@palbase/backend 39.1.7 → 40.0.1

package/dist/openapi/index.d.cts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../index-CCY1h_J2.cjs';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CH6HRR6T.cjs';
+import { A as AuthSpec, R as RateLimitConfig } from '../index-t7Ie44mM.cjs';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-C88au7ti.cjs';
 import '../db/env.cjs';
 import '../stack.cjs';
 import 'node:async_hooks';

package/dist/openapi/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../index-fLaf0PN2.js';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-C7tCRyPm.js';
+import { A as AuthSpec, R as RateLimitConfig } from '../index-B8zC9oV0.js';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-wwVUGunv.js';
 import '../db/env.js';
 import '../stack.js';
 import 'node:async_hooks';

package/dist/{registry-CH6HRR6T.d.cts → registry-C88au7ti.d.cts}

@@ -1,4 +1,4 @@
-import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './index-CCY1h_J2.cjs';
+import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './index-t7Ie44mM.cjs';
 import { ZodTypeAny } from 'zod';
 import { PalbaseBucketName } from './stack.cjs';
 

package/dist/{registry-C7tCRyPm.d.ts → registry-wwVUGunv.d.ts}

@@ -1,4 +1,4 @@
-import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './index-fLaf0PN2.js';
+import { D as DatabaseBudget, A as AuthSpec, R as RateLimitConfig } from './index-B8zC9oV0.js';
 import { ZodTypeAny } from 'zod';
 import { PalbaseBucketName } from './stack.js';
 

package/dist/stack.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/stack.ts"],"sourcesContent":["/**\n * `@palbase/backend/stack` — the controlled global augmentation target for the\n * names the project's STACK holds.\n *\n * `Secrets.get(...)`, the Flags client's key parameters and `@Upload({ bucket })`\n * take these unions, never a raw string, so a name the stack does not hold is a\n * COMPILE error rather than a 500 in production — or, worse, a silent read of a\n * secret nobody set.\n *\n * Three interfaces in ONE module because the three share a source and a refresh\n * moment: they all come from the linked environment's stack, and any `palbase\n * secret set` / `flags add` / `storage add` moves them together. `@palbase/\n * backend/env` and `@palbase/backend/purchases` stay separate for the opposite\n * reason — their sources are the schema and the catalog.\n *\n * All three are EMPTY by default; the generated `palbase-stack.d.ts` augments\n * them with one member per name:\n *\n *   // palbase-stack.d.ts (generated — do not edit)\n *   declare module \"@palbase/backend/stack\" {\n *     interface Secrets { OPENAI_API_KEY: true }\n *     interface Flags { newCheckout: true }\n *     interface Buckets { avatars: true }\n *   }\n *\n * A project that has not generated the file therefore has NO valid names, and\n * every call fails to compile until it does. That is the intended behaviour,\n * not a rough edge: it is the ONLY shape in which the gate is not optional. A\n * permissive `string` fallback would make the check opt-in, and an opt-in gate\n * is the same as no gate — which is precisely the hole the retired\n * `config/secrets.ts` push-check used to paper over.\n *\n * THIS REPLACED A DECLARATION, and the direction matters. `config/secrets.ts`\n * asked the author to restate, in the repo, names the vault already held; the\n * deploy then compared the two lists. Here the stack is simply read and the\n * result is a type. There is no second list to drift.\n */\n\n/** The secret names this project's vault holds. EMPTY by default; filled by the\n * generated `palbase-stack.d.ts`. */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-stack.d.ts.\nexport interface Secrets {}\n\n/** The flag keys this project's store defines. EMPTY by default; filled by the\n * generated `palbase-stack.d.ts`. */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-stack.d.ts.\nexport interface Flags {}\n\n/**\n * One typed bucket: which renditions the stack declared for it.\n *\n * `variants` is a UNION of the declared names, so asking for one the bucket does\n * not have is a compile error rather than a 404 somebody finds in production.\n * The default `never` means a bucket with no variants accepts no variant name at\n * all, which is exactly right.\n *\n * THIS MOVED HERE FROM `db/env.ts` (2026-08-29). It lived there because\n * `config/storage.ts` fed it through `palbase-env.d.ts`, alongside the schema's\n * tables. Buckets do not come from the schema — they come from the STACK — so\n * they belong in the file generated off the stack. Two `Buckets` interfaces for\n * one concept is how `Storage.buckets.docs` and `@Upload({ bucket: \"docs\" })`\n * came to disagree about whether \"docs\" exists.\n */\nexport interface BucketTypes {\n  variants: string;\n}\n\n/** The buckets this project's storage carries, keyed by name. EMPTY by default;\n * filled by the generated `palbase-stack.d.ts`. Drives BOTH `Storage.buckets.*`\n * (through `EnvBuckets`) and `@Upload({ bucket })`. */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-stack.d.ts.\nexport interface Buckets {}\n\n/** Every secret name the stack holds. */\nexport type PalbaseSecretName = keyof Secrets & string;\n\n/** Every flag key the stack defines. */\nexport type PalbaseFlagKey = keyof Flags & string;\n\n/** Every bucket the stack carries. */\nexport type PalbaseBucketName = keyof Buckets & string;\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;;","names":[]}
+{"version":3,"sources":["../src/stack.ts"],"sourcesContent":["/**\n * `@palbase/backend/stack` — the controlled global augmentation target for the\n * names the project's STACK holds.\n *\n * `Secrets.get(...)`, the Flags client's key parameters and `@Upload({ bucket })`\n * take these unions, never a raw string, so a name the stack does not hold is a\n * COMPILE error rather than a 500 in production — or, worse, a silent read of a\n * secret nobody set.\n *\n * Four interfaces in ONE module because the four share a source and a refresh\n * moment: they all come from the linked environment's stack, and any `palbase\n * secret set` / `flags add` / `storage add` / `roles` change moves them together.\n * `@palbase/backend/env` and `@palbase/backend/purchases` stay separate for the\n * opposite reason — their sources are the schema and the catalog.\n *\n * All four are EMPTY by default; the generated `palbase-stack.d.ts` augments\n * them with one member per name:\n *\n *   // palbase-stack.d.ts (generated — do not edit)\n *   declare module \"@palbase/backend/stack\" {\n *     interface Secrets { OPENAI_API_KEY: true }\n *     interface Flags { newCheckout: true }\n *     interface Buckets { avatars: true }\n *     interface Roles { admin: true }\n *   }\n *\n * A project that has not generated the file therefore has NO valid names, and\n * every call fails to compile until it does. That is the intended behaviour,\n * not a rough edge: it is the ONLY shape in which the gate is not optional. A\n * permissive `string` fallback would make the check opt-in, and an opt-in gate\n * is the same as no gate — which is precisely the hole the retired\n * `config/secrets.ts` push-check used to paper over.\n *\n * THIS REPLACED A DECLARATION, and the direction matters. `config/secrets.ts`\n * asked the author to restate, in the repo, names the vault already held; the\n * deploy then compared the two lists. Here the stack is simply read and the\n * result is a type. There is no second list to drift.\n */\n\n/** The secret names this project's vault holds. EMPTY by default; filled by the\n * generated `palbase-stack.d.ts`. */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-stack.d.ts.\nexport interface Secrets {}\n\n/** The flag keys this project's store defines. EMPTY by default; filled by the\n * generated `palbase-stack.d.ts`. */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-stack.d.ts.\nexport interface Flags {}\n\n/**\n * One typed bucket: which renditions the stack declared for it.\n *\n * `variants` is a UNION of the declared names, so asking for one the bucket does\n * not have is a compile error rather than a 404 somebody finds in production.\n * The default `never` means a bucket with no variants accepts no variant name at\n * all, which is exactly right.\n *\n * THIS MOVED HERE FROM `db/env.ts` (2026-08-29). It lived there because\n * `config/storage.ts` fed it through `palbase-env.d.ts`, alongside the schema's\n * tables. Buckets do not come from the schema — they come from the STACK — so\n * they belong in the file generated off the stack. Two `Buckets` interfaces for\n * one concept is how `Storage.buckets.docs` and `@Upload({ bucket: \"docs\" })`\n * came to disagree about whether \"docs\" exists.\n */\nexport interface BucketTypes {\n  variants: string;\n}\n\n/** The buckets this project's storage carries, keyed by name. EMPTY by default;\n * filled by the generated `palbase-stack.d.ts`. Drives BOTH `Storage.buckets.*`\n * (through `EnvBuckets`) and `@Upload({ bucket })`. */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by generated palbase-stack.d.ts.\nexport interface Buckets {}\n\n/**\n * The application roles this project's stack declares (`palbase roles`).\n * EMPTY by default; filled by the generated file's `@palbase/backend/stack`\n * block. Drives `auth: { role }` and `User.roles`.\n *\n * Same fail-closed shape as the three above, for the same reason: a permissive\n * `string` fallback would make the role gate opt-in, and an opt-in gate is the\n * same as no gate — a misspelled `auth: { role: \"admn\" }` would compile and\n * refuse every caller in production.\n */\n// biome-ignore lint/suspicious/noEmptyInterface: augmentation target — filled by the generated stack block.\nexport interface Roles {}\n\n/** Every secret name the stack holds. */\nexport type PalbaseSecretName = keyof Secrets & string;\n\n/** Every flag key the stack defines. */\nexport type PalbaseFlagKey = keyof Flags & string;\n\n/** Every bucket the stack carries. */\nexport type PalbaseBucketName = keyof Buckets & string;\n\n/** Every application role the stack declares. */\nexport type PalbaseRoleName = keyof Roles & string;\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;;","names":[]}

package/dist/stack.d.cts

@@ -7,13 +7,13 @@
  * COMPILE error rather than a 500 in production — or, worse, a silent read of a
  * secret nobody set.
  *
- * Three interfaces in ONE module because the three share a source and a refresh
+ * Four interfaces in ONE module because the four share a source and a refresh
  * moment: they all come from the linked environment's stack, and any `palbase
- * secret set` / `flags add` / `storage add` moves them together. `@palbase/
- * backend/env` and `@palbase/backend/purchases` stay separate for the opposite
- * reason — their sources are the schema and the catalog.
+ * secret set` / `flags add` / `storage add` / `roles` change moves them together.
+ * `@palbase/backend/env` and `@palbase/backend/purchases` stay separate for the
+ * opposite reason — their sources are the schema and the catalog.
  *
- * All three are EMPTY by default; the generated `palbase-stack.d.ts` augments
+ * All four are EMPTY by default; the generated `palbase-stack.d.ts` augments
  * them with one member per name:
  *
  *   // palbase-stack.d.ts (generated — do not edit)
@@ -21,6 +21,7 @@
  *     interface Secrets { OPENAI_API_KEY: true }
  *     interface Flags { newCheckout: true }
  *     interface Buckets { avatars: true }
+ *     interface Roles { admin: true }
  *   }
  *
  * A project that has not generated the file therefore has NO valid names, and
@@ -66,11 +67,25 @@ interface BucketTypes {
  * (through `EnvBuckets`) and `@Upload({ bucket })`. */
 interface Buckets {
 }
+/**
+ * The application roles this project's stack declares (`palbase roles`).
+ * EMPTY by default; filled by the generated file's `@palbase/backend/stack`
+ * block. Drives `auth: { role }` and `User.roles`.
+ *
+ * Same fail-closed shape as the three above, for the same reason: a permissive
+ * `string` fallback would make the role gate opt-in, and an opt-in gate is the
+ * same as no gate — a misspelled `auth: { role: "admn" }` would compile and
+ * refuse every caller in production.
+ */
+interface Roles {
+}
 /** Every secret name the stack holds. */
 type PalbaseSecretName = keyof Secrets & string;
 /** Every flag key the stack defines. */
 type PalbaseFlagKey = keyof Flags & string;
 /** Every bucket the stack carries. */
 type PalbaseBucketName = keyof Buckets & string;
+/** Every application role the stack declares. */
+type PalbaseRoleName = keyof Roles & string;
 
-export type { BucketTypes, Buckets, Flags, PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName, Secrets };
+export type { BucketTypes, Buckets, Flags, PalbaseBucketName, PalbaseFlagKey, PalbaseRoleName, PalbaseSecretName, Roles, Secrets };

package/dist/stack.d.ts

@@ -7,13 +7,13 @@
  * COMPILE error rather than a 500 in production — or, worse, a silent read of a
  * secret nobody set.
  *
- * Three interfaces in ONE module because the three share a source and a refresh
+ * Four interfaces in ONE module because the four share a source and a refresh
  * moment: they all come from the linked environment's stack, and any `palbase
- * secret set` / `flags add` / `storage add` moves them together. `@palbase/
- * backend/env` and `@palbase/backend/purchases` stay separate for the opposite
- * reason — their sources are the schema and the catalog.
+ * secret set` / `flags add` / `storage add` / `roles` change moves them together.
+ * `@palbase/backend/env` and `@palbase/backend/purchases` stay separate for the
+ * opposite reason — their sources are the schema and the catalog.
  *
- * All three are EMPTY by default; the generated `palbase-stack.d.ts` augments
+ * All four are EMPTY by default; the generated `palbase-stack.d.ts` augments
  * them with one member per name:
  *
  *   // palbase-stack.d.ts (generated — do not edit)
@@ -21,6 +21,7 @@
  *     interface Secrets { OPENAI_API_KEY: true }
  *     interface Flags { newCheckout: true }
  *     interface Buckets { avatars: true }
+ *     interface Roles { admin: true }
  *   }
  *
  * A project that has not generated the file therefore has NO valid names, and
@@ -66,11 +67,25 @@ interface BucketTypes {
  * (through `EnvBuckets`) and `@Upload({ bucket })`. */
 interface Buckets {
 }
+/**
+ * The application roles this project's stack declares (`palbase roles`).
+ * EMPTY by default; filled by the generated file's `@palbase/backend/stack`
+ * block. Drives `auth: { role }` and `User.roles`.
+ *
+ * Same fail-closed shape as the three above, for the same reason: a permissive
+ * `string` fallback would make the role gate opt-in, and an opt-in gate is the
+ * same as no gate — a misspelled `auth: { role: "admn" }` would compile and
+ * refuse every caller in production.
+ */
+interface Roles {
+}
 /** Every secret name the stack holds. */
 type PalbaseSecretName = keyof Secrets & string;
 /** Every flag key the stack defines. */
 type PalbaseFlagKey = keyof Flags & string;
 /** Every bucket the stack carries. */
 type PalbaseBucketName = keyof Buckets & string;
+/** Every application role the stack declares. */
+type PalbaseRoleName = keyof Roles & string;
 
-export type { BucketTypes, Buckets, Flags, PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName, Secrets };
+export type { BucketTypes, Buckets, Flags, PalbaseBucketName, PalbaseFlagKey, PalbaseRoleName, PalbaseSecretName, Roles, Secrets };

package/dist/test/index.cjs

@@ -26,6 +26,7 @@ __export(test_exports, {
   createTestApi: () => createTestApi,
   fakeDatabase: () => fakeDatabase,
   isolated: () => isolated,
+  testRun: () => testRun,
   withServices: () => withServices
 });
 module.exports = __toCommonJS(test_exports);
@@ -1406,7 +1407,7 @@ function parseIdentities(raw) {
   try {
     return JSON.parse(raw);
   } catch {
-    return {};
+    throw new Error("PALBASE_TEST_IDENTITIES is set but is not JSON \u2014 the run that started these tests handed over a broken identity set");
   }
 }
 __name(parseIdentities, "parseIdentities");
@@ -1418,6 +1419,22 @@ function safeParse(text) {
   }
 }
 __name(safeParse, "safeParse");
+var testRun = {
+  get stack() {
+    return Boolean(process.env.PALBASE_TEST_BASE_URL);
+  },
+  minted(name) {
+    const raw = process.env.PALBASE_TEST_IDENTITIES;
+    if (!raw) return false;
+    let identities;
+    try {
+      identities = JSON.parse(raw);
+    } catch {
+      throw new Error("PALBASE_TEST_IDENTITIES is set but is not JSON \u2014 the run that started these tests handed over a broken identity set");
+    }
+    return typeof identities === "object" && identities !== null && Object.prototype.hasOwnProperty.call(identities, name);
+  }
+};
 var configured = null;
 var api = new Proxy({}, {
   get(_target, prop) {
@@ -3321,6 +3338,7 @@ __name(withServices, "withServices");
   createTestApi,
   fakeDatabase,
   isolated,
+  testRun,
   withServices
 });
 /*! Bundled license information: