@palbase/backend 28.0.0 → 30.0.0

package/dist/{index-DtISj9QX.d.cts → index-DtCgaZAg.d.cts}

@@ -39,6 +39,20 @@ interface User {
      */
     emailVerified: boolean;
     role: string;
+    /**
+     * The caller's APPLICATION roles, as assigned in `auth.user_roles`.
+     *
+     * Not to be confused with {@link User.role}, which is the DATABASE role RLS
+     * reads and is the literal string "authenticated" for every signed-in user.
+     * These are the names a stack declares (`palbase roles`) and an operator
+     * assigns; `auth: { role }` gates on the same set.
+     *
+     * Resolved per request from the table, in the transaction the handler is
+     * about to use — never from a token claim, so a role revoked a second ago is
+     * already gone here. An empty array for a caller who holds none, never null:
+     * `user.roles.includes("agent")` needs no guard.
+     */
+    roles: string[];
     metadata: Record<string, unknown>;
     /**
      * Reserved, server-owned verified device claim. `null` on an authenticated
@@ -51,12 +65,24 @@ interface User {
 interface AuthConfig {
     /** Whether authentication is required. Defaults to true. */
     required: boolean;
-    /** Required role for access. If undefined, any authenticated user is allowed.
+    /** Required application role for access. If undefined, any authenticated user is allowed.
+     *
+     * Matched against the caller's rows in `auth.user_roles` — NOT against the
+     * `role` claim, which is the DATABASE role RLS reads and is the literal
+     * string "authenticated" for every signed-in user. Reading it from the table
+     * is what makes a revoked role take effect on the very NEXT request instead
+     * of whenever the token happens to expire.
      *
-     * Matched against the caller's `metadata.role` — NOT `user.role`, which is the
-     * database role RLS reads and is always "authenticated" for a signed-in user.
-     * Not signed in → 401; signed in with a different or missing role → 403. */
+     * Not signed in → 401; signed in without the role → 403. */
     role?: string;
+    /** Required permission for access, as `resource.action` (e.g. "posts.delete_any").
+     *
+     * Resolved through `auth.has_permission(...)`, which answers from the roles
+     * the caller holds and the permissions those roles carry. The query runs in
+     * the request's own transaction, so it costs no extra connection.
+     *
+     * Signed in without the permission → 403. */
+    permission?: string;
     /** Require a confirmed email address. An unverified caller gets 403
      * `email_not_verified`. Fences a whole controller; for a partial rule read
      * `user.emailVerified` in the handler instead. */
@@ -2068,6 +2094,37 @@ interface PalbaseAuthClient {
         dispose(): void;
     };
 }
+/**
+ * The `Auth` singleton a backend handler reaches — the ROLE-ASSIGNMENT surface,
+ * and nothing else.
+ *
+ * Deliberately not {@link PalbaseAuthClient}: that one is a person acting on
+ * their own account (sign-in, MFA, device attestation) and it belongs to the
+ * client SDK. What a server needs is the operator verb — "make this user an
+ * agent" — because the promotion usually happens inside the tenant's own
+ * product, in a handler a supervisor triggers.
+ *
+ * These calls carry the SERVICE-ROLE credential: the routes behind them refuse
+ * anon and `authenticated` alike (FR-013), which is what stops an end user from
+ * granting themselves the permission the rest of the feature gates on.
+ *
+ * Unlike the other clients here these THROW rather than envelope, because two
+ * of the three answer `void` — a refusal that came back as a value would be
+ * indistinguishable from a write that happened. See `clients/auth.ts`.
+ */
+interface PalbaseAuthAdminClient {
+    /**
+     * Give a user a role. Idempotent: assigning one they already hold is not an
+     * error and leaves one row. Throws `RoleNotDefined` when the stack declares
+     * no role by that name.
+     */
+    assignRole(userId: string, role: string): Promise<void>;
+    /** Take a role away. Revoking one they do not hold is not an error. */
+    revokeRole(userId: string, role: string): Promise<void>;
+    /** What that user holds right now. `[]` for a user with no roles — a FAILED
+     * read throws rather than answering the same thing. */
+    rolesOf(userId: string): Promise<string[]>;
+}
 /**
  * Bucket-level file operations available via `ctx.storage.bucket(name)`.
  * `getPublicUrl` is synchronous (no network call — constructs URL locally).
@@ -2527,11 +2584,14 @@ interface PalbaseLinksClient {
  * Realtime is BROADCAST-ONLY here (a stateless handler can push an event but
  * cannot hold a subscription socket — `subscribe()` lives on the client SDK).
  *
- * EXCLUDED on purpose: Functions, Links, Analytics, Auth. They are not
- * exposed as backend handler singletons (auth lives on the client SDK; the rest
- * are out of scope for backend endpoints). */
+ * EXCLUDED on purpose: Functions, Links, Analytics. They are not exposed as
+ * backend handler singletons — out of scope for backend endpoints. `Auth` is
+ * here in its ROLE-ASSIGNMENT shape only: signing in is the client SDK's job,
+ * but granting a role is an operator verb the tenant's own handler needs
+ * (FR-009). */
 interface RuntimeServices {
     Database: DBClient;
+    Auth: PalbaseAuthAdminClient;
     Secrets: SecretsService;
     Documents: PalbaseDocsClient;
     Storage: PalbaseStorageClient;
@@ -2741,6 +2801,20 @@ declare const Cache: CacheClient;
  * the STACK holds, because no route returns a platform secret's value at all.
  */
 declare const Secrets: SecretsService;
+/**
+ * Role assignment, as an operator — `Auth.assignRole(userId, "agent")`.
+ *
+ * The half of auth a SERVER owns. Signing in, MFA and device attestation are a
+ * person acting on their own account and live on the client SDK; granting a
+ * role is the tenant's product doing something to somebody else, which is
+ * exactly what a handler is for. It writes with the service-role credential,
+ * because an end user who could write their own assignment would make every
+ * permission underneath it meaningless.
+ *
+ * The write is visible to the very next request: authority is read from the
+ * table on each call, never carried on a token.
+ */
+declare const Auth: PalbaseAuthAdminClient;
 /** Structured logger. */
 declare const Log: Logger;
 /** Push / email / SMS / in-app notifications. */
@@ -2864,11 +2938,33 @@ interface TypedTable<T extends TableDef> {
      * if (row === undefined) throw new Conflict("yetersiz bakiye");
      * ```
      */
-    updateMany(q: MutateInput<RowShape<T>, InsertShape<T>>): Promise<RowShape<T>[]>;
+    updateMany<const Q extends MutateInput<RowShape<T>, InsertShape<T>>>(q: Q): Promise<Q extends {
+        returning: false;
+    } ? number : RowShape<T>[]>;
     /** Delete every matching row; resolves to how many. Empty filter refused. */
     deleteMany(q: {
         where: WhereFilter<RowShape<T>> | SqlFragment;
     }): Promise<number>;
+    /**
+     * Toplama — `sum` / `avg` / `min` / `max` / `count`, isteğe bağlı `groupBy`.
+     *
+     * ```ts
+     * const r = await Database.public.entries.aggregate({
+     *   where: { account_id },
+     *   sum: ["amount_kurus"],
+     *   count: true,
+     * });
+     * r.sum.amount_kurus;   // string | null — KAYIPSIZ
+     * r.count;              // number
+     * ```
+     *
+     * `sum`/`avg` yalnız sayısal kolonlarda ve HER ZAMAN `string` döner: para JS
+     * `number`'ına uğradığı anda kesinliğini kaybeder. `| null` çünkü Postgres
+     * boş kümede NULL döndürür — "hiç satır yoktu" ile "toplam sıfırdı" farklı.
+     *
+     * `groupBy` verilirse dönüş bir DİZİ ve her satır grup kolonlarını taşır.
+     */
+    aggregate<const Q extends AggregateInput<RowShape<T>>>(q: Q): Promise<AggregateResult<Q, RowShape<T>>>;
     /** How many rows match. An empty filter is legitimate: counting is a read. */
     count(q?: {
         where?: WhereFilter<RowShape<T>> | SqlFragment;
@@ -3020,7 +3116,26 @@ type ColumnsComparableTo<Row, V> = {
  * `findMany`'nin `Row`'u bilmediği yolların ve jsonb kolonlarının hâli, ve
  * ikisinde de tipin söyleyebileceği bir şey yok.
  */
-type ColRefOf<Row, V = unknown> = [keyof Row] extends [never] ? never : [unknown] extends [V] ? ColRef<Extract<keyof Row, string>> : ColRef<Extract<ColumnsComparableTo<Row, V>, string>>;
+/**
+ * "Kısıt verilmedi" için AYRI bir işaret — `unknown` DEĞİL.
+ *
+ * Eskiden varsayılan `unknown`'dı ve dal `[unknown] extends [V]` ile
+ * seçiliyordu. Ama `jsonb` kolonlarının DEĞER TİPİ de `unknown`: yani gerçek
+ * bir jsonb kolonu "kısıt verilmedi" sanılıp TÜM kolonlarla karşılaştırılabilir
+ * hâle geliyordu. D-021 bunu "jsonb ↔ text derleniyor" diye kaydetmişti ve PG
+ * markası tek başına kapatmadı — `unknown & X` kesişimi `X`'e çöktüğü için
+ * jsonb markalanamıyor (markalamak kolonu daraltıp meşru yazmaları kırdı,
+ * gerçek projede ölçüldü).
+ *
+ * Ayrı bir işaretle iki durum artık ayrışıyor: kısıtsız yol kısıtsız kalıyor,
+ * jsonb ise KENDİ ailesine düşüyor — yani yalnız başka bir jsonb ile
+ * karşılaştırılabiliyor.
+ */
+declare const NO_CONSTRAINT: unique symbol;
+type NoColConstraint = {
+    readonly [NO_CONSTRAINT]: true;
+};
+type ColRefOf<Row, V = NoColConstraint> = [keyof Row] extends [never] ? never : [V] extends [NoColConstraint] ? ColRef<Extract<keyof Row, string>> : ColRef<Extract<ColumnsComparableTo<Row, V>, string>>;
 /**
  * Doğrulanmış, GÖMÜLEBİLİR bir SQL parçası (FR-018, FR-019).
  *
@@ -3281,6 +3396,15 @@ type QueryInput<Row, K extends keyof Row = keyof Row, Rels = unknown> = {
 type MutateInput<Row, Insert, Rels = unknown> = {
     where: WhereFilter<Row> | SqlFragment | HasBranch<Row, Rels>;
     set: SetShape<Insert>;
+    /**
+     * `false` verilirse SATIRLAR değil SAYI döner — `deleteMany` ile aynı şekil.
+     *
+     * ÖLÇÜLDÜ (200 bin satır, canlı pg16): `RETURNING *` sunucuda %55 daha
+     * pahalı (7,2 sn → 11,1 sn) ve JS'te 45 MB yığın tutuyor — satır başına 236
+     * bayt, yani bir milyon satırda 225 MB. Çoğu çağrı için dönen diziyi okumak
+     * DOĞRU ve varsayılan odur; toplu bir iş için çıkış yolu olması gerekiyordu.
+     */
+    returning?: boolean;
 };
 /**
  * `set`'e yazılabilen değer (FR-012): kolonun kendi tipi ya da — sayısal
@@ -3391,6 +3515,64 @@ type RecommendParamsTyped<T extends TableTypes> = SimilarParamsTyped<T> & {
 type RelsOf<T> = T extends {
     relations: infer R;
 } ? R : unknown;
+/**
+ * TOPLAMA — dönüş tipi PG markasından TÜRETİLİR, tahmin edilmez.
+ *
+ * Para bu SDK'dan geçecek, ve toplamada kaybedilecek tek şey kesinliktir:
+ * `sum(numeric)` Postgres'te `numeric`, `sum(integer)` `bigint` — İKİSİ DE JS
+ * `number`'ında kayıplı. Bu yüzden `sum`/`avg` HER ZAMAN `string` döner ve
+ * motor `::text` ile döker. D-007'nin kapattığı hata buydu:
+ * 41.00821234567890123 canlıda 41.0082123456789 oluyordu.
+ *
+ * `| null` bir süs değil: Postgres BOŞ kümede NULL döndürür, 0 değil. "Hiç
+ * satır yoktu" ile "toplam sıfırdı" farklı şeyler, ve tip bunu sormaya
+ * ZORLUYOR.
+ */
+type SummableCols<Row> = {
+    [K in keyof Row]-?: "?" extends PgTag<Row[K]> ? NonNullable<Row[K]> extends number | string ? K : never : PgKind<PgTag<Row[K]>> extends "num" ? K : never;
+}[keyof Row];
+/** `min`/`max` sıralanabilir her kolonda — jsonb ve vektör hariç. */
+type OrderableCols<Row> = {
+    [K in keyof Row]-?: "?" extends PgTag<Row[K]> ? NonNullable<Row[K]> extends number | string | Date ? K : never : PgTag<Row[K]> extends "jsonb" | "vector" ? never : K;
+}[keyof Row];
+type AggCols<Row> = Extract<SummableCols<Row>, string>;
+type AggOrderCols<Row> = Extract<OrderableCols<Row>, string>;
+type AggregateInput<Row, Rels = unknown> = {
+    where?: WhereFilter<Row> | SqlFragment | HasBranch<Row, Rels>;
+    /** Toplam — yalnız sayısal kolonlarda; sonuç `string | null` (kayıpsız). */
+    sum?: readonly AggCols<Row>[];
+    /** Ortalama — sonuç `numeric`, yani `string | null`. */
+    avg?: readonly AggCols<Row>[];
+    min?: readonly AggOrderCols<Row>[];
+    max?: readonly AggOrderCols<Row>[];
+    /** Kaç satır — `count()` ile aynı sayı, ama AYNI turda. */
+    count?: boolean;
+    /** Verilirse SATIRLAR döner ve her satır grup kolonlarını taşır. */
+    groupBy?: readonly Extract<keyof Row, string>[];
+};
+type AggPart<Q, Row, F extends "sum" | "avg" | "min" | "max"> = Q extends {
+    [K in F]: readonly (infer C extends keyof Row)[];
+} ? {
+    [P in C]: F extends "sum" | "avg" ? string | null : Row[P] | null;
+} : never;
+type AggBody<Q, Row> = ([AggPart<Q, Row, "sum">] extends [never] ? unknown : {
+    sum: AggPart<Q, Row, "sum">;
+}) & ([AggPart<Q, Row, "avg">] extends [never] ? unknown : {
+    avg: AggPart<Q, Row, "avg">;
+}) & ([AggPart<Q, Row, "min">] extends [never] ? unknown : {
+    min: AggPart<Q, Row, "min">;
+}) & ([AggPart<Q, Row, "max">] extends [never] ? unknown : {
+    max: AggPart<Q, Row, "max">;
+}) & (Q extends {
+    count: true;
+} ? {
+    count: number;
+} : unknown);
+type AggregateResult<Q, Row> = Q extends {
+    groupBy: readonly (infer G extends keyof Row)[];
+} ? ({
+    [P in G]: Row[P];
+} & AggBody<Q, Row>)[] : AggBody<Q, Row>;
 /** Temel tablo erişimcisi — search'süz beş op. */
 interface EnvTypedTableBase<T extends TableTypes> {
     insert(data: InsertValues<T["insert"]>): Promise<T["row"]>;
@@ -3489,11 +3671,34 @@ interface EnvTypedTableBase<T extends TableTypes> {
      * if (row === undefined) throw new Conflict("yetersiz bakiye");
      * ```
      */
-    updateMany(q: MutateInput<T["row"], T["insert"], RelsOf<T>>): Promise<T["row"][]>;
+    updateMany<const Q extends MutateInput<T["row"], T["insert"], RelsOf<T>>>(q: Q): Promise<Q extends {
+        returning: false;
+    } ? number : T["row"][]>;
     /** Delete every matching row; resolves to how many. Empty filter refused. */
     deleteMany(q: {
         where: WhereFilter<T["row"]> | SqlFragment | HasBranch<T["row"], RelsOf<T>>;
     }): Promise<number>;
+    /**
+     * Toplama — `sum` / `avg` / `min` / `max` / `count`, isteğe bağlı `groupBy`.
+     *
+     * ```ts
+     * const r = await Database.public.entries.aggregate({
+     *   where: { account_id },
+     *   sum: ["amount_kurus"],
+     *   count: true,
+     * });
+     * r.sum.amount_kurus;   // string | null — KAYIPSIZ
+     * r.count;              // number
+     * ```
+     *
+     * `sum`/`avg` yalnız sayısal kolonlarda ve HER ZAMAN `string` döner: para JS
+     * `number`'ına uğradığı anda kesinliğini kaybeder. `| null` çünkü Postgres
+     * boş kümede NULL döndürür — "hiç satır yoktu" ile "toplam sıfırdı" farklı
+     * şeyler ve tip bunu sormaya zorluyor.
+     *
+     * `groupBy` verilirse dönüş bir DİZİ ve her satır grup kolonlarını taşır.
+     */
+    aggregate<const Q extends AggregateInput<T["row"], RelsOf<T>>>(q: Q): Promise<AggregateResult<Q, T["row"]>>;
     /** How many rows match. An empty filter is legitimate: counting is a read. */
     count(q?: {
         where?: WhereFilter<T["row"]> | SqlFragment | HasBranch<T["row"], RelsOf<T>>;
@@ -4441,6 +4646,15 @@ interface DBOps {
     /** Çok satır, TEK statement. Satırların anahtar kümesi aynı olmalı — kolon
      *  listesi paylaşıldığı için farklı şekilli bir satırın kolonu sessizce
      *  yazılmazdı. */
+    aggregate(table: string, q: {
+        where?: Record<string, unknown>;
+        sum?: readonly string[];
+        avg?: readonly string[];
+        min?: readonly string[];
+        max?: readonly string[];
+        count?: boolean;
+        groupBy?: readonly string[];
+    }): Promise<Record<string, unknown> | Record<string, unknown>[]>;
     insertMany(table: string, rows: readonly Record<string, unknown>[], opts?: {
         onConflict: readonly string[];
         action?: "ignore" | "update";
@@ -4518,7 +4732,9 @@ interface DBOps {
      * yetmedi) — ikisini ayıran tek şey dönen dizidir. Çağrı hata fırlatmadı diye
      * işlem oldu SAYILAMAZ; kontrol çağıranın işi.
      */
-    updateMany(table: string, where: Record<string, unknown>, set: Record<string, unknown>): Promise<Record<string, unknown>[]>;
+    updateMany(table: string, where: Record<string, unknown>, set: Record<string, unknown>, opts?: {
+        returning?: boolean;
+    }): Promise<Record<string, unknown>[] | number>;
     /**
      * Bir idempotency anahtarını sahiplen (FR-033).
      *
@@ -4944,4 +5160,4 @@ type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise
  */
 type AuthSpec = boolean | Partial<AuthConfig>;
 
-export { Notifications as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, EXTENSION_DEPENDENCIES as E, type ErrorThrowers as F, type FileContext as G, HttpError as H, Flags as I, Forbidden as J, type HttpMethod as K, IndexBuilder as L, type IndexDef as M, type InsertShape as N, type LifecycleHook as O, type PalbaseResult as P, Log as Q, type RateLimitConfig as R, type SchemaDef as S, type TxPlanBody as T, type Logger as U, type Materialized as V, type Middleware as W, type MiddlewareContext as X, type MiddlewareHandler as Y, NotFound as Z, __runWithRuntime as _, type DBOps as a, type PalbaseListOptions as a$, type OnDeleteAction as a0, PALBASE_EXTENSIONS as a1, type PBRequest as a2, PalError as a3, type PalbaseAnalyticsClient as a4, type PalbaseAnalyticsManagementNamespace as a5, type PalbaseAnalyticsProperties as a6, type PalbaseAnalyticsQueryNamespace as a7, type PalbaseAttestAndroidParams as a8, type PalbaseAttestAndroidResult as a9, type PalbaseExtension as aA, type PalbaseFileObject as aB, type PalbaseFlag as aC, type PalbaseFlagContext as aD, type PalbaseFlagSource as aE, type PalbaseFlagValue as aF, type PalbaseFlagVariant as aG, type PalbaseFlagsClient as aH, type PalbaseFlagsServiceClient as aI, type PalbaseFunctionsClient as aJ, type PalbaseFunnelQueryInput as aK, type PalbaseFunnelResult as aL, type PalbaseIdentifyTraits as aM, type PalbaseInboxClient as aN, type PalbaseInboxListOptions as aO, type PalbaseInboxListResult as aP, type PalbaseInboxMessage as aQ, type PalbaseInboxSendParams as aR, type PalbaseInboxSendResponse as aS, type PalbaseInitialLink as aT, type PalbaseInvokeOptions as aU, type PalbaseLink as aV, type PalbaseLinkAnalytics as aW, type PalbaseLinkDetails as aX, type PalbaseLinksClient as aY, type PalbaseListLinksOptions as aZ, type PalbaseListLinksResult as a_, type PalbaseAttestiOSParams as aa, type PalbaseAttestiOSResult as ab, type PalbaseAuthClient as ac, type PalbaseBatchOverrideOperation as ad, type PalbaseBatchSetOverridesResult as ae, type PalbaseBindDeviceParams as af, type PalbaseBucketClient as ag, type PalbaseClearAllOverridesResult as ah, type PalbaseClearOverrideResult as ai, type PalbaseCohortQueryInput as aj, type PalbaseCohortResult as ak, type PalbaseCollectionRef as al, type PalbaseCountQueryInput as am, type PalbaseCountResult as an, type PalbaseCreateLinkParams as ao, type PalbaseDeviceInfo as ap, type PalbaseDeviceTokenView as aq, type PalbaseDocsClient as ar, type PalbaseDocumentRef as as, type PalbaseDocumentSnapshot as at, type PalbaseEmailClient as au, type PalbaseEmailSendParams as av, type PalbaseEmailSendResponse as aw, type PalbaseEventNamesResult as ax, type PalbaseEventsQueryInput as ay, type PalbaseEventsResult as az, type TxPlanResponse as b, TxPlanError as b$, type PalbaseMatchParams as b0, type PalbaseMultiChannelResponse as b1, type PalbaseNotificationsClient as b2, type PalbaseOverviewResult as b3, type PalbasePreferences as b4, type PalbasePreferencesClient as b5, type PalbasePushClient as b6, type PalbasePushSendParams as b7, type PalbasePushSendResponse as b8, type PalbaseQrCodeOptions as b9, type PolicyExprCtx as bA, PolicyExprRef as bB, type PolicyMode as bC, type PolicyOperand as bD, type RawConstraintDef as bE, Realtime as bF, type Ref as bG, type RequestStore as bH, type RowShape as bI, Secrets as bJ, type SecretsService as bK, SerializationFailure as bL, type SetShape as bM, type SetValue as bN, type ShutdownRunner as bO, type SqlFragment as bP, Storage as bQ, TABLE_META as bR, type TableDef as bS, type TableHandle as bT, type TableInput as bU, TooManyRequests as bV, type TxColumnExpr as bW, type TxInsertShape as bX, type TxInsertValue as bY, type TxNow as bZ, type TxPlan as b_, type PalbaseQuerySnapshot as ba, type PalbaseRealtimeClient as bb, type PalbaseRegisterDeviceParams as bc, type PalbaseRetentionQueryInput as bd, type PalbaseRetentionResult as be, type PalbaseSession as bf, type PalbaseSetOverrideResult as bg, type PalbaseSetOverridesResult as bh, type PalbaseSignedUrlResponse as bi, type PalbaseSmsClient as bj, type PalbaseSmsSendParams as bk, type PalbaseSmsSendResponse as bl, type PalbaseStorageClient as bm, type PalbaseTransformOptions as bn, type PalbaseUpdateLinkParams as bo, type PalbaseUploadOptions as bp, type PalbaseUser as bq, type PalbaseUserDetailResult as br, type PalbaseUsersQueryInput as bs, type PalbaseUsersResult as bt, type PalbaseVerifyRequestSignatureParams as bu, type PalbaseWhereOperator as bv, type PolicyBinOp as bw, PolicyBuilder as bx, type PolicyCommand as by, type PolicyDef as bz, type RuntimeServices as c, type TxPlanHandle as c0, type TxPlanOpResult as c1, type TxPlanRejection as c2, TxRefError as c3, type TxRow as c4, type TxRows as c5, type TxSelectOptions as c6, type TxSetShape as c7, type TxSetValue as c8, type TxTable as c9, enumType as cA, exprCtx as cB, inc as cC, increment as cD, index as cE, installationRef as cF, integer as cG, isPalbaseExtension as cH, isRetryable as cI, jsonb as cJ, makeTypedDB as cK, now as cL, numeric as cM, onShutdown as cN, onStart as cO, openai as cP, ownedByUser as cQ, policy as cR, raw as cS, sqlFragment as cT, text as cU, timestamp as cV, userRef as cW, uuid as cX, vector as cY, withRetry as cZ, type TxTables as ca, type TxWhere as cb, type TxWireExpr as cc, type TxWireGuard as cd, type TxWireOp as ce, type TxWireRef as cf, type TxWireValue as cg, type TypedDB as ch, type TypedTable as ci, type TypedTx as cj, Unauthorized as ck, UniqueViolation as cl, type User as cm, type VerifiedDevice as cn, __getRuntime as co, __resetLifecycleHooks as cp, __runStartHooks as cq, __setRuntime as cr, bigint as cs, boolean as ct, col as cu, dec as cv, decrement as cw, defineMiddleware as cx, defineSchema as cy, defineTable as cz, __requestALS as d, type PolicyExpr as e, type AnyColumn as f, type AuthConfig as g, Cache as h, type ClientInfo as i, type ColRef as j, ColumnBuilder as k, type ColumnDef as l, type ColumnMap as m, type ColumnType as n, Conflict as o, Database as p, DeadlockDetected as q, Documents as r, type EmbeddingModelRef as s, type EnvSchemas as t, type EnvServiceDatabase as u, type EnvTables as v, type EnvTypedDatabase as w, type EnvTypedTable as x, type ErrorDef as y, type ErrorMap as z };
+export { NotFound as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, EXTENSION_DEPENDENCIES as E, type ErrorMap as F, type ErrorThrowers as G, HttpError as H, type FileContext as I, Flags as J, Forbidden as K, type HttpMethod as L, IndexBuilder as M, type IndexDef as N, type InsertShape as O, type PalbaseResult as P, type LifecycleHook as Q, type RateLimitConfig as R, type SchemaDef as S, type TxPlanBody as T, Log as U, type Logger as V, type Materialized as W, type Middleware as X, type MiddlewareContext as Y, type MiddlewareHandler as Z, __runWithRuntime as _, type DBOps as a, type PalbaseListLinksOptions as a$, Notifications as a0, type OnDeleteAction as a1, PALBASE_EXTENSIONS as a2, type PBRequest as a3, PalError as a4, type PalbaseAnalyticsClient as a5, type PalbaseAnalyticsManagementNamespace as a6, type PalbaseAnalyticsProperties as a7, type PalbaseAnalyticsQueryNamespace as a8, type PalbaseAttestAndroidParams as a9, type PalbaseEventsQueryInput as aA, type PalbaseEventsResult as aB, type PalbaseExtension as aC, type PalbaseFileObject as aD, type PalbaseFlag as aE, type PalbaseFlagContext as aF, type PalbaseFlagSource as aG, type PalbaseFlagValue as aH, type PalbaseFlagVariant as aI, type PalbaseFlagsClient as aJ, type PalbaseFlagsServiceClient as aK, type PalbaseFunctionsClient as aL, type PalbaseFunnelQueryInput as aM, type PalbaseFunnelResult as aN, type PalbaseIdentifyTraits as aO, type PalbaseInboxClient as aP, type PalbaseInboxListOptions as aQ, type PalbaseInboxListResult as aR, type PalbaseInboxMessage as aS, type PalbaseInboxSendParams as aT, type PalbaseInboxSendResponse as aU, type PalbaseInitialLink as aV, type PalbaseInvokeOptions as aW, type PalbaseLink as aX, type PalbaseLinkAnalytics as aY, type PalbaseLinkDetails as aZ, type PalbaseLinksClient as a_, type PalbaseAttestAndroidResult as aa, type PalbaseAttestiOSParams as ab, type PalbaseAttestiOSResult as ac, type PalbaseAuthAdminClient as ad, type PalbaseAuthClient as ae, type PalbaseBatchOverrideOperation as af, type PalbaseBatchSetOverridesResult as ag, type PalbaseBindDeviceParams as ah, type PalbaseBucketClient as ai, type PalbaseClearAllOverridesResult as aj, type PalbaseClearOverrideResult as ak, type PalbaseCohortQueryInput as al, type PalbaseCohortResult as am, type PalbaseCollectionRef as an, type PalbaseCountQueryInput as ao, type PalbaseCountResult as ap, type PalbaseCreateLinkParams as aq, type PalbaseDeviceInfo as ar, type PalbaseDeviceTokenView as as, type PalbaseDocsClient as at, type PalbaseDocumentRef as au, type PalbaseDocumentSnapshot as av, type PalbaseEmailClient as aw, type PalbaseEmailSendParams as ax, type PalbaseEmailSendResponse as ay, type PalbaseEventNamesResult as az, type TxPlanResponse as b, type TxNow as b$, type PalbaseListLinksResult as b0, type PalbaseListOptions as b1, type PalbaseMatchParams as b2, type PalbaseMultiChannelResponse as b3, type PalbaseNotificationsClient as b4, type PalbaseOverviewResult as b5, type PalbasePreferences as b6, type PalbasePreferencesClient as b7, type PalbasePushClient as b8, type PalbasePushSendParams as b9, type PolicyCommand as bA, type PolicyDef as bB, type PolicyExprCtx as bC, PolicyExprRef as bD, type PolicyMode as bE, type PolicyOperand as bF, type RawConstraintDef as bG, Realtime as bH, type Ref as bI, type RequestStore as bJ, type RowShape as bK, Secrets as bL, type SecretsService as bM, SerializationFailure as bN, type SetShape as bO, type SetValue as bP, type ShutdownRunner as bQ, type SqlFragment as bR, Storage as bS, TABLE_META as bT, type TableDef as bU, type TableHandle as bV, type TableInput as bW, TooManyRequests as bX, type TxColumnExpr as bY, type TxInsertShape as bZ, type TxInsertValue as b_, type PalbasePushSendResponse as ba, type PalbaseQrCodeOptions as bb, type PalbaseQuerySnapshot as bc, type PalbaseRealtimeClient as bd, type PalbaseRegisterDeviceParams as be, type PalbaseRetentionQueryInput as bf, type PalbaseRetentionResult as bg, type PalbaseSession as bh, type PalbaseSetOverrideResult as bi, type PalbaseSetOverridesResult as bj, type PalbaseSignedUrlResponse as bk, type PalbaseSmsClient as bl, type PalbaseSmsSendParams as bm, type PalbaseSmsSendResponse as bn, type PalbaseStorageClient as bo, type PalbaseTransformOptions as bp, type PalbaseUpdateLinkParams as bq, type PalbaseUploadOptions as br, type PalbaseUser as bs, type PalbaseUserDetailResult as bt, type PalbaseUsersQueryInput as bu, type PalbaseUsersResult as bv, type PalbaseVerifyRequestSignatureParams as bw, type PalbaseWhereOperator as bx, type PolicyBinOp as by, PolicyBuilder as bz, type RuntimeServices as c, withRetry as c$, type TxPlan as c0, TxPlanError as c1, type TxPlanHandle as c2, type TxPlanOpResult as c3, type TxPlanRejection as c4, TxRefError as c5, type TxRow as c6, type TxRows as c7, type TxSelectOptions as c8, type TxSetShape as c9, defineSchema as cA, defineTable as cB, enumType as cC, exprCtx as cD, inc as cE, increment as cF, index as cG, installationRef as cH, integer as cI, isPalbaseExtension as cJ, isRetryable as cK, jsonb as cL, makeTypedDB as cM, now as cN, numeric as cO, onShutdown as cP, onStart as cQ, openai as cR, ownedByUser as cS, policy as cT, raw as cU, sqlFragment as cV, text as cW, timestamp as cX, userRef as cY, uuid as cZ, vector as c_, type TxSetValue as ca, type TxTable as cb, type TxTables as cc, type TxWhere as cd, type TxWireExpr as ce, type TxWireGuard as cf, type TxWireOp as cg, type TxWireRef as ch, type TxWireValue as ci, type TypedDB as cj, type TypedTable as ck, type TypedTx as cl, Unauthorized as cm, UniqueViolation as cn, type User as co, type VerifiedDevice as cp, __getRuntime as cq, __resetLifecycleHooks as cr, __runStartHooks as cs, __setRuntime as ct, bigint as cu, boolean as cv, col as cw, dec as cx, decrement as cy, defineMiddleware as cz, __requestALS as d, type PolicyExpr as e, type AnyColumn as f, Auth as g, type AuthConfig as h, Cache as i, type ClientInfo as j, type ColRef as k, ColumnBuilder as l, type ColumnDef as m, type ColumnMap as n, type ColumnType as o, Conflict as p, Database as q, DeadlockDetected as r, Documents as s, type EmbeddingModelRef as t, type EnvSchemas as u, type EnvServiceDatabase as v, type EnvTables as w, type EnvTypedDatabase as x, type EnvTypedTable as y, type ErrorDef as z };

package/dist/{index-9C3JHxg-.d.cts → index-Zi7MptvP.d.cts}

@@ -1,6 +1,6 @@
-import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-DtISj9QX.cjs';
+import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-DtCgaZAg.cjs';
 import { T as Token } from './module-Dl1KFVtc.cjs';
-import { R as RouteMeta } from './registry-qIPM5BQe.cjs';
+import { R as RouteMeta } from './registry-CEYLH-Iz.cjs';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses
@@ -291,7 +291,9 @@ declare function createOps(tx: TxLike): {
      * should not silently succeed. Callers who mean every row say so with a
      * predicate that is true for every row.
      */
-    updateMany(table: string, where: Row, set: Row): Promise<Row[]>;
+    updateMany(table: string, where: Row, set: Row, opts?: {
+        returning?: boolean;
+    }): Promise<Row[] | number>;
     /**
      * Delete every row the filter matches, in ONE statement; resolves to how
      * many went. Same filter language, same empty-filter refusal as
@@ -307,6 +309,27 @@ declare function createOps(tx: TxLike): {
      * An empty filter is legitimate HERE: counting a whole table is a read, and
      * reads do not destroy anything.
      */
+    /**
+     * Toplama — `count`'un yanına `sum`/`avg`/`min`/`max` ve `groupBy`.
+     *
+     * Var olma nedeni: bunlar olmadan "bu hesabın toplamı" ya `$query`'ye ya da
+     * TÜM satırları çekip JS'te toplamaya düşüyor. İkincisi hem N+1 hem de para
+     * için YANLIŞ — `numeric` JS `number`'ına uğradığı anda kesinliğini
+     * kaybeder.
+     *
+     * `groupBy` verilirse SATIRLAR döner, verilmezse TEK sonuç. Boş kümede
+     * Postgres NULL döndürür, 0 değil — ve bu SDK onu `null` olarak geçiriyor:
+     * "hiç satır yoktu" ile "toplam sıfırdı" farklı şeyler.
+     */
+    aggregate(table: string, q?: {
+        where?: Row;
+        sum?: readonly string[];
+        avg?: readonly string[];
+        min?: readonly string[];
+        max?: readonly string[];
+        count?: boolean;
+        groupBy?: readonly string[];
+    }): Promise<Record<string, unknown> | Record<string, unknown>[]>;
     count(table: string, where?: Row): Promise<number>;
     findById(table: string, id: string): Promise<Row | null>;
     findMany(table: string, query?: Row, opts?: FindManyOptions): Promise<Row[]>;
@@ -809,6 +832,9 @@ declare class AuthVerifier {
 interface EffectiveAuth {
     required: boolean;
     role?: string;
+    /** The permission the route demands, as `resource.action`. Resolved against
+     * `auth.has_permission(...)` at the gate — see AuthConfig.permission. */
+    permission?: string;
     verifiedEmail: boolean;
 }
 /**
@@ -972,7 +998,7 @@ interface RuntimeHooks {
     __requestALS: typeof __requestALS;
 }
 /** The module singletons the engine injects, minus the two it owns itself. */
-type ModuleClients = Partial<Pick<RuntimeServices, "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
+type ModuleClients = Partial<Pick<RuntimeServices, "Auth" | "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
 interface CreateAppOptions {
     /**
      * Vault'tan TEK secret okuma (FR-025): sorgu-anı embedding'in anahtarı
@@ -1028,10 +1054,6 @@ interface App {
      */
     readonly container: Container;
 }
-/**
- * Build the app. Fails fast: the database is reached here, at boot, rather than
- * on the first request that needs it.
- */
 declare function createApp(opts: CreateAppOptions): Promise<App>;
 
 export { type App as A, BootRefused as B, type Container as C, DECLARATION_REFUSAL as D, type EgressPolicy as E, quoteIdent as F, scrubSecrets as G, withTables as H, type ModuleClients as M, RateLimiter as R, type ScrubResult as S, DeclarationRefused as a, DiError as b, type DiKind as c, type ModulePressure as d, assertNoOrphanEntryPoints as e, buildContainer as f, AuthVerifier as g, type CreateAppOptions as h, isDeclarationRefused as i, type EngineConfig as j, type RequestDatabase as k, type RouteEntry as l, type RuntimeHooks as m, type SqlDriver as n, type SqlTx as o, buildRouteTable as p, createApp as q, createLazyTransaction as r, createOps as s, createRequestDatabase as t, effectiveAuth as u, hostAllowed as v, installEgressFence as w, loadConfig as x, makeMemoryCache as y, matchRoute as z };

package/dist/{index-BbvOoZFr.d.ts → index-b-Q3l7W5.d.ts}

@@ -1,6 +1,6 @@
-import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-dTTLlHIn.js';
+import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-8qy3kIuA.js';
 import { T as Token } from './module-Dl1KFVtc.js';
-import { R as RouteMeta } from './registry-JQNIX-eA.js';
+import { R as RouteMeta } from './registry-BGJ-Al6F.js';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses
@@ -291,7 +291,9 @@ declare function createOps(tx: TxLike): {
      * should not silently succeed. Callers who mean every row say so with a
      * predicate that is true for every row.
      */
-    updateMany(table: string, where: Row, set: Row): Promise<Row[]>;
+    updateMany(table: string, where: Row, set: Row, opts?: {
+        returning?: boolean;
+    }): Promise<Row[] | number>;
     /**
      * Delete every row the filter matches, in ONE statement; resolves to how
      * many went. Same filter language, same empty-filter refusal as
@@ -307,6 +309,27 @@ declare function createOps(tx: TxLike): {
      * An empty filter is legitimate HERE: counting a whole table is a read, and
      * reads do not destroy anything.
      */
+    /**
+     * Toplama — `count`'un yanına `sum`/`avg`/`min`/`max` ve `groupBy`.
+     *
+     * Var olma nedeni: bunlar olmadan "bu hesabın toplamı" ya `$query`'ye ya da
+     * TÜM satırları çekip JS'te toplamaya düşüyor. İkincisi hem N+1 hem de para
+     * için YANLIŞ — `numeric` JS `number`'ına uğradığı anda kesinliğini
+     * kaybeder.
+     *
+     * `groupBy` verilirse SATIRLAR döner, verilmezse TEK sonuç. Boş kümede
+     * Postgres NULL döndürür, 0 değil — ve bu SDK onu `null` olarak geçiriyor:
+     * "hiç satır yoktu" ile "toplam sıfırdı" farklı şeyler.
+     */
+    aggregate(table: string, q?: {
+        where?: Row;
+        sum?: readonly string[];
+        avg?: readonly string[];
+        min?: readonly string[];
+        max?: readonly string[];
+        count?: boolean;
+        groupBy?: readonly string[];
+    }): Promise<Record<string, unknown> | Record<string, unknown>[]>;
     count(table: string, where?: Row): Promise<number>;
     findById(table: string, id: string): Promise<Row | null>;
     findMany(table: string, query?: Row, opts?: FindManyOptions): Promise<Row[]>;
@@ -809,6 +832,9 @@ declare class AuthVerifier {
 interface EffectiveAuth {
     required: boolean;
     role?: string;
+    /** The permission the route demands, as `resource.action`. Resolved against
+     * `auth.has_permission(...)` at the gate — see AuthConfig.permission. */
+    permission?: string;
     verifiedEmail: boolean;
 }
 /**
@@ -972,7 +998,7 @@ interface RuntimeHooks {
     __requestALS: typeof __requestALS;
 }
 /** The module singletons the engine injects, minus the two it owns itself. */
-type ModuleClients = Partial<Pick<RuntimeServices, "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
+type ModuleClients = Partial<Pick<RuntimeServices, "Auth" | "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
 interface CreateAppOptions {
     /**
      * Vault'tan TEK secret okuma (FR-025): sorgu-anı embedding'in anahtarı
@@ -1028,10 +1054,6 @@ interface App {
      */
     readonly container: Container;
 }
-/**
- * Build the app. Fails fast: the database is reached here, at boot, rather than
- * on the first request that needs it.
- */
 declare function createApp(opts: CreateAppOptions): Promise<App>;
 
 export { type App as A, BootRefused as B, type Container as C, DECLARATION_REFUSAL as D, type EgressPolicy as E, quoteIdent as F, scrubSecrets as G, withTables as H, type ModuleClients as M, RateLimiter as R, type ScrubResult as S, DeclarationRefused as a, DiError as b, type DiKind as c, type ModulePressure as d, assertNoOrphanEntryPoints as e, buildContainer as f, AuthVerifier as g, type CreateAppOptions as h, isDeclarationRefused as i, type EngineConfig as j, type RequestDatabase as k, type RouteEntry as l, type RuntimeHooks as m, type SqlDriver as n, type SqlTx as o, buildRouteTable as p, createApp as q, createLazyTransaction as r, createOps as s, createRequestDatabase as t, effectiveAuth as u, hostAllowed as v, installEgressFence as w, loadConfig as x, makeMemoryCache as y, matchRoute as z };