@palbase/backend 14.0.0 → 14.1.0

package/dist/db/index.d.cts

@@ -1,4 +1,4 @@
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, E as EnvTypedDatabase, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, S as SchemaDef, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, F as policy, G as raw, H as text, J as timestamp, K as uuid } from '../index-CaRM7qe_.cjs';
-export { M as Materialized, b1 as Ref, b3 as TxColumnExpr, b4 as TxInsertShape, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bj as TxTable, bk as TxWhere, bs as dec, bu as inc, bv as now } from '../endpoint-CAWdScEH.cjs';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, E as EnvTypedDatabase, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, S as SchemaDef, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, F as policy, G as raw, H as text, J as timestamp, K as uuid } from '../index-BcA7wqur.cjs';
+export { M as Materialized, b1 as Ref, b3 as TxColumnExpr, b4 as TxInsertShape, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bj as TxTable, bk as TxWhere, bs as dec, bu as inc, bv as now } from '../endpoint-D2yR2RD1.cjs';
 import './env.cjs';
 import 'zod';

package/dist/db/index.d.ts

@@ -1,4 +1,4 @@
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, E as EnvTypedDatabase, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, S as SchemaDef, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, F as policy, G as raw, H as text, J as timestamp, K as uuid } from '../index-EAlQyErf.js';
-export { M as Materialized, b1 as Ref, b3 as TxColumnExpr, b4 as TxInsertShape, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bj as TxTable, bk as TxWhere, bs as dec, bu as inc, bv as now } from '../endpoint-CAWdScEH.js';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, E as EnvTypedDatabase, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, S as SchemaDef, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, F as policy, G as raw, H as text, J as timestamp, K as uuid } from '../index-CB8TARW4.js';
+export { M as Materialized, b1 as Ref, b3 as TxColumnExpr, b4 as TxInsertShape, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bj as TxTable, bk as TxWhere, bs as dec, bu as inc, bv as now } from '../endpoint-D2yR2RD1.js';
 import './env.js';
 import 'zod';

package/dist/{endpoint-CAWdScEH.d.cts → endpoint-D2yR2RD1.d.cts}

@@ -48,8 +48,16 @@ interface User {
 interface AuthConfig {
     /** Whether authentication is required. Defaults to true. */
     required: boolean;
-    /** Required role for access. If undefined, any authenticated user is allowed. */
+    /** Required role for access. If undefined, any authenticated user is allowed.
+     *
+     * Matched against the caller's `metadata.role` — NOT `user.role`, which is the
+     * database role RLS reads and is always "authenticated" for a signed-in user.
+     * Not signed in → 401; signed in with a different or missing role → 403. */
     role?: string;
+    /** Require a confirmed email address. An unverified caller gets 403
+     * `email_not_verified`. Fences a whole controller; for a partial rule read
+     * `user.emailVerified` in the handler instead. */
+    verifiedEmail?: boolean;
 }
 
 /** Middleware context — subset of EndpointContext without input (not yet validated). */

package/dist/{endpoint-CAWdScEH.d.ts → endpoint-D2yR2RD1.d.ts}

@@ -48,8 +48,16 @@ interface User {
 interface AuthConfig {
     /** Whether authentication is required. Defaults to true. */
     required: boolean;
-    /** Required role for access. If undefined, any authenticated user is allowed. */
+    /** Required role for access. If undefined, any authenticated user is allowed.
+     *
+     * Matched against the caller's `metadata.role` — NOT `user.role`, which is the
+     * database role RLS reads and is always "authenticated" for a signed-in user.
+     * Not signed in → 401; signed in with a different or missing role → 403. */
     role?: string;
+    /** Require a confirmed email address. An unverified caller gets 403
+     * `email_not_verified`. Fences a whole controller; for a partial rule read
+     * `user.emailVerified` in the handler instead. */
+    verifiedEmail?: boolean;
 }
 
 /** Middleware context — subset of EndpointContext without input (not yet validated). */

package/dist/{index-CaRM7qe_.d.cts → index-BcA7wqur.d.cts}

@@ -1,5 +1,5 @@
 import { Tables, TableTypes } from './db/env.cjs';
-import { D as DBClient, b9 as TxPlanHandle, bj as TxTable, M as Materialized } from './endpoint-CAWdScEH.cjs';
+import { D as DBClient, b9 as TxPlanHandle, bj as TxTable, M as Materialized } from './endpoint-D2yR2RD1.cjs';
 
 /** On delete action for foreign key references. */
 type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';

package/dist/{index-EAlQyErf.d.ts → index-CB8TARW4.d.ts}

@@ -1,5 +1,5 @@
 import { Tables, TableTypes } from './db/env.js';
-import { D as DBClient, b9 as TxPlanHandle, bj as TxTable, M as Materialized } from './endpoint-CAWdScEH.js';
+import { D as DBClient, b9 as TxPlanHandle, bj as TxTable, M as Materialized } from './endpoint-D2yR2RD1.js';
 
 /** On delete action for foreign key references. */
 type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';

package/dist/index.d.cts

@@ -1,8 +1,8 @@
-import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-CAWdScEH.cjs';
-export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-CAWdScEH.cjs';
+import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-D2yR2RD1.cjs';
+export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-D2yR2RD1.cjs';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { E as EnvTypedDatabase, S as SchemaDef } from './index-CaRM7qe_.cjs';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-CaRM7qe_.cjs';
+import { E as EnvTypedDatabase, S as SchemaDef } from './index-BcA7wqur.cjs';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-BcA7wqur.cjs';
 import { EntitlementKey, LimitKey } from './purchases/keys.cjs';
 import { TableTypes, Tables } from './db/env.cjs';
 import { ZodTypeAny, z } from 'zod';

package/dist/index.d.ts

@@ -1,8 +1,8 @@
-import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-CAWdScEH.js';
-export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-CAWdScEH.js';
+import { C as CacheClient, b as PalbaseDocsClient, c as PalbaseFlagsClient, L as Logger, d as PalbaseNotificationsClient, e as PalbaseRealtimeClient, D as DBClient, f as PalbaseStorageClient, A as AuthSpec, R as RateLimitConfig, H as HttpError } from './endpoint-D2yR2RD1.js';
+export { g as AuthConfig, B as BadRequest, h as ClientInfo, i as Conflict, j as DBOps, E as ErrorDef, k as ErrorMap, l as ErrorThrowers, F as FileContext, m as Forbidden, n as HttpMethod, M as Materialized, o as Middleware, p as MiddlewareContext, q as MiddlewareHandler, N as NotFound, P as PBRequest, r as PalError, s as PalbaseAnalyticsClient, t as PalbaseAnalyticsManagementNamespace, u as PalbaseAnalyticsProperties, v as PalbaseAnalyticsQueryNamespace, w as PalbaseAttestAndroidParams, x as PalbaseAttestAndroidResult, y as PalbaseAttestiOSParams, z as PalbaseAttestiOSResult, G as PalbaseAuthClient, I as PalbaseBatchOverrideOperation, J as PalbaseBatchSetOverridesResult, K as PalbaseBindDeviceParams, O as PalbaseBucketClient, Q as PalbaseClearAllOverridesResult, S as PalbaseClearOverrideResult, T as PalbaseCohortQueryInput, V as PalbaseCohortResult, W as PalbaseCollectionRef, X as PalbaseCountQueryInput, Y as PalbaseCountResult, Z as PalbaseCreateLinkParams, _ as PalbaseDeviceInfo, $ as PalbaseDeviceTokenView, a0 as PalbaseDocumentRef, a1 as PalbaseDocumentSnapshot, a2 as PalbaseEmailClient, a3 as PalbaseEmailSendParams, a4 as PalbaseEmailSendResponse, a5 as PalbaseEventNamesResult, a6 as PalbaseEventsQueryInput, a7 as PalbaseEventsResult, a8 as PalbaseFileObject, a9 as PalbaseFlag, aa as PalbaseFlagContext, ab as PalbaseFlagSource, ac as PalbaseFlagValue, ad as PalbaseFlagVariant, ae as PalbaseFlagsServiceClient, af as PalbaseFunctionsClient, ag as PalbaseFunnelQueryInput, ah as PalbaseFunnelResult, ai as PalbaseIdentifyTraits, aj as PalbaseInboxClient, ak as PalbaseInboxListOptions, al as PalbaseInboxListResult, am as PalbaseInboxMessage, an as PalbaseInboxSendParams, ao as PalbaseInboxSendResponse, ap as PalbaseInitialLink, aq as PalbaseInvokeOptions, ar as PalbaseLink, as as PalbaseLinkAnalytics, at as PalbaseLinkDetails, au as PalbaseLinksClient, av as PalbaseListLinksOptions, aw as PalbaseListLinksResult, ax as PalbaseListOptions, ay as PalbaseMatchParams, az as PalbaseMultiChannelResponse, aA as PalbaseOverviewResult, aB as PalbasePreferences, aC as PalbasePreferencesClient, aD as PalbasePublicUrlResponse, aE as PalbasePushClient, aF as PalbasePushSendParams, aG as PalbasePushSendResponse, aH as PalbaseQrCodeOptions, aI as PalbaseQuerySnapshot, aJ as PalbaseRegisterDeviceParams, aK as PalbaseResult, aL as PalbaseRetentionQueryInput, aM as PalbaseRetentionResult, aN as PalbaseSession, aO as PalbaseSetOverrideResult, aP as PalbaseSetOverridesResult, aQ as PalbaseSignedUrlResponse, aR as PalbaseSmsClient, aS as PalbaseSmsSendParams, aT as PalbaseSmsSendResponse, aU as PalbaseTransformOptions, aV as PalbaseUpdateLinkParams, aW as PalbaseUploadOptions, aX as PalbaseUser, aY as PalbaseUserDetailResult, aZ as PalbaseUsersQueryInput, a_ as PalbaseUsersResult, a$ as PalbaseVerifyRequestSignatureParams, b0 as PalbaseWhereOperator, b1 as Ref, b2 as TooManyRequests, b3 as TxColumnExpr, b4 as TxInsertShape, b5 as TxInsertValue, b6 as TxNow, b7 as TxPlanBody, b8 as TxPlanError, b9 as TxPlanHandle, ba as TxPlanOpResult, bb as TxPlanRejection, bc as TxPlanResponse, bd as TxRefError, be as TxRow, bf as TxRows, bg as TxSelectOptions, bh as TxSetShape, bi as TxSetValue, bj as TxTable, bk as TxWhere, bl as TxWireExpr, bm as TxWireGuard, bn as TxWireOp, bo as TxWireRef, bp as TxWireValue, bq as Unauthorized, U as UserT, br as VerifiedDevice, bs as dec, bt as defineMiddleware, bu as inc, bv as now } from './endpoint-D2yR2RD1.js';
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { E as EnvTypedDatabase, S as SchemaDef } from './index-EAlQyErf.js';
-export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-EAlQyErf.js';
+import { E as EnvTypedDatabase, S as SchemaDef } from './index-CB8TARW4.js';
+export { C as ColumnBuilder, a as ColumnDef, b as ColumnMap, c as ColumnType, d as EXTENSION_DEPENDENCIES, e as EnvServiceDatabase, f as EnvTables, g as EnvTypedTable, I as InsertShape, O as OnDeleteAction, P as PALBASE_EXTENSIONS, h as PalbaseExtension, i as PolicyBuilder, j as PolicyCommand, k as PolicyDef, l as PolicyMode, R as RawConstraintDef, m as RowShape, n as SchemaInput, T as TableDef, o as TableInput, p as TxPlan, q as TxTables, r as TypedDB, s as TypedTable, t as TypedTx, u as bigint, v as boolean, w as defineSchema, x as enumType, y as integer, z as isPalbaseExtension, A as jsonb, B as makeTypedDB, D as numeric, F as policy, G as raw, H as text, J as timestamp, K as uuid } from './index-CB8TARW4.js';
 import { EntitlementKey, LimitKey } from './purchases/keys.js';
 import { TableTypes, Tables } from './db/env.js';
 import { ZodTypeAny, z } from 'zod';

package/dist/test/index.d.cts

@@ -1,4 +1,4 @@
-import { D as DBClient, P as PBRequest, a as PalbaseModuleClients, L as Logger, C as CacheClient, U as User } from '../endpoint-CAWdScEH.cjs';
+import { D as DBClient, P as PBRequest, a as PalbaseModuleClients, L as Logger, C as CacheClient, U as User } from '../endpoint-D2yR2RD1.cjs';
 import 'zod';
 
 /** Mock DB client with tracking and seed data support. */

package/dist/test/index.d.ts

@@ -1,4 +1,4 @@
-import { D as DBClient, P as PBRequest, a as PalbaseModuleClients, L as Logger, C as CacheClient, U as User } from '../endpoint-CAWdScEH.js';
+import { D as DBClient, P as PBRequest, a as PalbaseModuleClients, L as Logger, C as CacheClient, U as User } from '../endpoint-D2yR2RD1.js';
 import 'zod';
 
 /** Mock DB client with tracking and seed data support. */

package/docs/auth.md

@@ -36,11 +36,32 @@ interface User {
 }
 ```
 
-Every field is **server-resolved** from the verified token — nothing here is
-client-settable. `emailVerified` in particular is read from the user's verified
-profile, not from a JWT claim: a claim is only true as of when the token was
-minted, so a user who verifies mid-session would keep reporting `false` until
-their token expired.
+Every field is **server-resolved** from the verified profile — nothing here is
+client-settable. `metadata` is your own `auth.users.metadata` (set through the
+admin users API); `role` is the **database** role RLS reads and is always
+`"authenticated"` for a signed-in user, so application roles belong in
+`metadata`, not there.
+
+`emailVerified` is likewise read from the verified profile rather than a JWT
+claim: a claim is only true as of when the token was minted, so a user who
+verifies mid-session would keep reporting `false` until their token expired.
+
+## Roles
+
+`auth: { role: "admin" }` gates on the caller's `metadata.role`:
+
+```ts
+@Controller("/admin", { auth: { role: "admin" } })
+export default class AdminController {
+  @Get("/stats")
+  stats(): Promise<Stats> { … }   // only metadata.role === "admin" reaches here
+}
+```
+
+Not signed in → `401`. Signed in with a different (or missing) role → `403`. A
+role gate implies authentication, so the caller is resolved even on a route with
+no `@User()` parameter. The role is read from the verified profile per request,
+so revoking it takes effect on the next call rather than at token expiry.
 
 ## Email verification
 
@@ -92,10 +113,14 @@ publish(@User() user: UserT) {
 }
 ```
 
-> There is no per-route `requireVerifiedEmail` option. A route-level flag would
-> have to be enforced by the runtime, and the one-line check above is enforced by
-> your own code — visible where it applies, and impossible to declare on a route
-> and have quietly do nothing.
+Or declare it on the route and let the runtime enforce it:
+
+```ts
+@Controller("/posts", { auth: { verifiedEmail: true } })
+```
+
+Unverified callers get `403 email_not_verified`. Use the route flag to fence a
+whole controller, and the inline check when only part of a handler cares.
 
 ## Password reset and magic links
 

package/docs/llms-full.txt

@@ -680,11 +680,32 @@ interface User {
 }
 ```
 
-Every field is **server-resolved** from the verified token — nothing here is
-client-settable. `emailVerified` in particular is read from the user's verified
-profile, not from a JWT claim: a claim is only true as of when the token was
-minted, so a user who verifies mid-session would keep reporting `false` until
-their token expired.
+Every field is **server-resolved** from the verified profile — nothing here is
+client-settable. `metadata` is your own `auth.users.metadata` (set through the
+admin users API); `role` is the **database** role RLS reads and is always
+`"authenticated"` for a signed-in user, so application roles belong in
+`metadata`, not there.
+
+`emailVerified` is likewise read from the verified profile rather than a JWT
+claim: a claim is only true as of when the token was minted, so a user who
+verifies mid-session would keep reporting `false` until their token expired.
+
+## Roles
+
+`auth: { role: "admin" }` gates on the caller's `metadata.role`:
+
+```ts
+@Controller("/admin", { auth: { role: "admin" } })
+export default class AdminController {
+  @Get("/stats")
+  stats(): Promise<Stats> { … }   // only metadata.role === "admin" reaches here
+}
+```
+
+Not signed in → `401`. Signed in with a different (or missing) role → `403`. A
+role gate implies authentication, so the caller is resolved even on a route with
+no `@User()` parameter. The role is read from the verified profile per request,
+so revoking it takes effect on the next call rather than at token expiry.
 
 ## Email verification
 
@@ -736,10 +757,14 @@ publish(@User() user: UserT) {
 }
 ```
 
-> There is no per-route `requireVerifiedEmail` option. A route-level flag would
-> have to be enforced by the runtime, and the one-line check above is enforced by
-> your own code — visible where it applies, and impossible to declare on a route
-> and have quietly do nothing.
+Or declare it on the route and let the runtime enforce it:
+
+```ts
+@Controller("/posts", { auth: { verifiedEmail: true } })
+```
+
+Unverified callers get `403 email_not_verified`. Use the route flag to fence a
+whole controller, and the inline check when only part of a handler cares.
 
 ## Password reset and magic links
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@palbase/backend",
-  "version": "14.0.0",
+  "version": "14.1.0",
   "description": "Palbase Backend SDK — class controllers (@Controller/@Get/@Post + @Body/@QueryParams/@Param), error classes, schema DSL",
   "license": "MIT",
   "repository": {