@rebasepro/server 0.0.1-canary.4829d6e

package/dist/auth/mfa.d.ts

@@ -0,0 +1,49 @@
+/**
+ * TOTP (Time-based One-Time Password) implementation.
+ *
+ * Pure Node.js crypto implementation — no external dependencies required.
+ * Implements RFC 6238 (TOTP) and RFC 4226 (HOTP).
+ */
+/**
+ * Encode a Buffer to Base32 string (RFC 4648)
+ */
+export declare function base32Encode(buffer: Buffer): string;
+/**
+ * Decode a Base32 string to Buffer
+ */
+export declare function base32Decode(encoded: string): Buffer;
+/**
+ * Generate a TOTP value for the current time step
+ */
+export declare function generateTotp(secret: Buffer, timeStep?: number): string;
+/**
+ * Verify a TOTP token with a configurable time window
+ *
+ * @param secret - The shared secret as a Buffer
+ * @param token - The 6-digit TOTP code to verify
+ * @param window - Number of time steps to check on each side (default: 1)
+ * @returns true if the token is valid within the window
+ */
+export declare function verifyTotp(secret: Buffer, token: string, window?: number): boolean;
+/**
+ * Generate a new TOTP secret and return the setup information
+ *
+ * @param issuer - The issuer name (app name) for the QR code
+ * @param accountName - The account identifier (usually email)
+ * @returns Object with base32 secret and otpauth URI
+ */
+export declare function generateTotpSecret(issuer: string, accountName: string): {
+    secret: string;
+    uri: string;
+};
+/**
+ * Generate a set of one-time recovery codes
+ *
+ * @param count - Number of recovery codes to generate (default: 10)
+ * @returns Array of formatted recovery code strings (e.g. "A1B2C-D3E4F")
+ */
+export declare function generateRecoveryCodes(count?: number): string[];
+/**
+ * Hash a recovery code for storage
+ */
+export declare function hashRecoveryCode(code: string): string;

package/dist/auth/microsoft-oauth.d.ts

@@ -0,0 +1,16 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
+ *
+ * Supports both personal Microsoft accounts and work/school (Azure AD) accounts
+ * via the "common" tenant endpoint. Uses the authorization code flow.
+ */
+export declare function createMicrosoftProvider(config: {
+    clientId: string;
+    clientSecret: string;
+    /** Tenant ID. Defaults to "common" which allows both personal and organizational accounts. */
+    tenantId?: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/middleware.d.ts

@@ -0,0 +1,158 @@
+import { MiddlewareHandler, Context } from "hono";
+import { DataDriver } from "@rebasepro/types";
+import { AccessTokenPayload } from "./jwt";
+import { HonoEnv } from "../api/types";
+import type { ApiKeyStore } from "./api-keys/api-key-store";
+/**
+ * Result from a custom auth validator.
+ * - `false`/`null`/`undefined` = not authenticated
+ * - `true` = authenticated as default user
+ * - object with `userId` or `uid` = authenticated with user info
+ */
+export type AuthResult = boolean | null | undefined | {
+    userId?: string;
+    uid?: string;
+    roles?: string[];
+    [key: string]: unknown;
+};
+/**
+ * Options for creating an auth middleware via createAuthMiddleware()
+ */
+export interface AuthMiddlewareOptions {
+    /** DataDriver to scope via withAuth() for RLS */
+    driver: DataDriver;
+    /**
+     * Optional per-request driver resolver for multi-data-source backends.
+     * Given the request context, returns the unscoped delegate to use (e.g.
+     * Postgres vs Mongo, picked by the request's collection data source).
+     * When omitted, `driver` is used for every request.
+     */
+    resolveDriver?: (c: Context<HonoEnv>) => DataDriver;
+    /**
+     * If true, return 401 when no valid token is present.
+     *
+     * **Defaults to `true` (secure by default).** Set to `false` only for
+     * intentionally public endpoints where access control is fully delegated
+     * to Postgres Row-Level Security policies.
+     */
+    requireAuth?: boolean;
+    /** Optional custom validator (for non-JWT auth, e.g. external auth providers) */
+    validator?: (c: Context<HonoEnv>) => Promise<AuthResult>;
+    /**
+     * A static secret key for server-to-server / script authentication.
+     *
+     * When a request sends `Authorization: Bearer <key>` and the key matches
+     * this value, the request is granted admin-level access (uid: `service`,
+     * roles: `["admin"]`) **without** JWT verification. The driver is scoped
+     * via `withAuth()` with the service identity.
+     *
+     * This is the Rebase equivalent of a Service Account key.
+     * Set via `REBASE_SERVICE_KEY` in `.env` and pass through the backend config.
+     *
+     * **Security:** The comparison uses constant-time equality to prevent
+     * timing attacks. The key must be at least 32 characters.
+     */
+    serviceKey?: string;
+    /**
+     * API key store for authenticating `rk_` prefixed tokens.
+     * When set, tokens starting with `rk_` are validated against the
+     * database instead of being treated as JWTs.
+     */
+    apiKeyStore?: ApiKeyStore;
+}
+/**
+ * Hono middleware that requires a valid JWT token via Authorization header.
+ * Returns 401 if token is missing or invalid.
+ *
+ * **Security:** Tokens are only accepted via the `Authorization: Bearer`
+ * header. Query-string tokens (`?token=`) are intentionally NOT accepted
+ * here because URLs leak into access logs, proxies, Referer headers, and
+ * browser history. Use {@link queryTokenAuth} on routes that legitimately
+ * need query-string tokens (e.g. storage file serving for `<img src>`).
+ */
+export declare const requireAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Factory that creates a requireAuth middleware with optional service key support.
+ *
+ * When `serviceKey` is provided, the middleware will check if the Bearer token
+ * matches the service key using constant-time comparison. If it matches, the
+ * request is authenticated as a service user with admin privileges.
+ *
+ * This allows admin routes (which use standalone requireAuth + requireAdmin)
+ * to be accessed via service keys for scripts and server-to-server calls.
+ */
+export declare function createRequireAuth(options?: {
+    serviceKey?: string;
+}): MiddlewareHandler<HonoEnv>;
+/**
+ * Middleware that requires the user to have an admin or schema-admin role.
+ * Must be used AFTER requireAuth or on a route where user is guaranteed.
+ */
+export declare const requireAdmin: MiddlewareHandler<HonoEnv>;
+/**
+ * Middleware that optionally extracts user from JWT via Authorization header.
+ * Does not return 401 if token is missing — allows anonymous access.
+ *
+ * Query-string tokens are NOT accepted here. Use {@link queryTokenAuth}
+ * on routes that need them.
+ */
+export declare const optionalAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Extract user from token - for WebSocket authentication
+ */
+export declare function extractUserFromToken(token: string): AccessTokenPayload | null;
+/**
+ * Create a configurable auth middleware that handles:
+ * 1. Token extraction (via custom validator or JWT Bearer token)
+ * 2. RLS-scoped DataDriver via withAuth()
+ * 3. Enforcement (401 when requireAuth is true and no user)
+ *
+ * **Secure by default:** `requireAuth` defaults to `true`. Anonymous
+ * access is only allowed when the developer explicitly opts out by
+ * setting `requireAuth: false`, indicating that Postgres RLS policies
+ * fully control access.
+ *
+ * **Fail-closed:** The raw unscoped driver is never placed in the
+ * request context. Every code path either scopes via `withAuth()` or
+ * rejects the request. This prevents silent RLS bypass.
+ *
+ * This is the single source of truth for HTTP auth in Rebase.
+ * Use this instead of manually parsing tokens in route handlers.
+ */
+export declare function createAuthMiddleware(options: AuthMiddlewareOptions): MiddlewareHandler<HonoEnv>;
+/**
+ * Middleware that authenticates via a `?token=` query parameter.
+ *
+ * **Use sparingly.** Tokens in URLs leak into access logs, proxy logs,
+ * Referer headers, and browser history. This middleware exists solely for
+ * routes where the consumer cannot set HTTP headers — e.g. `<img src>`,
+ * `<a href>` for file downloads, or similar browser-native requests.
+ *
+ * Apply it **before** `requireAuth` or `optionalAuth` on the specific
+ * route that needs it. Those middlewares will see the user context this
+ * middleware sets and skip their own 401 check.
+ *
+ * @example
+ * ```ts
+ * router.get("/file/*", queryTokenAuth, readAuthMiddleware, handler);
+ * ```
+ */
+export declare const queryTokenAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Authorizes anonymous access to **public** storage objects (those under the
+ * public prefix), which are served token-less via stable, permanent URLs.
+ *
+ * Runs on the storage `/file/*` and `/metadata/*` routes, *after* the token
+ * middleware and *before* the read-auth gate. If the request is already
+ * authenticated (Bearer or scoped token), it does nothing. Otherwise, when the
+ * requested object path is public, it sets a minimal "public" principal so the
+ * downstream `requireAuth` gate lets the read through. Private paths are left
+ * untouched, so they still require a valid token.
+ */
+export declare const publicObjectAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Middleware that authenticates file-serving routes using scoped download tokens.
+ * It enforces that only scoped "file-read" tokens can access "/file/*" and "?token=" query params.
+ * Full access JWTs are explicitly rejected on "/file/*" routes, and in the "?token=" query param.
+ */
+export declare const fileTokenAuth: MiddlewareHandler<HonoEnv>;

package/dist/auth/password.d.ts

@@ -0,0 +1,22 @@
+export interface PasswordValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+/**
+ * Password requirements:
+ * - Minimum 8 characters
+ * - At least 1 uppercase letter
+ * - At least 1 lowercase letter
+ * - At least 1 number
+ */
+export declare function validatePasswordStrength(password: string): PasswordValidationResult;
+/**
+ * Hash a password using Node's built-in scrypt
+ * Returns format: salt:hash (both hex encoded)
+ */
+export declare function hashPassword(password: string): Promise<string>;
+/**
+ * Verify a password against a scrypt hash
+ * Expects format: salt:hash (both hex encoded)
+ */
+export declare function verifyPassword(password: string, storedHash: string): Promise<boolean>;

package/dist/auth/rate-limiter.d.ts

@@ -0,0 +1,50 @@
+import { MiddlewareHandler } from "hono";
+import { HonoEnv } from "../api/types";
+interface RateLimiterOptions {
+    /** Time window in milliseconds (default: 15 minutes) */
+    windowMs?: number;
+    /** Maximum requests per window (default: 100) */
+    limit?: number;
+    /** Key generator function. Defaults to IP-based keying. */
+    keyGenerator?: (c: Parameters<MiddlewareHandler<HonoEnv>>[0]) => string;
+    /** Custom message for rate limit responses */
+    message?: string;
+}
+/**
+ * Create a rate-limiting middleware.
+ *
+ * Uses a sliding window algorithm: only timestamps within the last
+ * `windowMs` milliseconds are counted. Old entries are garbage-collected
+ * every `windowMs` to prevent unbounded memory growth.
+ */
+export declare function createRateLimiter(options?: RateLimiterOptions): MiddlewareHandler<HonoEnv>;
+/**
+ * Pre-configured rate limiter for general auth endpoints (login, register).
+ * 200 requests per 15 minutes per IP.
+ */
+export declare const defaultAuthLimiter: MiddlewareHandler<HonoEnv>;
+/**
+ * Pre-configured strict rate limiter for sensitive endpoints (password reset, verification).
+ * 50 requests per 15 minutes per IP.
+ */
+export declare const strictAuthLimiter: MiddlewareHandler<HonoEnv>;
+/**
+ * Key generator for API-key-based rate limiting.
+ *
+ * Uses the API key ID (from `c.get("apiKey")`) as the rate limit key.
+ * Falls back to IP-based keying when the request is not authenticated
+ * via an API key.
+ */
+export declare function apiKeyKeyGenerator(c: Parameters<MiddlewareHandler<HonoEnv>>[0]): string;
+/**
+ * Create a rate limiter specifically for API key requests.
+ *
+ * When a request is authenticated via an API key that has a `rate_limit`
+ * configured, this limiter enforces per-key limits using the key's ID
+ * as the rate limit bucket.
+ *
+ * @param defaultLimit - Fallback limit when the key has no `rate_limit` set.
+ * @param windowMs     - Time window in milliseconds (default: 15 minutes).
+ */
+export declare function createApiKeyRateLimiter(defaultLimit?: number, windowMs?: number): MiddlewareHandler<HonoEnv>;
+export {};

package/dist/auth/reset-password-admin.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Standalone admin endpoint for resetting a user's password.
+ *
+ * Hook resolution order:
+ * 1. Collection-level hook (`auth.onResetPassword` on the collection)
+ * 2. Backend-level hook (`AuthHooks.onAdminResetPassword`)
+ * 3. Built-in default (send reset email, or generate temp password)
+ */
+import { Hono } from "hono";
+import type { AuthRepository } from "./interfaces";
+import type { AuthHooks } from "./auth-hooks";
+import type { EmailService, EmailConfig } from "../email";
+import type { HonoEnv } from "../api/types";
+import type { AuthCollectionConfig } from "@rebasepro/types";
+export interface ResetPasswordRouteConfig {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    serviceKey?: string;
+    authHooks?: AuthHooks;
+    /** The parsed auth config from the collection, if available. */
+    collectionAuthConfig?: AuthCollectionConfig;
+}
+/**
+ * Create a standalone admin route for resetting user passwords.
+ *
+ * Mounts: POST /users/:userId/reset-password
+ */
+export declare function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono<HonoEnv>;

package/dist/auth/rls-scope.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Shared RLS (Row-Level Security) scoping helper.
+ *
+ * DataDrivers may implement a `withAuth()` method that returns a scoped
+ * clone of the driver with RLS policies applied for the given user.
+ * This is database-specific (e.g. Postgres SET LOCAL ROLE) and is not
+ * part of the core DataDriver interface.
+ *
+ * This module provides the shared duck-typing logic used by the
+ * adapter-aware middleware.
+ *
+ * @module
+ */
+import type { DataDriver } from "@rebasepro/types";
+/**
+ * Scope a DataDriver via `withAuth()` for RLS.
+ *
+ * SECURITY: If `withAuth()` is available but fails, the error is re-thrown
+ * so the request is **denied** rather than proceeding with unscoped access
+ * (fail-closed behavior).
+ *
+ * If the driver does not support RLS, the original driver is returned.
+ *
+ * @param driver - The DataDriver to scope.
+ * @param user   - The authenticated user identity for RLS.
+ * @returns The RLS-scoped DataDriver (or the original if RLS is unsupported).
+ */
+export declare function scopeDataDriver(driver: DataDriver, user: {
+    uid: string;
+    roles?: string[];
+}): Promise<DataDriver>;

package/dist/auth/routes.d.ts

@@ -0,0 +1,66 @@
+import { Hono } from "hono";
+import type { AuthRepository, OAuthProvider } from "./interfaces";
+import type { AuthHooks } from "./auth-hooks";
+import { EmailService, EmailConfig } from "../email";
+import { HonoEnv } from "../api/types";
+/**
+ * Shared configuration for auth and admin route factories.
+ */
+export interface AuthModuleConfig {
+    authRepo: AuthRepository;
+    emailService?: EmailService;
+    emailConfig?: EmailConfig;
+    /** Allow new user registration (default: false). */
+    allowRegistration?: boolean;
+    /** Expose the authenticated email→minimal-profile lookup route (default: false). */
+    allowUserLookup?: boolean;
+    /** Default role ID to assign to new users (default: none). Must NOT be "admin". */
+    defaultRole?: string;
+    /** Optional array of OAuth providers */
+    oauthProviders?: OAuthProvider<unknown>[];
+    /** When true, blocks all self-registration regardless of `allowRegistration`. */
+    disableSelfRegistration?: boolean;
+    /**
+     * Auth hooks for customizing password hashing, credential
+     * verification, lifecycle hooks, etc.
+     */
+    authHooks?: AuthHooks;
+    /**
+     * Callback that checks if bootstrap has already been completed.
+     * Used by GET /auth/config to report `needsSetup` status.
+     * When not provided, falls back to checking if any users exist.
+     */
+    isBootstrapCompleted?: () => Promise<boolean>;
+    /** Enable magic link (passwordless email) login. Requires email service. */
+    enableMagicLink?: boolean;
+    /**
+     * Opt-in httpOnly cookie mode for refresh tokens.
+     *
+     * When set, the refresh token is delivered as an `httpOnly`, `Secure`,
+     * `SameSite` cookie instead of in the JSON response body. This
+     * prevents XSS from stealing the long-lived refresh token.
+     *
+     * The access token remains in the JSON body so the client can use it
+     * in `Authorization: Bearer` headers for API calls.
+     *
+     * **Requires** `credentials: "include"` on client-side fetch calls to
+     * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
+     */
+    cookieAuth?: CookieAuthConfig;
+}
+/**
+ * Configuration for httpOnly refresh-token cookies.
+ */
+export interface CookieAuthConfig {
+    /** Cookie name (default: "__rb_refresh"). */
+    cookieName?: string;
+    /** Cookie domain. Omit to use the current domain. */
+    domain?: string;
+    /** Cookie path (default: "/"). */
+    path?: string;
+    /** SameSite attribute (default: "Lax"). */
+    sameSite?: "Strict" | "Lax" | "None";
+    /** Force the Secure flag. Defaults to `true` when SameSite is "None", otherwise auto-detected from the request protocol. */
+    secure?: boolean;
+}
+export declare function createAuthRoutes(config: AuthModuleConfig): Hono<HonoEnv>;

package/dist/auth/session-routes.d.ts

@@ -0,0 +1,29 @@
+import { Hono } from "hono";
+import { z } from "zod";
+import { HonoEnv } from "../api/types";
+import type { AuthModuleConfig } from "./routes";
+import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
+import type { resolveAuthHooks } from "./auth-hooks";
+interface SessionRoutesConfig {
+    router: Hono<HonoEnv>;
+    config: AuthModuleConfig;
+    ops: ReturnType<typeof resolveAuthHooks>;
+    parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T;
+    buildAuthResponse: (user: {
+        id: string;
+        email: string;
+        displayName?: string | null;
+        photoUrl?: string | null;
+        emailVerified?: boolean;
+        isAnonymous?: boolean;
+        metadata?: Record<string, unknown> | null;
+    }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
+    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+        roleIds: string[];
+        accessToken: string;
+        refreshToken: string;
+    }>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>;
+}
+export declare function mountSessionRoutes(opts: SessionRoutesConfig): void;
+export {};

package/dist/auth/slack-oauth.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Slack OAuth Provider integration (OAuth 2.0 / "Sign in with Slack").
+ * Uses the OpenID Connect flow with the "openid,email,profile" scopes.
+ */
+export declare function createSlackProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/spotify-oauth.d.ts

@@ -0,0 +1,12 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Spotify OAuth Provider integration.
+ * Uses the authorization code flow with the "user-read-email" scope.
+ */
+export declare function createSpotifyProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+}>;

package/dist/auth/twitter-oauth.d.ts

@@ -0,0 +1,18 @@
+import type { OAuthProvider } from "./interfaces";
+/**
+ * Creates a Twitter/X OAuth 2.0 Provider integration.
+ *
+ * Uses OAuth 2.0 with PKCE (authorization code flow). The frontend must include
+ * the PKCE `code_verifier` when sending the authorization code.
+ *
+ * Twitter API v2 requires the "tweet.read" and "users.read" scopes at minimum,
+ * plus "offline.access" if refresh tokens are needed on Twitter's side.
+ */
+export declare function createTwitterProvider(config: {
+    clientId: string;
+    clientSecret: string;
+}): OAuthProvider<{
+    code: string;
+    redirectUri: string;
+    codeVerifier: string;
+}>;

package/dist/backup/backup-common.d.ts

@@ -0,0 +1,31 @@
+import type { BackupInfo } from "@rebasepro/types";
+import type { StorageController } from "../storage";
+export type BackupDestination = {
+    kind: "local";
+    path: string;
+} | {
+    kind: "s3";
+    bucket: string;
+    prefix: string;
+} | {
+    kind: "gcs";
+    bucket: string;
+    prefix: string;
+};
+/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */
+export declare function parseBackupDestination(out: string): BackupDestination;
+/**
+ * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.
+ * Returns `null` for names that don't match, so foreign objects are ignored.
+ */
+export declare function parseBackupTimestamp(fileName: string): Date | null;
+/**
+ * List the backups at a destination as {@link BackupInfo}, newest first.
+ * Only `.dump` files are considered.
+ */
+export declare function listBackupObjects(dest: BackupDestination, storage?: StorageController): Promise<BackupInfo[]>;
+/** Read a single backup's bytes. Guards against path traversal for local. */
+export declare function readBackupBytes(dest: BackupDestination, key: string, storage?: StorageController): Promise<{
+    bytes: Uint8Array<ArrayBuffer>;
+    name: string;
+} | null>;

package/dist/backup/backup-routes.d.ts

@@ -0,0 +1,22 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "../api/types";
+import type { StorageController } from "../storage";
+import { BackupDestination } from "./backup-common";
+export interface BackupRoutesConfig {
+    /**
+     * Resolve the current backup destination, or `null` when backups are not
+     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't
+     * required to pick up config.
+     */
+    getDestination: () => BackupDestination | null;
+    /** Storage controller for object-storage destinations. */
+    storage?: StorageController;
+}
+/**
+ * Admin REST routes for the Backups panel.
+ *
+ * Routes (mounted under `/admin/backups`, admin-guarded by the caller):
+ *   GET /            → list available backups
+ *   GET /download    → download a backup's bytes (?key=…)
+ */
+export declare function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv>;

package/dist/backup/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Storage-generic backup helpers and admin routes for the Backups panel.
+ * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.
+ */
+export * from "./backup-common";
+export { createBackupRoutes } from "./backup-routes";
+export type { BackupRoutesConfig } from "./backup-routes";

package/dist/collections/BackendCollectionRegistry.d.ts

@@ -0,0 +1,13 @@
+import { CollectionRegistry } from "@rebasepro/common";
+import { CollectionRegistryInterface } from "../db/interfaces";
+/**
+ * Backend-agnostic collection registry.
+ * Satisfies CollectionRegistryInterface through inheritance from CollectionRegistry.
+ */
+export declare class BackendCollectionRegistry extends CollectionRegistry implements CollectionRegistryInterface {
+    /**
+     * Get the available relation keys for a given collection path.
+     * Maps from the collection's relation property names to the relation names.
+     */
+    getRelationKeysForCollection(collectionPath: string): string[];
+}

package/dist/collections/loader.d.ts

@@ -0,0 +1,39 @@
+import { CollectionConfig, SecurityRule } from "@rebasepro/types";
+/**
+ * The one definition of "the collections".
+ *
+ * Four copies of this scan used to exist — the runtime, the drizzle-schema
+ * generator, the policy generator and the doctor — each deciding for itself
+ * which files counted. They agreed only by discipline, and any drift between
+ * them would silently serve one set of collections while pushing policies for
+ * another. Everything that needs to know what the collections are calls this.
+ */
+/** Read from a directory's `index` module, or from a single-file source. */
+export interface CollectionDefaults {
+    /**
+     * Applied to every collection that declares no `securityRules` of its own.
+     *
+     * This lives with the collections rather than in the server config because
+     * `db push` generates the actual Postgres policies from these files and
+     * never sees the running server — a default declared on the server could
+     * never reach the database, and would look like an authorization setting
+     * while enforcing nothing.
+     */
+    defaultSecurityRules?: SecurityRule[];
+}
+/**
+ * Apply directory-level defaults. A collection declaring its own rules is left
+ * alone; one declaring none inherits these. Declaring neither leaves
+ * `securityRules` unset, which the policy generator treats as locked-by-default.
+ */
+export declare function applyCollectionDefaults(collections: CollectionConfig[], defaults: CollectionDefaults): CollectionConfig[];
+/**
+ * Load collections from a directory of collection files, or from a single
+ * module exporting `backendCollections` / `collections`.
+ *
+ * Throws if any file fails to import. A collection that cannot be loaded is a
+ * configuration error, and continuing produces the worst outcome available: an
+ * API missing a route, or a policy file missing a table, with a successful exit
+ * code. Both read as "no data" rather than as a failure.
+ */
+export declare function loadCollectionsFromDirectory(source: string): Promise<CollectionConfig[]>;

package/dist/cron/cron-loader.d.ts

@@ -0,0 +1,18 @@
+import type { CronJobDefinition } from "@rebasepro/types";
+import { type ModuleImporter } from "../utils/dynamic-import.js";
+export interface LoadedCronJob {
+    /** Job ID derived from filename (e.g. "cleanup-sessions"). */
+    id: string;
+    /** The full definition. */
+    definition: CronJobDefinition;
+}
+/**
+ * Auto-discover cron job files from a directory.
+ *
+ * Each file should default-export a `CronJobDefinition`.
+ * The filename (without extension) becomes the job ID:
+ *   `crons/cleanup-sessions.ts` → id = "cleanup-sessions"
+ *
+ * Follows the same discovery pattern as `loadFunctionsFromDirectory`.
+ */
+export declare function loadCronJobsFromDirectory(directory: string, importModule?: ModuleImporter): Promise<LoadedCronJob[]>;

package/dist/cron/cron-routes.d.ts

@@ -0,0 +1,14 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "../api/types";
+import type { CronScheduler } from "./cron-scheduler";
+/**
+ * Create admin REST routes for managing cron jobs.
+ *
+ * Routes:
+ *   GET    /          → list all cron jobs
+ *   GET    /:id       → get a single job's status
+ *   POST   /:id/trigger → manually trigger a job
+ *   GET    /:id/logs  → get execution logs for a job
+ *   PUT    /:id       → update job (enable/disable)
+ */
+export declare function createCronRoutes(scheduler: CronScheduler): Hono<HonoEnv>;