palbase 0.11.2 → 0.13.2

package/dist/refuse/ai.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
 throw new Error("palbase/ai is for servers: it speaks with the project secret key, which never goes into a browser or a mobile app \u2014 call your backend, and let it ask the model");

package/dist/refuse/backend.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
 throw new Error("palbase/backend is a server framework: it runs on your backend, never in a browser or a mobile app \u2014 apps use palbase/web (or the native SDKs)");

package/dist/refuse/server.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
 throw new Error("palbase/server is for servers: its secret key never goes into a browser or a mobile app \u2014 apps use palbase/web (or the native SDKs) with the publishable key");

package/dist/server/index.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{a as e,b as f,c as g,d as h,e as i,f as j,g as k,h as l,i as m,j as n,k as o,l as p,m as q,n as r,o as s,p as t,q as u,r as v}from"../chunks/VPFDS7G7.js";import{a as c,b as d}from"../chunks/XOPSQEWX.js";import"../chunks/SI2TXLYT.js";import{m as b}from"../chunks/4NC6D3AY.js";import"../chunks/FIWWCA6S.js";import{b as a}from"../chunks/5FJNJOWL.js";import"../chunks/NT7K4S2X.js";import"../chunks/PF3S7VGN.js";export{l as AuthUnavailable,b as EVENT_TYPES,c as FieldError,d as Fields,a as PalbaseError,q as ReservationSettled,k as TokenError,n as TokenVerifier,f as WebhookSignatureError,e as createServer,p as isEntitled,v as loadSecrets,s as pages,u as platformOwn,t as processOwn,o as requestAddress,m as sessionStanding,i as signatureHeader,h as verifySignature,g as verifyWebhook,j as verifyWebhookRequest,r as withReservation};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{a as e,b as f,c as g,d as h,e as i,f as j,g as k,h as l,i as m,j as n,k as o,l as p,m as q,n as r,o as s,p as t,q as u,r as v,s as w,t as x,u as y}from"../chunks/UMCUTNWL.js";import{a as c,b as d}from"../chunks/ABRUIWQ3.js";import"../chunks/B33QXIR5.js";import"../chunks/X2BWW2WC.js";import{m as b}from"../chunks/WAMYRYDY.js";import"../chunks/ZOF56QTG.js";import{b as a}from"../chunks/7ZSVOQFN.js";import"../chunks/DLQT5KPC.js";import"../chunks/22JG5QKQ.js";export{o as AuthUnavailable,b as EVENT_TYPES,c as FieldError,d as Fields,a as PalbaseError,t as ReservationSettled,n as TokenError,q as TokenVerifier,f as Transit,e as TransitRefusal,g as TransitRequest,i as WebhookSignatureError,h as createServer,s as isEntitled,y as loadSecrets,v as pages,x as platformOwn,w as processOwn,r as requestAddress,p as sessionStanding,l as signatureHeader,k as verifySignature,j as verifyWebhook,m as verifyWebhookRequest,u as withReservation};

package/dist/server/testing.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{a,b,c,d,e}from"../chunks/MWKPDZHT.js";import"../chunks/XOPSQEWX.js";import"../chunks/NT7K4S2X.js";import"../chunks/PF3S7VGN.js";export{b as TestApiError,e as api,c as createTestApi,a as testFields,d as testRun};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{a,b,c,d,e}from"../chunks/53ZQBGJV.js";import"../chunks/ABRUIWQ3.js";import"../chunks/DLQT5KPC.js";import"../chunks/22JG5QKQ.js";export{b as TestApiError,e as api,c as createTestApi,a as testFields,d as testRun};

package/dist/web/index.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{a as h,b as g,c as C,d as w,e as v,f as b,g as E,h as T,i as P,j as S,k as x,l as k,m as R,n as I,o as L,p as M,q as G}from"../chunks/E765DY7Q.js";import{a as V,b as O,f as A}from"../chunks/WUPBDP6G.js";import"../chunks/W7UOMPUA.js";import"../chunks/XQUWS373.js";import"../chunks/6FV2T52H.js";import"../chunks/W6LUHPMU.js";import"../chunks/4NC6D3AY.js";import"../chunks/FIWWCA6S.js";import{b as u}from"../chunks/5FJNJOWL.js";import"../chunks/NT7K4S2X.js";import"../chunks/PF3S7VGN.js";var D="oai-events";async function N(e){if(typeof e?.start!="function")throw new TypeError("connectVoice: start(sdp) is the round trip to the app's backend, which starts the voice (chats.voice.start) and answers { id, sdp }");let o=e.rtc??B(),t=e.signal;t?.throwIfAborted();let s=e.audio??F(),c=e.microphone===void 0,a=e.microphone??await o.getUserMedia({audio:!0});if(t?.aborted){if(c)for(let r of a.getTracks())r.stop();throw t.reason}let n=new o.RTCPeerConnection,p=!1,d=()=>{if(!p){if(p=!0,f.close(),n.close(),c)for(let r of a.getTracks())r.stop();s.srcObject!==null&&(s.srcObject=null)}};n.addEventListener("track",r=>{s.srcObject=r.streams[0]??new MediaStream([r.track]),s.play?.()?.catch?.(()=>{})}),n.addEventListener("connectionstatechange",()=>e.onState?.(n.connectionState));for(let r of a.getAudioTracks())n.addTrack(r,a);let f=n.createDataChannel(D);f.addEventListener("message",r=>{let i=U(r.data);i!==void 0&&e.onError?.(i)});let y=()=>d();t?.addEventListener("abort",y,{once:!0});try{await n.setLocalDescription(await n.createOffer()),t?.throwIfAborted(),await H(n,e.iceTimeoutMs??1e4,t);let r=n.localDescription?.sdp;if(!r)throw new Error("connectVoice: the peer connection made no offer");let i=await e.start(r);if(t?.throwIfAborted(),typeof i?.id!="string"||i.id===""||typeof i.sdp!="string"||i.sdp==="")throw new TypeError("connectVoice: start answered no voice \u2014 it is { id, sdp }, chats.voice.start's answer as the backend got it");return await n.setRemoteDescription({type:"answer",sdp:i.sdp}),t?.removeEventListener("abort",y),{id:i.id,peer:n,audio:s,microphone:a,get muted(){return a.getAudioTracks().every(l=>!l.enabled)},mute(l){for(let m of a.getAudioTracks())m.enabled=!l},close:d}}catch(r){throw t?.removeEventListener("abort",y),d(),t?.aborted?t.reason:r}}function H(e,o,t){return e.iceGatheringState==="complete"?Promise.resolve():t?.aborted?Promise.reject(t.reason):new Promise((s,c)=>{let a=()=>{clearTimeout(d),e.removeEventListener("icegatheringstatechange",n),t?.removeEventListener("abort",p)},n=()=>{e.iceGatheringState==="complete"&&(a(),s())},p=()=>{a(),c(t?.reason)},d=setTimeout(()=>{a(),c(new Error(`connectVoice: the network candidates were not gathered in ${o} ms`))},o);e.addEventListener("icegatheringstatechange",n),t?.addEventListener("abort",p,{once:!0})})}function U(e){if(typeof e=="string")try{let o=JSON.parse(e);return o.type!=="error"?void 0:typeof o.error?.message=="string"?o.error.message:typeof o.error?.code=="string"?o.error.code:"the voice failed"}catch{return}}function B(){let e=globalThis;if(typeof e.RTCPeerConnection!="function"||typeof e.navigator?.mediaDevices?.getUserMedia!="function")throw new TypeError("connectVoice: this runtime has no WebRTC (RTCPeerConnection, navigator.mediaDevices): a chat's voice is a browser's");let o=e.navigator.mediaDevices;return{RTCPeerConnection:e.RTCPeerConnection,getUserMedia:t=>o.getUserMedia(t)}}function F(){let e=globalThis.document;if(!e)throw new TypeError("connectVoice: give audio \u2014 the element the voice plays in \u2014 where there is no document");let o=e.createElement("audio");return o.autoplay=!0,o}export{E as Analytics,V as BackendError,w as Channel,T as Consent,M as Flags,A as GatewayError,x as InApp,P as Inbox,b as Installation,R as Notify,u as PalbaseError,I as Purchases,v as RealtimeSocket,S as SESSION_START,h as SessionChangedError,k as WebPush,N as connectVoice,G as createClient,O as isBackendError,C as localStore,g as memoryStore,L as redemptionToken};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{a as M,b as j,c as q,d as G,e as N,f as U,g as D,h as H,i as J,j as B,k as F,l as K,m as W,n as X,o as Y,p as Z,q as ee}from"../chunks/LDZ7OKNS.js";import{a as _,b as Q,f as z}from"../chunks/ZT4AKS6D.js";import"../chunks/QCZJK4GZ.js";import"../chunks/JWLK6SLN.js";import"../chunks/NRWY25JZ.js";import{b as E,c as T,d as x,f as O,g as A,j as R,k as $,l as V,m as v,o as S}from"../chunks/B33QXIR5.js";import"../chunks/2DBSGJ7Z.js";import"../chunks/WAMYRYDY.js";import"../chunks/ZOF56QTG.js";import{b as L}from"../chunks/7ZSVOQFN.js";import"../chunks/DLQT5KPC.js";import"../chunks/22JG5QKQ.js";var te="oai-events";async function ne(e){if(typeof e?.start!="function")throw new TypeError("connectVoice: start(sdp) is the round trip to the app's backend, which starts the voice (chats.voice.start) and answers { id, sdp }");let r=e.rtc??se(),t=e.signal;t?.throwIfAborted();let f=e.audio??ae(),l=e.microphone===void 0,c=e.microphone??await r.getUserMedia({audio:!0});if(t?.aborted){if(l)for(let n of c.getTracks())n.stop();throw t.reason}let o=new r.RTCPeerConnection,s=!1,u=()=>{if(!s){if(s=!0,m.close(),o.close(),l)for(let n of c.getTracks())n.stop();f.srcObject!==null&&(f.srcObject=null)}};o.addEventListener("track",n=>{f.srcObject=n.streams[0]??new MediaStream([n.track]),f.play?.()?.catch?.(()=>{})}),o.addEventListener("connectionstatechange",()=>e.onState?.(o.connectionState));for(let n of c.getAudioTracks())o.addTrack(n,c);let m=o.createDataChannel(te);m.addEventListener("message",n=>{let p=oe(n.data);p!==void 0&&e.onError?.(p)});let d=()=>u();t?.addEventListener("abort",d,{once:!0});try{await o.setLocalDescription(await o.createOffer()),t?.throwIfAborted(),await re(o,e.iceTimeoutMs??1e4,t);let n=o.localDescription?.sdp;if(!n)throw new Error("connectVoice: the peer connection made no offer");let p=await e.start(n);if(t?.throwIfAborted(),typeof p?.id!="string"||p.id===""||typeof p.sdp!="string"||p.sdp==="")throw new TypeError("connectVoice: start answered no voice \u2014 it is { id, sdp }, chats.voice.start's answer as the backend got it");return await o.setRemoteDescription({type:"answer",sdp:p.sdp}),t?.removeEventListener("abort",d),{id:p.id,peer:o,audio:f,microphone:c,get muted(){return c.getAudioTracks().every(h=>!h.enabled)},mute(h){for(let w of c.getAudioTracks())w.enabled=!h},close:u}}catch(n){throw t?.removeEventListener("abort",d),u(),t?.aborted?t.reason:n}}function re(e,r,t){return e.iceGatheringState==="complete"?Promise.resolve():t?.aborted?Promise.reject(t.reason):new Promise((f,l)=>{let c=()=>{clearTimeout(u),e.removeEventListener("icegatheringstatechange",o),t?.removeEventListener("abort",s)},o=()=>{e.iceGatheringState==="complete"&&(c(),f())},s=()=>{c(),l(t?.reason)},u=setTimeout(()=>{c(),l(new Error(`connectVoice: the network candidates were not gathered in ${r} ms`))},r);e.addEventListener("icegatheringstatechange",o),t?.addEventListener("abort",s,{once:!0})})}function oe(e){if(typeof e=="string")try{let r=JSON.parse(e);return r.type!=="error"?void 0:typeof r.error?.message=="string"?r.error.message:typeof r.error?.code=="string"?r.error.code:"the voice failed"}catch{return}}function se(){let e=globalThis;if(typeof e.RTCPeerConnection!="function"||typeof e.navigator?.mediaDevices?.getUserMedia!="function")throw new TypeError("connectVoice: this runtime has no WebRTC (RTCPeerConnection, navigator.mediaDevices): a chat's voice is a browser's");let r=e.navigator.mediaDevices;return{RTCPeerConnection:e.RTCPeerConnection,getUserMedia:t=>r.getUserMedia(t)}}function ae(){let e=globalThis.document;if(!e)throw new TypeError("connectVoice: give audio \u2014 the element the voice plays in \u2014 where there is no document");let r=e.createElement("audio");return r.autoplay=!0,r}var i=e=>typeof e=="object"&&e!==null&&!Array.isArray(e)?e:void 0;function ie(e,r,t){let f=i(i(i(e)?.components)?.schemas)??{},l=(d,n)=>{let p=new Set,h=(C,g,y)=>{let a=i(C);if(!a)return;if(typeof a.$ref=="string"){if(y.has(a.$ref)||!a.$ref.startsWith("#/components/schemas/"))return;h(f[a.$ref.slice(21)],g,new Set(y).add(a.$ref));return}if(a[E]===!0){p.add(g);return}for(let b of["anyOf","oneOf","allOf"]){let k=a[b];if(Array.isArray(k))for(let I of k)h(I,g,y)}let P=i(a.properties);if(P)for(let[b,k]of Object.entries(P))h(k,`${g}/${v(b)}`,y);i(a.items)&&h(a.items,`${g}/*`,y);for(let b of["additionalProperties","patternProperties","prefixItems"])if(a[b]!==void 0&&w(a[b],new Set(y)))throw new Error(`${t}: an encrypted field is a named property \u2014 not every key of a record, nor a tuple's place`)},w=(C,g)=>{if(Array.isArray(C))return C.some(a=>w(a,g));let y=i(C);return y?y[E]===!0?!0:typeof y.$ref=="string"&&!g.has(y.$ref)&&y.$ref.startsWith("#/components/schemas/")?(g.add(y.$ref),w(f[y.$ref.slice(21)],g)):Object.values(y).some(a=>typeof a=="object"&&a!==null&&w(a,g)):!1};return h(d,n,new Set),[...p]},c=d=>i(i(i(d)?.["application/json"])?.schema),o=[];o.push(...l(c(i(r.requestBody)?.content),"/body"));for(let d of Array.isArray(r.parameters)?r.parameters:[]){let n=i(d);if(!n)continue;let p=l(n.schema,`/query/${v(String(n.name))}`);if(p.length!==0){if(n.in!=="query")throw new Error(`${t}: ${String(n.in)} parameter ${String(n.name)} is marked encrypted \u2014 a body's or a query's field is`);if(p.some(h=>h.split("/").length!==3))throw new Error(`${t}: an encrypted query field is one of the query's own names`);o.push(...p)}}let s=i(r.responses)??{},u=Object.keys(s).filter(d=>/^2\d\d$/.test(d)).sort((d,n)=>d==="200"?-1:n==="200"?1:d.localeCompare(n)),m=u.length>0?l(c(i(s[u[0]])?.content),"/response"):[];if(o.length+m.length!==0){if(r["x-palbase-sse"]!==void 0&&m.length>0)throw new Error(`${t}: a streamed answer carries no encrypted field`);if(r["x-palbase-upload"]!==void 0)throw new Error(`${t}: an upload goes through storage, which seals nothing \u2014 it carries no encrypted field`);return{request:o,response:m}}}async function ce(e){let r=`${e.method.toUpperCase()} ${e.path}`,t=i(i(i(i(e.contract)?.paths)?.[e.path])?.[e.method.toLowerCase()]),f=t?ie(e.contract,t,r):void 0;if(!f)return{body:e.body,query:e.query,open:async s=>s};let{key:l,header:c}=await A(e.key.kid,x(e.key.publicKey),O(e.projectId,e.method,e.path,e.params??[])),o=(s,u)=>s==null?s:S(s,u,f.request,(m,d)=>R(l,m,d));return{header:c,body:await o(e.body,"/body"),query:await o(e.query,"/query"),open:s=>s===void 0?Promise.resolve(s):S(s,"/response",f.response,async(u,m)=>{if(!$(m))throw new T("unopenable",`${r}: ${u} came plain where the contract says it is encrypted`);return V(l,u,m)})}}export{D as Analytics,_ as BackendError,G as Channel,H as Consent,Z as Flags,z as GatewayError,F as InApp,J as Inbox,U as Installation,W as Notify,L as PalbaseError,X as Purchases,N as RealtimeSocket,B as SESSION_START,M as SessionChangedError,K as WebPush,ne as connectVoice,ee as createClient,ce as encryptedCall,Q as isBackendError,q as localStore,j as memoryStore,Y as redemptionToken};

package/dist/web/message.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{a as i}from"../chunks/XQUWS373.js";import{a as e,b as s,c as t,d as p,e as o,f as a,h as r,j as n,k as y,p as M,q as l,t as g}from"../chunks/6FV2T52H.js";import"../chunks/PF3S7VGN.js";export{n as MESSAGE_COMPONENTS,a as MESSAGE_ICONS,r as MESSAGE_SCHEMA,s as assetId,y as countdownValues,e as fontFamily,o as htmlDocument,t as prepareAssets,i as presentMessage,g as renderMessage,M as resolveMessage,l as resolveMessageWithPaths,p as unzip};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{a as i}from"../chunks/JWLK6SLN.js";import{a as e,b as s,c as t,d as p,e as o,f as a,h as r,j as n,k as y,p as M,q as l,t as g}from"../chunks/NRWY25JZ.js";import"../chunks/22JG5QKQ.js";export{n as MESSAGE_COMPONENTS,a as MESSAGE_ICONS,r as MESSAGE_SCHEMA,s as assetId,y as countdownValues,e as fontFamily,o as htmlDocument,t as prepareAssets,i as presentMessage,g as renderMessage,M as resolveMessage,l as resolveMessageWithPaths,p as unzip};

package/dist/web/palbe.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{c as e,d as r,i as t}from"../chunks/WUPBDP6G.js";import"../chunks/W6LUHPMU.js";import"../chunks/FIWWCA6S.js";import"../chunks/5FJNJOWL.js";import"../chunks/NT7K4S2X.js";import"../chunks/PF3S7VGN.js";export{e as RESERVED_CLIENT_NAMES,t as __registerBackend,r as isClientName};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{c as e,d as r,i as t}from"../chunks/ZT4AKS6D.js";import"../chunks/B33QXIR5.js";import"../chunks/2DBSGJ7Z.js";import"../chunks/ZOF56QTG.js";import"../chunks/7ZSVOQFN.js";import"../chunks/DLQT5KPC.js";import"../chunks/22JG5QKQ.js";export{e as RESERVED_CLIENT_NAMES,t as __registerBackend,r as isClientName};

package/dist/web/paywall.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{a as f,b as d,c as m,d as u,e as A,f as c,g as R}from"../chunks/W7UOMPUA.js";import{a as e,b as a,c as t,d as l,e as r,f as o,g as p,i as y,k as s,l as P,n,o as i,s as w}from"../chunks/6FV2T52H.js";import"../chunks/5FJNJOWL.js";import"../chunks/NT7K4S2X.js";import"../chunks/PF3S7VGN.js";export{y as PAYWALL_COMPONENTS,o as PAYWALL_ICONS,p as PAYWALL_SCHEMA,c as Paywall,a as assetId,f as attributesHeader,s as countdownValues,R as defaultPaywall,e as fontFamily,u as formatPeriod,m as formatPrice,r as htmlDocument,A as packageValues,P as packagesOf,d as parseDuration,t as prepareAssets,w as renderPaywall,n as resolvePaywall,i as resolvePaywallWithPaths,l as unzip};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{a as f,b as d,c as m,d as u,e as A,f as c,g as R}from"../chunks/QCZJK4GZ.js";import{a as e,b as a,c as t,d as l,e as r,f as o,g as p,i as y,k as s,l as P,n,o as i,s as w}from"../chunks/NRWY25JZ.js";import"../chunks/7ZSVOQFN.js";import"../chunks/DLQT5KPC.js";import"../chunks/22JG5QKQ.js";export{y as PAYWALL_COMPONENTS,o as PAYWALL_ICONS,p as PAYWALL_SCHEMA,c as Paywall,a as assetId,f as attributesHeader,s as countdownValues,R as defaultPaywall,e as fontFamily,u as formatPeriod,m as formatPrice,r as htmlDocument,A as packageValues,P as packagesOf,d as parseDuration,t as prepareAssets,w as renderPaywall,n as resolvePaywall,i as resolvePaywallWithPaths,l as unzip};

package/dist/web/push-sw.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
 "use strict";(()=>{function f(e,s){if(e)try{let i=new URL(e,s);if(i.protocol==="https:"||i.protocol==="http:"&&(i.hostname==="localhost"||i.hostname==="127.0.0.1"))return i.href}catch{}}function g(e){let s=new URL(e.location.href).searchParams,i=s.get("url")??"",l=s.get("key")??"",r=(n,t)=>!n||!i?Promise.resolve():e.fetch(`${i.replace(/\/$/,"")}/notify/receipts`,{method:"POST",headers:{"content-type":"application/json",apikey:l},body:JSON.stringify({receipts:[{receipt:n,status:t}]}),keepalive:!0}).catch(()=>{}),a=async(n,t)=>{for(let o of await e.clients.matchAll({type:"window",includeUncontrolled:!0}))o.postMessage({type:"palbase.push",event:n,url:t.url,data:t.data})};e.addEventListener("push",(n=>{let t={};try{t=n.data?.json()??{}}catch{}let o={url:t.url,receipt:t.receipt,data:t.data};n.waitUntil(e.registration.showNotification(t.title??"",{body:t.body,image:t.image,tag:t.tag,data:o}).then(()=>Promise.all([r(t.receipt,"delivered"),a("received",o)])))})),e.addEventListener("notificationclick",(n=>{n.notification.close();let t=n.notification.data??{},o=f(t.url,e.location.origin),c=async()=>{if(!o)return;let d=(await e.clients.matchAll({type:"window",includeUncontrolled:!0})).find(u=>u.url===o);d?await d.focus():await e.clients.openWindow(o)};n.waitUntil(Promise.all([r(t.receipt,"opened"),c(),a("opened",t)]))})),e.addEventListener("notificationclose",(n=>{n.waitUntil(r(n.notification.data?.receipt,"dismissed"))}))}typeof self<"u"&&typeof self.registration=="object"&&!("document"in self)&&g(self);})();

package/dist/web/ssr.js

@@ -1,2 +1,2 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import{q as f}from"../chunks/E765DY7Q.js";import"../chunks/WUPBDP6G.js";import"../chunks/W7UOMPUA.js";import"../chunks/XQUWS373.js";import"../chunks/6FV2T52H.js";import"../chunks/W6LUHPMU.js";import"../chunks/4NC6D3AY.js";import"../chunks/FIWWCA6S.js";import"../chunks/5FJNJOWL.js";import"../chunks/NT7K4S2X.js";import"../chunks/PF3S7VGN.js";var C=Object.freeze({"Cache-Control":"private, no-cache, no-store, must-revalidate, max-age=0",Expires:"0",Pragma:"no-cache"}),x={path:"/",sameSite:"lax",secure:!0,httpOnly:!1,maxAge:400*24*60*60},u=3180,k=5*6e4;function d(t){let e=/^pb_([a-z0-9]+)_c/.exec(t)?.[1];if(e===void 0)throw new TypeError("publishableKey is the project publishable key (pb_<ref>_c\u2026)");return`pb-${e}-session`}var y=t=>{let e=new TextEncoder().encode(JSON.stringify(t)),o="";for(let s of e)o+=String.fromCharCode(s);return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},b=t=>{try{let e=atob(t.replace(/-/g,"+").replace(/_/g,"/")),o=JSON.parse(new TextDecoder().decode(Uint8Array.from(e,s=>s.charCodeAt(0))));return typeof o.accessToken!="string"||typeof o.refreshToken!="string"||typeof o.expiresAt!="number"||typeof o.userId!="string"?null:o}catch{return null}};function m(t,e,o={},s=!1){let c={...x,...o},g=async()=>new Map((await e.getAll()).map(n=>[n.name,n.value])),S=n=>n===t||n.startsWith(`${t}.`)&&/^\d+$/.test(n.slice(t.length+1)),h=async n=>{if(!e.setAll)return;let i=n===null?[]:n.length<=u?[[t,n]]:Array.from({length:Math.ceil(n.length/u)},(r,l)=>[`${t}.${l}`,n.slice(l*u,(l+1)*u)]),p=new Set(i.map(([r])=>r)),a=i.map(([r,l])=>({name:r,value:l,options:c}));for(let r of(await g()).keys())S(r)&&!p.has(r)&&a.push({name:r,value:"",options:{...c,maxAge:0}});a.length>0&&await e.setAll(a,{...C})};return{async load(){let n=await g(),i=n.get(t);if(i===void 0){let p="";for(let a=0;n.has(`${t}.${a}`);a++)p+=n.get(`${t}.${a}`);i=p}return i?b(i):null},save:n=>h(y(n)),clear:()=>h(null),shared:s}}function A(t){let{cookies:e,cookieOptions:o,...s}=t,c=t.refresh??(e.setAll?"before":"never");return f({...s,refresh:c,storage:m(d(t.publishableKey),e,o)})}function O(){let t=()=>{let e=globalThis.document;if(!e)throw new Error("documentCookies: there is no document here \u2014 a server gives its request's cookies to createServerClient");return e};return{getAll:()=>t().cookie.split(";").map(e=>e.trim()).filter(e=>e.includes("=")).map(e=>{let o=e.indexOf("=");return{name:e.slice(0,o),value:e.slice(o+1)}}),setAll(e){for(let o of e){let s=o.options,c=[`Path=${s.path??"/"}`,s.domain?`Domain=${s.domain}`:"",s.maxAge!==void 0?`Max-Age=${s.maxAge}`:"",s.expires?`Expires=${s.expires.toUTCString()}`:"",s.sameSite?`SameSite=${s.sameSite.charAt(0).toUpperCase()}${s.sameSite.slice(1)}`:"",s.secure?"Secure":""].filter(Boolean);t().cookie=[`${o.name}=${o.value}`,...c].join("; ")}}}}function $(t){let{cookieOptions:e,...o}=t,s=globalThis.location?.protocol==="https:";return f({...o,storage:m(d(t.publishableKey),O(),{secure:s,...e},!0)})}async function v(t){let e=await t.auth.currentSession();if(!e||(e.expiresAt-Date.now()<=k&&await t.auth.refreshSession().catch(()=>{}),!await t.auth.currentSession()))return null;try{return(await t.auth.api.verifyTokenUser()).data}catch(o){if(o.status===401)return null;throw o}}export{C as NO_STORE_HEADERS,x as SESSION_COOKIE_OPTIONS,m as cookieSessionStore,$ as createBrowserClient,A as createServerClient,O as documentCookies,v as keepSession,d as sessionCookieName};
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import{q as f}from"../chunks/LDZ7OKNS.js";import"../chunks/ZT4AKS6D.js";import"../chunks/QCZJK4GZ.js";import"../chunks/JWLK6SLN.js";import"../chunks/NRWY25JZ.js";import"../chunks/B33QXIR5.js";import"../chunks/2DBSGJ7Z.js";import"../chunks/WAMYRYDY.js";import"../chunks/ZOF56QTG.js";import"../chunks/7ZSVOQFN.js";import"../chunks/DLQT5KPC.js";import"../chunks/22JG5QKQ.js";var C=Object.freeze({"Cache-Control":"private, no-cache, no-store, must-revalidate, max-age=0",Expires:"0",Pragma:"no-cache"}),x={path:"/",sameSite:"lax",secure:!0,httpOnly:!1,maxAge:400*24*60*60},u=3180,k=5*6e4;function d(t){let e=/^pb_([a-z0-9]+)_c/.exec(t)?.[1];if(e===void 0)throw new TypeError("publishableKey is the project publishable key (pb_<ref>_c\u2026)");return`pb-${e}-session`}var y=t=>{let e=new TextEncoder().encode(JSON.stringify(t)),o="";for(let s of e)o+=String.fromCharCode(s);return btoa(o).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")},b=t=>{try{let e=atob(t.replace(/-/g,"+").replace(/_/g,"/")),o=JSON.parse(new TextDecoder().decode(Uint8Array.from(e,s=>s.charCodeAt(0))));return typeof o.accessToken!="string"||typeof o.refreshToken!="string"||typeof o.expiresAt!="number"||typeof o.userId!="string"?null:o}catch{return null}};function m(t,e,o={},s=!1){let c={...x,...o},g=async()=>new Map((await e.getAll()).map(n=>[n.name,n.value])),S=n=>n===t||n.startsWith(`${t}.`)&&/^\d+$/.test(n.slice(t.length+1)),h=async n=>{if(!e.setAll)return;let i=n===null?[]:n.length<=u?[[t,n]]:Array.from({length:Math.ceil(n.length/u)},(r,l)=>[`${t}.${l}`,n.slice(l*u,(l+1)*u)]),p=new Set(i.map(([r])=>r)),a=i.map(([r,l])=>({name:r,value:l,options:c}));for(let r of(await g()).keys())S(r)&&!p.has(r)&&a.push({name:r,value:"",options:{...c,maxAge:0}});a.length>0&&await e.setAll(a,{...C})};return{async load(){let n=await g(),i=n.get(t);if(i===void 0){let p="";for(let a=0;n.has(`${t}.${a}`);a++)p+=n.get(`${t}.${a}`);i=p}return i?b(i):null},save:n=>h(y(n)),clear:()=>h(null),shared:s}}function A(t){let{cookies:e,cookieOptions:o,...s}=t,c=t.refresh??(e.setAll?"before":"never");return f({...s,refresh:c,storage:m(d(t.publishableKey),e,o)})}function O(){let t=()=>{let e=globalThis.document;if(!e)throw new Error("documentCookies: there is no document here \u2014 a server gives its request's cookies to createServerClient");return e};return{getAll:()=>t().cookie.split(";").map(e=>e.trim()).filter(e=>e.includes("=")).map(e=>{let o=e.indexOf("=");return{name:e.slice(0,o),value:e.slice(o+1)}}),setAll(e){for(let o of e){let s=o.options,c=[`Path=${s.path??"/"}`,s.domain?`Domain=${s.domain}`:"",s.maxAge!==void 0?`Max-Age=${s.maxAge}`:"",s.expires?`Expires=${s.expires.toUTCString()}`:"",s.sameSite?`SameSite=${s.sameSite.charAt(0).toUpperCase()}${s.sameSite.slice(1)}`:"",s.secure?"Secure":""].filter(Boolean);t().cookie=[`${o.name}=${o.value}`,...c].join("; ")}}}}function $(t){let{cookieOptions:e,...o}=t,s=globalThis.location?.protocol==="https:";return f({...o,storage:m(d(t.publishableKey),O(),{secure:s,...e},!0)})}async function v(t){let e=await t.auth.currentSession();if(!e||(e.expiresAt-Date.now()<=k&&await t.auth.refreshSession().catch(()=>{}),!await t.auth.currentSession()))return null;try{return(await t.auth.api.verifyTokenUser()).data}catch(o){if(o.status===401)return null;throw o}}export{C as NO_STORE_HEADERS,x as SESSION_COOKIE_OPTIONS,m as cookieSessionStore,$ as createBrowserClient,A as createServerClient,O as documentCookies,v as keepSession,d as sessionCookieName};

package/dist/web/vite.js

@@ -1,3 +1,3 @@
-/*! palbase 0.11.2 — Palbase SDK License (see LICENSE) */
-import"../chunks/PF3S7VGN.js";import{execFile as $}from"node:child_process";import{existsSync as y,mkdtempSync as k,readFileSync as S,rmSync as x,writeFileSync as P}from"node:fs";import{createRequire as O}from"node:module";import{tmpdir as W}from"node:os";import{dirname as g,join as o,relative as u,resolve as v,sep as d}from"node:path";var E=/\.(?:ts|js|mts|mjs)$/;function F(n){if(!/^[a-z][a-z0-9-]*$/.test(n.app))throw new TypeError(`palbase({ app }): ${JSON.stringify(n.app)} is an app's slug (palbase apps:list)`);let c=process.cwd(),p="",i="",f=()=>v(c,n.dir??"palbase"),m=()=>{let e=n.environments[p];if(!e)throw new Error(`palbase: the mode "${p}" is not built against any environment \u2014 say which in vite.config: palbase({ environments: { ${JSON.stringify(p)}: '<environment slug>' } })`);return e};return{name:"palbase",enforce:"pre",config(e,s){p=s.mode,i=s.command??"";let r=e.build?.rollupOptions?.onwarn;return{build:{rollupOptions:{onwarn(t,a){let l=String(t.exporter??t.id??"");if(t.code==="MISSING_EXPORT"&&l.includes(`${d}environments${d}`))throw new Error(`palbase: ${t.message} \u2014 ${m()}'s backend has no such route (palbase apps:sync brings what it has)`);r?r(t,a):a(t)}}}}},configResolved(e){c=e.root,p=e.mode,i=e.command??i},async buildStart(){i!=="build"||n.typecheck===!1||await j(c,m(),n.tsconfig)},resolveId(e,s){if(!s)return null;let r=f();if(e==="palbase"||e.startsWith("palbase/")){let w=u(r,s);return w.startsWith("..")||w===""?null:this.resolve(e,o(c,"index.html"),{skipSelf:!0})}if(!(e.startsWith(".")||e.startsWith("/")))return null;let t=v(g(s),e);if(E.test(t)||(t+=".ts"),g(t)!==r&&g(t)!==o(r,"palbe"))return null;let a=u(r,t),l=`${n.app}.ts`;if(a!==l&&!a.startsWith(`palbe${d}`))return null;let h=m(),b=o(r,"environments",h,a===l?l:o("palbe",a.slice(`palbe${d}`.length)));if(!y(b))throw new Error(`palbase: ${u(c,b)} is not there \u2014 palbase apps:sync writes it (is ${n.app} set in ${h}, and has ${h} that machine?)`);return b}}}async function j(n,c,p){let i=p?v(n,p):["tsconfig.app.json","tsconfig.json"].map(e=>o(n,e)).find(y);if(!i)return;if(!y(i))throw new Error(`palbase({ tsconfig }): ${u(n,i)} is not there`);let f;try{let e=O(o(n,"package.json")).resolve("typescript/package.json"),s=JSON.parse(S(e,"utf8")).bin?.tsc;if(!s)throw new Error("no tsc");f=o(g(e),s)}catch{throw new Error("palbase: the build type-checks the app against its environment with the app's TypeScript, and the app has none (npm i -D typescript) \u2014 or say palbase({ typecheck: false })")}let m=k(o(W(),"palbase-typecheck-"));try{let e=o(m,"tsconfig.json");P(e,JSON.stringify({extends:i,compilerOptions:{noEmit:!0,composite:!1,incremental:!1,moduleSuffixes:[`.${c}`,""]}}));let s=await new Promise(r=>$(process.execPath,[f,"-p",e,"--pretty","false"],{cwd:n,maxBuffer:16<<20},(t,a,l)=>r({code:t?typeof t.code=="number"?t.code:1:0,text:`${a}${l}`.trim()})));if(s.code!==0)throw new Error(`palbase: the app does not type-check against ${c}, the environment this build is made for \u2014 a route its backend does not have, or a call that does not fit it:
+/*! palbase 0.13.2 — Palbase SDK License (see LICENSE) */
+import"../chunks/22JG5QKQ.js";import{execFile as $}from"node:child_process";import{existsSync as y,mkdtempSync as k,readFileSync as S,rmSync as x,writeFileSync as P}from"node:fs";import{createRequire as O}from"node:module";import{tmpdir as W}from"node:os";import{dirname as g,join as o,relative as u,resolve as v,sep as d}from"node:path";var E=/\.(?:ts|js|mts|mjs)$/;function F(n){if(!/^[a-z][a-z0-9-]*$/.test(n.app))throw new TypeError(`palbase({ app }): ${JSON.stringify(n.app)} is an app's slug (palbase apps:list)`);let c=process.cwd(),p="",i="",f=()=>v(c,n.dir??"palbase"),m=()=>{let e=n.environments[p];if(!e)throw new Error(`palbase: the mode "${p}" is not built against any environment \u2014 say which in vite.config: palbase({ environments: { ${JSON.stringify(p)}: '<environment slug>' } })`);return e};return{name:"palbase",enforce:"pre",config(e,s){p=s.mode,i=s.command??"";let r=e.build?.rollupOptions?.onwarn;return{build:{rollupOptions:{onwarn(t,a){let l=String(t.exporter??t.id??"");if(t.code==="MISSING_EXPORT"&&l.includes(`${d}environments${d}`))throw new Error(`palbase: ${t.message} \u2014 ${m()}'s backend has no such route (palbase apps:sync brings what it has)`);r?r(t,a):a(t)}}}}},configResolved(e){c=e.root,p=e.mode,i=e.command??i},async buildStart(){i!=="build"||n.typecheck===!1||await j(c,m(),n.tsconfig)},resolveId(e,s){if(!s)return null;let r=f();if(e==="palbase"||e.startsWith("palbase/")){let w=u(r,s);return w.startsWith("..")||w===""?null:this.resolve(e,o(c,"index.html"),{skipSelf:!0})}if(!(e.startsWith(".")||e.startsWith("/")))return null;let t=v(g(s),e);if(E.test(t)||(t+=".ts"),g(t)!==r&&g(t)!==o(r,"palbe"))return null;let a=u(r,t),l=`${n.app}.ts`;if(a!==l&&!a.startsWith(`palbe${d}`))return null;let h=m(),b=o(r,"environments",h,a===l?l:o("palbe",a.slice(`palbe${d}`.length)));if(!y(b))throw new Error(`palbase: ${u(c,b)} is not there \u2014 palbase apps:sync writes it (is ${n.app} set in ${h}, and has ${h} that machine?)`);return b}}}async function j(n,c,p){let i=p?v(n,p):["tsconfig.app.json","tsconfig.json"].map(e=>o(n,e)).find(y);if(!i)return;if(!y(i))throw new Error(`palbase({ tsconfig }): ${u(n,i)} is not there`);let f;try{let e=O(o(n,"package.json")).resolve("typescript/package.json"),s=JSON.parse(S(e,"utf8")).bin?.tsc;if(!s)throw new Error("no tsc");f=o(g(e),s)}catch{throw new Error("palbase: the build type-checks the app against its environment with the app's TypeScript, and the app has none (npm i -D typescript) \u2014 or say palbase({ typecheck: false })")}let m=k(o(W(),"palbase-typecheck-"));try{let e=o(m,"tsconfig.json");P(e,JSON.stringify({extends:i,compilerOptions:{noEmit:!0,composite:!1,incremental:!1,moduleSuffixes:[`.${c}`,""]}}));let s=await new Promise(r=>$(process.execPath,[f,"-p",e,"--pretty","false"],{cwd:n,maxBuffer:16<<20},(t,a,l)=>r({code:t?typeof t.code=="number"?t.code:1:0,text:`${a}${l}`.trim()})));if(s.code!==0)throw new Error(`palbase: the app does not type-check against ${c}, the environment this build is made for \u2014 a route its backend does not have, or a call that does not fit it:
 ${s.text}`)}finally{x(m,{recursive:!0,force:!0})}}export{F as palbase};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palbase",
-  "version": "0.11.2",
+  "version": "0.13.2",
   "description": "Palbase for JavaScript: the web client (palbase/web), the server SDK (palbase/server), the backend framework (palbase/backend), AI (palbase/ai) and the CLI (npx palbase).",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://palbase.studio",
@@ -135,7 +135,7 @@
   "dependencies": {
     "@types/node": "26.6.4",
     "bun-types": "1.4.2",
-    "palgres": "0.11.2",
+    "palgres": "0.13.2",
     "reflect-metadata": "^0.2.2",
     "typescript": "~6.0.3",
     "zod": "^4.6.5"

package/types/ai/src/chats.d.ts

@@ -406,6 +406,13 @@ export interface StartVoice {
     delegation?: 'chat' | 'events';
     /** The member the server starts it for: the voice is theirs (they read, tell and close it), and counts toward their starts (5 an hour). */
     as?: string;
+    /**
+     * How the voice speaks, after the chat's agent's own instructions; the server's alone. Given here, the voice speaks so
+     * from its first second — told after the start (command instruct), it talks without them until they are in.
+     */
+    instructions?: string;
+    /** What the voice knows as the talk opens, after the instructions; the server's alone. With instructions, at most 48 KiB. */
+    context?: string;
     signal?: AbortSignal;
 }
 export interface VoiceCommand {

package/types/backend/src/index.d.ts

@@ -25,3 +25,4 @@ export { t, type StringsTable } from './i18n.js';
 export { AuthUnavailable, TokenError, TokenVerifier, type SessionStanding, type TokenRefusal, type TokenUser } from '../../server/src/index.js';
 export { EVENT_TYPES, PalbaseError, type EventType, type PalbaseEvent, type PlatformEvent, type PlatformEvents, type WebhookEvent } from '../../server/src/index.js';
 export { z } from 'zod';
+export { encrypt, encrypted, type Encrypted } from './transit.js';

package/types/backend/src/transit.d.ts

@@ -0,0 +1,39 @@
+import type { StandardSchemaV1 } from './decorators.js';
+/**
+ * schema, marked: the field it validates comes encrypted, opened before it is
+ * validated — the handler reads the plain value. A zod schema: z.string(),
+ * z.number(), z.object(…). The contract says so (x-palbase-encrypted), and the
+ * app's generated clients seal it.
+ */
+export declare function encrypted<S extends StandardSchemaV1>(schema: S): S;
+declare const encryptedValue: unique symbol;
+/** A value a handler answers encrypted: encrypt(value). Its clients read the value. */
+export interface Encrypted<T> {
+    readonly [encryptedValue]: T;
+}
+/**
+ * value, answered encrypted: sealed with the request's key in the answer a
+ * route sends, opened by the app's generated client. The contract marks it.
+ */
+export declare function encrypt<T>(value: T): Encrypted<T>;
+/** How many encrypt() values were made in this process: an answer made while none was has none. */
+export declare function encryptValuesMade(): number;
+/**
+ * An answer's encrypt() values: the answer with each one's value in its place,
+ * and their pointers ("/response/patient/tc", an array's item by its index).
+ */
+export declare function answerFields(value: unknown): {
+    value: unknown;
+    pointers: string[];
+};
+/**
+ * The places a JSON schema marks encrypted below root ("/body", "/query"):
+ * "/body/patient/tc", "/body/items/*\/tc" for every item of an array. A field
+ * is marked by name: a mark under a record's any key is refused.
+ */
+export declare function marksOf(schema: unknown, root: string, where: string): string[];
+/** A schema's JSON Schema, as the contract converts it (openapi.ts): what its marks are read from. */
+export declare function jsonSchemaOfSchema(schema: StandardSchemaV1): unknown;
+/** Whether a JSON value holds a mark anywhere: what a schema that may not carry one is checked for. */
+export declare function holdsMark(jsonSchema: unknown): boolean;
+export {};

package/types/internal/src/modules/ai.d.ts

@@ -2186,10 +2186,18 @@ export type VoiceRequest = {
      * The member the server starts it for (the server's alone): the voice is theirs, and counts toward their starts.
      */
     as?: string;
+    /**
+     * What the voice knows as the talk opens (the server's alone), after the instructions. Given with the start, it is in the voice's instructions from its first second. Instructions and context are at most 48 KiB together.
+     */
+    context?: string;
     /**
      * What becomes of what the person asks for out loud: chat (the default) — a message of the voice's member to the chat's agent, a turn of the chat, whose answer the voice says back; events — the event ai.voice.delegated, for the project's backend to have done and answer with speak (its delegation_id).
      */
     delegation?: "chat" | "events";
+    /**
+     * How the voice speaks (the server's alone), after the chat's agent's own instructions. Given with the start, the voice speaks so from its first second — told after it (instruct), it talks without them until they are in. Instructions and context are at most 48 KiB together.
+     */
+    instructions?: string;
     /**
      * The app's WebRTC offer (an SDP).
      */

package/types/internal/src/modules/purchases.d.ts

@@ -327,7 +327,7 @@ export type AppleTransactionReport = {
      */
     device_verification_id?: string;
     /**
-     * The customer asked to restore their purchases: each purchase moves to them from the customer that has it — only with a transaction StoreKit signed for this device (`device_verification_id`), never an account's by a guest's restore, and one purchase 3 times in 30 days at most; one that stays is answered (403, 409) once the rest is applied. Without it (false, the default), a purchase another customer has stays theirs.
+     * The customer asked to restore their purchases: each purchase moves to them from the customer that has it — only with a transaction StoreKit signed for this device (`device_verification_id`), never an account's by a guest's restore, and one purchase 3 times in 30 days at most, with the new purchases that moved it; one that stays is answered (403, 409) once the rest is applied. Without it (false, the default), a purchase another customer has stays theirs — unless a new purchase on it carries another customer's appAccountToken, which moves it to its buyer.
      */
     restore?: boolean;
     /**
@@ -344,7 +344,7 @@ export type GooglePurchaseReport = {
      */
     purchases: GoogleReported[];
     /**
-     * The customer asked to restore their purchases: each moves to them from the customer that has it — never an account's by a guest's restore, and one purchase 3 times in 30 days at most; one that stays is answered (403, 409) once the rest is applied. Without it, a purchase another customer has stays theirs.
+     * The customer asked to restore their purchases: each moves to them from the customer that has it — never an account's by a guest's restore, and one purchase 3 times in 30 days at most, with the new purchases that moved it; one that stays is answered (403, 409) once the rest is applied. Without it, a purchase another customer has stays theirs — unless a new purchase on it names another customer in its obfuscated account id, which moves it to its buyer.
      */
     restore?: boolean;
 };
@@ -1510,6 +1510,53 @@ export type CustomerInfo = {
      */
     subscriptions: SubscriptionInfo[];
 };
+/**
+ * What the project's backend reads of a customer: what they have, as GET /purchases/me answers it to them, and the moves of their purchases to and from other customers — which the customer never reads.
+ */
+export type CustomerRecord = {
+    /**
+     * Their balance in every credit they have one in.
+     */
+    credits: CreditBalance[];
+    /**
+     * The customer: the user's id.
+     */
+    customer_id: string;
+    /**
+     * Every entitlement the customer has or had, by key.
+     */
+    entitlements: {
+        [key: string]: EntitlementInfo;
+    };
+    /**
+     * Whether the user is a guest (anonymous): what a guest buys moves to the account it signs in to.
+     */
+    guest: boolean;
+    /**
+     * Their use of every limit of the catalog.
+     */
+    limits: LimitUse[];
+    /**
+     * Their one-time purchases, oldest first.
+     */
+    purchases: PurchaseInfo[];
+    /**
+     * The time it was computed at: what was active is as of then.
+     */
+    requested_at: string;
+    /**
+     * Rises with every change of what the customer has (0: nothing yet). The customer's apps join the realtime channel `purchases:<project ref>:<user id>` — theirs alone, read-only — whose state and `changed` broadcast carry `{"revision": N}`: a revision above the one read means reading GET /purchases/me again. `purchases.customer.changed` carries it to the project's webhooks.
+     */
+    revision: number;
+    /**
+     * Their subscriptions and non-renewing periods, oldest first.
+     */
+    subscriptions: SubscriptionInfo[];
+    /**
+     * The moves of their purchases to and from other customers, newest first (the latest 100): a restore, a new purchase made on a store account they share, a guest's merge into its account — as purchases.ownership.transferred told each.
+     */
+    transfers: OwnershipTransfer[];
+};
 /**
  * purchases.customer.merged: a guest's purchases, grants, credits and quota use went to the account it signed in to; the guest's id points to the account from then on.
  */
@@ -2150,7 +2197,40 @@ export type OverflowReceipt = {
     units: number;
 };
 /**
- * purchases.ownership.transferred: a purchase moved from one customer to another: the second restored the App Store purchases of the Apple ID it was made with.
+ * One move of a purchase between two customers.
+ */
+export type OwnershipTransfer = {
+    /**
+     * When it moved.
+     */
+    at: string;
+    /**
+     * The purchase's id in the ledger (a subscription's every renewal is one).
+     */
+    chain_id: string;
+    /**
+     * Who had it.
+     */
+    from_customer_id: string | null;
+    /**
+     * The catalog's product; empty when unmapped.
+     */
+    product: string;
+    /**
+     * Where it was bought.
+     */
+    store: "app_store" | "play_store" | "stripe";
+    /**
+     * Who has it since.
+     */
+    to_customer_id: string;
+    /**
+     * How: restore — the second restored it; purchase — the second bought on it anew, on a store account the two share; merge — a guest's purchases went to the account it signed in to; assign — set by hand.
+     */
+    via: "restore" | "purchase" | "merge" | "assign";
+};
+/**
+ * purchases.ownership.transferred: a purchase moved from one customer to another: the second restored the store purchases of the account it was made with, or bought on it anew — its token naming them — on a store account the two share.
  */
 export type OwnershipTransferredEvent = {
     /**
@@ -2174,9 +2254,9 @@ export type OwnershipTransferredEvent = {
      */
     to_customer_id: string;
     /**
-     * How.
+     * How: restore — the second restored it; purchase — the second bought on it anew.
      */
-    via: "restore";
+    via: "restore" | "purchase";
 };
 /**
  * A paywall as Studio edits it: its draft, and what was published of it.
@@ -5492,7 +5572,7 @@ export type Offers = {
     offers: OfferView[];
 };
 /**
- * Which subscription the signature is for, in which app, where StoreKit runs.
+ * Which subscription the signature is for, in which app, where StoreKit runs, for which Apple account.
  */
 export type AppleOfferRequest = {
     /**
@@ -5507,6 +5587,10 @@ export type AppleOfferRequest = {
      * xcode for a StoreKit configuration on a developer's Mac (signed with its Subscription Offers Key); otherwise the App Store's.
      */
     environment?: string;
+    /**
+     * A transaction of the subscription's group as StoreKit signed it on the device (jwsRepresentation; the SDKs send the newest): the Apple account the offer is sold to — whoever Palbase has its subscription as, another of the app's accounts on a shared Apple ID too. Without it, the customer's own newest App Store subscription names it.
+     */
+    transaction?: string;
 };
 /**
  * What StoreKit buys the promotional offer with, for this customer's purchases and their Apple account: Apple's subscription offer signature.
@@ -5888,7 +5972,7 @@ export interface Events {
      */
     "purchases.entitlement.changed": EntitlementChangedEvent;
     /**
-     * purchases.ownership.transferred: a purchase moved from one customer to another: the second restored the App Store purchases of the Apple ID it was made with.
+     * purchases.ownership.transferred: a purchase moved from one customer to another: the second restored the store purchases of the account it was made with, or bought on it anew — its token naming them — on a store account the two share.
      */
     "purchases.ownership.transferred": OwnershipTransferredEvent;
     /**
@@ -5996,7 +6080,7 @@ export declare function client(t: Transport): {
     /**
      * Report what StoreKit gave the app
      *
-     * The signed-in customer's app — a guest's too: a guest buys in the app — reports the transactions StoreKit gave it: a purchase just made, Transaction.updates, or on a restore every one of currentEntitlements. Each is verified as the App Store signed it for the connected app, of the sandbox or production; with an Xcode certificate set, one Xcode signed with it on the developer's Mac (StoreKit Testing, environment Xcode, for one of the environment's iOS apps) is taken too — a test purchase, the sandbox's, gated by `sandbox_access` as the sandbox's are, of which nothing is asked of Apple — key connected or not. One that is neither refuses the report, naming it. A subscription's state is not taken from the device: it is read from Apple with the project's own key (Get All Subscription Statuses). Whose a purchase is: one nobody has becomes the customer's its appAccountToken names, or the reporter's; one another customer has stays theirs — unless `restore` from the device StoreKit signed its transaction for (`device_verification_id`), which moves it to the reporter (an account's is never taken by a guest's restore, and one purchase moves 3 times in 30 days at most). A restore that leaves a purchase where it was answers why once the rest of the report is applied (403 `restore_not_this_device`, 403 `restore_account_owned`, 409 `restore_limit`). Apple is asked of a subscription once however many copies of it the report holds. A guest that signed in to an account reports for the account: what StoreKit gave it is the account's, and the answer is the account's. Sent again, a report applies nothing twice. Answers what the customer has now, as GET /purchases/me. Emits what a purchase changed — `purchases.purchase.completed`, `purchases.subscription.changed`, `purchases.entitlement.changed`, `purchases.ownership.transferred` on a move, credits' events — and `purchases.customer.changed`.
+     * The signed-in customer's app — a guest's too: a guest buys in the app — reports the transactions StoreKit gave it: a purchase just made, Transaction.updates, or on a restore every one of currentEntitlements. Each is verified as the App Store signed it for the connected app, of the sandbox or production; with an Xcode certificate set, one Xcode signed with it on the developer's Mac (StoreKit Testing, environment Xcode, for one of the environment's iOS apps) is taken too — a test purchase, the sandbox's, gated by `sandbox_access` as the sandbox's are, of which nothing is asked of Apple — key connected or not. One that is neither refuses the report, naming it. A subscription's state is not taken from the device: it is read from Apple with the project's own key (Get All Subscription Statuses). Whose a purchase is: one nobody has becomes the customer's its appAccountToken names, or the reporter's; one another customer has stays theirs — unless a new purchase on it (a switch of plan, a resubscription, an offer bought: a transaction new to Palbase that is no renewal, the newest bought of it) carries another customer's appAccountToken, which moves it to that customer, who paid, whoever reports it (an Apple ID shared among the app's accounts); or `restore` from the device StoreKit signed its transaction for (`device_verification_id`), which moves it to the reporter (an account's is never taken by a guest's restore). One purchase moves 3 times in 30 days at most, restores and new purchases counted together. A restore, or the reporter's own new purchase, that leaves a purchase where it was answers why once the rest of the report is applied (403 `restore_not_this_device`, 403 `restore_account_owned`, 409 `restore_limit`). Apple is asked of a subscription once however many copies of it the report holds. A guest that signed in to an account reports for the account: what StoreKit gave it is the account's, and the answer is the account's. Sent again, a report applies nothing twice. Answers what the customer has now, as GET /purchases/me. Emits what a purchase changed — `purchases.purchase.completed`, `purchases.subscription.changed`, `purchases.entitlement.changed`, `purchases.ownership.transferred` on a move, credits' events — and `purchases.customer.changed`.
      */
     reportAppleTransactions(input: {
         body: AppleTransactionReport; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
@@ -6013,7 +6097,7 @@ export declare function client(t: Transport): {
     /**
      * Report Play Billing's purchases
      *
-     * The signed-in customer's app — a guest's too: a guest buys in the app — reports the purchases Play Billing gave it: one just made, or on a restore every one queryPurchasesAsync returns. Nothing of the device's word is taken: each is read from Play by its token, as the project's Play connection account, and applied to the ledger. Whose a purchase is: one nobody has becomes the customer's its obfuscated account id names, or the reporter's; one another customer has stays theirs — unless `restore`, which moves it to the reporter (an account's is never taken by a guest's restore, and one purchase moves 3 times in 30 days at most); one that stays is answered once the rest is applied (403 `restore_account_owned`, 409 `restore_limit`). A purchase the catalog maps is acknowledged — a consumable's consumed — once the ledger has it (Play refunds one not acknowledged in three days); one it does not map gives nothing and is not acknowledged.
+     * The signed-in customer's app — a guest's too: a guest buys in the app — reports the purchases Play Billing gave it: one just made, or on a restore every one queryPurchasesAsync returns. Nothing of the device's word is taken: each is read from Play by its token, as the project's Play connection account, and applied to the ledger. Whose a purchase is: one nobody has becomes the customer's its obfuscated account id names, or the reporter's; one another customer has stays theirs — unless a new purchase on it (no renewal) names another customer in its obfuscated account id, which moves it to them, who paid; or `restore`, which moves it to the reporter (an account's is never taken by a guest's restore). One purchase moves 3 times in 30 days at most, restores and new purchases counted together; one that stays is answered once the rest is applied (403 `restore_account_owned`, 409 `restore_limit`). A purchase the catalog maps is acknowledged — a consumable's consumed — once the ledger has it (Play refunds one not acknowledged in three days); one it does not map gives nothing and is not acknowledged.
      */
     reportGooglePurchases(input: {
         body: GooglePurchaseReport; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
@@ -6253,14 +6337,14 @@ export declare function client(t: Transport): {
     /**
      * Read a customer
      *
-     * What a customer has, as GET /purchases/me answers it to them, for the project's backend. A guest merged into an account answers the account's. A user never seen here has nothing yet but the free tier of every quota; the read writes nothing — they become a customer when something is theirs.
+     * What a customer has, as GET /purchases/me answers it to them, for the project's backend — and the moves of their purchases to and from other customers (`transfers`), which the customer never reads. A guest merged into an account answers the account's. A user never seen here has nothing yet but the free tier of every quota; the read writes nothing — they become a customer when something is theirs.
      */
     getCustomer(input: {
         path: {
             customer_id: string;
         }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
-    }): Promise<Reply<200, CustomerInfo>>;
+    }): Promise<Reply<200, CustomerRecord>>;
     /**
      * Grant credits
      *

package/types/internal/src/modules/secrets.d.ts

@@ -146,7 +146,7 @@ export type Secret = {
  * One read or write of the project's secrets.
  */
 export type SecretAuditEntry = {
-    action: "list" | "read" | "read_all" | "write" | "rollback" | "delete" | "versions" | "field_keys_list" | "field_keys_read" | "field_keys_rotate" | "field_open" | "field_placeholder";
+    action: "list" | "read" | "read_all" | "write" | "rollback" | "delete" | "versions" | "field_keys_list" | "field_keys_read" | "field_keys_rotate" | "field_open" | "field_placeholder" | "transit_keys_list" | "transit_keys_read" | "transit_keys_rotate" | "transit_key_retire";
     /**
      * When it happened.
      */
@@ -244,6 +244,100 @@ export type SecretWrite = {
      */
     value: string;
 };
+/**
+ * A transit key with its private half.
+ */
+export type TransitKey = {
+    /**
+     * The key's id (t1, t2, …).
+     */
+    id: string;
+    /**
+     * The 32-byte X25519 private key, base64url without padding.
+     */
+    key: string;
+};
+/**
+ * One of the project's transit keys, without its private half.
+ */
+export type TransitKeyInfo = {
+    created_at: string;
+    /**
+     * Who made it: a key's id, a developer's, or the first read's.
+     */
+    created_by: string;
+    /**
+     * The key's id (t1, t2, …).
+     */
+    id: string;
+    /**
+     * Its 32-byte X25519 public key, base64url without padding: what a developer's tool (palbase machines:call, Studio's Try it) seals a request's fields to. An app reads them signed (GET /secrets/transit/public).
+     */
+    public_key: string;
+    /**
+     * When it was retired: no request sealed to it opens from then on, and no app is told to seal to it.
+     */
+    retired_at?: string;
+    /**
+     * Who retired it.
+     */
+    retired_by?: string;
+};
+/**
+ * The project's transit keys, oldest first, the one its apps seal to now, and the public half of the key the list they fetch is signed with — what palbase apps:sync puts in an app's generated client.
+ */
+export type TransitKeyList = {
+    /**
+     * The key apps seal to now: the newest not retired.
+     */
+    current: string;
+    keys: TransitKeyInfo[];
+    /**
+     * The Ed25519 public key the list of public keys is signed with, base64url without padding.
+     */
+    signer: string;
+    /**
+     * Its id (s1).
+     */
+    signer_id: string;
+};
+/**
+ * What the project's backend opens its requests with: every key not retired, newest first, the retired ones by id — a request sealed to one is told to fetch the list again — and the project's id, which a request's key is sealed for.
+ */
+export type TransitKeys = {
+    keys: TransitKey[];
+    /**
+     * The project's id: what a request's key is sealed for, with the method and the route.
+     */
+    project: string;
+    retired: string[];
+};
+/**
+ * The public halves of the project's keys not retired, newest first, signed: an app verifies the signature with the key its generated client holds, that the list is its project's and that it carries the nonce it asked with, before it seals to the first key. The list's JSON: {v: 1, project, issued_at, nonce, keys: [{kid, key}]}, each key an X25519 public key, base64url without padding.
+ */
+export type TransitPublicKeys = {
+    /**
+     * The list's JSON, base64url without padding: what the signature covers, byte for byte.
+     */
+    payload: string;
+    /**
+     * Ed25519 over the payload's bytes, base64url without padding.
+     */
+    signature: string;
+    /**
+     * The id of the key that signed it (s1).
+     */
+    signer: string;
+};
+/**
+ * A rotation of the transit keys.
+ */
+export type TransitRotate = {
+    /**
+     * Retires every older key at once — when one may have been taken: the apps that sealed to one are told so, fetch the list again and seal to the new key.
+     */
+    retire_previous?: boolean;
+};
 /** Palbase Secrets */
 export declare function client(t: Transport): {
     /**
@@ -305,6 +399,59 @@ export declare function client(t: Transport): {
         }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<200, FieldKeyList>>;
+    /**
+     * List the transit keys
+     *
+     * The project's transit keys, never a key, and the public half of the key that signs the list its apps fetch — what palbase apps:sync puts in an app's generated client. The first key is made on the first read. Recorded in the audit trail.
+     */
+    listTransitKeys(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, TransitKeyList>>;
+    /**
+     * Read the transit keys
+     *
+     * The private halves of the project's keys not retired, and the retired ones by id: what its backend reads at startup, every minute after, and when a request names a key it does not hold (palbase/server's `transit`). A developer reads them only as the project's owner. A backend's reads are recorded in the audit trail once an hour, a developer's each time.
+     */
+    getTransitKeys(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, TransitKeys>>;
+    /**
+     * Read the public transit keys
+     *
+     * The public halves of the project's keys not retired, newest first, signed with the project's signing key: what an app seals the fields of a request to its backend to. Any of the project's keys reads it — an app with its publishable key. Nothing in it is secret.
+     */
+    getTransitPublicKeys(input: {
+        query: {
+            nonce: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, TransitPublicKeys>>;
+    /**
+     * Rotate the transit keys
+     *
+     * Makes a new transit key, sealed to at once: a backend that meets a key it does not hold fetches the keys again, and an app fetches the list again when told its key is retired. With retire_previous every older key is retired with it — when one may have been taken. A developer rotates as the project's owner or an admin. Recorded in the audit trail.
+     */
+    rotateTransitKeys(input?: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body?: TransitRotate; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, TransitKeyList>>;
+    /**
+     * Retire a transit key
+     *
+     * Retires a key that is not the one apps seal to now: no request sealed to it opens from then on, and the apps that sealed to it fetch the list again. The key in use is retired by a rotation with retire_previous (409 key_in_use). A developer retires as the project's owner or an admin. Recorded in the audit trail.
+     */
+    retireTransitKey(input: {
+        path: {
+            kid: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, TransitKeyList>>;
     /**
      * List an environment's secrets
      *