@bunbase-ae/js 2.13.3-next.304.484953e → 2.13.3-next.310.9b923b7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunbase-ae/js",
-  "version": "2.13.3-next.304.484953e",
+  "version": "2.13.3-next.310.9b923b7",
   "type": "module",
   "description": "TypeScript/JavaScript SDK for BunBase",
   "license": "UNLICENSED",

package/src/admin.ts

@@ -1099,11 +1099,27 @@ export interface NamedQueryParamDef {
   required?: boolean;
 }
 
+/**
+ * Access rules valid for a named query.
+ *
+ * Named queries don't carry a record-level owner — `"owner"` (which is valid
+ * on collections) has no per-row meaning here and is rejected at create/update
+ * time. Use `"authenticated"` for logged-in-only access, or `{ role: "..." }`
+ * for role-gated access.
+ */
+export type NamedQueryAccessRule = Exclude<AccessRule, "owner">;
+
 export interface NamedQuery {
   name: string;
   description: string | null;
   sql: string;
   params: Record<string, NamedQueryParamDef>;
+  /**
+   * The persisted access rule. New queries are restricted to
+   * {@link NamedQueryAccessRule}; this remains the broader {@link AccessRule}
+   * union so legacy rows persisted before the validator was tightened can
+   * still be read.
+   */
   access: AccessRule;
   row_limit: number;
   timeout_ms: number;
@@ -1124,7 +1140,7 @@ export interface CreateNamedQueryInput {
   description?: string | null;
   sql: string;
   params?: Record<string, NamedQueryParamDef>;
-  access?: AccessRule;
+  access?: NamedQueryAccessRule;
   row_limit?: number;
   timeout_ms?: number;
   result_cache_ttl_s?: number;