@palbase/backend 32.0.0 → 33.0.0

package/dist/bin/palbase-backend.cjs

@@ -839,9 +839,29 @@ function __runWithRuntime(services, fn) {
   }, fn);
 }
 __name(__runWithRuntime, "__runWithRuntime");
+var REQUIRED_SERVICES = [
+  "Database",
+  "Auth",
+  "Secrets",
+  "Documents",
+  "Storage",
+  "Cache",
+  "Log",
+  "Notifications",
+  "Flags",
+  "Realtime"
+];
+function refuseIncompleteBox(services) {
+  const missing = REQUIRED_SERVICES.filter((k) => services[k] === void 0);
+  if (missing.length > 0) {
+    throw new Error(`the request scope is missing ${missing.join(", ")} \u2014 this box was most likely written by a DIFFERENT @palbase/backend major sharing the same process (the request store is a process-wide well-known Symbol, deliberately, so two bundles of ONE version can share it). Align the versions, or pass every service when building the scope yourself.`);
+  }
+  return services;
+}
+__name(refuseIncompleteBox, "refuseIncompleteBox");
 function __getRuntime() {
   const scoped = __requestALS.getStore();
-  if (scoped) return scoped.runtime;
+  if (scoped) return refuseIncompleteBox(scoped.runtime);
   if (runtime === null) {
     throw new Error("Palbase services accessed outside a request scope. The Database/Documents/\u2026 singletons are only available inside an endpoint handler (or after the runtime has called __runWithRuntime / __setRuntime).");
   }
@@ -964,7 +984,12 @@ function makeTypedSurface(raw) {
     $findById: /* @__PURE__ */ __name((table, id) => raw.findById(table, id), "$findById"),
     $findMany: /* @__PURE__ */ __name((table, query, opts) => raw.findMany(table, query, opts), "$findMany"),
     $put: /* @__PURE__ */ __name((table, data, opts) => raw.put(table, data, opts), "$put"),
-    $updateMany: /* @__PURE__ */ __name((table, where, set) => raw.updateMany(table, where, set), "$updateMany"),
+    // `opts` İLETİLİR. Düşürüldüğü sürece `Database.$updateMany(t, w, s,
+    // { returning: false })` sessizce SATIRLARI döndürüyordu, sayıyı değil —
+    // ve `if (n === 0) throw new Conflict(...)` guard'ı HİÇ çalışmıyordu,
+    // çünkü `[] === 0` yanlıştır. Komşu forwarder'lar (`$findMany`, `$put`)
+    // kendi opsiyonlarını zaten iletiyordu; bu biri unutulmuştu.
+    $updateMany: /* @__PURE__ */ __name((table, where, set, opts) => raw.updateMany(table, where, set, opts), "$updateMany"),
     $deleteMany: /* @__PURE__ */ __name((table, where) => raw.deleteMany(table, where), "$deleteMany"),
     $count: /* @__PURE__ */ __name((table, where) => raw.count(table, where), "$count"),
     $search: /* @__PURE__ */ __name((table, params) => raw.search(table, params), "$search"),
@@ -1095,13 +1120,13 @@ var Flags = Object.assign({
    * Lazily resolve the runtime's cross-user sibling on each call. We do NOT
    * cache it: `rawFlags.asService()` reads the CURRENT request scope through
    * the runtime proxy, so caching would leak one request's sibling into
-   * another concurrent request. Mirrors `Database.asService()`.
+   * another concurrent request. Mirrors `Database.$asService()`.
    */
   $asService() {
     return rawFlags.asService();
   },
   /**
-   * The name this member carried before 31.0.0.
+   * The name this member carried before 32.0.0.
    *
    * It does NOT work silently. A retired member that quietly keeps returning
    * is how a rename becomes a mystery: the old call site goes on compiling,
@@ -1111,7 +1136,7 @@ var Flags = Object.assign({
    * Database.$asService()" while the promise went unkept.
    */
   asService() {
-    throw new Error("Flags.asService() was renamed to Flags.$asService() in 31.0.0 \u2014 system members carry the `$` prefix, like Database.$asService().");
+    throw new Error("Flags.asService() was renamed to Flags.$asService() in 32.0.0 \u2014 system members carry the `$` prefix, like Database.$asService().");
   }
 });
 var Realtime = makeServiceProxy("Realtime");
@@ -1486,15 +1511,27 @@ var CODECS = {
   // not representable and the author wants `asDecimal()` instead.
   number: {
     fromDb: /* @__PURE__ */ __name((v) => Number(v), "fromDb"),
-    toDb: /* @__PURE__ */ __name((v) => String(v), "toDb"),
+    // YAZMA YOLUNDA SESSİZ BOZULMA YOK. `toDb(9007199254740993)` bir zamanlar
+    // "9007199254740992" yazıyordu: uygulamanın tuttuğundan BAŞKA bir sayı
+    // kolona gidiyordu ve hiçbir şey söylemiyordu. `asNumber()`'ın JSDoc'u
+    // "2^53'ün altında güvenli" diyordu ama bunu uygulayan bir şey yoktu.
+    toDb: /* @__PURE__ */ __name((v) => {
+      if (typeof v === "number" && !Number.isSafeInteger(v)) {
+        throw new Error(`asNumber() cannot write ${v}: it is outside the safe integer range and would be stored as a different number. Declare .asDecimal() and hand this column a string.`);
+      }
+      return String(v);
+    }, "toDb"),
     tsType: "number"
   },
   // Exact-precision column → the string Postgres sent. It exists so the
   // DECLARATION is explicit: "this column is a decimal I handle as text",
   // rather than the ABSENCE of a declaration meaning the same thing by default.
+  // NULL güvencesi ÇİFTİN KENDİSİNDE. Motor NULL'ı zaten atlıyor (üç ayrı
+  // yerde), ama bir değişmez, onu koruyan üç `if`'in DIŞINDA yazılmalı: biri
+  // düşerse `String(null)` kolonu "null" dizesine çevirirdi.
   decimal: {
-    fromDb: /* @__PURE__ */ __name((v) => String(v), "fromDb"),
-    toDb: /* @__PURE__ */ __name((v) => String(v), "toDb"),
+    fromDb: /* @__PURE__ */ __name((v) => v === null || v === void 0 ? v : String(v), "fromDb"),
+    toDb: /* @__PURE__ */ __name((v) => v === null || v === void 0 ? v : String(v), "toDb"),
     tsType: "string"
   }
 };
@@ -4766,23 +4803,21 @@ async function createApp(opts) {
     if (spec.required && !callerClaims) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }
-    if (callerClaims) {
-      const uploadDb = createRequestDatabase(sql, {
-        role: config.dbRole,
-        serviceRole: config.dbServiceRole,
-        claimsJson: JSON.stringify(callerClaims)
-      });
-      try {
-        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
-        if (refusal) {
-          await uploadDb.commit();
-          return refusal;
-        }
+    const uploadDb = createRequestDatabase(sql, {
+      role: config.dbRole,
+      serviceRole: config.dbServiceRole,
+      claimsJson: JSON.stringify(callerClaims ?? {})
+    });
+    try {
+      const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
+      if (refusal) {
         await uploadDb.commit();
-      } catch (err) {
-        await uploadDb.rollback(err);
-        throw err;
+        return refusal;
       }
+      await uploadDb.commit();
+    } catch (err) {
+      await uploadDb.rollback(err);
+      throw err;
     }
     const grant = grantFor(target?.entry, {
       userId: typeof callerClaims?.sub === "string" ? callerClaims.sub : null,
@@ -4821,11 +4856,18 @@ async function createApp(opts) {
       claimsJson: JSON.stringify(claims ?? {})
     });
     const rolesOfCaller = makeRoleResolver(db.client);
-    if (claims) {
-      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
-      if (refusal) return refusal;
+    let dispatched = false;
+    const settleBeforeRefusal = /* @__PURE__ */ __name(async () => {
+      if (dispatched) return;
+      await db.rollback(new Error("request refused before dispatch"));
+    }, "settleBeforeRefusal");
+    const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
+    if (refusal) {
+      await settleBeforeRefusal();
+      return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
+      await settleBeforeRefusal();
       return envelope("email_not_verified", "A verified email address is required", 403, requestId);
     }
     let parsedBody;
@@ -4834,6 +4876,7 @@ async function createApp(opts) {
     if (req.method !== "GET" && req.method !== "HEAD") {
       const declared = Number(req.headers.get("content-length") ?? "");
       if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
+        await settleBeforeRefusal();
         return new Response(JSON.stringify({
           error: "payload_too_large",
           error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
@@ -4846,6 +4889,7 @@ async function createApp(opts) {
       }
       const buf = await req.arrayBuffer().catch(() => null);
       if (buf && buf.byteLength > MAX_BODY_BYTES) {
+        await settleBeforeRefusal();
         return new Response(JSON.stringify({
           error: "payload_too_large",
           error_description: `Request body exceeds ${MAX_BODY_BYTES} bytes`,
@@ -4881,6 +4925,7 @@ async function createApp(opts) {
         ...JSON_HEADERS
       };
       if (attest.nextChallenge) headers["x-palbase-attest-challenge"] = attest.nextChallenge;
+      await settleBeforeRefusal();
       return new Response(JSON.stringify({
         error: attest.reason,
         error_description: "This endpoint requires a verified app instance",
@@ -4895,6 +4940,7 @@ async function createApp(opts) {
     attestChallengeOut = attest.nextChallenge;
     const retryAfter = limiter.check(meta.options?.rateLimit, RateLimiter.key(hit.entry.id, userId, req.headers), Date.now());
     if (retryAfter !== null) {
+      await settleBeforeRefusal();
       return new Response(JSON.stringify({
         error: "too_many_requests",
         error_description: "Rate limit exceeded for this endpoint",
@@ -4926,6 +4972,7 @@ async function createApp(opts) {
           readParsedBody();
           const r = p.schema.safeParse(parsedBody);
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Request body failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -4938,6 +4985,7 @@ async function createApp(opts) {
         case "query": {
           const r = p.schema.safeParse(Object.fromEntries(url.searchParams));
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Query parameters failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -4958,6 +5006,7 @@ async function createApp(opts) {
           }
           const r = p.schema.safeParse(headersFor(raw, p.schema));
           if (!r.success) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "Request headers failed validation", 400, requestId, {
               data: {
                 fields: fieldErrors(r.error)
@@ -4990,17 +5039,20 @@ async function createApp(opts) {
           break;
         case "uploadedObject": {
           if (uploadSecret === "" || !verifySignature(req.headers.get(SIGNATURE_HEADER) ?? "", uploadSecret)) {
+            await settleBeforeRefusal();
             return envelope("unauthorized", "This endpoint accepts uploads through storage, not directly", 401, requestId);
           }
           readParsedBody();
           const envelopeIn = parsedBody;
           if (!envelopeIn?.uploadedObject) {
+            await settleBeforeRefusal();
             return envelope("bad_request", "the completion call carried no uploaded object", 400, requestId);
           }
           const uploadId = envelopeIn.uploadedObject.uploadId;
           if (typeof uploadId === "string" && uploadId !== "") {
             const already = completions.recall(uploadId);
             if (already) {
+              await settleBeforeRefusal();
               return new Response(already.body, {
                 status: already.status,
                 headers: already.contentType ? {
@@ -5050,6 +5102,7 @@ async function createApp(opts) {
           args[p.index] = void 0;
       }
     }
+    dispatched = true;
     try {
       const services = buildServices(db);
       if (meta.options?.sseConfig !== void 0) {