\") {\n    throw new Error(\"Webhook verify must be a function\");\n  }\n\n  return {\n    type: \"custom\",\n    path: config.path,\n    verify: config.verify,\n    handler: config.handler,\n  };\n}\n","/**\n * resource.ts — external connections as lifecycle-managed classes.\n *\n * A `Resource` subclass models one external connection (a pooled datastore, a\n * stateless API client, or a per-user factory). The framework discovers each\n * instance, calls `init(env)` ONCE at boot with the declared secret subset, and\n * `shutdown()` (reverse order) on SIGTERM. On top of that lifecycle the author\n * exposes their own clean facade methods.\n *\n *   // resources/neo4j.ts\n *   import { Resource } from \"@palbase/backend\";\n *   import neo4j, { type Driver, type Session } from \"neo4j-driver\";\n *\n *   export class Neo4jResource extends Resource {\n *     static secrets = [\"NEO4J_URL\", \"NEO4J_USER\", \"NEO4J_PASSWORD\"] as const;\n *     private driver!: Driver;\n *     async init(env: { NEO4J_URL: string; NEO4J_USER: string; NEO4J_PASSWORD: string }) {\n *       this.driver = neo4j.driver(env.NEO4J_URL, neo4j.auth.basic(env.NEO4J_USER, env.NEO4J_PASSWORD));\n *     }\n *     async shutdown() { await this.driver.close(); }\n *     session(): Session { return this.driver.session(); }\n *   }\n *   export const neo4j = new Neo4jResource();  // framework finds + manages it\n *\n * # Boot scope (NOT request-ALS)\n *\n * Resources are instantiated once at process boot. This is deliberately NOT the\n * per-request {@link AsyncLocalStorage} scope used for `Database`/`Cache`/… — a\n * connection pool must outlive a single request. The runtime discovers\n * resources from the project's `resources/` directory, registers each via\n * {@link __registerResource}, then calls {@link __runResourceBoot} before\n * serving and {@link __shutdownResources} on SIGTERM. Discovery is a runtime\n * concern; the SDK provides the base class + registry + boot/shutdown hooks.\n */\n\n/** Map a declared `secrets` tuple to the `init(env)` argument type — a record\n * over the secret names, each `string`. An empty tuple maps to an empty\n * record. */\nexport type ResourceEnv<Secrets extends readonly string[]> = {\n  [K in Secrets[number]]: string;\n};\n\n/**\n * Base class for external connections.\n *\n * - `static secrets` — OPTIONAL readonly tuple of env-var names this resource\n *   needs. Drives (a) the `env` type passed to `init` and (b) the\n *   missing-secret check at boot (deploy fails naming the absent secret).\n * - `init(env)` — called ONCE at boot with the declared secret subset. May be\n *   sync (`void`) or async (`Promise<void>`).\n * - `shutdown()` — OPTIONAL drain hook, called on SIGTERM in reverse boot\n *   order.\n *\n * @example\n * import { Resource } from \"@palbase/backend\";\n * import { Client } from \"@googlemaps/google-maps-services-js\";\n *\n * export class GoogleResource extends Resource {\n *   static secrets = [\"GOOGLE_MAPS_KEY\"] as const;\n *   private client = new Client();\n *   private key = \"\";\n *   init(env: { GOOGLE_MAPS_KEY: string }) { this.key = env.GOOGLE_MAPS_KEY; }\n * }\n * export const google = new GoogleResource();\n */\nexport abstract class Resource {\n  /** The env-var names this resource needs. Optional; omit for none. */\n  static secrets?: readonly string[];\n\n  /** Set up the connection from the declared secrets. Called once at boot. */\n  abstract init(env: Record<string, string>): void | Promise<void>;\n\n  /** Drain/close the connection on SIGTERM. Optional. */\n  shutdown?(): void | Promise<void>;\n}\n\n/** A value carrying an optional readonly `secrets` tuple — the constructor side\n * of a Resource subclass. Narrowed from `unknown` via {@link hasSecrets}. */\ninterface WithSecrets {\n  secrets?: readonly string[];\n}\n\n/** Guard: does this value carry a `secrets` array (the static on a Resource\n * subclass)? Lets us read `secrets` off `resource.constructor` (typed\n * `Function`) without a cast — narrows from `unknown` instead. */\nfunction hasSecrets(value: unknown): value is WithSecrets {\n  if (typeof value !== \"object\" && typeof value !== \"function\") return false;\n  const secrets = (value as { secrets?: unknown }).secrets;\n  return secrets === undefined || Array.isArray(secrets);\n}\n\n/** A registered resource plus whether its `init` has already run. The\n * `booted` flag makes {@link __runResourceBoot} idempotent (re-running boot,\n * e.g. across a re-entrant deploy path, never re-inits). */\ninterface RegistryEntry {\n  resource: Resource;\n  booted: boolean;\n}\n\n/** Module-level boot registry. Single per process (the br-pod is\n * single-project). Order is registration order; shutdown reverses it. */\nconst registry: RegistryEntry[] = [];\n\n/**\n * Register a resource instance with the boot registry. The runtime calls this\n * for each instance discovered under the project's `resources/` directory.\n * NOT part of the public author-facing API (prefixed `__`).\n */\nexport function __registerResource(resource: Resource): void {\n  registry.push({ resource, booted: false });\n}\n\n/** Read the declared `secrets` tuple off a resource instance's constructor. */\nfunction declaredSecrets(resource: Resource): readonly string[] {\n  const ctor: unknown = resource.constructor;\n  return hasSecrets(ctor) ? (ctor.secrets ?? []) : [];\n}\n\n/**\n * Boot every registered resource that has not yet been booted: resolve its\n * declared secret subset from `envMap`, then await its `init(env)`. Idempotent\n * — an already-booted resource is skipped. Throws (failing deploy/boot) when a\n * declared secret is absent, naming the missing secret. NOT part of the public\n * author-facing API.\n */\nexport async function __runResourceBoot(envMap: Record<string, string>): Promise<void> {\n  for (const entry of registry) {\n    if (entry.booted) continue;\n    const secrets = declaredSecrets(entry.resource);\n    const env: Record<string, string> = {};\n    for (const name of secrets) {\n      const value = envMap[name];\n      if (value === undefined) {\n        throw new Error(\n          `Resource ${entry.resource.constructor.name} requires secret \"${name}\" but it is not set. ` +\n            `Set it with \\`palbase secret set ${name} ...\\` (or in Studio) and redeploy.`,\n        );\n      }\n      env[name] = value;\n    }\n    await entry.resource.init(env);\n    entry.booted = true;\n  }\n}\n\n/**\n * Shut down every booted resource in REVERSE registration order, awaiting each\n * `shutdown()` (a no-op when undefined). Clears the registry afterwards so a\n * second call is a no-op. NOT part of the public author-facing API.\n */\nexport async function __shutdownResources(): Promise<void> {\n  for (let i = registry.length - 1; i >= 0; i -= 1) {\n    const entry = registry[i]!;\n    if (entry.booted && entry.resource.shutdown) {\n      await entry.resource.shutdown();\n    }\n  }\n  registry.length = 0;\n}\n\n/** Clear the registry without running shutdown. TEST-only helper so each test\n * starts from a clean registry. NOT part of the public author-facing API. */\nexport function __resetResources(): void {\n  registry.length = 0;\n}\n","/** Non-service, per-invocation data for hook handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface HookMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  projectId: string;\n  environmentId: string;\n}\n\n// --- Auth Event Payloads ---\n\n/** Payload for auth.onUserCreated hook. */\nexport interface UserCreatedEvent {\n  user: {\n    id: string;\n    /** User's email, if they signed up with one (absent for phone-only users). */\n    email?: string;\n    role: string;\n    metadata: Record<string, unknown>;\n    createdAt: string;\n  };\n}\n\n/** Payload for auth.onSignIn hook. */\nexport interface SignInEvent {\n  user: {\n    id: string;\n    /** User's email, if they have one (absent for phone-only users). */\n    email?: string;\n    role: string;\n  };\n  provider: string;\n  timestamp: string;\n}\n\n/** Payload for auth.onSignOut hook. */\nexport interface SignOutEvent {\n  user: {\n    id: string;\n    /** User's email, if they have one (absent for phone-only users). */\n    email?: string;\n  };\n  timestamp: string;\n}\n\n/** Payload for auth.onPasswordReset hook.\n * Password reset is inherently email-based, so `email` is always present here\n * (a phone-only passwordless user cannot trigger this event). */\nexport interface PasswordResetEvent {\n  user: {\n    id: string;\n    email: string;\n  };\n  timestamp: string;\n}\n\n// --- Storage Event Payloads ---\n\n/** Payload for storage.onFileUploaded hook. */\nexport interface FileUploadedEvent {\n  file: {\n    id: string;\n    name: string;\n    bucket: string;\n    path: string;\n    size: number;\n    contentType: string;\n  };\n}\n\n/** Payload for storage.onFileDeleted hook. */\nexport interface FileDeletedEvent {\n  file: {\n    id: string;\n    name: string;\n    bucket: string;\n    path: string;\n  };\n}\n\n// --- Documents Event Payloads ---\n\n/** Payload for documents.onDocumentCreated hook. */\nexport interface DocumentCreatedEvent {\n  document: {\n    id: string;\n    collection: string;\n    data: Record<string, unknown>;\n  };\n}\n\n/** Payload for documents.onDocumentUpdated hook. */\nexport interface DocumentUpdatedEvent {\n  document: {\n    id: string;\n    collection: string;\n    data: Record<string, unknown>;\n    previousData: Record<string, unknown>;\n  };\n}\n\n/** Payload for documents.onDocumentDeleted hook. */\nexport interface DocumentDeletedEvent {\n  document: {\n    id: string;\n    collection: string;\n    data: Record<string, unknown>;\n  };\n}\n\n// --- Hook Handler Types ---\n\nexport type HookHandler<TEvent> = (event: TEvent, meta: HookMeta) => Promise<void>;\n\n/** Resolved hook configuration (internal). */\nexport interface ResolvedHook<TEvent = unknown> {\n  module: string;\n  event: string;\n  handler: HookHandler<TEvent>;\n}\n\n// --- Auth Hooks ---\n\nexport const auth = {\n  onUserCreated(handler: HookHandler<UserCreatedEvent>): ResolvedHook<UserCreatedEvent> {\n    return { module: \"auth\", event: \"user.created\", handler };\n  },\n\n  onSignIn(handler: HookHandler<SignInEvent>): ResolvedHook<SignInEvent> {\n    return { module: \"auth\", event: \"user.sign_in\", handler };\n  },\n\n  onSignOut(handler: HookHandler<SignOutEvent>): ResolvedHook<SignOutEvent> {\n    return { module: \"auth\", event: \"user.sign_out\", handler };\n  },\n\n  onPasswordReset(handler: HookHandler<PasswordResetEvent>): ResolvedHook<PasswordResetEvent> {\n    return { module: \"auth\", event: \"user.password_reset\", handler };\n  },\n};\n\n// --- Storage Hooks ---\n\nexport const storage = {\n  onFileUploaded(handler: HookHandler<FileUploadedEvent>): ResolvedHook<FileUploadedEvent> {\n    return { module: \"storage\", event: \"file.uploaded\", handler };\n  },\n\n  onFileDeleted(handler: HookHandler<FileDeletedEvent>): ResolvedHook<FileDeletedEvent> {\n    return { module: \"storage\", event: \"file.deleted\", handler };\n  },\n};\n\n// --- Documents Hooks ---\n\nexport const documents = {\n  onDocumentCreated(handler: HookHandler<DocumentCreatedEvent>): ResolvedHook<DocumentCreatedEvent> {\n    return { module: \"documents\", event: \"document.created\", handler };\n  },\n\n  onDocumentUpdated(handler: HookHandler<DocumentUpdatedEvent>): ResolvedHook<DocumentUpdatedEvent> {\n    return { module: \"documents\", event: \"document.updated\", handler };\n  },\n\n  onDocumentDeleted(handler: HookHandler<DocumentDeletedEvent>): ResolvedHook<DocumentDeletedEvent> {\n    return { module: \"documents\", event: \"document.deleted\", handler };\n  },\n};\n","export type {\n  PBRequest,\n  ClientInfo,\n  RateLimitConfig,\n  DBClient,\n  TxClient,\n  FileContext,\n  QueueClient,\n  Logger,\n  CacheClient,\n  PalbaseDocsClient,\n  PalbaseCollectionRef,\n  PalbaseDocumentRef,\n  PalbaseDocumentSnapshot,\n  PalbaseQuerySnapshot,\n  PalbaseWhereOperator,\n  PalbaseResult,\n  Middleware,\n  ErrorDef,\n  ErrorMap,\n  ErrorThrowers,\n} from \"./endpoint.js\";\nexport {\n  Database,\n  Documents,\n  Storage,\n  Cache,\n  Queue,\n  Log,\n  Notifications,\n  Flags,\n  __setRuntime,\n  __runWithRuntime,\n  __requestALS,\n  __getRuntime,\n} from \"./runtime.js\";\nexport type { RuntimeServices } from \"./runtime.js\";\nexport type {\n  PalbaseAuthClient,\n  PalbaseStorageClient,\n  PalbaseBucketClient,\n  PalbaseRealtimeClient,\n  PalbaseRealtimeChannel,\n  PalbaseRealtimeMessage,\n  PalbaseFunctionsClient,\n  PalbaseInvokeOptions,\n  PalbaseFlagsClient,\n  PalbaseFlagContext,\n  PalbaseFlagVariant,\n  PalbaseFlag,\n  PalbaseNotificationsClient,\n  PalbasePushClient,\n  PalbaseEmailClient,\n  PalbaseSmsClient,\n  PalbaseInboxClient,\n  PalbasePreferencesClient,\n  PalbaseAnalyticsClient,\n  PalbaseAnalyticsQueryNamespace,\n  PalbaseAnalyticsManagementNamespace,\n  PalbaseLinksClient,\n  PalbaseCmsClient,\n  // Shared local types\n  PalbaseUser,\n  PalbaseSession,\n  PalbaseDeviceInfo,\n  PalbaseAttestAndroidParams,\n  PalbaseAttestAndroidResult,\n  PalbaseAttestiOSParams,\n  PalbaseAttestiOSResult,\n  PalbaseBindDeviceParams,\n  PalbaseVerifyRequestSignatureParams,\n  PalbaseFileObject,\n  PalbaseSignedUrlResponse,\n  PalbasePublicUrlResponse,\n  PalbaseUploadOptions,\n  PalbaseTransformOptions,\n  PalbaseListOptions,\n  PalbasePushSendParams,\n  PalbasePushSendResponse,\n  PalbaseEmailSendParams,\n  PalbaseEmailSendResponse,\n  PalbaseSmsSendParams,\n  PalbaseSmsSendResponse,\n  PalbaseInboxSendParams,\n  PalbaseInboxSendResponse,\n  PalbaseInboxMessage,\n  PalbaseInboxListOptions,\n  PalbaseInboxListResult,\n  PalbasePreferences,\n  PalbaseRegisterDeviceParams,\n  PalbaseDeviceTokenView,\n  PalbaseMultiChannelResponse,\n  PalbaseAnalyticsProperties,\n  PalbaseIdentifyTraits,\n  PalbaseCountQueryInput,\n  PalbaseCountResult,\n  PalbaseEventsQueryInput,\n  PalbaseEventsResult,\n  PalbaseUsersQueryInput,\n  PalbaseUsersResult,\n  PalbaseFunnelQueryInput,\n  PalbaseFunnelResult,\n  PalbaseRetentionQueryInput,\n  PalbaseRetentionResult,\n  PalbaseCohortQueryInput,\n  PalbaseCohortResult,\n  PalbaseOverviewResult,\n  PalbaseEventNamesResult,\n  PalbaseUserDetailResult,\n  PalbaseCreateLinkParams,\n  PalbaseUpdateLinkParams,\n  PalbaseLink,\n  PalbaseLinkDetails,\n  PalbaseLinkAnalytics,\n  PalbaseQrCodeOptions,\n  PalbaseMatchParams,\n  PalbaseInitialLink,\n  PalbaseListLinksOptions,\n  PalbaseListLinksResult,\n  PalbaseCmsFindOptions,\n  PalbaseCmsFindOneOptions,\n} from \"./clients.js\";\nexport { defineSchema } from \"./db/schema.js\";\nexport type { SchemaDef, TableDef, ColumnMap, SchemaInput } from \"./db/schema.js\";\nexport { uuid, text, integer, boolean, timestamp, jsonb, enumType } from \"./db/columns.js\";\nexport type { ColumnBuilder, ColumnDef, ColumnType, OnDeleteAction } from \"./db/columns.js\";\nexport { makeTypedDB } from \"./db/typed-db.js\";\nexport type {\n  TypedDB,\n  TypedTx,\n  TypedTable,\n  InsertShape,\n  RowShape,\n  EnvTypedDatabase,\n  EnvTypedTx,\n  EnvTypedTable,\n  EnvTables,\n} from \"./db/typed-db.js\";\nexport type { Tables, TableTypes } from \"./db/env.js\";\nexport { makeEnvDts } from \"./db/env-gen.js\";\nexport { defineHandler } from \"./handler.js\";\nexport type { HandlerConfig, HandlerDef } from \"./handler.js\";\nexport { defineController, route } from \"./controller.js\";\nexport type { ControllerDef, RouteDef, RouteMap, HttpMethodUpper } from \"./controller.js\";\nexport { defineMiddleware } from \"./middleware.js\";\nexport type { MiddlewareContext, MiddlewareHandler } from \"./middleware.js\";\nexport type { User, HttpMethod, AuthConfig } from \"./types.js\";\nexport { HttpError } from \"./errors.js\";\nexport { defineWorker } from \"./worker.js\";\nexport type {\n  WorkerConfig,\n  ResolvedWorkerConfig,\n  WorkerMeta,\n  BackoffStrategy,\n} from \"./worker.js\";\nexport { defineJob } from \"./job.js\";\nexport type { JobConfig, ResolvedJobConfig, JobMeta } from \"./job.js\";\nexport { defineWebhook } from \"./webhook.js\";\nexport type {\n  WebhookProvider,\n  WebhookMeta,\n  EnvSecretRef,\n  ProviderWebhookConfig,\n  CustomWebhookConfig,\n  ResolvedProviderWebhook,\n  ResolvedCustomWebhook,\n  ResolvedWebhookConfig,\n  WebhookEventHandler,\n  WebhookRequest,\n  ProviderEventMap,\n} from \"./webhook.js\";\nexport {\n  Resource,\n  __registerResource,\n  __runResourceBoot,\n  __shutdownResources,\n} from \"./resource.js\";\nexport type { ResourceEnv } from \"./resource.js\";\nexport { auth, storage, documents } from \"./hooks.js\";\nexport type {\n  HookMeta,\n  HookHandler,\n  ResolvedHook,\n  UserCreatedEvent,\n  SignInEvent,\n  SignOutEvent,\n  PasswordResetEvent,\n  FileUploadedEvent,\n  FileDeletedEvent,\n  DocumentCreatedEvent,\n  DocumentUpdatedEvent,\n  DocumentDeletedEvent,\n} from \"./hooks.js\";\nexport { z } from \"zod\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,WAAW,KAAwB;AAC1C,UAAQ,IAAI,MAAM;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,SAAS,IAAI,cAAc,CAAC;AAClC,UAAI,OAAO,WAAW,EAAG,QAAO;AAChC,aAAO,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,KAAK;AAAA,IACxD;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAGA,SAAS,QAAQ,KAAwB;AACvC,QAAM,OAAO,WAAW,GAAG;AAC3B,SAAO,IAAI,WAAW,GAAG,IAAI,YAAY;AAC3C;AAIA,SAAS,iBAAiB,KAAyB;AACjD,SACE,IAAI,aAAa,QACjB,IAAI,kBAAkB,QACtB,IAAI,eAAe,QACnB,IAAI,iBAAiB;AAEzB;AAIA,SAAS,WAAW,OAAiB,QAAwB;AAC3D,QAAM,OAAO,OAAO,QAAQ,MAAM,OAAO;AACzC,QAAM,WAAW,KAAK,IAAI,CAAC,CAAC,KAAK,OAAO,MAAM;AAC5C,WAAO,GAAG,MAAM,OAAO,GAAG,KAAK,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACtD,CAAC;AACD,QAAM,cAAc,KAAK,IAAI,CAAC,CAAC,KAAK,OAAO,MAAM;AAC/C,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,iBAAiB,GAAG,IAAI,MAAM;AAC1C,WAAO,GAAG,MAAM,OAAO,GAAG,GAAG,GAAG,KAAK,QAAQ,GAAG,CAAC;AAAA,EACnD,CAAC;AACD,SAAO;AAAA,IACL,GAAG,MAAM,GAAG,MAAM,IAAI;AAAA,IACtB,GAAG,MAAM;AAAA,IACT,GAAG;AAAA,IACH,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG;AAAA,IACH,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX,EAAE,KAAK,IAAI;AACb;AAUO,SAAS,WAAW,QAA2B;AACpD,QAAM,aAAa,OAAO,KAAK,OAAO,MAAM;AAC5C,QAAM,SAAS,WAAW,IAAI,CAAC,SAAS,WAAW,OAAO,OAAO,IAAI,GAAI,MAAM,CAAC;AAChF,QAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MAAS;AAChE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAMa,IAAI;AAAA;AAAA;AAAA;AAAA;AAK1B;;;ACiBO,SAAS,cAMd,QACyD;AACzD,SAAO,EAAE,WAAW,WAAW,GAAG,OAAO;AAC3C;;;ACxCA,SAAS,UAAqC,QAAW;AACvD,SAAO,SAAmC,MAAc,SAA4B;AAClF,WAAO,EAAE,WAAW,SAAS,QAAQ,MAAM,QAAQ;AAAA,EACrD;AACF;AAcO,IAAM,QAAQ;AAAA,EACnB,KAAK,UAAU,KAAK;AAAA,EACpB,MAAM,UAAU,MAAM;AAAA,EACtB,KAAK,UAAU,KAAK;AAAA,EACpB,OAAO,UAAU,OAAO;AAAA,EACxB,QAAQ,UAAU,QAAQ;AAC5B;AAkBO,SAAS,iBACd,UACA,QACkB;AAClB,SAAO,EAAE,WAAW,cAAc,UAAU,OAAO;AACrD;;;ACzGO,SAAS,iBAAiB,IAA0C;AACzE,SAAO;AACT;;;ACpBO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YAAY,QAAgB,OAAe,kBAA0B,MAAgB;AACnF,UAAM,gBAAgB;AACtB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,mBAAmB;AACxB,QAAI,SAAS,QAAW;AACtB,WAAK,OAAO;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,WAML;AACA,UAAM,SAMF;AAAA,MACF,OAAO,KAAK;AAAA,MACZ,mBAAmB,KAAK;AAAA,MACxB,QAAQ,KAAK;AAAA,IACf;AACA,QAAI,WAAW;AACb,aAAO,aAAa;AAAA,IACtB;AACA,QAAI,KAAK,SAAS,QAAW;AAC3B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;;;ACjBA,IAAM,oBAAoB;AAG1B,IAAM,kBAAkB;AAAA,EACtB,OAAO;AAAA,EACP,SAAS;AAAA,EACT,SAAS;AACX;AAoBO,SAAS,aACd,QACgC;AAChC,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,KAAK,MAAM,IAAI;AAC7C,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI,CAAC,kBAAkB,KAAK,OAAO,IAAI,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,wBAAwB,OAAO,IAAI;AAAA,IACrC;AAAA,EACF;AAEA,MAAI,OAAO,UAAU,WAAc,OAAO,QAAQ,KAAK,CAAC,OAAO,UAAU,OAAO,KAAK,IAAI;AACvF,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,MAAI,OAAO,YAAY,UAAa,OAAO,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,MACE,OAAO,YAAY,UACnB,CAAC,CAAC,eAAe,UAAU,OAAO,EAAE,SAAS,OAAO,OAAO,GAC3D;AACA,UAAM,IAAI,MAAM,6BAA6B,OAAO,OAAO,EAAE;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,OAAO,OAAO,SAAS,gBAAgB;AAAA,IACvC,SAAS,OAAO,WAAW,gBAAgB;AAAA,IAC3C,SAAS,OAAO,WAAW,gBAAgB;AAAA,IAC3C,SAAS,OAAO;AAAA,EAClB;AACF;;;ACjFA,IAAM,iBAAiB;AAGvB,IAAM,sBAAsB;AAG5B,IAAM,eAAe;AAAA,EACnB,SAAS;AACX;AAOA,SAAS,uBAAuB,YAAmC;AACjE,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,IAAI;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,4BAA4B,OAAO,6DAA6D,MAAM,MAAM;AAAA,EACrH;AAEA,QAAM,aAAa,CAAC,UAAU,QAAQ,gBAAgB,SAAS,aAAa;AAC5E,QAAM,cAAkC;AAAA,IACtC,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,CAAC;AAAA,EACP;AAEA,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC;AAEhC,UAAM,QAAQ,kBAAkB,OAAO,MAAM,KAAK,GAAG;AACrD,QAAI,UAAU,MAAM;AAClB,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBACP,OACA,MACA,KACA,KACe;AAEf,QAAM,YAAY,MAAM,MAAM,GAAG;AACjC,aAAW,QAAQ,WAAW;AAE5B,UAAM,YAAY,KAAK,MAAM,GAAG;AAChC,QAAI,UAAU,SAAS,GAAG;AACxB,aAAO,WAAW,IAAI,YAAY,KAAK;AAAA,IACzC;AAEA,UAAM,OAAO,UAAU,CAAC;AACxB,UAAM,OAAO,UAAU,CAAC;AAExB,QAAI,SAAS,QAAW;AACtB,YAAM,UAAU,OAAO,IAAI;AAC3B,UAAI,CAAC,OAAO,UAAU,OAAO,KAAK,UAAU,GAAG;AAC7C,eAAO,yBAAyB,IAAI,YAAY,KAAK;AAAA,MACvD;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB;AAAA,IACF;AAGA,QAAI,KAAK,SAAS,GAAG,GAAG;AACtB,YAAM,aAAa,KAAK,MAAM,GAAG;AACjC,UAAI,WAAW,WAAW,GAAG;AAC3B,eAAO,oBAAoB,IAAI,YAAY,KAAK;AAAA,MAClD;AACA,YAAM,aAAa,OAAO,WAAW,CAAC,CAAC;AACvC,YAAM,WAAW,OAAO,WAAW,CAAC,CAAC;AACrC,UACE,CAAC,OAAO,UAAU,UAAU,KAC5B,CAAC,OAAO,UAAU,QAAQ,KAC1B,aAAa,OACb,WAAW,OACX,aAAa,UACb;AACA,eAAO,oBAAoB,IAAI,YAAY,KAAK;AAAA,MAClD;AACA;AAAA,IACF;AAGA,UAAM,MAAM,OAAO,IAAI;AACvB,QAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,OAAO,MAAM,KAAK;AACpD,aAAO,oBAAoB,IAAI,YAAY,KAAK;AAAA,IAClD;AAAA,EACF;AAEA,SAAO;AACT;AAoBO,SAAS,UAAU,QAAsC;AAC9D,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,KAAK,MAAM,IAAI;AAC7C,UAAM,IAAI,MAAM,sBAAsB;AAAA,EACxC;AAEA,MAAI,CAAC,eAAe,KAAK,OAAO,IAAI,GAAG;AACrC,UAAM,IAAI;AAAA,MACR,qBAAqB,OAAO,IAAI;AAAA,IAClC;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,YAAY,OAAO,SAAS,KAAK,MAAM,IAAI;AACrD,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,YAAY,uBAAuB,OAAO,QAAQ;AACxD,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,MAAM,SAAS;AAAA,EAC3B;AAEA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI,OAAO,YAAY,UAAa,OAAO,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,MAAI,OAAO,YAAY,UAAa,CAAC,OAAO,UAAU,OAAO,OAAO,GAAG;AACrE,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AAEA,MAAI,OAAO,YAAY,UAAa,OAAO,UAAU,qBAAqB;AACxE,UAAM,IAAI;AAAA,MACR,eAAe,OAAO,OAAO,qBAAqB,mBAAmB;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,UAAU,OAAO,SAAS,KAAK;AAAA,IAC/B,SAAS,OAAO,WAAW,aAAa;AAAA,IACxC,SAAS,OAAO;AAAA,EAClB;AACF;;;ACrEA,IAAM,qBAAqB;AAsCpB,SAAS,cACd,QACuB;AACvB,MAAI,cAAc,QAAQ;AACxB,WAAO,wBAAwB,MAAM;AAAA,EACvC;AACA,SAAO,sBAAsB,MAAM;AACrC;AAEA,SAAS,wBACP,QAC4B;AAC5B,MAAI,CAAC,OAAO,UAAU;AACpB,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,QAAM,iBAAoC;AAAA,IACxC;AAAA,IAAU;AAAA,IAAU;AAAA,IAAU;AAAA,IAAY;AAAA,IAAS;AAAA,IAAW;AAAA,EAChE;AACA,MAAI,CAAC,eAAe,SAAS,OAAO,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR,6BAA6B,OAAO,QAAQ,qBAAqB,eAAe,KAAK,IAAI,CAAC;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,MAAM,yDAA2D;AAAA,EAC7E;AAEA,MAAI,OAAO,OAAO,OAAO,QAAQ,YAAY,OAAO,OAAO,IAAI,KAAK,MAAM,IAAI;AAC5E,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAEA,MAAI,CAAC,OAAO,UAAU,OAAO,KAAK,OAAO,MAAM,EAAE,WAAW,GAAG;AAC7D,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,aAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChE,QAAI,OAAO,YAAY,YAAY;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,sBAAsB;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB;AACF;AAEA,SAAS,sBAAsB,QAAoD;AACjF,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,KAAK,MAAM,IAAI;AAC7C,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,MAAI,CAAC,mBAAmB,KAAK,OAAO,IAAI,GAAG;AACzC,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,IAAI;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AAEA,MAAI,OAAO,OAAO,YAAY,YAAY;AACxC,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,MAAI,OAAO,WAAW,UAAa,OAAO,OAAO,WAAW,YAAY;AACtE,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,EAClB;AACF;;;ACxLO,IAAe,WAAf,MAAwB;AAAA;AAAA,EAE7B,OAAO;AAOT;AAWA,SAAS,WAAW,OAAsC;AACxD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAY,QAAO;AACrE,QAAM,UAAW,MAAgC;AACjD,SAAO,YAAY,UAAa,MAAM,QAAQ,OAAO;AACvD;AAYA,IAAM,WAA4B,CAAC;AAO5B,SAAS,mBAAmB,UAA0B;AAC3D,WAAS,KAAK,EAAE,UAAU,QAAQ,MAAM,CAAC;AAC3C;AAGA,SAAS,gBAAgB,UAAuC;AAC9D,QAAM,OAAgB,SAAS;AAC/B,SAAO,WAAW,IAAI,IAAK,KAAK,WAAW,CAAC,IAAK,CAAC;AACpD;AASA,eAAsB,kBAAkB,QAA+C;AACrF,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAQ;AAClB,UAAM,UAAU,gBAAgB,MAAM,QAAQ;AAC9C,UAAM,MAA8B,CAAC;AACrC,eAAW,QAAQ,SAAS;AAC1B,YAAM,QAAQ,OAAO,IAAI;AACzB,UAAI,UAAU,QAAW;AACvB,cAAM,IAAI;AAAA,UACR,YAAY,MAAM,SAAS,YAAY,IAAI,qBAAqB,IAAI,yDAC9B,IAAI;AAAA,QAC5C;AAAA,MACF;AACA,UAAI,IAAI,IAAI;AAAA,IACd;AACA,UAAM,MAAM,SAAS,KAAK,GAAG;AAC7B,UAAM,SAAS;AAAA,EACjB;AACF;AAOA,eAAsB,sBAAqC;AACzD,WAAS,IAAI,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG;AAChD,UAAM,QAAQ,SAAS,CAAC;AACxB,QAAI,MAAM,UAAU,MAAM,SAAS,UAAU;AAC3C,YAAM,MAAM,SAAS,SAAS;AAAA,IAChC;AAAA,EACF;AACA,WAAS,SAAS;AACpB;;;ACnCO,IAAM,OAAO;AAAA,EAClB,cAAc,SAAwE;AACpF,WAAO,EAAE,QAAQ,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,EAC1D;AAAA,EAEA,SAAS,SAA8D;AACrE,WAAO,EAAE,QAAQ,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,EAC1D;AAAA,EAEA,UAAU,SAAgE;AACxE,WAAO,EAAE,QAAQ,QAAQ,OAAO,iBAAiB,QAAQ;AAAA,EAC3D;AAAA,EAEA,gBAAgB,SAA4E;AAC1F,WAAO,EAAE,QAAQ,QAAQ,OAAO,uBAAuB,QAAQ;AAAA,EACjE;AACF;AAIO,IAAM,UAAU;AAAA,EACrB,eAAe,SAA0E;AACvF,WAAO,EAAE,QAAQ,WAAW,OAAO,iBAAiB,QAAQ;AAAA,EAC9D;AAAA,EAEA,cAAc,SAAwE;AACpF,WAAO,EAAE,QAAQ,WAAW,OAAO,gBAAgB,QAAQ;AAAA,EAC7D;AACF;AAIO,IAAM,YAAY;AAAA,EACvB,kBAAkB,SAAgF;AAChG,WAAO,EAAE,QAAQ,aAAa,OAAO,oBAAoB,QAAQ;AAAA,EACnE;AAAA,EAEA,kBAAkB,SAAgF;AAChG,WAAO,EAAE,QAAQ,aAAa,OAAO,oBAAoB,QAAQ;AAAA,EACnE;AAAA,EAEA,kBAAkB,SAAgF;AAChG,WAAO,EAAE,QAAQ,aAAa,OAAO,oBAAoB,QAAQ;AAAA,EACnE;AACF;;;AC0BA,SAAS,SAAS;","names":[]}
+{"version":3,"sources":["../src/db/env-gen.ts","../src/decorators/controller.ts","../src/decorators/registry.ts","../src/decorators/methods.ts","../src/decorators/params.ts","../src/middleware.ts","../src/errors.ts","../src/worker.ts","../src/job.ts","../src/webhook.ts","../src/resource.ts","../src/hooks.ts","../src/index.ts"],"sourcesContent":["/**\n * env-gen.ts — generate the `palbase-env.d.ts` text from a `defineSchema()`\n * result.\n *\n * The CLI (`palbase serve` / codegen) and the deploy pipeline call\n * {@link makeEnvDts} with the project's schema and write the returned string to\n * `palbase-env.d.ts` at the project root. That file AUGMENTS the\n * `@palbase/backend/env` `Tables` interface (controlled global augmentation,\n * C5) so `Database.tables.<name>` is typed with no import and no generic.\n *\n * The output is FLAT: each table gets a `{ row: {...}; insert: {...} }` entry\n * with plain TypeScript object types. The phantom `ColumnBuilder<...>` type\n * NEVER appears in the generated `.d.ts` — that type only lives at authoring\n * time inside `db/schema.ts`.\n */\n\nimport type { ColumnDef } from \"./columns.js\";\nimport type { SchemaDef, TableDef } from \"./schema.js\";\n\n/** The TypeScript value type for a column, ignoring nullability (added by the\n * caller). Mirrors the `ColValue` mapped type in columns.ts exactly. */\nfunction baseTsType(def: ColumnDef): string {\n  switch (def.type) {\n    case \"uuid\":\n    case \"text\":\n    case \"timestamp\":\n      return \"string\";\n    case \"integer\":\n      return \"number\";\n    case \"boolean\":\n      return \"boolean\";\n    case \"jsonb\":\n      return \"unknown\";\n    case \"enum\": {\n      const values = def.enumValues ?? [];\n      if (values.length === 0) return \"string\";\n      return values.map((v) => JSON.stringify(v)).join(\" | \");\n    }\n    default:\n      return \"unknown\";\n  }\n}\n\n/** The full row type for a column: base type, `| null` when nullable. */\nfunction rowType(def: ColumnDef): string {\n  const base = baseTsType(def);\n  return def.nullable ? `${base} | null` : base;\n}\n\n/** True when a column may be omitted on INSERT — nullable OR has any default.\n * Mirrors `ColIsOptionalOnInsert` in columns.ts. */\nfunction optionalOnInsert(def: ColumnDef): boolean {\n  return (\n    def.nullable === true ||\n    def.defaultRandom === true ||\n    def.defaultNow === true ||\n    def.defaultValue !== undefined\n  );\n}\n\n/** Emit the `row: {...}` and `insert: {...}` blocks for one table at the given\n * base indentation. */\nfunction tableBlock(table: TableDef, indent: string): string {\n  const cols = Object.entries(table.columns);\n  const rowLines = cols.map(([col, builder]) => {\n    return `${indent}    ${col}: ${rowType(builder._def)};`;\n  });\n  const insertLines = cols.map(([col, builder]) => {\n    const def = builder._def;\n    const opt = optionalOnInsert(def) ? \"?\" : \"\";\n    return `${indent}    ${col}${opt}: ${rowType(def)};`;\n  });\n  return [\n    `${indent}${table.name}: {`,\n    `${indent}  row: {`,\n    ...rowLines,\n    `${indent}  };`,\n    `${indent}  insert: {`,\n    ...insertLines,\n    `${indent}  };`,\n    `${indent}};`,\n  ].join(\"\\n\");\n}\n\n/**\n * Generate the full `palbase-env.d.ts` text for a schema.\n *\n * @example\n * import { makeEnvDts } from \"@palbase/backend\";\n * import schema from \"./db/schema.js\";\n * writeFileSync(\"palbase-env.d.ts\", makeEnvDts(schema));\n */\nexport function makeEnvDts(schema: SchemaDef): string {\n  const tableNames = Object.keys(schema.tables);\n  const blocks = tableNames.map((name) => tableBlock(schema.tables[name]!, \"    \"));\n  const body = blocks.length > 0 ? `\\n${blocks.join(\"\\n\")}\\n  ` : \"\";\n  return `// AUTO-GENERATED by @palbase/backend — DO NOT EDIT.\n// Regenerated from db/schema.ts on every \\`palbase serve\\` / deploy.\n// Augments the @palbase/backend/env \\`Tables\\` interface so \\`Database.tables.*\\`\n// is typed with no import and no generic.\n\ndeclare module \"@palbase/backend/env\" {\n  interface Tables {${body}}\n}\n\nexport {};\n`;\n}\n","// `@Controller(basePath, options?)` — the class decorator that marks a class as\n// a Palbase backend controller. It stamps a non-enumerable `__palbase`\n// discriminant + the resolved controller metadata onto the class so the\n// deploy/dispatch pipeline (and `isController`/`resolveController`) can detect\n// and read it without `reflect-metadata`.\nimport type { AuthSpec } from \"../endpoint.js\";\n\n/** The controller metadata stamped onto a `@Controller`-decorated class. The\n * default export of a `controllers/*.controller.ts` file resolves to this via\n * {@link resolveController}. */\nexport interface ControllerMeta {\n  /** Discriminant the runtime + tooling read. */\n  readonly __palbase: \"controller\";\n  /** The base path every route in this controller mounts under (e.g. \"/todos\"). */\n  basePath: string;\n  /** Controller-level default auth, applied to routes that don't set their own\n   * (`@Get(\"/x\", { auth })` overrides this). `undefined` ⇒ secure-by-default. */\n  defaultAuth?: AuthSpec;\n}\n\n/** Options accepted by `@Controller`. */\nexport interface ControllerOptions {\n  /** Default auth for ALL routes in this controller (route-level overrides). */\n  auth?: AuthSpec;\n}\n\n/** Symbol the controller metadata is stamped under. Symbol-keyed (not a string\n * property) so it never collides with an authored member and stays off the\n * structural surface. */\nexport const CONTROLLER_META: unique symbol = Symbol.for(\"palbase.backend.controllerMeta\");\n\n/** A class carrying the stamped controller metadata + discriminant. */\ninterface ControllerCarrier {\n  __palbase?: \"controller\";\n  [CONTROLLER_META]?: ControllerMeta;\n}\n\n/**\n * Mark a class as a Palbase backend controller. `basePath` is the mount path\n * for every route the class declares; `options.auth` sets the controller-level\n * default auth (a route's own `auth` overrides it; absent ⇒ secure-by-default).\n *\n * @example\n * \\@Controller(\"/todos\", { auth: false })\n * export class TodosController {\n *   \\@Get(\"\") list(\\@Query(ListTodosQuery) q: ListTodosQuery): TodoSchema[] { … }\n * }\n */\nexport function Controller(basePath: string, options: ControllerOptions = {}) {\n  return function <T extends abstract new (...args: never[]) => object>(ctor: T): T {\n    const carrier = ctor as unknown as ControllerCarrier;\n    const meta: ControllerMeta = {\n      __palbase: \"controller\",\n      basePath,\n      ...(options.auth !== undefined ? { defaultAuth: options.auth } : {}),\n    };\n    // Non-enumerable so it doesn't leak onto instances / structural checks.\n    Object.defineProperty(carrier, CONTROLLER_META, {\n      value: meta,\n      enumerable: false,\n      configurable: true,\n      writable: false,\n    });\n    // The bare `__palbase` discriminant is the cheap detection marker the\n    // runtime/extractor checks; keep it readable but non-enumerable.\n    Object.defineProperty(carrier, \"__palbase\", {\n      value: \"controller\",\n      enumerable: false,\n      configurable: true,\n      writable: false,\n    });\n    return ctor;\n  };\n}\n\n/** True when `value` is a `@Controller`-decorated class (cheap discriminant\n * check). Accepts the class constructor (the default export of a controller\n * file). */\nexport function isController(value: unknown): boolean {\n  if (typeof value !== \"function\" && (typeof value !== \"object\" || value === null)) {\n    return false;\n  }\n  const carrier = value as ControllerCarrier;\n  return carrier.__palbase === \"controller\" && carrier[CONTROLLER_META] !== undefined;\n}\n\n/** Read the resolved controller metadata off a `@Controller`-decorated class.\n * Throws if the class was not decorated — callers should gate with\n * {@link isController} first (the loader does). */\nexport function resolveController(ctor: unknown): ControllerMeta {\n  if (typeof ctor !== \"function\" && (typeof ctor !== \"object\" || ctor === null)) {\n    throw new TypeError(\"resolveController: value is not a class\");\n  }\n  const meta = (ctor as ControllerCarrier)[CONTROLLER_META];\n  if (!meta) {\n    throw new TypeError(\n      \"resolveController: class is not a @Controller — every controller file must `export default` a @Controller-decorated class\",\n    );\n  }\n  return meta;\n}\n","// The decorator registry — the single plain-data store the method + parameter\n// decorators write into, and the deploy/dispatch pipeline reads back. No\n// `reflect-metadata`, no `emitDecoratorMetadata`: the registry is built from the\n// decorator arguments + the parameter INDEX that esbuild/tsc preserve for legacy\n// parameter decorators (verified — see the design spec §0/§4.1).\n//\n// A controller class carries its route metadata on a symbol-keyed static\n// property (`ROUTES`). `@Get`/`@Post`/… append a {@link RouteMeta} entry;\n// `@Body`/`@User`/… append a {@link ParamMeta} entry onto the route for the\n// method they decorate. Because parameter decorators run BEFORE the method\n// decorator for the same member (TS evaluates innermost-first, params before the\n// method), the route entry may not exist yet when a param decorator fires — so\n// param metadata is buffered per method name and merged when the method\n// decorator creates the route entry.\nimport type { AuthSpec, RateLimitConfig } from \"../endpoint.js\";\nimport type { ZodTypeAny } from \"zod\";\n\n/** The HTTP verbs a route may declare, upper-cased (the runtime router +\n * OpenAPI lower-case on their own). */\nexport type HttpMethodUpper = \"GET\" | \"POST\" | \"PUT\" | \"PATCH\" | \"DELETE\";\n\n/** Route-level options accepted by the method decorators (`@Get`/`@Post`/…). */\nexport interface RouteOptions {\n  /** OVERRIDES the controller-level default auth for this one route. */\n  auth?: AuthSpec;\n  /** Per-route rate limit. */\n  rateLimit?: RateLimitConfig;\n}\n\n/** The kind of value a parameter decorator injects. Drives both dispatch\n * (which request slice to inject) and codegen (which OpenAPI parameter source a\n * schema-bearing kind maps to). */\nexport type ParamKind =\n  | \"body\"\n  | \"query\"\n  | \"param\"\n  | \"headers\"\n  | \"user\"\n  | \"optionalUser\"\n  | \"client\"\n  | \"requestId\"\n  | \"traceId\"\n  | \"req\";\n\n/** One parameter decorator's recorded metadata. `index` is the parameter\n * position esbuild/tsc preserve; `schema` is present for the schema-bearing\n * kinds (`body`/`query`/`headers`); `name` is the path-param name for `param`. */\nexport interface ParamMeta {\n  index: number;\n  kind: ParamKind;\n  /** Zod schema for `body`/`query`/`headers` (validation + codegen source). */\n  schema?: ZodTypeAny;\n  /** Path-param name for `@Param(\"id\")`. */\n  name?: string;\n}\n\n/** One route's recorded metadata: the verb + subpath + method name + options,\n * the ordered parameter metas, and the resolved return schema (injected by the\n * codegen step — see `returnSchema`). */\nexport interface RouteMeta {\n  method: HttpMethodUpper;\n  subpath: string;\n  fnName: string;\n  options: RouteOptions;\n  params: ParamMeta[];\n  /** Response schema for the route, if any. Derived from the method's RETURN\n   * TYPE by codegen and written here via `recordReturn` (a generated top-level\n   * IIFE injected per controller), not by an author-written decorator. */\n  returnSchema?: ZodTypeAny;\n}\n\n/** Symbol the route metadata list is stored under on a controller class. Using\n * a symbol (not a string key) keeps it off the public structural surface and\n * avoids any chance of an authored property collision. */\nexport const ROUTES: unique symbol = Symbol.for(\"palbase.backend.routes\");\n\n/** Symbol the per-method buffered parameter metas are stored under while a class\n * is being decorated. Parameter decorators fire before the method decorator, so\n * they buffer here keyed by method name; the method decorator drains the buffer\n * into the route entry it creates. */\nconst PARAM_BUFFER: unique symbol = Symbol.for(\"palbase.backend.paramBuffer\");\n\n/** Symbol the per-method buffered return-type schemas are stored under while a\n * class's registry is being populated. The codegen-injected `recordReturn` call\n * can fire before OR after the method decorator; it buffers here keyed by method\n * name and `recordRoute` drains it into the route entry (and `recordReturn`\n * writes through if the route already exists). Buffering on BOTH sides means a\n * fully-formed route entry always carries its return schema — a raw-symbol\n * reader (the runtime) never has to re-merge. */\nconst RETURN_BUFFER: unique symbol = Symbol.for(\"palbase.backend.returnBuffer\");\n\n/** A class constructor carrying the symbol-keyed registry slots. We type the\n * registry-bearing class as this so the decorators can read/write the slots\n * without `any` — a plain `Function` does not carry index signatures. */\ninterface RegistryCarrier {\n  [ROUTES]?: RouteMeta[];\n  [PARAM_BUFFER]?: Record<string, ParamMeta[]>;\n  [RETURN_BUFFER]?: Record<string, ZodTypeAny>;\n}\n\n/** Coerce a decorated target (class constructor or its prototype) into the\n * registry carrier that owns the slots. Method/param decorators receive the\n * PROTOTYPE as their target; the class decorator receives the constructor. We\n * always anchor the registry on the CONSTRUCTOR so `getRoutes(ctor)` finds it. */\nfunction carrierOf(target: object): RegistryCarrier {\n  // For instance-member decorators, `target` is the prototype; its `.constructor`\n  // is the class. For a static member or the class decorator, `target` is the\n  // constructor already. Resolve to the constructor either way.\n  const ctor =\n    typeof target === \"function\"\n      ? (target as unknown as RegistryCarrier)\n      : (((target as { constructor?: unknown }).constructor ??\n          target) as unknown as RegistryCarrier);\n  return ctor;\n}\n\n/** Get (creating if absent) the own route list for a class constructor. Own —\n * not inherited — so a subclass does not mutate its base's routes. */\nfunction ownRoutes(carrier: RegistryCarrier): RouteMeta[] {\n  if (!Object.prototype.hasOwnProperty.call(carrier, ROUTES)) {\n    carrier[ROUTES] = [];\n  }\n  return carrier[ROUTES] as RouteMeta[];\n}\n\n/** Get (creating if absent) the own per-method param buffer for a class. */\nfunction ownParamBuffer(carrier: RegistryCarrier): Record<string, ParamMeta[]> {\n  if (!Object.prototype.hasOwnProperty.call(carrier, PARAM_BUFFER)) {\n    carrier[PARAM_BUFFER] = {};\n  }\n  return carrier[PARAM_BUFFER] as Record<string, ParamMeta[]>;\n}\n\n/** Record a route (called by the method decorators). Drains any parameter\n * metas already buffered for `fnName` into the new route entry, then sorts them\n * by parameter index so dispatch can inject positionally. */\nexport function recordRoute(\n  target: object,\n  fnName: string,\n  method: HttpMethodUpper,\n  subpath: string,\n  options: RouteOptions,\n): void {\n  const carrier = carrierOf(target);\n  const routes = ownRoutes(carrier);\n  const buffer = ownParamBuffer(carrier);\n  const params = (buffer[fnName] ?? []).slice().sort((a, b) => a.index - b.index);\n  const route: RouteMeta = { method, subpath, fnName, options, params };\n  // Drain a buffered return schema (the recordReturn-ran-first ordering) so the\n  // route entry is complete the moment it's created — a raw-symbol consumer\n  // (the runtime extractor/worker) sees the return schema without re-merging.\n  const returnBuffer = carrier[RETURN_BUFFER];\n  if (returnBuffer && returnBuffer[fnName] !== undefined) {\n    route.returnSchema = returnBuffer[fnName];\n  }\n  routes.push(route);\n}\n\n/** Record one parameter decorator (called by `@Body`/`@User`/…). Buffers per\n * method name; the method decorator merges the buffer into the route entry. If\n * the route already exists (method decorator ran first — TS does evaluate the\n * method decorator AFTER its parameter decorators, but we stay order-robust),\n * the meta is also appended directly so neither ordering loses it. */\nexport function recordParam(target: object, fnName: string, meta: ParamMeta): void {\n  const carrier = carrierOf(target);\n  const buffer = ownParamBuffer(carrier);\n  (buffer[fnName] ??= []).push(meta);\n\n  // Order-robust: if the route already exists, merge in place + keep sorted.\n  const routes = carrier[ROUTES];\n  if (routes) {\n    const route = routes.find((r) => r.fnName === fnName);\n    if (route) {\n      route.params.push(meta);\n      route.params.sort((a, b) => a.index - b.index);\n    }\n  }\n}\n\n/** Attach a return schema to the route for `fnName` (called by the codegen\n * injection that reads the method's return type). If the route does not exist\n * yet, the schema is buffered (RETURN_BUFFER) and drained into the route by\n * `recordRoute` when the method decorator runs. */\nexport function recordReturn(target: object, fnName: string, schema: ZodTypeAny): void {\n  const carrier = carrierOf(target);\n  const routes = carrier[ROUTES];\n  const route = routes?.find((r) => r.fnName === fnName);\n  if (route) {\n    route.returnSchema = schema;\n    return;\n  }\n  if (!Object.prototype.hasOwnProperty.call(carrier, RETURN_BUFFER)) {\n    carrier[RETURN_BUFFER] = {};\n  }\n  const returnBuffer = carrier[RETURN_BUFFER];\n  if (returnBuffer) returnBuffer[fnName] = schema;\n}\n\n/** Read the route metadata for a controller class (the deploy/dispatch entry\n * point). Applies any buffered return schemas (for the recordReturn-runs-before\n * ordering) and returns a defensive copy so callers cannot mutate the registry.\n */\nexport function getRoutes(ctor: object): RouteMeta[] {\n  const carrier = carrierOf(ctor);\n  const routes = carrier[ROUTES] ?? [];\n  const returnBuffer = carrier[RETURN_BUFFER];\n  if (returnBuffer) {\n    for (const route of routes) {\n      const buffered = returnBuffer[route.fnName];\n      if (buffered && route.returnSchema === undefined) {\n        route.returnSchema = buffered;\n      }\n    }\n  }\n  return routes.map((r) => ({ ...r, params: r.params.slice() }));\n}\n","// Method decorators: `@Get` / `@Post` / `@Put` / `@Patch` / `@Delete` declare a\n// route (verb + subpath + options) on a controller method. These are LEGACY\n// method decorators (`experimentalDecorators`), receiving\n// `(prototype, methodName, descriptor)`. They write into the per-class registry\n// (registry.ts). The success-response schema is NOT declared here: it is derived\n// from the method's RETURN TYPE by a codegen step and injected onto the route at\n// runtime via `recordReturn` (registry.ts).\nimport {\n  recordRoute,\n  type HttpMethodUpper,\n  type RouteOptions,\n} from \"./registry.js\";\n\n/** A legacy method decorator. */\ntype MethodDecorator = (\n  target: object,\n  propertyKey: string | symbol,\n  descriptor: PropertyDescriptor,\n) => void;\n\n/** Build a method decorator for one HTTP verb. The decorated method's name is\n * the route `fnName` (authoring sugar — the operationId is derived flat from\n * method+path by the runtime, not from this name). */\nfunction makeMethodDecorator(method: HttpMethodUpper) {\n  return function (subpath: string, options: RouteOptions = {}): MethodDecorator {\n    return function (target, propertyKey) {\n      recordRoute(target, String(propertyKey), method, subpath, options);\n    };\n  };\n}\n\n/** `@Get(subpath, options?)` — declare a GET route. */\nexport const Get = makeMethodDecorator(\"GET\");\n/** `@Post(subpath, options?)` — declare a POST route. */\nexport const Post = makeMethodDecorator(\"POST\");\n/** `@Put(subpath, options?)` — declare a PUT route. */\nexport const Put = makeMethodDecorator(\"PUT\");\n/** `@Patch(subpath, options?)` — declare a PATCH route. */\nexport const Patch = makeMethodDecorator(\"PATCH\");\n/** `@Delete(subpath, options?)` — declare a DELETE route. */\nexport const Delete = makeMethodDecorator(\"DELETE\");\n","// Parameter decorators: `@Body` / `@Query` / `@Param` / `@Headers` / `@User` /\n// `@OptionalUser` / `@Client` / `@RequestId` / `@TraceId` / `@Req`. Each records\n// `{ index, kind, schema?, name? }` into the per-class registry for the method\n// it decorates. These are LEGACY parameter decorators\n// (`experimentalDecorators`), receiving `(prototype, methodName, paramIndex)` —\n// esbuild/tsc preserve the param index at runtime (verified, design §0), which\n// is how dispatch injects positionally. No type reflection\n// (`emitDecoratorMetadata`) is used: validation comes from the zod schema, the\n// type annotation the developer writes is purely for autocomplete.\nimport type { ZodTypeAny } from \"zod\";\nimport { recordParam, type ParamKind } from \"./registry.js\";\n\n/** A legacy parameter decorator. */\ntype ParameterDecorator = (\n  target: object,\n  propertyKey: string | symbol,\n  parameterIndex: number,\n) => void;\n\n/** Build a parameter decorator that records the given kind (+ optional schema /\n * name) at the decorated parameter's index. */\nfunction makeParamDecorator(\n  kind: ParamKind,\n  extra?: { schema?: ZodTypeAny; name?: string },\n): ParameterDecorator {\n  return function (target, propertyKey, parameterIndex) {\n    recordParam(target, String(propertyKey), {\n      index: parameterIndex,\n      kind,\n      ...(extra?.schema !== undefined ? { schema: extra.schema } : {}),\n      ...(extra?.name !== undefined ? { name: extra.name } : {}),\n    });\n  };\n}\n\n/** `@Body(schema)` — inject the request body, validated against `schema`. The\n * developer writes `: T` (= `z.infer<schema>`, same name) for autocomplete. */\nexport function Body(schema: ZodTypeAny): ParameterDecorator {\n  return makeParamDecorator(\"body\", { schema });\n}\n\n/** `@Query(schema)` — inject the parsed query params, validated against\n * `schema`. */\nexport function Query(schema: ZodTypeAny): ParameterDecorator {\n  return makeParamDecorator(\"query\", { schema });\n}\n\n/** `@Headers(schema?)` — inject the request headers (lowercase keys). With a\n * schema, headers are validated + the codegen emits header parameters. */\nexport function Headers(schema?: ZodTypeAny): ParameterDecorator {\n  return makeParamDecorator(\"headers\", schema !== undefined ? { schema } : undefined);\n}\n\n/** `@Param(\"id\")` — inject one matched path param by name. */\nexport function Param(name: string): ParameterDecorator {\n  return makeParamDecorator(\"param\", { name });\n}\n\n/** `@User()` — inject the authenticated user (`: User`, non-null for an\n * effective-required route). The runtime resolves the effective auth. */\nexport function User(): ParameterDecorator {\n  return makeParamDecorator(\"user\");\n}\n\n/** `@OptionalUser()` — inject the user as `User | null` (for routes whose\n * effective auth is `false` / `{ required: false }`). */\nexport function OptionalUser(): ParameterDecorator {\n  return makeParamDecorator(\"optionalUser\");\n}\n\n/** `@Client()` — inject the parsed calling-client metadata (`: ClientInfo`). */\nexport function Client(): ParameterDecorator {\n  return makeParamDecorator(\"client\");\n}\n\n/** `@RequestId()` — inject the per-request id (`: string`). */\nexport function RequestId(): ParameterDecorator {\n  return makeParamDecorator(\"requestId\");\n}\n\n/** `@TraceId()` — inject the W3C trace id (`: string`). */\nexport function TraceId(): ParameterDecorator {\n  return makeParamDecorator(\"traceId\");\n}\n\n/** `@Req()` — inject the raw request object (escape hatch, `: PBRequest`). */\nexport function Req(): ParameterDecorator {\n  return makeParamDecorator(\"req\");\n}\n","import type { DBClient, Logger, CacheClient, PalbaseModuleClients } from \"./endpoint.js\";\nimport type { User } from \"./types.js\";\n\n/** Middleware context — subset of EndpointContext without input (not yet validated). */\nexport interface MiddlewareContext extends PalbaseModuleClients {\n  params: Record<string, string>;\n  query: Record<string, string>;\n  headers: Record<string, string>;\n  user: User | null;\n  db: DBClient;\n  env: Record<string, string>;\n  log: Logger;\n  cache: CacheClient;\n  requestId: string;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Middleware function signature — receives context and next function. */\nexport type MiddlewareHandler = (\n  ctx: MiddlewareContext,\n  next: () => Promise<void>,\n) => Promise<void>;\n\n/**\n * Define a middleware function for use in the middleware/ directory or\n * as endpoint-specific middleware.\n *\n * Middleware runs before the handler. Call `next()` to pass control\n * to the next middleware or handler. If `next()` is not called, the\n * handler will not execute.\n *\n * Errors thrown in middleware are caught by the pipeline and returned\n * as error responses.\n */\nexport function defineMiddleware(fn: MiddlewareHandler): MiddlewareHandler {\n  return fn;\n}\n","/** HTTP error with structured error response format.\n *\n * The base class for the throwable error classes (`PalError`, `Conflict`,\n * `NotFound`, …). Construct one directly with `throw new HttpError(404,\n * \"todo_not_found\", \"No such todo\")`, or throw a named subclass\n * (`throw new NotFound(\"todo not found\")`). The runtime catches any `HttpError`\n * and emits the standard envelope; on the wire (and to iOS) it surfaces as\n * `BackendError.server(code, status, message, requestId)`.\n *\n * The optional `data` field carries a structured payload alongside the\n * standard envelope — for errors that need to ship extra context\n * (e.g. `new Conflict(\"locked\", \"title_locked\", { retryAfter: 30 })`). It rides\n * through to the iOS typed enum's associated value.\n */\nexport class HttpError extends Error {\n  public readonly status: number;\n  public readonly error: string;\n  public readonly errorDescription: string;\n  public readonly data?: unknown;\n\n  constructor(status: number, error: string, errorDescription: string, data?: unknown) {\n    super(errorDescription);\n    this.name = \"HttpError\";\n    this.status = status;\n    this.error = error;\n    this.errorDescription = errorDescription;\n    if (data !== undefined) {\n      this.data = data;\n    }\n  }\n\n  /**\n   * Serialize to the standard Palbase error response format.\n   * The `requestId` is injected by the runtime layer from the request context.\n   * When called without arguments (e.g. JSON.stringify), request_id is omitted.\n   * When `data` is set, it is appended as a strict-superset field.\n   */\n  toJSON(requestId?: string): {\n    error: string;\n    error_description: string;\n    status: number;\n    request_id?: string;\n    data?: unknown;\n  } {\n    const result: {\n      error: string;\n      error_description: string;\n      status: number;\n      request_id?: string;\n      data?: unknown;\n    } = {\n      error: this.error,\n      error_description: this.errorDescription,\n      status: this.status,\n    };\n    if (requestId) {\n      result.request_id = requestId;\n    }\n    if (this.data !== undefined) {\n      result.data = this.data;\n    }\n    return result;\n  }\n}\n\n/**\n * Throw with a custom HTTP status + wire code. The general-purpose escape hatch\n * when none of the named classes (`Conflict`/`NotFound`/…) fits.\n *\n * @example\n * throw new PalError(418, \"teapot\", \"I'm a teapot\");\n */\nexport class PalError extends HttpError {\n  constructor(status: number, code: string, description: string, data?: unknown) {\n    super(status, code, description, data);\n    this.name = \"PalError\";\n  }\n}\n\n/** Base for the named status classes. Each subclass fixes its HTTP status; the\n * `code` defaults to the class's canonical wire code (overridable), and the\n * `message` defaults to a human-readable label (overridable). */\nabstract class NamedHttpError extends HttpError {\n  protected constructor(\n    status: number,\n    defaultCode: string,\n    name: string,\n    message?: string,\n    code?: string,\n    data?: unknown,\n  ) {\n    super(status, code ?? defaultCode, message ?? defaultMessage(name), data);\n    this.name = name;\n  }\n}\n\n/** Derive a default human-readable message from a class name\n * (\"NotFound\" → \"Not found\", \"TooManyRequests\" → \"Too many requests\"). */\nfunction defaultMessage(name: string): string {\n  const spaced = name.replace(/([a-z0-9])([A-Z])/g, \"$1 $2\");\n  return spaced.charAt(0).toUpperCase() + spaced.slice(1).toLowerCase();\n}\n\n/** 400 — the request was malformed or failed validation. */\nexport class BadRequest extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(400, \"bad_request\", \"BadRequest\", message, code, data);\n  }\n}\n\n/** 401 — the caller is not authenticated. */\nexport class Unauthorized extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(401, \"unauthorized\", \"Unauthorized\", message, code, data);\n  }\n}\n\n/** 403 — the caller is authenticated but not allowed. */\nexport class Forbidden extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(403, \"forbidden\", \"Forbidden\", message, code, data);\n  }\n}\n\n/** 404 — the requested resource does not exist. */\nexport class NotFound extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(404, \"not_found\", \"NotFound\", message, code, data);\n  }\n}\n\n/** 409 — the request conflicts with the current state. */\nexport class Conflict extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(409, \"conflict\", \"Conflict\", message, code, data);\n  }\n}\n\n/** 429 — the caller has exceeded the rate limit. */\nexport class TooManyRequests extends NamedHttpError {\n  constructor(message?: string, code?: string, data?: unknown) {\n    super(429, \"too_many_requests\", \"TooManyRequests\", message, code, data);\n  }\n}\n","import type { User } from \"./types.js\";\n\n/** Non-service, per-invocation data for background worker handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface WorkerMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  /** The user that enqueued the job, if any (background jobs are usually system-initiated). */\n  user: User | null;\n  /** Per-invocation id for correlation. */\n  requestId: string;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Backoff strategy for worker retries. */\nexport type BackoffStrategy = \"exponential\" | \"linear\" | \"fixed\";\n\n/** Configuration for a background worker. */\nexport interface WorkerConfig<TPayload = unknown> {\n  /** Worker name — must be unique across the project. */\n  name: string;\n  /** Maximum number of retries before sending to dead letter queue. Defaults to 3. */\n  retry?: number;\n  /** Execution timeout in seconds. Defaults to 30. */\n  timeout?: number;\n  /** Backoff strategy between retries. Defaults to \"exponential\". */\n  backoff?: BackoffStrategy;\n  /** Handler function that processes the job payload. */\n  handler: (\n    payload: TPayload,\n    meta: WorkerMeta,\n  ) => Promise<void>;\n}\n\n/** Resolved worker configuration with defaults applied. */\nexport interface ResolvedWorkerConfig<TPayload = unknown> {\n  name: string;\n  retry: number;\n  timeout: number;\n  backoff: BackoffStrategy;\n  handler: (\n    payload: TPayload,\n    meta: WorkerMeta,\n  ) => Promise<void>;\n}\n\n/** Valid worker name pattern: alphanumeric, underscore, hyphen only.\n * Prevents Redis key injection via colons or path separators. */\nconst VALID_WORKER_NAME = /^[a-zA-Z0-9_-]+$/;\n\n/** Default values for worker configuration. */\nconst WORKER_DEFAULTS = {\n  retry: 3,\n  timeout: 30,\n  backoff: \"exponential\" as BackoffStrategy,\n} as const;\n\n/**\n * Define a background worker that processes jobs from the queue.\n *\n * Workers are placed in the `workers/` directory and auto-discovered at deploy time.\n *\n * @example\n * ```ts\n * export default defineWorker({\n *   name: \"send-email\",\n *   retry: 5,\n *   timeout: 60,\n *   backoff: \"exponential\",\n *   handler: async (payload: { to: string; subject: string }, meta) => {\n *     await sendEmail(payload.to, payload.subject);\n *   },\n * });\n * ```\n */\nexport function defineWorker<TPayload = unknown>(\n  config: WorkerConfig<TPayload>,\n): ResolvedWorkerConfig<TPayload> {\n  if (!config.name || config.name.trim() === \"\") {\n    throw new Error(\"Worker name is required\");\n  }\n\n  if (!VALID_WORKER_NAME.test(config.name)) {\n    throw new Error(\n      `Invalid worker name \"${config.name}\": must match [a-zA-Z0-9_-]+`,\n    );\n  }\n\n  if (config.retry !== undefined && (config.retry < 0 || !Number.isInteger(config.retry))) {\n    throw new Error(\"Worker retry must be a non-negative integer\");\n  }\n\n  if (config.timeout !== undefined && config.timeout <= 0) {\n    throw new Error(\"Worker timeout must be a positive number\");\n  }\n\n  if (\n    config.backoff !== undefined &&\n    ![\"exponential\", \"linear\", \"fixed\"].includes(config.backoff)\n  ) {\n    throw new Error(`Invalid backoff strategy: ${config.backoff}`);\n  }\n\n  return {\n    name: config.name,\n    retry: config.retry ?? WORKER_DEFAULTS.retry,\n    timeout: config.timeout ?? WORKER_DEFAULTS.timeout,\n    backoff: config.backoff ?? WORKER_DEFAULTS.backoff,\n    handler: config.handler,\n  };\n}\n","/** Non-service, per-invocation data for job handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface JobMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Configuration for defining a scheduled job. */\nexport interface JobConfig {\n  /** Unique job name — alphanumeric, underscore, hyphen only. */\n  name: string;\n  /** Cron expression (e.g., \"0 3 * * *\"). */\n  schedule: string;\n  /** Execution timeout in seconds. Defaults to 30. */\n  timeout?: number;\n  /** Job handler function. */\n  handler: (meta: JobMeta) => Promise<void>;\n}\n\n/** Resolved job configuration with defaults applied. */\nexport interface ResolvedJobConfig {\n  name: string;\n  schedule: string;\n  timeout: number;\n  handler: (meta: JobMeta) => Promise<void>;\n}\n\n/** Valid job name pattern: alphanumeric, underscore, hyphen only. */\nconst VALID_JOB_NAME = /^[a-zA-Z0-9_-]+$/;\n\n/** Maximum allowed timeout in seconds (5 minutes, matching sandbox limits). */\nconst MAX_TIMEOUT_SECONDS = 300;\n\n/** Default values for job configuration. */\nconst JOB_DEFAULTS = {\n  timeout: 30,\n} as const;\n\n/**\n * Cron expression validation.\n * Supports standard 5-field cron: minute hour day-of-month month day-of-week.\n * Each field allows: number, *, ranges (1-5), steps (star/2), lists (1,3,5).\n */\nfunction validateCronExpression(expression: string): string | null {\n  const trimmed = expression.trim();\n  if (trimmed === \"\") {\n    return \"Cron expression is required\";\n  }\n\n  const parts = trimmed.split(/\\s+/);\n  if (parts.length !== 5) {\n    return `Invalid cron expression \"${trimmed}\": expected 5 fields (minute hour day month weekday), got ${parts.length}`;\n  }\n\n  const fieldNames = [\"minute\", \"hour\", \"day of month\", \"month\", \"day of week\"];\n  const fieldRanges: [number, number][] = [\n    [0, 59],\n    [0, 23],\n    [1, 31],\n    [1, 12],\n    [0, 7],\n  ];\n\n  for (let i = 0; i < 5; i++) {\n    const field = parts[i]!;\n    const name = fieldNames[i]!;\n    const [min, max] = fieldRanges[i]!;\n\n    const error = validateCronField(field, name, min, max);\n    if (error !== null) {\n      return error;\n    }\n  }\n\n  return null;\n}\n\nfunction validateCronField(\n  field: string,\n  name: string,\n  min: number,\n  max: number,\n): string | null {\n  // Split by comma for lists\n  const listParts = field.split(\",\");\n  for (const part of listParts) {\n    // Check for step: */2, 1-5/2\n    const stepParts = part.split(\"/\");\n    if (stepParts.length > 2) {\n      return `Invalid ${name} field: \"${field}\"`;\n    }\n\n    const base = stepParts[0]!;\n    const step = stepParts[1];\n\n    if (step !== undefined) {\n      const stepNum = Number(step);\n      if (!Number.isInteger(stepNum) || stepNum < 1) {\n        return `Invalid step value in ${name} field: \"${field}\"`;\n      }\n    }\n\n    if (base === \"*\") {\n      continue;\n    }\n\n    // Check for range: 1-5\n    if (base.includes(\"-\")) {\n      const rangeParts = base.split(\"-\");\n      if (rangeParts.length !== 2) {\n        return `Invalid range in ${name} field: \"${field}\"`;\n      }\n      const rangeStart = Number(rangeParts[0]);\n      const rangeEnd = Number(rangeParts[1]);\n      if (\n        !Number.isInteger(rangeStart) ||\n        !Number.isInteger(rangeEnd) ||\n        rangeStart < min ||\n        rangeEnd > max ||\n        rangeStart > rangeEnd\n      ) {\n        return `Invalid range in ${name} field: \"${field}\"`;\n      }\n      continue;\n    }\n\n    // Single number\n    const num = Number(base);\n    if (!Number.isInteger(num) || num < min || num > max) {\n      return `Invalid value in ${name} field: \"${field}\"`;\n    }\n  }\n\n  return null;\n}\n\n/**\n * Define a scheduled cron job.\n *\n * Jobs are placed in the `jobs/` directory and auto-discovered at deploy time.\n *\n * @example\n * ```ts\n * export default defineJob({\n *   name: \"cleanup-expired\",\n *   schedule: \"0 3 * * *\", // every day at 3 AM\n *   timeout: 60,\n *   handler: async (meta) => {\n *     await Database.delete(\"sessions\", \"expired < NOW()\");\n *     Log.info(\"Cleaned up expired sessions\");\n *   },\n * });\n * ```\n */\nexport function defineJob(config: JobConfig): ResolvedJobConfig {\n  if (!config.name || config.name.trim() === \"\") {\n    throw new Error(\"Job name is required\");\n  }\n\n  if (!VALID_JOB_NAME.test(config.name)) {\n    throw new Error(\n      `Invalid job name \"${config.name}\": must match [a-zA-Z0-9_-]+`,\n    );\n  }\n\n  if (!config.schedule || config.schedule.trim() === \"\") {\n    throw new Error(\"Job schedule is required\");\n  }\n\n  const cronError = validateCronExpression(config.schedule);\n  if (cronError !== null) {\n    throw new Error(cronError);\n  }\n\n  if (!config.handler) {\n    throw new Error(\"Job handler is required\");\n  }\n\n  if (config.timeout !== undefined && config.timeout <= 0) {\n    throw new Error(\"Job timeout must be a positive number\");\n  }\n\n  if (config.timeout !== undefined && !Number.isInteger(config.timeout)) {\n    throw new Error(\"Job timeout must be an integer\");\n  }\n\n  if (config.timeout !== undefined && config.timeout > MAX_TIMEOUT_SECONDS) {\n    throw new Error(\n      `Job timeout ${config.timeout}s exceeds maximum ${MAX_TIMEOUT_SECONDS}s`,\n    );\n  }\n\n  return {\n    name: config.name,\n    schedule: config.schedule.trim(),\n    timeout: config.timeout ?? JOB_DEFAULTS.timeout,\n    handler: config.handler,\n  };\n}\n","/** Supported webhook provider types. */\nexport type WebhookProvider =\n  | \"stripe\"\n  | \"github\"\n  | \"twilio\"\n  | \"sendgrid\"\n  | \"slack\"\n  | \"discord\"\n  | \"livekit\";\n\n/** Non-service, per-invocation data for webhook handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface WebhookMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  /** Per-invocation id for correlation. */\n  requestId: string;\n  projectId: string;\n  environmentId: string;\n}\n\n/** Secret reference — resolves from environment variables at runtime. */\nexport interface EnvSecretRef {\n  env: string;\n}\n\n/** Provider-specific event maps for type-safe event handlers. */\nexport interface ProviderEventMap {\n  stripe: {\n    \"checkout.session.completed\": Record<string, unknown>;\n    \"payment_intent.succeeded\": Record<string, unknown>;\n    \"payment_intent.payment_failed\": Record<string, unknown>;\n    \"customer.subscription.created\": Record<string, unknown>;\n    \"customer.subscription.updated\": Record<string, unknown>;\n    \"customer.subscription.deleted\": Record<string, unknown>;\n    \"invoice.paid\": Record<string, unknown>;\n    \"invoice.payment_failed\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  github: {\n    push: Record<string, unknown>;\n    pull_request: Record<string, unknown>;\n    issues: Record<string, unknown>;\n    \"pull_request.opened\": Record<string, unknown>;\n    \"pull_request.closed\": Record<string, unknown>;\n    \"pull_request.merged\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  twilio: {\n    \"message.received\": Record<string, unknown>;\n    \"message.sent\": Record<string, unknown>;\n    \"call.completed\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  sendgrid: {\n    delivered: Record<string, unknown>;\n    bounce: Record<string, unknown>;\n    open: Record<string, unknown>;\n    click: Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  slack: {\n    url_verification: Record<string, unknown>;\n    event_callback: Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  discord: {\n    PING: Record<string, unknown>;\n    MESSAGE_CREATE: Record<string, unknown>;\n    INTERACTION_CREATE: Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n  livekit: {\n    \"room.started\": Record<string, unknown>;\n    \"room.finished\": Record<string, unknown>;\n    \"participant.joined\": Record<string, unknown>;\n    \"participant.left\": Record<string, unknown>;\n    [key: string]: Record<string, unknown>;\n  };\n}\n\n/** Event handler function type. */\nexport type WebhookEventHandler<TEvent = Record<string, unknown>> = (\n  event: TEvent,\n  meta: WebhookMeta,\n) => Promise<void>;\n\n/** Provider-based webhook configuration. */\nexport interface ProviderWebhookConfig<P extends WebhookProvider = WebhookProvider> {\n  provider: P;\n  secret: EnvSecretRef;\n  events: {\n    [K in keyof ProviderEventMap[P]]?: WebhookEventHandler<ProviderEventMap[P][K]>;\n  };\n}\n\n/** Incoming request representation for custom verify functions. */\nexport interface WebhookRequest {\n  headers: Record<string, string>;\n  body: string;\n  method: string;\n  url: string;\n}\n\n/** Custom webhook configuration. */\nexport interface CustomWebhookConfig {\n  path: string;\n  verify?: (req: WebhookRequest) => Promise<boolean> | boolean;\n  handler: (payload: Record<string, unknown>, meta: WebhookMeta) => Promise<void>;\n}\n\n/** Resolved provider webhook (internal). */\nexport interface ResolvedProviderWebhook<P extends WebhookProvider = WebhookProvider> {\n  type: \"provider\";\n  provider: P;\n  secret: EnvSecretRef;\n  events: Record<string, WebhookEventHandler>;\n}\n\n/** Resolved custom webhook (internal). */\nexport interface ResolvedCustomWebhook {\n  type: \"custom\";\n  path: string;\n  verify?: (req: WebhookRequest) => Promise<boolean> | boolean;\n  handler: (payload: Record<string, unknown>, meta: WebhookMeta) => Promise<void>;\n}\n\n/** Union of resolved webhook types. */\nexport type ResolvedWebhookConfig = ResolvedProviderWebhook | ResolvedCustomWebhook;\n\n/** Valid webhook path pattern: starts with /, alphanumeric + hyphen + slash. */\nconst VALID_WEBHOOK_PATH = /^\\/[a-zA-Z0-9/_-]+$/;\n\n/**\n * Define a provider-based webhook.\n *\n * @example\n * ```ts\n * export default defineWebhook({\n *   provider: \"stripe\",\n *   secret: { env: \"STRIPE_WEBHOOK_SECRET\" },\n *   events: {\n *     \"checkout.session.completed\": async (event, meta) => {\n *       await Database.insert(\"orders\", { status: \"paid\" });\n *     },\n *   },\n * });\n * ```\n */\nexport function defineWebhook<P extends WebhookProvider>(\n  config: ProviderWebhookConfig<P>,\n): ResolvedProviderWebhook<P>;\n\n/**\n * Define a custom webhook with optional verification.\n *\n * @example\n * ```ts\n * export default defineWebhook({\n *   path: \"/webhooks/livekit\",\n *   verify: async (req) => req.headers[\"x-api-key\"] === \"secret\",\n *   handler: async (payload, meta) => {\n *     Log.info(\"Received webhook\", payload);\n *   },\n * });\n * ```\n */\nexport function defineWebhook(config: CustomWebhookConfig): ResolvedCustomWebhook;\n\nexport function defineWebhook(\n  config: ProviderWebhookConfig | CustomWebhookConfig,\n): ResolvedWebhookConfig {\n  if (\"provider\" in config) {\n    return validateProviderWebhook(config);\n  }\n  return validateCustomWebhook(config);\n}\n\nfunction validateProviderWebhook<P extends WebhookProvider>(\n  config: ProviderWebhookConfig<P>,\n): ResolvedProviderWebhook<P> {\n  if (!config.provider) {\n    throw new Error(\"Webhook provider is required\");\n  }\n\n  const validProviders: WebhookProvider[] = [\n    \"stripe\", \"github\", \"twilio\", \"sendgrid\", \"slack\", \"discord\", \"livekit\",\n  ];\n  if (!validProviders.includes(config.provider)) {\n    throw new Error(\n      `Invalid webhook provider \"${config.provider}\": must be one of ${validProviders.join(\", \")}`,\n    );\n  }\n\n  if (!config.secret) {\n    throw new Error(\"Webhook secret is required (use { env: \\\"SECRET_NAME\\\" })\");\n  }\n\n  if (typeof config.secret.env !== \"string\" || config.secret.env.trim() === \"\") {\n    throw new Error(\"Webhook secret env name must be a non-empty string\");\n  }\n\n  if (!config.events || Object.keys(config.events).length === 0) {\n    throw new Error(\"At least one event handler is required\");\n  }\n\n  for (const [eventName, handler] of Object.entries(config.events)) {\n    if (typeof handler !== \"function\") {\n      throw new Error(`Event handler for \"${eventName}\" must be a function`);\n    }\n  }\n\n  return {\n    type: \"provider\",\n    provider: config.provider,\n    secret: config.secret,\n    events: config.events as Record<string, WebhookEventHandler>,\n  };\n}\n\nfunction validateCustomWebhook(config: CustomWebhookConfig): ResolvedCustomWebhook {\n  if (!config.path || config.path.trim() === \"\") {\n    throw new Error(\"Webhook path is required\");\n  }\n\n  if (!VALID_WEBHOOK_PATH.test(config.path)) {\n    throw new Error(\n      `Invalid webhook path \"${config.path}\": must start with / and contain only alphanumeric, hyphen, underscore, slash`,\n    );\n  }\n\n  if (!config.handler) {\n    throw new Error(\"Webhook handler is required\");\n  }\n\n  if (typeof config.handler !== \"function\") {\n    throw new Error(\"Webhook handler must be a function\");\n  }\n\n  if (config.verify !== undefined && typeof config.verify !== \"function\") {\n    throw new Error(\"Webhook verify must be a function\");\n  }\n\n  return {\n    type: \"custom\",\n    path: config.path,\n    verify: config.verify,\n    handler: config.handler,\n  };\n}\n","/**\n * resource.ts — external connections as lifecycle-managed classes.\n *\n * A `Resource` subclass models one external connection (a pooled datastore, a\n * stateless API client, or a per-user factory). The framework discovers each\n * instance, calls `init(env)` ONCE at boot with the declared secret subset, and\n * `shutdown()` (reverse order) on SIGTERM. On top of that lifecycle the author\n * exposes their own clean facade methods.\n *\n *   // resources/neo4j.ts\n *   import { Resource } from \"@palbase/backend\";\n *   import neo4j, { type Driver, type Session } from \"neo4j-driver\";\n *\n *   export class Neo4jResource extends Resource {\n *     static secrets = [\"NEO4J_URL\", \"NEO4J_USER\", \"NEO4J_PASSWORD\"] as const;\n *     private driver!: Driver;\n *     async init(env: { NEO4J_URL: string; NEO4J_USER: string; NEO4J_PASSWORD: string }) {\n *       this.driver = neo4j.driver(env.NEO4J_URL, neo4j.auth.basic(env.NEO4J_USER, env.NEO4J_PASSWORD));\n *     }\n *     async shutdown() { await this.driver.close(); }\n *     session(): Session { return this.driver.session(); }\n *   }\n *   export const neo4j = new Neo4jResource();  // framework finds + manages it\n *\n * # Boot scope (NOT request-ALS)\n *\n * Resources are instantiated once at process boot. This is deliberately NOT the\n * per-request {@link AsyncLocalStorage} scope used for `Database`/`Cache`/… — a\n * connection pool must outlive a single request. The runtime discovers\n * resources from the project's `resources/` directory, registers each via\n * {@link __registerResource}, then calls {@link __runResourceBoot} before\n * serving and {@link __shutdownResources} on SIGTERM. Discovery is a runtime\n * concern; the SDK provides the base class + registry + boot/shutdown hooks.\n */\n\n/** Map a declared `secrets` tuple to the `init(env)` argument type — a record\n * over the secret names, each `string`. An empty tuple maps to an empty\n * record. */\nexport type ResourceEnv<Secrets extends readonly string[]> = {\n  [K in Secrets[number]]: string;\n};\n\n/**\n * Base class for external connections.\n *\n * - `static secrets` — OPTIONAL readonly tuple of env-var names this resource\n *   needs. Drives (a) the `env` type passed to `init` and (b) the\n *   missing-secret check at boot (deploy fails naming the absent secret).\n * - `init(env)` — called ONCE at boot with the declared secret subset. May be\n *   sync (`void`) or async (`Promise<void>`).\n * - `shutdown()` — OPTIONAL drain hook, called on SIGTERM in reverse boot\n *   order.\n *\n * @example\n * import { Resource } from \"@palbase/backend\";\n * import { Client } from \"@googlemaps/google-maps-services-js\";\n *\n * export class GoogleResource extends Resource {\n *   static secrets = [\"GOOGLE_MAPS_KEY\"] as const;\n *   private client = new Client();\n *   private key = \"\";\n *   init(env: { GOOGLE_MAPS_KEY: string }) { this.key = env.GOOGLE_MAPS_KEY; }\n * }\n * export const google = new GoogleResource();\n */\nexport abstract class Resource {\n  /** The env-var names this resource needs. Optional; omit for none. */\n  static secrets?: readonly string[];\n\n  /** Set up the connection from the declared secrets. Called once at boot. */\n  abstract init(env: Record<string, string>): void | Promise<void>;\n\n  /** Drain/close the connection on SIGTERM. Optional. */\n  shutdown?(): void | Promise<void>;\n}\n\n/** A value carrying an optional readonly `secrets` tuple — the constructor side\n * of a Resource subclass. Narrowed from `unknown` via {@link hasSecrets}. */\ninterface WithSecrets {\n  secrets?: readonly string[];\n}\n\n/** Guard: does this value carry a `secrets` array (the static on a Resource\n * subclass)? Lets us read `secrets` off `resource.constructor` (typed\n * `Function`) without a cast — narrows from `unknown` instead. */\nfunction hasSecrets(value: unknown): value is WithSecrets {\n  if (typeof value !== \"object\" && typeof value !== \"function\") return false;\n  const secrets = (value as { secrets?: unknown }).secrets;\n  return secrets === undefined || Array.isArray(secrets);\n}\n\n/** A registered resource plus whether its `init` has already run. The\n * `booted` flag makes {@link __runResourceBoot} idempotent (re-running boot,\n * e.g. across a re-entrant deploy path, never re-inits). */\ninterface RegistryEntry {\n  resource: Resource;\n  booted: boolean;\n}\n\n/** Module-level boot registry. Single per process (the br-pod is\n * single-project). Order is registration order; shutdown reverses it. */\nconst registry: RegistryEntry[] = [];\n\n/**\n * Register a resource instance with the boot registry. The runtime calls this\n * for each instance discovered under the project's `resources/` directory.\n * NOT part of the public author-facing API (prefixed `__`).\n */\nexport function __registerResource(resource: Resource): void {\n  registry.push({ resource, booted: false });\n}\n\n/** Read the declared `secrets` tuple off a resource instance's constructor. */\nfunction declaredSecrets(resource: Resource): readonly string[] {\n  const ctor: unknown = resource.constructor;\n  return hasSecrets(ctor) ? (ctor.secrets ?? []) : [];\n}\n\n/**\n * Boot every registered resource that has not yet been booted: resolve its\n * declared secret subset from `envMap`, then await its `init(env)`. Idempotent\n * — an already-booted resource is skipped. Throws (failing deploy/boot) when a\n * declared secret is absent, naming the missing secret. NOT part of the public\n * author-facing API.\n */\nexport async function __runResourceBoot(envMap: Record<string, string>): Promise<void> {\n  for (const entry of registry) {\n    if (entry.booted) continue;\n    const secrets = declaredSecrets(entry.resource);\n    const env: Record<string, string> = {};\n    for (const name of secrets) {\n      const value = envMap[name];\n      if (value === undefined) {\n        throw new Error(\n          `Resource ${entry.resource.constructor.name} requires secret \"${name}\" but it is not set. ` +\n            `Set it with \\`palbase secret set ${name} ...\\` (or in Studio) and redeploy.`,\n        );\n      }\n      env[name] = value;\n    }\n    await entry.resource.init(env);\n    entry.booted = true;\n  }\n}\n\n/**\n * Shut down every booted resource in REVERSE registration order, awaiting each\n * `shutdown()` (a no-op when undefined). Clears the registry afterwards so a\n * second call is a no-op. NOT part of the public author-facing API.\n */\nexport async function __shutdownResources(): Promise<void> {\n  for (let i = registry.length - 1; i >= 0; i -= 1) {\n    const entry = registry[i]!;\n    if (entry.booted && entry.resource.shutdown) {\n      await entry.resource.shutdown();\n    }\n  }\n  registry.length = 0;\n}\n\n/** Clear the registry without running shutdown. TEST-only helper so each test\n * starts from a clean registry. NOT part of the public author-facing API. */\nexport function __resetResources(): void {\n  registry.length = 0;\n}\n","/** Non-service, per-invocation data for hook handlers.\n * Services (Database, Log, …) are imported as singletons, not passed here. */\nexport interface HookMeta {\n  /** Branch-scoped env vars. */\n  env: Record<string, string>;\n  projectId: string;\n  environmentId: string;\n}\n\n// --- Auth Event Payloads ---\n\n/** Payload for auth.onUserCreated hook. */\nexport interface UserCreatedEvent {\n  user: {\n    id: string;\n    /** User's email, if they signed up with one (absent for phone-only users). */\n    email?: string;\n    role: string;\n    metadata: Record<string, unknown>;\n    createdAt: string;\n  };\n}\n\n/** Payload for auth.onSignIn hook. */\nexport interface SignInEvent {\n  user: {\n    id: string;\n    /** User's email, if they have one (absent for phone-only users). */\n    email?: string;\n    role: string;\n  };\n  provider: string;\n  timestamp: string;\n}\n\n/** Payload for auth.onSignOut hook. */\nexport interface SignOutEvent {\n  user: {\n    id: string;\n    /** User's email, if they have one (absent for phone-only users). */\n    email?: string;\n  };\n  timestamp: string;\n}\n\n/** Payload for auth.onPasswordReset hook.\n * Password reset is inherently email-based, so `email` is always present here\n * (a phone-only passwordless user cannot trigger this event). */\nexport interface PasswordResetEvent {\n  user: {\n    id: string;\n    email: string;\n  };\n  timestamp: string;\n}\n\n// --- Storage Event Payloads ---\n\n/** Payload for storage.onFileUploaded hook. */\nexport interface FileUploadedEvent {\n  file: {\n    id: string;\n    name: string;\n    bucket: string;\n    path: string;\n    size: number;\n    contentType: string;\n  };\n}\n\n/** Payload for storage.onFileDeleted hook. */\nexport interface FileDeletedEvent {\n  file: {\n    id: string;\n    name: string;\n    bucket: string;\n    path: string;\n  };\n}\n\n// --- Documents Event Payloads ---\n\n/** Payload for documents.onDocumentCreated hook. */\nexport interface DocumentCreatedEvent {\n  document: {\n    id: string;\n    collection: string;\n    data: Record<string, unknown>;\n  };\n}\n\n/** Payload for documents.onDocumentUpdated hook. */\nexport interface DocumentUpdatedEvent {\n  document: {\n    id: string;\n    collection: string;\n    data: Record<string, unknown>;\n    previousData: Record<string, unknown>;\n  };\n}\n\n/** Payload for documents.onDocumentDeleted hook. */\nexport interface DocumentDeletedEvent {\n  document: {\n    id: string;\n    collection: string;\n    data: Record<string, unknown>;\n  };\n}\n\n// --- Hook Handler Types ---\n\nexport type HookHandler<TEvent> = (event: TEvent, meta: HookMeta) => Promise<void>;\n\n/** Resolved hook configuration (internal). */\nexport interface ResolvedHook<TEvent = unknown> {\n  module: string;\n  event: string;\n  handler: HookHandler<TEvent>;\n}\n\n// --- Auth Hooks ---\n\nexport const auth = {\n  onUserCreated(handler: HookHandler<UserCreatedEvent>): ResolvedHook<UserCreatedEvent> {\n    return { module: \"auth\", event: \"user.created\", handler };\n  },\n\n  onSignIn(handler: HookHandler<SignInEvent>): ResolvedHook<SignInEvent> {\n    return { module: \"auth\", event: \"user.sign_in\", handler };\n  },\n\n  onSignOut(handler: HookHandler<SignOutEvent>): ResolvedHook<SignOutEvent> {\n    return { module: \"auth\", event: \"user.sign_out\", handler };\n  },\n\n  onPasswordReset(handler: HookHandler<PasswordResetEvent>): ResolvedHook<PasswordResetEvent> {\n    return { module: \"auth\", event: \"user.password_reset\", handler };\n  },\n};\n\n// --- Storage Hooks ---\n\nexport const storage = {\n  onFileUploaded(handler: HookHandler<FileUploadedEvent>): ResolvedHook<FileUploadedEvent> {\n    return { module: \"storage\", event: \"file.uploaded\", handler };\n  },\n\n  onFileDeleted(handler: HookHandler<FileDeletedEvent>): ResolvedHook<FileDeletedEvent> {\n    return { module: \"storage\", event: \"file.deleted\", handler };\n  },\n};\n\n// --- Documents Hooks ---\n\nexport const documents = {\n  onDocumentCreated(handler: HookHandler<DocumentCreatedEvent>): ResolvedHook<DocumentCreatedEvent> {\n    return { module: \"documents\", event: \"document.created\", handler };\n  },\n\n  onDocumentUpdated(handler: HookHandler<DocumentUpdatedEvent>): ResolvedHook<DocumentUpdatedEvent> {\n    return { module: \"documents\", event: \"document.updated\", handler };\n  },\n\n  onDocumentDeleted(handler: HookHandler<DocumentDeletedEvent>): ResolvedHook<DocumentDeletedEvent> {\n    return { module: \"documents\", event: \"document.deleted\", handler };\n  },\n};\n","export type {\n  PBRequest,\n  ClientInfo,\n  RateLimitConfig,\n  DBClient,\n  DBOps,\n  TxClient,\n  FileContext,\n  QueueClient,\n  Logger,\n  CacheClient,\n  PalbaseDocsClient,\n  PalbaseCollectionRef,\n  PalbaseDocumentRef,\n  PalbaseDocumentSnapshot,\n  PalbaseQuerySnapshot,\n  PalbaseWhereOperator,\n  PalbaseResult,\n  Middleware,\n  ErrorDef,\n  ErrorMap,\n  ErrorThrowers,\n} from \"./endpoint.js\";\nexport {\n  Database,\n  Documents,\n  Storage,\n  Cache,\n  Queue,\n  Log,\n  Notifications,\n  Flags,\n  __setRuntime,\n  __runWithRuntime,\n  __requestALS,\n  __getRuntime,\n} from \"./runtime.js\";\nexport type { RuntimeServices } from \"./runtime.js\";\nexport type {\n  PalbaseAuthClient,\n  PalbaseStorageClient,\n  PalbaseBucketClient,\n  PalbaseRealtimeClient,\n  PalbaseRealtimeChannel,\n  PalbaseRealtimeMessage,\n  PalbaseFunctionsClient,\n  PalbaseInvokeOptions,\n  PalbaseFlagsClient,\n  PalbaseFlagContext,\n  PalbaseFlagVariant,\n  PalbaseFlag,\n  PalbaseNotificationsClient,\n  PalbasePushClient,\n  PalbaseEmailClient,\n  PalbaseSmsClient,\n  PalbaseInboxClient,\n  PalbasePreferencesClient,\n  PalbaseAnalyticsClient,\n  PalbaseAnalyticsQueryNamespace,\n  PalbaseAnalyticsManagementNamespace,\n  PalbaseLinksClient,\n  PalbaseCmsClient,\n  // Shared local types\n  PalbaseUser,\n  PalbaseSession,\n  PalbaseDeviceInfo,\n  PalbaseAttestAndroidParams,\n  PalbaseAttestAndroidResult,\n  PalbaseAttestiOSParams,\n  PalbaseAttestiOSResult,\n  PalbaseBindDeviceParams,\n  PalbaseVerifyRequestSignatureParams,\n  PalbaseFileObject,\n  PalbaseSignedUrlResponse,\n  PalbasePublicUrlResponse,\n  PalbaseUploadOptions,\n  PalbaseTransformOptions,\n  PalbaseListOptions,\n  PalbasePushSendParams,\n  PalbasePushSendResponse,\n  PalbaseEmailSendParams,\n  PalbaseEmailSendResponse,\n  PalbaseSmsSendParams,\n  PalbaseSmsSendResponse,\n  PalbaseInboxSendParams,\n  PalbaseInboxSendResponse,\n  PalbaseInboxMessage,\n  PalbaseInboxListOptions,\n  PalbaseInboxListResult,\n  PalbasePreferences,\n  PalbaseRegisterDeviceParams,\n  PalbaseDeviceTokenView,\n  PalbaseMultiChannelResponse,\n  PalbaseAnalyticsProperties,\n  PalbaseIdentifyTraits,\n  PalbaseCountQueryInput,\n  PalbaseCountResult,\n  PalbaseEventsQueryInput,\n  PalbaseEventsResult,\n  PalbaseUsersQueryInput,\n  PalbaseUsersResult,\n  PalbaseFunnelQueryInput,\n  PalbaseFunnelResult,\n  PalbaseRetentionQueryInput,\n  PalbaseRetentionResult,\n  PalbaseCohortQueryInput,\n  PalbaseCohortResult,\n  PalbaseOverviewResult,\n  PalbaseEventNamesResult,\n  PalbaseUserDetailResult,\n  PalbaseCreateLinkParams,\n  PalbaseUpdateLinkParams,\n  PalbaseLink,\n  PalbaseLinkDetails,\n  PalbaseLinkAnalytics,\n  PalbaseQrCodeOptions,\n  PalbaseMatchParams,\n  PalbaseInitialLink,\n  PalbaseListLinksOptions,\n  PalbaseListLinksResult,\n  PalbaseCmsFindOptions,\n  PalbaseCmsFindOneOptions,\n} from \"./clients.js\";\nexport { defineSchema } from \"./db/schema.js\";\nexport type { SchemaDef, TableDef, TableInput, ColumnMap, SchemaInput } from \"./db/schema.js\";\nexport { policy, PolicyBuilder } from \"./db/policy.js\";\nexport type { PolicyDef, PolicyCommand, PolicyMode } from \"./db/policy.js\";\nexport { PALBASE_EXTENSIONS, EXTENSION_DEPENDENCIES, isPalbaseExtension } from \"./db/extensions.js\";\nexport type { PalbaseExtension } from \"./db/extensions.js\";\nexport { uuid, text, integer, boolean, timestamp, jsonb, enumType } from \"./db/columns.js\";\nexport type { ColumnBuilder, ColumnDef, ColumnType, OnDeleteAction } from \"./db/columns.js\";\nexport { makeTypedDB } from \"./db/typed-db.js\";\nexport type {\n  TypedDB,\n  TypedTx,\n  TypedTable,\n  InsertShape,\n  RowShape,\n  EnvTypedDatabase,\n  EnvServiceDatabase,\n  EnvTypedTx,\n  EnvTypedTable,\n  EnvTables,\n} from \"./db/typed-db.js\";\nexport type { Tables, TableTypes } from \"./db/env.js\";\nexport { makeEnvDts } from \"./db/env-gen.js\";\n// Class-controller decorator model (replaces defineController/defineHandler/route).\nexport { Controller } from \"./decorators/controller.js\";\nexport type { ControllerOptions } from \"./decorators/controller.js\";\nexport { Get, Post, Put, Patch, Delete } from \"./decorators/methods.js\";\nexport {\n  Body,\n  Query,\n  Headers,\n  Param,\n  User,\n  OptionalUser,\n  Client,\n  RequestId,\n  TraceId,\n  Req,\n} from \"./decorators/params.js\";\nexport type { RouteOptions, HttpMethodUpper } from \"./decorators/registry.js\";\nexport { defineMiddleware } from \"./middleware.js\";\nexport type { MiddlewareContext, MiddlewareHandler } from \"./middleware.js\";\n// The authenticated-user TYPE is exported as `UserT` (not `User`) because the\n// value name `User` is the @User() parameter decorator (exported above). A\n// controller annotates `@User() user: UserT` — decorator for the value\n// position, `UserT` for the type. (NestJS-style: same name as the decorator\n// would collide in the value+type namespaces.)\nexport type { User as UserT, HttpMethod, AuthConfig } from \"./types.js\";\nexport {\n  HttpError,\n  PalError,\n  BadRequest,\n  Unauthorized,\n  Forbidden,\n  NotFound,\n  Conflict,\n  TooManyRequests,\n} from \"./errors.js\";\nexport { defineWorker } from \"./worker.js\";\nexport type {\n  WorkerConfig,\n  ResolvedWorkerConfig,\n  WorkerMeta,\n  BackoffStrategy,\n} from \"./worker.js\";\nexport { defineJob } from \"./job.js\";\nexport type { JobConfig, ResolvedJobConfig, JobMeta } from \"./job.js\";\nexport { defineWebhook } from \"./webhook.js\";\nexport type {\n  WebhookProvider,\n  WebhookMeta,\n  EnvSecretRef,\n  ProviderWebhookConfig,\n  CustomWebhookConfig,\n  ResolvedProviderWebhook,\n  ResolvedCustomWebhook,\n  ResolvedWebhookConfig,\n  WebhookEventHandler,\n  WebhookRequest,\n  ProviderEventMap,\n} from \"./webhook.js\";\nexport {\n  Resource,\n  __registerResource,\n  __runResourceBoot,\n  __shutdownResources,\n} from \"./resource.js\";\nexport type { ResourceEnv } from \"./resource.js\";\nexport { auth, storage, documents } from \"./hooks.js\";\nexport type {\n  HookMeta,\n  HookHandler,\n  ResolvedHook,\n  UserCreatedEvent,\n  SignInEvent,\n  SignOutEvent,\n  PasswordResetEvent,\n  FileUploadedEvent,\n  FileDeletedEvent,\n  DocumentCreatedEvent,\n  DocumentUpdatedEvent,\n  DocumentDeletedEvent,\n} from \"./hooks.js\";\nexport { z } from \"zod\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,SAAS,WAAW,KAAwB;AAC1C,UAAQ,IAAI,MAAM;AAAA,IAChB,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK,QAAQ;AACX,YAAM,SAAS,IAAI,cAAc,CAAC;AAClC,UAAI,OAAO,WAAW,EAAG,QAAO;AAChC,aAAO,OAAO,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,KAAK;AAAA,IACxD;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAGA,SAAS,QAAQ,KAAwB;AACvC,QAAM,OAAO,WAAW,GAAG;AAC3B,SAAO,IAAI,WAAW,GAAG,IAAI,YAAY;AAC3C;AAIA,SAAS,iBAAiB,KAAyB;AACjD,SACE,IAAI,aAAa,QACjB,IAAI,kBAAkB,QACtB,IAAI,eAAe,QACnB,IAAI,iBAAiB;AAEzB;AAIA,SAAS,WAAW,OAAiB,QAAwB;AAC3D,QAAM,OAAO,OAAO,QAAQ,MAAM,OAAO;AACzC,QAAM,WAAW,KAAK,IAAI,CAAC,CAAC,KAAK,OAAO,MAAM;AAC5C,WAAO,GAAG,MAAM,OAAO,GAAG,KAAK,QAAQ,QAAQ,IAAI,CAAC;AAAA,EACtD,CAAC;AACD,QAAM,cAAc,KAAK,IAAI,CAAC,CAAC,KAAK,OAAO,MAAM;AAC/C,UAAM,MAAM,QAAQ;AACpB,UAAM,MAAM,iBAAiB,GAAG,IAAI,MAAM;AAC1C,WAAO,GAAG,MAAM,OAAO,GAAG,GAAG,GAAG,KAAK,QAAQ,GAAG,CAAC;AAAA,EACnD,CAAC;AACD,SAAO;AAAA,IACL,GAAG,MAAM,GAAG,MAAM,IAAI;AAAA,IACtB,GAAG,MAAM;AAAA,IACT,GAAG;AAAA,IACH,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,IACT,GAAG;AAAA,IACH,GAAG,MAAM;AAAA,IACT,GAAG,MAAM;AAAA,EACX,EAAE,KAAK,IAAI;AACb;AAUO,SAAS,WAAW,QAA2B;AACpD,QAAM,aAAa,OAAO,KAAK,OAAO,MAAM;AAC5C,QAAM,SAAS,WAAW,IAAI,CAAC,SAAS,WAAW,OAAO,OAAO,IAAI,GAAI,MAAM,CAAC;AAChF,QAAM,OAAO,OAAO,SAAS,IAAI;AAAA,EAAK,OAAO,KAAK,IAAI,CAAC;AAAA,MAAS;AAChE,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,sBAMa,IAAI;AAAA;AAAA;AAAA;AAAA;AAK1B;;;AC9EO,IAAM,kBAAiC,uBAAO,IAAI,gCAAgC;AAmBlF,SAAS,WAAW,UAAkB,UAA6B,CAAC,GAAG;AAC5E,SAAO,SAA+D,MAAY;AAChF,UAAM,UAAU;AAChB,UAAM,OAAuB;AAAA,MAC3B,WAAW;AAAA,MACX;AAAA,MACA,GAAI,QAAQ,SAAS,SAAY,EAAE,aAAa,QAAQ,KAAK,IAAI,CAAC;AAAA,IACpE;AAEA,WAAO,eAAe,SAAS,iBAAiB;AAAA,MAC9C,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAGD,WAAO,eAAe,SAAS,aAAa;AAAA,MAC1C,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AACD,WAAO;AAAA,EACT;AACF;;;ACCO,IAAM,SAAwB,uBAAO,IAAI,wBAAwB;AAMxE,IAAM,eAA8B,uBAAO,IAAI,6BAA6B;AAS5E,IAAM,gBAA+B,uBAAO,IAAI,8BAA8B;AAe9E,SAAS,UAAU,QAAiC;AAIlD,QAAM,OACJ,OAAO,WAAW,aACb,SACE,OAAqC,eACtC;AACR,SAAO;AACT;AAIA,SAAS,UAAU,SAAuC;AACxD,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,MAAM,GAAG;AAC1D,YAAQ,MAAM,IAAI,CAAC;AAAA,EACrB;AACA,SAAO,QAAQ,MAAM;AACvB;AAGA,SAAS,eAAe,SAAuD;AAC7E,MAAI,CAAC,OAAO,UAAU,eAAe,KAAK,SAAS,YAAY,GAAG;AAChE,YAAQ,YAAY,IAAI,CAAC;AAAA,EAC3B;AACA,SAAO,QAAQ,YAAY;AAC7B;AAKO,SAAS,YACd,QACA,QACA,QACA,SACA,SACM;AACN,QAAM,UAAU,UAAU,MAAM;AAChC,QAAM,SAAS,UAAU,OAAO;AAChC,QAAM,SAAS,eAAe,OAAO;AACrC,QAAM,UAAU,OAAO,MAAM,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAC9E,QAAM,QAAmB,EAAE,QAAQ,SAAS,QAAQ,SAAS,OAAO;AAIpE,QAAM,eAAe,QAAQ,aAAa;AAC1C,MAAI,gBAAgB,aAAa,MAAM,MAAM,QAAW;AACtD,UAAM,eAAe,aAAa,MAAM;AAAA,EAC1C;AACA,SAAO,KAAK,KAAK;AACnB;AAOO,SAAS,YAAY,QAAgB,QAAgB,MAAuB;AACjF,QAAM,UAAU,UAAU,MAAM;AAChC,QAAM,SAAS,eAAe,OAAO;AACrC,GAAC,OAAO,MAAM,MAAM,CAAC,GAAG,KAAK,IAAI;AAGjC,QAAM,SAAS,QAAQ,MAAM;AAC7B,MAAI,QAAQ;AACV,UAAM,QAAQ,OAAO,KAAK,CAAC,MAAM,EAAE,WAAW,MAAM;AACpD,QAAI,OAAO;AACT,YAAM,OAAO,KAAK,IAAI;AACtB,YAAM,OAAO,KAAK,CAAC,GAAG,MAAM,EAAE,QAAQ,EAAE,KAAK;AAAA,IAC/C;AAAA,EACF;AACF;;;AC1JA,SAAS,oBAAoB,QAAyB;AACpD,SAAO,SAAU,SAAiB,UAAwB,CAAC,GAAoB;AAC7E,WAAO,SAAU,QAAQ,aAAa;AACpC,kBAAY,QAAQ,OAAO,WAAW,GAAG,QAAQ,SAAS,OAAO;AAAA,IACnE;AAAA,EACF;AACF;AAGO,IAAM,MAAM,oBAAoB,KAAK;AAErC,IAAM,OAAO,oBAAoB,MAAM;AAEvC,IAAM,MAAM,oBAAoB,KAAK;AAErC,IAAM,QAAQ,oBAAoB,OAAO;AAEzC,IAAM,SAAS,oBAAoB,QAAQ;;;ACnBlD,SAAS,mBACP,MACA,OACoB;AACpB,SAAO,SAAU,QAAQ,aAAa,gBAAgB;AACpD,gBAAY,QAAQ,OAAO,WAAW,GAAG;AAAA,MACvC,OAAO;AAAA,MACP;AAAA,MACA,GAAI,OAAO,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,MAC9D,GAAI,OAAO,SAAS,SAAY,EAAE,MAAM,MAAM,KAAK,IAAI,CAAC;AAAA,IAC1D,CAAC;AAAA,EACH;AACF;AAIO,SAAS,KAAK,QAAwC;AAC3D,SAAO,mBAAmB,QAAQ,EAAE,OAAO,CAAC;AAC9C;AAIO,SAAS,MAAM,QAAwC;AAC5D,SAAO,mBAAmB,SAAS,EAAE,OAAO,CAAC;AAC/C;AAIO,SAAS,QAAQ,QAAyC;AAC/D,SAAO,mBAAmB,WAAW,WAAW,SAAY,EAAE,OAAO,IAAI,MAAS;AACpF;AAGO,SAAS,MAAM,MAAkC;AACtD,SAAO,mBAAmB,SAAS,EAAE,KAAK,CAAC;AAC7C;AAIO,SAAS,OAA2B;AACzC,SAAO,mBAAmB,MAAM;AAClC;AAIO,SAAS,eAAmC;AACjD,SAAO,mBAAmB,cAAc;AAC1C;AAGO,SAAS,SAA6B;AAC3C,SAAO,mBAAmB,QAAQ;AACpC;AAGO,SAAS,YAAgC;AAC9C,SAAO,mBAAmB,WAAW;AACvC;AAGO,SAAS,UAA8B;AAC5C,SAAO,mBAAmB,SAAS;AACrC;AAGO,SAAS,MAA0B;AACxC,SAAO,mBAAmB,KAAK;AACjC;;;ACrDO,SAAS,iBAAiB,IAA0C;AACzE,SAAO;AACT;;;ACvBO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YAAY,QAAgB,OAAe,kBAA0B,MAAgB;AACnF,UAAM,gBAAgB;AACtB,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AACb,SAAK,mBAAmB;AACxB,QAAI,SAAS,QAAW;AACtB,WAAK,OAAO;AAAA,IACd;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,OAAO,WAML;AACA,UAAM,SAMF;AAAA,MACF,OAAO,KAAK;AAAA,MACZ,mBAAmB,KAAK;AAAA,MACxB,QAAQ,KAAK;AAAA,IACf;AACA,QAAI,WAAW;AACb,aAAO,aAAa;AAAA,IACtB;AACA,QAAI,KAAK,SAAS,QAAW;AAC3B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;AASO,IAAM,WAAN,cAAuB,UAAU;AAAA,EACtC,YAAY,QAAgB,MAAc,aAAqB,MAAgB;AAC7E,UAAM,QAAQ,MAAM,aAAa,IAAI;AACrC,SAAK,OAAO;AAAA,EACd;AACF;AAKA,IAAe,iBAAf,cAAsC,UAAU;AAAA,EACpC,YACR,QACA,aACA,MACA,SACA,MACA,MACA;AACA,UAAM,QAAQ,QAAQ,aAAa,WAAW,eAAe,IAAI,GAAG,IAAI;AACxE,SAAK,OAAO;AAAA,EACd;AACF;AAIA,SAAS,eAAe,MAAsB;AAC5C,QAAM,SAAS,KAAK,QAAQ,sBAAsB,OAAO;AACzD,SAAO,OAAO,OAAO,CAAC,EAAE,YAAY,IAAI,OAAO,MAAM,CAAC,EAAE,YAAY;AACtE;AAGO,IAAM,aAAN,cAAyB,eAAe;AAAA,EAC7C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,eAAe,cAAc,SAAS,MAAM,IAAI;AAAA,EAC7D;AACF;AAGO,IAAM,eAAN,cAA2B,eAAe;AAAA,EAC/C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,gBAAgB,gBAAgB,SAAS,MAAM,IAAI;AAAA,EAChE;AACF;AAGO,IAAM,YAAN,cAAwB,eAAe;AAAA,EAC5C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,aAAa,aAAa,SAAS,MAAM,IAAI;AAAA,EAC1D;AACF;AAGO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAC3C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,aAAa,YAAY,SAAS,MAAM,IAAI;AAAA,EACzD;AACF;AAGO,IAAM,WAAN,cAAuB,eAAe;AAAA,EAC3C,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,YAAY,YAAY,SAAS,MAAM,IAAI;AAAA,EACxD;AACF;AAGO,IAAM,kBAAN,cAA8B,eAAe;AAAA,EAClD,YAAY,SAAkB,MAAe,MAAgB;AAC3D,UAAM,KAAK,qBAAqB,mBAAmB,SAAS,MAAM,IAAI;AAAA,EACxE;AACF;;;AC9FA,IAAM,oBAAoB;AAG1B,IAAM,kBAAkB;AAAA,EACtB,OAAO;AAAA,EACP,SAAS;AAAA,EACT,SAAS;AACX;AAoBO,SAAS,aACd,QACgC;AAChC,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,KAAK,MAAM,IAAI;AAC7C,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI,CAAC,kBAAkB,KAAK,OAAO,IAAI,GAAG;AACxC,UAAM,IAAI;AAAA,MACR,wBAAwB,OAAO,IAAI;AAAA,IACrC;AAAA,EACF;AAEA,MAAI,OAAO,UAAU,WAAc,OAAO,QAAQ,KAAK,CAAC,OAAO,UAAU,OAAO,KAAK,IAAI;AACvF,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,MAAI,OAAO,YAAY,UAAa,OAAO,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,0CAA0C;AAAA,EAC5D;AAEA,MACE,OAAO,YAAY,UACnB,CAAC,CAAC,eAAe,UAAU,OAAO,EAAE,SAAS,OAAO,OAAO,GAC3D;AACA,UAAM,IAAI,MAAM,6BAA6B,OAAO,OAAO,EAAE;AAAA,EAC/D;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,OAAO,OAAO,SAAS,gBAAgB;AAAA,IACvC,SAAS,OAAO,WAAW,gBAAgB;AAAA,IAC3C,SAAS,OAAO,WAAW,gBAAgB;AAAA,IAC3C,SAAS,OAAO;AAAA,EAClB;AACF;;;ACjFA,IAAM,iBAAiB;AAGvB,IAAM,sBAAsB;AAG5B,IAAM,eAAe;AAAA,EACnB,SAAS;AACX;AAOA,SAAS,uBAAuB,YAAmC;AACjE,QAAM,UAAU,WAAW,KAAK;AAChC,MAAI,YAAY,IAAI;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,MAAI,MAAM,WAAW,GAAG;AACtB,WAAO,4BAA4B,OAAO,6DAA6D,MAAM,MAAM;AAAA,EACrH;AAEA,QAAM,aAAa,CAAC,UAAU,QAAQ,gBAAgB,SAAS,aAAa;AAC5E,QAAM,cAAkC;AAAA,IACtC,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,EAAE;AAAA,IACN,CAAC,GAAG,CAAC;AAAA,EACP;AAEA,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,OAAO,WAAW,CAAC;AACzB,UAAM,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC;AAEhC,UAAM,QAAQ,kBAAkB,OAAO,MAAM,KAAK,GAAG;AACrD,QAAI,UAAU,MAAM;AAClB,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO;AACT;AAEA,SAAS,kBACP,OACA,MACA,KACA,KACe;AAEf,QAAM,YAAY,MAAM,MAAM,GAAG;AACjC,aAAW,QAAQ,WAAW;AAE5B,UAAM,YAAY,KAAK,MAAM,GAAG;AAChC,QAAI,UAAU,SAAS,GAAG;AACxB,aAAO,WAAW,IAAI,YAAY,KAAK;AAAA,IACzC;AAEA,UAAM,OAAO,UAAU,CAAC;AACxB,UAAM,OAAO,UAAU,CAAC;AAExB,QAAI,SAAS,QAAW;AACtB,YAAM,UAAU,OAAO,IAAI;AAC3B,UAAI,CAAC,OAAO,UAAU,OAAO,KAAK,UAAU,GAAG;AAC7C,eAAO,yBAAyB,IAAI,YAAY,KAAK;AAAA,MACvD;AAAA,IACF;AAEA,QAAI,SAAS,KAAK;AAChB;AAAA,IACF;AAGA,QAAI,KAAK,SAAS,GAAG,GAAG;AACtB,YAAM,aAAa,KAAK,MAAM,GAAG;AACjC,UAAI,WAAW,WAAW,GAAG;AAC3B,eAAO,oBAAoB,IAAI,YAAY,KAAK;AAAA,MAClD;AACA,YAAM,aAAa,OAAO,WAAW,CAAC,CAAC;AACvC,YAAM,WAAW,OAAO,WAAW,CAAC,CAAC;AACrC,UACE,CAAC,OAAO,UAAU,UAAU,KAC5B,CAAC,OAAO,UAAU,QAAQ,KAC1B,aAAa,OACb,WAAW,OACX,aAAa,UACb;AACA,eAAO,oBAAoB,IAAI,YAAY,KAAK;AAAA,MAClD;AACA;AAAA,IACF;AAGA,UAAM,MAAM,OAAO,IAAI;AACvB,QAAI,CAAC,OAAO,UAAU,GAAG,KAAK,MAAM,OAAO,MAAM,KAAK;AACpD,aAAO,oBAAoB,IAAI,YAAY,KAAK;AAAA,IAClD;AAAA,EACF;AAEA,SAAO;AACT;AAoBO,SAAS,UAAU,QAAsC;AAC9D,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,KAAK,MAAM,IAAI;AAC7C,UAAM,IAAI,MAAM,sBAAsB;AAAA,EACxC;AAEA,MAAI,CAAC,eAAe,KAAK,OAAO,IAAI,GAAG;AACrC,UAAM,IAAI;AAAA,MACR,qBAAqB,OAAO,IAAI;AAAA,IAClC;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,YAAY,OAAO,SAAS,KAAK,MAAM,IAAI;AACrD,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,QAAM,YAAY,uBAAuB,OAAO,QAAQ;AACxD,MAAI,cAAc,MAAM;AACtB,UAAM,IAAI,MAAM,SAAS;AAAA,EAC3B;AAEA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI,OAAO,YAAY,UAAa,OAAO,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,uCAAuC;AAAA,EACzD;AAEA,MAAI,OAAO,YAAY,UAAa,CAAC,OAAO,UAAU,OAAO,OAAO,GAAG;AACrE,UAAM,IAAI,MAAM,gCAAgC;AAAA,EAClD;AAEA,MAAI,OAAO,YAAY,UAAa,OAAO,UAAU,qBAAqB;AACxE,UAAM,IAAI;AAAA,MACR,eAAe,OAAO,OAAO,qBAAqB,mBAAmB;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM,OAAO;AAAA,IACb,UAAU,OAAO,SAAS,KAAK;AAAA,IAC/B,SAAS,OAAO,WAAW,aAAa;AAAA,IACxC,SAAS,OAAO;AAAA,EAClB;AACF;;;ACrEA,IAAM,qBAAqB;AAsCpB,SAAS,cACd,QACuB;AACvB,MAAI,cAAc,QAAQ;AACxB,WAAO,wBAAwB,MAAM;AAAA,EACvC;AACA,SAAO,sBAAsB,MAAM;AACrC;AAEA,SAAS,wBACP,QAC4B;AAC5B,MAAI,CAAC,OAAO,UAAU;AACpB,UAAM,IAAI,MAAM,8BAA8B;AAAA,EAChD;AAEA,QAAM,iBAAoC;AAAA,IACxC;AAAA,IAAU;AAAA,IAAU;AAAA,IAAU;AAAA,IAAY;AAAA,IAAS;AAAA,IAAW;AAAA,EAChE;AACA,MAAI,CAAC,eAAe,SAAS,OAAO,QAAQ,GAAG;AAC7C,UAAM,IAAI;AAAA,MACR,6BAA6B,OAAO,QAAQ,qBAAqB,eAAe,KAAK,IAAI,CAAC;AAAA,IAC5F;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,QAAQ;AAClB,UAAM,IAAI,MAAM,yDAA2D;AAAA,EAC7E;AAEA,MAAI,OAAO,OAAO,OAAO,QAAQ,YAAY,OAAO,OAAO,IAAI,KAAK,MAAM,IAAI;AAC5E,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AAEA,MAAI,CAAC,OAAO,UAAU,OAAO,KAAK,OAAO,MAAM,EAAE,WAAW,GAAG;AAC7D,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AAEA,aAAW,CAAC,WAAW,OAAO,KAAK,OAAO,QAAQ,OAAO,MAAM,GAAG;AAChE,QAAI,OAAO,YAAY,YAAY;AACjC,YAAM,IAAI,MAAM,sBAAsB,SAAS,sBAAsB;AAAA,IACvE;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,UAAU,OAAO;AAAA,IACjB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,EACjB;AACF;AAEA,SAAS,sBAAsB,QAAoD;AACjF,MAAI,CAAC,OAAO,QAAQ,OAAO,KAAK,KAAK,MAAM,IAAI;AAC7C,UAAM,IAAI,MAAM,0BAA0B;AAAA,EAC5C;AAEA,MAAI,CAAC,mBAAmB,KAAK,OAAO,IAAI,GAAG;AACzC,UAAM,IAAI;AAAA,MACR,yBAAyB,OAAO,IAAI;AAAA,IACtC;AAAA,EACF;AAEA,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,6BAA6B;AAAA,EAC/C;AAEA,MAAI,OAAO,OAAO,YAAY,YAAY;AACxC,UAAM,IAAI,MAAM,oCAAoC;AAAA,EACtD;AAEA,MAAI,OAAO,WAAW,UAAa,OAAO,OAAO,WAAW,YAAY;AACtE,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,MAAM,OAAO;AAAA,IACb,QAAQ,OAAO;AAAA,IACf,SAAS,OAAO;AAAA,EAClB;AACF;;;ACxLO,IAAe,WAAf,MAAwB;AAAA;AAAA,EAE7B,OAAO;AAOT;AAWA,SAAS,WAAW,OAAsC;AACxD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,WAAY,QAAO;AACrE,QAAM,UAAW,MAAgC;AACjD,SAAO,YAAY,UAAa,MAAM,QAAQ,OAAO;AACvD;AAYA,IAAM,WAA4B,CAAC;AAO5B,SAAS,mBAAmB,UAA0B;AAC3D,WAAS,KAAK,EAAE,UAAU,QAAQ,MAAM,CAAC;AAC3C;AAGA,SAAS,gBAAgB,UAAuC;AAC9D,QAAM,OAAgB,SAAS;AAC/B,SAAO,WAAW,IAAI,IAAK,KAAK,WAAW,CAAC,IAAK,CAAC;AACpD;AASA,eAAsB,kBAAkB,QAA+C;AACrF,aAAW,SAAS,UAAU;AAC5B,QAAI,MAAM,OAAQ;AAClB,UAAM,UAAU,gBAAgB,MAAM,QAAQ;AAC9C,UAAM,MAA8B,CAAC;AACrC,eAAW,QAAQ,SAAS;AAC1B,YAAM,QAAQ,OAAO,IAAI;AACzB,UAAI,UAAU,QAAW;AACvB,cAAM,IAAI;AAAA,UACR,YAAY,MAAM,SAAS,YAAY,IAAI,qBAAqB,IAAI,yDAC9B,IAAI;AAAA,QAC5C;AAAA,MACF;AACA,UAAI,IAAI,IAAI;AAAA,IACd;AACA,UAAM,MAAM,SAAS,KAAK,GAAG;AAC7B,UAAM,SAAS;AAAA,EACjB;AACF;AAOA,eAAsB,sBAAqC;AACzD,WAAS,IAAI,SAAS,SAAS,GAAG,KAAK,GAAG,KAAK,GAAG;AAChD,UAAM,QAAQ,SAAS,CAAC;AACxB,QAAI,MAAM,UAAU,MAAM,SAAS,UAAU;AAC3C,YAAM,MAAM,SAAS,SAAS;AAAA,IAChC;AAAA,EACF;AACA,WAAS,SAAS;AACpB;;;ACnCO,IAAM,OAAO;AAAA,EAClB,cAAc,SAAwE;AACpF,WAAO,EAAE,QAAQ,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,EAC1D;AAAA,EAEA,SAAS,SAA8D;AACrE,WAAO,EAAE,QAAQ,QAAQ,OAAO,gBAAgB,QAAQ;AAAA,EAC1D;AAAA,EAEA,UAAU,SAAgE;AACxE,WAAO,EAAE,QAAQ,QAAQ,OAAO,iBAAiB,QAAQ;AAAA,EAC3D;AAAA,EAEA,gBAAgB,SAA4E;AAC1F,WAAO,EAAE,QAAQ,QAAQ,OAAO,uBAAuB,QAAQ;AAAA,EACjE;AACF;AAIO,IAAM,UAAU;AAAA,EACrB,eAAe,SAA0E;AACvF,WAAO,EAAE,QAAQ,WAAW,OAAO,iBAAiB,QAAQ;AAAA,EAC9D;AAAA,EAEA,cAAc,SAAwE;AACpF,WAAO,EAAE,QAAQ,WAAW,OAAO,gBAAgB,QAAQ;AAAA,EAC7D;AACF;AAIO,IAAM,YAAY;AAAA,EACvB,kBAAkB,SAAgF;AAChG,WAAO,EAAE,QAAQ,aAAa,OAAO,oBAAoB,QAAQ;AAAA,EACnE;AAAA,EAEA,kBAAkB,SAAgF;AAChG,WAAO,EAAE,QAAQ,aAAa,OAAO,oBAAoB,QAAQ;AAAA,EACnE;AAAA,EAEA,kBAAkB,SAAgF;AAChG,WAAO,EAAE,QAAQ,aAAa,OAAO,oBAAoB,QAAQ;AAAA,EACnE;AACF;;;AC2DA,SAAS,SAAS;","names":[]}