@palbase/backend 9.0.1 → 10.1.0

package/dist/{endpoint-CGI5cZMg.d.cts → endpoint-Cn3ICGTf.d.cts}

@@ -2,6 +2,21 @@ import { ZodSchema, z } from 'zod';
 
 /** Supported HTTP methods for endpoints. */
 type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+/**
+ * Verified device claim, minted at the platform attestation boundary (App
+ * Attest / Play Integrity). Server-owned and immutable: it is populated ONLY
+ * from a successful, request-bound verification — never from a raw client
+ * header or from user/JWT metadata.
+ */
+interface VerifiedDevice {
+    /** Server-minted `auth.installations` anchor (`ins_…`); may be "" until the installation binding is wired at the verify boundary. */
+    installationId: string;
+    /** Palauth device record (`dev_…`) proven by the App Attest assertion. Absent on the Android integrity path. */
+    authDeviceId?: string;
+    platform: "ios" | "android" | "web";
+    /** Proven verification tier — never a string-matched or header-asserted value. */
+    assurance: "attested" | "app_integrity" | "registered";
+}
 /** Authenticated user attached to the request context. */
 interface User {
     id: string;
@@ -9,6 +24,12 @@ interface User {
     email?: string;
     role: string;
     metadata: Record<string, unknown>;
+    /**
+     * Reserved, server-owned verified device claim. `null` on an authenticated
+     * request with no verified device. The context assembler is the sole writer;
+     * user/JWT metadata can never populate it.
+     */
+    device: VerifiedDevice | null;
 }
 /** Authentication configuration for an endpoint. */
 interface AuthConfig {
@@ -29,7 +50,6 @@ interface MiddlewareContext extends PalbaseModuleClients {
     log: Logger;
     cache: CacheClient;
     requestId: string;
-    projectId: string;
     environmentId: string;
 }
 /** Middleware function signature — receives context and next function. */
@@ -513,8 +533,8 @@ interface PalbaseRegisterDeviceParams {
 /** Email template view (camelCase). */
 interface PalbaseEmailTemplate {
     id: string;
-    projectId: string;
     slug: string;
+    locale: string;
     subject: string;
     htmlBody: string;
     textBody?: string;
@@ -526,6 +546,7 @@ interface PalbaseEmailTemplate {
 /** Payload for templates.email.create. */
 interface PalbaseCreateEmailTemplateInput {
     slug: string;
+    locale?: string;
     subject: string;
     htmlBody: string;
     textBody?: string;
@@ -541,8 +562,8 @@ interface PalbaseUpdateEmailTemplateInput {
 /** SMS template view (camelCase). No subject / html / text distinction. */
 interface PalbaseSMSTemplate {
     id: string;
-    projectId: string;
     slug: string;
+    locale: string;
     body: string;
     variables: string[];
     isDefault: boolean;
@@ -552,6 +573,7 @@ interface PalbaseSMSTemplate {
 /** Payload for templates.sms.create. */
 interface PalbaseCreateSMSTemplateInput {
     slug: string;
+    locale?: string;
     body: string;
     variables?: string[];
 }
@@ -1576,4 +1598,4 @@ type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise
  */
 type AuthSpec = boolean | Partial<AuthConfig>;
 
-export { type PalbaseDeviceTokenView as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type ErrorDef as E, type FileContext as F, type PalbaseBatchOverrideOperation as G, HttpError as H, type PalbaseBatchSetOverridesResult as I, type PalbaseBindDeviceParams as J, type PalbaseBucketClient as K, type Logger as L, type Middleware as M, NotFound as N, type PalbaseClearAllOverridesResult as O, type PBRequest as P, type QueueClient as Q, type RateLimitConfig as R, type PalbaseClearOverrideResult as S, type PalbaseCohortQueryInput as T, type User as U, type PalbaseCohortResult as V, type PalbaseCollectionRef as W, type PalbaseCountQueryInput as X, type PalbaseCountResult as Y, type PalbaseCreateLinkParams as Z, type PalbaseDeviceInfo as _, type PalbaseModuleClients as a, type PalbaseVerifyRequestSignatureParams as a$, type PalbaseDocumentRef as a0, type PalbaseDocumentSnapshot as a1, type PalbaseEmailClient as a2, type PalbaseEmailSendParams as a3, type PalbaseEmailSendResponse as a4, type PalbaseEventNamesResult as a5, type PalbaseEventsQueryInput as a6, type PalbaseEventsResult as a7, type PalbaseFileObject as a8, type PalbaseFlag as a9, type PalbaseOverviewResult as aA, type PalbasePreferences as aB, type PalbasePreferencesClient as aC, type PalbasePublicUrlResponse as aD, type PalbasePushClient as aE, type PalbasePushSendParams as aF, type PalbasePushSendResponse as aG, type PalbaseQrCodeOptions as aH, type PalbaseQuerySnapshot as aI, type PalbaseRegisterDeviceParams as aJ, type PalbaseResult as aK, type PalbaseRetentionQueryInput as aL, type PalbaseRetentionResult as aM, type PalbaseSession as aN, type PalbaseSetOverrideResult as aO, type PalbaseSetOverridesResult as aP, type PalbaseSignedUrlResponse as aQ, type PalbaseSmsClient as aR, type PalbaseSmsSendParams as aS, type PalbaseSmsSendResponse as aT, type PalbaseTransformOptions as aU, type PalbaseUpdateLinkParams as aV, type PalbaseUploadOptions as aW, type PalbaseUser as aX, type PalbaseUserDetailResult as aY, type PalbaseUsersQueryInput as aZ, type PalbaseUsersResult as a_, type PalbaseFlagContext as aa, type PalbaseFlagSource as ab, type PalbaseFlagValue as ac, type PalbaseFlagVariant as ad, type PalbaseFlagsServiceClient as ae, type PalbaseFunctionsClient as af, type PalbaseFunnelQueryInput as ag, type PalbaseFunnelResult as ah, type PalbaseIdentifyTraits as ai, type PalbaseInboxClient as aj, type PalbaseInboxListOptions as ak, type PalbaseInboxListResult as al, type PalbaseInboxMessage as am, type PalbaseInboxSendParams as an, type PalbaseInboxSendResponse as ao, type PalbaseInitialLink as ap, type PalbaseInvokeOptions as aq, type PalbaseLink as ar, type PalbaseLinkAnalytics as as, type PalbaseLinkDetails as at, type PalbaseLinksClient as au, type PalbaseListLinksOptions as av, type PalbaseListLinksResult as aw, type PalbaseListOptions as ax, type PalbaseMatchParams as ay, type PalbaseMultiChannelResponse as az, type PalbaseDocsClient as b, type PalbaseWhereOperator as b0, TooManyRequests as b1, type TxClient as b2, Unauthorized as b3, defineMiddleware as b4, type PalbaseFlagsClient as c, type PalbaseNotificationsClient as d, type PalbaseRealtimeClient as e, type PalbaseStorageClient as f, type AuthConfig as g, type ClientInfo as h, Conflict as i, type DBOps as j, type ErrorMap as k, type ErrorThrowers as l, Forbidden as m, type HttpMethod as n, type MiddlewareContext as o, type MiddlewareHandler as p, PalError as q, type PalbaseAnalyticsClient as r, type PalbaseAnalyticsManagementNamespace as s, type PalbaseAnalyticsProperties as t, type PalbaseAnalyticsQueryNamespace as u, type PalbaseAttestAndroidParams as v, type PalbaseAttestAndroidResult as w, type PalbaseAttestiOSParams as x, type PalbaseAttestiOSResult as y, type PalbaseAuthClient as z };
+export { type PalbaseDeviceTokenView as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type ErrorDef as E, type FileContext as F, type PalbaseBatchOverrideOperation as G, HttpError as H, type PalbaseBatchSetOverridesResult as I, type PalbaseBindDeviceParams as J, type PalbaseBucketClient as K, type Logger as L, type Middleware as M, NotFound as N, type PalbaseClearAllOverridesResult as O, type PBRequest as P, type QueueClient as Q, type RateLimitConfig as R, type PalbaseClearOverrideResult as S, type PalbaseCohortQueryInput as T, type User as U, type PalbaseCohortResult as V, type PalbaseCollectionRef as W, type PalbaseCountQueryInput as X, type PalbaseCountResult as Y, type PalbaseCreateLinkParams as Z, type PalbaseDeviceInfo as _, type PalbaseModuleClients as a, type PalbaseVerifyRequestSignatureParams as a$, type PalbaseDocumentRef as a0, type PalbaseDocumentSnapshot as a1, type PalbaseEmailClient as a2, type PalbaseEmailSendParams as a3, type PalbaseEmailSendResponse as a4, type PalbaseEventNamesResult as a5, type PalbaseEventsQueryInput as a6, type PalbaseEventsResult as a7, type PalbaseFileObject as a8, type PalbaseFlag as a9, type PalbaseOverviewResult as aA, type PalbasePreferences as aB, type PalbasePreferencesClient as aC, type PalbasePublicUrlResponse as aD, type PalbasePushClient as aE, type PalbasePushSendParams as aF, type PalbasePushSendResponse as aG, type PalbaseQrCodeOptions as aH, type PalbaseQuerySnapshot as aI, type PalbaseRegisterDeviceParams as aJ, type PalbaseResult as aK, type PalbaseRetentionQueryInput as aL, type PalbaseRetentionResult as aM, type PalbaseSession as aN, type PalbaseSetOverrideResult as aO, type PalbaseSetOverridesResult as aP, type PalbaseSignedUrlResponse as aQ, type PalbaseSmsClient as aR, type PalbaseSmsSendParams as aS, type PalbaseSmsSendResponse as aT, type PalbaseTransformOptions as aU, type PalbaseUpdateLinkParams as aV, type PalbaseUploadOptions as aW, type PalbaseUser as aX, type PalbaseUserDetailResult as aY, type PalbaseUsersQueryInput as aZ, type PalbaseUsersResult as a_, type PalbaseFlagContext as aa, type PalbaseFlagSource as ab, type PalbaseFlagValue as ac, type PalbaseFlagVariant as ad, type PalbaseFlagsServiceClient as ae, type PalbaseFunctionsClient as af, type PalbaseFunnelQueryInput as ag, type PalbaseFunnelResult as ah, type PalbaseIdentifyTraits as ai, type PalbaseInboxClient as aj, type PalbaseInboxListOptions as ak, type PalbaseInboxListResult as al, type PalbaseInboxMessage as am, type PalbaseInboxSendParams as an, type PalbaseInboxSendResponse as ao, type PalbaseInitialLink as ap, type PalbaseInvokeOptions as aq, type PalbaseLink as ar, type PalbaseLinkAnalytics as as, type PalbaseLinkDetails as at, type PalbaseLinksClient as au, type PalbaseListLinksOptions as av, type PalbaseListLinksResult as aw, type PalbaseListOptions as ax, type PalbaseMatchParams as ay, type PalbaseMultiChannelResponse as az, type PalbaseDocsClient as b, type PalbaseWhereOperator as b0, TooManyRequests as b1, type TxClient as b2, Unauthorized as b3, type VerifiedDevice as b4, defineMiddleware as b5, type PalbaseFlagsClient as c, type PalbaseNotificationsClient as d, type PalbaseRealtimeClient as e, type PalbaseStorageClient as f, type AuthConfig as g, type ClientInfo as h, Conflict as i, type DBOps as j, type ErrorMap as k, type ErrorThrowers as l, Forbidden as m, type HttpMethod as n, type MiddlewareContext as o, type MiddlewareHandler as p, PalError as q, type PalbaseAnalyticsClient as r, type PalbaseAnalyticsManagementNamespace as s, type PalbaseAnalyticsProperties as t, type PalbaseAnalyticsQueryNamespace as u, type PalbaseAttestAndroidParams as v, type PalbaseAttestAndroidResult as w, type PalbaseAttestiOSParams as x, type PalbaseAttestiOSResult as y, type PalbaseAuthClient as z };

package/dist/{endpoint-CGI5cZMg.d.ts → endpoint-Cn3ICGTf.d.ts}

@@ -2,6 +2,21 @@ import { ZodSchema, z } from 'zod';
 
 /** Supported HTTP methods for endpoints. */
 type HttpMethod = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
+/**
+ * Verified device claim, minted at the platform attestation boundary (App
+ * Attest / Play Integrity). Server-owned and immutable: it is populated ONLY
+ * from a successful, request-bound verification — never from a raw client
+ * header or from user/JWT metadata.
+ */
+interface VerifiedDevice {
+    /** Server-minted `auth.installations` anchor (`ins_…`); may be "" until the installation binding is wired at the verify boundary. */
+    installationId: string;
+    /** Palauth device record (`dev_…`) proven by the App Attest assertion. Absent on the Android integrity path. */
+    authDeviceId?: string;
+    platform: "ios" | "android" | "web";
+    /** Proven verification tier — never a string-matched or header-asserted value. */
+    assurance: "attested" | "app_integrity" | "registered";
+}
 /** Authenticated user attached to the request context. */
 interface User {
     id: string;
@@ -9,6 +24,12 @@ interface User {
     email?: string;
     role: string;
     metadata: Record<string, unknown>;
+    /**
+     * Reserved, server-owned verified device claim. `null` on an authenticated
+     * request with no verified device. The context assembler is the sole writer;
+     * user/JWT metadata can never populate it.
+     */
+    device: VerifiedDevice | null;
 }
 /** Authentication configuration for an endpoint. */
 interface AuthConfig {
@@ -29,7 +50,6 @@ interface MiddlewareContext extends PalbaseModuleClients {
     log: Logger;
     cache: CacheClient;
     requestId: string;
-    projectId: string;
     environmentId: string;
 }
 /** Middleware function signature — receives context and next function. */
@@ -513,8 +533,8 @@ interface PalbaseRegisterDeviceParams {
 /** Email template view (camelCase). */
 interface PalbaseEmailTemplate {
     id: string;
-    projectId: string;
     slug: string;
+    locale: string;
     subject: string;
     htmlBody: string;
     textBody?: string;
@@ -526,6 +546,7 @@ interface PalbaseEmailTemplate {
 /** Payload for templates.email.create. */
 interface PalbaseCreateEmailTemplateInput {
     slug: string;
+    locale?: string;
     subject: string;
     htmlBody: string;
     textBody?: string;
@@ -541,8 +562,8 @@ interface PalbaseUpdateEmailTemplateInput {
 /** SMS template view (camelCase). No subject / html / text distinction. */
 interface PalbaseSMSTemplate {
     id: string;
-    projectId: string;
     slug: string;
+    locale: string;
     body: string;
     variables: string[];
     isDefault: boolean;
@@ -552,6 +573,7 @@ interface PalbaseSMSTemplate {
 /** Payload for templates.sms.create. */
 interface PalbaseCreateSMSTemplateInput {
     slug: string;
+    locale?: string;
     body: string;
     variables?: string[];
 }
@@ -1576,4 +1598,4 @@ type Middleware = (ctx: MiddlewareContext, next: () => Promise<void>) => Promise
  */
 type AuthSpec = boolean | Partial<AuthConfig>;
 
-export { type PalbaseDeviceTokenView as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type ErrorDef as E, type FileContext as F, type PalbaseBatchOverrideOperation as G, HttpError as H, type PalbaseBatchSetOverridesResult as I, type PalbaseBindDeviceParams as J, type PalbaseBucketClient as K, type Logger as L, type Middleware as M, NotFound as N, type PalbaseClearAllOverridesResult as O, type PBRequest as P, type QueueClient as Q, type RateLimitConfig as R, type PalbaseClearOverrideResult as S, type PalbaseCohortQueryInput as T, type User as U, type PalbaseCohortResult as V, type PalbaseCollectionRef as W, type PalbaseCountQueryInput as X, type PalbaseCountResult as Y, type PalbaseCreateLinkParams as Z, type PalbaseDeviceInfo as _, type PalbaseModuleClients as a, type PalbaseVerifyRequestSignatureParams as a$, type PalbaseDocumentRef as a0, type PalbaseDocumentSnapshot as a1, type PalbaseEmailClient as a2, type PalbaseEmailSendParams as a3, type PalbaseEmailSendResponse as a4, type PalbaseEventNamesResult as a5, type PalbaseEventsQueryInput as a6, type PalbaseEventsResult as a7, type PalbaseFileObject as a8, type PalbaseFlag as a9, type PalbaseOverviewResult as aA, type PalbasePreferences as aB, type PalbasePreferencesClient as aC, type PalbasePublicUrlResponse as aD, type PalbasePushClient as aE, type PalbasePushSendParams as aF, type PalbasePushSendResponse as aG, type PalbaseQrCodeOptions as aH, type PalbaseQuerySnapshot as aI, type PalbaseRegisterDeviceParams as aJ, type PalbaseResult as aK, type PalbaseRetentionQueryInput as aL, type PalbaseRetentionResult as aM, type PalbaseSession as aN, type PalbaseSetOverrideResult as aO, type PalbaseSetOverridesResult as aP, type PalbaseSignedUrlResponse as aQ, type PalbaseSmsClient as aR, type PalbaseSmsSendParams as aS, type PalbaseSmsSendResponse as aT, type PalbaseTransformOptions as aU, type PalbaseUpdateLinkParams as aV, type PalbaseUploadOptions as aW, type PalbaseUser as aX, type PalbaseUserDetailResult as aY, type PalbaseUsersQueryInput as aZ, type PalbaseUsersResult as a_, type PalbaseFlagContext as aa, type PalbaseFlagSource as ab, type PalbaseFlagValue as ac, type PalbaseFlagVariant as ad, type PalbaseFlagsServiceClient as ae, type PalbaseFunctionsClient as af, type PalbaseFunnelQueryInput as ag, type PalbaseFunnelResult as ah, type PalbaseIdentifyTraits as ai, type PalbaseInboxClient as aj, type PalbaseInboxListOptions as ak, type PalbaseInboxListResult as al, type PalbaseInboxMessage as am, type PalbaseInboxSendParams as an, type PalbaseInboxSendResponse as ao, type PalbaseInitialLink as ap, type PalbaseInvokeOptions as aq, type PalbaseLink as ar, type PalbaseLinkAnalytics as as, type PalbaseLinkDetails as at, type PalbaseLinksClient as au, type PalbaseListLinksOptions as av, type PalbaseListLinksResult as aw, type PalbaseListOptions as ax, type PalbaseMatchParams as ay, type PalbaseMultiChannelResponse as az, type PalbaseDocsClient as b, type PalbaseWhereOperator as b0, TooManyRequests as b1, type TxClient as b2, Unauthorized as b3, defineMiddleware as b4, type PalbaseFlagsClient as c, type PalbaseNotificationsClient as d, type PalbaseRealtimeClient as e, type PalbaseStorageClient as f, type AuthConfig as g, type ClientInfo as h, Conflict as i, type DBOps as j, type ErrorMap as k, type ErrorThrowers as l, Forbidden as m, type HttpMethod as n, type MiddlewareContext as o, type MiddlewareHandler as p, PalError as q, type PalbaseAnalyticsClient as r, type PalbaseAnalyticsManagementNamespace as s, type PalbaseAnalyticsProperties as t, type PalbaseAnalyticsQueryNamespace as u, type PalbaseAttestAndroidParams as v, type PalbaseAttestAndroidResult as w, type PalbaseAttestiOSParams as x, type PalbaseAttestiOSResult as y, type PalbaseAuthClient as z };
+export { type PalbaseDeviceTokenView as $, type AuthSpec as A, BadRequest as B, type CacheClient as C, type DBClient as D, type ErrorDef as E, type FileContext as F, type PalbaseBatchOverrideOperation as G, HttpError as H, type PalbaseBatchSetOverridesResult as I, type PalbaseBindDeviceParams as J, type PalbaseBucketClient as K, type Logger as L, type Middleware as M, NotFound as N, type PalbaseClearAllOverridesResult as O, type PBRequest as P, type QueueClient as Q, type RateLimitConfig as R, type PalbaseClearOverrideResult as S, type PalbaseCohortQueryInput as T, type User as U, type PalbaseCohortResult as V, type PalbaseCollectionRef as W, type PalbaseCountQueryInput as X, type PalbaseCountResult as Y, type PalbaseCreateLinkParams as Z, type PalbaseDeviceInfo as _, type PalbaseModuleClients as a, type PalbaseVerifyRequestSignatureParams as a$, type PalbaseDocumentRef as a0, type PalbaseDocumentSnapshot as a1, type PalbaseEmailClient as a2, type PalbaseEmailSendParams as a3, type PalbaseEmailSendResponse as a4, type PalbaseEventNamesResult as a5, type PalbaseEventsQueryInput as a6, type PalbaseEventsResult as a7, type PalbaseFileObject as a8, type PalbaseFlag as a9, type PalbaseOverviewResult as aA, type PalbasePreferences as aB, type PalbasePreferencesClient as aC, type PalbasePublicUrlResponse as aD, type PalbasePushClient as aE, type PalbasePushSendParams as aF, type PalbasePushSendResponse as aG, type PalbaseQrCodeOptions as aH, type PalbaseQuerySnapshot as aI, type PalbaseRegisterDeviceParams as aJ, type PalbaseResult as aK, type PalbaseRetentionQueryInput as aL, type PalbaseRetentionResult as aM, type PalbaseSession as aN, type PalbaseSetOverrideResult as aO, type PalbaseSetOverridesResult as aP, type PalbaseSignedUrlResponse as aQ, type PalbaseSmsClient as aR, type PalbaseSmsSendParams as aS, type PalbaseSmsSendResponse as aT, type PalbaseTransformOptions as aU, type PalbaseUpdateLinkParams as aV, type PalbaseUploadOptions as aW, type PalbaseUser as aX, type PalbaseUserDetailResult as aY, type PalbaseUsersQueryInput as aZ, type PalbaseUsersResult as a_, type PalbaseFlagContext as aa, type PalbaseFlagSource as ab, type PalbaseFlagValue as ac, type PalbaseFlagVariant as ad, type PalbaseFlagsServiceClient as ae, type PalbaseFunctionsClient as af, type PalbaseFunnelQueryInput as ag, type PalbaseFunnelResult as ah, type PalbaseIdentifyTraits as ai, type PalbaseInboxClient as aj, type PalbaseInboxListOptions as ak, type PalbaseInboxListResult as al, type PalbaseInboxMessage as am, type PalbaseInboxSendParams as an, type PalbaseInboxSendResponse as ao, type PalbaseInitialLink as ap, type PalbaseInvokeOptions as aq, type PalbaseLink as ar, type PalbaseLinkAnalytics as as, type PalbaseLinkDetails as at, type PalbaseLinksClient as au, type PalbaseListLinksOptions as av, type PalbaseListLinksResult as aw, type PalbaseListOptions as ax, type PalbaseMatchParams as ay, type PalbaseMultiChannelResponse as az, type PalbaseDocsClient as b, type PalbaseWhereOperator as b0, TooManyRequests as b1, type TxClient as b2, Unauthorized as b3, type VerifiedDevice as b4, defineMiddleware as b5, type PalbaseFlagsClient as c, type PalbaseNotificationsClient as d, type PalbaseRealtimeClient as e, type PalbaseStorageClient as f, type AuthConfig as g, type ClientInfo as h, Conflict as i, type DBOps as j, type ErrorMap as k, type ErrorThrowers as l, Forbidden as m, type HttpMethod as n, type MiddlewareContext as o, type MiddlewareHandler as p, PalError as q, type PalbaseAnalyticsClient as r, type PalbaseAnalyticsManagementNamespace as s, type PalbaseAnalyticsProperties as t, type PalbaseAnalyticsQueryNamespace as u, type PalbaseAttestAndroidParams as v, type PalbaseAttestAndroidResult as w, type PalbaseAttestiOSParams as x, type PalbaseAttestiOSResult as y, type PalbaseAuthClient as z };

package/dist/{index-osv2jMmZ.d.cts → index-Bt7UHkAM.d.cts}

@@ -1,8 +1,17 @@
 import { Tables, TableTypes } from './db/env.cjs';
-import { D as DBClient } from './endpoint-CGI5cZMg.cjs';
+import { D as DBClient } from './endpoint-Cn3ICGTf.cjs';
 
 /** On delete action for foreign key references. */
 type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
+/**
+ * The ON DELETE actions permitted on a foreign key to the built-in auth users
+ * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached
+ * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK
+ * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the
+ * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real
+ * boundary, this narrows the type so the common mistake is caught at compile time.
+ */
+type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
 /** Column type identifiers. */
 type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum';
 /** Base column definition shared by all column types. */
@@ -73,11 +82,37 @@ declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean
      * `auth.users` lives in the SAME tenant database (palauth-owned), so this is
      * a genuine cross-schema integrity constraint scoped to THIS tenant's users.
      * The referenced `auth.users.id` is `text` (palauth ids are `usr_<uuid>`), so
-     * the referencing column must be `text()` too. Combine with `.onDelete(...)`
-     * for cascade behaviour, e.g. a `user_id` column defined as
-     * `text().notNull().referencesAuthUser().onDelete("cascade")`.
+     * the referencing column must be `text()` too.
+     *
+     * ON DELETE is REQUIRED here and may only be `cascade` or `set null`: an
+     * account-erasure request must never be blocked by a lingering FK, so
+     * `restrict` / `no action` are not accepted (they don't type-check). Example:
+     * `text().notNull().referencesAuthUser("cascade")`, or
+     * `text().nullable().referencesAuthUser("set null")`. The server
+     * (validateAuthUserFK) enforces this — and the remaining rules the type can't
+     * express (referencing column is text, `set null` needs a nullable column) —
+     * as the real boundary; this signature is the compile-time DX mirror.
+     */
+    referencesAuthUser(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
+    /**
+     * Add a real DB-level foreign key to the canonical, server-minted installation
+     * anchor (`REFERENCES auth.installations(id)`) — the app-scoped verified-device
+     * root (`ins_...`). Sugar for `.references("auth.installations", "id")`.
+     *
+     * An installation is an APP INSTALL, not a user: this FK is NOT user ownership.
+     * A user-owned row STILL needs its own `.referencesAuthUser(...)` FK so account
+     * erasure removes it — an installation reference alone does not tie a row to a
+     * user's deletion. Use this only for install-scoped state (device prefs, push
+     * routing, …), alongside a separate auth-user FK where the row is user-owned.
+     *
+     * `auth.installations` lives in the SAME tenant DB (palauth-owned); its `id` is
+     * `text` (`ins_<uuid>`), so the referencing column must be `text()` too. ON
+     * DELETE is REQUIRED and may only be `cascade` or `set null` (same allowed set
+     * as an auth-user FK): an installation revoke / orphan cleanup must never be
+     * blocked by a lingering FK. The server (validateAuthAnchorFK) is the real
+     * boundary; this signature is the compile-time DX mirror.
      */
-    referencesAuthUser(): ColumnBuilder<K, N, D, E, P>;
+    referencesInstallation(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
     /** Set the ON DELETE action for a foreign key reference. */
     onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P>;
     /** Add a single-column UNIQUE constraint. */

package/dist/{index--dH5i4Nu.d.ts → index-V0ealeY-.d.ts}

@@ -1,8 +1,17 @@
 import { Tables, TableTypes } from './db/env.js';
-import { D as DBClient } from './endpoint-CGI5cZMg.js';
+import { D as DBClient } from './endpoint-Cn3ICGTf.js';
 
 /** On delete action for foreign key references. */
 type OnDeleteAction = 'cascade' | 'set null' | 'restrict' | 'no action';
+/**
+ * The ON DELETE actions permitted on a foreign key to the built-in auth users
+ * (`auth.users`). Both let a user's rows be removed (`cascade`) or detached
+ * (`set null`) when the account is erased; `restrict` / `no action` would BLOCK
+ * erasure and are therefore excluded. This is the CLIENT-SIDE mirror of the
+ * server's auth-FK deletion policy — the server (validateAuthUserFK) is the real
+ * boundary, this narrows the type so the common mistake is caught at compile time.
+ */
+type AuthUserOnDelete = Extract<OnDeleteAction, 'cascade' | 'set null'>;
 /** Column type identifiers. */
 type ColumnType = 'uuid' | 'text' | 'integer' | 'bigint' | 'numeric' | 'boolean' | 'timestamp' | 'jsonb' | 'enum';
 /** Base column definition shared by all column types. */
@@ -73,11 +82,37 @@ declare class ColumnBuilder<K extends ColumnType = ColumnType, N extends boolean
      * `auth.users` lives in the SAME tenant database (palauth-owned), so this is
      * a genuine cross-schema integrity constraint scoped to THIS tenant's users.
      * The referenced `auth.users.id` is `text` (palauth ids are `usr_<uuid>`), so
-     * the referencing column must be `text()` too. Combine with `.onDelete(...)`
-     * for cascade behaviour, e.g. a `user_id` column defined as
-     * `text().notNull().referencesAuthUser().onDelete("cascade")`.
+     * the referencing column must be `text()` too.
+     *
+     * ON DELETE is REQUIRED here and may only be `cascade` or `set null`: an
+     * account-erasure request must never be blocked by a lingering FK, so
+     * `restrict` / `no action` are not accepted (they don't type-check). Example:
+     * `text().notNull().referencesAuthUser("cascade")`, or
+     * `text().nullable().referencesAuthUser("set null")`. The server
+     * (validateAuthUserFK) enforces this — and the remaining rules the type can't
+     * express (referencing column is text, `set null` needs a nullable column) —
+     * as the real boundary; this signature is the compile-time DX mirror.
+     */
+    referencesAuthUser(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
+    /**
+     * Add a real DB-level foreign key to the canonical, server-minted installation
+     * anchor (`REFERENCES auth.installations(id)`) — the app-scoped verified-device
+     * root (`ins_...`). Sugar for `.references("auth.installations", "id")`.
+     *
+     * An installation is an APP INSTALL, not a user: this FK is NOT user ownership.
+     * A user-owned row STILL needs its own `.referencesAuthUser(...)` FK so account
+     * erasure removes it — an installation reference alone does not tie a row to a
+     * user's deletion. Use this only for install-scoped state (device prefs, push
+     * routing, …), alongside a separate auth-user FK where the row is user-owned.
+     *
+     * `auth.installations` lives in the SAME tenant DB (palauth-owned); its `id` is
+     * `text` (`ins_<uuid>`), so the referencing column must be `text()` too. ON
+     * DELETE is REQUIRED and may only be `cascade` or `set null` (same allowed set
+     * as an auth-user FK): an installation revoke / orphan cleanup must never be
+     * blocked by a lingering FK. The server (validateAuthAnchorFK) is the real
+     * boundary; this signature is the compile-time DX mirror.
      */
-    referencesAuthUser(): ColumnBuilder<K, N, D, E, P>;
+    referencesInstallation(onDelete: AuthUserOnDelete): ColumnBuilder<K, N, D, E, P>;
     /** Set the ON DELETE action for a foreign key reference. */
     onDelete(action: OnDeleteAction): ColumnBuilder<K, N, D, E, P>;
     /** Add a single-column UNIQUE constraint. */