@palbase/backend 29.0.0 → 30.0.1

package/dist/index.d.cts

@@ -1,11 +1,11 @@
-import { P as PalbaseResult, e as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-ChvoVczS.cjs';
-export { f as AnyColumn, g as AuthConfig, B as BadRequest, h as Cache, C as CacheClient, i as ClientInfo, j as ColRef, k as ColumnBuilder, l as ColumnDef, m as ColumnMap, n as ColumnType, o as Conflict, D as DBClient, a as DBOps, p as Database, q as DeadlockDetected, r as Documents, E as EXTENSION_DEPENDENCIES, s as EmbeddingModelRef, t as EnvSchemas, u as EnvServiceDatabase, v as EnvTables, w as EnvTypedDatabase, x as EnvTypedTable, y as ErrorDef, z as ErrorMap, F as ErrorThrowers, G as FileContext, I as Flags, J as Forbidden, K as HttpMethod, L as IndexBuilder, M as IndexDef, N as InsertShape, O as LifecycleHook, Q as Log, U as Logger, V as Materialized, W as Middleware, X as MiddlewareContext, Y as MiddlewareHandler, Z as NotFound, $ as Notifications, a0 as OnDeleteAction, a1 as PALBASE_EXTENSIONS, a2 as PBRequest, a3 as PalError, a4 as PalbaseAnalyticsClient, a5 as PalbaseAnalyticsManagementNamespace, a6 as PalbaseAnalyticsProperties, a7 as PalbaseAnalyticsQueryNamespace, a8 as PalbaseAttestAndroidParams, a9 as PalbaseAttestAndroidResult, aa as PalbaseAttestiOSParams, ab as PalbaseAttestiOSResult, ac as PalbaseAuthClient, ad as PalbaseBatchOverrideOperation, ae as PalbaseBatchSetOverridesResult, af as PalbaseBindDeviceParams, ag as PalbaseBucketClient, ah as PalbaseClearAllOverridesResult, ai as PalbaseClearOverrideResult, aj as PalbaseCohortQueryInput, ak as PalbaseCohortResult, al as PalbaseCollectionRef, am as PalbaseCountQueryInput, an as PalbaseCountResult, ao as PalbaseCreateLinkParams, ap as PalbaseDeviceInfo, aq as PalbaseDeviceTokenView, ar as PalbaseDocsClient, as as PalbaseDocumentRef, at as PalbaseDocumentSnapshot, au as PalbaseEmailClient, av as PalbaseEmailSendParams, aw as PalbaseEmailSendResponse, ax as PalbaseEventNamesResult, ay as PalbaseEventsQueryInput, az as PalbaseEventsResult, aA as PalbaseExtension, aB as PalbaseFileObject, aC as PalbaseFlag, aD as PalbaseFlagContext, aE as PalbaseFlagSource, aF as PalbaseFlagValue, aG as PalbaseFlagVariant, aH as PalbaseFlagsClient, aI as PalbaseFlagsServiceClient, aJ as PalbaseFunctionsClient, aK as PalbaseFunnelQueryInput, aL as PalbaseFunnelResult, aM as PalbaseIdentifyTraits, aN as PalbaseInboxClient, aO as PalbaseInboxListOptions, aP as PalbaseInboxListResult, aQ as PalbaseInboxMessage, aR as PalbaseInboxSendParams, aS as PalbaseInboxSendResponse, aT as PalbaseInitialLink, aU as PalbaseInvokeOptions, aV as PalbaseLink, aW as PalbaseLinkAnalytics, aX as PalbaseLinkDetails, aY as PalbaseLinksClient, aZ as PalbaseListLinksOptions, a_ as PalbaseListLinksResult, a$ as PalbaseListOptions, b0 as PalbaseMatchParams, b1 as PalbaseMultiChannelResponse, b2 as PalbaseNotificationsClient, b3 as PalbaseOverviewResult, b4 as PalbasePreferences, b5 as PalbasePreferencesClient, b6 as PalbasePushClient, b7 as PalbasePushSendParams, b8 as PalbasePushSendResponse, b9 as PalbaseQrCodeOptions, ba as PalbaseQuerySnapshot, bb as PalbaseRealtimeClient, bc as PalbaseRegisterDeviceParams, bd as PalbaseRetentionQueryInput, be as PalbaseRetentionResult, bf as PalbaseSession, bg as PalbaseSetOverrideResult, bh as PalbaseSetOverridesResult, bi as PalbaseSignedUrlResponse, bj as PalbaseSmsClient, bk as PalbaseSmsSendParams, bl as PalbaseSmsSendResponse, bm as PalbaseStorageClient, bn as PalbaseTransformOptions, bo as PalbaseUpdateLinkParams, bp as PalbaseUploadOptions, bq as PalbaseUser, br as PalbaseUserDetailResult, bs as PalbaseUsersQueryInput, bt as PalbaseUsersResult, bu as PalbaseVerifyRequestSignatureParams, bv as PalbaseWhereOperator, bw as PolicyBinOp, bx as PolicyBuilder, by as PolicyCommand, bz as PolicyDef, bA as PolicyExprCtx, bB as PolicyExprRef, bC as PolicyMode, bD as PolicyOperand, R as RateLimitConfig, bE as RawConstraintDef, bF as Realtime, bG as Ref, bH as RequestStore, bI as RowShape, c as RuntimeServices, bJ as Secrets, bK as SecretsService, bL as SerializationFailure, bM as SetShape, bN as SetValue, bO as ShutdownRunner, bP as SqlFragment, bQ as Storage, bR as TABLE_META, bS as TableDef, bT as TableHandle, bU as TableInput, bV as TooManyRequests, bW as TxColumnExpr, bX as TxInsertShape, bY as TxInsertValue, bZ as TxNow, b_ as TxPlan, T as TxPlanBody, b$ as TxPlanError, c0 as TxPlanHandle, c1 as TxPlanOpResult, c2 as TxPlanRejection, b as TxPlanResponse, c3 as TxRefError, c4 as TxRow, c5 as TxRows, c6 as TxSelectOptions, c7 as TxSetShape, c8 as TxSetValue, c9 as TxTable, ca as TxTables, cb as TxWhere, cc as TxWireExpr, cd as TxWireGuard, ce as TxWireOp, cf as TxWireRef, cg as TxWireValue, ch as TypedDB, ci as TypedTable, cj as TypedTx, ck as Unauthorized, cl as UniqueViolation, cm as UserT, cn as VerifiedDevice, co as __getRuntime, d as __requestALS, cp as __resetLifecycleHooks, cq as __runStartHooks, _ as __runWithRuntime, cr as __setRuntime, cs as bigint, ct as boolean, cu as col, cv as dec, cw as decrement, cx as defineMiddleware, cy as defineSchema, cz as defineTable, cA as enumType, cB as exprCtx, cC as inc, cD as increment, cE as index, cF as installationRef, cG as integer, cH as isPalbaseExtension, cI as isRetryable, cJ as jsonb, cK as makeTypedDB, cL as now, cM as numeric, cN as onShutdown, cO as onStart, cP as openai, cQ as ownedByUser, cR as policy, cS as raw, cT as sqlFragment, cU as text, cV as timestamp, cW as userRef, cX as uuid, cY as vector, cZ as withRetry } from './index-ChvoVczS.cjs';
-import { M as ModuleClients, C as Container } from './index-BZfmdRmh.cjs';
-export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-BZfmdRmh.cjs';
+import { P as PalbaseResult, e as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-DtCgaZAg.cjs';
+export { f as AnyColumn, g as Auth, h as AuthConfig, B as BadRequest, i as Cache, C as CacheClient, j as ClientInfo, k as ColRef, l as ColumnBuilder, m as ColumnDef, n as ColumnMap, o as ColumnType, p as Conflict, D as DBClient, a as DBOps, q as Database, r as DeadlockDetected, s as Documents, E as EXTENSION_DEPENDENCIES, t as EmbeddingModelRef, u as EnvSchemas, v as EnvServiceDatabase, w as EnvTables, x as EnvTypedDatabase, y as EnvTypedTable, z as ErrorDef, F as ErrorMap, G as ErrorThrowers, I as FileContext, J as Flags, K as Forbidden, L as HttpMethod, M as IndexBuilder, N as IndexDef, O as InsertShape, Q as LifecycleHook, U as Log, V as Logger, W as Materialized, X as Middleware, Y as MiddlewareContext, Z as MiddlewareHandler, $ as NotFound, a0 as Notifications, a1 as OnDeleteAction, a2 as PALBASE_EXTENSIONS, a3 as PBRequest, a4 as PalError, a5 as PalbaseAnalyticsClient, a6 as PalbaseAnalyticsManagementNamespace, a7 as PalbaseAnalyticsProperties, a8 as PalbaseAnalyticsQueryNamespace, a9 as PalbaseAttestAndroidParams, aa as PalbaseAttestAndroidResult, ab as PalbaseAttestiOSParams, ac as PalbaseAttestiOSResult, ad as PalbaseAuthAdminClient, ae as PalbaseAuthClient, af as PalbaseBatchOverrideOperation, ag as PalbaseBatchSetOverridesResult, ah as PalbaseBindDeviceParams, ai as PalbaseBucketClient, aj as PalbaseClearAllOverridesResult, ak as PalbaseClearOverrideResult, al as PalbaseCohortQueryInput, am as PalbaseCohortResult, an as PalbaseCollectionRef, ao as PalbaseCountQueryInput, ap as PalbaseCountResult, aq as PalbaseCreateLinkParams, ar as PalbaseDeviceInfo, as as PalbaseDeviceTokenView, at as PalbaseDocsClient, au as PalbaseDocumentRef, av as PalbaseDocumentSnapshot, aw as PalbaseEmailClient, ax as PalbaseEmailSendParams, ay as PalbaseEmailSendResponse, az as PalbaseEventNamesResult, aA as PalbaseEventsQueryInput, aB as PalbaseEventsResult, aC as PalbaseExtension, aD as PalbaseFileObject, aE as PalbaseFlag, aF as PalbaseFlagContext, aG as PalbaseFlagSource, aH as PalbaseFlagValue, aI as PalbaseFlagVariant, aJ as PalbaseFlagsClient, aK as PalbaseFlagsServiceClient, aL as PalbaseFunctionsClient, aM as PalbaseFunnelQueryInput, aN as PalbaseFunnelResult, aO as PalbaseIdentifyTraits, aP as PalbaseInboxClient, aQ as PalbaseInboxListOptions, aR as PalbaseInboxListResult, aS as PalbaseInboxMessage, aT as PalbaseInboxSendParams, aU as PalbaseInboxSendResponse, aV as PalbaseInitialLink, aW as PalbaseInvokeOptions, aX as PalbaseLink, aY as PalbaseLinkAnalytics, aZ as PalbaseLinkDetails, a_ as PalbaseLinksClient, a$ as PalbaseListLinksOptions, b0 as PalbaseListLinksResult, b1 as PalbaseListOptions, b2 as PalbaseMatchParams, b3 as PalbaseMultiChannelResponse, b4 as PalbaseNotificationsClient, b5 as PalbaseOverviewResult, b6 as PalbasePreferences, b7 as PalbasePreferencesClient, b8 as PalbasePushClient, b9 as PalbasePushSendParams, ba as PalbasePushSendResponse, bb as PalbaseQrCodeOptions, bc as PalbaseQuerySnapshot, bd as PalbaseRealtimeClient, be as PalbaseRegisterDeviceParams, bf as PalbaseRetentionQueryInput, bg as PalbaseRetentionResult, bh as PalbaseSession, bi as PalbaseSetOverrideResult, bj as PalbaseSetOverridesResult, bk as PalbaseSignedUrlResponse, bl as PalbaseSmsClient, bm as PalbaseSmsSendParams, bn as PalbaseSmsSendResponse, bo as PalbaseStorageClient, bp as PalbaseTransformOptions, bq as PalbaseUpdateLinkParams, br as PalbaseUploadOptions, bs as PalbaseUser, bt as PalbaseUserDetailResult, bu as PalbaseUsersQueryInput, bv as PalbaseUsersResult, bw as PalbaseVerifyRequestSignatureParams, bx as PalbaseWhereOperator, by as PolicyBinOp, bz as PolicyBuilder, bA as PolicyCommand, bB as PolicyDef, bC as PolicyExprCtx, bD as PolicyExprRef, bE as PolicyMode, bF as PolicyOperand, R as RateLimitConfig, bG as RawConstraintDef, bH as Realtime, bI as Ref, bJ as RequestStore, bK as RowShape, c as RuntimeServices, bL as Secrets, bM as SecretsService, bN as SerializationFailure, bO as SetShape, bP as SetValue, bQ as ShutdownRunner, bR as SqlFragment, bS as Storage, bT as TABLE_META, bU as TableDef, bV as TableHandle, bW as TableInput, bX as TooManyRequests, bY as TxColumnExpr, bZ as TxInsertShape, b_ as TxInsertValue, b$ as TxNow, c0 as TxPlan, T as TxPlanBody, c1 as TxPlanError, c2 as TxPlanHandle, c3 as TxPlanOpResult, c4 as TxPlanRejection, b as TxPlanResponse, c5 as TxRefError, c6 as TxRow, c7 as TxRows, c8 as TxSelectOptions, c9 as TxSetShape, ca as TxSetValue, cb as TxTable, cc as TxTables, cd as TxWhere, ce as TxWireExpr, cf as TxWireGuard, cg as TxWireOp, ch as TxWireRef, ci as TxWireValue, cj as TypedDB, ck as TypedTable, cl as TypedTx, cm as Unauthorized, cn as UniqueViolation, co as UserT, cp as VerifiedDevice, cq as __getRuntime, d as __requestALS, cr as __resetLifecycleHooks, cs as __runStartHooks, _ as __runWithRuntime, ct as __setRuntime, cu as bigint, cv as boolean, cw as col, cx as dec, cy as decrement, cz as defineMiddleware, cA as defineSchema, cB as defineTable, cC as enumType, cD as exprCtx, cE as inc, cF as increment, cG as index, cH as installationRef, cI as integer, cJ as isPalbaseExtension, cK as isRetryable, cL as jsonb, cM as makeTypedDB, cN as now, cO as numeric, cP as onShutdown, cQ as onStart, cR as openai, cS as ownedByUser, cT as policy, cU as raw, cV as sqlFragment, cW as text, cX as timestamp, cY as userRef, cZ as uuid, c_ as vector, c$ as withRetry } from './index-DtCgaZAg.cjs';
+import { M as ModuleClients, C as Container } from './index-Zi7MptvP.cjs';
+export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-Zi7MptvP.cjs';
 export { TableTypes, Tables } from './db/env.cjs';
 export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.cjs';
-import { a as RouteOptions } from './registry-B2KfKWv1.cjs';
-export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-B2KfKWv1.cjs';
+import { a as RouteOptions } from './registry-CEYLH-Iz.cjs';
+export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-CEYLH-Iz.cjs';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import { T as Token } from './module-Dl1KFVtc.cjs';
@@ -20,10 +20,12 @@ import 'node:async_hooks';
  *
  * WHAT IS NOT BUILT HERE, and why each one is absent rather than forgotten:
  *
- *   - `auth`, `functions`, `analytics`, `links` — the SDK exports no singleton
- *     for any of them (`runtime.ts` exports ten, and these four are not among
- *     them), so no handler could reach them. They were constructed on every
- *     boot and thrown away.
+ *   - `functions`, `analytics`, `links` — the SDK exports no singleton for any
+ *     of them, so no handler could reach them. They were constructed on every
+ *     boot and thrown away. `auth` was in this list until roles arrived: the
+ *     sign-in half still belongs to the client SDK, but the ASSIGNMENT half is
+ *     an operator verb a handler has to be able to call, so `Auth` is built
+ *     above — as `PalbaseAuthAdminClient`, three methods and no more.
  *   - `Purchases` — its client talked to palstore, and v2 contains no palstore
  *     at all. The surface was unbacked before it was untyped. Dropped from v2
  *     by the user's decision on 2026-08-15, with the SDK's `src/purchases/`
@@ -128,6 +130,44 @@ declare class PalbaseModuleError extends Error {
 }
 declare function makeHttpClient(cfg: TransportConfig): ModuleTransport;
 
+/**
+ * auth.ts — the role-assignment half of auth, as a backend handler reaches it.
+ *
+ * WHAT THIS IS NOT. It is not the client SDK's `auth` (sign-up, sign-in, MFA,
+ * device attestation): those are a person acting on their OWN account, they run
+ * in the app, and a server has no business holding them. This is the operator
+ * verb — "make this user an agent" — and it exists because the product itself is
+ * often where the promotion happens: a supervisor taps a button in the tenant's
+ * own app, and the tenant's handler has to be able to write the assignment.
+ *
+ * THE CREDENTIAL IS THE POINT. `/admin/users/{uid}/roles/{role}` answers 403 to
+ * anon and to `authenticated` alike (FR-013), so these calls ride the transport
+ * built with the SERVICE-ROLE key. A backend is the only place that key exists;
+ * putting this surface anywhere a client SDK could reach it would let an end
+ * user grant themselves the permission the rest of the feature is about.
+ *
+ * IT THROWS, and the rest of this package envelopes. That is a deliberate split
+ * and it comes from the SHAPE OF THE ANSWER: `assignRole` returns nothing, so a
+ * failure it did not throw for would be indistinguishable from a write that
+ * happened. The named `RoleNotDefined` is the one refusal a caller can act on —
+ * the role names live in git, so a miss is a typo, not a runtime condition —
+ * and every other refusal arrives as the transport's own `PalbaseModuleError`
+ * with the platform's code on it.
+ */
+
+/**
+ * The named refusal: this stack declares no role by that name.
+ *
+ * A role's DEFINITION is committed (`palbase roles`, lowered into the generated
+ * client as an enum), so a name that misses is a typo in code rather than a
+ * state a retry could fix. It carries the name it was asked for, because the
+ * message alone would make a handler parse text to log which one failed.
+ */
+declare class RoleNotDefined extends Error {
+    readonly role: string;
+    constructor(role: string, message?: string);
+}
+
 /** One column, flattened. Mirrors Go's `schema.ColumnJSON`. */
 interface ColumnJSON {
     type: string;
@@ -1051,4 +1091,4 @@ declare function getJobManifest(ctor: object): JobManifest;
  */
 declare function getJobConfig(ctor: object, container: Container): ResolvedJob;
 
-export { type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Container, Controller, type ControllerOptions, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, type FileDeletedEvent, type FileUploadedEvent, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Injectable, Job, type JobMeta, type JobOptions, type ModuleClientsConfig, type ModuleTransport, On, OnAuthorize, OnEmpty, OnFirst, OnJoin, OnLeave, OnMessage, OptionalUser, PalbaseModuleError, PalbaseResult, Param, Patch, PolicyExpr, type PolicyJSON, Post, Put, Query, QueryParams, type RegisteredError, Req, RequestId, type RequestOptions, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Room, type RoomOptions, RouteOptions, SchemaDef, type SchemaJSON, type SignatureSpec, type StackNames, type TableJSON, Token, TraceId, type TransportConfig, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __claimInjectables, __resetDefaultAuth, __resetRegisteredControllers, assertZeroArgConstructor, buildModuleClients, controllersOf, defineChannels, defineDefaultAuth, defineError, getErrorRegistry, getHookConfig, getHookManifest, getJobConfig, getJobManifest, getRegisteredControllers, getWebhookConfig, getWebhookManifest, hooksOf, jobsOf, makeEnvDts, makeHttpClient, makeStackDts, ownerOnly, publicChannel, resolveEffectiveAuth, roomsOf, toSchemaJSON, webhooksOf };
+export { type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Container, Controller, type ControllerOptions, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, type FileDeletedEvent, type FileUploadedEvent, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Injectable, Job, type JobMeta, type JobOptions, type ModuleClientsConfig, type ModuleTransport, On, OnAuthorize, OnEmpty, OnFirst, OnJoin, OnLeave, OnMessage, OptionalUser, PalbaseModuleError, PalbaseResult, Param, Patch, PolicyExpr, type PolicyJSON, Post, Put, Query, QueryParams, type RegisteredError, Req, RequestId, type RequestOptions, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, RoleNotDefined, Room, type RoomOptions, RouteOptions, SchemaDef, type SchemaJSON, type SignatureSpec, type StackNames, type TableJSON, Token, TraceId, type TransportConfig, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __claimInjectables, __resetDefaultAuth, __resetRegisteredControllers, assertZeroArgConstructor, buildModuleClients, controllersOf, defineChannels, defineDefaultAuth, defineError, getErrorRegistry, getHookConfig, getHookManifest, getJobConfig, getJobManifest, getRegisteredControllers, getWebhookConfig, getWebhookManifest, hooksOf, jobsOf, makeEnvDts, makeHttpClient, makeStackDts, ownerOnly, publicChannel, resolveEffectiveAuth, roomsOf, toSchemaJSON, webhooksOf };

package/dist/index.d.ts

@@ -1,11 +1,11 @@
-import { P as PalbaseResult, e as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-BOe82fsK.js';
-export { f as AnyColumn, g as AuthConfig, B as BadRequest, h as Cache, C as CacheClient, i as ClientInfo, j as ColRef, k as ColumnBuilder, l as ColumnDef, m as ColumnMap, n as ColumnType, o as Conflict, D as DBClient, a as DBOps, p as Database, q as DeadlockDetected, r as Documents, E as EXTENSION_DEPENDENCIES, s as EmbeddingModelRef, t as EnvSchemas, u as EnvServiceDatabase, v as EnvTables, w as EnvTypedDatabase, x as EnvTypedTable, y as ErrorDef, z as ErrorMap, F as ErrorThrowers, G as FileContext, I as Flags, J as Forbidden, K as HttpMethod, L as IndexBuilder, M as IndexDef, N as InsertShape, O as LifecycleHook, Q as Log, U as Logger, V as Materialized, W as Middleware, X as MiddlewareContext, Y as MiddlewareHandler, Z as NotFound, $ as Notifications, a0 as OnDeleteAction, a1 as PALBASE_EXTENSIONS, a2 as PBRequest, a3 as PalError, a4 as PalbaseAnalyticsClient, a5 as PalbaseAnalyticsManagementNamespace, a6 as PalbaseAnalyticsProperties, a7 as PalbaseAnalyticsQueryNamespace, a8 as PalbaseAttestAndroidParams, a9 as PalbaseAttestAndroidResult, aa as PalbaseAttestiOSParams, ab as PalbaseAttestiOSResult, ac as PalbaseAuthClient, ad as PalbaseBatchOverrideOperation, ae as PalbaseBatchSetOverridesResult, af as PalbaseBindDeviceParams, ag as PalbaseBucketClient, ah as PalbaseClearAllOverridesResult, ai as PalbaseClearOverrideResult, aj as PalbaseCohortQueryInput, ak as PalbaseCohortResult, al as PalbaseCollectionRef, am as PalbaseCountQueryInput, an as PalbaseCountResult, ao as PalbaseCreateLinkParams, ap as PalbaseDeviceInfo, aq as PalbaseDeviceTokenView, ar as PalbaseDocsClient, as as PalbaseDocumentRef, at as PalbaseDocumentSnapshot, au as PalbaseEmailClient, av as PalbaseEmailSendParams, aw as PalbaseEmailSendResponse, ax as PalbaseEventNamesResult, ay as PalbaseEventsQueryInput, az as PalbaseEventsResult, aA as PalbaseExtension, aB as PalbaseFileObject, aC as PalbaseFlag, aD as PalbaseFlagContext, aE as PalbaseFlagSource, aF as PalbaseFlagValue, aG as PalbaseFlagVariant, aH as PalbaseFlagsClient, aI as PalbaseFlagsServiceClient, aJ as PalbaseFunctionsClient, aK as PalbaseFunnelQueryInput, aL as PalbaseFunnelResult, aM as PalbaseIdentifyTraits, aN as PalbaseInboxClient, aO as PalbaseInboxListOptions, aP as PalbaseInboxListResult, aQ as PalbaseInboxMessage, aR as PalbaseInboxSendParams, aS as PalbaseInboxSendResponse, aT as PalbaseInitialLink, aU as PalbaseInvokeOptions, aV as PalbaseLink, aW as PalbaseLinkAnalytics, aX as PalbaseLinkDetails, aY as PalbaseLinksClient, aZ as PalbaseListLinksOptions, a_ as PalbaseListLinksResult, a$ as PalbaseListOptions, b0 as PalbaseMatchParams, b1 as PalbaseMultiChannelResponse, b2 as PalbaseNotificationsClient, b3 as PalbaseOverviewResult, b4 as PalbasePreferences, b5 as PalbasePreferencesClient, b6 as PalbasePushClient, b7 as PalbasePushSendParams, b8 as PalbasePushSendResponse, b9 as PalbaseQrCodeOptions, ba as PalbaseQuerySnapshot, bb as PalbaseRealtimeClient, bc as PalbaseRegisterDeviceParams, bd as PalbaseRetentionQueryInput, be as PalbaseRetentionResult, bf as PalbaseSession, bg as PalbaseSetOverrideResult, bh as PalbaseSetOverridesResult, bi as PalbaseSignedUrlResponse, bj as PalbaseSmsClient, bk as PalbaseSmsSendParams, bl as PalbaseSmsSendResponse, bm as PalbaseStorageClient, bn as PalbaseTransformOptions, bo as PalbaseUpdateLinkParams, bp as PalbaseUploadOptions, bq as PalbaseUser, br as PalbaseUserDetailResult, bs as PalbaseUsersQueryInput, bt as PalbaseUsersResult, bu as PalbaseVerifyRequestSignatureParams, bv as PalbaseWhereOperator, bw as PolicyBinOp, bx as PolicyBuilder, by as PolicyCommand, bz as PolicyDef, bA as PolicyExprCtx, bB as PolicyExprRef, bC as PolicyMode, bD as PolicyOperand, R as RateLimitConfig, bE as RawConstraintDef, bF as Realtime, bG as Ref, bH as RequestStore, bI as RowShape, c as RuntimeServices, bJ as Secrets, bK as SecretsService, bL as SerializationFailure, bM as SetShape, bN as SetValue, bO as ShutdownRunner, bP as SqlFragment, bQ as Storage, bR as TABLE_META, bS as TableDef, bT as TableHandle, bU as TableInput, bV as TooManyRequests, bW as TxColumnExpr, bX as TxInsertShape, bY as TxInsertValue, bZ as TxNow, b_ as TxPlan, T as TxPlanBody, b$ as TxPlanError, c0 as TxPlanHandle, c1 as TxPlanOpResult, c2 as TxPlanRejection, b as TxPlanResponse, c3 as TxRefError, c4 as TxRow, c5 as TxRows, c6 as TxSelectOptions, c7 as TxSetShape, c8 as TxSetValue, c9 as TxTable, ca as TxTables, cb as TxWhere, cc as TxWireExpr, cd as TxWireGuard, ce as TxWireOp, cf as TxWireRef, cg as TxWireValue, ch as TypedDB, ci as TypedTable, cj as TypedTx, ck as Unauthorized, cl as UniqueViolation, cm as UserT, cn as VerifiedDevice, co as __getRuntime, d as __requestALS, cp as __resetLifecycleHooks, cq as __runStartHooks, _ as __runWithRuntime, cr as __setRuntime, cs as bigint, ct as boolean, cu as col, cv as dec, cw as decrement, cx as defineMiddleware, cy as defineSchema, cz as defineTable, cA as enumType, cB as exprCtx, cC as inc, cD as increment, cE as index, cF as installationRef, cG as integer, cH as isPalbaseExtension, cI as isRetryable, cJ as jsonb, cK as makeTypedDB, cL as now, cM as numeric, cN as onShutdown, cO as onStart, cP as openai, cQ as ownedByUser, cR as policy, cS as raw, cT as sqlFragment, cU as text, cV as timestamp, cW as userRef, cX as uuid, cY as vector, cZ as withRetry } from './index-BOe82fsK.js';
-import { M as ModuleClients, C as Container } from './index-BYDUKexK.js';
-export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-BYDUKexK.js';
+import { P as PalbaseResult, e as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-8qy3kIuA.js';
+export { f as AnyColumn, g as Auth, h as AuthConfig, B as BadRequest, i as Cache, C as CacheClient, j as ClientInfo, k as ColRef, l as ColumnBuilder, m as ColumnDef, n as ColumnMap, o as ColumnType, p as Conflict, D as DBClient, a as DBOps, q as Database, r as DeadlockDetected, s as Documents, E as EXTENSION_DEPENDENCIES, t as EmbeddingModelRef, u as EnvSchemas, v as EnvServiceDatabase, w as EnvTables, x as EnvTypedDatabase, y as EnvTypedTable, z as ErrorDef, F as ErrorMap, G as ErrorThrowers, I as FileContext, J as Flags, K as Forbidden, L as HttpMethod, M as IndexBuilder, N as IndexDef, O as InsertShape, Q as LifecycleHook, U as Log, V as Logger, W as Materialized, X as Middleware, Y as MiddlewareContext, Z as MiddlewareHandler, $ as NotFound, a0 as Notifications, a1 as OnDeleteAction, a2 as PALBASE_EXTENSIONS, a3 as PBRequest, a4 as PalError, a5 as PalbaseAnalyticsClient, a6 as PalbaseAnalyticsManagementNamespace, a7 as PalbaseAnalyticsProperties, a8 as PalbaseAnalyticsQueryNamespace, a9 as PalbaseAttestAndroidParams, aa as PalbaseAttestAndroidResult, ab as PalbaseAttestiOSParams, ac as PalbaseAttestiOSResult, ad as PalbaseAuthAdminClient, ae as PalbaseAuthClient, af as PalbaseBatchOverrideOperation, ag as PalbaseBatchSetOverridesResult, ah as PalbaseBindDeviceParams, ai as PalbaseBucketClient, aj as PalbaseClearAllOverridesResult, ak as PalbaseClearOverrideResult, al as PalbaseCohortQueryInput, am as PalbaseCohortResult, an as PalbaseCollectionRef, ao as PalbaseCountQueryInput, ap as PalbaseCountResult, aq as PalbaseCreateLinkParams, ar as PalbaseDeviceInfo, as as PalbaseDeviceTokenView, at as PalbaseDocsClient, au as PalbaseDocumentRef, av as PalbaseDocumentSnapshot, aw as PalbaseEmailClient, ax as PalbaseEmailSendParams, ay as PalbaseEmailSendResponse, az as PalbaseEventNamesResult, aA as PalbaseEventsQueryInput, aB as PalbaseEventsResult, aC as PalbaseExtension, aD as PalbaseFileObject, aE as PalbaseFlag, aF as PalbaseFlagContext, aG as PalbaseFlagSource, aH as PalbaseFlagValue, aI as PalbaseFlagVariant, aJ as PalbaseFlagsClient, aK as PalbaseFlagsServiceClient, aL as PalbaseFunctionsClient, aM as PalbaseFunnelQueryInput, aN as PalbaseFunnelResult, aO as PalbaseIdentifyTraits, aP as PalbaseInboxClient, aQ as PalbaseInboxListOptions, aR as PalbaseInboxListResult, aS as PalbaseInboxMessage, aT as PalbaseInboxSendParams, aU as PalbaseInboxSendResponse, aV as PalbaseInitialLink, aW as PalbaseInvokeOptions, aX as PalbaseLink, aY as PalbaseLinkAnalytics, aZ as PalbaseLinkDetails, a_ as PalbaseLinksClient, a$ as PalbaseListLinksOptions, b0 as PalbaseListLinksResult, b1 as PalbaseListOptions, b2 as PalbaseMatchParams, b3 as PalbaseMultiChannelResponse, b4 as PalbaseNotificationsClient, b5 as PalbaseOverviewResult, b6 as PalbasePreferences, b7 as PalbasePreferencesClient, b8 as PalbasePushClient, b9 as PalbasePushSendParams, ba as PalbasePushSendResponse, bb as PalbaseQrCodeOptions, bc as PalbaseQuerySnapshot, bd as PalbaseRealtimeClient, be as PalbaseRegisterDeviceParams, bf as PalbaseRetentionQueryInput, bg as PalbaseRetentionResult, bh as PalbaseSession, bi as PalbaseSetOverrideResult, bj as PalbaseSetOverridesResult, bk as PalbaseSignedUrlResponse, bl as PalbaseSmsClient, bm as PalbaseSmsSendParams, bn as PalbaseSmsSendResponse, bo as PalbaseStorageClient, bp as PalbaseTransformOptions, bq as PalbaseUpdateLinkParams, br as PalbaseUploadOptions, bs as PalbaseUser, bt as PalbaseUserDetailResult, bu as PalbaseUsersQueryInput, bv as PalbaseUsersResult, bw as PalbaseVerifyRequestSignatureParams, bx as PalbaseWhereOperator, by as PolicyBinOp, bz as PolicyBuilder, bA as PolicyCommand, bB as PolicyDef, bC as PolicyExprCtx, bD as PolicyExprRef, bE as PolicyMode, bF as PolicyOperand, R as RateLimitConfig, bG as RawConstraintDef, bH as Realtime, bI as Ref, bJ as RequestStore, bK as RowShape, c as RuntimeServices, bL as Secrets, bM as SecretsService, bN as SerializationFailure, bO as SetShape, bP as SetValue, bQ as ShutdownRunner, bR as SqlFragment, bS as Storage, bT as TABLE_META, bU as TableDef, bV as TableHandle, bW as TableInput, bX as TooManyRequests, bY as TxColumnExpr, bZ as TxInsertShape, b_ as TxInsertValue, b$ as TxNow, c0 as TxPlan, T as TxPlanBody, c1 as TxPlanError, c2 as TxPlanHandle, c3 as TxPlanOpResult, c4 as TxPlanRejection, b as TxPlanResponse, c5 as TxRefError, c6 as TxRow, c7 as TxRows, c8 as TxSelectOptions, c9 as TxSetShape, ca as TxSetValue, cb as TxTable, cc as TxTables, cd as TxWhere, ce as TxWireExpr, cf as TxWireGuard, cg as TxWireOp, ch as TxWireRef, ci as TxWireValue, cj as TypedDB, ck as TypedTable, cl as TypedTx, cm as Unauthorized, cn as UniqueViolation, co as UserT, cp as VerifiedDevice, cq as __getRuntime, d as __requestALS, cr as __resetLifecycleHooks, cs as __runStartHooks, _ as __runWithRuntime, ct as __setRuntime, cu as bigint, cv as boolean, cw as col, cx as dec, cy as decrement, cz as defineMiddleware, cA as defineSchema, cB as defineTable, cC as enumType, cD as exprCtx, cE as inc, cF as increment, cG as index, cH as installationRef, cI as integer, cJ as isPalbaseExtension, cK as isRetryable, cL as jsonb, cM as makeTypedDB, cN as now, cO as numeric, cP as onShutdown, cQ as onStart, cR as openai, cS as ownedByUser, cT as policy, cU as raw, cV as sqlFragment, cW as text, cX as timestamp, cY as userRef, cZ as uuid, c_ as vector, c$ as withRetry } from './index-8qy3kIuA.js';
+import { M as ModuleClients, C as Container } from './index-b-Q3l7W5.js';
+export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-b-Q3l7W5.js';
 export { TableTypes, Tables } from './db/env.js';
 export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.js';
-import { a as RouteOptions } from './registry-DaqHsOq8.js';
-export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-DaqHsOq8.js';
+import { a as RouteOptions } from './registry-BGJ-Al6F.js';
+export { H as HttpMethodUpper, b as ParamKind, P as ParamMeta, R as RouteMeta, c as Signal, d as Sse, S as SseConfig, e as SseOut, f as SseWriter, T as ThrowDescriptor, g as Upload, U as UploadConfig, h as UploadedObject, i as getRoutes, r as recordThrows } from './registry-BGJ-Al6F.js';
 import { ZodTypeAny, z } from 'zod';
 export { z } from 'zod';
 import { T as Token } from './module-Dl1KFVtc.js';
@@ -20,10 +20,12 @@ import 'node:async_hooks';
  *
  * WHAT IS NOT BUILT HERE, and why each one is absent rather than forgotten:
  *
- *   - `auth`, `functions`, `analytics`, `links` — the SDK exports no singleton
- *     for any of them (`runtime.ts` exports ten, and these four are not among
- *     them), so no handler could reach them. They were constructed on every
- *     boot and thrown away.
+ *   - `functions`, `analytics`, `links` — the SDK exports no singleton for any
+ *     of them, so no handler could reach them. They were constructed on every
+ *     boot and thrown away. `auth` was in this list until roles arrived: the
+ *     sign-in half still belongs to the client SDK, but the ASSIGNMENT half is
+ *     an operator verb a handler has to be able to call, so `Auth` is built
+ *     above — as `PalbaseAuthAdminClient`, three methods and no more.
  *   - `Purchases` — its client talked to palstore, and v2 contains no palstore
  *     at all. The surface was unbacked before it was untyped. Dropped from v2
  *     by the user's decision on 2026-08-15, with the SDK's `src/purchases/`
@@ -128,6 +130,44 @@ declare class PalbaseModuleError extends Error {
 }
 declare function makeHttpClient(cfg: TransportConfig): ModuleTransport;
 
+/**
+ * auth.ts — the role-assignment half of auth, as a backend handler reaches it.
+ *
+ * WHAT THIS IS NOT. It is not the client SDK's `auth` (sign-up, sign-in, MFA,
+ * device attestation): those are a person acting on their OWN account, they run
+ * in the app, and a server has no business holding them. This is the operator
+ * verb — "make this user an agent" — and it exists because the product itself is
+ * often where the promotion happens: a supervisor taps a button in the tenant's
+ * own app, and the tenant's handler has to be able to write the assignment.
+ *
+ * THE CREDENTIAL IS THE POINT. `/admin/users/{uid}/roles/{role}` answers 403 to
+ * anon and to `authenticated` alike (FR-013), so these calls ride the transport
+ * built with the SERVICE-ROLE key. A backend is the only place that key exists;
+ * putting this surface anywhere a client SDK could reach it would let an end
+ * user grant themselves the permission the rest of the feature is about.
+ *
+ * IT THROWS, and the rest of this package envelopes. That is a deliberate split
+ * and it comes from the SHAPE OF THE ANSWER: `assignRole` returns nothing, so a
+ * failure it did not throw for would be indistinguishable from a write that
+ * happened. The named `RoleNotDefined` is the one refusal a caller can act on —
+ * the role names live in git, so a miss is a typo, not a runtime condition —
+ * and every other refusal arrives as the transport's own `PalbaseModuleError`
+ * with the platform's code on it.
+ */
+
+/**
+ * The named refusal: this stack declares no role by that name.
+ *
+ * A role's DEFINITION is committed (`palbase roles`, lowered into the generated
+ * client as an enum), so a name that misses is a typo in code rather than a
+ * state a retry could fix. It carries the name it was asked for, because the
+ * message alone would make a handler parse text to log which one failed.
+ */
+declare class RoleNotDefined extends Error {
+    readonly role: string;
+    constructor(role: string, message?: string);
+}
+
 /** One column, flattened. Mirrors Go's `schema.ColumnJSON`. */
 interface ColumnJSON {
     type: string;
@@ -1051,4 +1091,4 @@ declare function getJobManifest(ctor: object): JobManifest;
  */
 declare function getJobConfig(ctor: object, container: Container): ResolvedJob;
 
-export { type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Container, Controller, type ControllerOptions, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, type FileDeletedEvent, type FileUploadedEvent, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Injectable, Job, type JobMeta, type JobOptions, type ModuleClientsConfig, type ModuleTransport, On, OnAuthorize, OnEmpty, OnFirst, OnJoin, OnLeave, OnMessage, OptionalUser, PalbaseModuleError, PalbaseResult, Param, Patch, PolicyExpr, type PolicyJSON, Post, Put, Query, QueryParams, type RegisteredError, Req, RequestId, type RequestOptions, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, Room, type RoomOptions, RouteOptions, SchemaDef, type SchemaJSON, type SignatureSpec, type StackNames, type TableJSON, Token, TraceId, type TransportConfig, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __claimInjectables, __resetDefaultAuth, __resetRegisteredControllers, assertZeroArgConstructor, buildModuleClients, controllersOf, defineChannels, defineDefaultAuth, defineError, getErrorRegistry, getHookConfig, getHookManifest, getJobConfig, getJobManifest, getRegisteredControllers, getWebhookConfig, getWebhookManifest, hooksOf, jobsOf, makeEnvDts, makeHttpClient, makeStackDts, ownerOnly, publicChannel, resolveEffectiveAuth, roomsOf, toSchemaJSON, webhooksOf };
+export { type AuthHookEvent, Body, type ChannelAuthorizeCtx, type ChannelEntry, type ChannelGrant, type ChannelsDef, type ChannelsInput, Client, type ColumnJSON, Container, Controller, type ControllerOptions, type DefinedError, type DefinedErrorWithData, Delete, Deny, type DocumentHookEvent, type FileDeletedEvent, type FileUploadedEvent, Get, Headers, Hook, type HookFn, type HookMeta, HttpError, Injectable, Job, type JobMeta, type JobOptions, type ModuleClientsConfig, type ModuleTransport, On, OnAuthorize, OnEmpty, OnFirst, OnJoin, OnLeave, OnMessage, OptionalUser, PalbaseModuleError, PalbaseResult, Param, Patch, PolicyExpr, type PolicyJSON, Post, Put, Query, QueryParams, type RegisteredError, Req, RequestId, type RequestOptions, type ResolvedHookClass, type ResolvedJob, type ResolvedWebhook, RoleNotDefined, Room, type RoomOptions, RouteOptions, SchemaDef, type SchemaJSON, type SignatureSpec, type StackNames, type TableJSON, Token, TraceId, type TransportConfig, User, Webhook, type WebhookEventHandler, type WebhookMeta, type WebhookOptions, type WebhookProvider, type WebhookRequest, __claimInjectables, __resetDefaultAuth, __resetRegisteredControllers, assertZeroArgConstructor, buildModuleClients, controllersOf, defineChannels, defineDefaultAuth, defineError, getErrorRegistry, getHookConfig, getHookManifest, getJobConfig, getJobManifest, getRegisteredControllers, getWebhookConfig, getWebhookManifest, hooksOf, jobsOf, makeEnvDts, makeHttpClient, makeStackDts, ownerOnly, publicChannel, resolveEffectiveAuth, roomsOf, toSchemaJSON, webhooksOf };

package/dist/index.js

@@ -32,6 +32,7 @@ import {
   getErrorRegistry
 } from "./chunk-TWX6JTGJ.js";
 import {
+  Auth,
   Cache,
   DECLARATION_REFUSAL,
   Database,
@@ -65,7 +66,7 @@ import {
   onStart,
   roomsOf,
   webhooksOf
-} from "./chunk-ESSQ3YML.js";
+} from "./chunk-YRVIWHJC.js";
 import {
   col,
   makeTypedDB,
@@ -201,6 +202,48 @@ function makeHttpClient(cfg) {
 }
 __name(makeHttpClient, "makeHttpClient");
 
+// src/clients/auth.ts
+var RoleNotDefined = class extends Error {
+  static {
+    __name(this, "RoleNotDefined");
+  }
+  role;
+  constructor(role, message) {
+    super(message ?? `No role named "${role}" is defined for this stack`);
+    this.name = "RoleNotDefined";
+    this.role = role;
+  }
+};
+function refuse(error, role) {
+  if (error.code === "role_not_defined") throw new RoleNotDefined(role, error.message);
+  if (error instanceof PalbaseModuleError) throw error;
+  throw new PalbaseModuleError(error.code ?? "unknown_error", error.message ?? "request failed", 0);
+}
+__name(refuse, "refuse");
+function rolesPath(userId, role) {
+  const base = `/admin/users/${encodeURIComponent(userId)}/roles`;
+  return role === void 0 ? base : `${base}/${encodeURIComponent(role)}`;
+}
+__name(rolesPath, "rolesPath");
+function buildAuthClient(http) {
+  return {
+    async assignRole(userId, role) {
+      const { error } = await http.request("PUT", rolesPath(userId, role));
+      if (error) refuse(error, role);
+    },
+    async revokeRole(userId, role) {
+      const { error } = await http.request("DELETE", rolesPath(userId, role));
+      if (error) refuse(error, role);
+    },
+    async rolesOf(userId) {
+      const { data, error } = await http.request("GET", rolesPath(userId));
+      if (error) refuse(error, "");
+      return data?.roles ?? [];
+    }
+  };
+}
+__name(buildAuthClient, "buildAuthClient");
+
 // src/clients/documents.ts
 var SEGMENT_RE = /^[A-Za-z0-9_-]+$/;
 function validateSegment(segment, label) {
@@ -1185,6 +1228,10 @@ function buildModuleClients(cfg) {
     fetchImpl: cfg.fetchImpl
   });
   return {
+    // The ROLE half of auth only (`clients/auth.ts` says why the rest is not
+    // here). It rides the same service-role transport, which is exactly the
+    // credential the assignment routes demand.
+    Auth: buildAuthClient(http),
     Documents: buildDocumentsClient(http),
     Storage: buildStorageClient(http, cfg.publicOrigin),
     Notifications: buildNotificationsClient(http),
@@ -1938,6 +1985,7 @@ __name(getJobConfig, "getJobConfig");
 // src/index.ts
 import { z } from "zod";
 export {
+  Auth,
   BadRequest,
   Body,
   Cache,
@@ -1988,6 +2036,7 @@ export {
   Realtime,
   Req,
   RequestId,
+  RoleNotDefined,
   Room,
   Secrets,
   SerializationFailure,