@palbase/backend 39.0.0 → 39.1.1

package/dist/engine/index.d.cts

@@ -1,5 +1,5 @@
 import '../index-pK2At5Yc.cjs';
-export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-B0mjUnxy.cjs';
+export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-Brhp8cxj.cjs';
 import 'zod';
 import '../db/env.cjs';
 import '../stack.cjs';

package/dist/engine/index.d.ts

@@ -1,5 +1,5 @@
 import '../index-eN4KzGa5.js';
-export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-yDno9Ju9.js';
+export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-Dlu2b9-f.js';
 import 'zod';
 import '../db/env.js';
 import '../stack.js';

package/dist/engine/index.js

@@ -20,7 +20,7 @@ import {
   setCursorKey,
   withQueryCancellation,
   withTables
-} from "../chunk-JJSR4BUX.js";
+} from "../chunk-C525N4OW.js";
 import {
   DECLARATION_REFUSAL,
   DeclarationRefused,

package/dist/{index-B0mjUnxy.d.cts → index-Brhp8cxj.d.cts}

@@ -895,18 +895,6 @@ interface RouteMatch {
 /** First match wins; the table is small and declaration order is the tiebreak. */
 declare function matchRoute(table: readonly RouteEntry[], method: string, pathname: string): RouteMatch | null;
 
-/**
- * engine/auth.ts — verifying the stack's own access tokens.
- *
- * The engine does this itself rather than trusting a header stamped upstream.
- * In the isolate architecture a gateway verified the token and the runtime read
- * the result; a backend that boots on its own has no such upstream, so the
- * verification lives here — against the keys the stack publishes.
- *
- * Deliberately narrow: ES256 over P-256, which is what palauth mints. An
- * unrecognised `alg` is refused rather than accommodated, because the classic
- * JWT break is a verifier that is helpful about algorithms.
- */
 /** The claims the engine reads. Everything else rides along untyped. */
 interface VerifiedClaims extends Record<string, unknown> {
     sub?: string;
@@ -930,20 +918,26 @@ declare class AuthVerifier {
     private keys;
     private fetchedAt;
     private inflight;
+    private nextRefreshAt;
+    private refreshFailed;
     private readonly jwksUrl;
     private readonly issuer?;
     private readonly fetchImpl;
     private readonly ttl;
     constructor(opts: AuthVerifierOptions);
-    /** Fetch the keyset at most once per TTL, and at most once concurrently. */
+    /** Fetch once concurrently. Known keys use their trust TTL; misses and
+     * failures share a short cooldown so arbitrary kids cannot force a fetch
+     * per request, and recovery does not wait for an entire trust TTL. */
     private refresh;
+    private fetchKeyset;
     private key;
     /**
      * Verify an `Authorization` header value.
      *
      * @returns the verified claims, or `null` for absent / malformed / expired /
-     *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
-     *   the caller answers 401 either way, and a detailed reason is an oracle.
+     *   wrong-issuer / bad-signature. Credential refusals deliberately share one
+     *   result. An unavailable keyset throws 503 instead: no authentication
+     *   decision was possible, and the caller's session must not be invalidated.
      */
     verify(authorization: string | null | undefined): Promise<VerifiedClaims | null>;
 }

package/dist/{index-yDno9Ju9.d.ts → index-Dlu2b9-f.d.ts}

@@ -895,18 +895,6 @@ interface RouteMatch {
 /** First match wins; the table is small and declaration order is the tiebreak. */
 declare function matchRoute(table: readonly RouteEntry[], method: string, pathname: string): RouteMatch | null;
 
-/**
- * engine/auth.ts — verifying the stack's own access tokens.
- *
- * The engine does this itself rather than trusting a header stamped upstream.
- * In the isolate architecture a gateway verified the token and the runtime read
- * the result; a backend that boots on its own has no such upstream, so the
- * verification lives here — against the keys the stack publishes.
- *
- * Deliberately narrow: ES256 over P-256, which is what palauth mints. An
- * unrecognised `alg` is refused rather than accommodated, because the classic
- * JWT break is a verifier that is helpful about algorithms.
- */
 /** The claims the engine reads. Everything else rides along untyped. */
 interface VerifiedClaims extends Record<string, unknown> {
     sub?: string;
@@ -930,20 +918,26 @@ declare class AuthVerifier {
     private keys;
     private fetchedAt;
     private inflight;
+    private nextRefreshAt;
+    private refreshFailed;
     private readonly jwksUrl;
     private readonly issuer?;
     private readonly fetchImpl;
     private readonly ttl;
     constructor(opts: AuthVerifierOptions);
-    /** Fetch the keyset at most once per TTL, and at most once concurrently. */
+    /** Fetch once concurrently. Known keys use their trust TTL; misses and
+     * failures share a short cooldown so arbitrary kids cannot force a fetch
+     * per request, and recovery does not wait for an entire trust TTL. */
     private refresh;
+    private fetchKeyset;
     private key;
     /**
      * Verify an `Authorization` header value.
      *
      * @returns the verified claims, or `null` for absent / malformed / expired /
-     *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
-     *   the caller answers 401 either way, and a detailed reason is an oracle.
+     *   wrong-issuer / bad-signature. Credential refusals deliberately share one
+     *   result. An unavailable keyset throws 503 instead: no authentication
+     *   decision was possible, and the caller's session must not be invalidated.
      */
     verify(authorization: string | null | undefined): Promise<VerifiedClaims | null>;
 }

package/dist/index.cjs

@@ -4456,12 +4456,13 @@ __name(sqlFragment, "sqlFragment");
 // src/db/repository.ts
 function defineRepository(table, opts) {
   const tenantColumn = opts.tenant;
+  const rowKey = opts.key ?? "id";
   const scope = /* @__PURE__ */ __name((tenant) => ({
     [tenantColumn]: tenant
   }), "scope");
   const scopeRow = /* @__PURE__ */ __name((tenant, id) => ({
     [tenantColumn]: tenant,
-    id
+    [rowKey]: id
   }), "scopeRow");
   const scopedPayload = /* @__PURE__ */ __name((values, tenant) => ({
     ...values,
@@ -4489,7 +4490,7 @@ function defineRepository(table, opts) {
     async update(tenant, id, patch) {
       const row = await this.updateScoped(tenant, id, patch);
       if (row === null) {
-        throw new NotFound(`${String(tenantColumn)}=${String(tenant)} kapsam\u0131nda ${id} bulunamad\u0131`);
+        throw new NotFound(`${String(tenantColumn)}=${String(tenant)} kapsam\u0131nda ${rowKey}=${String(id)} bulunamad\u0131`);
       }
       return row;
     }