@rebasepro/server-core 0.6.0 → 0.7.0

package/dist/api/server.d.ts

@@ -1,40 +0,0 @@
-import { Hono } from "hono";
-import { DataDriver } from "@rebasepro/types";
-import { ApiConfig, HonoEnv } from "./types";
-/**
- * Simplified API server that leverages existing Rebase infrastructure
- * Can be used standalone or mounted on existing Hono app
- */
-export declare class RebaseApiServer {
-    private app;
-    private router;
-    private config;
-    private driver;
-    private constructor();
-    /**
-     * Factory method to create an asynchronously initialized ApiServer instance
-     */
-    static create(config: ApiConfig & {
-        driver: DataDriver;
-    }): Promise<RebaseApiServer>;
-    /**
-     * Setup Hono middleware
-     */
-    private setupMiddleware;
-    /**
-     * Setup API routes using existing services
-     */
-    private setupRoutes;
-    /**
-     * Get the Hono router with all API routes
-     */
-    getRouter(): Hono<HonoEnv>;
-    /**
-     * Get the standalone Hono app
-     */
-    getApp(): Hono<HonoEnv>;
-    /**
-     * Start the server (standalone mode) via @hono/node-server
-     */
-    listen(port?: number, callback?: () => void): void;
-}

package/dist/api/types.d.ts

@@ -1,98 +0,0 @@
-import { EntityCollection, VectorSearchParams, LogicalCondition } from "@rebasepro/types";
-import { AuthResult } from "../auth/middleware";
-import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { DataDriver } from "@rebasepro/types";
-import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
-/**
- * Hono Environment Variables
- * Passed to generic Hono<HonoEnv> to type `c.get()`
- */
-export type HonoEnv = {
-    Variables: {
-        user?: AuthResult | {
-            userId?: string;
-            roles?: string[];
-        };
-        driver?: DataDriver;
-        /** Set when the request is authenticated via a Service API Key. */
-        apiKey?: ApiKeyMasked;
-        /** Unique request correlation ID (generated or propagated from X-Request-ID header). */
-        requestId?: string;
-    };
-};
-/**
- * Configuration for API generation
- */
-/**
- * Configuration for API generation
- */
-export interface ApiConfig {
-    collections?: EntityCollection[];
-    collectionsDir?: string;
-    basePath?: string;
-    enableGraphQL?: boolean;
-    enableREST?: boolean;
-    cors?: {
-        origin?: string | string[] | boolean;
-        credentials?: boolean;
-    };
-    /** Whether auth is required for API endpoints (default: true) */
-    requireAuth?: boolean;
-    /** Optional custom validator for authentication */
-    authValidator?: (c: import("hono").Context<import("./types").HonoEnv>) => Promise<AuthResult>;
-    pagination?: {
-        defaultLimit: number;
-        maxLimit: number;
-    };
-}
-/**
- * Context passed to resolvers and handlers
- */
-export interface ApiContext {
-    user?: AuthResult;
-    collections: Map<string, EntityCollection>;
-    db: NodePgDatabase;
-}
-/**
- * Standard API response format
- */
-export interface ApiResponse<T = unknown> {
-    data?: T;
-    error?: {
-        message: string;
-        code?: string;
-        details?: unknown;
-    };
-    meta?: {
-        total?: number;
-        page?: number;
-        limit?: number;
-        hasMore?: boolean;
-    };
-}
-/**
- * Query options for API endpoints
- */
-export interface QueryOptions {
-    limit?: number;
-    offset?: number;
-    where?: Record<string, unknown>;
-    logical?: LogicalCondition;
-    orderBy?: Array<{
-        field: string;
-        direction: "asc" | "desc";
-    }>;
-    include?: string[];
-    /** Columns to return in the response (field-level selection) */
-    fields?: string[];
-    /** Vector similarity search configuration */
-    vectorSearch?: VectorSearchParams;
-}
-/**
- * Relation resolution configuration
- */
-export interface RelationConfig {
-    relationName: string;
-    depth?: number;
-    include?: string[];
-}

package/dist/auth/adapter-middleware.d.ts

@@ -1,37 +0,0 @@
-/**
- * Adapter Auth Middleware
- *
- * Creates a Hono middleware that delegates authentication to an `AuthAdapter`
- * instead of hardcoded JWT verification. This is used when the user passes
- * an `AuthAdapter` to `initializeRebaseBackend()`.
- *
- * The middleware:
- * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
- * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
- * 3. Scopes the DataDriver via `withAuth()` for RLS
- * 4. Enforces auth (401) when `requireAuth` is true and no user is found
- *
- * The behavior is identical to `createAuthMiddleware()` — only the
- * token verification strategy is pluggable.
- */
-import type { MiddlewareHandler } from "hono";
-import type { DataDriver, AuthAdapter } from "@rebasepro/types";
-import type { HonoEnv } from "../api/types";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
-export interface AdapterAuthMiddlewareOptions {
-    /** The auth adapter to delegate verification to. */
-    adapter: AuthAdapter;
-    /** The DataDriver to scope via withAuth() for RLS. */
-    driver: DataDriver;
-    /**
-     * If true, return 401 when no valid user is resolved.
-     * Defaults to `true` (secure by default).
-     */
-    requireAuth?: boolean;
-    /** Optional API key store — when provided, `rk_` bearer tokens are accepted. */
-    apiKeyStore?: ApiKeyStore;
-}
-/**
- * Create a Hono middleware that uses an `AuthAdapter` for request verification.
- */
-export declare function createAdapterAuthMiddleware(options: AdapterAuthMiddlewareOptions): MiddlewareHandler<HonoEnv>;

package/dist/auth/admin-user-ops.d.ts

@@ -1,79 +0,0 @@
-/**
- * Admin User Operations
- *
- * Shared utilities and orchestration for admin-initiated user management
- * (user creation via REST API, password reset via admin panel).
- *
- * Hook resolution order:
- * 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
- * 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
- * 3. Built-in default — framework fallback
- */
-import type { AuthRepository } from "./interfaces";
-import type { EmailService, EmailConfig } from "../email";
-import type { ResolvedAuthHooks } from "./auth-hooks";
-import type { AuthCollectionConfig } from "@rebasepro/types";
-/**
- * Generate a cryptographically secure random password that meets strength requirements.
- *
- * 16 characters, guaranteed at least one uppercase, one lowercase, one digit.
- * Ambiguous characters (0, O, 1, l, I) are excluded.
- */
-export declare function generateSecurePassword(): string;
-/**
- * Generate a cryptographically secure random token (80 hex characters).
- */
-export declare function generateSecureToken(): string;
-/**
- * Hash a token for database storage using SHA-256.
- */
-export declare function hashToken(token: string): string;
-/**
- * Context needed by admin user creation / password reset operations.
- */
-export interface AdminUserContext {
-    authRepo: AuthRepository;
-    emailService?: EmailService;
-    emailConfig?: EmailConfig;
-    resolvedHooks: ResolvedAuthHooks;
-    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
-    collectionAuthConfig?: AuthCollectionConfig;
-}
-/**
- * Result of preparing user values for admin-initiated creation.
- */
-export interface AdminUserPrepareResult {
-    /** Values ready for `driver.saveEntity()`. */
-    values: Record<string, unknown>;
-    /** The cleartext password (for returning to admin or sending via email). */
-    clearPassword?: string;
-    /** Whether the hook already handled the invitation email. */
-    hookHandledEmail: boolean;
-    /** Whether an invitation was sent (only relevant when hookHandledEmail is true). */
-    invitationSent: boolean;
-}
-/**
- * Prepare user values for an admin-initiated user creation.
- *
- * Resolution order:
- * 1. Collection-level `auth.onCreateUser` — closest to the data
- * 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
- * 3. Built-in default — generate password → hash → normalize email
- *
- * The caller is responsible for persisting (via `driver.saveEntity()`).
- */
-export declare function prepareAdminUserValues(body: Record<string, unknown>, ctx: AdminUserContext): Promise<AdminUserPrepareResult>;
-/**
- * Handle post-creation work for admin-created users.
- *
- * Sends an invitation email (password-reset link) if email is configured
- * and no explicit password was provided. Falls back to returning the
- * temporary password if email fails or is not configured.
- */
-export declare function finalizeAdminUserCreation(entity: {
-    id: string;
-    values: Record<string, unknown>;
-}, clearPassword: string | undefined, ctx: AdminUserContext): Promise<{
-    temporaryPassword?: string;
-    invitationSent: boolean;
-}>;

package/dist/auth/api-keys/api-key-middleware.d.ts

@@ -1,39 +0,0 @@
-/**
- * Hono middleware for authenticating requests via Service API Keys.
- *
- * This middleware is integrated into `createAuthMiddleware()` and
- * activates only when the bearer token starts with `rk_`. It:
- *
- * 1. Hashes the token with SHA-256
- * 2. Looks up the hash in the `rebase.api_keys` table
- * 3. Validates the key is not revoked and not expired
- * 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
- * 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
- *
- * @module
- */
-import type { Context } from "hono";
-import type { DataDriver } from "@rebasepro/types";
-import type { HonoEnv } from "../../api/types";
-import type { ApiKeyStore } from "./api-key-store";
-/**
- * Check whether a token looks like a Rebase API key.
- */
-export declare function isApiKeyToken(token: string): boolean;
-/**
- * Options for the API key authentication handler.
- */
-export interface ApiKeyAuthOptions {
-    store: ApiKeyStore;
-    driver: DataDriver;
-}
-/**
- * Validate an API key token and populate the Hono context.
- *
- * Returns `true` if the key is valid and context has been populated,
- * or returns an error Response if the key is invalid.
- *
- * This is NOT a standalone middleware — it's called from within
- * `createAuthMiddleware()` when a `rk_` prefixed token is detected.
- */
-export declare function validateApiKey(c: Context<HonoEnv>, token: string, options: ApiKeyAuthOptions): Promise<Response | true>;

package/dist/auth/api-keys/api-key-permission-guard.d.ts

@@ -1,32 +0,0 @@
-/**
- * Permission guard for Service API Keys.
- *
- * Checks whether an API key's permission set allows a specific operation
- * on a specific collection. Used by the REST API generator middleware to
- * enforce fine-grained access control.
- *
- * @module
- */
-import type { ApiKeyPermission } from "./api-key-types";
-/** Operations that map to HTTP methods. */
-export type ApiKeyOperation = "read" | "write" | "delete";
-/**
- * Map an HTTP method string to an `ApiKeyOperation`.
- *
- * - `GET`, `HEAD`, `OPTIONS` → `"read"`
- * - `POST`, `PUT`, `PATCH`  → `"write"`
- * - `DELETE`                → `"delete"`
- */
-export declare function httpMethodToOperation(method: string): ApiKeyOperation;
-/**
- * Check whether the given permissions array allows `operation` on `collection`.
- *
- * Supports the `"*"` wildcard for the collection field, which matches any
- * collection. Returns `true` if at least one permission entry grants access.
- *
- * @param permissions - The API key's permission entries.
- * @param collection  - The target collection slug.
- * @param operation   - The requested operation.
- * @returns `true` if the operation is permitted.
- */
-export declare function isOperationAllowed(permissions: ApiKeyPermission[], collection: string, operation: ApiKeyOperation): boolean;

package/dist/auth/api-keys/api-key-routes.d.ts

@@ -1,20 +0,0 @@
-/**
- * Admin routes for managing Service API Keys.
- *
- * Mounted under `/api/admin/api-keys` with `requireAuth` + `requireAdmin`.
- * All routes return masked keys (never the hash). The full plaintext key
- * is returned exactly once in the POST response.
- *
- * @module
- */
-import { Hono } from "hono";
-import type { HonoEnv } from "../../api/types";
-import type { ApiKeyStore } from "./api-key-store";
-export interface ApiKeyRouteOptions {
-    store: ApiKeyStore;
-    serviceKey?: string;
-}
-/**
- * Create admin routes for API key management.
- */
-export declare function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv>;

package/dist/auth/api-keys/api-key-store.d.ts

@@ -1,35 +0,0 @@
-/**
- * Database operations for Service API Keys.
- *
- * Uses the DataDriver's `admin.executeSql` capability (same pattern as
- * the cron-store and ensure-tables modules). All data lives in the
- * `rebase.api_keys` table.
- *
- * @module
- */
-import type { DataDriver } from "@rebasepro/types";
-import type { ApiKey, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
-export interface ApiKeyStore {
-    /** Ensure the `rebase.api_keys` table exists. Called once on startup. */
-    ensureTable(): Promise<void>;
-    /** Create a new API key. Returns the full plaintext key exactly once. */
-    createApiKey(request: CreateApiKeyRequest, createdBy: string): Promise<ApiKeyWithSecret>;
-    /** Look up an API key by its SHA-256 hash. Returns `null` if not found. */
-    findByKeyHash(hash: string): Promise<ApiKey | null>;
-    /** List all API keys (masked, never includes hash). */
-    listApiKeys(): Promise<ApiKeyMasked[]>;
-    /** Get a single API key by ID (masked). */
-    getApiKeyById(id: string): Promise<ApiKeyMasked | null>;
-    /** Update name, permissions, rate_limit, or expires_at. */
-    updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null>;
-    /** Soft-delete: set `revoked_at` to now. */
-    revokeApiKey(id: string): Promise<boolean>;
-    /** Touch `last_used_at` to the current timestamp. */
-    updateLastUsed(id: string): Promise<void>;
-}
-/**
- * Create an `ApiKeyStore` backed by the driver's SQL admin capability.
- *
- * Returns `undefined` if the driver does not support `executeSql`.
- */
-export declare function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined;

package/dist/auth/api-keys/api-key-types.d.ts

@@ -1,88 +0,0 @@
-/**
- * Type definitions for Service API Keys.
- *
- * API keys provide machine-to-machine authentication for scripts, cron jobs,
- * and third-party integrations. Each key is scoped to specific collections
- * and operations via the `ApiKeyPermission` model.
- *
- * @module
- */
-/**
- * A single permission entry scoping an API key to a collection and set of operations.
- *
- * Use `"*"` as the collection value to grant access to all collections.
- */
-export interface ApiKeyPermission {
-    /** Collection slug, or `"*"` for all collections. */
-    collection: string;
-    /** Allowed operations on the collection. */
-    operations: ("read" | "write" | "delete")[];
-}
-/**
- * Full database row for an API key.
- * The `key_hash` is never exposed via the API — only stored for lookup.
- */
-export interface ApiKey {
-    id: string;
-    name: string;
-    /** First 12 characters of the plaintext key, for display only. */
-    key_prefix: string;
-    /** SHA-256 hash of the full plaintext key. */
-    key_hash: string;
-    permissions: ApiKeyPermission[];
-    /** Requests per 15-minute window. `null` means unlimited. */
-    rate_limit: number | null;
-    created_by: string;
-    created_at: string;
-    updated_at: string;
-    last_used_at: string | null;
-    expires_at: string | null;
-    revoked_at: string | null;
-}
-/**
- * Masked version of an API key, safe for API responses.
- * Omits `key_hash` and shows only the prefix.
- */
-export interface ApiKeyMasked {
-    id: string;
-    name: string;
-    key_prefix: string;
-    permissions: ApiKeyPermission[];
-    rate_limit: number | null;
-    created_by: string;
-    created_at: string;
-    updated_at: string;
-    last_used_at: string | null;
-    expires_at: string | null;
-    revoked_at: string | null;
-}
-/**
- * Request body for creating a new API key.
- */
-export interface CreateApiKeyRequest {
-    name: string;
-    permissions: ApiKeyPermission[];
-    /** Requests per 15-minute window. Omit or `null` for unlimited. */
-    rate_limit?: number | null;
-    /** ISO-8601 expiration timestamp. Omit for no expiration. */
-    expires_at?: string | null;
-}
-/**
- * Request body for updating an existing API key.
- * All fields are optional — only provided fields are updated.
- */
-export interface UpdateApiKeyRequest {
-    name?: string;
-    permissions?: ApiKeyPermission[];
-    rate_limit?: number | null;
-    expires_at?: string | null;
-}
-/**
- * Returned exactly once when a key is created.
- * The `key` field contains the full plaintext key — it is never stored
- * or returned again after creation.
- */
-export interface ApiKeyWithSecret extends ApiKeyMasked {
-    /** Full plaintext API key (e.g. `rk_live_abc123...`). */
-    key: string;
-}

package/dist/auth/api-keys/index.d.ts

@@ -1,17 +0,0 @@
-/**
- * Service API Keys module.
- *
- * Re-exports types, store, middleware, permission guard, and routes
- * for the API key authentication system.
- *
- * @module
- */
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
-export { createApiKeyStore } from "./api-key-store";
-export type { ApiKeyStore } from "./api-key-store";
-export { isApiKeyToken, validateApiKey } from "./api-key-middleware";
-export type { ApiKeyAuthOptions } from "./api-key-middleware";
-export { httpMethodToOperation, isOperationAllowed } from "./api-key-permission-guard";
-export type { ApiKeyOperation } from "./api-key-permission-guard";
-export { createApiKeyRoutes } from "./api-key-routes";
-export type { ApiKeyRouteOptions } from "./api-key-routes";

package/dist/auth/apple-oauth.d.ts

@@ -1,30 +0,0 @@
-import type { OAuthProvider } from "./interfaces";
-/**
- * Creates an Apple Sign In OAuth Provider integration.
- *
- * Apple requires a client secret that is a signed JWT, regenerated on each
- * token exchange (valid up to 6 months). This provider handles that automatically.
- *
- * Required Apple Developer configuration:
- * - Services ID (clientId)
- * - Key ID from the private key registered with Apple
- * - Team ID from Apple Developer account
- * - Private key (.p8 file contents) downloaded from Apple Developer portal
- */
-export declare function createAppleProvider(config: {
-    clientId: string;
-    teamId: string;
-    keyId: string;
-    /** The raw PEM contents of the .p8 private key file */
-    privateKey: string;
-}): OAuthProvider<{
-    code: string;
-    redirectUri: string;
-    user?: {
-        name?: {
-            firstName?: string;
-            lastName?: string;
-        };
-        email?: string;
-    };
-}>;