@palbase/backend 39.1.7 → 40.0.1

package/dist/index.d.cts

@@ -1,11 +1,11 @@
-import { k as PalbaseResult, l as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-CCY1h_J2.cjs';
-export { m as AggregateInput, n as AggregateResult, o as AnyColumn, p as AtomicDatabase, q as AtomicOptions, r as Auth, s as AuthConfig, B as BackfillDef, t as BadRequest, u as Cache, i as CacheClient, v as CheckDef, w as ClientInfo, x as ColRef, y as ColumnBuilder, z as ColumnDef, F as ColumnMap, G as ColumnType, C as CommandOptions, I as Conflict, a as DBClient, e as DBOps, J as Database, D as DatabaseBudget, d as DatabaseDiagnostics, c as DatabaseDiagnosticsOptions, K as DatabaseQueryEvent, L as DeadlockDetected, M as Documents, N as EXTENSION_DEPENDENCIES, O as EmbeddingModelRef, Q as EnvSchemas, E as EnvServiceDatabase, U as EnvTables, V as EnvTypedDatabase, W as EnvTypedTable, X as ErrorDef, Y as ErrorMap, Z as ErrorThrowers, $ as FileContext, a0 as FindManyOpts, a1 as FkAction, a2 as FkMatch, a3 as Flags, a4 as Forbidden, a5 as ForeignKeyBuilder, a6 as ForeignKeyDef, a7 as FreezeBuilder, a8 as FreezeDef, a9 as GuardBuilder, aa as GuardDef, ab as GuardEvent, ac as HttpMethod, ad as IndexBuilder, ae as IndexDef, af as InsertManyOptions, ag as InsertShape, ah as InsertValues, ai as LifecycleHook, aj as Log, ak as Logger, al as Materialized, am as Middleware, an as MiddlewareContext, ao as MiddlewareHandler, ap as MutateInput, aq as NotFound, ar as Notifications, as as OnDeleteAction, at as OrderBySpec, au as PALBASE_EXTENSIONS, av as PBRequest, P as Page, aw as PageInfo, ax as PageInput, ay as PageNavigation, az as PalError, aA as PalbaseAnalyticsClient, aB as PalbaseAnalyticsManagementNamespace, aC as PalbaseAnalyticsProperties, aD as PalbaseAnalyticsQueryNamespace, aE as PalbaseAttestAndroidParams, aF as PalbaseAttestAndroidResult, aG as PalbaseAttestiOSParams, aH as PalbaseAttestiOSResult, aI as PalbaseAuthAdminClient, aJ as PalbaseAuthClient, aK as PalbaseBatchOverrideOperation, aL as PalbaseBatchSetOverridesResult, aM as PalbaseBindDeviceParams, aN as PalbaseBucketClient, aO as PalbaseClearAllOverridesResult, aP as PalbaseClearOverrideResult, aQ as PalbaseCohortQueryInput, aR as PalbaseCohortResult, aS as PalbaseCollectionRef, aT as PalbaseCountQueryInput, aU as PalbaseCountResult, aV as PalbaseCreateLinkParams, aW as PalbaseDeviceInfo, aX as PalbaseDeviceTokenView, aY as PalbaseDocsClient, aZ as PalbaseDocumentRef, a_ as PalbaseDocumentSnapshot, a$ as PalbaseEmailClient, b0 as PalbaseEmailSendParams, b1 as PalbaseEmailSendResponse, b2 as PalbaseEventNamesResult, b3 as PalbaseEventsQueryInput, b4 as PalbaseEventsResult, b5 as PalbaseExtension, b6 as PalbaseFileObject, b7 as PalbaseFlag, b8 as PalbaseFlagContext, b9 as PalbaseFlagSource, ba as PalbaseFlagValue, bb as PalbaseFlagVariant, bc as PalbaseFlagsClient, bd as PalbaseFlagsServiceClient, be as PalbaseFunctionsClient, bf as PalbaseFunnelQueryInput, bg as PalbaseFunnelResult, bh as PalbaseIdentifyTraits, bi as PalbaseInboxClient, bj as PalbaseInboxListOptions, bk as PalbaseInboxListResult, bl as PalbaseInboxMessage, bm as PalbaseInboxSendParams, bn as PalbaseInboxSendResponse, bo as PalbaseInitialLink, bp as PalbaseInvokeOptions, bq as PalbaseLink, br as PalbaseLinkAnalytics, bs as PalbaseLinkDetails, bt as PalbaseLinksClient, bu as PalbaseListLinksOptions, bv as PalbaseListLinksResult, bw as PalbaseListOptions, bx as PalbaseMatchParams, by as PalbaseMultiChannelResponse, bz as PalbaseNotificationChannel, bA as PalbaseNotificationsClient, bB as PalbaseOverviewResult, bC as PalbasePreferences, bD as PalbasePreferencesClient, bE as PalbasePushClient, bF as PalbasePushSendParams, bG as PalbasePushSendResponse, bH as PalbaseQrCodeOptions, bI as PalbaseQuerySnapshot, bJ as PalbaseRealtimeClient, bK as PalbaseRegisterDeviceParams, bL as PalbaseRetentionQueryInput, bM as PalbaseRetentionResult, bN as PalbaseSession, bO as PalbaseSetOverrideResult, bP as PalbaseSetOverridesResult, bQ as PalbaseSignedUrlResponse, bR as PalbaseSmsClient, bS as PalbaseSmsSendParams, bT as PalbaseSmsSendResponse, bU as PalbaseStorageClient, bV as PalbaseTransformOptions, bW as PalbaseUpdateLinkParams, bX as PalbaseUploadOptions, bY as PalbaseUser, bZ as PalbaseUserDetailResult, b_ as PalbaseUsersQueryInput, b$ as PalbaseUsersResult, c0 as PalbaseVerifyRequestSignatureParams, c1 as PalbaseWhatsAppClient, c2 as PalbaseWhatsAppEvent, c3 as PalbaseWhatsAppSendParams, c4 as PalbaseWhatsAppSendResponse, c5 as PalbaseWhatsAppTemplate, c6 as PalbaseWhereOperator, c7 as PolicyBinOp, c8 as PolicyBuilder, c9 as PolicyCommand, ca as PolicyDef, cb as PolicyExprCtx, cc as PolicyExprRef, cd as PolicyMode, ce as PolicyOperand, cf as QueryInput, R as RateLimitConfig, cg as RawConstraintDef, f as RawPageOptions, ch as Realtime, ci as Ref, cj as RequestStore, ck as RowShape, b as RuntimeServices, cl as Secrets, cm as SecretsService, cn as SerializationFailure, co as SetShape, cp as SetValue, cq as ShutdownRunner, cr as SqlFragment, cs as Storage, ct as TABLE_META, cu as TableDef, cv as TableHandle, cw as TableInput, cx as TableRef, cy as TooManyRequests, T as TransactionIsolation, cz as TxColumnExpr, cA as TxInsertShape, cB as TxInsertValue, cC as TxNow, cD as TxPlan, g as TxPlanBody, cE as TxPlanError, cF as TxPlanHandle, cG as TxPlanOpResult, cH as TxPlanRejection, h as TxPlanResponse, cI as TxRefError, cJ as TxRow, cK as TxRows, cL as TxSelectOptions, cM as TxSetShape, cN as TxSetValue, cO as TxTable, cP as TxTables, cQ as TxWhere, cR as TxWireExpr, cS as TxWireGuard, cT as TxWireOp, cU as TxWireRef, cV as TxWireValue, cW as TypedDB, cX as TypedTable, cY as TypedTx, cZ as Unauthorized, c_ as UniqueViolation, c$ as UniqueWhere, d0 as UserT, d1 as VerifiedDevice, d2 as WhereFilter, d3 as WhereOp, d4 as __getRuntime, j as __requestALS, d5 as __resetLifecycleHooks, d6 as __runStartHooks, _ as __runWithRuntime, d7 as __setRuntime, d8 as backfill, d9 as bigint, da as boolean, db as can, dc as check, dd as col, de as dec, df as decrement, dg as defineMiddleware, dh as defineSchema, di as defineTable, dj as enumType, dk as exprCtx, dl as foreignKey, dm as freeze, dn as guard, dp as inc, dq as increment, dr as index, ds as installationRef, dt as integer, du as isPalbaseExtension, dv as isRetryable, dw as jsonb, dx as makeTypedDB, dy as now, dz as numeric, dA as onShutdown, dB as onStart, dC as openai, dD as ownedByUser, dE as policy, dF as raw, dG as sqlFragment, dH as text, dI as timestamp, dJ as userRef, dK as uuid, dL as vector, dM as withRetry } from './index-CCY1h_J2.cjs';
-import { M as ModuleClients, C as Container } from './index-Db5QHdTa.cjs';
-export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-Db5QHdTa.cjs';
+import { k as PalbaseResult, l as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-t7Ie44mM.cjs';
+export { m as AggregateInput, n as AggregateResult, o as AnyColumn, p as AtomicDatabase, q as AtomicOptions, r as Auth, s as AuthConfig, B as BackfillDef, t as BadRequest, u as Cache, i as CacheClient, v as CheckDef, w as ClientInfo, x as ColRef, y as ColumnBuilder, z as ColumnDef, F as ColumnMap, G as ColumnType, C as CommandOptions, I as Conflict, a as DBClient, e as DBOps, J as Database, D as DatabaseBudget, d as DatabaseDiagnostics, c as DatabaseDiagnosticsOptions, K as DatabaseQueryEvent, L as DeadlockDetected, M as Documents, N as EXTENSION_DEPENDENCIES, O as EmbeddingModelRef, Q as EnvSchemas, E as EnvServiceDatabase, U as EnvTables, V as EnvTypedDatabase, W as EnvTypedTable, X as ErrorDef, Y as ErrorMap, Z as ErrorThrowers, $ as FileContext, a0 as FindManyOpts, a1 as FkAction, a2 as FkMatch, a3 as Flags, a4 as Forbidden, a5 as ForeignKeyBuilder, a6 as ForeignKeyDef, a7 as FreezeBuilder, a8 as FreezeDef, a9 as GuardBuilder, aa as GuardDef, ab as GuardEvent, ac as HttpMethod, ad as IndexBuilder, ae as IndexDef, af as InsertManyOptions, ag as InsertShape, ah as InsertValues, ai as LifecycleHook, aj as Log, ak as Logger, al as Materialized, am as Middleware, an as MiddlewareContext, ao as MiddlewareHandler, ap as MutateInput, aq as NotFound, ar as Notifications, as as OnDeleteAction, at as OrderBySpec, au as PALBASE_EXTENSIONS, av as PBRequest, P as Page, aw as PageInfo, ax as PageInput, ay as PageNavigation, az as PalError, aA as PalbaseAnalyticsClient, aB as PalbaseAnalyticsManagementNamespace, aC as PalbaseAnalyticsProperties, aD as PalbaseAnalyticsQueryNamespace, aE as PalbaseAttestAndroidParams, aF as PalbaseAttestAndroidResult, aG as PalbaseAttestiOSParams, aH as PalbaseAttestiOSResult, aI as PalbaseAuthAdminClient, aJ as PalbaseAuthClient, aK as PalbaseBatchOverrideOperation, aL as PalbaseBatchSetOverridesResult, aM as PalbaseBindDeviceParams, aN as PalbaseBucketClient, aO as PalbaseClearAllOverridesResult, aP as PalbaseClearOverrideResult, aQ as PalbaseCohortQueryInput, aR as PalbaseCohortResult, aS as PalbaseCollectionRef, aT as PalbaseCountQueryInput, aU as PalbaseCountResult, aV as PalbaseCreateLinkParams, aW as PalbaseDeviceInfo, aX as PalbaseDeviceTokenView, aY as PalbaseDocsClient, aZ as PalbaseDocumentRef, a_ as PalbaseDocumentSnapshot, a$ as PalbaseEmailClient, b0 as PalbaseEmailSendParams, b1 as PalbaseEmailSendResponse, b2 as PalbaseEventNamesResult, b3 as PalbaseEventsQueryInput, b4 as PalbaseEventsResult, b5 as PalbaseExtension, b6 as PalbaseFileObject, b7 as PalbaseFlag, b8 as PalbaseFlagContext, b9 as PalbaseFlagSource, ba as PalbaseFlagValue, bb as PalbaseFlagVariant, bc as PalbaseFlagsClient, bd as PalbaseFlagsServiceClient, be as PalbaseFunctionsClient, bf as PalbaseFunnelQueryInput, bg as PalbaseFunnelResult, bh as PalbaseIdentifyTraits, bi as PalbaseInboxClient, bj as PalbaseInboxListOptions, bk as PalbaseInboxListResult, bl as PalbaseInboxMessage, bm as PalbaseInboxSendParams, bn as PalbaseInboxSendResponse, bo as PalbaseInitialLink, bp as PalbaseInvokeOptions, bq as PalbaseLink, br as PalbaseLinkAnalytics, bs as PalbaseLinkDetails, bt as PalbaseLinksClient, bu as PalbaseListLinksOptions, bv as PalbaseListLinksResult, bw as PalbaseListOptions, bx as PalbaseMatchParams, by as PalbaseMultiChannelResponse, bz as PalbaseNotificationChannel, bA as PalbaseNotificationsClient, bB as PalbaseOverviewResult, bC as PalbasePreferences, bD as PalbasePreferencesClient, bE as PalbasePushClient, bF as PalbasePushSendParams, bG as PalbasePushSendResponse, bH as PalbaseQrCodeOptions, bI as PalbaseQuerySnapshot, bJ as PalbaseRealtimeClient, bK as PalbaseRegisterDeviceParams, bL as PalbaseRetentionQueryInput, bM as PalbaseRetentionResult, bN as PalbaseSession, bO as PalbaseSetOverrideResult, bP as PalbaseSetOverridesResult, bQ as PalbaseSignedUrlResponse, bR as PalbaseSmsClient, bS as PalbaseSmsSendParams, bT as PalbaseSmsSendResponse, bU as PalbaseStorageClient, bV as PalbaseTransformOptions, bW as PalbaseUpdateLinkParams, bX as PalbaseUploadOptions, bY as PalbaseUser, bZ as PalbaseUserDetailResult, b_ as PalbaseUsersQueryInput, b$ as PalbaseUsersResult, c0 as PalbaseVerifyRequestSignatureParams, c1 as PalbaseWhatsAppClient, c2 as PalbaseWhatsAppEvent, c3 as PalbaseWhatsAppSendParams, c4 as PalbaseWhatsAppSendResponse, c5 as PalbaseWhatsAppTemplate, c6 as PalbaseWhereOperator, c7 as PolicyBinOp, c8 as PolicyBuilder, c9 as PolicyCommand, ca as PolicyDef, cb as PolicyExprCtx, cc as PolicyExprRef, cd as PolicyMode, ce as PolicyOperand, cf as QueryInput, R as RateLimitConfig, cg as RawConstraintDef, f as RawPageOptions, ch as Realtime, ci as Ref, cj as RequestStore, ck as RowShape, b as RuntimeServices, cl as Secrets, cm as SecretsService, cn as SerializationFailure, co as SetShape, cp as SetValue, cq as ShutdownRunner, cr as SqlFragment, cs as Storage, ct as TABLE_META, cu as TableDef, cv as TableHandle, cw as TableInput, cx as TableRef, cy as TooManyRequests, T as TransactionIsolation, cz as TxColumnExpr, cA as TxInsertShape, cB as TxInsertValue, cC as TxNow, cD as TxPlan, g as TxPlanBody, cE as TxPlanError, cF as TxPlanHandle, cG as TxPlanOpResult, cH as TxPlanRejection, h as TxPlanResponse, cI as TxRefError, cJ as TxRow, cK as TxRows, cL as TxSelectOptions, cM as TxSetShape, cN as TxSetValue, cO as TxTable, cP as TxTables, cQ as TxWhere, cR as TxWireExpr, cS as TxWireGuard, cT as TxWireOp, cU as TxWireRef, cV as TxWireValue, cW as TypedDB, cX as TypedTable, cY as TypedTx, cZ as Unauthorized, c_ as UniqueViolation, c$ as UniqueWhere, d0 as UserT, d1 as VerifiedDevice, d2 as WhereFilter, d3 as WhereOp, d4 as __getRuntime, j as __requestALS, d5 as __resetLifecycleHooks, d6 as __runStartHooks, _ as __runWithRuntime, d7 as __setRuntime, d8 as backfill, d9 as bigint, da as boolean, db as can, dc as check, dd as col, de as dec, df as decrement, dg as defineMiddleware, dh as defineSchema, di as defineTable, dj as enumType, dk as exprCtx, dl as foreignKey, dm as freeze, dn as guard, dp as inc, dq as increment, dr as index, ds as installationRef, dt as integer, du as isPalbaseExtension, dv as isRetryable, dw as jsonb, dx as makeTypedDB, dy as now, dz as numeric, dA as onShutdown, dB as onStart, dC as openai, dD as ownedByUser, dE as policy, dF as raw, dG as sqlFragment, dH as text, dI as timestamp, dJ as userRef, dK as uuid, dL as vector, dM as withRetry } from './index-t7Ie44mM.cjs';
+import { M as ModuleClients, C as Container } from './index-BAjRbjnq.cjs';
+export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-BAjRbjnq.cjs';
 export { TableTypes, Tables } from './db/env.cjs';
-export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.cjs';
-import { a as RouteOptions } from './registry-CH6HRR6T.cjs';
-export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-CH6HRR6T.cjs';
+export { PalbaseBucketName, PalbaseFlagKey, PalbaseRoleName, PalbaseSecretName, Roles } from './stack.cjs';
+import { a as RouteOptions } from './registry-C88au7ti.cjs';
+export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-C88au7ti.cjs';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import { T as Token } from './module-Dl1KFVtc.cjs';
@@ -639,8 +639,6 @@ declare function defineRepository<Row, Insert, Patch, K extends keyof Row & stri
     key?: PK;
 }): abstract new () => RepositoryOf<Row, Insert, Patch, K, PK>;
 
-declare function makeEnvDts(schemas: readonly SchemaDef[]): string;
-
 /**
  * stack-gen.ts — generate the `palbase-stack.d.ts` text from the names the
  * linked environment's stack holds.
@@ -685,18 +683,22 @@ interface StackNames {
      * variants", which renders `never` and accepts none.
      */
     buckets: readonly (string | BucketInput)[];
+    /**
+     * Application role names the stack declares (`palbase roles`).
+     *
+     * OPTIONAL — omitted by every caller that predates FR-002a (this file's own
+     * golden tests included). A missing set renders `interface Roles {}`, the
+     * same closed default as an empty one; no existing caller breaks.
+     */
+    roles?: readonly string[];
 }
-/**
- * Render the project's `palbase-stack.d.ts`.
- *
- * An empty set renders an empty interface, which is a MEANINGFUL value: the
- * stack holds no such names, so the corresponding union is `never` and every
- * call spelling one fails to compile. It is not the same as "the file was never
- * generated" only in that the file exists — both states refuse every name, and
- * both are correct.
- */
+/** Render the project's standalone `palbase-stack.d.ts` (pre-T008 shape; kept
+ * for the direct callers `index.ts` still exports it to). See
+ * {@link stackInterfaceBody} for what actually decides the four interfaces. */
 declare function makeStackDts(names: StackNames): string;
 
+declare function makeEnvDts(schemas: readonly SchemaDef[], names?: StackNames): string;
+
 /** Options accepted by `@Controller`. */
 interface ControllerOptions {
     /** Default auth for ALL routes in this controller (route-level overrides;

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { k as PalbaseResult, l as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-fLaf0PN2.js';
-export { m as AggregateInput, n as AggregateResult, o as AnyColumn, p as AtomicDatabase, q as AtomicOptions, r as Auth, s as AuthConfig, B as BackfillDef, t as BadRequest, u as Cache, i as CacheClient, v as CheckDef, w as ClientInfo, x as ColRef, y as ColumnBuilder, z as ColumnDef, F as ColumnMap, G as ColumnType, C as CommandOptions, I as Conflict, a as DBClient, e as DBOps, J as Database, D as DatabaseBudget, d as DatabaseDiagnostics, c as DatabaseDiagnosticsOptions, K as DatabaseQueryEvent, L as DeadlockDetected, M as Documents, N as EXTENSION_DEPENDENCIES, O as EmbeddingModelRef, Q as EnvSchemas, E as EnvServiceDatabase, U as EnvTables, V as EnvTypedDatabase, W as EnvTypedTable, X as ErrorDef, Y as ErrorMap, Z as ErrorThrowers, $ as FileContext, a0 as FindManyOpts, a1 as FkAction, a2 as FkMatch, a3 as Flags, a4 as Forbidden, a5 as ForeignKeyBuilder, a6 as ForeignKeyDef, a7 as FreezeBuilder, a8 as FreezeDef, a9 as GuardBuilder, aa as GuardDef, ab as GuardEvent, ac as HttpMethod, ad as IndexBuilder, ae as IndexDef, af as InsertManyOptions, ag as InsertShape, ah as InsertValues, ai as LifecycleHook, aj as Log, ak as Logger, al as Materialized, am as Middleware, an as MiddlewareContext, ao as MiddlewareHandler, ap as MutateInput, aq as NotFound, ar as Notifications, as as OnDeleteAction, at as OrderBySpec, au as PALBASE_EXTENSIONS, av as PBRequest, P as Page, aw as PageInfo, ax as PageInput, ay as PageNavigation, az as PalError, aA as PalbaseAnalyticsClient, aB as PalbaseAnalyticsManagementNamespace, aC as PalbaseAnalyticsProperties, aD as PalbaseAnalyticsQueryNamespace, aE as PalbaseAttestAndroidParams, aF as PalbaseAttestAndroidResult, aG as PalbaseAttestiOSParams, aH as PalbaseAttestiOSResult, aI as PalbaseAuthAdminClient, aJ as PalbaseAuthClient, aK as PalbaseBatchOverrideOperation, aL as PalbaseBatchSetOverridesResult, aM as PalbaseBindDeviceParams, aN as PalbaseBucketClient, aO as PalbaseClearAllOverridesResult, aP as PalbaseClearOverrideResult, aQ as PalbaseCohortQueryInput, aR as PalbaseCohortResult, aS as PalbaseCollectionRef, aT as PalbaseCountQueryInput, aU as PalbaseCountResult, aV as PalbaseCreateLinkParams, aW as PalbaseDeviceInfo, aX as PalbaseDeviceTokenView, aY as PalbaseDocsClient, aZ as PalbaseDocumentRef, a_ as PalbaseDocumentSnapshot, a$ as PalbaseEmailClient, b0 as PalbaseEmailSendParams, b1 as PalbaseEmailSendResponse, b2 as PalbaseEventNamesResult, b3 as PalbaseEventsQueryInput, b4 as PalbaseEventsResult, b5 as PalbaseExtension, b6 as PalbaseFileObject, b7 as PalbaseFlag, b8 as PalbaseFlagContext, b9 as PalbaseFlagSource, ba as PalbaseFlagValue, bb as PalbaseFlagVariant, bc as PalbaseFlagsClient, bd as PalbaseFlagsServiceClient, be as PalbaseFunctionsClient, bf as PalbaseFunnelQueryInput, bg as PalbaseFunnelResult, bh as PalbaseIdentifyTraits, bi as PalbaseInboxClient, bj as PalbaseInboxListOptions, bk as PalbaseInboxListResult, bl as PalbaseInboxMessage, bm as PalbaseInboxSendParams, bn as PalbaseInboxSendResponse, bo as PalbaseInitialLink, bp as PalbaseInvokeOptions, bq as PalbaseLink, br as PalbaseLinkAnalytics, bs as PalbaseLinkDetails, bt as PalbaseLinksClient, bu as PalbaseListLinksOptions, bv as PalbaseListLinksResult, bw as PalbaseListOptions, bx as PalbaseMatchParams, by as PalbaseMultiChannelResponse, bz as PalbaseNotificationChannel, bA as PalbaseNotificationsClient, bB as PalbaseOverviewResult, bC as PalbasePreferences, bD as PalbasePreferencesClient, bE as PalbasePushClient, bF as PalbasePushSendParams, bG as PalbasePushSendResponse, bH as PalbaseQrCodeOptions, bI as PalbaseQuerySnapshot, bJ as PalbaseRealtimeClient, bK as PalbaseRegisterDeviceParams, bL as PalbaseRetentionQueryInput, bM as PalbaseRetentionResult, bN as PalbaseSession, bO as PalbaseSetOverrideResult, bP as PalbaseSetOverridesResult, bQ as PalbaseSignedUrlResponse, bR as PalbaseSmsClient, bS as PalbaseSmsSendParams, bT as PalbaseSmsSendResponse, bU as PalbaseStorageClient, bV as PalbaseTransformOptions, bW as PalbaseUpdateLinkParams, bX as PalbaseUploadOptions, bY as PalbaseUser, bZ as PalbaseUserDetailResult, b_ as PalbaseUsersQueryInput, b$ as PalbaseUsersResult, c0 as PalbaseVerifyRequestSignatureParams, c1 as PalbaseWhatsAppClient, c2 as PalbaseWhatsAppEvent, c3 as PalbaseWhatsAppSendParams, c4 as PalbaseWhatsAppSendResponse, c5 as PalbaseWhatsAppTemplate, c6 as PalbaseWhereOperator, c7 as PolicyBinOp, c8 as PolicyBuilder, c9 as PolicyCommand, ca as PolicyDef, cb as PolicyExprCtx, cc as PolicyExprRef, cd as PolicyMode, ce as PolicyOperand, cf as QueryInput, R as RateLimitConfig, cg as RawConstraintDef, f as RawPageOptions, ch as Realtime, ci as Ref, cj as RequestStore, ck as RowShape, b as RuntimeServices, cl as Secrets, cm as SecretsService, cn as SerializationFailure, co as SetShape, cp as SetValue, cq as ShutdownRunner, cr as SqlFragment, cs as Storage, ct as TABLE_META, cu as TableDef, cv as TableHandle, cw as TableInput, cx as TableRef, cy as TooManyRequests, T as TransactionIsolation, cz as TxColumnExpr, cA as TxInsertShape, cB as TxInsertValue, cC as TxNow, cD as TxPlan, g as TxPlanBody, cE as TxPlanError, cF as TxPlanHandle, cG as TxPlanOpResult, cH as TxPlanRejection, h as TxPlanResponse, cI as TxRefError, cJ as TxRow, cK as TxRows, cL as TxSelectOptions, cM as TxSetShape, cN as TxSetValue, cO as TxTable, cP as TxTables, cQ as TxWhere, cR as TxWireExpr, cS as TxWireGuard, cT as TxWireOp, cU as TxWireRef, cV as TxWireValue, cW as TypedDB, cX as TypedTable, cY as TypedTx, cZ as Unauthorized, c_ as UniqueViolation, c$ as UniqueWhere, d0 as UserT, d1 as VerifiedDevice, d2 as WhereFilter, d3 as WhereOp, d4 as __getRuntime, j as __requestALS, d5 as __resetLifecycleHooks, d6 as __runStartHooks, _ as __runWithRuntime, d7 as __setRuntime, d8 as backfill, d9 as bigint, da as boolean, db as can, dc as check, dd as col, de as dec, df as decrement, dg as defineMiddleware, dh as defineSchema, di as defineTable, dj as enumType, dk as exprCtx, dl as foreignKey, dm as freeze, dn as guard, dp as inc, dq as increment, dr as index, ds as installationRef, dt as integer, du as isPalbaseExtension, dv as isRetryable, dw as jsonb, dx as makeTypedDB, dy as now, dz as numeric, dA as onShutdown, dB as onStart, dC as openai, dD as ownedByUser, dE as policy, dF as raw, dG as sqlFragment, dH as text, dI as timestamp, dJ as userRef, dK as uuid, dL as vector, dM as withRetry } from './index-fLaf0PN2.js';
-import { M as ModuleClients, C as Container } from './index-QWN1Ncrv.js';
-export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-QWN1Ncrv.js';
+import { k as PalbaseResult, l as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-B8zC9oV0.js';
+export { m as AggregateInput, n as AggregateResult, o as AnyColumn, p as AtomicDatabase, q as AtomicOptions, r as Auth, s as AuthConfig, B as BackfillDef, t as BadRequest, u as Cache, i as CacheClient, v as CheckDef, w as ClientInfo, x as ColRef, y as ColumnBuilder, z as ColumnDef, F as ColumnMap, G as ColumnType, C as CommandOptions, I as Conflict, a as DBClient, e as DBOps, J as Database, D as DatabaseBudget, d as DatabaseDiagnostics, c as DatabaseDiagnosticsOptions, K as DatabaseQueryEvent, L as DeadlockDetected, M as Documents, N as EXTENSION_DEPENDENCIES, O as EmbeddingModelRef, Q as EnvSchemas, E as EnvServiceDatabase, U as EnvTables, V as EnvTypedDatabase, W as EnvTypedTable, X as ErrorDef, Y as ErrorMap, Z as ErrorThrowers, $ as FileContext, a0 as FindManyOpts, a1 as FkAction, a2 as FkMatch, a3 as Flags, a4 as Forbidden, a5 as ForeignKeyBuilder, a6 as ForeignKeyDef, a7 as FreezeBuilder, a8 as FreezeDef, a9 as GuardBuilder, aa as GuardDef, ab as GuardEvent, ac as HttpMethod, ad as IndexBuilder, ae as IndexDef, af as InsertManyOptions, ag as InsertShape, ah as InsertValues, ai as LifecycleHook, aj as Log, ak as Logger, al as Materialized, am as Middleware, an as MiddlewareContext, ao as MiddlewareHandler, ap as MutateInput, aq as NotFound, ar as Notifications, as as OnDeleteAction, at as OrderBySpec, au as PALBASE_EXTENSIONS, av as PBRequest, P as Page, aw as PageInfo, ax as PageInput, ay as PageNavigation, az as PalError, aA as PalbaseAnalyticsClient, aB as PalbaseAnalyticsManagementNamespace, aC as PalbaseAnalyticsProperties, aD as PalbaseAnalyticsQueryNamespace, aE as PalbaseAttestAndroidParams, aF as PalbaseAttestAndroidResult, aG as PalbaseAttestiOSParams, aH as PalbaseAttestiOSResult, aI as PalbaseAuthAdminClient, aJ as PalbaseAuthClient, aK as PalbaseBatchOverrideOperation, aL as PalbaseBatchSetOverridesResult, aM as PalbaseBindDeviceParams, aN as PalbaseBucketClient, aO as PalbaseClearAllOverridesResult, aP as PalbaseClearOverrideResult, aQ as PalbaseCohortQueryInput, aR as PalbaseCohortResult, aS as PalbaseCollectionRef, aT as PalbaseCountQueryInput, aU as PalbaseCountResult, aV as PalbaseCreateLinkParams, aW as PalbaseDeviceInfo, aX as PalbaseDeviceTokenView, aY as PalbaseDocsClient, aZ as PalbaseDocumentRef, a_ as PalbaseDocumentSnapshot, a$ as PalbaseEmailClient, b0 as PalbaseEmailSendParams, b1 as PalbaseEmailSendResponse, b2 as PalbaseEventNamesResult, b3 as PalbaseEventsQueryInput, b4 as PalbaseEventsResult, b5 as PalbaseExtension, b6 as PalbaseFileObject, b7 as PalbaseFlag, b8 as PalbaseFlagContext, b9 as PalbaseFlagSource, ba as PalbaseFlagValue, bb as PalbaseFlagVariant, bc as PalbaseFlagsClient, bd as PalbaseFlagsServiceClient, be as PalbaseFunctionsClient, bf as PalbaseFunnelQueryInput, bg as PalbaseFunnelResult, bh as PalbaseIdentifyTraits, bi as PalbaseInboxClient, bj as PalbaseInboxListOptions, bk as PalbaseInboxListResult, bl as PalbaseInboxMessage, bm as PalbaseInboxSendParams, bn as PalbaseInboxSendResponse, bo as PalbaseInitialLink, bp as PalbaseInvokeOptions, bq as PalbaseLink, br as PalbaseLinkAnalytics, bs as PalbaseLinkDetails, bt as PalbaseLinksClient, bu as PalbaseListLinksOptions, bv as PalbaseListLinksResult, bw as PalbaseListOptions, bx as PalbaseMatchParams, by as PalbaseMultiChannelResponse, bz as PalbaseNotificationChannel, bA as PalbaseNotificationsClient, bB as PalbaseOverviewResult, bC as PalbasePreferences, bD as PalbasePreferencesClient, bE as PalbasePushClient, bF as PalbasePushSendParams, bG as PalbasePushSendResponse, bH as PalbaseQrCodeOptions, bI as PalbaseQuerySnapshot, bJ as PalbaseRealtimeClient, bK as PalbaseRegisterDeviceParams, bL as PalbaseRetentionQueryInput, bM as PalbaseRetentionResult, bN as PalbaseSession, bO as PalbaseSetOverrideResult, bP as PalbaseSetOverridesResult, bQ as PalbaseSignedUrlResponse, bR as PalbaseSmsClient, bS as PalbaseSmsSendParams, bT as PalbaseSmsSendResponse, bU as PalbaseStorageClient, bV as PalbaseTransformOptions, bW as PalbaseUpdateLinkParams, bX as PalbaseUploadOptions, bY as PalbaseUser, bZ as PalbaseUserDetailResult, b_ as PalbaseUsersQueryInput, b$ as PalbaseUsersResult, c0 as PalbaseVerifyRequestSignatureParams, c1 as PalbaseWhatsAppClient, c2 as PalbaseWhatsAppEvent, c3 as PalbaseWhatsAppSendParams, c4 as PalbaseWhatsAppSendResponse, c5 as PalbaseWhatsAppTemplate, c6 as PalbaseWhereOperator, c7 as PolicyBinOp, c8 as PolicyBuilder, c9 as PolicyCommand, ca as PolicyDef, cb as PolicyExprCtx, cc as PolicyExprRef, cd as PolicyMode, ce as PolicyOperand, cf as QueryInput, R as RateLimitConfig, cg as RawConstraintDef, f as RawPageOptions, ch as Realtime, ci as Ref, cj as RequestStore, ck as RowShape, b as RuntimeServices, cl as Secrets, cm as SecretsService, cn as SerializationFailure, co as SetShape, cp as SetValue, cq as ShutdownRunner, cr as SqlFragment, cs as Storage, ct as TABLE_META, cu as TableDef, cv as TableHandle, cw as TableInput, cx as TableRef, cy as TooManyRequests, T as TransactionIsolation, cz as TxColumnExpr, cA as TxInsertShape, cB as TxInsertValue, cC as TxNow, cD as TxPlan, g as TxPlanBody, cE as TxPlanError, cF as TxPlanHandle, cG as TxPlanOpResult, cH as TxPlanRejection, h as TxPlanResponse, cI as TxRefError, cJ as TxRow, cK as TxRows, cL as TxSelectOptions, cM as TxSetShape, cN as TxSetValue, cO as TxTable, cP as TxTables, cQ as TxWhere, cR as TxWireExpr, cS as TxWireGuard, cT as TxWireOp, cU as TxWireRef, cV as TxWireValue, cW as TypedDB, cX as TypedTable, cY as TypedTx, cZ as Unauthorized, c_ as UniqueViolation, c$ as UniqueWhere, d0 as UserT, d1 as VerifiedDevice, d2 as WhereFilter, d3 as WhereOp, d4 as __getRuntime, j as __requestALS, d5 as __resetLifecycleHooks, d6 as __runStartHooks, _ as __runWithRuntime, d7 as __setRuntime, d8 as backfill, d9 as bigint, da as boolean, db as can, dc as check, dd as col, de as dec, df as decrement, dg as defineMiddleware, dh as defineSchema, di as defineTable, dj as enumType, dk as exprCtx, dl as foreignKey, dm as freeze, dn as guard, dp as inc, dq as increment, dr as index, ds as installationRef, dt as integer, du as isPalbaseExtension, dv as isRetryable, dw as jsonb, dx as makeTypedDB, dy as now, dz as numeric, dA as onShutdown, dB as onStart, dC as openai, dD as ownedByUser, dE as policy, dF as raw, dG as sqlFragment, dH as text, dI as timestamp, dJ as userRef, dK as uuid, dL as vector, dM as withRetry } from './index-B8zC9oV0.js';
+import { M as ModuleClients, C as Container } from './index-Ck2K1TgC.js';
+export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-Ck2K1TgC.js';
 export { TableTypes, Tables } from './db/env.js';
-export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.js';
-import { a as RouteOptions } from './registry-C7tCRyPm.js';
-export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-C7tCRyPm.js';
+export { PalbaseBucketName, PalbaseFlagKey, PalbaseRoleName, PalbaseSecretName, Roles } from './stack.js';
+import { a as RouteOptions } from './registry-wwVUGunv.js';
+export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-wwVUGunv.js';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import { T as Token } from './module-Dl1KFVtc.js';
@@ -639,8 +639,6 @@ declare function defineRepository<Row, Insert, Patch, K extends keyof Row & stri
     key?: PK;
 }): abstract new () => RepositoryOf<Row, Insert, Patch, K, PK>;
 
-declare function makeEnvDts(schemas: readonly SchemaDef[]): string;
-
 /**
  * stack-gen.ts — generate the `palbase-stack.d.ts` text from the names the
  * linked environment's stack holds.
@@ -685,18 +683,22 @@ interface StackNames {
      * variants", which renders `never` and accepts none.
      */
     buckets: readonly (string | BucketInput)[];
+    /**
+     * Application role names the stack declares (`palbase roles`).
+     *
+     * OPTIONAL — omitted by every caller that predates FR-002a (this file's own
+     * golden tests included). A missing set renders `interface Roles {}`, the
+     * same closed default as an empty one; no existing caller breaks.
+     */
+    roles?: readonly string[];
 }
-/**
- * Render the project's `palbase-stack.d.ts`.
- *
- * An empty set renders an empty interface, which is a MEANINGFUL value: the
- * stack holds no such names, so the corresponding union is `never` and every
- * call spelling one fails to compile. It is not the same as "the file was never
- * generated" only in that the file exists — both states refuse every name, and
- * both are correct.
- */
+/** Render the project's standalone `palbase-stack.d.ts` (pre-T008 shape; kept
+ * for the direct callers `index.ts` still exports it to). See
+ * {@link stackInterfaceBody} for what actually decides the four interfaces. */
 declare function makeStackDts(names: StackNames): string;
 
+declare function makeEnvDts(schemas: readonly SchemaDef[], names?: StackNames): string;
+
 /** Options accepted by `@Controller`. */
 interface ControllerOptions {
     /** Default auth for ALL routes in this controller (route-level overrides;

package/dist/index.js

@@ -43,9 +43,10 @@ import {
   isDeclarationRefused,
   jobsOf,
   makeEnvDts,
+  makeStackDts,
   roomsOf,
   webhooksOf
-} from "./chunk-H7EKL6HC.js";
+} from "./chunk-RA7KFELX.js";
 import {
   Auth,
   Cache,
@@ -1415,66 +1416,6 @@ function defineRepository(table, opts) {
 }
 __name(defineRepository, "defineRepository");
 
-// src/stack-gen.ts
-function liveNames(names) {
-  return [
-    ...new Set(names)
-  ].sort();
-}
-__name(liveNames, "liveNames");
-function memberName(name) {
-  return /^[A-Za-z_$][A-Za-z0-9_$]*$/.test(name) ? name : JSON.stringify(name);
-}
-__name(memberName, "memberName");
-function members(names) {
-  if (names.length === 0) return "";
-  return `
-${names.map((n) => `    ${memberName(n)}: true;`).join("\n")}
-  `;
-}
-__name(members, "members");
-function bucketMembers(buckets) {
-  const normalized = buckets.map((b) => typeof b === "string" ? {
-    name: b,
-    variants: []
-  } : b);
-  const byName = /* @__PURE__ */ new Map();
-  for (const b of normalized) byName.set(b.name, b.variants);
-  const names = [
-    ...byName.keys()
-  ].sort();
-  if (names.length === 0) return "";
-  const rows = names.map((name) => {
-    const variants = [
-      ...new Set(byName.get(name) ?? [])
-    ].sort();
-    const union = variants.length === 0 ? "never" : variants.map((v) => JSON.stringify(v)).join(" | ");
-    return `    ${memberName(name)}: { variants: ${union} };`;
-  });
-  return `
-${rows.join("\n")}
-  `;
-}
-__name(bucketMembers, "bucketMembers");
-function makeStackDts(names) {
-  const secrets = liveNames(names.secrets);
-  const flags = liveNames(names.flags);
-  return `// palbase-stack.d.ts \u2014 GENERATED by @palbase/backend. Do not edit.
-// Source: the linked environment's stack.
-
-declare module "@palbase/backend/stack" {
-  interface Secrets {${members(secrets)}}
-
-  interface Flags {${members(flags)}}
-
-  interface Buckets {${bucketMembers(names.buckets)}}
-}
-
-export {};
-`;
-}
-__name(makeStackDts, "makeStackDts");
-
 // src/decorators/methods.ts
 function makeMethodDecorator(method) {
   return function(subpath, options = {}) {