@rebasepro/server-mongodb 0.0.1-canary.09e5ec5

package/dist/server-core/src/auth/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/interfaces.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH;;GAEG;AACH,MAAM,WAAW,QAAQ;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,sBAAsB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,uBAAuB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtC,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7C,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,aAAa,CAAC,CAAC,GAAG,OAAO;IACtC,+DAA+D;IAC/D,EAAE,EAAE,MAAM,CAAC;IAEX,iFAAiF;IACjF,MAAM,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAEvB,0EAA0E;IAC1E,MAAM,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;CAChE;AAED;;GAEG;AACH,MAAM,WAAW,QAAQ;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,kBAAkB,EAAE;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;KACpB,GAAG,IAAI,CAAC;IACT,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE;QAClC,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,OAAO,CAAC;QACf,MAAM,CAAC,EAAE,OAAO,CAAC;KACpB,CAAC,GAAG,IAAI,CAAC;IACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC1C;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACpD,qBAAqB,CAAC,EAAE,QAAQ,CAAC,uBAAuB,CAAC,CAAC;IAC1D,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;CAC/B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6EAA6E;IAC7E,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sCAAsC;IACtC,QAAQ,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IAC1B,wBAAwB;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACjC,KAAK,EAAE,QAAQ,EAAE,CAAC;IAClB,yEAAyE;IACzE,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC3B;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpD;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAElD;;OAEG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAExD;;OAEG;IACH,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAElF;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAE/D;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7H;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAE5F;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEjC;;OAEG;IACH,kBAAkB,CAAC,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAE9E;;OAEG;IACH,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhE;;OAEG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;OAEG;IACH,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;OAEG;IACH,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEpE;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAElD;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAElD;;OAEG;IACH,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D;;OAEG;IACH,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjE;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,KAAK,EAAE,QAAQ,EAAE,CAAA;KAAE,GAAG,IAAI,CAAC,CAAC;CAC3F;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC3B;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAElD;;OAEG;IACH,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEjC;;OAEG;IACH,UAAU,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEpD;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAEtF;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAG5B;;OAEG;IACH,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE9H;;OAEG;IACH,sBAAsB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAE5E;;OAEG;IACH,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErD;;OAEG;IACH,6BAA6B,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAEtE;;OAEG;IACH,sBAAsB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAIlE;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE5F;;OAEG;IACH,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,GAAG,IAAI,CAAC,CAAC;IAEvF;;OAEG;IACH,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D;;OAEG;IACH,mCAAmC,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEnE;;OAEG;IACH,mBAAmB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,cAAc,EAAE,cAAc,EAAE,eAAe;CAAI"}

package/dist/server-core/src/auth/jwt.d.ts

@@ -0,0 +1,44 @@
+export interface JwtConfig {
+    secret: string;
+    accessExpiresIn?: string;
+    refreshExpiresIn?: string;
+}
+export interface AccessTokenPayload {
+    userId: string;
+    roles: string[];
+    uid?: string;
+}
+/**
+ * Configure JWT settings - call this during initialization.
+ * Validates the secret strength to prevent deployment with default/weak secrets.
+ */
+export declare function configureJwt(config: JwtConfig): void;
+/**
+ * Generate an access token (short-lived, 1 hour by default)
+ */
+export declare function generateAccessToken(userId: string, roles: string[]): string;
+/**
+ * Get the expiration time of an access token in milliseconds from now
+ */
+export declare function getAccessTokenExpiryMs(): number;
+/**
+ * Get the expiration timestamp for an access token
+ */
+export declare function getAccessTokenExpiry(): number;
+/**
+ * Verify and decode an access token
+ */
+export declare function verifyAccessToken(token: string): AccessTokenPayload | null;
+/**
+ * Generate a random refresh token (long-lived, 30 days by default)
+ */
+export declare function generateRefreshToken(): string;
+/**
+ * Hash a refresh token for database storage (don't store raw tokens)
+ */
+export declare function hashRefreshToken(token: string): string;
+/**
+ * Calculate refresh token expiration date
+ */
+export declare function getRefreshTokenExpiry(): Date;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/server-core/src/auth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/jwt.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,SAAS;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,kBAAkB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB;AAQD;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAwCpD;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAY3E;AAED;;GAEG;AACH,wBAAgB,sBAAsB,IAAI,MAAM,CAmB/C;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAqB1E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;GAEG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAsB5C"}

package/dist/server-core/src/auth/linkedin-oauth.d.ts

@@ -0,0 +1,19 @@
+import type { OAuthProvider } from "./interfaces";
+export interface LinkedinUserInfo {
+    linkedinId: string;
+    email: string;
+    displayName: string | null;
+    photoUrl: string | null;
+    emailVerified: boolean;
+}
+/**
+ * Creates a LinkedIn OAuth Provider integration
+ */
+export declare function createLinkedinProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;
+//# sourceMappingURL=linkedin-oauth.d.ts.map

package/dist/server-core/src/auth/linkedin-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"linkedin-oauth.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/linkedin-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAGxE,MAAM,WAAW,gBAAgB;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,aAAa,EAAE,OAAO,CAAC;CAC1B;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAkE/I"}

package/dist/server-core/src/auth/microsoft-oauth.d.ts

@@ -0,0 +1,17 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
+ *
+ * Supports both personal Microsoft accounts and work/school (Azure AD) accounts
+ * via the "common" tenant endpoint. Uses the authorization code flow.
+ */
+export declare function createMicrosoftProvider(config: {
+    clientId: string;
+    clientSecret: string;
+    /** Tenant ID. Defaults to "common" which allows both personal and organizational accounts. */
+    tenantId?: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;
+//# sourceMappingURL=microsoft-oauth.d.ts.map

package/dist/server-core/src/auth/microsoft-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft-oauth.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/microsoft-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAGxE;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,8FAA8F;IAC9F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAyEvD"}

package/dist/server-core/src/auth/middleware.d.ts

@@ -0,0 +1,82 @@
+import { MiddlewareHandler, Context } from "hono";
+import { DataDriver } from "@rebasepro/types";
+import { AccessTokenPayload } from "./jwt";
+import { HonoEnv } from "../api/types";
+/**
+ * Result from a custom auth validator.
+ * - `false`/`null`/`undefined` = not authenticated
+ * - `true` = authenticated as default user
+ * - object with `userId` or `uid` = authenticated with user info
+ */
+export type AuthResult = boolean | null | undefined | {
+    userId?: string;
+    uid?: string;
+    roles?: string[];
+    [key: string]: unknown;
+};
+/**
+ * Options for creating an auth middleware via createAuthMiddleware()
+ */
+export interface AuthMiddlewareOptions {
+    /** DataDriver to scope via withAuth() for RLS */
+    driver: DataDriver;
+    /**
+     * If true, return 401 when no valid token is present.
+     *
+     * **Defaults to `true` (secure by default).** Set to `false` only for
+     * intentionally public endpoints where access control is fully delegated
+     * to Postgres Row-Level Security policies.
+     */
+    requireAuth?: boolean;
+    /** Optional custom validator (for non-JWT auth, e.g. Firebase Auth) */
+    validator?: (c: Context<HonoEnv>) => Promise<AuthResult>;
+    /**
+     * A static secret key for server-to-server / script authentication.
+     *
+     * When a request sends `Authorization: Bearer <key>` and the key matches
+     * this value, the request is granted admin-level access (uid: `service`,
+     * roles: `["admin"]`) **without** JWT verification. The driver is scoped
+     * via `withAuth()` with the service identity.
+     *
+     * This is the Rebase equivalent of a Firebase Service Account key.
+     * Set via `REBASE_SERVICE_KEY` in `.env` and pass through the backend config.
+     *
+     * **Security:** The comparison uses constant-time equality to prevent
+     * timing attacks. The key must be at least 32 characters.
+     */
+    serviceKey?: string;
+}
+/**
+ * Hono middleware that requires a valid JWT token
+ * Returns 401 if token is missing or invalid
+ */
+export declare const requireAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Factory that creates a requireAuth middleware with optional service key support.
+ *
+ * When `serviceKey` is provided, the middleware will check if the Bearer token
+ * matches the service key using constant-time comparison. If it matches, the
+ * request is authenticated as a service user with admin privileges.
+ *
+ * This allows admin routes (which use standalone requireAuth + requireAdmin)
+ * to be accessed via service keys for scripts and server-to-server calls.
+ */
+export declare function createRequireAuth(options?: {
+    serviceKey?: string;
+}): MiddlewareHandler<HonoEnv>;
+/**
+ * Middleware that requires the user to have an admin or schema-admin role.
+ * Must be used AFTER requireAuth or on a route where user is guaranteed.
+ */
+export declare const requireAdmin: MiddlewareHandler<HonoEnv>;
+/**
+ * Middleware that optionally extracts user from JWT
+ * Does not return 401 if token is missing - allows anonymous access
+ */
+export declare const optionalAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Extract user from token - for WebSocket authentication
+ */
+export declare function extractUserFromToken(token: string): AccessTokenPayload | null;
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler<HonoEnv>;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/server-core/src/auth/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAqB,kBAAkB,EAAE,MAAM,OAAO,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC;;;;;GAKG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC;AAElI;;GAEG;AACH,MAAM,WAAW,qBAAqB;IAClC,iDAAiD;IACjD,MAAM,EAAE,UAAU,CAAC;IACnB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,uEAAuE;IACvE,SAAS,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IACzD;;;;;;;;;;;;;OAaG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,WAAW,EAAE,iBAAiB,CAAC,OAAO,CA+BlD,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,iBAAiB,CAAC,OAAO,CAAC,CA0C/F;AAED;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAAC,OAAO,CA6BnD,CAAC;AAGF;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,iBAAiB,CAAC,OAAO,CAiBnD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI,CAE7E;AAkED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAmH/F"}

package/dist/server-core/src/auth/password.d.ts

@@ -0,0 +1,23 @@
+export interface PasswordValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Password requirements:
+ * - Minimum 8 characters
+ * - At least 1 uppercase letter
+ * - At least 1 lowercase letter
+ * - At least 1 number
+ */
+export declare function validatePasswordStrength(password: string): PasswordValidationResult;
+/**
+ * Hash a password using Node's built-in scrypt
+ * Returns format: salt:hash (both hex encoded)
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verify a password against a scrypt hash
+ * Expects format: salt:hash (both hex encoded)
+ */
+export declare function verifyPassword(password: string, storedHash: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/server-core/src/auth/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/password.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,wBAAwB;IACrC,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,wBAAwB,CAuBnF;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAa3F"}

package/dist/server-core/src/auth/rate-limiter.d.ts

@@ -0,0 +1,32 @@
+import { MiddlewareHandler } from "hono";
+import { HonoEnv } from "../api/types";
+interface RateLimiterOptions {
+    /** Time window in milliseconds (default: 15 minutes) */
+    windowMs?: number;
+    /** Maximum requests per window (default: 100) */
+    limit?: number;
+    /** Key generator function. Defaults to IP-based keying. */
+    keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
+    /** Custom message for rate limit responses */
+    message?: string;
+}
+/**
+ * Create a rate-limiting middleware.
+ *
+ * Uses a sliding window algorithm: only timestamps within the last
+ * `windowMs` milliseconds are counted. Old entries are garbage-collected
+ * every `windowMs` to prevent unbounded memory growth.
+ */
+export declare function createRateLimiter(options?: RateLimiterOptions): MiddlewareHandler<HonoEnv>;
+/**
+ * Pre-configured rate limiter for general auth endpoints (login, register).
+ * 200 requests per 15 minutes per IP.
+ */
+export declare const defaultAuthLimiter: MiddlewareHandler<HonoEnv>;
+/**
+ * Pre-configured strict rate limiter for sensitive endpoints (password reset, verification).
+ * 50 requests per 15 minutes per IP.
+ */
+export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
+export {};
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/server-core/src/auth/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/rate-limiter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAcvC,UAAU,kBAAkB;IACxB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2DAA2D;IAC3D,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC;IACxE,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,kBAAuB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAgE9F;AAaD;;;GAGG;AACH,eAAO,MAAM,kBAAkB,4BAI7B,CAAC;AAEH;;;GAGG;AACH,eAAO,MAAM,iBAAiB,4BAI5B,CAAC"}

package/dist/server-core/src/auth/routes.d.ts

@@ -0,0 +1,28 @@
+import { Hono } from "hono";
+import type { AuthRepository, OAuthProvider } from "./interfaces";
+import { EmailService, EmailConfig } from "../email";
+import { HonoEnv } from "../api/types";
+/**
+ * Shared configuration for auth and admin route factories.
+ */
+export interface AuthModuleConfig {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    /** Allow new user registration (default: false). */
+    allowRegistration?: boolean;
+    /** Default role ID to assign to new users (default: none). Must NOT be "admin". */
+    defaultRole?: string;
+    /** Optional array of OAuth providers */
+    oauthProviders?: OAuthProvider[];
+    /** When true, blocks all self-registration regardless of `allowRegistration`. */
+    disableSelfRegistration?: boolean;
+    /**
+     * Callback that checks if bootstrap has already been completed.
+     * Used by GET /auth/config to report `needsSetup` status.
+     * When not provided, falls back to checking if any users exist.
+     */
+    isBootstrapCompleted?: () => Promise<boolean>;
+}
+export declare function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/server-core/src/auth/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAIlE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAErD,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAIvC;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,EAAE,cAAc,CAAC;IACzB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,oDAAoD;IACpD,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,cAAc,CAAC,EAAE,aAAa,EAAE,CAAC;IACjC,iFAAiF;IACjF,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD;AAgDD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC,CAisBxE"}

package/dist/server-core/src/auth/slack-oauth.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
+ * Uses the OpenID Connect flow with the "openid,email,profile" scopes.
+ */
+export declare function createSlackProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;
+//# sourceMappingURL=slack-oauth.d.ts.map

package/dist/server-core/src/auth/slack-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"slack-oauth.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/slack-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAGxE;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA+D5I"}

package/dist/server-core/src/auth/spotify-oauth.d.ts

@@ -0,0 +1,13 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Spotify OAuth Provider integration.
+ * Uses the authorization code flow with the "user-read-email" scope.
+ */
+export declare function createSpotifyProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;
+//# sourceMappingURL=spotify-oauth.d.ts.map

package/dist/server-core/src/auth/spotify-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spotify-oauth.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/spotify-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAGxE;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CA2D9I"}

package/dist/server-core/src/auth/twitter-oauth.d.ts

@@ -0,0 +1,19 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Twitter/X OAuth 2.0 Provider integration.
+ *
+ * Uses OAuth 2.0 with PKCE (authorization code flow). The frontend must include
+ * the PKCE `code_verifier` when sending the authorization code.
+ *
+ * Twitter API v2 requires the "tweet.read" and "users.read" scopes at minimum,
+ * plus "offline.access" if refresh tokens are needed on Twitter's side.
+ */
+export declare function createTwitterProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+}>;
+//# sourceMappingURL=twitter-oauth.d.ts.map

package/dist/server-core/src/auth/twitter-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"twitter-oauth.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/auth/twitter-oauth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAwB,MAAM,cAAc,CAAC;AAGxE;;;;;;;;GAQG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,aAAa,CAAC;IAC7F,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACxB,CAAC,CAuGT"}

package/dist/server-core/src/collections/BackendCollectionRegistry.d.ts

@@ -0,0 +1,14 @@
+import { CollectionRegistry } from "@rebasepro/common";
+import { CollectionRegistryInterface } from "../db/interfaces";
+/**
+ * Backend-agnostic collection registry.
+ * Satisfies CollectionRegistryInterface through inheritance from CollectionRegistry.
+ */
+export declare class BackendCollectionRegistry extends CollectionRegistry implements CollectionRegistryInterface {
+    /**
+     * Get the available relation keys for a given collection path.
+     * Maps from the collection's relation property names to the relation names.
+     */
+    getRelationKeysForCollection(collectionPath: string): string[];
+}
+//# sourceMappingURL=BackendCollectionRegistry.d.ts.map

package/dist/server-core/src/collections/BackendCollectionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackendCollectionRegistry.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/collections/BackendCollectionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAC;AAG/D;;;GAGG;AACH,qBAAa,yBAA0B,SAAQ,kBAAmB,YAAW,2BAA2B;IAEpG;;;OAGG;IACH,4BAA4B,CAAC,cAAc,EAAE,MAAM,GAAG,MAAM,EAAE;CAKjE"}

package/dist/server-core/src/collections/loader.d.ts

@@ -0,0 +1,6 @@
+import { EntityCollection } from "@rebasepro/types";
+/**
+ * Asynchronously load collection files from a directory for backend initialization
+ */
+export declare function loadCollectionsFromDirectory(directory: string): Promise<EntityCollection[]>;
+//# sourceMappingURL=loader.d.ts.map

package/dist/server-core/src/collections/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/collections/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAKpD;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAwCjG"}

package/dist/server-core/src/cron/cron-loader.d.ts

@@ -0,0 +1,18 @@
+import type { CronJobDefinition } from "@rebasepro/types";
+export interface LoadedCronJob {
+    /** Job ID derived from filename (e.g. "cleanup-sessions"). */
+    id: string;
+    /** The full definition. */
+    definition: CronJobDefinition;
+}
+/**
+ * Auto-discover cron job files from a directory.
+ *
+ * Each file should default-export a `CronJobDefinition`.
+ * The filename (without extension) becomes the job ID:
+ *   `crons/cleanup-sessions.ts` → id = "cleanup-sessions"
+ *
+ * Follows the same discovery pattern as `loadFunctionsFromDirectory`.
+ */
+export declare function loadCronJobsFromDirectory(directory: string): Promise<LoadedCronJob[]>;
+//# sourceMappingURL=cron-loader.d.ts.map

package/dist/server-core/src/cron/cron-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-loader.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/cron/cron-loader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC1B,8DAA8D;IAC9D,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,UAAU,EAAE,iBAAiB,CAAC;CACjC;AAED;;;;;;;;GAQG;AACH,wBAAsB,yBAAyB,CAC3C,SAAS,EAAE,MAAM,GAClB,OAAO,CAAC,aAAa,EAAE,CAAC,CAiE1B"}

package/dist/server-core/src/cron/cron-routes.d.ts

@@ -0,0 +1,15 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "../api/types";
+import type { CronScheduler } from "./cron-scheduler";
+/**
+ * Create admin REST routes for managing cron jobs.
+ *
+ * Routes:
+ *   GET    /          → list all cron jobs
+ *   GET    /:id       → get a single job's status
+ *   POST   /:id/trigger → manually trigger a job
+ *   GET    /:id/logs  → get execution logs for a job
+ *   PUT    /:id       → update job (enable/disable)
+ */
+export declare function createCronRoutes(scheduler: CronScheduler): Hono<HonoEnv>;
+//# sourceMappingURL=cron-routes.d.ts.map

package/dist/server-core/src/cron/cron-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-routes.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/cron/cron-routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,CAsExE"}

package/dist/server-core/src/cron/cron-scheduler.d.ts

@@ -0,0 +1,62 @@
+import type { CronJobStatus, CronJobLogEntry } from "@rebasepro/types";
+import type { RebaseClient } from "@rebasepro/client";
+import type { LoadedCronJob } from "./cron-loader";
+import type { CronStore } from "./cron-store";
+export declare class CronScheduler {
+    private jobs;
+    private started;
+    private store?;
+    private client?;
+    /**
+     * Set the RebaseClient instance to make it available to cron job handlers.
+     */
+    setClient(client: RebaseClient): void;
+    /**
+     * Attach a persistence store for cron logs.
+     * When set, execution logs are written to the database after each run,
+     * and counters are seeded from the database on start.
+     */
+    setStore(store: CronStore): void;
+    /**
+     * Register a batch of loaded cron jobs.
+     */
+    registerJobs(loadedJobs: LoadedCronJob[]): void;
+    /**
+     * Start the scheduler — begins ticking all enabled jobs.
+     */
+    start(): void;
+    /**
+     * Stop the scheduler and clear all timers.
+     */
+    stop(): void;
+    /**
+     * List all registered jobs with their current status.
+     */
+    listJobs(): CronJobStatus[];
+    /**
+     * Get a single job status by ID.
+     */
+    getJob(id: string): CronJobStatus | undefined;
+    /**
+     * Get log entries for a job.
+     */
+    getJobLogs(id: string, limit?: number): CronJobLogEntry[];
+    /**
+     * Get log entries for a job from the database (if store is available).
+     * Falls back to in-memory logs if no store is configured.
+     */
+    getJobLogsFromDb(id: string, limit?: number): Promise<CronJobLogEntry[]>;
+    /**
+     * Enable or disable a job at runtime.
+     */
+    setJobEnabled(id: string, enabled: boolean): CronJobStatus | undefined;
+    /**
+     * Manually trigger a job execution immediately.
+     */
+    triggerJob(id: string): Promise<CronJobLogEntry | undefined>;
+    private scheduleNext;
+    private stopJob;
+    private executeJob;
+    private toStatus;
+}
+//# sourceMappingURL=cron-scheduler.d.ts.map

package/dist/server-core/src/cron/cron-scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-scheduler.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/cron/cron-scheduler.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAER,aAAa,EACb,eAAe,EAGlB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAkH9C,qBAAa,aAAa;IACtB,OAAO,CAAC,IAAI,CAAoC;IAChD,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,KAAK,CAAC,CAAY;IAC1B,OAAO,CAAC,MAAM,CAAC,CAAe;IAE9B;;OAEG;IACH,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAIrC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,IAAI;IAIhC;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,aAAa,EAAE,GAAG,IAAI;IAoB/C;;OAEG;IACH,KAAK,IAAI,IAAI;IA8Bb;;OAEG;IACH,IAAI,IAAI,IAAI;IAOZ;;OAEG;IACH,QAAQ,IAAI,aAAa,EAAE;IAI3B;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAK7C;;OAEG;IACH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,eAAe,EAAE;IAOzD;;;OAGG;IACG,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC;IAS9E;;OAEG;IACH,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS;IAiBtE;;OAEG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;IAQlE,OAAO,CAAC,YAAY;IAwBpB,OAAO,CAAC,OAAO;YASD,UAAU;IAmFxB,OAAO,CAAC,QAAQ;CAgBnB"}

package/dist/server-core/src/cron/cron-store.d.ts

@@ -0,0 +1,33 @@
+import type { CronJobLogEntry } from "@rebasepro/types";
+import type { DataDriver } from "@rebasepro/types";
+/**
+ * Persistence layer for cron job execution logs.
+ *
+ * Uses the DataDriver's `admin.executeSql` capability to store logs in a
+ * `rebase.cron_logs` table. Falls back gracefully if the driver doesn't
+ * support SQL (e.g. MongoDB) — in that case, no persistence occurs.
+ */
+export interface CronStore {
+    /** Ensure the backing table exists. Called once on startup. */
+    ensureTable(): Promise<void>;
+    /** Persist a single log entry after execution. */
+    insertLog(entry: CronJobLogEntry): Promise<void>;
+    /**
+     * Fetch the most recent logs for a job.
+     * @param jobId  The job identifier
+     * @param limit  Max entries to return (default 50)
+     * @returns Logs sorted newest-first
+     */
+    fetchLogs(jobId: string, limit?: number): Promise<CronJobLogEntry[]>;
+    /**
+     * Fetch aggregate stats for all jobs (totalRuns, totalFailures, lastRunAt).
+     * Used to seed in-memory counters on startup.
+     */
+    fetchJobStats(): Promise<Map<string, {
+        totalRuns: number;
+        totalFailures: number;
+        lastRunAt?: string;
+    }>>;
+}
+export declare function createCronStore(driver: DataDriver): CronStore | undefined;
+//# sourceMappingURL=cron-store.d.ts.map

package/dist/server-core/src/cron/cron-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron-store.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/cron/cron-store.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD;;;;;;GAMG;AACH,MAAM,WAAW,SAAS;IACtB,+DAA+D;IAC/D,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7B,kDAAkD;IAClD,SAAS,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAErE;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,CAAC;CAC3G;AAMD,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,SAAS,CA6GzE"}

package/dist/server-core/src/cron/index.d.ts

@@ -0,0 +1,7 @@
+export { loadCronJobsFromDirectory } from "./cron-loader";
+export type { LoadedCronJob } from "./cron-loader";
+export { CronScheduler } from "./cron-scheduler";
+export { createCronRoutes } from "./cron-routes";
+export { createCronStore } from "./cron-store";
+export type { CronStore } from "./cron-store";
+//# sourceMappingURL=index.d.ts.map

package/dist/server-core/src/cron/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/cron/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC"}

package/dist/server-core/src/db/interfaces.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Database Abstraction Interfaces
+ *
+ * These interfaces define the contracts that any database backend must implement
+ * to be used with Rebase. This allows for pluggable database backends like
+ * PostgreSQL, MongoDB, MySQL, etc.
+ */
+import { DatabaseConnection, QueryFilter, FetchCollectionOptions, SearchOptions, CountOptions, ConditionBuilder, ConditionBuilderStatic, EntityRepository, CollectionSubscriptionConfig, EntitySubscriptionConfig, RealtimeProvider, CollectionRegistryInterface, DataTransformer, BackendConfig, BackendInstance, BackendFactory } from "@rebasepro/types";
+import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { PgTransaction } from "drizzle-orm/pg-core";
+/**
+ * Type representing either a direct database connection or a transaction.
+ * Used to allow services to operate within a transaction context.
+ * Note: `any` is intentional here — it represents a Drizzle client with
+ * a dynamic schema, enabling `db.query[tableName]` access without casts.
+ */
+export type DrizzleClient = NodePgDatabase<Record<string, unknown>> | PgTransaction<any, any, any>;
+export type { DatabaseConnection, QueryFilter, FetchCollectionOptions, SearchOptions, CountOptions, ConditionBuilder, ConditionBuilderStatic, EntityRepository, CollectionSubscriptionConfig, EntitySubscriptionConfig, RealtimeProvider, CollectionRegistryInterface, DataTransformer, BackendConfig, BackendInstance, BackendFactory };
+//# sourceMappingURL=interfaces.d.ts.map

package/dist/server-core/src/db/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/db/interfaces.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKH,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACjB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD;;;;;GAKG;AAEH,MAAM,MAAM,aAAa,GAAG,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;AAEnG,YAAY,EACR,kBAAkB,EAClB,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,sBAAsB,EACtB,gBAAgB,EAChB,4BAA4B,EAC5B,wBAAwB,EACxB,gBAAgB,EAChB,2BAA2B,EAC3B,eAAe,EACf,aAAa,EACb,eAAe,EACf,cAAc,EACjB,CAAC"}

package/dist/server-core/src/email/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Email module exports
+ */
+export type { EmailService, EmailSendOptions, SMTPConfig, EmailConfig, PasswordResetTemplateFunction, EmailVerificationTemplateFunction, UserInvitationTemplateFunction, WelcomeEmailTemplateFunction } from "./types";
+export { SMTPEmailService, createEmailService } from "./smtp-email-service";
+export { getPasswordResetTemplate, getEmailVerificationTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate } from "./templates";
+//# sourceMappingURL=index.d.ts.map

package/dist/server-core/src/email/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/email/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,YAAY,EACR,YAAY,EACZ,gBAAgB,EAChB,UAAU,EACV,WAAW,EACX,6BAA6B,EAC7B,iCAAiC,EACjC,8BAA8B,EAC9B,4BAA4B,EAC/B,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE5E,OAAO,EAAE,wBAAwB,EAAE,4BAA4B,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC"}

package/dist/server-core/src/email/smtp-email-service.d.ts

@@ -0,0 +1,26 @@
+import { EmailService, EmailSendOptions, EmailConfig } from "./types";
+/**
+ * SMTP Email Service implementation using Nodemailer
+ */
+export declare class SMTPEmailService implements EmailService {
+    private transporter;
+    private config;
+    constructor(config: EmailConfig);
+    /**
+     * Check if the email service is properly configured
+     */
+    isConfigured(): boolean;
+    /**
+     * Send an email using SMTP or custom send function
+     */
+    send(options: EmailSendOptions): Promise<void>;
+    /**
+     * Verify SMTP connection (useful for startup checks)
+     */
+    verifyConnection(): Promise<boolean>;
+}
+/**
+ * Create an email service from configuration
+ */
+export declare function createEmailService(config: EmailConfig): EmailService;
+//# sourceMappingURL=smtp-email-service.d.ts.map

package/dist/server-core/src/email/smtp-email-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smtp-email-service.d.ts","sourceRoot":"","sources":["../../../../../server-core/src/email/smtp-email-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEtE;;GAEG;AACH,qBAAa,gBAAiB,YAAW,YAAY;IACjD,OAAO,CAAC,WAAW,CAA4B;IAC/C,OAAO,CAAC,MAAM,CAAc;gBAEhB,MAAM,EAAE,WAAW;IAgB/B;;OAEG;IACH,YAAY,IAAI,OAAO;IAIvB;;OAEG;IACG,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IA8BpD;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC;CAc7C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,WAAW,GAAG,YAAY,CAEpE"}