palbase 0.10.0 → 0.10.2

package/dist/refuse/ai.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
 throw new Error("palbase/ai is for servers: it speaks with the project secret key, which never goes into a browser or a mobile app \u2014 call your backend, and let it ask the model");

package/dist/refuse/backend.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
 throw new Error("palbase/backend is a server framework: it runs on your backend, never in a browser or a mobile app \u2014 apps use palbase/web (or the native SDKs)");

package/dist/refuse/server.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
 throw new Error("palbase/server is for servers: its secret key never goes into a browser or a mobile app \u2014 apps use palbase/web (or the native SDKs) with the publishable key");

package/dist/server/index.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{a as c,b as d,c as e,d as f,e as g,f as h,g as i,h as j,i as k,j as l,k as m,l as n,m as o,n as p,o as q,p as r,q as s,r as t}from"../chunks/4TAQYROZ.js";import"../chunks/25HVOUXT.js";import{m as b}from"../chunks/ZTEFF6RA.js";import"../chunks/DZEBLD5Q.js";import{b as a}from"../chunks/3GAOOWLS.js";import"../chunks/KEIAA3OO.js";import"../chunks/D3TRQOQE.js";export{j as AuthUnavailable,b as EVENT_TYPES,a as PalbaseError,o as ReservationSettled,i as TokenError,l as TokenVerifier,d as WebhookSignatureError,c as createServer,n as isEntitled,t as loadSecrets,q as pages,s as platformOwn,r as processOwn,m as requestAddress,k as sessionStanding,g as signatureHeader,f as verifySignature,e as verifyWebhook,h as verifyWebhookRequest,p as withReservation};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{a as c,b as d,c as e,d as f,e as g,f as h,g as i,h as j,i as k,j as l,k as m,l as n,m as o,n as p,o as q,p as r,q as s,r as t}from"../chunks/PKBCMWTM.js";import"../chunks/O5CJJFEU.js";import{m as b}from"../chunks/BMCC423W.js";import"../chunks/QTAPRS4Q.js";import{b as a}from"../chunks/SCXHU5B7.js";import"../chunks/RYWIWH4U.js";import"../chunks/MAPLN2FY.js";export{j as AuthUnavailable,b as EVENT_TYPES,a as PalbaseError,o as ReservationSettled,i as TokenError,l as TokenVerifier,d as WebhookSignatureError,c as createServer,n as isEntitled,t as loadSecrets,q as pages,s as platformOwn,r as processOwn,m as requestAddress,k as sessionStanding,g as signatureHeader,f as verifySignature,e as verifyWebhook,h as verifyWebhookRequest,p as withReservation};

package/dist/server/testing.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{a,b,c,d}from"../chunks/PVUUYZ5Q.js";import"../chunks/KEIAA3OO.js";import"../chunks/D3TRQOQE.js";export{a as TestApiError,d as api,b as createTestApi,c as testRun};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{a,b,c,d}from"../chunks/I2TY2GLY.js";import"../chunks/RYWIWH4U.js";import"../chunks/MAPLN2FY.js";export{a as TestApiError,d as api,b as createTestApi,c as testRun};

package/dist/web/index.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{a as h,b as g,c as C,d as w,e as v,f as b,g as E,h as T,i as P,j as S,k as x,l as k,m as R,n as I,o as L,p as M,q as G}from"../chunks/OCTZRGVD.js";import{a as V,b as O,f as A}from"../chunks/3VSPZCIV.js";import"../chunks/RT2KS2DU.js";import"../chunks/HLH62XRX.js";import"../chunks/QM66Y5BA.js";import"../chunks/GLCP3MQA.js";import"../chunks/ZTEFF6RA.js";import"../chunks/DZEBLD5Q.js";import{b as u}from"../chunks/3GAOOWLS.js";import"../chunks/KEIAA3OO.js";import"../chunks/D3TRQOQE.js";var D="oai-events";async function N(e){if(typeof e?.start!="function")throw new TypeError("connectVoice: start(sdp) is the round trip to the app's backend, which starts the voice (chats.voice.start) and answers { id, sdp }");let o=e.rtc??B(),t=e.signal;t?.throwIfAborted();let s=e.audio??F(),c=e.microphone===void 0,a=e.microphone??await o.getUserMedia({audio:!0});if(t?.aborted){if(c)for(let r of a.getTracks())r.stop();throw t.reason}let n=new o.RTCPeerConnection,p=!1,d=()=>{if(!p){if(p=!0,f.close(),n.close(),c)for(let r of a.getTracks())r.stop();s.srcObject!==null&&(s.srcObject=null)}};n.addEventListener("track",r=>{s.srcObject=r.streams[0]??new MediaStream([r.track]),s.play?.()?.catch?.(()=>{})}),n.addEventListener("connectionstatechange",()=>e.onState?.(n.connectionState));for(let r of a.getAudioTracks())n.addTrack(r,a);let f=n.createDataChannel(D);f.addEventListener("message",r=>{let i=U(r.data);i!==void 0&&e.onError?.(i)});let y=()=>d();t?.addEventListener("abort",y,{once:!0});try{await n.setLocalDescription(await n.createOffer()),t?.throwIfAborted(),await H(n,e.iceTimeoutMs??1e4,t);let r=n.localDescription?.sdp;if(!r)throw new Error("connectVoice: the peer connection made no offer");let i=await e.start(r);if(t?.throwIfAborted(),typeof i?.id!="string"||i.id===""||typeof i.sdp!="string"||i.sdp==="")throw new TypeError("connectVoice: start answered no voice \u2014 it is { id, sdp }, chats.voice.start's answer as the backend got it");return await n.setRemoteDescription({type:"answer",sdp:i.sdp}),t?.removeEventListener("abort",y),{id:i.id,peer:n,audio:s,microphone:a,get muted(){return a.getAudioTracks().every(l=>!l.enabled)},mute(l){for(let m of a.getAudioTracks())m.enabled=!l},close:d}}catch(r){throw t?.removeEventListener("abort",y),d(),t?.aborted?t.reason:r}}function H(e,o,t){return e.iceGatheringState==="complete"?Promise.resolve():t?.aborted?Promise.reject(t.reason):new Promise((s,c)=>{let a=()=>{clearTimeout(d),e.removeEventListener("icegatheringstatechange",n),t?.removeEventListener("abort",p)},n=()=>{e.iceGatheringState==="complete"&&(a(),s())},p=()=>{a(),c(t?.reason)},d=setTimeout(()=>{a(),c(new Error(`connectVoice: the network candidates were not gathered in ${o} ms`))},o);e.addEventListener("icegatheringstatechange",n),t?.addEventListener("abort",p,{once:!0})})}function U(e){if(typeof e=="string")try{let o=JSON.parse(e);return o.type!=="error"?void 0:typeof o.error?.message=="string"?o.error.message:typeof o.error?.code=="string"?o.error.code:"the voice failed"}catch{return}}function B(){let e=globalThis;if(typeof e.RTCPeerConnection!="function"||typeof e.navigator?.mediaDevices?.getUserMedia!="function")throw new TypeError("connectVoice: this runtime has no WebRTC (RTCPeerConnection, navigator.mediaDevices): a chat's voice is a browser's");let o=e.navigator.mediaDevices;return{RTCPeerConnection:e.RTCPeerConnection,getUserMedia:t=>o.getUserMedia(t)}}function F(){let e=globalThis.document;if(!e)throw new TypeError("connectVoice: give audio \u2014 the element the voice plays in \u2014 where there is no document");let o=e.createElement("audio");return o.autoplay=!0,o}export{E as Analytics,V as BackendError,w as Channel,T as Consent,M as Flags,A as GatewayError,x as InApp,P as Inbox,b as Installation,R as Notify,u as PalbaseError,I as Purchases,v as RealtimeSocket,S as SESSION_START,h as SessionChangedError,k as WebPush,N as connectVoice,G as createClient,O as isBackendError,C as localStore,g as memoryStore,L as redemptionToken};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{a as h,b as g,c as C,d as w,e as v,f as b,g as E,h as T,i as P,j as S,k as x,l as k,m as R,n as I,o as L,p as M,q as G}from"../chunks/S4F256W2.js";import{a as V,b as O,f as A}from"../chunks/6JUQZ4D4.js";import"../chunks/L4SCG6HT.js";import"../chunks/IW34A4TV.js";import"../chunks/7PBQ3LI2.js";import"../chunks/5NZGW67E.js";import"../chunks/BMCC423W.js";import"../chunks/QTAPRS4Q.js";import{b as u}from"../chunks/SCXHU5B7.js";import"../chunks/RYWIWH4U.js";import"../chunks/MAPLN2FY.js";var D="oai-events";async function N(e){if(typeof e?.start!="function")throw new TypeError("connectVoice: start(sdp) is the round trip to the app's backend, which starts the voice (chats.voice.start) and answers { id, sdp }");let o=e.rtc??B(),t=e.signal;t?.throwIfAborted();let s=e.audio??F(),c=e.microphone===void 0,a=e.microphone??await o.getUserMedia({audio:!0});if(t?.aborted){if(c)for(let r of a.getTracks())r.stop();throw t.reason}let n=new o.RTCPeerConnection,p=!1,d=()=>{if(!p){if(p=!0,f.close(),n.close(),c)for(let r of a.getTracks())r.stop();s.srcObject!==null&&(s.srcObject=null)}};n.addEventListener("track",r=>{s.srcObject=r.streams[0]??new MediaStream([r.track]),s.play?.()?.catch?.(()=>{})}),n.addEventListener("connectionstatechange",()=>e.onState?.(n.connectionState));for(let r of a.getAudioTracks())n.addTrack(r,a);let f=n.createDataChannel(D);f.addEventListener("message",r=>{let i=U(r.data);i!==void 0&&e.onError?.(i)});let y=()=>d();t?.addEventListener("abort",y,{once:!0});try{await n.setLocalDescription(await n.createOffer()),t?.throwIfAborted(),await H(n,e.iceTimeoutMs??1e4,t);let r=n.localDescription?.sdp;if(!r)throw new Error("connectVoice: the peer connection made no offer");let i=await e.start(r);if(t?.throwIfAborted(),typeof i?.id!="string"||i.id===""||typeof i.sdp!="string"||i.sdp==="")throw new TypeError("connectVoice: start answered no voice \u2014 it is { id, sdp }, chats.voice.start's answer as the backend got it");return await n.setRemoteDescription({type:"answer",sdp:i.sdp}),t?.removeEventListener("abort",y),{id:i.id,peer:n,audio:s,microphone:a,get muted(){return a.getAudioTracks().every(l=>!l.enabled)},mute(l){for(let m of a.getAudioTracks())m.enabled=!l},close:d}}catch(r){throw t?.removeEventListener("abort",y),d(),t?.aborted?t.reason:r}}function H(e,o,t){return e.iceGatheringState==="complete"?Promise.resolve():t?.aborted?Promise.reject(t.reason):new Promise((s,c)=>{let a=()=>{clearTimeout(d),e.removeEventListener("icegatheringstatechange",n),t?.removeEventListener("abort",p)},n=()=>{e.iceGatheringState==="complete"&&(a(),s())},p=()=>{a(),c(t?.reason)},d=setTimeout(()=>{a(),c(new Error(`connectVoice: the network candidates were not gathered in ${o} ms`))},o);e.addEventListener("icegatheringstatechange",n),t?.addEventListener("abort",p,{once:!0})})}function U(e){if(typeof e=="string")try{let o=JSON.parse(e);return o.type!=="error"?void 0:typeof o.error?.message=="string"?o.error.message:typeof o.error?.code=="string"?o.error.code:"the voice failed"}catch{return}}function B(){let e=globalThis;if(typeof e.RTCPeerConnection!="function"||typeof e.navigator?.mediaDevices?.getUserMedia!="function")throw new TypeError("connectVoice: this runtime has no WebRTC (RTCPeerConnection, navigator.mediaDevices): a chat's voice is a browser's");let o=e.navigator.mediaDevices;return{RTCPeerConnection:e.RTCPeerConnection,getUserMedia:t=>o.getUserMedia(t)}}function F(){let e=globalThis.document;if(!e)throw new TypeError("connectVoice: give audio \u2014 the element the voice plays in \u2014 where there is no document");let o=e.createElement("audio");return o.autoplay=!0,o}export{E as Analytics,V as BackendError,w as Channel,T as Consent,M as Flags,A as GatewayError,x as InApp,P as Inbox,b as Installation,R as Notify,u as PalbaseError,I as Purchases,v as RealtimeSocket,S as SESSION_START,h as SessionChangedError,k as WebPush,N as connectVoice,G as createClient,O as isBackendError,C as localStore,g as memoryStore,L as redemptionToken};

package/dist/web/message.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{a as i}from"../chunks/HLH62XRX.js";import{a as e,b as s,c as t,d as p,e as o,f as a,h as r,j as n,k as y,p as M,q as l,t as g}from"../chunks/QM66Y5BA.js";import"../chunks/D3TRQOQE.js";export{n as MESSAGE_COMPONENTS,a as MESSAGE_ICONS,r as MESSAGE_SCHEMA,s as assetId,y as countdownValues,e as fontFamily,o as htmlDocument,t as prepareAssets,i as presentMessage,g as renderMessage,M as resolveMessage,l as resolveMessageWithPaths,p as unzip};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{a as i}from"../chunks/IW34A4TV.js";import{a as e,b as s,c as t,d as p,e as o,f as a,h as r,j as n,k as y,p as M,q as l,t as g}from"../chunks/7PBQ3LI2.js";import"../chunks/MAPLN2FY.js";export{n as MESSAGE_COMPONENTS,a as MESSAGE_ICONS,r as MESSAGE_SCHEMA,s as assetId,y as countdownValues,e as fontFamily,o as htmlDocument,t as prepareAssets,i as presentMessage,g as renderMessage,M as resolveMessage,l as resolveMessageWithPaths,p as unzip};

package/dist/web/palbe.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{c as e,d as r,i as t}from"../chunks/3VSPZCIV.js";import"../chunks/GLCP3MQA.js";import"../chunks/DZEBLD5Q.js";import"../chunks/3GAOOWLS.js";import"../chunks/KEIAA3OO.js";import"../chunks/D3TRQOQE.js";export{e as RESERVED_CLIENT_NAMES,t as __registerBackend,r as isClientName};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{c as e,d as r,i as t}from"../chunks/6JUQZ4D4.js";import"../chunks/5NZGW67E.js";import"../chunks/QTAPRS4Q.js";import"../chunks/SCXHU5B7.js";import"../chunks/RYWIWH4U.js";import"../chunks/MAPLN2FY.js";export{e as RESERVED_CLIENT_NAMES,t as __registerBackend,r as isClientName};

package/dist/web/paywall.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{a as f,b as d,c as m,d as u,e as A,f as c,g as R}from"../chunks/RT2KS2DU.js";import{a as e,b as a,c as t,d as l,e as r,f as o,g as p,i as y,k as s,l as P,n,o as i,s as w}from"../chunks/QM66Y5BA.js";import"../chunks/3GAOOWLS.js";import"../chunks/KEIAA3OO.js";import"../chunks/D3TRQOQE.js";export{y as PAYWALL_COMPONENTS,o as PAYWALL_ICONS,p as PAYWALL_SCHEMA,c as Paywall,a as assetId,f as attributesHeader,s as countdownValues,R as defaultPaywall,e as fontFamily,u as formatPeriod,m as formatPrice,r as htmlDocument,A as packageValues,P as packagesOf,d as parseDuration,t as prepareAssets,w as renderPaywall,n as resolvePaywall,i as resolvePaywallWithPaths,l as unzip};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{a as f,b as d,c as m,d as u,e as A,f as c,g as R}from"../chunks/L4SCG6HT.js";import{a as e,b as a,c as t,d as l,e as r,f as o,g as p,i as y,k as s,l as P,n,o as i,s as w}from"../chunks/7PBQ3LI2.js";import"../chunks/SCXHU5B7.js";import"../chunks/RYWIWH4U.js";import"../chunks/MAPLN2FY.js";export{y as PAYWALL_COMPONENTS,o as PAYWALL_ICONS,p as PAYWALL_SCHEMA,c as Paywall,a as assetId,f as attributesHeader,s as countdownValues,R as defaultPaywall,e as fontFamily,u as formatPeriod,m as formatPrice,r as htmlDocument,A as packageValues,P as packagesOf,d as parseDuration,t as prepareAssets,w as renderPaywall,n as resolvePaywall,i as resolvePaywallWithPaths,l as unzip};

package/dist/web/push-sw.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
 "use strict";(()=>{function f(e,s){if(e)try{let i=new URL(e,s);if(i.protocol==="https:"||i.protocol==="http:"&&(i.hostname==="localhost"||i.hostname==="127.0.0.1"))return i.href}catch{}}function g(e){let s=new URL(e.location.href).searchParams,i=s.get("url")??"",l=s.get("key")??"",r=(n,t)=>!n||!i?Promise.resolve():e.fetch(`${i.replace(/\/$/,"")}/notify/receipts`,{method:"POST",headers:{"content-type":"application/json",apikey:l},body:JSON.stringify({receipts:[{receipt:n,status:t}]}),keepalive:!0}).catch(()=>{}),a=async(n,t)=>{for(let o of await e.clients.matchAll({type:"window",includeUncontrolled:!0}))o.postMessage({type:"palbase.push",event:n,url:t.url,data:t.data})};e.addEventListener("push",(n=>{let t={};try{t=n.data?.json()??{}}catch{}let o={url:t.url,receipt:t.receipt,data:t.data};n.waitUntil(e.registration.showNotification(t.title??"",{body:t.body,image:t.image,tag:t.tag,data:o}).then(()=>Promise.all([r(t.receipt,"delivered"),a("received",o)])))})),e.addEventListener("notificationclick",(n=>{n.notification.close();let t=n.notification.data??{},o=f(t.url,e.location.origin),c=async()=>{if(!o)return;let d=(await e.clients.matchAll({type:"window",includeUncontrolled:!0})).find(u=>u.url===o);d?await d.focus():await e.clients.openWindow(o)};n.waitUntil(Promise.all([r(t.receipt,"opened"),c(),a("opened",t)]))})),e.addEventListener("notificationclose",(n=>{n.waitUntil(r(n.notification.data?.receipt,"dismissed"))}))}typeof self<"u"&&typeof self.registration=="object"&&!("document"in self)&&g(self);})();

package/dist/web/ssr.js

@@ -1,2 +1,2 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import{q as f}from"../chunks/OCTZRGVD.js";import"../chunks/3VSPZCIV.js";import"../chunks/RT2KS2DU.js";import"../chunks/HLH62XRX.js";import"../chunks/QM66Y5BA.js";import"../chunks/GLCP3MQA.js";import"../chunks/ZTEFF6RA.js";import"../chunks/DZEBLD5Q.js";import"../chunks/3GAOOWLS.js";import"../chunks/KEIAA3OO.js";import"../chunks/D3TRQOQE.js";var C=Object.freeze({"Cache-Control":"private, no-cache, no-store, must-revalidate, max-age=0",Expires:"0",Pragma:"no-cache"}),x={path:"/",sameSite:"lax",secure:!0,httpOnly:!1,maxAge:400*24*60*60},u=3180,k=5*6e4;function d(t){let e=/^pb_([a-z0-9]+)_c/.exec(t)?.[1];if(e===void 0)throw new TypeError("publishableKey is the project publishable key (pb_<ref>_c\u2026)");return`pb-${e}-session`}var y=t=>{let e=new TextEncoder().encode(JSON.stringify(t)),o="";for(let s of e)o+=String.fromCharCode(s);return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},b=t=>{try{let e=atob(t.replace(/-/g,"+").replace(/_/g,"/")),o=JSON.parse(new TextDecoder().decode(Uint8Array.from(e,s=>s.charCodeAt(0))));return typeof o.accessToken!="string"||typeof o.refreshToken!="string"||typeof o.expiresAt!="number"||typeof o.userId!="string"?null:o}catch{return null}};function m(t,e,o={},s=!1){let c={...x,...o},g=async()=>new Map((await e.getAll()).map(n=>[n.name,n.value])),S=n=>n===t||n.startsWith(`${t}.`)&&/^\d+$/.test(n.slice(t.length+1)),h=async n=>{if(!e.setAll)return;let i=n===null?[]:n.length<=u?[[t,n]]:Array.from({length:Math.ceil(n.length/u)},(r,l)=>[`${t}.${l}`,n.slice(l*u,(l+1)*u)]),p=new Set(i.map(([r])=>r)),a=i.map(([r,l])=>({name:r,value:l,options:c}));for(let r of(await g()).keys())S(r)&&!p.has(r)&&a.push({name:r,value:"",options:{...c,maxAge:0}});a.length>0&&await e.setAll(a,{...C})};return{async load(){let n=await g(),i=n.get(t);if(i===void 0){let p="";for(let a=0;n.has(`${t}.${a}`);a++)p+=n.get(`${t}.${a}`);i=p}return i?b(i):null},save:n=>h(y(n)),clear:()=>h(null),shared:s}}function A(t){let{cookies:e,cookieOptions:o,...s}=t,c=t.refresh??(e.setAll?"before":"never");return f({...s,refresh:c,storage:m(d(t.publishableKey),e,o)})}function O(){let t=()=>{let e=globalThis.document;if(!e)throw new Error("documentCookies: there is no document here \u2014 a server gives its request's cookies to createServerClient");return e};return{getAll:()=>t().cookie.split(";").map(e=>e.trim()).filter(e=>e.includes("=")).map(e=>{let o=e.indexOf("=");return{name:e.slice(0,o),value:e.slice(o+1)}}),setAll(e){for(let o of e){let s=o.options,c=[`Path=${s.path??"/"}`,s.domain?`Domain=${s.domain}`:"",s.maxAge!==void 0?`Max-Age=${s.maxAge}`:"",s.expires?`Expires=${s.expires.toUTCString()}`:"",s.sameSite?`SameSite=${s.sameSite.charAt(0).toUpperCase()}${s.sameSite.slice(1)}`:"",s.secure?"Secure":""].filter(Boolean);t().cookie=[`${o.name}=${o.value}`,...c].join("; ")}}}}function $(t){let{cookieOptions:e,...o}=t,s=globalThis.location?.protocol==="https:";return f({...o,storage:m(d(t.publishableKey),O(),{secure:s,...e},!0)})}async function v(t){let e=await t.auth.currentSession();if(!e||(e.expiresAt-Date.now()<=k&&await t.auth.refreshSession().catch(()=>{}),!await t.auth.currentSession()))return null;try{return(await t.auth.api.verifyTokenUser()).data}catch(o){if(o.status===401)return null;throw o}}export{C as NO_STORE_HEADERS,x as SESSION_COOKIE_OPTIONS,m as cookieSessionStore,$ as createBrowserClient,A as createServerClient,O as documentCookies,v as keepSession,d as sessionCookieName};
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import{q as f}from"../chunks/S4F256W2.js";import"../chunks/6JUQZ4D4.js";import"../chunks/L4SCG6HT.js";import"../chunks/IW34A4TV.js";import"../chunks/7PBQ3LI2.js";import"../chunks/5NZGW67E.js";import"../chunks/BMCC423W.js";import"../chunks/QTAPRS4Q.js";import"../chunks/SCXHU5B7.js";import"../chunks/RYWIWH4U.js";import"../chunks/MAPLN2FY.js";var C=Object.freeze({"Cache-Control":"private, no-cache, no-store, must-revalidate, max-age=0",Expires:"0",Pragma:"no-cache"}),x={path:"/",sameSite:"lax",secure:!0,httpOnly:!1,maxAge:400*24*60*60},u=3180,k=5*6e4;function d(t){let e=/^pb_([a-z0-9]+)_c/.exec(t)?.[1];if(e===void 0)throw new TypeError("publishableKey is the project publishable key (pb_<ref>_c\u2026)");return`pb-${e}-session`}var y=t=>{let e=new TextEncoder().encode(JSON.stringify(t)),o="";for(let s of e)o+=String.fromCharCode(s);return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},b=t=>{try{let e=atob(t.replace(/-/g,"+").replace(/_/g,"/")),o=JSON.parse(new TextDecoder().decode(Uint8Array.from(e,s=>s.charCodeAt(0))));return typeof o.accessToken!="string"||typeof o.refreshToken!="string"||typeof o.expiresAt!="number"||typeof o.userId!="string"?null:o}catch{return null}};function m(t,e,o={},s=!1){let c={...x,...o},g=async()=>new Map((await e.getAll()).map(n=>[n.name,n.value])),S=n=>n===t||n.startsWith(`${t}.`)&&/^\d+$/.test(n.slice(t.length+1)),h=async n=>{if(!e.setAll)return;let i=n===null?[]:n.length<=u?[[t,n]]:Array.from({length:Math.ceil(n.length/u)},(r,l)=>[`${t}.${l}`,n.slice(l*u,(l+1)*u)]),p=new Set(i.map(([r])=>r)),a=i.map(([r,l])=>({name:r,value:l,options:c}));for(let r of(await g()).keys())S(r)&&!p.has(r)&&a.push({name:r,value:"",options:{...c,maxAge:0}});a.length>0&&await e.setAll(a,{...C})};return{async load(){let n=await g(),i=n.get(t);if(i===void 0){let p="";for(let a=0;n.has(`${t}.${a}`);a++)p+=n.get(`${t}.${a}`);i=p}return i?b(i):null},save:n=>h(y(n)),clear:()=>h(null),shared:s}}function A(t){let{cookies:e,cookieOptions:o,...s}=t,c=t.refresh??(e.setAll?"before":"never");return f({...s,refresh:c,storage:m(d(t.publishableKey),e,o)})}function O(){let t=()=>{let e=globalThis.document;if(!e)throw new Error("documentCookies: there is no document here \u2014 a server gives its request's cookies to createServerClient");return e};return{getAll:()=>t().cookie.split(";").map(e=>e.trim()).filter(e=>e.includes("=")).map(e=>{let o=e.indexOf("=");return{name:e.slice(0,o),value:e.slice(o+1)}}),setAll(e){for(let o of e){let s=o.options,c=[`Path=${s.path??"/"}`,s.domain?`Domain=${s.domain}`:"",s.maxAge!==void 0?`Max-Age=${s.maxAge}`:"",s.expires?`Expires=${s.expires.toUTCString()}`:"",s.sameSite?`SameSite=${s.sameSite.charAt(0).toUpperCase()}${s.sameSite.slice(1)}`:"",s.secure?"Secure":""].filter(Boolean);t().cookie=[`${o.name}=${o.value}`,...c].join("; ")}}}}function $(t){let{cookieOptions:e,...o}=t,s=globalThis.location?.protocol==="https:";return f({...o,storage:m(d(t.publishableKey),O(),{secure:s,...e},!0)})}async function v(t){let e=await t.auth.currentSession();if(!e||(e.expiresAt-Date.now()<=k&&await t.auth.refreshSession().catch(()=>{}),!await t.auth.currentSession()))return null;try{return(await t.auth.api.verifyTokenUser()).data}catch(o){if(o.status===401)return null;throw o}}export{C as NO_STORE_HEADERS,x as SESSION_COOKIE_OPTIONS,m as cookieSessionStore,$ as createBrowserClient,A as createServerClient,O as documentCookies,v as keepSession,d as sessionCookieName};

package/dist/web/vite.js

@@ -1,3 +1,3 @@
-/*! palbase 0.10.0 — Palbase SDK License (see LICENSE) */
-import"../chunks/D3TRQOQE.js";import{execFile as $}from"node:child_process";import{existsSync as y,mkdtempSync as k,readFileSync as S,rmSync as x,writeFileSync as P}from"node:fs";import{createRequire as O}from"node:module";import{tmpdir as W}from"node:os";import{dirname as g,join as o,relative as u,resolve as v,sep as d}from"node:path";var E=/\.(?:ts|js|mts|mjs)$/;function F(n){if(!/^[a-z][a-z0-9-]*$/.test(n.app))throw new TypeError(`palbase({ app }): ${JSON.stringify(n.app)} is an app's slug (palbase apps:list)`);let c=process.cwd(),p="",i="",f=()=>v(c,n.dir??"palbase"),m=()=>{let e=n.environments[p];if(!e)throw new Error(`palbase: the mode "${p}" is not built against any environment \u2014 say which in vite.config: palbase({ environments: { ${JSON.stringify(p)}: '<environment slug>' } })`);return e};return{name:"palbase",enforce:"pre",config(e,s){p=s.mode,i=s.command??"";let r=e.build?.rollupOptions?.onwarn;return{build:{rollupOptions:{onwarn(t,a){let l=String(t.exporter??t.id??"");if(t.code==="MISSING_EXPORT"&&l.includes(`${d}environments${d}`))throw new Error(`palbase: ${t.message} \u2014 ${m()}'s backend has no such route (palbase apps:sync brings what it has)`);r?r(t,a):a(t)}}}}},configResolved(e){c=e.root,p=e.mode,i=e.command??i},async buildStart(){i!=="build"||n.typecheck===!1||await j(c,m(),n.tsconfig)},resolveId(e,s){if(!s)return null;let r=f();if(e==="palbase"||e.startsWith("palbase/")){let w=u(r,s);return w.startsWith("..")||w===""?null:this.resolve(e,o(c,"index.html"),{skipSelf:!0})}if(!(e.startsWith(".")||e.startsWith("/")))return null;let t=v(g(s),e);if(E.test(t)||(t+=".ts"),g(t)!==r&&g(t)!==o(r,"palbe"))return null;let a=u(r,t),l=`${n.app}.ts`;if(a!==l&&!a.startsWith(`palbe${d}`))return null;let h=m(),b=o(r,"environments",h,a===l?l:o("palbe",a.slice(`palbe${d}`.length)));if(!y(b))throw new Error(`palbase: ${u(c,b)} is not there \u2014 palbase apps:sync writes it (is ${n.app} set in ${h}, and has ${h} that machine?)`);return b}}}async function j(n,c,p){let i=p?v(n,p):["tsconfig.app.json","tsconfig.json"].map(e=>o(n,e)).find(y);if(!i)return;if(!y(i))throw new Error(`palbase({ tsconfig }): ${u(n,i)} is not there`);let f;try{let e=O(o(n,"package.json")).resolve("typescript/package.json"),s=JSON.parse(S(e,"utf8")).bin?.tsc;if(!s)throw new Error("no tsc");f=o(g(e),s)}catch{throw new Error("palbase: the build type-checks the app against its environment with the app's TypeScript, and the app has none (npm i -D typescript) \u2014 or say palbase({ typecheck: false })")}let m=k(o(W(),"palbase-typecheck-"));try{let e=o(m,"tsconfig.json");P(e,JSON.stringify({extends:i,compilerOptions:{noEmit:!0,composite:!1,incremental:!1,moduleSuffixes:[`.${c}`,""]}}));let s=await new Promise(r=>$(process.execPath,[f,"-p",e,"--pretty","false"],{cwd:n,maxBuffer:16<<20},(t,a,l)=>r({code:t?typeof t.code=="number"?t.code:1:0,text:`${a}${l}`.trim()})));if(s.code!==0)throw new Error(`palbase: the app does not type-check against ${c}, the environment this build is made for \u2014 a route its backend does not have, or a call that does not fit it:
+/*! palbase 0.10.2 — Palbase SDK License (see LICENSE) */
+import"../chunks/MAPLN2FY.js";import{execFile as $}from"node:child_process";import{existsSync as y,mkdtempSync as k,readFileSync as S,rmSync as x,writeFileSync as P}from"node:fs";import{createRequire as O}from"node:module";import{tmpdir as W}from"node:os";import{dirname as g,join as o,relative as u,resolve as v,sep as d}from"node:path";var E=/\.(?:ts|js|mts|mjs)$/;function F(n){if(!/^[a-z][a-z0-9-]*$/.test(n.app))throw new TypeError(`palbase({ app }): ${JSON.stringify(n.app)} is an app's slug (palbase apps:list)`);let c=process.cwd(),p="",i="",f=()=>v(c,n.dir??"palbase"),m=()=>{let e=n.environments[p];if(!e)throw new Error(`palbase: the mode "${p}" is not built against any environment \u2014 say which in vite.config: palbase({ environments: { ${JSON.stringify(p)}: '<environment slug>' } })`);return e};return{name:"palbase",enforce:"pre",config(e,s){p=s.mode,i=s.command??"";let r=e.build?.rollupOptions?.onwarn;return{build:{rollupOptions:{onwarn(t,a){let l=String(t.exporter??t.id??"");if(t.code==="MISSING_EXPORT"&&l.includes(`${d}environments${d}`))throw new Error(`palbase: ${t.message} \u2014 ${m()}'s backend has no such route (palbase apps:sync brings what it has)`);r?r(t,a):a(t)}}}}},configResolved(e){c=e.root,p=e.mode,i=e.command??i},async buildStart(){i!=="build"||n.typecheck===!1||await j(c,m(),n.tsconfig)},resolveId(e,s){if(!s)return null;let r=f();if(e==="palbase"||e.startsWith("palbase/")){let w=u(r,s);return w.startsWith("..")||w===""?null:this.resolve(e,o(c,"index.html"),{skipSelf:!0})}if(!(e.startsWith(".")||e.startsWith("/")))return null;let t=v(g(s),e);if(E.test(t)||(t+=".ts"),g(t)!==r&&g(t)!==o(r,"palbe"))return null;let a=u(r,t),l=`${n.app}.ts`;if(a!==l&&!a.startsWith(`palbe${d}`))return null;let h=m(),b=o(r,"environments",h,a===l?l:o("palbe",a.slice(`palbe${d}`.length)));if(!y(b))throw new Error(`palbase: ${u(c,b)} is not there \u2014 palbase apps:sync writes it (is ${n.app} set in ${h}, and has ${h} that machine?)`);return b}}}async function j(n,c,p){let i=p?v(n,p):["tsconfig.app.json","tsconfig.json"].map(e=>o(n,e)).find(y);if(!i)return;if(!y(i))throw new Error(`palbase({ tsconfig }): ${u(n,i)} is not there`);let f;try{let e=O(o(n,"package.json")).resolve("typescript/package.json"),s=JSON.parse(S(e,"utf8")).bin?.tsc;if(!s)throw new Error("no tsc");f=o(g(e),s)}catch{throw new Error("palbase: the build type-checks the app against its environment with the app's TypeScript, and the app has none (npm i -D typescript) \u2014 or say palbase({ typecheck: false })")}let m=k(o(W(),"palbase-typecheck-"));try{let e=o(m,"tsconfig.json");P(e,JSON.stringify({extends:i,compilerOptions:{noEmit:!0,composite:!1,incremental:!1,moduleSuffixes:[`.${c}`,""]}}));let s=await new Promise(r=>$(process.execPath,[f,"-p",e,"--pretty","false"],{cwd:n,maxBuffer:16<<20},(t,a,l)=>r({code:t?typeof t.code=="number"?t.code:1:0,text:`${a}${l}`.trim()})));if(s.code!==0)throw new Error(`palbase: the app does not type-check against ${c}, the environment this build is made for \u2014 a route its backend does not have, or a call that does not fit it:
 ${s.text}`)}finally{x(m,{recursive:!0,force:!0})}}export{F as palbase};

package/package.json

@@ -1,9 +1,28 @@
 {
   "name": "palbase",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "Palbase for JavaScript: the web client (palbase/web), the server SDK (palbase/server), the backend framework (palbase/backend), AI (palbase/ai) and the CLI (npx palbase).",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://palbase.studio",
+  "keywords": [
+    "palbase",
+    "baas",
+    "backend-as-a-service",
+    "backend",
+    "sdk",
+    "cli",
+    "auth",
+    "postgres",
+    "storage",
+    "realtime",
+    "feature-flags",
+    "push-notifications",
+    "in-app-purchases",
+    "analytics",
+    "ai",
+    "nextjs",
+    "typescript"
+  ],
   "author": "Pallasite OÜ",
   "type": "module",
   "engines": {
@@ -116,7 +135,7 @@
   "dependencies": {
     "@types/node": "26.6.4",
     "bun-types": "1.4.2",
-    "palgres": "0.10.0",
+    "palgres": "0.10.2",
     "reflect-metadata": "^0.2.2",
     "typescript": "~6.0.3",
     "zod": "^4.6.5"

package/types/backend/src/container.d.ts

@@ -30,6 +30,8 @@ export declare class Container {
     readonly cronProviders: Ctor[];
     /** The providers that are @Task classes: the platform runs them as their tasks come due. */
     readonly taskProviders: Ctor[];
+    /** The providers that are @TestUserTemplate classes: the platform calls them for the test users made with their names. */
+    readonly templateProviders: Ctor[];
     /** The providers that are @Gateway classes. */
     readonly gateways: Ctor[];
     constructor(modules: Function[]);

package/types/backend/src/decorators.d.ts

@@ -88,6 +88,7 @@ export declare const EVENTS: unique symbol;
 export declare const WEBHOOK: unique symbol;
 export declare const CRONS: unique symbol;
 export declare const TASKS: unique symbol;
+export declare const TEST_USER_TEMPLATES: unique symbol;
 export declare function declared(): Set<Function>;
 export declare const RESERVED: Set<string>;
 export declare function Controller(basePath: string, options?: ControllerOptions): ClassDecorator;

package/types/backend/src/engine.d.ts

@@ -106,7 +106,12 @@ export interface AppOptions {
      * - its ai tools and agents (@palbase/ai's ai.tool and ai.agent), from the
      *   ai module: POST /_palbase/ai/tools runs the tool an agent called (its
      *   body's tool), POST /_palbase/ai/agents answers the definition of the
-     *   agent a turn is of (its body's agent) — ai-calls.ts.
+     *   agent a turn is of (its body's agent) — ai-calls.ts;
+     * - its @TestUserTemplate classes, from the machines module, for a test
+     *   user it made through auth: POST /_palbase/test-user-templates/<name>
+     *   writes the template for the user its body names — a test user, auth
+     *   says, or 403 — and answers {rows: {table: n}}; …/<name>/undo takes it
+     *   away (404: the template has none) — test-user-templates.ts.
      */
     platform?: {
         secret: string;

package/types/backend/src/index.d.ts

@@ -1,6 +1,7 @@
 import 'reflect-metadata';
 export { Body, Client, Controller, Delete, Get, getRegisteredControllers, getRoutes, Headers, Cron, Injectable, Module, On, OptionalUser, Param, Patch, Post, Put, Query, QueryParams, Req, RequestId, Resolve, TraceId, User, Webhook, type AuthConfig, type AuthSpec, type ControllerOptions, type EventHandler, type CronMeta, type CronOptions, type ModuleDef, type OnOptions, type ParamResolver, type RateLimitConfig, type ResolveContext, type RouteInfo, type RouteOptions, type SignatureSpec, type StandardSchemaV1, type Token, type WebhookOptions, type WebhookProvider, } from './decorators.js';
 export { Task, TaskFailure, Tasks, type EnqueueOptions, type PayloadOf, type QueuedTask, type TaskClass, type TaskMeta, type TaskOptions, type TasksService } from './tasks.js';
+export { TestUserTemplate, type TemplateMeta, type TemplateUser, type TestUserTemplateClass, type TestUserTemplateOptions } from './test-user-templates.js';
 export { Upload, UploadedObject, type UploadConfig } from './upload.js';
 export { Authorize, ChatPart, Gateway, GatewayRefusal, OnConnect, OnDisconnect, OnEmpty, OnFirst, Subscribe, type GatewayAuthorizeContext, type GatewayContext, type GatewayEvents, type GatewayGrant, type GatewayMessageContext, type GatewayOptions, type GatewayUser, type PipeSource, } from './gateways.js';
 export type { GatewaysApi, GatewayTarget } from './runtime.js';

package/types/backend/src/test-user-templates.d.ts

@@ -0,0 +1,58 @@
+import type { PalbaseServer } from '../../server/src/index.js';
+export declare const TEST_USER_TEMPLATES_PATH = "/_palbase/test-user-templates";
+/** A template's name, as the platform takes it: lowercase letters, digits, '_' and '-', a letter first, at most 64. */
+export declare const TEMPLATE_NAME: RegExp;
+export interface TestUserTemplateOptions {
+    /** What `palbase auth:test-users:create --template <name>` names it by. */
+    name: string;
+}
+export interface TestUserTemplateDeclaration {
+    name: string;
+}
+/** The test user a template writes for, as the platform names it: auth made it, and says it is a test user. */
+export interface TemplateUser {
+    id: string;
+    email: string;
+}
+/** What seed() and undo() are given beside the user. */
+export interface TemplateMeta {
+    /** The app's environment variables, as it started (its keys left out). */
+    env: Record<string, string>;
+    /** The project the app belongs to (its id). */
+    environmentId: string;
+    /** The template's name. */
+    template: string;
+}
+/** A @TestUserTemplate class: seed(user, meta) writes what the screen shows, undo(user, meta) — when it has one — takes it away. */
+export type TestUserTemplateClass = abstract new (...args: never[]) => {
+    seed(user: TemplateUser, meta: TemplateMeta): unknown;
+    undo?(user: TemplateUser, meta: TemplateMeta): unknown;
+};
+/**
+ * A provider whose seed(user, meta) writes the data a test account needs —
+ * the rows behind the screen a person or an agent signs in to see — for test
+ * users alone: the platform calls it for each test user made with its name
+ * (palbase auth:test-users:create --template <name>), and the framework asks
+ * auth first that the user is a test user. It runs in one transaction, as the
+ * service role: all of it written, or none. An undo(user, meta) takes away
+ * what seed wrote that the user's deletion does not (user.deleted forgets
+ * what ownedByUser() owns). Its module lists it in its providers, as any other.
+ */
+export declare function TestUserTemplate(options: TestUserTemplateOptions): ClassDecorator;
+/** What the platform's call names, or why it is not one: the template the path names, and its test user. */
+export declare function templateCallOf(name: string, body: unknown): {
+    user: TemplateUser;
+} | string;
+/**
+ * Whether auth says the user is a test user: false for one it does not say
+ * is, or does not know (404). Anything else — auth not answering — throws: a
+ * template is never run, nor refused, on a guess.
+ */
+export declare function isTestUser(server: PalbaseServer, id: string): Promise<boolean>;
+/**
+ * The rows the transaction wrote, by table — public's by name, any other
+ * schema's as <schema>.<table> — as Postgres counts them for it
+ * (pg_stat_xact_user_tables: its inserts and updates). An app with no
+ * database wrote none.
+ */
+export declare function rowsWritten(database: object | undefined): Promise<Record<string, number>>;

package/types/internal/src/modules/auth.d.ts

@@ -627,7 +627,7 @@ export type AdminUserImportError = {
  */
 export type AdminUserImportHash = {
     /**
-     * palbase-argon2id: Argon2id (PHC string) over HMAC-SHA256(pepper, secret) — Palbase's own scheme, before and now.
+     * palbase-argon2id: Argon2id (PHC string) over HMAC-SHA256(pepper, secret) — Palbase's own scheme.
      */
     algorithm: "palbase-argon2id";
     /**
@@ -635,7 +635,7 @@ export type AdminUserImportHash = {
      */
     pepper: string;
     /**
-     * What the source put before a recovery code it hashed (the platform before used palauth-rc:). This platform's own, palbase-rc:, when absent.
+     * What the source put before a recovery code it hashed. This platform's own, palbase-rc:, when absent.
      */
     recovery_code_prefix?: string;
 };
@@ -1021,6 +1021,10 @@ export type AuthSettings = {
      * Bind each session to the device it was opened on: a refresh from another device fingerprint, browser or operating system ends the session; a network change is recorded in the audit log. Default false.
      */
     session_device_binding?: boolean;
+    /**
+     * Let clients create new users — the project's sign-up switch. Default true; off, every way a client opens an account answers 403 `signups_closed`: `POST /auth/signup`, a passkey signup, a guest, a phone's first code and a provider's first sign-in. Accounts sign in as before, and the admin API (`POST /admin/users`, imports, test users) still creates users.
+     */
+    signups_enabled?: boolean;
     /**
      * Base URL for the links in auth emails (reset, verify, magic link). Empty: the Palbase-hosted default.
      */
@@ -1100,6 +1104,10 @@ export type AuthSettingsUpdateRequest = {
      * Bind each session to the device it was opened on: a refresh from another device fingerprint, browser or operating system ends the session; a network change is recorded in the audit log. Default false.
      */
     session_device_binding?: boolean;
+    /**
+     * Let clients create new users — the project's sign-up switch. Default true; off, every way a client opens an account answers 403 `signups_closed`: `POST /auth/signup`, a passkey signup, a guest, a phone's first code and a provider's first sign-in. Accounts sign in as before, and the admin API (`POST /admin/users`, imports, test users) still creates users.
+     */
+    signups_enabled?: boolean;
     /**
      * Absolute http(s) URL without a fragment, at most 2048 characters; empty clears it.
      */
@@ -4521,7 +4529,7 @@ export declare function client(t: Transport): {
      *
      * Opens a guest account and its session: an account with no address, password or credential, whose id stays when it becomes an account — by `POST /auth/anonymous/convert` (an address and a password), by adding a passkey (`POST /auth/webauthn/register/begin`, with `user_name`), or by linking a provider (`POST /auth/oauth/transactions` with the guest's session). What the visitor does as a guest is kept under that id.
      *
-     * The project must have turned guests on (`anonymous_sign_ins`; 403 `anonymous_sign_ins_disabled` otherwise). Held to what holds signup: the project's user ceiling (403 `signups_closed`), proof of work (403 `pow_required`, with the challenge), the risk engine and the project's `before.user.create` hook (told `is_anonymous`) — and to 30 guests an hour from one address (429). The access token carries `is_anonymous: true`; a native client that sends a DPoP proof gets the session and its tokens bound to that key, as a sign-in does. Send an `Idempotency-Key`: a retry then gets the same guest back, not a second one.
+     * The project must have turned guests on (`anonymous_sign_ins`; 403 `anonymous_sign_ins_disabled` otherwise). Held to what holds signup: the project's sign-up switch and user ceiling (`signups_enabled`, 403 `signups_closed`), proof of work (403 `pow_required`, with the challenge), the risk engine and the project's `before.user.create` hook (told `is_anonymous`) — and to 30 guests an hour from one address (429). The access token carries `is_anonymous: true`; a native client that sends a DPoP proof gets the session and its tokens bound to that key, as a sign-in does. Send an `Idempotency-Key`: a retry then gets the same guest back, not a second one.
      */
     signInAnonymously(input?: {
         headers?: {
@@ -5098,7 +5106,7 @@ export declare function client(t: Transport): {
     /**
      * Complete a social sign-in
      *
-     * Finishes a sign-in with the provider's answer: signs the user in (or asks for a second factor), or links the identity. Retrying with the same body answers the same result.
+     * Finishes a sign-in with the provider's answer: signs the user in (or asks for a second factor), or links the identity. Retrying with the same body answers the same result. A first sign-in that would open an account answers 403 `signups_closed` while the project takes no new users.
      */
     socialComplete(input: {
         path: {
@@ -5119,7 +5127,7 @@ export declare function client(t: Transport): {
     /**
      * Sign in with an SMS code
      *
-     * Checks the code sent by `POST /auth/otp`. A correct code signs the phone's owner in; an unknown number gets a new account when the project allows phone sign-ups (403 `signup_disabled` otherwise). A user with a second factor enrolled gets the `mfa_required` envelope instead of tokens and finishes with `mfa_token` at `/auth/mfa/*`. Codes are single-use; too many wrong attempts (`otp_max_attempts`) or an expired code (`otp_expired`) means requesting a new one.
+     * Checks the code sent by `POST /auth/otp`. A correct code signs the phone's owner in; an unknown number gets a new account when the project allows phone sign-ups (403 `signup_disabled` otherwise) and takes new users at all (403 `signups_closed` otherwise). A user with a second factor enrolled gets the `mfa_required` envelope instead of tokens and finishes with `mfa_token` at `/auth/mfa/*`. Codes are single-use; too many wrong attempts (`otp_max_attempts`) or an expired code (`otp_expired`) means requesting a new one.
      */
     verifyPhoneOtp(input: {
         body: PhoneOTPVerifyRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
@@ -5411,6 +5419,8 @@ export declare function client(t: Transport): {
      * IP-based rate limiting. Pepper + Argon2id is applied server-side;
      * the plaintext password never reaches storage.
      *
+     * 403 `signups_closed` while the project takes no new users (its `signups_enabled` is off, or its user ceiling is reached).
+     *
      */
     signup(input: {
         headers?: {
@@ -5762,6 +5772,8 @@ export declare function client(t: Transport): {
      * Finish the ceremony at `/auth/webauthn/signup/finish` carrying
      * the returned `user_id` as a query parameter.
      *
+     * 403 `signups_closed` while the project takes no new users.
+     *
      */
     webauthnSignupBegin(input: {
         body: WebAuthnSignupBeginRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
@@ -5774,6 +5786,8 @@ export declare function client(t: Transport): {
      * attestation for the user returned by
      * `/auth/webauthn/signup/begin`.
      *
+     * 403 `signups_closed` while the project takes no new users.
+     *
      */
     webauthnSignupFinish(input: {
         query: {

package/types/internal/src/modules/events.d.ts

@@ -13,11 +13,11 @@ export interface PlatformEvents extends AiEvents, AnalyticsEvents, AuthEvents, F
 /** A platform event's type: one a module's contract declares. */
 export type EventType = keyof PlatformEvents;
 /** Every platform event's type, as the contracts declare them. */
-export declare const EVENT_TYPES: readonly ["ai.goal.updated", "ai.response.completed", "ai.response.failed", "ai.response.started", "ai.voice.closed", "ai.voice.delegated", "ai.voice.started", "ai.workspace.published", "ai.workspace.pushed", "audience.entered", "audience.exited", "consent.changed", "device.revoked", "file.deleted", "file.moved", "file.uploaded", "flag.changed", "flag.override_changed", "notification.action", "notification.bounced", "notification.complained", "notification.delivered", "notification.dismissed", "notification.expired", "notification.failed", "notification.not_shown", "notification.opened", "notification.read", "notification.received", "notification.rejected", "notification.sent", "notification.unconfirmed", "notification.undelivered", "notification.uninstalled", "purchases.catalog.applied", "purchases.catalog.changed", "purchases.coupon.redeemed", "purchases.credits.depleted", "purchases.credits.low", "purchases.customer.changed", "purchases.customer.erased", "purchases.customer.merged", "purchases.entitlement.changed", "purchases.offer.redeemed", "purchases.ownership.transferred", "purchases.paywall.published", "purchases.purchase.completed", "purchases.quota.exhausted", "purchases.quota.threshold", "purchases.refund.changed", "purchases.store.changed", "purchases.subscription.changed", "session.ended", "stores.action.changed", "stores.app.changed", "stores.apple.changed", "stores.delivery.changed", "stores.delivery.requested", "stores.google.changed", "stores.group.changed", "stores.package.changed", "user.converted", "user.deleted", "user.locale_changed", "user.permissions_changed"];
+export declare const EVENT_TYPES: readonly ["ai.goal.updated", "ai.response.completed", "ai.response.failed", "ai.response.started", "ai.voice.closed", "ai.voice.delegated", "ai.voice.started", "ai.workspace.published", "ai.workspace.pushed", "audience.entered", "audience.exited", "consent.changed", "device.revoked", "file.deleted", "file.moved", "file.uploaded", "flag.changed", "flag.override_changed", "notification.action", "notification.bounced", "notification.complained", "notification.delivered", "notification.dismissed", "notification.expired", "notification.failed", "notification.not_shown", "notification.opened", "notification.read", "notification.received", "notification.rejected", "notification.sent", "notification.unconfirmed", "notification.undelivered", "notification.uninstalled", "purchases.catalog.applied", "purchases.catalog.changed", "purchases.coupon.redeemed", "purchases.credits.depleted", "purchases.credits.low", "purchases.customer.changed", "purchases.customer.erased", "purchases.customer.merged", "purchases.entitlement.changed", "purchases.offer.redeemed", "purchases.ownership.transferred", "purchases.paywall.published", "purchases.purchase.completed", "purchases.quota.exhausted", "purchases.quota.threshold", "purchases.refund.changed", "purchases.store.changed", "purchases.subscription.changed", "session.ended", "stores.action.changed", "stores.app.changed", "stores.apple.changed", "stores.delivery.changed", "stores.delivery.requested", "stores.google.changed", "stores.group.changed", "stores.package.changed", "stores.version.changed", "stores.version.reviewed", "user.converted", "user.deleted", "user.locale_changed", "user.permissions_changed"];
 /**
  * A platform event as delivered: one member per type the contracts declare,
  * its data that type's payload, so a switch on its type narrows it. An
  * event of a type none of them declares (one a newer platform sends) is no
  * member: at run time it reaches the switch's default, which takes it.
  */
-export type PalbaseEvent = WebhookEvent<PlatformEvents["ai.goal.updated"], "ai.goal.updated"> | WebhookEvent<PlatformEvents["ai.response.completed"], "ai.response.completed"> | WebhookEvent<PlatformEvents["ai.response.failed"], "ai.response.failed"> | WebhookEvent<PlatformEvents["ai.response.started"], "ai.response.started"> | WebhookEvent<PlatformEvents["ai.voice.closed"], "ai.voice.closed"> | WebhookEvent<PlatformEvents["ai.voice.delegated"], "ai.voice.delegated"> | WebhookEvent<PlatformEvents["ai.voice.started"], "ai.voice.started"> | WebhookEvent<PlatformEvents["ai.workspace.published"], "ai.workspace.published"> | WebhookEvent<PlatformEvents["ai.workspace.pushed"], "ai.workspace.pushed"> | WebhookEvent<PlatformEvents["audience.entered"], "audience.entered"> | WebhookEvent<PlatformEvents["audience.exited"], "audience.exited"> | WebhookEvent<PlatformEvents["consent.changed"], "consent.changed"> | WebhookEvent<PlatformEvents["device.revoked"], "device.revoked"> | WebhookEvent<PlatformEvents["file.deleted"], "file.deleted"> | WebhookEvent<PlatformEvents["file.moved"], "file.moved"> | WebhookEvent<PlatformEvents["file.uploaded"], "file.uploaded"> | WebhookEvent<PlatformEvents["flag.changed"], "flag.changed"> | WebhookEvent<PlatformEvents["flag.override_changed"], "flag.override_changed"> | WebhookEvent<PlatformEvents["notification.action"], "notification.action"> | WebhookEvent<PlatformEvents["notification.bounced"], "notification.bounced"> | WebhookEvent<PlatformEvents["notification.complained"], "notification.complained"> | WebhookEvent<PlatformEvents["notification.delivered"], "notification.delivered"> | WebhookEvent<PlatformEvents["notification.dismissed"], "notification.dismissed"> | WebhookEvent<PlatformEvents["notification.expired"], "notification.expired"> | WebhookEvent<PlatformEvents["notification.failed"], "notification.failed"> | WebhookEvent<PlatformEvents["notification.not_shown"], "notification.not_shown"> | WebhookEvent<PlatformEvents["notification.opened"], "notification.opened"> | WebhookEvent<PlatformEvents["notification.read"], "notification.read"> | WebhookEvent<PlatformEvents["notification.received"], "notification.received"> | WebhookEvent<PlatformEvents["notification.rejected"], "notification.rejected"> | WebhookEvent<PlatformEvents["notification.sent"], "notification.sent"> | WebhookEvent<PlatformEvents["notification.unconfirmed"], "notification.unconfirmed"> | WebhookEvent<PlatformEvents["notification.undelivered"], "notification.undelivered"> | WebhookEvent<PlatformEvents["notification.uninstalled"], "notification.uninstalled"> | WebhookEvent<PlatformEvents["purchases.catalog.applied"], "purchases.catalog.applied"> | WebhookEvent<PlatformEvents["purchases.catalog.changed"], "purchases.catalog.changed"> | WebhookEvent<PlatformEvents["purchases.coupon.redeemed"], "purchases.coupon.redeemed"> | WebhookEvent<PlatformEvents["purchases.credits.depleted"], "purchases.credits.depleted"> | WebhookEvent<PlatformEvents["purchases.credits.low"], "purchases.credits.low"> | WebhookEvent<PlatformEvents["purchases.customer.changed"], "purchases.customer.changed"> | WebhookEvent<PlatformEvents["purchases.customer.erased"], "purchases.customer.erased"> | WebhookEvent<PlatformEvents["purchases.customer.merged"], "purchases.customer.merged"> | WebhookEvent<PlatformEvents["purchases.entitlement.changed"], "purchases.entitlement.changed"> | WebhookEvent<PlatformEvents["purchases.offer.redeemed"], "purchases.offer.redeemed"> | WebhookEvent<PlatformEvents["purchases.ownership.transferred"], "purchases.ownership.transferred"> | WebhookEvent<PlatformEvents["purchases.paywall.published"], "purchases.paywall.published"> | WebhookEvent<PlatformEvents["purchases.purchase.completed"], "purchases.purchase.completed"> | WebhookEvent<PlatformEvents["purchases.quota.exhausted"], "purchases.quota.exhausted"> | WebhookEvent<PlatformEvents["purchases.quota.threshold"], "purchases.quota.threshold"> | WebhookEvent<PlatformEvents["purchases.refund.changed"], "purchases.refund.changed"> | WebhookEvent<PlatformEvents["purchases.store.changed"], "purchases.store.changed"> | WebhookEvent<PlatformEvents["purchases.subscription.changed"], "purchases.subscription.changed"> | WebhookEvent<PlatformEvents["session.ended"], "session.ended"> | WebhookEvent<PlatformEvents["stores.action.changed"], "stores.action.changed"> | WebhookEvent<PlatformEvents["stores.app.changed"], "stores.app.changed"> | WebhookEvent<PlatformEvents["stores.apple.changed"], "stores.apple.changed"> | WebhookEvent<PlatformEvents["stores.delivery.changed"], "stores.delivery.changed"> | WebhookEvent<PlatformEvents["stores.delivery.requested"], "stores.delivery.requested"> | WebhookEvent<PlatformEvents["stores.google.changed"], "stores.google.changed"> | WebhookEvent<PlatformEvents["stores.group.changed"], "stores.group.changed"> | WebhookEvent<PlatformEvents["stores.package.changed"], "stores.package.changed"> | WebhookEvent<PlatformEvents["user.converted"], "user.converted"> | WebhookEvent<PlatformEvents["user.deleted"], "user.deleted"> | WebhookEvent<PlatformEvents["user.locale_changed"], "user.locale_changed"> | WebhookEvent<PlatformEvents["user.permissions_changed"], "user.permissions_changed">;
+export type PalbaseEvent = WebhookEvent<PlatformEvents["ai.goal.updated"], "ai.goal.updated"> | WebhookEvent<PlatformEvents["ai.response.completed"], "ai.response.completed"> | WebhookEvent<PlatformEvents["ai.response.failed"], "ai.response.failed"> | WebhookEvent<PlatformEvents["ai.response.started"], "ai.response.started"> | WebhookEvent<PlatformEvents["ai.voice.closed"], "ai.voice.closed"> | WebhookEvent<PlatformEvents["ai.voice.delegated"], "ai.voice.delegated"> | WebhookEvent<PlatformEvents["ai.voice.started"], "ai.voice.started"> | WebhookEvent<PlatformEvents["ai.workspace.published"], "ai.workspace.published"> | WebhookEvent<PlatformEvents["ai.workspace.pushed"], "ai.workspace.pushed"> | WebhookEvent<PlatformEvents["audience.entered"], "audience.entered"> | WebhookEvent<PlatformEvents["audience.exited"], "audience.exited"> | WebhookEvent<PlatformEvents["consent.changed"], "consent.changed"> | WebhookEvent<PlatformEvents["device.revoked"], "device.revoked"> | WebhookEvent<PlatformEvents["file.deleted"], "file.deleted"> | WebhookEvent<PlatformEvents["file.moved"], "file.moved"> | WebhookEvent<PlatformEvents["file.uploaded"], "file.uploaded"> | WebhookEvent<PlatformEvents["flag.changed"], "flag.changed"> | WebhookEvent<PlatformEvents["flag.override_changed"], "flag.override_changed"> | WebhookEvent<PlatformEvents["notification.action"], "notification.action"> | WebhookEvent<PlatformEvents["notification.bounced"], "notification.bounced"> | WebhookEvent<PlatformEvents["notification.complained"], "notification.complained"> | WebhookEvent<PlatformEvents["notification.delivered"], "notification.delivered"> | WebhookEvent<PlatformEvents["notification.dismissed"], "notification.dismissed"> | WebhookEvent<PlatformEvents["notification.expired"], "notification.expired"> | WebhookEvent<PlatformEvents["notification.failed"], "notification.failed"> | WebhookEvent<PlatformEvents["notification.not_shown"], "notification.not_shown"> | WebhookEvent<PlatformEvents["notification.opened"], "notification.opened"> | WebhookEvent<PlatformEvents["notification.read"], "notification.read"> | WebhookEvent<PlatformEvents["notification.received"], "notification.received"> | WebhookEvent<PlatformEvents["notification.rejected"], "notification.rejected"> | WebhookEvent<PlatformEvents["notification.sent"], "notification.sent"> | WebhookEvent<PlatformEvents["notification.unconfirmed"], "notification.unconfirmed"> | WebhookEvent<PlatformEvents["notification.undelivered"], "notification.undelivered"> | WebhookEvent<PlatformEvents["notification.uninstalled"], "notification.uninstalled"> | WebhookEvent<PlatformEvents["purchases.catalog.applied"], "purchases.catalog.applied"> | WebhookEvent<PlatformEvents["purchases.catalog.changed"], "purchases.catalog.changed"> | WebhookEvent<PlatformEvents["purchases.coupon.redeemed"], "purchases.coupon.redeemed"> | WebhookEvent<PlatformEvents["purchases.credits.depleted"], "purchases.credits.depleted"> | WebhookEvent<PlatformEvents["purchases.credits.low"], "purchases.credits.low"> | WebhookEvent<PlatformEvents["purchases.customer.changed"], "purchases.customer.changed"> | WebhookEvent<PlatformEvents["purchases.customer.erased"], "purchases.customer.erased"> | WebhookEvent<PlatformEvents["purchases.customer.merged"], "purchases.customer.merged"> | WebhookEvent<PlatformEvents["purchases.entitlement.changed"], "purchases.entitlement.changed"> | WebhookEvent<PlatformEvents["purchases.offer.redeemed"], "purchases.offer.redeemed"> | WebhookEvent<PlatformEvents["purchases.ownership.transferred"], "purchases.ownership.transferred"> | WebhookEvent<PlatformEvents["purchases.paywall.published"], "purchases.paywall.published"> | WebhookEvent<PlatformEvents["purchases.purchase.completed"], "purchases.purchase.completed"> | WebhookEvent<PlatformEvents["purchases.quota.exhausted"], "purchases.quota.exhausted"> | WebhookEvent<PlatformEvents["purchases.quota.threshold"], "purchases.quota.threshold"> | WebhookEvent<PlatformEvents["purchases.refund.changed"], "purchases.refund.changed"> | WebhookEvent<PlatformEvents["purchases.store.changed"], "purchases.store.changed"> | WebhookEvent<PlatformEvents["purchases.subscription.changed"], "purchases.subscription.changed"> | WebhookEvent<PlatformEvents["session.ended"], "session.ended"> | WebhookEvent<PlatformEvents["stores.action.changed"], "stores.action.changed"> | WebhookEvent<PlatformEvents["stores.app.changed"], "stores.app.changed"> | WebhookEvent<PlatformEvents["stores.apple.changed"], "stores.apple.changed"> | WebhookEvent<PlatformEvents["stores.delivery.changed"], "stores.delivery.changed"> | WebhookEvent<PlatformEvents["stores.delivery.requested"], "stores.delivery.requested"> | WebhookEvent<PlatformEvents["stores.google.changed"], "stores.google.changed"> | WebhookEvent<PlatformEvents["stores.group.changed"], "stores.group.changed"> | WebhookEvent<PlatformEvents["stores.package.changed"], "stores.package.changed"> | WebhookEvent<PlatformEvents["stores.version.changed"], "stores.version.changed"> | WebhookEvent<PlatformEvents["stores.version.reviewed"], "stores.version.reviewed"> | WebhookEvent<PlatformEvents["user.converted"], "user.converted"> | WebhookEvent<PlatformEvents["user.deleted"], "user.deleted"> | WebhookEvent<PlatformEvents["user.locale_changed"], "user.locale_changed"> | WebhookEvent<PlatformEvents["user.permissions_changed"], "user.permissions_changed">;

package/types/internal/src/modules/machines.d.ts

@@ -123,7 +123,7 @@ export type InstallationLink = {
     user_token: string;
 };
 /**
- * Connects an installation another project of the same organization connected, on Studio's word that both are one organization's (the X-Palbase-Studio-Share header, which Studio's backend alone signs; Studio's call that connects an organization's installation asks it) — no GitHub user's token. The project reaches what that project's GitHub user can push to, as it does.
+ * Connects an installation another project of the same organization connected, on the registry's word that both are one organization's (the X-Palbase-Studio-Share header, which the registry alone signs, for an admin of both; Studio's call that connects an organization's installation asks it) — no GitHub user's token. The project reaches what that project's GitHub user can push to, as it does.
  */
 export type InstallationShare = {
     installation_id: number;
@@ -1345,6 +1345,41 @@ export type TaskType = {
 export type TaskTypeList = {
     types: TaskType[];
 };
+/**
+ * A template written for a test user — its rows by table, as the machine's program said — or why it was not (error: no_template, not_a_test_user, template_failed, template_timeout, machine_unavailable, then a colon and why). again: answered from what was kept when it was written before; the machine was not asked again.
+ */
+export type TemplateOutcome = {
+    name: string;
+    rows?: {
+        [key: string]: number;
+    };
+    error?: string;
+    again?: boolean;
+};
+/**
+ * A test user made with a template: its sign-in, shown this once, and what became of the template. The user is made whatever came of the template.
+ */
+export type TemplatedUser = {
+    user_id: string;
+    email: string;
+    /**
+     * Its password, shown this once (a test fixture).
+     */
+    password: string;
+    /**
+     * With with_tokens: an access token for it (a test fixture).
+     */
+    access_token?: string;
+    template: TemplateOutcome;
+};
+export type TemplatedUserList = {
+    users: TemplatedUser[];
+};
+export type TemplatedUsersAsked = {
+    count?: number;
+    template: string;
+    with_tokens?: boolean;
+};
 /** Palbase Machines */
 export declare function client(t: Transport): {
     /**
@@ -1412,7 +1447,7 @@ export declare function client(t: Transport): {
     /**
      * Share an installation of the organization
      *
-     * Connects an installation of Palbase Cloud that another project of the same organization connected, on Studio's word (X-Palbase-Studio-Share): a program that opens a project for each product connects its own installation to each, with no person's GitHub token. The project reaches the repositories of it the GitHub user who connected it there can push to — and, as with every connection, one created or added to the installation later once that user can push to it (asked when a machine is built from it, and when GitHub says repositories were added). Refused without Studio's word, or when that project has not connected the installation; and when this project connected it otherwise — for other repositories, for all of them where this names some (or some where this names none), or by another GitHub user: linking again never widens, narrows or hands over a connection, so it is disconnected and connected anew. The same share again is as it was.
+     * Connects an installation of Palbase Cloud that another project of the same organization connected, on the registry's word (X-Palbase-Studio-Share), which Studio asks the registry for an admin of both projects: a program that opens a project for each product connects its own installation to each, with no person's GitHub token. The project reaches the repositories of it the GitHub user who connected it there can push to — and, as with every connection, one created or added to the installation later once that user can push to it (asked when a machine is built from it, and when GitHub says repositories were added). Refused without the registry's word, or when that project has not connected the installation; and when this project connected it otherwise — for other repositories, for all of them where this names some (or some where this names none), or by another GitHub user: linking again never widens, narrows or hands over a connection, so it is disconnected and connected anew. The same share again is as it was.
      */
     shareInstallation(input: {
         body: InstallationShare; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
@@ -1877,5 +1912,42 @@ export declare function client(t: Transport): {
         }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<200, TaskTypeList>>;
+    /**
+     * Make test users with a template's data
+     *
+     * Makes 1 to 10 test users (auth's: their tokens say test: true) and has the machine's own program write a template's data for each — the backend's seed for one account (palbase/backend's @TestUserTemplate), for a person or an agent to sign in and see a screen with its data. The platform calls the program for each user — POST /_palbase/test-user-templates/<template> on the machine's own port, with {"user": {"id", "email"}, "template"}, signed as a cron's call is, waking the machine for it; the program writes the template in one transaction and answers {"rows": {table: count}}, or refuses a user auth does not say is a test user (403). A user is made whatever came of its template: its template answers its error by name. The same user and template asked again (POST …/test-users/{user}/templates/{template}) answers what was kept, the machine not asked again. The users' passwords (and with with_tokens their access tokens) are test fixtures, shown this once, as auth's test users' are. 409 when auth makes no more test users for the project; 429 quota_exceeded, and no user made, when the project's machines are not run now (its machine time for the period used up, or the project deleted).
+     */
+    makeTemplatedTestUsers(input: {
+        path: {
+            name: string;
+        };
+        body: TemplatedUsersAsked; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, TemplatedUserList>>;
+    /**
+     * Write a template for a test user
+     *
+     * Has the machine's program write a template for a test user this machine made with one (POST /machines/{name}/test-users) — answered from what was kept when it wrote that template for that user before, the machine not asked again (again: true). 429 quota_exceeded when the project's machines are not run now and the template was not written before. 404 when the user is no test user this machine made with a template: a test user is the machine's that made it, another machine of the project neither writes for it nor deletes it.
+     */
+    templateTestUser(input: {
+        path: {
+            name: string; /** The test user's id, as the users made with a template were answered. */
+            user: string; /** The template's name, as the machine's program names it (@TestUserTemplate): lowercase letters, digits, _ and -, starting with a letter, 64 at most. */
+            template: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, TemplateOutcome>>;
+    /**
+     * Delete a test user made with a template
+     *
+     * Has the machine's program undo each template the user was written with — POST /_palbase/test-user-templates/<template>/undo, signed as the template's call; a program with no undo (404) leaves it to its user.deleted — then deletes the user. 502 undo_failed when the program did not undo one: the user is kept, for the delete to be asked again. 429 quota_exceeded, the user kept, when the project's machines are not run now. 404 when the user is no test user this machine made with a template: a test user is the machine's that made it, another machine of the project neither writes for it nor deletes it.
+     */
+    deleteTemplatedTestUser(input: {
+        path: {
+            name: string; /** The test user's id, as the users made with a template were answered. */
+            user: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<204, undefined>>;
 };
 export type Client = ReturnType<typeof client>;