@palbase/backend 29.0.0 → 30.0.0

package/dist/engine/index.d.cts

@@ -1,8 +1,8 @@
-import '../index-ChvoVczS.cjs';
-export { A as App, g as AuthVerifier, B as BootRefused, h as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, j as EngineConfig, M as ModuleClients, R as RateLimiter, k as RequestDatabase, l as RouteEntry, m as RuntimeHooks, S as ScrubResult, n as SqlDriver, o as SqlTx, p as buildRouteTable, q as createApp, r as createLazyTransaction, s as createOps, t as createRequestDatabase, u as effectiveAuth, v as hostAllowed, w as installEgressFence, i as isDeclarationRefused, x as loadConfig, y as makeMemoryCache, z as matchRoute, F as quoteIdent, G as scrubSecrets, H as withTables } from '../index-BZfmdRmh.cjs';
+import '../index-DtCgaZAg.cjs';
+export { A as App, g as AuthVerifier, B as BootRefused, h as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, j as EngineConfig, M as ModuleClients, R as RateLimiter, k as RequestDatabase, l as RouteEntry, m as RuntimeHooks, S as ScrubResult, n as SqlDriver, o as SqlTx, p as buildRouteTable, q as createApp, r as createLazyTransaction, s as createOps, t as createRequestDatabase, u as effectiveAuth, v as hostAllowed, w as installEgressFence, i as isDeclarationRefused, x as loadConfig, y as makeMemoryCache, z as matchRoute, F as quoteIdent, G as scrubSecrets, H as withTables } from '../index-Zi7MptvP.cjs';
 import '../db/env.cjs';
 import '../stack.cjs';
 import 'zod';
 import 'node:async_hooks';
 import '../module-Dl1KFVtc.cjs';
-import '../registry-B2KfKWv1.cjs';
+import '../registry-CEYLH-Iz.cjs';

package/dist/engine/index.d.ts

@@ -1,8 +1,8 @@
-import '../index-BOe82fsK.js';
-export { A as App, g as AuthVerifier, B as BootRefused, h as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, j as EngineConfig, M as ModuleClients, R as RateLimiter, k as RequestDatabase, l as RouteEntry, m as RuntimeHooks, S as ScrubResult, n as SqlDriver, o as SqlTx, p as buildRouteTable, q as createApp, r as createLazyTransaction, s as createOps, t as createRequestDatabase, u as effectiveAuth, v as hostAllowed, w as installEgressFence, i as isDeclarationRefused, x as loadConfig, y as makeMemoryCache, z as matchRoute, F as quoteIdent, G as scrubSecrets, H as withTables } from '../index-BYDUKexK.js';
+import '../index-8qy3kIuA.js';
+export { A as App, g as AuthVerifier, B as BootRefused, h as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, j as EngineConfig, M as ModuleClients, R as RateLimiter, k as RequestDatabase, l as RouteEntry, m as RuntimeHooks, S as ScrubResult, n as SqlDriver, o as SqlTx, p as buildRouteTable, q as createApp, r as createLazyTransaction, s as createOps, t as createRequestDatabase, u as effectiveAuth, v as hostAllowed, w as installEgressFence, i as isDeclarationRefused, x as loadConfig, y as makeMemoryCache, z as matchRoute, F as quoteIdent, G as scrubSecrets, H as withTables } from '../index-b-Q3l7W5.js';
 import '../db/env.js';
 import '../stack.js';
 import 'zod';
 import 'node:async_hooks';
 import '../module-Dl1KFVtc.js';
-import '../registry-DaqHsOq8.js';
+import '../registry-BGJ-Al6F.js';

package/dist/engine/index.js

@@ -16,12 +16,12 @@ import {
   quoteIdent,
   scrubSecrets,
   withTables
-} from "../chunk-DHJ3SYAE.js";
+} from "../chunk-VN7NMDUH.js";
 import {
   DECLARATION_REFUSAL,
   DeclarationRefused,
   isDeclarationRefused
-} from "../chunk-ESSQ3YML.js";
+} from "../chunk-5J5W75A6.js";
 import "../chunk-SG4UTNOP.js";
 import "../chunk-3TUJWHC2.js";
 import "../chunk-VVMJEVQP.js";

package/dist/{index-BOe82fsK.d.ts → index-8qy3kIuA.d.ts}

@@ -39,6 +39,20 @@ interface User {
      */
     emailVerified: boolean;
     role: string;
+    /**
+     * The caller's APPLICATION roles, as assigned in `auth.user_roles`.
+     *
+     * Not to be confused with {@link User.role}, which is the DATABASE role RLS
+     * reads and is the literal string "authenticated" for every signed-in user.
+     * These are the names a stack declares (`palbase roles`) and an operator
+     * assigns; `auth: { role }` gates on the same set.
+     *
+     * Resolved per request from the table, in the transaction the handler is
+     * about to use — never from a token claim, so a role revoked a second ago is
+     * already gone here. An empty array for a caller who holds none, never null:
+     * `user.roles.includes("agent")` needs no guard.
+     */
+    roles: string[];
     metadata: Record<string, unknown>;
     /**
      * Reserved, server-owned verified device claim. `null` on an authenticated
@@ -2080,6 +2094,37 @@ interface PalbaseAuthClient {
         dispose(): void;
     };
 }
+/**
+ * The `Auth` singleton a backend handler reaches — the ROLE-ASSIGNMENT surface,
+ * and nothing else.
+ *
+ * Deliberately not {@link PalbaseAuthClient}: that one is a person acting on
+ * their own account (sign-in, MFA, device attestation) and it belongs to the
+ * client SDK. What a server needs is the operator verb — "make this user an
+ * agent" — because the promotion usually happens inside the tenant's own
+ * product, in a handler a supervisor triggers.
+ *
+ * These calls carry the SERVICE-ROLE credential: the routes behind them refuse
+ * anon and `authenticated` alike (FR-013), which is what stops an end user from
+ * granting themselves the permission the rest of the feature gates on.
+ *
+ * Unlike the other clients here these THROW rather than envelope, because two
+ * of the three answer `void` — a refusal that came back as a value would be
+ * indistinguishable from a write that happened. See `clients/auth.ts`.
+ */
+interface PalbaseAuthAdminClient {
+    /**
+     * Give a user a role. Idempotent: assigning one they already hold is not an
+     * error and leaves one row. Throws `RoleNotDefined` when the stack declares
+     * no role by that name.
+     */
+    assignRole(userId: string, role: string): Promise<void>;
+    /** Take a role away. Revoking one they do not hold is not an error. */
+    revokeRole(userId: string, role: string): Promise<void>;
+    /** What that user holds right now. `[]` for a user with no roles — a FAILED
+     * read throws rather than answering the same thing. */
+    rolesOf(userId: string): Promise<string[]>;
+}
 /**
  * Bucket-level file operations available via `ctx.storage.bucket(name)`.
  * `getPublicUrl` is synchronous (no network call — constructs URL locally).
@@ -2539,11 +2584,14 @@ interface PalbaseLinksClient {
  * Realtime is BROADCAST-ONLY here (a stateless handler can push an event but
  * cannot hold a subscription socket — `subscribe()` lives on the client SDK).
  *
- * EXCLUDED on purpose: Functions, Links, Analytics, Auth. They are not
- * exposed as backend handler singletons (auth lives on the client SDK; the rest
- * are out of scope for backend endpoints). */
+ * EXCLUDED on purpose: Functions, Links, Analytics. They are not exposed as
+ * backend handler singletons — out of scope for backend endpoints. `Auth` is
+ * here in its ROLE-ASSIGNMENT shape only: signing in is the client SDK's job,
+ * but granting a role is an operator verb the tenant's own handler needs
+ * (FR-009). */
 interface RuntimeServices {
     Database: DBClient;
+    Auth: PalbaseAuthAdminClient;
     Secrets: SecretsService;
     Documents: PalbaseDocsClient;
     Storage: PalbaseStorageClient;
@@ -2753,6 +2801,20 @@ declare const Cache: CacheClient;
  * the STACK holds, because no route returns a platform secret's value at all.
  */
 declare const Secrets: SecretsService;
+/**
+ * Role assignment, as an operator — `Auth.assignRole(userId, "agent")`.
+ *
+ * The half of auth a SERVER owns. Signing in, MFA and device attestation are a
+ * person acting on their own account and live on the client SDK; granting a
+ * role is the tenant's product doing something to somebody else, which is
+ * exactly what a handler is for. It writes with the service-role credential,
+ * because an end user who could write their own assignment would make every
+ * permission underneath it meaningless.
+ *
+ * The write is visible to the very next request: authority is read from the
+ * table on each call, never carried on a token.
+ */
+declare const Auth: PalbaseAuthAdminClient;
 /** Structured logger. */
 declare const Log: Logger;
 /** Push / email / SMS / in-app notifications. */
@@ -5098,4 +5160,4 @@ type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise
  */
 type AuthSpec = boolean | Partial<AuthConfig>;
 
-export { Notifications as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, EXTENSION_DEPENDENCIES as E, type ErrorThrowers as F, type FileContext as G, HttpError as H, Flags as I, Forbidden as J, type HttpMethod as K, IndexBuilder as L, type IndexDef as M, type InsertShape as N, type LifecycleHook as O, type PalbaseResult as P, Log as Q, type RateLimitConfig as R, type SchemaDef as S, type TxPlanBody as T, type Logger as U, type Materialized as V, type Middleware as W, type MiddlewareContext as X, type MiddlewareHandler as Y, NotFound as Z, __runWithRuntime as _, type DBOps as a, type PalbaseListOptions as a$, type OnDeleteAction as a0, PALBASE_EXTENSIONS as a1, type PBRequest as a2, PalError as a3, type PalbaseAnalyticsClient as a4, type PalbaseAnalyticsManagementNamespace as a5, type PalbaseAnalyticsProperties as a6, type PalbaseAnalyticsQueryNamespace as a7, type PalbaseAttestAndroidParams as a8, type PalbaseAttestAndroidResult as a9, type PalbaseExtension as aA, type PalbaseFileObject as aB, type PalbaseFlag as aC, type PalbaseFlagContext as aD, type PalbaseFlagSource as aE, type PalbaseFlagValue as aF, type PalbaseFlagVariant as aG, type PalbaseFlagsClient as aH, type PalbaseFlagsServiceClient as aI, type PalbaseFunctionsClient as aJ, type PalbaseFunnelQueryInput as aK, type PalbaseFunnelResult as aL, type PalbaseIdentifyTraits as aM, type PalbaseInboxClient as aN, type PalbaseInboxListOptions as aO, type PalbaseInboxListResult as aP, type PalbaseInboxMessage as aQ, type PalbaseInboxSendParams as aR, type PalbaseInboxSendResponse as aS, type PalbaseInitialLink as aT, type PalbaseInvokeOptions as aU, type PalbaseLink as aV, type PalbaseLinkAnalytics as aW, type PalbaseLinkDetails as aX, type PalbaseLinksClient as aY, type PalbaseListLinksOptions as aZ, type PalbaseListLinksResult as a_, type PalbaseAttestiOSParams as aa, type PalbaseAttestiOSResult as ab, type PalbaseAuthClient as ac, type PalbaseBatchOverrideOperation as ad, type PalbaseBatchSetOverridesResult as ae, type PalbaseBindDeviceParams as af, type PalbaseBucketClient as ag, type PalbaseClearAllOverridesResult as ah, type PalbaseClearOverrideResult as ai, type PalbaseCohortQueryInput as aj, type PalbaseCohortResult as ak, type PalbaseCollectionRef as al, type PalbaseCountQueryInput as am, type PalbaseCountResult as an, type PalbaseCreateLinkParams as ao, type PalbaseDeviceInfo as ap, type PalbaseDeviceTokenView as aq, type PalbaseDocsClient as ar, type PalbaseDocumentRef as as, type PalbaseDocumentSnapshot as at, type PalbaseEmailClient as au, type PalbaseEmailSendParams as av, type PalbaseEmailSendResponse as aw, type PalbaseEventNamesResult as ax, type PalbaseEventsQueryInput as ay, type PalbaseEventsResult as az, type TxPlanResponse as b, TxPlanError as b$, type PalbaseMatchParams as b0, type PalbaseMultiChannelResponse as b1, type PalbaseNotificationsClient as b2, type PalbaseOverviewResult as b3, type PalbasePreferences as b4, type PalbasePreferencesClient as b5, type PalbasePushClient as b6, type PalbasePushSendParams as b7, type PalbasePushSendResponse as b8, type PalbaseQrCodeOptions as b9, type PolicyExprCtx as bA, PolicyExprRef as bB, type PolicyMode as bC, type PolicyOperand as bD, type RawConstraintDef as bE, Realtime as bF, type Ref as bG, type RequestStore as bH, type RowShape as bI, Secrets as bJ, type SecretsService as bK, SerializationFailure as bL, type SetShape as bM, type SetValue as bN, type ShutdownRunner as bO, type SqlFragment as bP, Storage as bQ, TABLE_META as bR, type TableDef as bS, type TableHandle as bT, type TableInput as bU, TooManyRequests as bV, type TxColumnExpr as bW, type TxInsertShape as bX, type TxInsertValue as bY, type TxNow as bZ, type TxPlan as b_, type PalbaseQuerySnapshot as ba, type PalbaseRealtimeClient as bb, type PalbaseRegisterDeviceParams as bc, type PalbaseRetentionQueryInput as bd, type PalbaseRetentionResult as be, type PalbaseSession as bf, type PalbaseSetOverrideResult as bg, type PalbaseSetOverridesResult as bh, type PalbaseSignedUrlResponse as bi, type PalbaseSmsClient as bj, type PalbaseSmsSendParams as bk, type PalbaseSmsSendResponse as bl, type PalbaseStorageClient as bm, type PalbaseTransformOptions as bn, type PalbaseUpdateLinkParams as bo, type PalbaseUploadOptions as bp, type PalbaseUser as bq, type PalbaseUserDetailResult as br, type PalbaseUsersQueryInput as bs, type PalbaseUsersResult as bt, type PalbaseVerifyRequestSignatureParams as bu, type PalbaseWhereOperator as bv, type PolicyBinOp as bw, PolicyBuilder as bx, type PolicyCommand as by, type PolicyDef as bz, type RuntimeServices as c, type TxPlanHandle as c0, type TxPlanOpResult as c1, type TxPlanRejection as c2, TxRefError as c3, type TxRow as c4, type TxRows as c5, type TxSelectOptions as c6, type TxSetShape as c7, type TxSetValue as c8, type TxTable as c9, enumType as cA, exprCtx as cB, inc as cC, increment as cD, index as cE, installationRef as cF, integer as cG, isPalbaseExtension as cH, isRetryable as cI, jsonb as cJ, makeTypedDB as cK, now as cL, numeric as cM, onShutdown as cN, onStart as cO, openai as cP, ownedByUser as cQ, policy as cR, raw as cS, sqlFragment as cT, text as cU, timestamp as cV, userRef as cW, uuid as cX, vector as cY, withRetry as cZ, type TxTables as ca, type TxWhere as cb, type TxWireExpr as cc, type TxWireGuard as cd, type TxWireOp as ce, type TxWireRef as cf, type TxWireValue as cg, type TypedDB as ch, type TypedTable as ci, type TypedTx as cj, Unauthorized as ck, UniqueViolation as cl, type User as cm, type VerifiedDevice as cn, __getRuntime as co, __resetLifecycleHooks as cp, __runStartHooks as cq, __setRuntime as cr, bigint as cs, boolean as ct, col as cu, dec as cv, decrement as cw, defineMiddleware as cx, defineSchema as cy, defineTable as cz, __requestALS as d, type PolicyExpr as e, type AnyColumn as f, type AuthConfig as g, Cache as h, type ClientInfo as i, type ColRef as j, ColumnBuilder as k, type ColumnDef as l, type ColumnMap as m, type ColumnType as n, Conflict as o, Database as p, DeadlockDetected as q, Documents as r, type EmbeddingModelRef as s, type EnvSchemas as t, type EnvServiceDatabase as u, type EnvTables as v, type EnvTypedDatabase as w, type EnvTypedTable as x, type ErrorDef as y, type ErrorMap as z };
+export { NotFound as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, EXTENSION_DEPENDENCIES as E, type ErrorMap as F, type ErrorThrowers as G, HttpError as H, type FileContext as I, Flags as J, Forbidden as K, type HttpMethod as L, IndexBuilder as M, type IndexDef as N, type InsertShape as O, type PalbaseResult as P, type LifecycleHook as Q, type RateLimitConfig as R, type SchemaDef as S, type TxPlanBody as T, Log as U, type Logger as V, type Materialized as W, type Middleware as X, type MiddlewareContext as Y, type MiddlewareHandler as Z, __runWithRuntime as _, type DBOps as a, type PalbaseListLinksOptions as a$, Notifications as a0, type OnDeleteAction as a1, PALBASE_EXTENSIONS as a2, type PBRequest as a3, PalError as a4, type PalbaseAnalyticsClient as a5, type PalbaseAnalyticsManagementNamespace as a6, type PalbaseAnalyticsProperties as a7, type PalbaseAnalyticsQueryNamespace as a8, type PalbaseAttestAndroidParams as a9, type PalbaseEventsQueryInput as aA, type PalbaseEventsResult as aB, type PalbaseExtension as aC, type PalbaseFileObject as aD, type PalbaseFlag as aE, type PalbaseFlagContext as aF, type PalbaseFlagSource as aG, type PalbaseFlagValue as aH, type PalbaseFlagVariant as aI, type PalbaseFlagsClient as aJ, type PalbaseFlagsServiceClient as aK, type PalbaseFunctionsClient as aL, type PalbaseFunnelQueryInput as aM, type PalbaseFunnelResult as aN, type PalbaseIdentifyTraits as aO, type PalbaseInboxClient as aP, type PalbaseInboxListOptions as aQ, type PalbaseInboxListResult as aR, type PalbaseInboxMessage as aS, type PalbaseInboxSendParams as aT, type PalbaseInboxSendResponse as aU, type PalbaseInitialLink as aV, type PalbaseInvokeOptions as aW, type PalbaseLink as aX, type PalbaseLinkAnalytics as aY, type PalbaseLinkDetails as aZ, type PalbaseLinksClient as a_, type PalbaseAttestAndroidResult as aa, type PalbaseAttestiOSParams as ab, type PalbaseAttestiOSResult as ac, type PalbaseAuthAdminClient as ad, type PalbaseAuthClient as ae, type PalbaseBatchOverrideOperation as af, type PalbaseBatchSetOverridesResult as ag, type PalbaseBindDeviceParams as ah, type PalbaseBucketClient as ai, type PalbaseClearAllOverridesResult as aj, type PalbaseClearOverrideResult as ak, type PalbaseCohortQueryInput as al, type PalbaseCohortResult as am, type PalbaseCollectionRef as an, type PalbaseCountQueryInput as ao, type PalbaseCountResult as ap, type PalbaseCreateLinkParams as aq, type PalbaseDeviceInfo as ar, type PalbaseDeviceTokenView as as, type PalbaseDocsClient as at, type PalbaseDocumentRef as au, type PalbaseDocumentSnapshot as av, type PalbaseEmailClient as aw, type PalbaseEmailSendParams as ax, type PalbaseEmailSendResponse as ay, type PalbaseEventNamesResult as az, type TxPlanResponse as b, type TxNow as b$, type PalbaseListLinksResult as b0, type PalbaseListOptions as b1, type PalbaseMatchParams as b2, type PalbaseMultiChannelResponse as b3, type PalbaseNotificationsClient as b4, type PalbaseOverviewResult as b5, type PalbasePreferences as b6, type PalbasePreferencesClient as b7, type PalbasePushClient as b8, type PalbasePushSendParams as b9, type PolicyCommand as bA, type PolicyDef as bB, type PolicyExprCtx as bC, PolicyExprRef as bD, type PolicyMode as bE, type PolicyOperand as bF, type RawConstraintDef as bG, Realtime as bH, type Ref as bI, type RequestStore as bJ, type RowShape as bK, Secrets as bL, type SecretsService as bM, SerializationFailure as bN, type SetShape as bO, type SetValue as bP, type ShutdownRunner as bQ, type SqlFragment as bR, Storage as bS, TABLE_META as bT, type TableDef as bU, type TableHandle as bV, type TableInput as bW, TooManyRequests as bX, type TxColumnExpr as bY, type TxInsertShape as bZ, type TxInsertValue as b_, type PalbasePushSendResponse as ba, type PalbaseQrCodeOptions as bb, type PalbaseQuerySnapshot as bc, type PalbaseRealtimeClient as bd, type PalbaseRegisterDeviceParams as be, type PalbaseRetentionQueryInput as bf, type PalbaseRetentionResult as bg, type PalbaseSession as bh, type PalbaseSetOverrideResult as bi, type PalbaseSetOverridesResult as bj, type PalbaseSignedUrlResponse as bk, type PalbaseSmsClient as bl, type PalbaseSmsSendParams as bm, type PalbaseSmsSendResponse as bn, type PalbaseStorageClient as bo, type PalbaseTransformOptions as bp, type PalbaseUpdateLinkParams as bq, type PalbaseUploadOptions as br, type PalbaseUser as bs, type PalbaseUserDetailResult as bt, type PalbaseUsersQueryInput as bu, type PalbaseUsersResult as bv, type PalbaseVerifyRequestSignatureParams as bw, type PalbaseWhereOperator as bx, type PolicyBinOp as by, PolicyBuilder as bz, type RuntimeServices as c, withRetry as c$, type TxPlan as c0, TxPlanError as c1, type TxPlanHandle as c2, type TxPlanOpResult as c3, type TxPlanRejection as c4, TxRefError as c5, type TxRow as c6, type TxRows as c7, type TxSelectOptions as c8, type TxSetShape as c9, defineSchema as cA, defineTable as cB, enumType as cC, exprCtx as cD, inc as cE, increment as cF, index as cG, installationRef as cH, integer as cI, isPalbaseExtension as cJ, isRetryable as cK, jsonb as cL, makeTypedDB as cM, now as cN, numeric as cO, onShutdown as cP, onStart as cQ, openai as cR, ownedByUser as cS, policy as cT, raw as cU, sqlFragment as cV, text as cW, timestamp as cX, userRef as cY, uuid as cZ, vector as c_, type TxSetValue as ca, type TxTable as cb, type TxTables as cc, type TxWhere as cd, type TxWireExpr as ce, type TxWireGuard as cf, type TxWireOp as cg, type TxWireRef as ch, type TxWireValue as ci, type TypedDB as cj, type TypedTable as ck, type TypedTx as cl, Unauthorized as cm, UniqueViolation as cn, type User as co, type VerifiedDevice as cp, __getRuntime as cq, __resetLifecycleHooks as cr, __runStartHooks as cs, __setRuntime as ct, bigint as cu, boolean as cv, col as cw, dec as cx, decrement as cy, defineMiddleware as cz, __requestALS as d, type PolicyExpr as e, type AnyColumn as f, Auth as g, type AuthConfig as h, Cache as i, type ClientInfo as j, type ColRef as k, ColumnBuilder as l, type ColumnDef as m, type ColumnMap as n, type ColumnType as o, Conflict as p, Database as q, DeadlockDetected as r, Documents as s, type EmbeddingModelRef as t, type EnvSchemas as u, type EnvServiceDatabase as v, type EnvTables as w, type EnvTypedDatabase as x, type EnvTypedTable as y, type ErrorDef as z };

package/dist/{index-ChvoVczS.d.cts → index-DtCgaZAg.d.cts}

@@ -39,6 +39,20 @@ interface User {
      */
     emailVerified: boolean;
     role: string;
+    /**
+     * The caller's APPLICATION roles, as assigned in `auth.user_roles`.
+     *
+     * Not to be confused with {@link User.role}, which is the DATABASE role RLS
+     * reads and is the literal string "authenticated" for every signed-in user.
+     * These are the names a stack declares (`palbase roles`) and an operator
+     * assigns; `auth: { role }` gates on the same set.
+     *
+     * Resolved per request from the table, in the transaction the handler is
+     * about to use — never from a token claim, so a role revoked a second ago is
+     * already gone here. An empty array for a caller who holds none, never null:
+     * `user.roles.includes("agent")` needs no guard.
+     */
+    roles: string[];
     metadata: Record<string, unknown>;
     /**
      * Reserved, server-owned verified device claim. `null` on an authenticated
@@ -2080,6 +2094,37 @@ interface PalbaseAuthClient {
         dispose(): void;
     };
 }
+/**
+ * The `Auth` singleton a backend handler reaches — the ROLE-ASSIGNMENT surface,
+ * and nothing else.
+ *
+ * Deliberately not {@link PalbaseAuthClient}: that one is a person acting on
+ * their own account (sign-in, MFA, device attestation) and it belongs to the
+ * client SDK. What a server needs is the operator verb — "make this user an
+ * agent" — because the promotion usually happens inside the tenant's own
+ * product, in a handler a supervisor triggers.
+ *
+ * These calls carry the SERVICE-ROLE credential: the routes behind them refuse
+ * anon and `authenticated` alike (FR-013), which is what stops an end user from
+ * granting themselves the permission the rest of the feature gates on.
+ *
+ * Unlike the other clients here these THROW rather than envelope, because two
+ * of the three answer `void` — a refusal that came back as a value would be
+ * indistinguishable from a write that happened. See `clients/auth.ts`.
+ */
+interface PalbaseAuthAdminClient {
+    /**
+     * Give a user a role. Idempotent: assigning one they already hold is not an
+     * error and leaves one row. Throws `RoleNotDefined` when the stack declares
+     * no role by that name.
+     */
+    assignRole(userId: string, role: string): Promise<void>;
+    /** Take a role away. Revoking one they do not hold is not an error. */
+    revokeRole(userId: string, role: string): Promise<void>;
+    /** What that user holds right now. `[]` for a user with no roles — a FAILED
+     * read throws rather than answering the same thing. */
+    rolesOf(userId: string): Promise<string[]>;
+}
 /**
  * Bucket-level file operations available via `ctx.storage.bucket(name)`.
  * `getPublicUrl` is synchronous (no network call — constructs URL locally).
@@ -2539,11 +2584,14 @@ interface PalbaseLinksClient {
  * Realtime is BROADCAST-ONLY here (a stateless handler can push an event but
  * cannot hold a subscription socket — `subscribe()` lives on the client SDK).
  *
- * EXCLUDED on purpose: Functions, Links, Analytics, Auth. They are not
- * exposed as backend handler singletons (auth lives on the client SDK; the rest
- * are out of scope for backend endpoints). */
+ * EXCLUDED on purpose: Functions, Links, Analytics. They are not exposed as
+ * backend handler singletons — out of scope for backend endpoints. `Auth` is
+ * here in its ROLE-ASSIGNMENT shape only: signing in is the client SDK's job,
+ * but granting a role is an operator verb the tenant's own handler needs
+ * (FR-009). */
 interface RuntimeServices {
     Database: DBClient;
+    Auth: PalbaseAuthAdminClient;
     Secrets: SecretsService;
     Documents: PalbaseDocsClient;
     Storage: PalbaseStorageClient;
@@ -2753,6 +2801,20 @@ declare const Cache: CacheClient;
  * the STACK holds, because no route returns a platform secret's value at all.
  */
 declare const Secrets: SecretsService;
+/**
+ * Role assignment, as an operator — `Auth.assignRole(userId, "agent")`.
+ *
+ * The half of auth a SERVER owns. Signing in, MFA and device attestation are a
+ * person acting on their own account and live on the client SDK; granting a
+ * role is the tenant's product doing something to somebody else, which is
+ * exactly what a handler is for. It writes with the service-role credential,
+ * because an end user who could write their own assignment would make every
+ * permission underneath it meaningless.
+ *
+ * The write is visible to the very next request: authority is read from the
+ * table on each call, never carried on a token.
+ */
+declare const Auth: PalbaseAuthAdminClient;
 /** Structured logger. */
 declare const Log: Logger;
 /** Push / email / SMS / in-app notifications. */
@@ -5098,4 +5160,4 @@ type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise
  */
 type AuthSpec = boolean | Partial<AuthConfig>;
 
-export { Notifications as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, EXTENSION_DEPENDENCIES as E, type ErrorThrowers as F, type FileContext as G, HttpError as H, Flags as I, Forbidden as J, type HttpMethod as K, IndexBuilder as L, type IndexDef as M, type InsertShape as N, type LifecycleHook as O, type PalbaseResult as P, Log as Q, type RateLimitConfig as R, type SchemaDef as S, type TxPlanBody as T, type Logger as U, type Materialized as V, type Middleware as W, type MiddlewareContext as X, type MiddlewareHandler as Y, NotFound as Z, __runWithRuntime as _, type DBOps as a, type PalbaseListOptions as a$, type OnDeleteAction as a0, PALBASE_EXTENSIONS as a1, type PBRequest as a2, PalError as a3, type PalbaseAnalyticsClient as a4, type PalbaseAnalyticsManagementNamespace as a5, type PalbaseAnalyticsProperties as a6, type PalbaseAnalyticsQueryNamespace as a7, type PalbaseAttestAndroidParams as a8, type PalbaseAttestAndroidResult as a9, type PalbaseExtension as aA, type PalbaseFileObject as aB, type PalbaseFlag as aC, type PalbaseFlagContext as aD, type PalbaseFlagSource as aE, type PalbaseFlagValue as aF, type PalbaseFlagVariant as aG, type PalbaseFlagsClient as aH, type PalbaseFlagsServiceClient as aI, type PalbaseFunctionsClient as aJ, type PalbaseFunnelQueryInput as aK, type PalbaseFunnelResult as aL, type PalbaseIdentifyTraits as aM, type PalbaseInboxClient as aN, type PalbaseInboxListOptions as aO, type PalbaseInboxListResult as aP, type PalbaseInboxMessage as aQ, type PalbaseInboxSendParams as aR, type PalbaseInboxSendResponse as aS, type PalbaseInitialLink as aT, type PalbaseInvokeOptions as aU, type PalbaseLink as aV, type PalbaseLinkAnalytics as aW, type PalbaseLinkDetails as aX, type PalbaseLinksClient as aY, type PalbaseListLinksOptions as aZ, type PalbaseListLinksResult as a_, type PalbaseAttestiOSParams as aa, type PalbaseAttestiOSResult as ab, type PalbaseAuthClient as ac, type PalbaseBatchOverrideOperation as ad, type PalbaseBatchSetOverridesResult as ae, type PalbaseBindDeviceParams as af, type PalbaseBucketClient as ag, type PalbaseClearAllOverridesResult as ah, type PalbaseClearOverrideResult as ai, type PalbaseCohortQueryInput as aj, type PalbaseCohortResult as ak, type PalbaseCollectionRef as al, type PalbaseCountQueryInput as am, type PalbaseCountResult as an, type PalbaseCreateLinkParams as ao, type PalbaseDeviceInfo as ap, type PalbaseDeviceTokenView as aq, type PalbaseDocsClient as ar, type PalbaseDocumentRef as as, type PalbaseDocumentSnapshot as at, type PalbaseEmailClient as au, type PalbaseEmailSendParams as av, type PalbaseEmailSendResponse as aw, type PalbaseEventNamesResult as ax, type PalbaseEventsQueryInput as ay, type PalbaseEventsResult as az, type TxPlanResponse as b, TxPlanError as b$, type PalbaseMatchParams as b0, type PalbaseMultiChannelResponse as b1, type PalbaseNotificationsClient as b2, type PalbaseOverviewResult as b3, type PalbasePreferences as b4, type PalbasePreferencesClient as b5, type PalbasePushClient as b6, type PalbasePushSendParams as b7, type PalbasePushSendResponse as b8, type PalbaseQrCodeOptions as b9, type PolicyExprCtx as bA, PolicyExprRef as bB, type PolicyMode as bC, type PolicyOperand as bD, type RawConstraintDef as bE, Realtime as bF, type Ref as bG, type RequestStore as bH, type RowShape as bI, Secrets as bJ, type SecretsService as bK, SerializationFailure as bL, type SetShape as bM, type SetValue as bN, type ShutdownRunner as bO, type SqlFragment as bP, Storage as bQ, TABLE_META as bR, type TableDef as bS, type TableHandle as bT, type TableInput as bU, TooManyRequests as bV, type TxColumnExpr as bW, type TxInsertShape as bX, type TxInsertValue as bY, type TxNow as bZ, type TxPlan as b_, type PalbaseQuerySnapshot as ba, type PalbaseRealtimeClient as bb, type PalbaseRegisterDeviceParams as bc, type PalbaseRetentionQueryInput as bd, type PalbaseRetentionResult as be, type PalbaseSession as bf, type PalbaseSetOverrideResult as bg, type PalbaseSetOverridesResult as bh, type PalbaseSignedUrlResponse as bi, type PalbaseSmsClient as bj, type PalbaseSmsSendParams as bk, type PalbaseSmsSendResponse as bl, type PalbaseStorageClient as bm, type PalbaseTransformOptions as bn, type PalbaseUpdateLinkParams as bo, type PalbaseUploadOptions as bp, type PalbaseUser as bq, type PalbaseUserDetailResult as br, type PalbaseUsersQueryInput as bs, type PalbaseUsersResult as bt, type PalbaseVerifyRequestSignatureParams as bu, type PalbaseWhereOperator as bv, type PolicyBinOp as bw, PolicyBuilder as bx, type PolicyCommand as by, type PolicyDef as bz, type RuntimeServices as c, type TxPlanHandle as c0, type TxPlanOpResult as c1, type TxPlanRejection as c2, TxRefError as c3, type TxRow as c4, type TxRows as c5, type TxSelectOptions as c6, type TxSetShape as c7, type TxSetValue as c8, type TxTable as c9, enumType as cA, exprCtx as cB, inc as cC, increment as cD, index as cE, installationRef as cF, integer as cG, isPalbaseExtension as cH, isRetryable as cI, jsonb as cJ, makeTypedDB as cK, now as cL, numeric as cM, onShutdown as cN, onStart as cO, openai as cP, ownedByUser as cQ, policy as cR, raw as cS, sqlFragment as cT, text as cU, timestamp as cV, userRef as cW, uuid as cX, vector as cY, withRetry as cZ, type TxTables as ca, type TxWhere as cb, type TxWireExpr as cc, type TxWireGuard as cd, type TxWireOp as ce, type TxWireRef as cf, type TxWireValue as cg, type TypedDB as ch, type TypedTable as ci, type TypedTx as cj, Unauthorized as ck, UniqueViolation as cl, type User as cm, type VerifiedDevice as cn, __getRuntime as co, __resetLifecycleHooks as cp, __runStartHooks as cq, __setRuntime as cr, bigint as cs, boolean as ct, col as cu, dec as cv, decrement as cw, defineMiddleware as cx, defineSchema as cy, defineTable as cz, __requestALS as d, type PolicyExpr as e, type AnyColumn as f, type AuthConfig as g, Cache as h, type ClientInfo as i, type ColRef as j, ColumnBuilder as k, type ColumnDef as l, type ColumnMap as m, type ColumnType as n, Conflict as o, Database as p, DeadlockDetected as q, Documents as r, type EmbeddingModelRef as s, type EnvSchemas as t, type EnvServiceDatabase as u, type EnvTables as v, type EnvTypedDatabase as w, type EnvTypedTable as x, type ErrorDef as y, type ErrorMap as z };
+export { NotFound as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, EXTENSION_DEPENDENCIES as E, type ErrorMap as F, type ErrorThrowers as G, HttpError as H, type FileContext as I, Flags as J, Forbidden as K, type HttpMethod as L, IndexBuilder as M, type IndexDef as N, type InsertShape as O, type PalbaseResult as P, type LifecycleHook as Q, type RateLimitConfig as R, type SchemaDef as S, type TxPlanBody as T, Log as U, type Logger as V, type Materialized as W, type Middleware as X, type MiddlewareContext as Y, type MiddlewareHandler as Z, __runWithRuntime as _, type DBOps as a, type PalbaseListLinksOptions as a$, Notifications as a0, type OnDeleteAction as a1, PALBASE_EXTENSIONS as a2, type PBRequest as a3, PalError as a4, type PalbaseAnalyticsClient as a5, type PalbaseAnalyticsManagementNamespace as a6, type PalbaseAnalyticsProperties as a7, type PalbaseAnalyticsQueryNamespace as a8, type PalbaseAttestAndroidParams as a9, type PalbaseEventsQueryInput as aA, type PalbaseEventsResult as aB, type PalbaseExtension as aC, type PalbaseFileObject as aD, type PalbaseFlag as aE, type PalbaseFlagContext as aF, type PalbaseFlagSource as aG, type PalbaseFlagValue as aH, type PalbaseFlagVariant as aI, type PalbaseFlagsClient as aJ, type PalbaseFlagsServiceClient as aK, type PalbaseFunctionsClient as aL, type PalbaseFunnelQueryInput as aM, type PalbaseFunnelResult as aN, type PalbaseIdentifyTraits as aO, type PalbaseInboxClient as aP, type PalbaseInboxListOptions as aQ, type PalbaseInboxListResult as aR, type PalbaseInboxMessage as aS, type PalbaseInboxSendParams as aT, type PalbaseInboxSendResponse as aU, type PalbaseInitialLink as aV, type PalbaseInvokeOptions as aW, type PalbaseLink as aX, type PalbaseLinkAnalytics as aY, type PalbaseLinkDetails as aZ, type PalbaseLinksClient as a_, type PalbaseAttestAndroidResult as aa, type PalbaseAttestiOSParams as ab, type PalbaseAttestiOSResult as ac, type PalbaseAuthAdminClient as ad, type PalbaseAuthClient as ae, type PalbaseBatchOverrideOperation as af, type PalbaseBatchSetOverridesResult as ag, type PalbaseBindDeviceParams as ah, type PalbaseBucketClient as ai, type PalbaseClearAllOverridesResult as aj, type PalbaseClearOverrideResult as ak, type PalbaseCohortQueryInput as al, type PalbaseCohortResult as am, type PalbaseCollectionRef as an, type PalbaseCountQueryInput as ao, type PalbaseCountResult as ap, type PalbaseCreateLinkParams as aq, type PalbaseDeviceInfo as ar, type PalbaseDeviceTokenView as as, type PalbaseDocsClient as at, type PalbaseDocumentRef as au, type PalbaseDocumentSnapshot as av, type PalbaseEmailClient as aw, type PalbaseEmailSendParams as ax, type PalbaseEmailSendResponse as ay, type PalbaseEventNamesResult as az, type TxPlanResponse as b, type TxNow as b$, type PalbaseListLinksResult as b0, type PalbaseListOptions as b1, type PalbaseMatchParams as b2, type PalbaseMultiChannelResponse as b3, type PalbaseNotificationsClient as b4, type PalbaseOverviewResult as b5, type PalbasePreferences as b6, type PalbasePreferencesClient as b7, type PalbasePushClient as b8, type PalbasePushSendParams as b9, type PolicyCommand as bA, type PolicyDef as bB, type PolicyExprCtx as bC, PolicyExprRef as bD, type PolicyMode as bE, type PolicyOperand as bF, type RawConstraintDef as bG, Realtime as bH, type Ref as bI, type RequestStore as bJ, type RowShape as bK, Secrets as bL, type SecretsService as bM, SerializationFailure as bN, type SetShape as bO, type SetValue as bP, type ShutdownRunner as bQ, type SqlFragment as bR, Storage as bS, TABLE_META as bT, type TableDef as bU, type TableHandle as bV, type TableInput as bW, TooManyRequests as bX, type TxColumnExpr as bY, type TxInsertShape as bZ, type TxInsertValue as b_, type PalbasePushSendResponse as ba, type PalbaseQrCodeOptions as bb, type PalbaseQuerySnapshot as bc, type PalbaseRealtimeClient as bd, type PalbaseRegisterDeviceParams as be, type PalbaseRetentionQueryInput as bf, type PalbaseRetentionResult as bg, type PalbaseSession as bh, type PalbaseSetOverrideResult as bi, type PalbaseSetOverridesResult as bj, type PalbaseSignedUrlResponse as bk, type PalbaseSmsClient as bl, type PalbaseSmsSendParams as bm, type PalbaseSmsSendResponse as bn, type PalbaseStorageClient as bo, type PalbaseTransformOptions as bp, type PalbaseUpdateLinkParams as bq, type PalbaseUploadOptions as br, type PalbaseUser as bs, type PalbaseUserDetailResult as bt, type PalbaseUsersQueryInput as bu, type PalbaseUsersResult as bv, type PalbaseVerifyRequestSignatureParams as bw, type PalbaseWhereOperator as bx, type PolicyBinOp as by, PolicyBuilder as bz, type RuntimeServices as c, withRetry as c$, type TxPlan as c0, TxPlanError as c1, type TxPlanHandle as c2, type TxPlanOpResult as c3, type TxPlanRejection as c4, TxRefError as c5, type TxRow as c6, type TxRows as c7, type TxSelectOptions as c8, type TxSetShape as c9, defineSchema as cA, defineTable as cB, enumType as cC, exprCtx as cD, inc as cE, increment as cF, index as cG, installationRef as cH, integer as cI, isPalbaseExtension as cJ, isRetryable as cK, jsonb as cL, makeTypedDB as cM, now as cN, numeric as cO, onShutdown as cP, onStart as cQ, openai as cR, ownedByUser as cS, policy as cT, raw as cU, sqlFragment as cV, text as cW, timestamp as cX, userRef as cY, uuid as cZ, vector as c_, type TxSetValue as ca, type TxTable as cb, type TxTables as cc, type TxWhere as cd, type TxWireExpr as ce, type TxWireGuard as cf, type TxWireOp as cg, type TxWireRef as ch, type TxWireValue as ci, type TypedDB as cj, type TypedTable as ck, type TypedTx as cl, Unauthorized as cm, UniqueViolation as cn, type User as co, type VerifiedDevice as cp, __getRuntime as cq, __resetLifecycleHooks as cr, __runStartHooks as cs, __setRuntime as ct, bigint as cu, boolean as cv, col as cw, dec as cx, decrement as cy, defineMiddleware as cz, __requestALS as d, type PolicyExpr as e, type AnyColumn as f, Auth as g, type AuthConfig as h, Cache as i, type ClientInfo as j, type ColRef as k, ColumnBuilder as l, type ColumnDef as m, type ColumnMap as n, type ColumnType as o, Conflict as p, Database as q, DeadlockDetected as r, Documents as s, type EmbeddingModelRef as t, type EnvSchemas as u, type EnvServiceDatabase as v, type EnvTables as w, type EnvTypedDatabase as x, type EnvTypedTable as y, type ErrorDef as z };

package/dist/{index-BZfmdRmh.d.cts → index-Zi7MptvP.d.cts}

@@ -1,6 +1,6 @@
-import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-ChvoVczS.cjs';
+import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-DtCgaZAg.cjs';
 import { T as Token } from './module-Dl1KFVtc.cjs';
-import { R as RouteMeta } from './registry-B2KfKWv1.cjs';
+import { R as RouteMeta } from './registry-CEYLH-Iz.cjs';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses
@@ -998,7 +998,7 @@ interface RuntimeHooks {
     __requestALS: typeof __requestALS;
 }
 /** The module singletons the engine injects, minus the two it owns itself. */
-type ModuleClients = Partial<Pick<RuntimeServices, "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
+type ModuleClients = Partial<Pick<RuntimeServices, "Auth" | "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
 interface CreateAppOptions {
     /**
      * Vault'tan TEK secret okuma (FR-025): sorgu-anı embedding'in anahtarı

package/dist/{index-BYDUKexK.d.ts → index-b-Q3l7W5.d.ts}

@@ -1,6 +1,6 @@
-import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-BOe82fsK.js';
+import { D as DBClient, a as DBOps, T as TxPlanBody, b as TxPlanResponse, A as AuthSpec, C as CacheClient, c as RuntimeServices, _ as __runWithRuntime, d as __requestALS } from './index-8qy3kIuA.js';
 import { T as Token } from './module-Dl1KFVtc.js';
-import { R as RouteMeta } from './registry-DaqHsOq8.js';
+import { R as RouteMeta } from './registry-BGJ-Al6F.js';
 
 /**
  * engine/config.ts — settings from the environment, and the gate that refuses
@@ -998,7 +998,7 @@ interface RuntimeHooks {
     __requestALS: typeof __requestALS;
 }
 /** The module singletons the engine injects, minus the two it owns itself. */
-type ModuleClients = Partial<Pick<RuntimeServices, "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
+type ModuleClients = Partial<Pick<RuntimeServices, "Auth" | "Documents" | "Storage" | "Notifications" | "Flags" | "Realtime" | "Secrets">>;
 interface CreateAppOptions {
     /**
      * Vault'tan TEK secret okuma (FR-025): sorgu-anı embedding'in anahtarı

package/dist/index.cjs

@@ -21,6 +21,7 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 // src/index.ts
 var src_exports = {};
 __export(src_exports, {
+  Auth: () => Auth,
   BadRequest: () => BadRequest,
   Body: () => Body,
   Cache: () => Cache,
@@ -71,6 +72,7 @@ __export(src_exports, {
   Realtime: () => Realtime,
   Req: () => Req,
   RequestId: () => RequestId,
+  RoleNotDefined: () => RoleNotDefined,
   Room: () => Room,
   Secrets: () => Secrets,
   SerializationFailure: () => SerializationFailure,
@@ -1520,6 +1522,7 @@ var Storage = Object.assign({
 });
 var Cache = makeServiceProxy("Cache");
 var Secrets = makeServiceProxy("Secrets");
+var Auth = makeServiceProxy("Auth");
 var Log = makeServiceProxy("Log");
 var Notifications = makeServiceProxy("Notifications");
 var rawFlags = makeServiceProxy("Flags");
@@ -1647,6 +1650,48 @@ function makeHttpClient(cfg) {
 }
 __name(makeHttpClient, "makeHttpClient");
 
+// src/clients/auth.ts
+var RoleNotDefined = class extends Error {
+  static {
+    __name(this, "RoleNotDefined");
+  }
+  role;
+  constructor(role, message) {
+    super(message ?? `No role named "${role}" is defined for this stack`);
+    this.name = "RoleNotDefined";
+    this.role = role;
+  }
+};
+function refuse(error, role) {
+  if (error.code === "role_not_defined") throw new RoleNotDefined(role, error.message);
+  if (error instanceof PalbaseModuleError) throw error;
+  throw new PalbaseModuleError(error.code ?? "unknown_error", error.message ?? "request failed", 0);
+}
+__name(refuse, "refuse");
+function rolesPath(userId, role) {
+  const base = `/admin/users/${encodeURIComponent(userId)}/roles`;
+  return role === void 0 ? base : `${base}/${encodeURIComponent(role)}`;
+}
+__name(rolesPath, "rolesPath");
+function buildAuthClient(http) {
+  return {
+    async assignRole(userId, role) {
+      const { error } = await http.request("PUT", rolesPath(userId, role));
+      if (error) refuse(error, role);
+    },
+    async revokeRole(userId, role) {
+      const { error } = await http.request("DELETE", rolesPath(userId, role));
+      if (error) refuse(error, role);
+    },
+    async rolesOf(userId) {
+      const { data, error } = await http.request("GET", rolesPath(userId));
+      if (error) refuse(error, "");
+      return data?.roles ?? [];
+    }
+  };
+}
+__name(buildAuthClient, "buildAuthClient");
+
 // src/clients/documents.ts
 var SEGMENT_RE = /^[A-Za-z0-9_-]+$/;
 function validateSegment(segment, label) {
@@ -2631,6 +2676,10 @@ function buildModuleClients(cfg) {
     fetchImpl: cfg.fetchImpl
   });
   return {
+    // The ROLE half of auth only (`clients/auth.ts` says why the rest is not
+    // here). It rides the same service-role transport, which is exactly the
+    // credential the assignment routes demand.
+    Auth: buildAuthClient(http),
     Documents: buildDocumentsClient(http),
     Storage: buildStorageClient(http, cfg.publicOrigin),
     Notifications: buildNotificationsClient(http),
@@ -5280,6 +5329,7 @@ __name(getJobConfig, "getJobConfig");
 var import_zod2 = require("zod");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
+  Auth,
   BadRequest,
   Body,
   Cache,
@@ -5330,6 +5380,7 @@ var import_zod2 = require("zod");
   Realtime,
   Req,
   RequestId,
+  RoleNotDefined,
   Room,
   Secrets,
   SerializationFailure,