@rebasepro/server-core 0.7.0 → 0.8.0

package/build-errors.txt

@@ -0,0 +1,52 @@
+
+> @rebasepro/server-core@0.0.1 build /Users/francesco/rebase/packages/server-core
+> vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json
+
+vite v5.4.21 building for production...
+transforming...
+✓ 1641 modules transformed.
+rendering chunks...
+computing gzip size...
+dist/index.es.js            1.68 kB │ gzip:   0.80 kB │ map:     0.09 kB
+dist/index-CvlusawO.js      8.86 kB │ gzip:   2.11 kB │ map:    16.79 kB
+dist/index-BGGPU0RK.js  1,946.14 kB │ gzip: 411.28 kB │ map: 4,292.57 kB
+dist/index.umd.js  2,070.48 kB │ gzip: 419.31 kB │ map: 4,326.51 kB
+✓ built in 2.97s
+src/api/graphql/graphql-schema-generator.ts(65,34): error TS18046: 'source' is of type 'unknown'.
+src/api/graphql/graphql-schema-generator.ts(72,51): error TS18046: 'source' is of type 'unknown'.
+src/api/graphql/graphql-schema-generator.ts(136,13): error TS2322: Type 'Record<string, unknown>' is not assignable to type 'ThunkObjMap<GraphQLInputFieldConfig>'.
+src/api/graphql/graphql-schema-generator.ts(178,17): error TS2322: Type '(_: unknown, args: any, context: { driver: DataDriver; }) => Promise<Entity<Record<string, unknown>> | undefined>' is not assignable to type 'GraphQLFieldResolver<unknown, unknown, any, unknown>'.
+  Types of parameters 'context' and 'context' are incompatible.
+    Type 'unknown' is not assignable to type '{ driver: DataDriver; }'.
+src/api/graphql/graphql-schema-generator.ts(198,17): error TS2322: Type '(_: unknown, args: any, context: { driver: DataDriver; }) => Promise<Entity<Record<string, unknown>>[]>' is not assignable to type 'GraphQLFieldResolver<unknown, unknown, any, unknown>'.
+  Types of parameters 'context' and 'context' are incompatible.
+    Type 'unknown' is not assignable to type '{ driver: DataDriver; }'.
+src/api/graphql/graphql-schema-generator.ts(249,17): error TS2322: Type '(_: unknown, args: any, context: { driver: DataDriver; }) => Promise<Entity<Record<string, unknown>>>' is not assignable to type 'GraphQLFieldResolver<unknown, unknown, any, unknown>'.
+  Types of parameters 'context' and 'context' are incompatible.
+    Type 'unknown' is not assignable to type '{ driver: DataDriver; }'.
+src/api/graphql/graphql-schema-generator.ts(269,17): error TS2322: Type '(_: unknown, args: any, context: { driver: DataDriver; }) => Promise<Entity<Record<string, unknown>>>' is not assignable to type 'GraphQLFieldResolver<unknown, unknown, any, unknown>'.
+  Types of parameters 'context' and 'context' are incompatible.
+    Type 'unknown' is not assignable to type '{ driver: DataDriver; }'.
+src/api/graphql/graphql-schema-generator.ts(288,17): error TS2322: Type '(_: unknown, args: any, context: { driver: DataDriver; }) => Promise<boolean>' is not assignable to type 'GraphQLFieldResolver<unknown, unknown, any, unknown>'.
+  Types of parameters 'context' and 'context' are incompatible.
+    Type 'unknown' is not assignable to type '{ driver: DataDriver; }'.
+src/api/rest/api-generator.ts(90,63): error TS18046: 'entities' is of type 'unknown'.
+src/collections/BackendCollectionRegistry.ts(18,9): error TS2322: Type '{}[]' is not assignable to type 'string[]'.
+  Type '{}' is not assignable to type 'string'.
+src/functions/function-loader.ts(10,15): error TS2344: Type 'unknown' does not satisfy the constraint 'Env'.
+src/functions/function-routes.ts(27,37): error TS2345: Argument of type 'Hono<unknown, BlankSchema, "/">' is not assignable to parameter of type 'Hono<Env, BlankSchema, "/", "/">'.
+  The types of 'get(...).get' are incompatible between these types.
+    Type 'HandlerInterface<unknown, "get", BlankSchema, "/", any>' is not assignable to type 'HandlerInterface<Env, "get", BlankSchema, "/", any>'.
+      Types of parameters 'handlers' and 'handlers' are incompatible.
+        Type 'H<Env, any, any, any>' is not assignable to type 'H<unknown, any, any, any>'.
+          Type 'Handler<Env, any, any, any>' is not assignable to type 'H<unknown, any, any, any>'.
+            Type 'Handler<Env, any, any, any>' is not assignable to type 'Handler<unknown, any, any, any>'.
+              Types of parameters 'c' and 'c' are incompatible.
+                Type 'Context<unknown, any, any>' is not assignable to type 'Context<Env, any, any>'.
+                  Types of property 'env' are incompatible.
+                    Type 'unknown' is not assignable to type 'object | undefined'.
+src/history/history-routes.ts(48,30): error TS18046: 'historyService' is of type 'unknown'.
+src/history/history-routes.ts(87,36): error TS18046: 'historyService' is of type 'unknown'.
+src/serve-spa.ts(38,36): error TS2344: Type 'unknown' does not satisfy the constraint 'Env'.
+src/storage/LocalStorageController.ts(346,33): error TS2339: Property 'code' does not exist on type '{}'.
+ ELIFECYCLE  Command failed with exit code 2.

package/dist/api/ast-schema-editor.d.ts

@@ -0,0 +1,21 @@
+export declare class AstSchemaEditor {
+    private project;
+    private collectionsDir;
+    constructor(collectionsDir: string);
+    /**
+     * Sanitize collectionId to prevent path traversal attacks.
+     * Only allows alphanumeric characters, underscores, and hyphens.
+     */
+    private sanitizeCollectionId;
+    /**
+     * Resolve a file path and ensure it falls within the collectionsDir.
+     */
+    private safePath;
+    private getCollectionFile;
+    private getCollectionObject;
+    private convertJsonToAstString;
+    saveProperty(collectionId: string, propertyKey: string, propertyConfig: Record<string, unknown>): Promise<void>;
+    deleteProperty(collectionId: string, propertyKey: string): Promise<void>;
+    saveCollection(collectionId: string, collectionData: Record<string, unknown>): Promise<void>;
+    deleteCollection(collectionId: string): Promise<void>;
+}

package/dist/api/collections_for_test/callbacks_test_collection.d.ts

@@ -0,0 +1,2 @@
+import { PostgresCollection } from "@rebasepro/types";
+export declare const callbacksTestCollection: PostgresCollection;

package/dist/api/errors.d.ts

@@ -0,0 +1,53 @@
+import type { ErrorHandler } from "hono";
+import type { HonoEnv } from "./types";
+/**
+ * Standardized API error class.
+ * Throw this from any route handler — the errorHandler middleware
+ * will format it into `{ error: { message, code, details? } }`.
+ */
+export declare class ApiError extends Error {
+    readonly statusCode: number;
+    readonly code: string;
+    readonly details?: unknown;
+    constructor(statusCode: number, code: string, message: string, details?: unknown);
+    static badRequest(message: string, code?: string, details?: unknown): ApiError;
+    static unauthorized(message: string, code?: string): ApiError;
+    static forbidden(message: string, code?: string): ApiError;
+    static notFound(message: string, code?: string): ApiError;
+    static conflict(message: string, code?: string): ApiError;
+    static internal(message: string, code?: string): ApiError;
+    static serviceUnavailable(message: string, code?: string): ApiError;
+}
+/**
+ * Canonical error response shape:
+ * `{ error: { message: string, code: string, details?: unknown } }`
+ */
+export interface ErrorResponse {
+    error: {
+        message: string;
+        code: string;
+        details?: unknown;
+        /** Request correlation ID for tracing (echoes X-Request-ID). */
+        requestId?: string;
+    };
+}
+/**
+ * General shape of errors that flow through the API error handler.
+ * Extends Error with optional HTTP status, error code, and details.
+ */
+export interface RebaseApiError extends Error {
+    statusCode?: number;
+    code?: string;
+    details?: unknown;
+}
+/**
+ * Type guard for errors that carry optional API metadata (statusCode, code, details).
+ * Returns true for any Error instance — the optional properties are then
+ * checked via normal property access.
+ */
+export declare function isRebaseApiError(error: unknown): error is RebaseApiError;
+/**
+ * Hono error-handling middleware (`app.onError`).
+ * Converts any error into the canonical `{ error: { message, code } }` shape.
+ */
+export declare const errorHandler: ErrorHandler<HonoEnv>;

package/dist/api/graphql/graphql-schema-generator.d.ts

@@ -0,0 +1,44 @@
+import { GraphQLSchema } from "graphql";
+import { DataDriver, EntityCollection } from "@rebasepro/types";
+/**
+ * Lightweight GraphQL schema generator that leverages existing DataDriver
+ * No duplication - uses your existing data layer and services
+ */
+export declare class GraphQLSchemaGenerator {
+    private collections;
+    private driver;
+    private typeRegistry;
+    private inputTypeRegistry;
+    constructor(collections: EntityCollection[], driver: DataDriver);
+    /**
+     * Enforce API key permission scoping for a GraphQL resolver.
+     *
+     * Extracts the `apiKey` from the Hono context passed by `@hono/graphql-server`.
+     * If the request was made with an API key and the key does not have the
+     * required permission for the target collection/operation, an error is thrown.
+     * Non-API-key requests (e.g. session auth) are allowed through.
+     */
+    private enforceApiKeyPermission;
+    /**
+     * Generate complete GraphQL schema using existing DataDriver
+     */
+    generateSchema(): GraphQLSchema;
+    /**
+     * Create GraphQL type for an entity collection
+     */
+    private createEntityType;
+    private convertPropertyToField;
+    private createInputType;
+    private convertPropertyToInputType;
+    /**
+     * Create Query type using existing DataDriver methods
+     */
+    private createQueryType;
+    /**
+     * Create Mutation type using existing DataDriver methods
+     */
+    private createMutationType;
+    private getTypeName;
+    private getSingleQueryName;
+    private getListQueryName;
+}

package/dist/api/graphql/index.d.ts

@@ -0,0 +1 @@
+export * from "./graphql-schema-generator";

package/dist/api/index.d.ts

@@ -0,0 +1,9 @@
+/**
+ * API generation infrastructure for Rebase
+ * Automatically generates GraphQL and REST APIs from EntityCollection definitions
+ */
+export * from "./graphql";
+export * from "./rest";
+export * from "./types";
+export * from "./errors";
+export * from "./server";

package/dist/api/logs-routes.d.ts

@@ -0,0 +1,37 @@
+import { Hono } from "hono";
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "./types";
+export interface LogEntry {
+    id: string;
+    timestamp: string;
+    level: "debug" | "info" | "warn" | "error";
+    source: "api" | "auth" | "storage" | "realtime" | "system";
+    message: string;
+    metadata?: Record<string, unknown>;
+}
+declare class LogRingBuffer {
+    private buffer;
+    private maxSize;
+    private idCounter;
+    constructor(maxSize?: number);
+    push(entry: Omit<LogEntry, "id">): void;
+    query(options: {
+        level?: string;
+        source?: string;
+        search?: string;
+        limit?: number;
+        offset?: number;
+        since?: string;
+    }): {
+        entries: LogEntry[];
+        total: number;
+    };
+    getLatest(count?: number): LogEntry[];
+}
+export declare const logBuffer: LogRingBuffer;
+/** Add a log entry */
+export declare function addLog(level: LogEntry["level"], source: LogEntry["source"], message: string, metadata?: Record<string, unknown>): void;
+/** Hono middleware to log API requests */
+export declare function logMiddleware(): MiddlewareHandler<HonoEnv>;
+declare const app: Hono<HonoEnv, import("hono/types").BlankSchema, "/">;
+export default app;

package/dist/api/openapi-generator.d.ts

@@ -0,0 +1,16 @@
+import { EntityCollection } from "@rebasepro/types";
+/**
+ * OpenAPI 3.0.3 specification generator.
+ *
+ * Produces a spec that exactly mirrors the REST API consumed by the
+ * Rebase SDK client (`@rebasepro/client`).
+ *
+ * Routes are mounted at `{basePath}/data/{slug}` by `initializeRebaseBackend`.
+ */
+export interface OpenApiGeneratorOptions {
+    /** Base path for the API (e.g. "/api"). Defaults to "/api". */
+    basePath?: string;
+    /** Whether auth is enabled on data routes. Defaults to true. */
+    requireAuth?: boolean;
+}
+export declare function generateOpenApiSpec(collections: EntityCollection[], options?: OpenApiGeneratorOptions): Record<string, unknown>;

package/dist/api/rest/api-generator.d.ts

@@ -0,0 +1,76 @@
+import { Hono } from "hono";
+import { AuthAdapter, DataDriver, EntityCollection } from "@rebasepro/types";
+import { HonoEnv } from "../types";
+/**
+ * Lightweight REST API generator that leverages existing Rebase DataDriver.
+ * Supports `include` query parameter for eager-loading relations via Drizzle.
+ */
+export declare class RestApiGenerator {
+    private collections;
+    private router;
+    private driver;
+    private authAdapter?;
+    constructor(collections: EntityCollection[], driver: DataDriver, authAdapter?: AuthAdapter);
+    /**
+     * Generate REST routes using existing DataDriver
+     */
+    generateRoutes(): Hono<HonoEnv>;
+    /**
+     * Check API key permissions for a collection operation.
+     * Throws 403 if the key doesn't have the required permission.
+     * No-ops if the request is not authenticated via an API key.
+     */
+    private enforceApiKeyPermission;
+    /**
+     * Get the request-scoped driver. Throws if none is set — never falls
+     * back to the unscoped `this.driver` to avoid bypassing RLS/auth.
+     */
+    private getScopedDriver;
+    /**
+     * Get the typed RestFetchService from a driver if it exposes one (for include support).
+     */
+    private getFetchService;
+    /**
+     * Create REST routes for a collection using existing Rebase patterns
+     */
+    private createCollectionRoutes;
+    /**
+     * Catch-all routes for subcollection paths.
+     *
+     * Matches URL patterns like:
+     *   GET    /authors/111094/posts          → list child collection
+     *   GET    /authors/111094/posts/43       → get child entity
+     *   POST   /authors/111094/posts          → create child entity
+     *   PUT    /authors/111094/posts/43       → update child entity
+     *   DELETE /authors/111094/posts/43       → delete child entity
+     *
+     * The `:rest{.+}` regex param captures the full remainder of the URL
+     * path (Hono v4 `*` wildcard does not populate `c.req.param("*")`).
+     * We split it into segments and reconstruct the `collectionPath`
+     * (e.g. "authors/111094/posts") and optional `entityId` (e.g. "43").
+     *
+     * The DataDriver.saveEntity / fetchCollection / etc. already know how to
+     * resolve multi-segment relation paths, so we just forward to them.
+     */
+    private createSubcollectionRoutes;
+    /**
+     * Format successful API response - flattened for traditional REST API
+     */
+    private formatResponse;
+    /**
+     * Flatten Rebase entity structure to traditional REST format
+     */
+    private flattenEntity;
+    /**
+     * Fetch raw collection data without Entity wrapper (fallback for non-Postgres)
+     */
+    private fetchRawCollection;
+    /**
+     * Count raw entities for a collection
+     */
+    private countRawEntities;
+    /**
+     * Fetch single entity raw data without Entity wrapper (fallback)
+     */
+    private fetchRawEntity;
+}

package/dist/api/rest/index.d.ts

@@ -0,0 +1 @@
+export * from "./api-generator";

package/dist/api/rest/query-parser.d.ts

@@ -0,0 +1,8 @@
+import type { LogicalCondition, FilterCondition, WhereFilterOp } from "@rebasepro/types";
+export declare const mapOperator: (op: string) => WhereFilterOp | null;
+import { QueryOptions } from "../types";
+export declare function parseLogicalString(str: string): FilterCondition | LogicalCondition;
+/**
+ * Parse query parameters into QueryOptions
+ */
+export declare function parseQueryOptions(query: Record<string, unknown>): QueryOptions;

package/dist/api/schema-editor-routes.d.ts

@@ -0,0 +1,3 @@
+import { Hono } from "hono";
+import { HonoEnv } from "./types";
+export declare function createSchemaEditorRoutes(collectionsDir: string): Hono<HonoEnv>;

package/dist/api/server.d.ts

@@ -0,0 +1,40 @@
+import { Hono } from "hono";
+import { DataDriver } from "@rebasepro/types";
+import { ApiConfig, HonoEnv } from "./types";
+/**
+ * Simplified API server that leverages existing Rebase infrastructure
+ * Can be used standalone or mounted on existing Hono app
+ */
+export declare class RebaseApiServer {
+    private app;
+    private router;
+    private config;
+    private driver;
+    private constructor();
+    /**
+     * Factory method to create an asynchronously initialized ApiServer instance
+     */
+    static create(config: ApiConfig & {
+        driver: DataDriver;
+    }): Promise<RebaseApiServer>;
+    /**
+     * Setup Hono middleware
+     */
+    private setupMiddleware;
+    /**
+     * Setup API routes using existing services
+     */
+    private setupRoutes;
+    /**
+     * Get the Hono router with all API routes
+     */
+    getRouter(): Hono<HonoEnv>;
+    /**
+     * Get the standalone Hono app
+     */
+    getApp(): Hono<HonoEnv>;
+    /**
+     * Start the server (standalone mode) via @hono/node-server
+     */
+    listen(port?: number, callback?: () => void): void;
+}

package/dist/api/types.d.ts

@@ -0,0 +1,104 @@
+import { EntityCollection, VectorSearchParams, LogicalCondition, FilterValues } from "@rebasepro/types";
+import { AuthResult } from "../auth/middleware";
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { DataDriver } from "@rebasepro/types";
+import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
+/**
+ * Hono Environment Variables
+ * Passed to generic Hono<HonoEnv> to type `c.get()`
+ */
+export type HonoEnv = {
+    Variables: {
+        user?: AuthResult | {
+            userId?: string;
+            roles?: string[];
+        };
+        driver?: DataDriver;
+        /** Set when the request is authenticated via a Service API Key. */
+        apiKey?: ApiKeyMasked;
+        /** Unique request correlation ID (generated or propagated from X-Request-ID header). */
+        requestId?: string;
+    };
+};
+/**
+ * Configuration for API generation
+ */
+/**
+ * Configuration for API generation
+ */
+export interface ApiConfig {
+    collections?: EntityCollection[];
+    collectionsDir?: string;
+    /**
+     * Declared data sources. When provided, collections on a `direct`/`custom`
+     * transport are treated as client-only and no server routes are generated
+     * for them.
+     */
+    dataSources?: import("@rebasepro/types").DataSourceDefinition[];
+    basePath?: string;
+    enableGraphQL?: boolean;
+    enableREST?: boolean;
+    cors?: {
+        origin?: string | string[] | boolean;
+        credentials?: boolean;
+    };
+    /** Whether auth is required for API endpoints (default: true) */
+    requireAuth?: boolean;
+    /** Optional custom validator for authentication */
+    authValidator?: (c: import("hono").Context<import("./types").HonoEnv>) => Promise<AuthResult>;
+    pagination?: {
+        defaultLimit: number;
+        maxLimit: number;
+    };
+}
+/**
+ * Context passed to resolvers and handlers
+ */
+export interface ApiContext {
+    user?: AuthResult;
+    collections: Map<string, EntityCollection>;
+    db: NodePgDatabase;
+}
+/**
+ * Standard API response format
+ */
+export interface ApiResponse<T = unknown> {
+    data?: T;
+    error?: {
+        message: string;
+        code?: string;
+        details?: unknown;
+    };
+    meta?: {
+        total?: number;
+        page?: number;
+        limit?: number;
+        hasMore?: boolean;
+    };
+}
+/**
+ * Query options for API endpoints
+ */
+export interface QueryOptions {
+    limit?: number;
+    offset?: number;
+    where?: FilterValues<string>;
+    logical?: LogicalCondition;
+    orderBy?: Array<{
+        field: string;
+        direction: "asc" | "desc";
+    }>;
+    include?: string[];
+    /** Columns to return in the response (field-level selection) */
+    fields?: string[];
+    /** Vector similarity search configuration */
+    vectorSearch?: VectorSearchParams;
+}
+/**
+ * Relation resolution configuration
+ */
+export interface RelationConfig {
+    relationName: string;
+    depth?: number;
+    include?: string[];
+}

package/dist/auth/adapter-middleware.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Adapter Auth Middleware
+ *
+ * Creates a Hono middleware that delegates authentication to an `AuthAdapter`
+ * instead of hardcoded JWT verification. This is used when the user passes
+ * an `AuthAdapter` to `initializeRebaseBackend()`.
+ *
+ * The middleware:
+ * 1. Checks for API key tokens (`rk_` prefix) first — these are Rebase-level
+ * 2. Falls back to `adapter.verifyRequest(request)` to resolve the user
+ * 3. Scopes the DataDriver via `withAuth()` for RLS
+ * 4. Enforces auth (401) when `requireAuth` is true and no user is found
+ *
+ * The behavior is identical to `createAuthMiddleware()` — only the
+ * token verification strategy is pluggable.
+ */
+import type { MiddlewareHandler, Context } from "hono";
+import type { DataDriver, AuthAdapter } from "@rebasepro/types";
+import type { HonoEnv } from "../api/types";
+import type { ApiKeyStore } from "./api-keys/api-key-store";
+export interface AdapterAuthMiddlewareOptions {
+    /** The auth adapter to delegate verification to. */
+    adapter: AuthAdapter;
+    /** The DataDriver to scope via withAuth() for RLS. */
+    driver: DataDriver;
+    /**
+     * Optional per-request driver resolver for multi-data-source backends.
+     * Returns the unscoped delegate to use for this request (e.g. Postgres vs
+     * Mongo). When omitted, `driver` is used for every request.
+     */
+    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
+    /**
+     * If true, return 401 when no valid user is resolved.
+     * Defaults to `true` (secure by default).
+     */
+    requireAuth?: boolean;
+    /** Optional API key store — when provided, `rk_` bearer tokens are accepted. */
+    apiKeyStore?: ApiKeyStore;
+}
+/**
+ * Create a Hono middleware that uses an `AuthAdapter` for request verification.
+ */
+export declare function createAdapterAuthMiddleware(options: AdapterAuthMiddlewareOptions): MiddlewareHandler<HonoEnv>;

package/dist/auth/admin-roles-route.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Admin endpoint for listing all roles.
+ *
+ * Mounts: GET /roles
+ */
+import { Hono } from "hono";
+import type { AuthRepository } from "./interfaces";
+import type { HonoEnv } from "../api/types";
+export interface AdminRolesRouteConfig {
+    authRepo: AuthRepository;
+    serviceKey?: string;
+}
+/**
+ * Create a standalone admin route for listing roles.
+ *
+ * Mounts: GET /roles
+ */
+export declare function createAdminRolesRoute(config: AdminRolesRouteConfig): Hono<HonoEnv>;

package/dist/auth/admin-user-ops.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Admin User Operations
+ *
+ * Shared utilities and orchestration for admin-initiated user management
+ * (user creation via REST API, password reset via admin panel).
+ *
+ * Hook resolution order:
+ * 1. Collection-level hook (`auth.onCreateUser` on the collection) — closest to the data
+ * 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
+ * 3. Built-in default — framework fallback
+ */
+import type { AuthRepository } from "./interfaces";
+import type { EmailService, EmailConfig } from "../email";
+import type { ResolvedAuthHooks } from "./auth-hooks";
+import type { AuthCollectionConfig } from "@rebasepro/types";
+/**
+ * Generate a cryptographically secure random password that meets strength requirements.
+ *
+ * 16 characters, guaranteed at least one uppercase, one lowercase, one digit.
+ * Ambiguous characters (0, O, 1, l, I) are excluded.
+ */
+export declare function generateSecurePassword(): string;
+/**
+ * Generate a cryptographically secure random token (80 hex characters).
+ */
+export declare function generateSecureToken(): string;
+/**
+ * Hash a token for database storage using SHA-256.
+ */
+export declare function hashToken(token: string): string;
+/**
+ * Context needed by admin user creation / password reset operations.
+ */
+export interface AdminUserContext {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    resolvedHooks: ResolvedAuthHooks;
+    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
+    collectionAuthConfig?: AuthCollectionConfig;
+}
+/**
+ * Result of preparing user values for admin-initiated creation.
+ */
+export interface AdminUserPrepareResult {
+    /** Values ready for `driver.saveEntity()`. */
+    values: Record<string, unknown>;
+    /** The cleartext password (for returning to admin or sending via email). */
+    clearPassword?: string;
+    /** Whether the hook already handled the invitation email. */
+    hookHandledEmail: boolean;
+    /** Whether an invitation was sent (only relevant when hookHandledEmail is true). */
+    invitationSent: boolean;
+}
+/**
+ * Prepare user values for an admin-initiated user creation.
+ *
+ * Resolution order:
+ * 1. Collection-level `auth.onCreateUser` — closest to the data
+ * 2. Backend-level `AuthHooks.onAdminCreateUser` — global override
+ * 3. Built-in default — generate password → hash → normalize email
+ *
+ * The caller is responsible for persisting (via `driver.saveEntity()`).
+ */
+export declare function prepareAdminUserValues(body: Record<string, unknown>, ctx: AdminUserContext): Promise<AdminUserPrepareResult>;
+/**
+ * Handle post-creation work for admin-created users.
+ *
+ * Sends an invitation email (password-reset link) if email is configured
+ * and no explicit password was provided. Falls back to returning the
+ * temporary password if email fails or is not configured.
+ */
+export declare function finalizeAdminUserCreation(entity: {
+    id: string;
+    values: Record<string, unknown>;
+}, clearPassword: string | undefined, ctx: AdminUserContext): Promise<{
+    temporaryPassword?: string;
+    invitationSent: boolean;
+}>;

package/dist/auth/admin-users-route.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Standalone admin endpoint for user management.
+ *
+ * Mounts:
+ *   GET /users
+ *   GET /users/:userId
+ *   POST /users
+ *   PUT /users/:userId
+ *   DELETE /users/:userId
+ *   POST /bootstrap
+ */
+import { Hono } from "hono";
+import type { AuthRepository } from "./interfaces";
+import type { AuthHooks } from "./auth-hooks";
+import type { EmailService, EmailConfig } from "../email";
+import type { HonoEnv } from "../api/types";
+import type { AuthCollectionConfig } from "@rebasepro/types";
+export interface AdminUsersRouteConfig {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    serviceKey?: string;
+    authHooks?: AuthHooks;
+    collectionAuthConfig?: AuthCollectionConfig;
+    isBootstrapCompleted?: () => Promise<boolean>;
+    setBootstrapCompleted?: () => Promise<void>;
+}
+export declare function createAdminUsersRoute(config: AdminUsersRouteConfig): Hono<HonoEnv>;