@rebasepro/server-core 0.7.0 → 0.8.0

package/dist/auth/api-keys/api-key-middleware.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Hono middleware for authenticating requests via Service API Keys.
+ *
+ * This middleware is integrated into `createAuthMiddleware()` and
+ * activates only when the bearer token starts with `rk_`. It:
+ *
+ * 1. Hashes the token with SHA-256
+ * 2. Looks up the hash in the `rebase.api_keys` table
+ * 3. Validates the key is not revoked and not expired
+ * 4. Sets `c.set("user", ...)` and `c.set("apiKey", ...)` for downstream use
+ * 5. Scopes the DataDriver via `withAuth()` using the API key's service identity
+ *
+ * @module
+ */
+import type { Context } from "hono";
+import type { DataDriver } from "@rebasepro/types";
+import type { HonoEnv } from "../../api/types";
+import type { ApiKeyStore } from "./api-key-store";
+/**
+ * Check whether a token looks like a Rebase API key.
+ */
+export declare function isApiKeyToken(token: string): boolean;
+/**
+ * Options for the API key authentication handler.
+ */
+export interface ApiKeyAuthOptions {
+    store: ApiKeyStore;
+    driver: DataDriver;
+}
+/**
+ * Validate an API key token and populate the Hono context.
+ *
+ * Returns `true` if the key is valid and context has been populated,
+ * or returns an error Response if the key is invalid.
+ *
+ * This is NOT a standalone middleware — it's called from within
+ * `createAuthMiddleware()` when a `rk_` prefixed token is detected.
+ */
+export declare function validateApiKey(c: Context<HonoEnv>, token: string, options: ApiKeyAuthOptions): Promise<Response | true>;

package/dist/auth/api-keys/api-key-permission-guard.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Permission guard for Service API Keys.
+ *
+ * Checks whether an API key's permission set allows a specific operation
+ * on a specific collection. Used by the REST API generator middleware to
+ * enforce fine-grained access control.
+ *
+ * @module
+ */
+import type { ApiKeyPermission } from "./api-key-types";
+/** Operations that map to HTTP methods. */
+export type ApiKeyOperation = "read" | "write" | "delete";
+/**
+ * Map an HTTP method string to an `ApiKeyOperation`.
+ *
+ * - `GET`, `HEAD`, `OPTIONS` → `"read"`
+ * - `POST`, `PUT`, `PATCH`  → `"write"`
+ * - `DELETE`                → `"delete"`
+ */
+export declare function httpMethodToOperation(method: string): ApiKeyOperation;
+/**
+ * Check whether the given permissions array allows `operation` on `collection`.
+ *
+ * Supports the `"*"` wildcard for the collection field, which matches any
+ * collection. Returns `true` if at least one permission entry grants access.
+ *
+ * @param permissions - The API key's permission entries.
+ * @param collection  - The target collection slug.
+ * @param operation   - The requested operation.
+ * @returns `true` if the operation is permitted.
+ */
+export declare function isOperationAllowed(permissions: ApiKeyPermission[], collection: string, operation: ApiKeyOperation): boolean;

package/dist/auth/api-keys/api-key-routes.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Admin routes for managing Service API Keys.
+ *
+ * Mounted under `/api/admin/api-keys` with `requireAuth` + `requireAdmin`.
+ * All routes return masked keys (never the hash). The full plaintext key
+ * is returned exactly once in the POST response.
+ *
+ * @module
+ */
+import { Hono } from "hono";
+import type { HonoEnv } from "../../api/types";
+import type { ApiKeyStore } from "./api-key-store";
+export interface ApiKeyRouteOptions {
+    store: ApiKeyStore;
+    serviceKey?: string;
+}
+/**
+ * Create admin routes for API key management.
+ */
+export declare function createApiKeyRoutes(options: ApiKeyRouteOptions): Hono<HonoEnv>;

package/dist/auth/api-keys/api-key-store.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Database operations for Service API Keys.
+ *
+ * Uses the DataDriver's `admin.executeSql` capability (same pattern as
+ * the cron-store and ensure-tables modules). All data lives in the
+ * `rebase.api_keys` table.
+ *
+ * @module
+ */
+import type { DataDriver } from "@rebasepro/types";
+import type { ApiKey, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
+export interface ApiKeyStore {
+    /** Ensure the `rebase.api_keys` table exists. Called once on startup. */
+    ensureTable(): Promise<void>;
+    /** Create a new API key. Returns the full plaintext key exactly once. */
+    createApiKey(request: CreateApiKeyRequest, createdBy: string): Promise<ApiKeyWithSecret>;
+    /** Look up an API key by its SHA-256 hash. Returns `null` if not found. */
+    findByKeyHash(hash: string): Promise<ApiKey | null>;
+    /** List all API keys (masked, never includes hash). */
+    listApiKeys(): Promise<ApiKeyMasked[]>;
+    /** Get a single API key by ID (masked). */
+    getApiKeyById(id: string): Promise<ApiKeyMasked | null>;
+    /** Update name, permissions, rate_limit, or expires_at. */
+    updateApiKey(id: string, updates: UpdateApiKeyRequest): Promise<ApiKeyMasked | null>;
+    /** Soft-delete: set `revoked_at` to now. */
+    revokeApiKey(id: string): Promise<boolean>;
+    /** Touch `last_used_at` to the current timestamp. */
+    updateLastUsed(id: string): Promise<void>;
+}
+/**
+ * Create an `ApiKeyStore` backed by the driver's SQL admin capability.
+ *
+ * Returns `undefined` if the driver does not support `executeSql`.
+ */
+export declare function createApiKeyStore(driver: DataDriver): ApiKeyStore | undefined;

package/dist/auth/api-keys/api-key-types.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Type definitions for Service API Keys.
+ *
+ * API keys provide machine-to-machine authentication for scripts, cron jobs,
+ * and third-party integrations. Each key is scoped to specific collections
+ * and operations via the `ApiKeyPermission` model.
+ *
+ * @module
+ */
+/**
+ * A single permission entry scoping an API key to a collection and set of operations.
+ *
+ * Use `"*"` as the collection value to grant access to all collections.
+ */
+export interface ApiKeyPermission {
+    /** Collection slug, or `"*"` for all collections. */
+    collection: string;
+    /** Allowed operations on the collection. */
+    operations: ("read" | "write" | "delete")[];
+}
+/**
+ * Full database row for an API key.
+ * The `key_hash` is never exposed via the API — only stored for lookup.
+ */
+export interface ApiKey {
+    id: string;
+    name: string;
+    /** First 12 characters of the plaintext key, for display only. */
+    key_prefix: string;
+    /** SHA-256 hash of the full plaintext key. */
+    key_hash: string;
+    permissions: ApiKeyPermission[];
+    /** When true, the key is granted the `admin` role (access to admin routes). */
+    admin: boolean;
+    /** Requests per 15-minute window. `null` means unlimited. */
+    rate_limit: number | null;
+    created_by: string;
+    created_at: string;
+    updated_at: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+/**
+ * Masked version of an API key, safe for API responses.
+ * Omits `key_hash` and shows only the prefix.
+ */
+export interface ApiKeyMasked {
+    id: string;
+    name: string;
+    key_prefix: string;
+    permissions: ApiKeyPermission[];
+    /** When true, the key is granted the `admin` role (access to admin routes). */
+    admin: boolean;
+    rate_limit: number | null;
+    created_by: string;
+    created_at: string;
+    updated_at: string;
+    last_used_at: string | null;
+    expires_at: string | null;
+    revoked_at: string | null;
+}
+/**
+ * Request body for creating a new API key.
+ */
+export interface CreateApiKeyRequest {
+    name: string;
+    permissions: ApiKeyPermission[];
+    /** When true, grants the `admin` role — allows access to admin routes. */
+    admin?: boolean;
+    /** Requests per 15-minute window. Omit or `null` for unlimited. */
+    rate_limit?: number | null;
+    /** ISO-8601 expiration timestamp. Omit for no expiration. */
+    expires_at?: string | null;
+}
+/**
+ * Request body for updating an existing API key.
+ * All fields are optional — only provided fields are updated.
+ */
+export interface UpdateApiKeyRequest {
+    name?: string;
+    permissions?: ApiKeyPermission[];
+    /** When true, grants the `admin` role — allows access to admin routes. */
+    admin?: boolean;
+    rate_limit?: number | null;
+    expires_at?: string | null;
+}
+/**
+ * Returned exactly once when a key is created.
+ * The `key` field contains the full plaintext key — it is never stored
+ * or returned again after creation.
+ */
+export interface ApiKeyWithSecret extends ApiKeyMasked {
+    /** Full plaintext API key (e.g. `rk_live_abc123...`). */
+    key: string;
+}

package/dist/auth/api-keys/index.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Service API Keys module.
+ *
+ * Re-exports types, store, middleware, permission guard, and routes
+ * for the API key authentication system.
+ *
+ * @module
+ */
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
+export { createApiKeyStore } from "./api-key-store";
+export type { ApiKeyStore } from "./api-key-store";
+export { isApiKeyToken, validateApiKey } from "./api-key-middleware";
+export type { ApiKeyAuthOptions } from "./api-key-middleware";
+export { httpMethodToOperation, isOperationAllowed } from "./api-key-permission-guard";
+export type { ApiKeyOperation } from "./api-key-permission-guard";
+export { createApiKeyRoutes } from "./api-key-routes";
+export type { ApiKeyRouteOptions } from "./api-key-routes";

package/dist/auth/apple-oauth.d.ts

@@ -0,0 +1,30 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates an Apple Sign In OAuth Provider integration.
+ *
+ * Apple requires a client secret that is a signed JWT, regenerated on each
+ * token exchange (valid up to 6 months). This provider handles that automatically.
+ *
+ * Required Apple Developer configuration:
+ * - Services ID (clientId)
+ * - Key ID from the private key registered with Apple
+ * - Team ID from Apple Developer account
+ * - Private key (.p8 file contents) downloaded from Apple Developer portal
+ */
+export declare function createAppleProvider(config: {
+    clientId: string;
+    teamId: string;
+    keyId: string;
+    /** The raw PEM contents of the .p8 private key file */
+    privateKey: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+    user?: {
+        name?: {
+            firstName?: string;
+            lastName?: string;
+        };
+        email?: string;
+    };
+}>;

package/dist/auth/auth-hooks.d.ts

@@ -0,0 +1,242 @@
+/**
+ * AuthHooks
+ *
+ * Customize specific behaviors of the built-in Rebase auth system.
+ *
+ * Each method replaces one piece of the default implementation.
+ * Unset methods fall through to the built-in defaults (scrypt passwords,
+ * standard validation rules, etc.).
+ *
+ * This interface is intentionally open for extension — new hooks
+ * can be added as optional methods without breaking existing configurations.
+ *
+ * @example bcrypt password support
+ * ```ts
+ * import bcrypt from "bcrypt";
+ *
+ * const hooks: AuthHooks = {
+ *     hashPassword: (pw) => bcrypt.hash(pw, 12),
+ *     verifyPassword: (pw, hash) => bcrypt.compare(pw, hash),
+ *     validatePasswordStrength: (pw) => ({
+ *         valid: pw.length >= 6,
+ *         errors: pw.length < 6 ? ["Password must be at least 6 characters"] : []
+ *     })
+ * };
+ * ```
+ *
+ * @example Override the entire login credential check
+ * ```ts
+ * const hooks: AuthHooks = {
+ *     verifyCredentials: async (email, password, repo) => {
+ *         const user = await repo.getUserByEmail(email);
+ *         if (!user || !user.passwordHash) return null;
+ *         const valid = await myCustomVerify(password, user.passwordHash);
+ *         return valid ? user : null;
+ *     }
+ * };
+ * ```
+ */
+import type { PasswordValidationResult } from "./password";
+import type { AuthRepository, UserData, CreateUserData } from "./interfaces";
+import type { EmailService, EmailConfig } from "../email";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
+/**
+ * Authentication method identifier for lifecycle hooks.
+ */
+export type AuthMethod = "login" | "register" | "oauth" | "refresh" | "password-reset" | "anonymous" | "magic-link" | "mfa";
+/**
+ * Hook specific parts of the built-in Rebase auth implementation.
+ *
+ * Every method is optional. The built-in defaults apply for any method
+ * that is not provided.
+ */
+export interface AuthHooks {
+    /**
+     * Hash a cleartext password for storage.
+     *
+     * Default: scrypt (Node.js crypto, 64-byte key, random 32-byte salt).
+     *
+     * @param password - The cleartext password.
+     * @returns The hashed password string (format is implementation-defined).
+     */
+    hashPassword?(password: string): Promise<string>;
+    /**
+     * Verify a cleartext password against a stored hash.
+     *
+     * Default: scrypt verification with timing-safe comparison.
+     *
+     * @param password - The cleartext password to check.
+     * @param storedHash - The hash string retrieved from the database.
+     * @returns `true` if the password matches the hash.
+     */
+    verifyPassword?(password: string, storedHash: string): Promise<boolean>;
+    /**
+     * Validate password strength before hashing.
+     *
+     * Default: minimum 8 characters, at least one uppercase, one lowercase, one digit.
+     *
+     * @param password - The cleartext password to validate.
+     * @returns Validation result with `valid` flag and error messages.
+     */
+    validatePasswordStrength?(password: string): PasswordValidationResult;
+    /**
+     * Override the complete credential verification during email/password login.
+     *
+     * When set, this replaces the default flow:
+     *   1. Look up user by email
+     *   2. Verify password hash
+     *
+     * The auth repository is provided for database access. Return the user
+     * data if credentials are valid, or `null` to reject the login.
+     *
+     * Default: `getUserByEmail(email)` + `verifyPassword(password, user.passwordHash)`.
+     */
+    verifyCredentials?(email: string, password: string, repo: AuthRepository): Promise<UserData | null>;
+    /**
+     * Called after any successful authentication event (login, register,
+     * OAuth, token refresh, password reset).
+     *
+     * Use for audit logging, syncing external state, updating
+     * last-login timestamps, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    onAuthenticated?(user: UserData, method: AuthMethod): Promise<void>;
+    /**
+     * Called before a new user is created (registration or admin creation).
+     *
+     * Return modified data to alter what gets stored, or throw an error
+     * to reject the creation entirely.
+     *
+     * Default: passthrough (returns data unchanged).
+     */
+    beforeUserCreate?(data: CreateUserData): Promise<CreateUserData>;
+    /**
+     * Called after a new user is created.
+     *
+     * Use for provisioning external resources, sending notifications
+     * to third-party systems, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    afterUserCreate?(user: UserData): Promise<void>;
+    /**
+     * Pre-login validation. Called before credential verification.
+     *
+     * Throw an error to reject the login attempt (e.g. for account lockout,
+     * IP-based restrictions, etc.).
+     */
+    beforeLogin?(email: string, method: AuthMethod): Promise<void>;
+    /**
+     * Post-logout cleanup.
+     *
+     * Called after a user's session has been invalidated.
+     * Use for audit logging, cleanup of temporary resources, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    afterLogout?(userId: string): Promise<void>;
+    /**
+     * Called after successful MFA verification.
+     *
+     * Use for audit logging, notifying external systems, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    onMfaVerified?(userId: string, factorId: string): Promise<void>;
+    /**
+     * Customize JWT access token claims before signing.
+     *
+     * Return the modified claims object. The returned claims are merged
+     * into the JWT payload alongside standard claims (userId, roles).
+     *
+     * @param claims - The default claims that would be included.
+     * @param user - The authenticated user data.
+     * @returns Modified claims to include in the JWT.
+     */
+    customizeAccessToken?(claims: Record<string, unknown>, user: UserData): Promise<Record<string, unknown>>;
+    /**
+     * Transform the auth response before sending it to the client.
+     *
+     * Called after successful login, register, refresh, OAuth, anonymous,
+     * magic-link, and MFA flows. The hook receives the fully-formed
+     * response and returns a (potentially enriched) response.
+     *
+     * Use cases:
+     * - Inject tokens from external auth systems (custom provider tokens, etc.)
+     * - Add project-specific metadata to the response
+     * - Enrich the user object with data from external sources
+     *
+     * The hook runs in the request path — keep it fast.
+     * Heavy work should be offloaded to `onAuthenticated` (fire-and-forget).
+     */
+    transformAuthResponse?(response: AuthResponsePayload, context: TransformAuthResponseContext): Promise<AuthResponsePayload>;
+    /**
+     * Called after a successful password reset.
+     *
+     * Use for audit logging, sending confirmation notifications, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    onPasswordReset?(userId: string): Promise<void>;
+    /**
+     * Called before a user is deleted.
+     *
+     * Throw an error to prevent deletion (e.g. for users with active
+     * subscriptions, pending transactions, etc.).
+     */
+    beforeUserDelete?(userId: string): Promise<void>;
+    /**
+     * Called after a user is deleted.
+     *
+     * Use for cleaning up external resources, audit logging, etc.
+     *
+     * This is fire-and-forget — errors are logged but do not fail the request.
+     */
+    afterUserDelete?(userId: string): Promise<void>;
+    /**
+     * Optional hook to customize or override the default user creation flow via the admin panel/REST API.
+     * When provided, this replaces the built-in password generation, hashing, and invitation email logic.
+     */
+    onAdminCreateUser?(values: Record<string, unknown>, ctx: {
+        authRepo: AuthRepository;
+        emailService?: EmailService;
+        emailConfig?: EmailConfig;
+        hashPassword: (password: string) => Promise<string>;
+    }): Promise<{
+        values: Record<string, unknown>;
+        temporaryPassword?: string;
+        invitationSent?: boolean;
+    }>;
+    /**
+     * Optional hook to customize or override the default password reset flow via the admin panel.
+     * When provided, this replaces the built-in password reset token generation, hashing, and email logic.
+     */
+    onAdminResetPassword?(userId: string, ctx: {
+        authRepo: AuthRepository;
+        emailService?: EmailService;
+        emailConfig?: EmailConfig;
+    }): Promise<{
+        temporaryPassword?: string;
+        invitationSent?: boolean;
+    }>;
+}
+/**
+ * Resolved auth hooks — password operations are guaranteed to exist,
+ * all other hooks are passed through as-is (optional).
+ *
+ * Created by `resolveAuthHooks()` which merges user hooks
+ * with built-in defaults.
+ *
+ * Consumers should use the resolved object exclusively —
+ * never access the raw `AuthHooks` directly.
+ */
+export type ResolvedAuthHooks = Required<Pick<AuthHooks, "hashPassword" | "verifyPassword" | "validatePasswordStrength">> & Omit<AuthHooks, "hashPassword" | "verifyPassword" | "validatePasswordStrength">;
+/**
+ * Merge user-provided hooks with the built-in defaults to produce
+ * a complete set of resolved hooks.
+ *
+ * This is the single point where defaults are applied — all consumers
+ * call this once and use the resolved hooks throughout.
+ */
+export declare function resolveAuthHooks(hooks?: AuthHooks): ResolvedAuthHooks;

package/dist/auth/bitbucket-oauth.d.ts

@@ -0,0 +1,11 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
+ */
+export declare function createBitbucketProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/builtin-auth-adapter.d.ts

@@ -0,0 +1,51 @@
+/**
+ * RebaseBuiltinAuthAdapter
+ *
+ * Wraps Rebase's existing built-in JWT auth system (routes, middleware, user/role
+ * management) into the `AuthAdapter` interface. This is the default adapter used
+ * when the user passes a plain `RebaseAuthConfig` object.
+ *
+ * This is NOT a rewrite — it delegates to the existing `createAuthRoutes()`,
+ * `createResetPasswordRoute()`, and `verifyAccessToken()` functions. The goal is to
+ * present the same functionality through the pluggable `AuthAdapter` contract.
+ */
+import type { AuthAdapter } from "@rebasepro/types";
+import type { AuthRepository, OAuthProvider } from "./interfaces";
+import type { AuthHooks } from "./auth-hooks";
+import type { EmailService, EmailConfig } from "../email";
+/**
+ * Configuration for the built-in Rebase auth adapter.
+ *
+ * This mirrors the existing `RebaseAuthConfig` — users pass this and
+ * server-core auto-wraps it in a `RebaseBuiltinAuthAdapter`.
+ */
+export interface BuiltinAuthAdapterConfig {
+    /** The bootstrapper-provided auth repository (users, roles, tokens). */
+    authRepository: AuthRepository;
+    /** Email service for password resets, verification, etc. */
+    emailService?: EmailService;
+    /** Email configuration. */
+    emailConfig?: EmailConfig;
+    /** Whether to allow new user registration. */
+    allowRegistration?: boolean;
+    /** Default role to assign to new users. */
+    defaultRole?: string;
+    /** OAuth providers to register. */
+    oauthProviders?: OAuthProvider<unknown>[];
+    /** Static service key for server-to-server auth. */
+    serviceKey?: string;
+    /** Auth hooks for customizing password, credentials, lifecycle, etc. */
+    authHooks?: AuthHooks;
+    /** The parsed auth config from the collection (if `auth` is an object, not just `true`). */
+    collectionAuthConfig?: import("@rebasepro/types").AuthCollectionConfig;
+    /** Enable magic link (passwordless email) login. Requires email service. */
+    enableMagicLink?: boolean;
+}
+/**
+ * Create the built-in Rebase auth adapter.
+ *
+ * This wraps the existing auth infrastructure (JWT, OAuth, user/role management)
+ * into the `AuthAdapter` interface. It's used internally by `initializeRebaseBackend()`
+ * when the user passes a plain `RebaseAuthConfig` object.
+ */
+export declare function createBuiltinAuthAdapter(config: BuiltinAuthAdapterConfig): AuthAdapter;

package/dist/auth/crypto-utils.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Cryptographic utility functions for auth.
+ *
+ * @module
+ */
+/**
+ * Constant-time string comparison to prevent timing attacks.
+ *
+ * Used for comparing service keys, tokens, and other secrets where
+ * timing side-channels could leak information about the expected value.
+ *
+ * @param a - First string to compare.
+ * @param b - Second string to compare.
+ * @returns `true` if the strings are identical, `false` otherwise.
+ */
+export declare function safeCompare(a: string, b: string): boolean;

package/dist/auth/custom-auth-adapter.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Custom Auth Adapter Factory
+ *
+ * Provides a minimal-config way for users with existing auth systems
+ * to plug into Rebase. Only `verifyRequest` is required — everything
+ * else is optional.
+ *
+ * @example
+ * ```ts
+ * import { createCustomAuthAdapter } from "@rebasepro/server-core";
+ *
+ * const auth = createCustomAuthAdapter({
+ *   verifyRequest: async (request) => {
+ *     const token = request.headers.get("Authorization")?.replace("Bearer ", "");
+ *     if (!token) return null;
+ *     const decoded = jwt.verify(token, MY_SECRET);
+ *     return {
+ *       uid: decoded.sub,
+ *       email: decoded.email,
+ *       displayName: decoded.name,
+ *       roles: decoded.roles || [],
+ *       isAdmin: decoded.roles?.includes("admin") ?? false,
+ *     };
+ *   },
+ * });
+ * ```
+ */
+import type { AuthAdapter, CustomAuthAdapterOptions } from "@rebasepro/types";
+/**
+ * Create a custom auth adapter from minimal options.
+ *
+ * This is the recommended entry point for users who already have their own
+ * auth system and just need to tell Rebase how to extract the user from
+ * incoming requests.
+ *
+ * @param options - Configuration options. Only `verifyRequest` is required.
+ * @returns A fully-formed `AuthAdapter` ready for `initializeRebaseBackend()`.
+ */
+export declare function createCustomAuthAdapter(options: CustomAuthAdapterOptions): AuthAdapter;

package/dist/auth/discord-oauth.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Discord OAuth2 Provider integration.
+ *
+ * Uses the authorization code flow. Requires the "identify" and "email"
+ * scopes to retrieve the user's email and profile information.
+ */
+export declare function createDiscordProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/facebook-oauth.d.ts

@@ -0,0 +1,14 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Facebook / Meta OAuth Provider integration.
+ *
+ * Uses the authorization code flow to exchange a code for an access token,
+ * then fetches user profile from the Facebook Graph API.
+ */
+export declare function createFacebookProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;