@maravilla-labs/platform 0.5.1 → 0.6.0

package/dist/index.d.ts

@@ -1,3 +1,5 @@
+import { DbDocument, AuthService, AuthUser } from '@maravilla-labs/types';
+export { ActAsContext, AddCircleMemberOptions, AddRelationOptions, AuthCaller, AuthCircle, AuthConfig, AuthField, AuthGroup, AuthService, AuthSession, AuthStewardshipApi, AuthUser, CanCheck, CircleMembership, CreateCircleOptions, CreateGroupOptions, CreateManagedUserOptions, CreateRelationTypeOptions, CreateResourceOptions, CreateStewardshipOverrideOptions, DbDocument, DelegationMode, GroupPermission, ListRelationsOptions, LoginOptions, PolicyExplain, RegisterOptions, Relation, RelationListDirection, RelationType, Resource, ResourceServiceType, ScopedPermission, StewardshipAuditEntry, StewardshipOverride, StewardshipResolution, StewardshipStatus, UpdateCircleOptions, UpdateGroupOptions, UpdateRelationTypeOptions, UpdateResourceOptions, UpdateUserOptions, UserListFilter, UserListResponse } from '@maravilla-labs/types';
 export { R as RenClient, a as RenClientOptions, b as RenEvent, g as getOrCreateClientId, r as renFetch, s as storageDelete, c as storageUpload } from './ren-DrYefHO5.js';
 import { LocalParticipant } from 'livekit-client';
 export { RegisterPushOptions, RegisterPushResult, offsetBefore, registerPush, unregisterPush } from './push.js';
@@ -214,7 +216,7 @@ interface Database {
      * );
      * ```
      */
-    find(collection: string, filter?: any, options?: DbFindOptions): Promise<any[]>;
+    find<T = Record<string, unknown>>(collection: string, filter?: any, options?: DbFindOptions): Promise<DbDocument<T>[]>;
     /**
      * Find a single document in a collection.
      *
@@ -230,7 +232,7 @@ interface Database {
      * }
      * ```
      */
-    findOne(collection: string, filter: any): Promise<any | null>;
+    findOne<T = Record<string, unknown>>(collection: string, filter: any): Promise<DbDocument<T> | null>;
     /**
      * Insert a single document into a collection.
      *
@@ -816,571 +818,7 @@ interface PresenceService {
         lastSeen?: number;
     }>>;
 }
-/**
- * Authenticated user record from the platform auth service.
- */
-interface AuthUser {
-    /** Unique user ID (prefixed with "usr_") */
-    id: string;
-    /** User's email address */
-    email: string;
-    /** Whether the email has been verified */
-    email_verified: boolean;
-    /** Account status */
-    status: 'active' | 'suspended' | 'deactivated';
-    /** Authentication provider ("email", "google", "github", etc.) */
-    provider: string;
-    /** Group IDs the user belongs to */
-    groups: string[];
-    /** Unix timestamp when the user was created */
-    created_at: number;
-    /** Unix timestamp when the user was last updated */
-    updated_at: number;
-    /** Unix timestamp of last login (if any) */
-    last_login_at?: number;
-}
-/**
- * Snapshot of whoever is currently bound to the request as the caller.
- *
- * Populated by {@link AuthService.login} (implicit), {@link AuthService.setCurrentUser}
- * (explicit), or left anonymous if neither has run for this request.
- * This is exactly what per-resource policies see as `auth.*` when they run.
- */
-interface AuthCaller {
-    /** Caller's user id, or `""` if anonymous */
-    user_id: string;
-    /** Caller's email, or `""` if anonymous */
-    email: string;
-    /** Admin flag from the session */
-    is_admin: boolean;
-    /** Role names (project-scoped) */
-    roles: string[];
-    /** `true` when no identity is bound to this request */
-    is_anonymous: boolean;
-}
-/**
- * Session returned after successful login or token refresh.
- */
-interface AuthSession {
-    /** Short-lived JWT access token (default 15 min) */
-    access_token: string;
-    /** Single-use opaque refresh token (default 30 days) */
-    refresh_token: string;
-    /** Access token lifetime in seconds */
-    expires_in: number;
-    /** The authenticated user */
-    user: AuthUser;
-}
-/**
- * Custom registration field defined in project auth settings.
- */
-interface AuthField {
-    /** Field key (used as form field name) */
-    key: string;
-    /** Display label */
-    label: string;
-    /** Field type: text, email, phone, date, number, select, boolean, url, textarea */
-    field_type: string;
-    /** Whether the field is required */
-    required: boolean;
-    /** Whether the field appears on the registration form */
-    show_on_register: boolean;
-}
-/**
- * Options for registering a new user.
- */
-interface RegisterOptions {
-    /** User's email address */
-    email: string;
-    /** Password (minimum 8 characters) */
-    password: string;
-    /** Optional profile data (custom fields) */
-    profile?: Record<string, any>;
-}
-/**
- * Options for logging in.
- */
-interface LoginOptions {
-    /** User's email address */
-    email: string;
-    /** User's password */
-    password: string;
-}
-/**
- * Filter options for listing users.
- */
-interface UserListFilter {
-    /** Max results per page (default 50) */
-    limit?: number;
-    /** Number of results to skip */
-    offset?: number;
-    /** Filter by account status */
-    status?: 'active' | 'suspended' | 'deactivated';
-    /** Filter by email (partial match) */
-    email_contains?: string;
-    /** Filter by group ID */
-    group_id?: string;
-}
-/**
- * Paginated user list response.
- */
-interface UserListResponse {
-    /** Users in this page */
-    users: AuthUser[];
-    /** Total number of matching users */
-    total: number;
-    /** Page size */
-    limit: number;
-    /** Offset */
-    offset: number;
-}
-/**
- * Options for updating a user.
- */
-interface UpdateUserOptions {
-    /** New email address */
-    email?: string;
-    /** New status */
-    status?: 'active' | 'suspended' | 'deactivated';
-    /** Profile data to merge */
-    profile?: Record<string, any>;
-}
-interface AuthGroup {
-    id: string;
-    name: string;
-    description: string | null;
-    permissions: string[];
-    member_count: number;
-    created_at: number;
-    updated_at: number;
-}
-interface CreateGroupOptions {
-    name: string;
-    description?: string;
-    permissions?: string[];
-}
-interface UpdateGroupOptions {
-    name?: string;
-    description?: string;
-    permissions?: string[];
-}
-interface GroupPermission {
-    resource_name: string;
-    actions: string[];
-}
-interface AuthCircle {
-    id: string;
-    name: string;
-    metadata: Record<string, any> | null;
-    member_count: number;
-    created_at: number;
-    updated_at: number;
-}
-interface CreateCircleOptions {
-    name: string;
-    metadata?: Record<string, any>;
-}
-interface UpdateCircleOptions {
-    name?: string;
-    metadata?: Record<string, any>;
-}
-interface AddCircleMemberOptions {
-    user_id: string;
-    relationship: string;
-    is_primary_contact?: boolean;
-}
-interface CircleMembership {
-    user_id: string;
-    email: string;
-    relationship: string;
-    is_primary_contact: boolean;
-    joined_at: number;
-}
-type ResourceServiceType = 'kv' | 'database' | 'realtime' | 'media' | 'vector' | 'storage' | 'queue' | 'push' | 'workflow' | 'transforms';
-interface Resource {
-    id: string;
-    resource_name: string;
-    title: string;
-    description: string | null;
-    actions: string[];
-    policy: string | null;
-    service_type: ResourceServiceType | null;
-    read_filter: string | null;
-    created_at: number;
-    updated_at: number;
-}
-interface CreateResourceOptions {
-    resource_name: string;
-    title: string;
-    description?: string;
-    actions?: string[];
-    policy?: string;
-    service_type?: ResourceServiceType;
-    read_filter?: string;
-}
-interface UpdateResourceOptions {
-    title?: string;
-    description?: string;
-    actions?: string[];
-    policy?: string;
-    service_type?: ResourceServiceType;
-    read_filter?: string;
-}
-interface RelationType {
-    id: string;
-    relation_name: string;
-    title: string;
-    description: string | null;
-    category: string;
-    icon: string | null;
-    color: string | null;
-    inverse_relation_id: string | null;
-    implies_stewardship: boolean;
-    requires_minor: boolean;
-    bidirectional: boolean;
-    is_system: boolean;
-    created_at: number;
-    updated_at: number;
-}
-interface CreateRelationTypeOptions {
-    relation_name: string;
-    title: string;
-    description?: string;
-    category?: string;
-    icon?: string;
-    color?: string;
-    inverse_relation_id?: string;
-    implies_stewardship?: boolean;
-    requires_minor?: boolean;
-    bidirectional?: boolean;
-    is_system?: boolean;
-}
-interface UpdateRelationTypeOptions {
-    title?: string;
-    description?: string;
-    category?: string;
-    icon?: string;
-    color?: string;
-    inverse_relation_id?: string;
-    implies_stewardship?: boolean;
-    requires_minor?: boolean;
-    bidirectional?: boolean;
-}
-interface AuthConfig {
-    fields: AuthField[];
-    oauth_providers: any[];
-    branding: Record<string, any>;
-    password_policy: Record<string, any>;
-    session_config: Record<string, any>;
-}
-type DelegationMode = 'full' | 'scoped';
-type StewardshipStatus = 'active' | 'suspended' | 'revoked' | 'expired';
-interface ScopedPermission {
-    resource: string;
-    actions: string[];
-}
-interface StewardshipOverride {
-    id: string;
-    steward_id: string;
-    ward_id: string;
-    delegation_mode: DelegationMode;
-    scoped_permissions: ScopedPermission[];
-    valid_from: number | null;
-    valid_until: number | null;
-    status: StewardshipStatus;
-    reason: string | null;
-    source: string;
-    source_circle_id: string | null;
-    source_relation_type_id: string | null;
-    created_at: number;
-    updated_at: number;
-}
-interface CreateStewardshipOverrideOptions {
-    steward_id: string;
-    ward_id: string;
-    delegation_mode?: DelegationMode;
-    scoped_permissions?: ScopedPermission[];
-    valid_from?: number;
-    valid_until?: number;
-    reason?: string;
-}
-interface StewardshipResolution {
-    stewards: StewardshipOverride[];
-    wards: StewardshipOverride[];
-}
-interface ActAsContext {
-    steward_id: string;
-    ward_id: string;
-    delegation_mode: DelegationMode;
-    scoped_permissions: ScopedPermission[];
-    session_token: string;
-    expires_at: number;
-}
-interface StewardshipAuditEntry {
-    id: string;
-    performed_by: string;
-    on_behalf_of: string;
-    action: string;
-    resource: string | null;
-    details: Record<string, any> | null;
-    created_at: number;
-}
-/**
- * Sub-namespace exposed at `platform.auth.stewardship` mirroring the
- * runtime's `globalThis.platform.auth.stewardship.*` surface.
- */
-interface AuthStewardshipApi {
-    resolve(userId: string): Promise<StewardshipResolution>;
-    createOverride(opts: CreateStewardshipOverrideOptions): Promise<StewardshipOverride>;
-    revoke(id: string): Promise<void>;
-    checkPermission(stewardId: string, wardId: string, resource: string, action: string): Promise<boolean>;
-    createActAs(stewardId: string, wardId: string): Promise<ActAsContext>;
-    listAudit(userId: string, options?: {
-        limit?: number;
-        offset?: number;
-    }): Promise<StewardshipAuditEntry[]>;
-}
-/**
- * Auth service for end-user authentication and user management.
- *
- * @example
- * ```typescript
- * const platform = getPlatform();
- *
- * // Register a new user
- * const user = await platform.auth.register({
- *   email: 'user@example.com',
- *   password: 'securePassword123'
- * });
- *
- * // Login
- * const session = await platform.auth.login({
- *   email: 'user@example.com',
- *   password: 'securePassword123'
- * });
- * // session.access_token — short-lived JWT
- * // session.refresh_token — single-use refresh token
- *
- * // Validate a token (e.g. from Authorization header or cookie)
- * const user = await platform.auth.validate(session.access_token);
- *
- * // Protect a route with withAuth middleware
- * export default {
- *   fetch: platform.auth.withAuth(async (request) => {
- *     // request.user is guaranteed to be set
- *     return new Response(`Hello ${request.user.email}`);
- *   })
- * };
- * ```
- */
-interface AuthService {
-    /**
-     * Register a new user with email and password.
-     * @returns The created user (not yet email-verified)
-     */
-    register(options: RegisterOptions): Promise<AuthUser>;
-    /**
-     * Authenticate a user and create a session.
-     * @returns Session with access token, refresh token, and user info
-     */
-    login(options: LoginOptions): Promise<AuthSession>;
-    /**
-     * Validate an access token and return the authenticated user.
-     * @param accessToken - JWT access token from login or refresh
-     * @throws If the token is invalid or expired
-     */
-    validate(accessToken: string): Promise<AuthUser>;
-    /**
-     * Refresh a session using a refresh token (single-use).
-     * @param refreshToken - The refresh token from a previous login/refresh
-     * @returns New session with fresh access and refresh tokens
-     */
-    refresh(refreshToken: string): Promise<AuthSession>;
-    /**
-     * Revoke a specific session.
-     */
-    logout(sessionId: string): Promise<void>;
-    /**
-     * Get a user by ID.
-     * @returns The user, or null if not found
-     */
-    getUser(userId: string): Promise<AuthUser | null>;
-    /**
-     * List users with optional filtering and pagination.
-     */
-    listUsers(filter?: UserListFilter): Promise<UserListResponse>;
-    /**
-     * Update a user's email, status, or profile data.
-     */
-    updateUser(userId: string, update: UpdateUserOptions): Promise<AuthUser>;
-    /**
-     * Delete a user and all their sessions.
-     */
-    deleteUser(userId: string): Promise<void>;
-    /**
-     * Create an email verification token.
-     * @returns The verification token (caller decides how to deliver it)
-     */
-    sendVerification(userId: string): Promise<{
-        token: string;
-    }>;
-    /**
-     * Verify an email address using a verification token.
-     */
-    verifyEmail(token: string): Promise<void>;
-    /**
-     * Create a password reset token for an email address.
-     * @returns The reset token (caller decides how to deliver it)
-     */
-    sendPasswordReset(email: string): Promise<{
-        token: string;
-    }>;
-    /**
-     * Reset a password using a reset token.
-     */
-    resetPassword(token: string, newPassword: string): Promise<void>;
-    /**
-     * Change a user's password (requires old password).
-     */
-    changePassword(userId: string, oldPassword: string, newPassword: string): Promise<void>;
-    /**
-     * Get the configured registration fields for this project.
-     */
-    getFieldConfig(): Promise<{
-        fields: AuthField[];
-    }>;
-    /**
-     * Start an OAuth flow by generating an authorization URL.
-     * Redirect the user to the returned URL to begin authentication.
-     *
-     * @param provider - Provider name: "google", "github", "okta", or "custom_oidc"
-     * @param options - Optional configuration
-     * @returns Object with `auth_url` (redirect target) and `state` (for CSRF verification)
-     */
-    getOAuthUrl(provider: string, options?: {
-        redirectUri?: string;
-    }): Promise<{
-        auth_url: string;
-        state: string;
-    }>;
-    /**
-     * Complete an OAuth flow by exchanging the authorization code.
-     * Call this after the provider redirects back with a code and state.
-     *
-     * @param provider - Provider name
-     * @param params - The code and state from the OAuth callback
-     * @returns Either a session (user authenticated) or a link_required result
-     */
-    handleOAuthCallback(provider: string, params: {
-        code: string;
-        state: string;
-    }): Promise<AuthSession | {
-        type: 'LinkRequired';
-        email: string;
-        provider: string;
-        provider_id: string;
-        existing_user_id: string;
-    }>;
-    /**
-     * Middleware helper that validates auth and injects `request.user`.
-     * Returns 401 JSON response if no valid token is found.
-     *
-     * Extracts token from `Authorization: Bearer <token>` header
-     * or `__session` cookie.
-     *
-     * @example
-     * ```typescript
-     * export default {
-     *   fetch: platform.auth.withAuth(async (request) => {
-     *     const data = await platform.db.items.find({ owner: request.user.id });
-     *     return Response.json(data);
-     *   })
-     * };
-     * ```
-     */
-    withAuth<T extends (request: Request & {
-        user: AuthUser;
-    }) => Promise<Response>>(handler: T): (request: Request) => Promise<Response>;
-    createGroup(options: CreateGroupOptions): Promise<AuthGroup>;
-    listGroups(): Promise<AuthGroup[]>;
-    getGroup(groupId: string): Promise<AuthGroup | null>;
-    /**
-     * Look up a group by its declarative name (the same name used in
-     * `maravilla.config.ts`'s `groups: [...]` block). Returns null if the
-     * auth-settings reconciler hasn't created it yet. Apps that want to
-     * add a user to a group typically only know the name, so use this
-     * first to resolve the id, then call `addUserToGroup`.
-     */
-    getGroupByName(name: string): Promise<AuthGroup | null>;
-    updateGroup(groupId: string, options: UpdateGroupOptions): Promise<AuthGroup>;
-    deleteGroup(groupId: string): Promise<void>;
-    addUserToGroup(userId: string, groupId: string): Promise<void>;
-    removeUserFromGroup(userId: string, groupId: string): Promise<void>;
-    getUserGroups(userId: string): Promise<AuthGroup[]>;
-    getGroupMembers(groupId: string): Promise<AuthUser[]>;
-    getGroupPermissions(groupId: string): Promise<GroupPermission[]>;
-    setGroupPermissions(groupId: string, permissions: GroupPermission[]): Promise<void>;
-    createCircle(options: CreateCircleOptions): Promise<AuthCircle>;
-    listCircles(): Promise<AuthCircle[]>;
-    getCircle(circleId: string): Promise<AuthCircle | null>;
-    updateCircle(circleId: string, options: UpdateCircleOptions): Promise<AuthCircle>;
-    deleteCircle(circleId: string): Promise<void>;
-    addCircleMember(circleId: string, options: AddCircleMemberOptions): Promise<void>;
-    removeCircleMember(circleId: string, userId: string): Promise<void>;
-    getCircleMembers(circleId: string): Promise<CircleMembership[]>;
-    getUserCircles(userId: string): Promise<AuthCircle[]>;
-    createResource(options: CreateResourceOptions): Promise<Resource>;
-    listResources(): Promise<Resource[]>;
-    updateResource(resourceId: string, options: UpdateResourceOptions): Promise<Resource>;
-    deleteResource(resourceId: string): Promise<void>;
-    createRelationType(options: CreateRelationTypeOptions): Promise<RelationType>;
-    listRelationTypes(): Promise<RelationType[]>;
-    updateRelationType(id: string, options: UpdateRelationTypeOptions): Promise<RelationType>;
-    deleteRelationType(id: string): Promise<void>;
-    getProfile(userId: string): Promise<Record<string, any>>;
-    setProfile(userId: string, data: Record<string, any>): Promise<void>;
-    getAuthConfig(): Promise<AuthConfig>;
-    setAuthConfig(config: AuthConfig): Promise<void>;
-    readonly stewardship: AuthStewardshipApi;
-    /**
-     * Explicitly bind the caller for the remainder of this request.
-     * Pass a JWT to validate + bind, or `null` / `""` to clear.
-     *
-     * `login()` already binds implicitly on success; reach for `setCurrentUser`
-     * when you receive a JWT from an inbound `Authorization` header or cookie
-     * and want subsequent KV/DB/realtime/media ops to run as that user.
-     *
-     * Not available on remote clients — throws.
-     */
-    setCurrentUser(token: string | null): Promise<void>;
-    /**
-     * Snapshot of the currently bound caller. Returns an anonymous caller
-     * (`is_anonymous: true`) when no identity has been bound.
-     *
-     * Not available on remote clients — throws.
-     */
-    getCurrentUser(): AuthCaller;
-    /**
-     * Ask the policy engine whether the bound caller would be allowed to
-     * perform `action` on `resourceId`, given the supplied `node` payload.
-     * Returns a boolean — never throws on denial.
-     *
-     * The check runs the exact same evaluator that gates direct KV/DB/
-     * realtime/media ops, so `can(...)` is authoritative.
-     *
-     * @example
-     * ```typescript
-     * const ok = await platform.auth.can("delete", "documents", {
-     *   owner: doc.owner,
-     *   status: doc.status,
-     * });
-     * if (!ok) return new Response("Forbidden", { status: 403 });
-     * ```
-     *
-     * Not available on remote clients — throws.
-     */
-    can(action: string, resourceId: string, node?: Record<string, unknown> | null): Promise<boolean>;
-}
+
 /**
  * Per-request opt-out toggle for the Layer 2 policy evaluator.
  *
@@ -2066,4 +1504,4 @@ declare function getPlatform(options?: {
  */
 declare function clearPlatformCache(): void;
 
-export { type ActAsContext, type AddCircleMemberOptions, type AuthCaller, type AuthCircle, type AuthConfig, type AuthField, type AuthGroup, type AuthService, type AuthSession, type AuthStewardshipApi, type AuthUser, type CircleMembership, type CreateCircleOptions, type CreateGroupOptions, type CreateRelationTypeOptions, type CreateResourceOptions, type CreateStewardshipOverrideOptions, type Database, type DbFindOptions, type DelegationMode, type GroupPermission, type IndexDescriptor, type IndexDirection, type IndexKind, type IndexSpec, type KvListResult, type KvNamespace, type ListScheduledFilter, type LoginOptions, MediaLocalParticipant, type MediaParticipant, type MediaParticipantInfo, MediaRoom, MediaRoomEvent, type MediaRoomInfo, type MediaRoomInfoSettings, type MediaRoomOptions, type MediaService, type MediaTokenResult, type MediaTrackPublication, type NotificationPayload, type Platform, type PlatformEnv, type PolicyService, type PresenceMember, type PresenceService, type PublicPushConfig, type PushService, type PushTarget, type QueueStats, RealtimeClient, type RealtimeClientOptions, type RealtimeEvent, type RealtimeService, type RegisterOptions, type RelationType, RemoteMediaService, type RequestStore, type Resource, type ResourceServiceType, type ScheduleOptions, type ScheduledJob, type ScopedPermission, type SendReport, type StewardshipAuditEntry, type StewardshipOverride, type StewardshipResolution, type StewardshipStatus, type Storage, type StoragePutStreamSource, type StoredPushSubscription, type SubscriptionCounts, type TrackKind, type TrackSource, type UpdateCircleOptions, type UpdateGroupOptions, type UpdateRelationTypeOptions, type UpdateResourceOptions, type UpdateUserOptions, type UserListFilter, type UserListResponse, type VectorAggregation, type VectorIndexDescriptor, type VectorIndexSpec, type VectorMetric, type VectorQuery, type VectorQueryMode, type VectorQueryWithFilter, type VectorSearchHit, type VectorStorage, type VideoResolution, type WorkflowHandle, type WorkflowRun, type WorkflowRunStatus, type WorkflowStepKind, type WorkflowStepRecord, type Workflows, attachTrack, clearPlatformCache, detachTrack, getCurrentRequestStore, getPlatform, runWithRequest };
+export { type Database, type DbFindOptions, type IndexDescriptor, type IndexDirection, type IndexKind, type IndexSpec, type KvListResult, type KvNamespace, type ListScheduledFilter, MediaLocalParticipant, type MediaParticipant, type MediaParticipantInfo, MediaRoom, MediaRoomEvent, type MediaRoomInfo, type MediaRoomInfoSettings, type MediaRoomOptions, type MediaService, type MediaTokenResult, type MediaTrackPublication, type NotificationPayload, type Platform, type PlatformEnv, type PolicyService, type PresenceMember, type PresenceService, type PublicPushConfig, type PushService, type PushTarget, type QueueStats, RealtimeClient, type RealtimeClientOptions, type RealtimeEvent, type RealtimeService, RemoteMediaService, type RequestStore, type ScheduleOptions, type ScheduledJob, type SendReport, type Storage, type StoragePutStreamSource, type StoredPushSubscription, type SubscriptionCounts, type TrackKind, type TrackSource, type VectorAggregation, type VectorIndexDescriptor, type VectorIndexSpec, type VectorMetric, type VectorQuery, type VectorQueryMode, type VectorQueryWithFilter, type VectorSearchHit, type VectorStorage, type VideoResolution, type WorkflowHandle, type WorkflowRun, type WorkflowRunStatus, type WorkflowStepKind, type WorkflowStepRecord, type Workflows, attachTrack, clearPlatformCache, detachTrack, getCurrentRequestStore, getPlatform, runWithRequest };

package/dist/index.js

@@ -568,6 +568,9 @@ var RemoteAuthService = class _RemoteAuthService {
   async deleteUser(userId) {
     await this.post("/delete-user", { user_id: userId });
   }
+  async createManagedUser(options) {
+    return this.post("/create-managed-user", options);
+  }
   async sendVerification(userId) {
     return this.post("/send-verification", { user_id: userId });
   }
@@ -684,6 +687,28 @@ var RemoteAuthService = class _RemoteAuthService {
   async deleteRelationType(id) {
     await this.post("/relation-types/delete", { id });
   }
+  // ── Relations (typed edges, FR-1) ──
+  async addRelation(options) {
+    return this.post("/relations/add", {
+      from_user_id: options.from_user_id,
+      to_user_id: options.to_user_id,
+      relation_type: options.relation_type,
+      metadata: options.metadata ?? null
+    });
+  }
+  async removeRelation(fromUserId, toUserId, relationTypeId) {
+    await this.post("/relations/remove", {
+      from_user_id: fromUserId,
+      to_user_id: toUserId,
+      relation_type_id: relationTypeId
+    });
+  }
+  async listRelations(options) {
+    return this.post("/relations/list", {
+      user_id: options.user_id,
+      direction: options.direction ?? "both"
+    });
+  }
   // ── Profile ──
   async getProfile(userId) {
     return this.post("/profile/get", { user_id: userId });
@@ -808,6 +833,43 @@ var RemoteAuthService = class _RemoteAuthService {
     });
     return Boolean(r?.allowed);
   }
+  async explain(action, resourceId, node) {
+    const { getCurrentRequestStore: getCurrentRequestStore2 } = await Promise.resolve().then(() => (init_request_scope(), request_scope_exports));
+    const store = getCurrentRequestStore2();
+    const token = store?.token;
+    if (!token) {
+      return { allowed: false, reason: "no bound user" };
+    }
+    const r = await this.post("/can-explain", {
+      token,
+      action,
+      resource_id: resourceId,
+      node: node ?? null
+    });
+    return {
+      allowed: Boolean(r?.allowed),
+      reason: r?.reason,
+      failedClause: r?.failedClause
+    };
+  }
+  async canMany(checks) {
+    const { getCurrentRequestStore: getCurrentRequestStore2 } = await Promise.resolve().then(() => (init_request_scope(), request_scope_exports));
+    const store = getCurrentRequestStore2();
+    const token = store?.token;
+    if (!token) {
+      return checks.map(() => ({ allowed: false }));
+    }
+    const r = await this.post("/can-many", {
+      token,
+      checks: checks.map((c) => ({
+        action: c.action,
+        resource_id: c.resourceId,
+        node: c.node ?? null
+      }))
+    });
+    const results = Array.isArray(r) ? r : r?.results ?? [];
+    return checks.map((_, i) => ({ allowed: Boolean(results[i]?.allowed) }));
+  }
 };
 Promise.resolve().then(() => (init_request_scope(), request_scope_exports)).then((mod) => {
   RemoteAuthService._requestScope = mod;