@pramen/server 0.0.48 → 0.0.50

package/dist/auth.d.ts

@@ -1,8 +1,9 @@
 import type { Identity } from "./sdk/acl";
+import type { JsonObject } from "./sdk/infer";
 /** Verifies a JWT and returns its claims, or null if invalid. Implementations
  * differ only in how they verify the signature. */
 export interface VerifyStrategy {
-    verify(token: string): Promise<Record<string, unknown> | null>;
+    verify(token: string): Promise<JsonObject | null>;
 }
 /** Optional, opt-in claim validation layered on top of signature + exp/nbf. All
  * default OFF (unset) so existing tokens keep verifying; a deployment turns these on
@@ -22,7 +23,7 @@ export declare class HmacStrategy implements VerifyStrategy {
     private readonly secret;
     private readonly opts;
     constructor(secret: string, opts?: VerifyOptions);
-    verify(token: string): Promise<Record<string, unknown> | null>;
+    verify(token: string): Promise<JsonObject | null>;
 }
 /** RS256 verified against a remote JWKS. Public keys are fetched once and cached
  * (TTL); a token with an unknown `kid` triggers one forced refetch to pick up key
@@ -35,7 +36,7 @@ export declare class JwksStrategy implements VerifyStrategy {
     private fetchedAt;
     private inflight;
     constructor(url: string, ttlMs?: number, opts?: VerifyOptions);
-    verify(token: string): Promise<Record<string, unknown> | null>;
+    verify(token: string): Promise<JsonObject | null>;
     private lookup;
     private keyFor;
     private refresh;

package/dist/cli.js

@@ -20,29 +20,10 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { createTableSql } from "./runtime/ddl";
 import { schemaHash } from "./runtime/migrate";
-import { diffSchemaShape, schemaShape } from "./runtime/schema-diff";
+import { diffSchemaFingerprint, schemaFingerprint } from "./runtime/schema-diff";
 import { entitiesInPartition, partitionsOf } from "./sdk/schema";
-/** Mint an HS256 JWT — mirrors what a real auth service would issue, for local
- * dev/testing (`pramen token`, and the default token for `schema status`). Signs
- * with AUTH_SECRET when set, else the dev secret from the scaffolded oblaka.ts. */
-const DEV_SECRET = "dev-secret-change-me";
-function bytesToB64url(bytes) {
-    let bin = "";
-    for (const b of bytes)
-        bin += String.fromCharCode(b);
-    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-const strToB64url = (s) => bytesToB64url(new TextEncoder().encode(s));
-async function sign(payload) {
-    const secret = process.env.AUTH_SECRET || DEV_SECRET;
-    const now = Math.floor(Date.now() / 1000);
-    const header = strToB64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
-    const body = strToB64url(JSON.stringify({ iat: now, exp: now + 3600, ...payload }));
-    const data = `${header}.${body}`;
-    const key = await crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
-    const sig = await crypto.subtle.sign("HMAC", key, new TextEncoder().encode(data));
-    return `${data}.${bytesToB64url(new Uint8Array(sig))}`;
-}
+import { signDevToken } from "./runtime/dev-token";
+const sign = (payload) => signDevToken(payload);
 /** The sub-schema of a single partition (used to mirror the DO's per-partition hash,
  * which migrate() computes over exactly this subset). For a single-partition app the
  * subset equals the whole schema, so the hash is identical to the unpartitioned case. */
@@ -90,7 +71,7 @@ Usage: pramen <command>
   init [dir]                scaffold a new project (app.ts + worker.ts + oblaka.ts)
   schema sql                print CREATE TABLE statements for the schema
   schema hash               print the schema hash
-  schema snapshot           save the schema shape to .pramen/schema.json
+  schema snapshot           save the schema fingerprint to .pramen/schema.json
   schema diff               compare the schema to the snapshot (safe vs unsafe)
   schema status             compare a deployed tenant's schema to the local schema
                             [--tenant t] [--url u] [--token jwt]
@@ -113,20 +94,23 @@ async function schemaCmd(sub) {
     if (sub === "snapshot") {
         const { schema } = await loadApp();
         mkdirSync(dirname(snapshotPath), { recursive: true });
-        const snap = { hash: schemaHash(schema), shape: schemaShape(schema) };
+        const snap = { hash: schemaHash(schema), fingerprint: schemaFingerprint(schema) };
         writeFileSync(snapshotPath, JSON.stringify(snap, null, 2) + "\n");
-        console.log(`wrote ${snapshotPath} (${Object.keys(snap.shape).length} tables)`);
+        console.log(`wrote ${snapshotPath} (${Object.keys(snap.fingerprint).length} tables)`);
         return;
     }
     if (sub === "diff") {
         const { schema } = await loadApp();
-        const next = schemaShape(schema);
+        const next = schemaFingerprint(schema);
         if (!existsSync(snapshotPath)) {
             console.log("no snapshot — run `pramen schema snapshot` to set a baseline.");
             return;
         }
-        const prev = JSON.parse(readFileSync(snapshotPath, "utf8")).shape;
-        const changes = diffSchemaShape(prev, next);
+        // `fingerprint` was called `shape` before; keep reading an existing snapshot so an
+        // upgrade doesn't force a re-baseline.
+        const snap = JSON.parse(readFileSync(snapshotPath, "utf8"));
+        const prev = snap.fingerprint ?? snap["shape"] ?? {};
+        const changes = diffSchemaFingerprint(prev, next);
         if (changes.length === 0) {
             console.log("no changes since snapshot.");
             return;
@@ -181,7 +165,7 @@ async function schemaCmd(sub) {
             console.log(`live:    ${live.hash ?? "(none)"}`);
             console.log(`current: ${current}`);
             console.log(upToDate ? "✓ up to date" : "⚠ BEHIND — migrates on the tenant's next boot");
-            const want = schemaShape(subset);
+            const want = schemaFingerprint(subset);
             for (const table of Object.keys(want)) {
                 const liveCols = new Set(live.tables[table] ?? []);
                 const missing = Object.keys(want[table].columns).filter((col) => !liveCols.has(col));
@@ -202,7 +186,10 @@ async function tokenCmd(args) {
         fail("token: <sub> required");
     const roles = pos.slice(1);
     const tenants = flag("tenant")?.split(",");
-    console.log(await sign({ sub, roles: roles.length ? roles : ["admin"], ...(tenants ? { tenants } : {}) }));
+    const claims = { sub, roles: roles.length ? roles : ["admin"] };
+    if (tenants)
+        claims.tenants = tenants;
+    console.log(await sign(claims));
 }
 function initCmd(args) {
     const dir = resolve(process.cwd(), positionals(args)[0] ?? ".");

package/dist/dev.d.ts

@@ -0,0 +1 @@
+export { signDevToken, DEV_SECRET } from "./runtime/dev-token";

package/dist/dev.js

@@ -0,0 +1,9 @@
+// `@pramen/server/dev` — tooling helpers, deliberately NOT on the authoring entry point.
+//
+// `signDevToken` mints an HS256 JWT for local development: the `pramen` and `pramen-cms`
+// bins and the repo's test helper all use it. It is kept off `@pramen/server` because its
+// secret lookup reads `process.env.AUTH_SECRET`, which does not exist in a deployed
+// Worker (bindings and secrets arrive on `env`) — so an app handler importing it from the
+// main entry would silently sign with the PUBLISHED dev constant while appearing to honour
+// AUTH_SECRET. A separate subpath makes "this is dev tooling" part of the import.
+export { signDevToken, DEV_SECRET } from "./runtime/dev-token";

package/dist/durable-object.d.ts

@@ -76,6 +76,7 @@ export declare class PramenDOBase extends DurableObject<DoEnv> {
     private handleSchema;
     private handleAdminData;
     private ctxFor;
+    private widenedEnv;
     private get envBag();
     private filesFor;
     private identityOf;

package/dist/durable-object.js

@@ -164,9 +164,10 @@ export class PramenDOBase extends DurableObject {
             return new Response(null, { status: 101, webSocket: client });
         }
         const name = new URL(request.url).pathname.replace(/^\/rpc\//, "");
-        let input;
+        // The RPC body is JSON — parse it into the domain type once, here at the boundary.
+        let input = null;
         if (request.method === "POST") {
-            input = await request.json().catch(() => undefined);
+            input = ((await request.json().catch(() => null)) ?? null);
         }
         try {
             const { result, kind, touched, enqueued } = await dispatch(this.app.handlers, this.app.schema, this.driver, this.kv, this.filesFor(this.tenant), this.envBag, this.ctxFor(identity), name, input);
@@ -202,6 +203,8 @@ export class PramenDOBase extends DurableObject {
             files: this.filesFor(this.tenant),
             env: this.envBag,
             identity,
+            tenant: this.tenant,
+            store: "do",
             tasks: tasksFacade(this.driver),
             mail: createMail(this.envBag, this.kv),
             queue: createQueue(this.envBag),
@@ -291,12 +294,12 @@ export class PramenDOBase extends DurableObject {
         await this.ensureMigrated();
         switch (msg.type) {
             case "subscribe":
-                return this.onSubscribe(ws, msg.id, msg.name, msg.input);
+                return this.onSubscribe(ws, msg.id, msg.name, msg.input ?? null);
             case "unsubscribe":
                 this.setSubs(ws, this.getSubs(ws).filter((s) => s.id !== msg.id));
                 return;
             case "call":
-                return this.onCall(ws, msg.id, msg.name, msg.input);
+                return this.onCall(ws, msg.id, msg.name, msg.input ?? null);
             default:
                 return this.send(ws, { type: "error", id: "", error: "unknown message type" });
         }
@@ -532,12 +535,16 @@ export class PramenDOBase extends DurableObject {
         // Carry the schema so any consumer of this context (not just Db) can compile
         // relation-aware `where` rules into subqueries, and the active partition so Db's
         // table-access guard rejects any table outside this DO's partition.
-        return { acl: this.acl, identity, schema: this.app.schema, partition };
+        return { acl: this.acl, identity, schema: this.app.schema, partition, tenant: this.tenant };
     }
     // The DO env (bindings + vars + secrets) handed to handlers as ctx.env. Loosely
     // typed at the boundary so handlers can read any var/secret without a DoEnv cast.
+    widenedEnv = null;
     get envBag() {
-        return this.env;
+        // `this.env` is fixed for the DO's lifetime, so widen it once. This getter is read
+        // inside the per-subscription live-query loop, where a copy per read would allocate
+        // one whole binding bag per subscription on every write.
+        return (this.widenedEnv ??= { ...this.env });
     }
     // One Files facade per DO (a DO serves one tenant). Backed by the R2 binding;
     // signing uses FILES_SECRET. Handlers mint signed urls; the bytes never enter here.

package/dist/index.d.ts

@@ -1,16 +1,18 @@
-export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, hidden, defaultTo, primaryKey, generated, expr, ExprDefault, trigger } from "./sdk/schema";
+export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, hidden, defaultTo, primaryKey, generated, expr, ExprDefault, trigger, partitionOf, DEFAULT_PARTITION } from "./sdk/schema";
 export type { TriggerDef, TriggerOp } from "./sdk/schema";
 export { isValidUuid } from "./sdk/uuid";
 export type { DefaultValue, FieldType, FieldDef, EntityFields, EntityDef, SchemaDef, RelationDef, RelationDefs, BelongsToDef, HasManyDef, ManyToManyDef, OneHasOneDef, OneHasOneInverseDef, OnDelete, } from "./sdk/schema";
 export { createApp } from "./sdk/app";
 export { query, mutation, authorizeHandler } from "./sdk/handlers";
-export type { Handler, HandlerContext, HandlerKind, HandlerMap, HandlerOpts, HandlerAuth, Tasks, TaskHandler, AppTaskMap, BootstrapContext, BootstrapFn } from "./sdk/handlers";
+export type { EnvBag, Handler, HandlerContext, HandlerKind, HandlerMap, HandlerOpts, HandlerAuth, Tasks, TaskHandler, AppTaskMap, BootstrapContext, BootstrapFn } from "./sdk/handlers";
 export { $identity, $input, $now, allow, deny, policy, resolve, role, isAllow, isDeny, isResolver, isIdentityMarker, isInputMarker, isNowMarker } from "./sdk/acl";
 export type { Action, Identity, IdentityMarker, InputMarker, NowMarker, Policy, PolicyRule, PolicyRules, Role, Validator, WhereRule, ConditionalFields, FieldsFn, RelationAclRule, SetValue, ResolverFn, ResolverContext, ResolverDb, } from "./sdk/acl";
-export type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, JsonValue, ProjectedRow, RelationsOf, RelationsResult, WhereClause, WhereInput, WhereOps, } from "./sdk/infer";
+export type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, JsonValue, JsonObject, SqlValue, CellValue, Row, ProjectedRow, RelationsOf, RelationsResult, WhereClause, WhereInput, WhereOps, } from "./sdk/infer";
 export { Kv, denySession, allowSession, isSessionDenied } from "./runtime/kv";
 export type { FileRef, Files, SignUploadOpts, SignDownloadOpts, HeadResult } from "./sdk/files";
 export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runtime/storage";
+export { signToken, verifyToken, isUsableSecret, resolveSecret, MIN_TOKEN_SECRET_LEN } from "./runtime/token";
+export type { ExpiringToken } from "./runtime/token";
 export type { StorageAdapter, PutResult, GetResult } from "./runtime/storage";
 export { Mail, CloudflareEmailAdapter, KvMailAdapter, MemoryMailAdapter, UnconfiguredMailAdapter, createMail } from "./runtime/mail";
 export type { MailMessage, MailAddress, MailAdapter, SendEmailBinding } from "./runtime/mail";
@@ -18,6 +20,6 @@ export { Queue, CloudflareQueueAdapter, MemoryQueueAdapter, createQueue, discove
 export type { QueueAdapter, QueueProducerBinding, QueueSendOptions, QueueSendRequest, QueueBatchOptions, QueueContentType } from "./runtime/queue";
 export { routeQueue, dispatchQueueBatch } from "./runtime/queue-consumer";
 export type { QueueContext, QueueHandler, QueueMessage, QueueBatch, AppQueueMap } from "./runtime/queue-consumer";
-export { PramenError, BadRequest, Unauthorized, Forbidden } from "./runtime/errors";
+export { PramenError, BadRequest, Unauthorized, Forbidden, Conflict } from "./runtime/errors";
 export { sqliteDialect, postgresDialect, DoSqliteDriver, D1Driver } from "./runtime/driver";
-export type { Driver, Dialect, Row } from "./runtime/driver";
+export type { Driver, Dialect, DriverRow } from "./runtime/driver";

package/dist/index.js

@@ -7,7 +7,7 @@
 // which only exists in the Workers runtime; keeping it separate lets the CLI, tests,
 // and codegen load an app.ts for its schema without dragging in the DO runtime.
 // --- schema authoring ---
-export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, hidden, defaultTo, primaryKey, generated, expr, ExprDefault, trigger } from "./sdk/schema";
+export { Entity, defineSchema, renamedFrom, notNull, unique, indexed, hidden, defaultTo, primaryKey, generated, expr, ExprDefault, trigger, partitionOf, DEFAULT_PARTITION } from "./sdk/schema";
 export { isValidUuid } from "./sdk/uuid";
 // --- app + handlers ---
 export { createApp } from "./sdk/app";
@@ -17,12 +17,16 @@ export { $identity, $input, $now, allow, deny, policy, resolve, role, isAllow, i
 // --- kv (ctx.kv) + session denylist (hard token revocation) ---
 export { Kv, denySession, allowSession, isSessionDenied } from "./runtime/kv";
 export { R2Adapter, MemoryAdapter, createFiles, handleFileRequest } from "./runtime/storage";
+// Signed capability tokens (HMAC-SHA256) — the machinery behind signed file urls and
+// page-preview links. Exported so an app (or @pramen/cms) can mint its own capability url
+// without a second signing implementation.
+export { signToken, verifyToken, isUsableSecret, resolveSecret, MIN_TOKEN_SECRET_LEN } from "./runtime/token";
 // --- mail (ctx.mail) ---
 export { Mail, CloudflareEmailAdapter, KvMailAdapter, MemoryMailAdapter, UnconfiguredMailAdapter, createMail } from "./runtime/mail";
 // --- queue (ctx.queue — Cloudflare Queues) ---
 export { Queue, CloudflareQueueAdapter, MemoryQueueAdapter, createQueue, discoverQueueBindings } from "./runtime/queue";
 export { routeQueue, dispatchQueueBatch } from "./runtime/queue-consumer";
 // --- errors ---
-export { PramenError, BadRequest, Unauthorized, Forbidden } from "./runtime/errors";
+export { PramenError, BadRequest, Unauthorized, Forbidden, Conflict } from "./runtime/errors";
 // --- substrate seam (advanced: bring your own SQL backend) ---
 export { sqliteDialect, postgresDialect, DoSqliteDriver, D1Driver } from "./runtime/driver";

package/dist/pramen.d.ts

@@ -4,13 +4,15 @@ import { type SchemaDef } from "./sdk/schema";
 import type { AppTaskMap, HandlerMap, BootstrapFn } from "./sdk/handlers";
 import type { AppQueueMap, QueueBatch } from "./runtime/queue-consumer";
 import type { Role } from "./sdk/acl";
+import type { EnvBag } from "./sdk/handlers";
+import type { JsonValue } from "./sdk/infer";
 /** Injected into a public route's handler — forward a privileged mutation into the
  * tenant's DO without the handler importing any deploy-side code (so app.ts stays
  * authoring-only). The synthetic identity defaults to the admin role. */
 export interface RouteContext {
     callPrivileged(opts: {
         name: string;
-        input?: unknown;
+        input?: JsonValue;
         tenant?: string;
         roles?: string[];
     }): Promise<Response>;
@@ -25,7 +27,7 @@ export interface PublicRoute {
     method: string;
     /** Exact pathname to match (e.g. "/stripe/webhook"). */
     path: string;
-    handler: (request: Request, env: Readonly<Record<string, unknown>>, ctx: RouteContext) => Response | Promise<Response>;
+    handler: (request: Request, env: EnvBag, ctx: RouteContext) => Response | Promise<Response>;
 }
 /** The user-facing app: a schema, the handler map, ACL roles, and optional public
  * (pre-auth) routes. `example/app.ts` exports this shape. */

package/dist/runtime/acl.d.ts

@@ -1,6 +1,7 @@
-import { type Action, type FieldsFn, type Identity, type PolicyRule, type ResolverDb, type Role, type Validator } from "../sdk/acl";
+import { type Action, type FieldsFn, type Identity, type PolicyRule, type ResolverDb, type Role, type Validator, type WhereRule } from "../sdk/acl";
 import { type SqlExpr } from "./read-engine";
 import { PramenError } from "./errors";
+import type { Row } from "../sdk/infer";
 import type { SchemaDef } from "../sdk/schema";
 export declare class AclDenied extends PramenError {
     readonly entity: string;
@@ -26,6 +27,14 @@ export interface AclContext {
     /** The app schema — lets `where` rules traverse relations (`{ rel: { col } }`),
      * compiled to a subquery with the related entity's read scope AND-merged in. */
     readonly schema?: SchemaDef;
+    /** The tenant this request is for — the `x-pramen-tenant` value the DO was addressed
+     * with. Carried so a handler can mint a tenant-scoped capability (e.g. a signed page
+     * preview link) without the caller supplying, and thus being able to forge, a tenant. */
+    readonly tenant?: string;
+    /** Which substrate is serving this request — `"do"` (a Durable Object, the default) or
+     * `"d1"` (the shared D1 database, selected per-request with `x-pramen-store: d1`). A
+     * handler needs this when a capability it mints can only be redeemed on one of them. */
+    readonly store?: "do" | "d1";
     /** The partition this DO serves. When set, Db rejects any access to a table that
      * lives in a different partition (a partition-DO only owns its own tables). Unset
      * (e.g. the D1/Worker shared-store path) disables the guard — a no-op. */
@@ -78,15 +87,15 @@ export declare const MAX_REL_DEPTH = 5;
  * `allowRelations` is false for single-table contexts (cell-level `when`, which is
  * evaluated in memory and cannot do a SQL round-trip): a relation key then raises a
  * clear authoring error instead of emitting a `sub` node that throws at read time. */
-export declare function compileScopedWhere(rule: Record<string, unknown>, entity: string, ctx: AclContext, depth?: number, allowRelations?: boolean): SqlExpr;
+export declare function compileScopedWhere(rule: WhereRule, entity: string, ctx: AclContext, depth?: number, allowRelations?: boolean): SqlExpr;
 export declare function resolveScope(ctx: AclContext, entity: string, action: Action, depth?: number): Scope;
 /** Effective visible fields for one row = base ∪ matching-conditional ∪ fn-output.
  * Returns null (all fields) when the base is null or a resolver grants everything. */
-export declare function effectiveFields(scope: Scope, row: Record<string, unknown>, identity: Identity | null): string[] | null;
+export declare function effectiveFields(scope: Scope, row: Row, identity: Identity | null): string[] | null;
 /** Forced values + validators for a write, gathered from matched write policies.
  * `set` values are resolved against the identity; later policies override earlier. */
 export interface WriteRules {
-    set: Record<string, unknown>;
+    set: Row;
     validators: Validator[];
 }
 export declare function resolveWriteRules(ctx: AclContext, entity: string, action: Action): WriteRules;
@@ -94,4 +103,4 @@ export declare function resolveWriteRules(ctx: AclContext, entity: string, actio
  * target's own read scope OR a parent read policy's relation rule with directAccess. */
 export declare function resolveRelationScope(ctx: AclContext, parentEntity: string, relName: string, target: string): Scope;
 /** Project a row to the permitted fields. null = all. */
-export declare function projectRow(row: Record<string, unknown>, fields: string[] | null): Record<string, unknown>;
+export declare function projectRow(row: Row, fields: string[] | null): Row;

package/dist/runtime/acl.js

@@ -85,10 +85,6 @@ function getPath(obj, path) {
     return path.split(".").reduce((acc, seg) => (acc == null ? undefined : acc[seg]), obj ?? undefined);
 }
 const UNRESOLVED = Symbol("unresolved");
-// Resolve a value that may be an $identity marker (against the caller), an
-// $input marker (against the request input — a capability/by-key grant), or a
-// $now marker (the evaluation instant). An unresolvable marker yields UNRESOLVED,
-// which makes its rule match nothing. $now always resolves.
 function resolveValue(v, identity, input) {
     if (isNowMarker(v))
         return new Date().toISOString();
@@ -180,7 +176,7 @@ function pkOf(schema, entity) {
  * are skipped: they're re-scoped against THEIR own target's read scope downstream.
  * Mirrors Db.assertReadableWhere's recursion for the top-level user `where`. */
 function assertReadableRelationWhere(where, target, fields, ctx) {
-    const targetRels = (ctx.schema?.[target]?.relations ?? {});
+    const targetRels = ctx.schema?.[target]?.relations ?? {};
     for (const [k, v] of Object.entries(where)) {
         if (k === "AND" || k === "OR") {
             for (const g of v)

package/dist/runtime/db.d.ts

@@ -1,9 +1,10 @@
 import { type AclContext } from "./acl";
+import type { CellValue, Row as SharedRow } from "../sdk/infer";
 import { type AggFn } from "./read-engine";
 import type { Driver } from "./driver";
 import { type EntityFields, type SchemaDef } from "../sdk/schema";
 import type { Cell, FieldsOf, InferInsert, InferRow, InferUpdate, RelationsOf, RelationsResult, WhereClause } from "../sdk/infer";
-type Row = Record<string, unknown>;
+type Row = SharedRow;
 type Id = string | number | bigint;
 type OrderSpec<S extends SchemaDef, T extends keyof S> = {
     column: keyof FieldsOf<S[T]> & string;
@@ -215,7 +216,7 @@ export declare class Db<S extends SchemaDef = SchemaDef> {
     /** Delete a row by id within scope. Returns whether a row was deleted. */
     delete<T extends keyof S & string>(table: T, id: Id): Promise<boolean>;
     /** Escape hatch — raw SQL, NOT ACL-checked. For system/internal use only. */
-    exec(sql: string, ...params: unknown[]): Promise<Row[]>;
+    exec(sql: string, ...params: CellValue[]): Promise<Row[]>;
     private returningClause;
     private scopeClause;
 }

package/dist/runtime/dev-token.d.ts

@@ -0,0 +1,4 @@
+/** The scaffolded oblaka.ts dev secret. Used only when AUTH_SECRET is unset. */
+export declare const DEV_SECRET = "dev-secret-change-me";
+/** Sign a dev JWT (1h). Secret: the `secret` argument, else `AUTH_SECRET`, else DEV_SECRET. */
+export declare function signDevToken(payload: Record<string, unknown>, secret?: string): Promise<string>;

package/dist/runtime/dev-token.js

@@ -0,0 +1,34 @@
+// Mint an HS256 JWT for local development and tooling — what a real auth service would
+// issue, without running one.
+//
+// Extracted because it was already written twice (the `pramen` CLI and the repo's test
+// helper) and `@pramen/cms`'s own bin would have been a third. One implementation, in the
+// package that owns tokens.
+//
+// NOT an auth system: the dev fallback secret is public, so a token signed with it is
+// worthless anywhere `AUTH_SECRET` is set to something real. That is the point — it makes
+// a forgotten secret fail loudly rather than quietly accept dev tokens in production.
+/** The scaffolded oblaka.ts dev secret. Used only when AUTH_SECRET is unset. */
+export const DEV_SECRET = "dev-secret-change-me";
+function bytesToB64url(bytes) {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+const strToB64url = (s) => bytesToB64url(new TextEncoder().encode(s));
+/** Sign a dev JWT (1h). Secret: the `secret` argument, else `AUTH_SECRET`, else DEV_SECRET. */
+export async function signDevToken(payload, secret) {
+    // `||`, not `??`: an AUTH_SECRET set to the empty string previously fell through to
+    // DEV_SECRET, and signing with an empty HMAC key instead would produce tokens the server
+    // rejects with no useful message.
+    const env = globalThis.process?.env;
+    const key = secret || env?.AUTH_SECRET || DEV_SECRET;
+    const now = Math.floor(Date.now() / 1000);
+    const header = strToB64url(JSON.stringify({ alg: "HS256", typ: "JWT" }));
+    const body = strToB64url(JSON.stringify({ iat: now, exp: now + 3600, ...payload }));
+    const data = `${header}.${body}`;
+    const cryptoKey = await crypto.subtle.importKey("raw", new TextEncoder().encode(key), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const sig = await crypto.subtle.sign("HMAC", cryptoKey, new TextEncoder().encode(data));
+    return `${data}.${bytesToB64url(new Uint8Array(sig))}`;
+}

package/dist/runtime/dispatch.d.ts

@@ -5,6 +5,8 @@ import type { Kv } from "./kv";
 import type { Files } from "../sdk/files";
 import type { SchemaDef } from "../sdk/schema";
 import { type AppTaskMap, type HandlerContext, type HandlerKind, type HandlerMap, type Tasks } from "../sdk/handlers";
+import type { EnvBag } from "../sdk/handlers";
+import type { JsonValue } from "../sdk/infer";
 export interface DispatchResult {
     readonly result: unknown;
     readonly kind: HandlerKind;
@@ -17,4 +19,4 @@ export interface DispatchResult {
 export declare function tasksFacade(driver: Driver, onEnqueue?: () => void): Tasks;
 /** Bind `app.tasks` (which take a ctx) into the ctx-free `TaskMap` the drainer calls. */
 export declare function bindTasks(appTasks: AppTaskMap | undefined, ctx: HandlerContext): TaskMap;
-export declare function dispatch(handlers: HandlerMap, schema: SchemaDef, driver: Driver, kv: Kv, files: Files, env: Readonly<Record<string, unknown>>, acl: AclContext, name: string, input: unknown): Promise<DispatchResult>;
+export declare function dispatch(handlers: HandlerMap, schema: SchemaDef, driver: Driver, kv: Kv, files: Files, env: EnvBag, acl: AclContext, name: string, input: JsonValue): Promise<DispatchResult>;

package/dist/runtime/dispatch.js

@@ -62,6 +62,8 @@ export async function dispatch(handlers, schema, driver, kv, files, env, acl, na
         files,
         env,
         identity: acl.identity,
+        tenant: acl.tenant ?? "main",
+        store: acl.store ?? "do",
         tasks: tasksFacade(driver, () => enqueued++),
         mail: createMail(env, kv),
         queue: createQueue(env),

package/dist/runtime/driver.d.ts

@@ -1,4 +1,7 @@
-export type Row = Record<string, unknown>;
+/** A raw row exactly as the substrate returns it, before pramen's object↔JSON codec.
+ * Distinct from the decoded `Row` handlers see at the `Db` chokepoint. */
+export type DriverRow = Record<string, SqlValue>;
+import type { CellValue, SqlValue } from "../sdk/infer";
 export interface Dialect {
     /** Render an identifier (table/column), quoting as the backend requires. */
     id(name: string): string;
@@ -7,7 +10,7 @@ export interface Dialect {
     /** Whether INSERT/UPDATE/DELETE ... RETURNING is supported (SQLite/Postgres yes; MySQL no). */
     readonly returning: boolean;
     /** Coerce a JS value for binding (e.g. boolean → 0/1 on SQLite). */
-    encode(v: unknown): unknown;
+    encode(v: CellValue): CellValue;
 }
 /** Render an identifier as a standard double-quoted name (`"order"`), guarding its
  * shape first. SQLite (DO SQLite + D1) and Postgres all accept double-quoted
@@ -27,7 +30,7 @@ export interface Driver {
     readonly dialect: Dialect;
     /** Run a parameterized statement and return the result rows (empty for writes
      * without RETURNING). Params are already dialect-encoded by the caller. */
-    exec(sql: string, params: unknown[]): Promise<Row[]>;
+    exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
     /** Run `fn` inside a transaction: commit on resolve, roll back on throw. */
     transaction<T>(fn: () => Promise<T>): Promise<T>;
     /** Run a fixed sequence of write statements ATOMICALLY with FK checks deferred to the
@@ -46,7 +49,7 @@ export declare class DoSqliteDriver implements Driver {
     private readonly storage;
     readonly dialect: Dialect;
     constructor(storage: DurableObjectStorage);
-    exec(sql: string, params: unknown[]): Promise<Row[]>;
+    exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
     transaction<T>(fn: () => Promise<T>): Promise<T>;
 }
 /** How a D1Driver's session is anchored (passed to `db.withSession`):
@@ -79,7 +82,7 @@ export declare class D1Driver implements Driver {
     constructor(db: D1Database, opts?: {
         start?: D1SessionStart;
     });
-    exec(sql: string, params: unknown[]): Promise<Row[]>;
+    exec(sql: string, params: CellValue[]): Promise<DriverRow[]>;
     /** The session's latest bookmark (null before any query). Threaded back to the client
      * via the `x-pramen-d1-bookmark` response header so a subsequent request can anchor a
      * fresh session at it and read its own writes. */

package/dist/runtime/errors.d.ts

@@ -15,6 +15,12 @@ export declare class Unauthorized extends PramenError {
 export declare class Forbidden extends PramenError {
     constructor(message?: string);
 }
+/** 409 — the request conflicts with the current state of the resource. For
+ * optimistic concurrency (a stale `expectedVersion`) and for uniqueness clashes the
+ * caller could resolve by retrying with different input. */
+export declare class Conflict extends PramenError {
+    constructor(message?: string);
+}
 export interface ErrorBody {
     ok: false;
     error: string;

package/dist/runtime/errors.js

@@ -29,6 +29,14 @@ export class Forbidden extends PramenError {
         super(message, 403, "forbidden");
     }
 }
+/** 409 — the request conflicts with the current state of the resource. For
+ * optimistic concurrency (a stale `expectedVersion`) and for uniqueness clashes the
+ * caller could resolve by retrying with different input. */
+export class Conflict extends PramenError {
+    constructor(message = "conflict") {
+        super(message, 409, "conflict");
+    }
+}
 function classify(err) {
     if (err instanceof PramenError) {
         return { status: err.status, body: { ok: false, error: err.message, code: err.code } };

package/dist/runtime/mail.d.ts

@@ -1,4 +1,5 @@
 import type { Kv } from "./kv";
+import type { EnvBag } from "../sdk/handlers";
 export interface MailAddress {
     email: string;
     name?: string;
@@ -77,4 +78,4 @@ export declare class UnconfiguredMailAdapter implements MailAdapter {
  *    a synthetic dev sender — an EXPLICIT dev opt-in, never the production default.
  *  - else → fail closed: a `send` throws (so a missing-MAIL_FROM prod doesn't silently
  *    stash security emails in KV). */
-export declare function createMail(env: Readonly<Record<string, unknown>>, kv?: Kv): Mail;
+export declare function createMail(env: EnvBag, kv?: Kv): Mail;

package/dist/runtime/protocol.d.ts

@@ -1,8 +1,9 @@
+import type { JsonValue } from "../sdk/infer";
 export interface SubscribeMsg {
     type: "subscribe";
     id: string;
     name: string;
-    input?: unknown;
+    input?: JsonValue;
 }
 export interface UnsubscribeMsg {
     type: "unsubscribe";
@@ -12,7 +13,7 @@ export interface CallMsg {
     type: "call";
     id: string;
     name: string;
-    input?: unknown;
+    input?: JsonValue;
 }
 export type ClientMsg = SubscribeMsg | UnsubscribeMsg | CallMsg;
 export type ServerMsg = {
@@ -32,7 +33,7 @@ export type ServerMsg = {
 export interface Subscription {
     id: string;
     name: string;
-    input: unknown;
+    input: JsonValue;
     /** Tables the query read — the coarse prefilter for which writes might matter. */
     tables: string[];
     /** Digest of the last result pushed — used to suppress no-op (row-level) pushes. */

package/dist/runtime/queue-consumer.d.ts

@@ -1,6 +1,8 @@
 import type { Mail } from "./mail";
 import type { Queue } from "./queue";
 import type { Kv } from "./kv";
+import type { EnvBag } from "../sdk/handlers";
+import type { JsonValue } from "../sdk/infer";
 /** One received message (the Cloudflare Queues `Message` shape). */
 export interface QueueMessage<Body = unknown> {
     readonly id: string;
@@ -30,7 +32,7 @@ export interface QueueBatch<Body = unknown> {
  * tenant data via `ctx.callPrivileged`. */
 export interface QueueContext {
     /** The Worker environment (bindings + vars + secrets). */
-    readonly env: Readonly<Record<string, unknown>>;
+    readonly env: EnvBag;
     /** Project KV (cross-tenant). */
     readonly kv: Kv;
     /** Send email (the notification path). */
@@ -41,7 +43,7 @@ export interface QueueContext {
      * The message body should carry the `tenant`. */
     callPrivileged(opts: {
         name: string;
-        input?: unknown;
+        input?: JsonValue;
         tenant?: string;
         roles?: string[];
         partition?: string;

package/dist/runtime/queue.d.ts

@@ -1,3 +1,4 @@
+import type { EnvBag } from "../sdk/handlers";
 /** Cloudflare Queues content type for a sent message. Omitted ⇒ the platform default
  * (v8 structured clone). Use "json" for cross-runtime / external consumers. */
 export type QueueContentType = "text" | "bytes" | "json" | "v8";
@@ -64,9 +65,9 @@ export declare class MemoryQueueAdapter implements QueueAdapter {
 /** Discover the Cloudflare Queues producer bindings in an environment: any value that
  * exposes BOTH `send` and `sendBatch` functions (which excludes the email `send`-only
  * binding, KV, R2, D1, the DO namespace, …). Returns name → binding. */
-export declare function discoverQueueBindings(env: Readonly<Record<string, unknown>>): Record<string, QueueProducerBinding>;
+export declare function discoverQueueBindings(env: EnvBag): Record<string, QueueProducerBinding>;
 /** Build `ctx.queue` from the environment: a Cloudflare adapter over the discovered
  * producer bindings. Sending to an undeclared queue fails closed (the adapter throws).
  * There is no silent capture fallback — declare the `Queue` binding and it exists in
  * dev (lopata) and miniflare too. */
-export declare function createQueue(env: Readonly<Record<string, unknown>>): Queue;
+export declare function createQueue(env: EnvBag): Queue;