@palbase/backend 39.1.0 → 39.1.1

package/dist/engine/index.d.cts

@@ -1,5 +1,5 @@
 import '../index-pK2At5Yc.cjs';
-export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-B0mjUnxy.cjs';
+export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-Brhp8cxj.cjs';
 import 'zod';
 import '../db/env.cjs';
 import '../stack.cjs';

package/dist/engine/index.d.ts

@@ -1,5 +1,5 @@
 import '../index-eN4KzGa5.js';
-export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-yDno9Ju9.js';
+export { A as App, g as AuthVerifier, B as BootRefused, h as COMMAND_EXECUTOR_DDL, j as CreateAppOptions, D as DECLARATION_REFUSAL, a as DeclarationRefused, E as EgressPolicy, k as EngineConfig, M as ModuleClients, R as RateLimiter, l as RequestDatabase, m as RouteEntry, n as RuntimeHooks, S as ScrubResult, o as SqlDriver, p as SqlTx, q as buildRouteTable, r as createApp, s as createLazyTransaction, t as createOps, u as createRequestDatabase, v as effectiveAuth, w as hostAllowed, x as installCommandExecutor, y as installEgressFence, i as isDeclarationRefused, z as loadConfig, F as makeMemoryCache, G as matchRoute, H as quoteIdent, I as scrubSecrets, J as setCursorKey, K as withQueryCancellation, L as withTables } from '../index-Dlu2b9-f.js';
 import 'zod';
 import '../db/env.js';
 import '../stack.js';

package/dist/engine/index.js

@@ -20,7 +20,7 @@ import {
   setCursorKey,
   withQueryCancellation,
   withTables
-} from "../chunk-JJSR4BUX.js";
+} from "../chunk-C525N4OW.js";
 import {
   DECLARATION_REFUSAL,
   DeclarationRefused,

package/dist/{index-B0mjUnxy.d.cts → index-Brhp8cxj.d.cts}

@@ -895,18 +895,6 @@ interface RouteMatch {
 /** First match wins; the table is small and declaration order is the tiebreak. */
 declare function matchRoute(table: readonly RouteEntry[], method: string, pathname: string): RouteMatch | null;
 
-/**
- * engine/auth.ts — verifying the stack's own access tokens.
- *
- * The engine does this itself rather than trusting a header stamped upstream.
- * In the isolate architecture a gateway verified the token and the runtime read
- * the result; a backend that boots on its own has no such upstream, so the
- * verification lives here — against the keys the stack publishes.
- *
- * Deliberately narrow: ES256 over P-256, which is what palauth mints. An
- * unrecognised `alg` is refused rather than accommodated, because the classic
- * JWT break is a verifier that is helpful about algorithms.
- */
 /** The claims the engine reads. Everything else rides along untyped. */
 interface VerifiedClaims extends Record<string, unknown> {
     sub?: string;
@@ -930,20 +918,26 @@ declare class AuthVerifier {
     private keys;
     private fetchedAt;
     private inflight;
+    private nextRefreshAt;
+    private refreshFailed;
     private readonly jwksUrl;
     private readonly issuer?;
     private readonly fetchImpl;
     private readonly ttl;
     constructor(opts: AuthVerifierOptions);
-    /** Fetch the keyset at most once per TTL, and at most once concurrently. */
+    /** Fetch once concurrently. Known keys use their trust TTL; misses and
+     * failures share a short cooldown so arbitrary kids cannot force a fetch
+     * per request, and recovery does not wait for an entire trust TTL. */
     private refresh;
+    private fetchKeyset;
     private key;
     /**
      * Verify an `Authorization` header value.
      *
      * @returns the verified claims, or `null` for absent / malformed / expired /
-     *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
-     *   the caller answers 401 either way, and a detailed reason is an oracle.
+     *   wrong-issuer / bad-signature. Credential refusals deliberately share one
+     *   result. An unavailable keyset throws 503 instead: no authentication
+     *   decision was possible, and the caller's session must not be invalidated.
      */
     verify(authorization: string | null | undefined): Promise<VerifiedClaims | null>;
 }

package/dist/{index-yDno9Ju9.d.ts → index-Dlu2b9-f.d.ts}

@@ -895,18 +895,6 @@ interface RouteMatch {
 /** First match wins; the table is small and declaration order is the tiebreak. */
 declare function matchRoute(table: readonly RouteEntry[], method: string, pathname: string): RouteMatch | null;
 
-/**
- * engine/auth.ts — verifying the stack's own access tokens.
- *
- * The engine does this itself rather than trusting a header stamped upstream.
- * In the isolate architecture a gateway verified the token and the runtime read
- * the result; a backend that boots on its own has no such upstream, so the
- * verification lives here — against the keys the stack publishes.
- *
- * Deliberately narrow: ES256 over P-256, which is what palauth mints. An
- * unrecognised `alg` is refused rather than accommodated, because the classic
- * JWT break is a verifier that is helpful about algorithms.
- */
 /** The claims the engine reads. Everything else rides along untyped. */
 interface VerifiedClaims extends Record<string, unknown> {
     sub?: string;
@@ -930,20 +918,26 @@ declare class AuthVerifier {
     private keys;
     private fetchedAt;
     private inflight;
+    private nextRefreshAt;
+    private refreshFailed;
     private readonly jwksUrl;
     private readonly issuer?;
     private readonly fetchImpl;
     private readonly ttl;
     constructor(opts: AuthVerifierOptions);
-    /** Fetch the keyset at most once per TTL, and at most once concurrently. */
+    /** Fetch once concurrently. Known keys use their trust TTL; misses and
+     * failures share a short cooldown so arbitrary kids cannot force a fetch
+     * per request, and recovery does not wait for an entire trust TTL. */
     private refresh;
+    private fetchKeyset;
     private key;
     /**
      * Verify an `Authorization` header value.
      *
      * @returns the verified claims, or `null` for absent / malformed / expired /
-     *   wrong-issuer / bad-signature. One `null` for every failure on purpose:
-     *   the caller answers 401 either way, and a detailed reason is an oracle.
+     *   wrong-issuer / bad-signature. Credential refusals deliberately share one
+     *   result. An unavailable keyset throws 503 instead: no authentication
+     *   decision was possible, and the caller's session must not be invalidated.
      */
     verify(authorization: string | null | undefined): Promise<VerifiedClaims | null>;
 }

package/dist/index.d.cts

@@ -1,7 +1,7 @@
 import { k as PalbaseResult, l as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-pK2At5Yc.cjs';
 export { m as AggregateInput, n as AggregateResult, o as AnyColumn, p as AtomicDatabase, q as AtomicOptions, r as Auth, s as AuthConfig, B as BackfillDef, t as BadRequest, u as Cache, i as CacheClient, v as CheckDef, w as ClientInfo, x as ColRef, y as ColumnBuilder, z as ColumnDef, F as ColumnMap, G as ColumnType, C as CommandOptions, I as Conflict, a as DBClient, e as DBOps, J as Database, D as DatabaseBudget, d as DatabaseDiagnostics, c as DatabaseDiagnosticsOptions, K as DatabaseQueryEvent, L as DeadlockDetected, M as Documents, N as EXTENSION_DEPENDENCIES, O as EmbeddingModelRef, Q as EnvSchemas, E as EnvServiceDatabase, U as EnvTables, V as EnvTypedDatabase, W as EnvTypedTable, X as ErrorDef, Y as ErrorMap, Z as ErrorThrowers, $ as FileContext, a0 as FindManyOpts, a1 as FkAction, a2 as FkMatch, a3 as Flags, a4 as Forbidden, a5 as ForeignKeyBuilder, a6 as ForeignKeyDef, a7 as FreezeBuilder, a8 as FreezeDef, a9 as GuardBuilder, aa as GuardDef, ab as GuardEvent, ac as HttpMethod, ad as IndexBuilder, ae as IndexDef, af as InsertManyOptions, ag as InsertShape, ah as InsertValues, ai as LifecycleHook, aj as Log, ak as Logger, al as Materialized, am as Middleware, an as MiddlewareContext, ao as MiddlewareHandler, ap as MutateInput, aq as NotFound, ar as Notifications, as as OnDeleteAction, at as OrderBySpec, au as PALBASE_EXTENSIONS, av as PBRequest, P as Page, aw as PageInfo, ax as PageInput, ay as PageNavigation, az as PalError, aA as PalbaseAnalyticsClient, aB as PalbaseAnalyticsManagementNamespace, aC as PalbaseAnalyticsProperties, aD as PalbaseAnalyticsQueryNamespace, aE as PalbaseAttestAndroidParams, aF as PalbaseAttestAndroidResult, aG as PalbaseAttestiOSParams, aH as PalbaseAttestiOSResult, aI as PalbaseAuthAdminClient, aJ as PalbaseAuthClient, aK as PalbaseBatchOverrideOperation, aL as PalbaseBatchSetOverridesResult, aM as PalbaseBindDeviceParams, aN as PalbaseBucketClient, aO as PalbaseClearAllOverridesResult, aP as PalbaseClearOverrideResult, aQ as PalbaseCohortQueryInput, aR as PalbaseCohortResult, aS as PalbaseCollectionRef, aT as PalbaseCountQueryInput, aU as PalbaseCountResult, aV as PalbaseCreateLinkParams, aW as PalbaseDeviceInfo, aX as PalbaseDeviceTokenView, aY as PalbaseDocsClient, aZ as PalbaseDocumentRef, a_ as PalbaseDocumentSnapshot, a$ as PalbaseEmailClient, b0 as PalbaseEmailSendParams, b1 as PalbaseEmailSendResponse, b2 as PalbaseEventNamesResult, b3 as PalbaseEventsQueryInput, b4 as PalbaseEventsResult, b5 as PalbaseExtension, b6 as PalbaseFileObject, b7 as PalbaseFlag, b8 as PalbaseFlagContext, b9 as PalbaseFlagSource, ba as PalbaseFlagValue, bb as PalbaseFlagVariant, bc as PalbaseFlagsClient, bd as PalbaseFlagsServiceClient, be as PalbaseFunctionsClient, bf as PalbaseFunnelQueryInput, bg as PalbaseFunnelResult, bh as PalbaseIdentifyTraits, bi as PalbaseInboxClient, bj as PalbaseInboxListOptions, bk as PalbaseInboxListResult, bl as PalbaseInboxMessage, bm as PalbaseInboxSendParams, bn as PalbaseInboxSendResponse, bo as PalbaseInitialLink, bp as PalbaseInvokeOptions, bq as PalbaseLink, br as PalbaseLinkAnalytics, bs as PalbaseLinkDetails, bt as PalbaseLinksClient, bu as PalbaseListLinksOptions, bv as PalbaseListLinksResult, bw as PalbaseListOptions, bx as PalbaseMatchParams, by as PalbaseMultiChannelResponse, bz as PalbaseNotificationChannel, bA as PalbaseNotificationsClient, bB as PalbaseOverviewResult, bC as PalbasePreferences, bD as PalbasePreferencesClient, bE as PalbasePushClient, bF as PalbasePushSendParams, bG as PalbasePushSendResponse, bH as PalbaseQrCodeOptions, bI as PalbaseQuerySnapshot, bJ as PalbaseRealtimeClient, bK as PalbaseRegisterDeviceParams, bL as PalbaseRetentionQueryInput, bM as PalbaseRetentionResult, bN as PalbaseSession, bO as PalbaseSetOverrideResult, bP as PalbaseSetOverridesResult, bQ as PalbaseSignedUrlResponse, bR as PalbaseSmsClient, bS as PalbaseSmsSendParams, bT as PalbaseSmsSendResponse, bU as PalbaseStorageClient, bV as PalbaseTransformOptions, bW as PalbaseUpdateLinkParams, bX as PalbaseUploadOptions, bY as PalbaseUser, bZ as PalbaseUserDetailResult, b_ as PalbaseUsersQueryInput, b$ as PalbaseUsersResult, c0 as PalbaseVerifyRequestSignatureParams, c1 as PalbaseWhatsAppClient, c2 as PalbaseWhatsAppEvent, c3 as PalbaseWhatsAppSendParams, c4 as PalbaseWhatsAppSendResponse, c5 as PalbaseWhatsAppTemplate, c6 as PalbaseWhereOperator, c7 as PolicyBinOp, c8 as PolicyBuilder, c9 as PolicyCommand, ca as PolicyDef, cb as PolicyExprCtx, cc as PolicyExprRef, cd as PolicyMode, ce as PolicyOperand, cf as QueryInput, R as RateLimitConfig, cg as RawConstraintDef, f as RawPageOptions, ch as Realtime, ci as Ref, cj as RequestStore, ck as RowShape, b as RuntimeServices, cl as Secrets, cm as SecretsService, cn as SerializationFailure, co as SetShape, cp as SetValue, cq as ShutdownRunner, cr as SqlFragment, cs as Storage, ct as TABLE_META, cu as TableDef, cv as TableHandle, cw as TableInput, cx as TableRef, cy as TooManyRequests, T as TransactionIsolation, cz as TxColumnExpr, cA as TxInsertShape, cB as TxInsertValue, cC as TxNow, cD as TxPlan, g as TxPlanBody, cE as TxPlanError, cF as TxPlanHandle, cG as TxPlanOpResult, cH as TxPlanRejection, h as TxPlanResponse, cI as TxRefError, cJ as TxRow, cK as TxRows, cL as TxSelectOptions, cM as TxSetShape, cN as TxSetValue, cO as TxTable, cP as TxTables, cQ as TxWhere, cR as TxWireExpr, cS as TxWireGuard, cT as TxWireOp, cU as TxWireRef, cV as TxWireValue, cW as TypedDB, cX as TypedTable, cY as TypedTx, cZ as Unauthorized, c_ as UniqueViolation, c$ as UniqueWhere, d0 as UserT, d1 as VerifiedDevice, d2 as WhereFilter, d3 as WhereOp, d4 as __getRuntime, j as __requestALS, d5 as __resetLifecycleHooks, d6 as __runStartHooks, _ as __runWithRuntime, d7 as __setRuntime, d8 as backfill, d9 as bigint, da as boolean, db as can, dc as check, dd as col, de as dec, df as decrement, dg as defineMiddleware, dh as defineSchema, di as defineTable, dj as enumType, dk as exprCtx, dl as foreignKey, dm as freeze, dn as guard, dp as inc, dq as increment, dr as index, ds as installationRef, dt as integer, du as isPalbaseExtension, dv as isRetryable, dw as jsonb, dx as makeTypedDB, dy as now, dz as numeric, dA as onShutdown, dB as onStart, dC as openai, dD as ownedByUser, dE as policy, dF as raw, dG as sqlFragment, dH as text, dI as timestamp, dJ as userRef, dK as uuid, dL as vector, dM as withRetry } from './index-pK2At5Yc.cjs';
-import { M as ModuleClients, C as Container } from './index-B0mjUnxy.cjs';
-export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-B0mjUnxy.cjs';
+import { M as ModuleClients, C as Container } from './index-Brhp8cxj.cjs';
+export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-Brhp8cxj.cjs';
 export { TableTypes, Tables } from './db/env.cjs';
 export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.cjs';
 import { a as RouteOptions } from './registry-9dNeVN5d.cjs';

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { k as PalbaseResult, l as PolicyExpr, S as SchemaDef, A as AuthSpec, H as HttpError } from './index-eN4KzGa5.js';
 export { m as AggregateInput, n as AggregateResult, o as AnyColumn, p as AtomicDatabase, q as AtomicOptions, r as Auth, s as AuthConfig, B as BackfillDef, t as BadRequest, u as Cache, i as CacheClient, v as CheckDef, w as ClientInfo, x as ColRef, y as ColumnBuilder, z as ColumnDef, F as ColumnMap, G as ColumnType, C as CommandOptions, I as Conflict, a as DBClient, e as DBOps, J as Database, D as DatabaseBudget, d as DatabaseDiagnostics, c as DatabaseDiagnosticsOptions, K as DatabaseQueryEvent, L as DeadlockDetected, M as Documents, N as EXTENSION_DEPENDENCIES, O as EmbeddingModelRef, Q as EnvSchemas, E as EnvServiceDatabase, U as EnvTables, V as EnvTypedDatabase, W as EnvTypedTable, X as ErrorDef, Y as ErrorMap, Z as ErrorThrowers, $ as FileContext, a0 as FindManyOpts, a1 as FkAction, a2 as FkMatch, a3 as Flags, a4 as Forbidden, a5 as ForeignKeyBuilder, a6 as ForeignKeyDef, a7 as FreezeBuilder, a8 as FreezeDef, a9 as GuardBuilder, aa as GuardDef, ab as GuardEvent, ac as HttpMethod, ad as IndexBuilder, ae as IndexDef, af as InsertManyOptions, ag as InsertShape, ah as InsertValues, ai as LifecycleHook, aj as Log, ak as Logger, al as Materialized, am as Middleware, an as MiddlewareContext, ao as MiddlewareHandler, ap as MutateInput, aq as NotFound, ar as Notifications, as as OnDeleteAction, at as OrderBySpec, au as PALBASE_EXTENSIONS, av as PBRequest, P as Page, aw as PageInfo, ax as PageInput, ay as PageNavigation, az as PalError, aA as PalbaseAnalyticsClient, aB as PalbaseAnalyticsManagementNamespace, aC as PalbaseAnalyticsProperties, aD as PalbaseAnalyticsQueryNamespace, aE as PalbaseAttestAndroidParams, aF as PalbaseAttestAndroidResult, aG as PalbaseAttestiOSParams, aH as PalbaseAttestiOSResult, aI as PalbaseAuthAdminClient, aJ as PalbaseAuthClient, aK as PalbaseBatchOverrideOperation, aL as PalbaseBatchSetOverridesResult, aM as PalbaseBindDeviceParams, aN as PalbaseBucketClient, aO as PalbaseClearAllOverridesResult, aP as PalbaseClearOverrideResult, aQ as PalbaseCohortQueryInput, aR as PalbaseCohortResult, aS as PalbaseCollectionRef, aT as PalbaseCountQueryInput, aU as PalbaseCountResult, aV as PalbaseCreateLinkParams, aW as PalbaseDeviceInfo, aX as PalbaseDeviceTokenView, aY as PalbaseDocsClient, aZ as PalbaseDocumentRef, a_ as PalbaseDocumentSnapshot, a$ as PalbaseEmailClient, b0 as PalbaseEmailSendParams, b1 as PalbaseEmailSendResponse, b2 as PalbaseEventNamesResult, b3 as PalbaseEventsQueryInput, b4 as PalbaseEventsResult, b5 as PalbaseExtension, b6 as PalbaseFileObject, b7 as PalbaseFlag, b8 as PalbaseFlagContext, b9 as PalbaseFlagSource, ba as PalbaseFlagValue, bb as PalbaseFlagVariant, bc as PalbaseFlagsClient, bd as PalbaseFlagsServiceClient, be as PalbaseFunctionsClient, bf as PalbaseFunnelQueryInput, bg as PalbaseFunnelResult, bh as PalbaseIdentifyTraits, bi as PalbaseInboxClient, bj as PalbaseInboxListOptions, bk as PalbaseInboxListResult, bl as PalbaseInboxMessage, bm as PalbaseInboxSendParams, bn as PalbaseInboxSendResponse, bo as PalbaseInitialLink, bp as PalbaseInvokeOptions, bq as PalbaseLink, br as PalbaseLinkAnalytics, bs as PalbaseLinkDetails, bt as PalbaseLinksClient, bu as PalbaseListLinksOptions, bv as PalbaseListLinksResult, bw as PalbaseListOptions, bx as PalbaseMatchParams, by as PalbaseMultiChannelResponse, bz as PalbaseNotificationChannel, bA as PalbaseNotificationsClient, bB as PalbaseOverviewResult, bC as PalbasePreferences, bD as PalbasePreferencesClient, bE as PalbasePushClient, bF as PalbasePushSendParams, bG as PalbasePushSendResponse, bH as PalbaseQrCodeOptions, bI as PalbaseQuerySnapshot, bJ as PalbaseRealtimeClient, bK as PalbaseRegisterDeviceParams, bL as PalbaseRetentionQueryInput, bM as PalbaseRetentionResult, bN as PalbaseSession, bO as PalbaseSetOverrideResult, bP as PalbaseSetOverridesResult, bQ as PalbaseSignedUrlResponse, bR as PalbaseSmsClient, bS as PalbaseSmsSendParams, bT as PalbaseSmsSendResponse, bU as PalbaseStorageClient, bV as PalbaseTransformOptions, bW as PalbaseUpdateLinkParams, bX as PalbaseUploadOptions, bY as PalbaseUser, bZ as PalbaseUserDetailResult, b_ as PalbaseUsersQueryInput, b$ as PalbaseUsersResult, c0 as PalbaseVerifyRequestSignatureParams, c1 as PalbaseWhatsAppClient, c2 as PalbaseWhatsAppEvent, c3 as PalbaseWhatsAppSendParams, c4 as PalbaseWhatsAppSendResponse, c5 as PalbaseWhatsAppTemplate, c6 as PalbaseWhereOperator, c7 as PolicyBinOp, c8 as PolicyBuilder, c9 as PolicyCommand, ca as PolicyDef, cb as PolicyExprCtx, cc as PolicyExprRef, cd as PolicyMode, ce as PolicyOperand, cf as QueryInput, R as RateLimitConfig, cg as RawConstraintDef, f as RawPageOptions, ch as Realtime, ci as Ref, cj as RequestStore, ck as RowShape, b as RuntimeServices, cl as Secrets, cm as SecretsService, cn as SerializationFailure, co as SetShape, cp as SetValue, cq as ShutdownRunner, cr as SqlFragment, cs as Storage, ct as TABLE_META, cu as TableDef, cv as TableHandle, cw as TableInput, cx as TableRef, cy as TooManyRequests, T as TransactionIsolation, cz as TxColumnExpr, cA as TxInsertShape, cB as TxInsertValue, cC as TxNow, cD as TxPlan, g as TxPlanBody, cE as TxPlanError, cF as TxPlanHandle, cG as TxPlanOpResult, cH as TxPlanRejection, h as TxPlanResponse, cI as TxRefError, cJ as TxRow, cK as TxRows, cL as TxSelectOptions, cM as TxSetShape, cN as TxSetValue, cO as TxTable, cP as TxTables, cQ as TxWhere, cR as TxWireExpr, cS as TxWireGuard, cT as TxWireOp, cU as TxWireRef, cV as TxWireValue, cW as TypedDB, cX as TypedTable, cY as TypedTx, cZ as Unauthorized, c_ as UniqueViolation, c$ as UniqueWhere, d0 as UserT, d1 as VerifiedDevice, d2 as WhereFilter, d3 as WhereOp, d4 as __getRuntime, j as __requestALS, d5 as __resetLifecycleHooks, d6 as __runStartHooks, _ as __runWithRuntime, d7 as __setRuntime, d8 as backfill, d9 as bigint, da as boolean, db as can, dc as check, dd as col, de as dec, df as decrement, dg as defineMiddleware, dh as defineSchema, di as defineTable, dj as enumType, dk as exprCtx, dl as foreignKey, dm as freeze, dn as guard, dp as inc, dq as increment, dr as index, ds as installationRef, dt as integer, du as isPalbaseExtension, dv as isRetryable, dw as jsonb, dx as makeTypedDB, dy as now, dz as numeric, dA as onShutdown, dB as onStart, dC as openai, dD as ownedByUser, dE as policy, dF as raw, dG as sqlFragment, dH as text, dI as timestamp, dJ as userRef, dK as uuid, dL as vector, dM as withRetry } from './index-eN4KzGa5.js';
-import { M as ModuleClients, C as Container } from './index-yDno9Ju9.js';
-export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-yDno9Ju9.js';
+import { M as ModuleClients, C as Container } from './index-Dlu2b9-f.js';
+export { D as DECLARATION_REFUSAL, a as DeclarationRefused, b as DiError, c as DiKind, d as ModulePressure, e as assertNoOrphanEntryPoints, f as buildContainer, i as isDeclarationRefused } from './index-Dlu2b9-f.js';
 export { TableTypes, Tables } from './db/env.js';
 export { PalbaseBucketName, PalbaseFlagKey, PalbaseSecretName } from './stack.js';
 import { a as RouteOptions } from './registry-B8ddZiMY.js';

package/docs/auth.md

@@ -5,6 +5,26 @@ unless it opts out with `auth: false`. Client SDKs attach the user's token
 automatically, so on the backend you declare what a route needs and inject the
 user.
 
+## Temporary verification failures
+
+An absent or invalid access token produces `401 unauthorized` on a protected
+route. If the runtime cannot retrieve a usable signing keyset, it instead
+returns `503 auth_unavailable`. A network failure, an unsuccessful JWKS response,
+or a keyset with no usable signing keys is an availability failure, not evidence
+that the caller's token is invalid. Keep the session and retry after the service
+recovers; signing in again is not required while the token remains valid.
+
+The same rule applies to upload authorization. Requests that cannot be verified
+do not reach the handler or the database, and uploads receive no grant. Public
+requests without credentials continue to work.
+
+Known signing keys remain usable within their trust TTL (five minutes by
+default). Expired keysets are not trusted during an outage. Concurrent refreshes
+share one request, and failed refreshes and unknown key IDs share a one-second
+retry interval so recovery and key rotation do not wait for the entire TTL.
+
+## Declaring authentication
+
 ```ts
 import { Controller, Get, Post, Body, User, OptionalUser } from "@palbase/backend";
 import type { UserT } from "@palbase/backend";

package/docs/llms-full.txt

@@ -795,6 +795,26 @@ unless it opts out with `auth: false`. Client SDKs attach the user's token
 automatically, so on the backend you declare what a route needs and inject the
 user.
 
+## Temporary verification failures
+
+An absent or invalid access token produces `401 unauthorized` on a protected
+route. If the runtime cannot retrieve a usable signing keyset, it instead
+returns `503 auth_unavailable`. A network failure, an unsuccessful JWKS response,
+or a keyset with no usable signing keys is an availability failure, not evidence
+that the caller's token is invalid. Keep the session and retry after the service
+recovers; signing in again is not required while the token remains valid.
+
+The same rule applies to upload authorization. Requests that cannot be verified
+do not reach the handler or the database, and uploads receive no grant. Public
+requests without credentials continue to work.
+
+Known signing keys remain usable within their trust TTL (five minutes by
+default). Expired keysets are not trusted during an outage. Concurrent refreshes
+share one request, and failed refreshes and unknown key IDs share a one-second
+retry interval so recovery and key rotation do not wait for the entire TTL.
+
+## Declaring authentication
+
 ```ts
 import { Controller, Get, Post, Body, User, OptionalUser } from "@palbase/backend";
 import type { UserT } from "@palbase/backend";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@palbase/backend",
-  "version": "39.1.0",
+  "version": "39.1.1",
   "description": "Palbase Backend SDK — class controllers (@Controller/@Get/@Post + @Body/@QueryParams/@Param), error classes, schema DSL",
   "license": "MIT",
   "repository": {