@rebasepro/server 0.15.0 → 0.16.0

package/dist/auth/api-keys/api-key-middleware.d.ts

@@ -17,7 +17,7 @@
  * injected `default_admin` policies; a non-admin key (roles `["service"]`,
  * uid `api-key:<id>`) only sees rows that a policy explicitly grants to the
  * `service` role or to the public. Owner-style policies
- * (`owner_id = auth.uid()`) never match an API key's synthetic uid.
+ * (`owner_id = rebase.uid()`) never match an API key's synthetic uid.
  *
  * @module
  */

package/dist/auth/jwt.d.ts

@@ -25,7 +25,7 @@ export interface JwtConfig {
 export interface AccessTokenPayload {
     /**
      * The user's id — the same spelling the domain model, the auth adapters and
-     * the RLS layer (`auth.uid()`) all use. Tokens minted before this rename
+     * the RLS layer (`rebase.uid()`) all use. Tokens minted before this rename
      * carry `uid` instead, and older external IdPs may send `sub`;
      * {@link verifyAccessToken} accepts all three and normalises to this.
      */

package/dist/auth/rls-scope.d.ts

@@ -25,7 +25,7 @@ import type { DataDriver } from "@rebasepro/types";
  *
  * - It passes the default policies through their `rolesOverlap(['admin'])`
  *   arm — the same arm an application user holding the `admin` role passes.
- * - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is therefore
+ * - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
  *   **false** for it. A collection with `disableDefaultPolicies: true` whose
  *   only rule is `serverContext()` denies these writes (42501) and returns
  *   zero rows for these reads.

package/dist/{auth-DIKS1rsI.js → auth-5Et5mnUA.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-B-E7RjdN.js";
+import { C as ListLimitError, D as isAnonymousUid, E as ANONYMOUS_USER_ID, T as resolveClientListLimit, a as deserializeLogicalCondition, i as deserializeFilter, r as UnknownFilterOperatorError } from "./src-BPfYOeN4.js";
 import "./src-CrCxd8km.js";
 import { n as createDdlBootstrapper, o as revokeInternalTableSql, s as isSQLAdmin } from "./ddl-bootstrap-Cywoj8Ta.js";
 import { S as canonicalStorageId, T as require_jsonwebtoken, _ as verifyMfaPendingToken, a as generateMfaPendingToken, c as getJwks, d as hasAsymmetricSigningKey, f as hashRefreshToken, g as verifyDownloadToken, h as verifyAccessToken, i as generateDownloadToken, l as getRefreshTokenExpiry, n as configureJwt, o as generateRefreshToken, p as isJwtConfigured, r as generateAccessToken, s as getAccessTokenExpiry, t as MAX_COOKIE_AGE_MS, u as getRefreshTokenTtlMs, w as tryCanonicalStorageKey } from "./jwt-DxH9fLPt.js";
@@ -589,7 +589,7 @@ var import_jsonwebtoken = /* @__PURE__ */ __toESM(require_jsonwebtoken(), 1);
 *
 * - It passes the default policies through their `rolesOverlap(['admin'])`
 *   arm — the same arm an application user holding the `admin` role passes.
-* - `policy.serverContext()` compiles to `auth.uid() IS NULL` and is therefore
+* - `policy.serverContext()` compiles to `rebase.uid() IS NULL` and is therefore
 *   **false** for it. A collection with `disableDefaultPolicies: true` whose
 *   only rule is `serverContext()` denies these writes (42501) and returns
 *   zero rows for these reads.
@@ -710,7 +710,7 @@ function extractBearerToken(authHeader) {
 * injected `default_admin` policies; a non-admin key (roles `["service"]`,
 * uid `api-key:<id>`) only sees rows that a policy explicitly grants to the
 * `service` role or to the public. Owner-style policies
-* (`owner_id = auth.uid()`) never match an API key's synthetic uid.
+* (`owner_id = rebase.uid()`) never match an API key's synthetic uid.
 *
 * @module
 */
@@ -1561,9 +1561,90 @@ var styles = {
     `)
 };
 /**
+* The app name every template falls back to when `email.appName` is unset.
+*/
+var DEFAULT_APP_NAME = "Rebase";
+/**
+* The Rebase mark, hosted. Mail clients do not render SVG (Gmail strips it
+* outright), so this is the PNG rather than `logo.svg`, and it is an absolute
+* URL rather than a data URI because Gmail blocks those in `<img src>` too.
+*/
+var REBASE_LOGO_URL = "https://rebase.pro/img/logo_small.png";
+/**
+* Whether a configured logo can actually be fetched by a mail client.
+*
+* A relative path, a `data:` URI or a `file:` URL all produce a broken image in
+* the recipient's inbox rather than an error anyone would see, so an unusable
+* value renders no logo at all instead. This is deliberately not a boot-time
+* assert like `assertEmailLinkBases`: a dead link makes the mail useless, a
+* missing logo only makes it plain.
+*/
+function isMailableImageUrl(url) {
+	if (!url) return false;
+	try {
+		const { protocol } = new URL(url);
+		return protocol === "https:" || protocol === "http:";
+	} catch {
+		return false;
+	}
+}
+/**
+* Whether this config still carries the stock app name — i.e. nobody has
+* branded this install.
+*
+* Testing against the *value* rather than against `undefined` is deliberate and
+* load-bearing: `APP_NAME` is declared `z.string().default("Rebase")` in the
+* cloud, in the demo app and in the eject template, so `appName` arrives here as
+* the literal string "Rebase" even when the operator set nothing. Keying the
+* fallback on `appName === undefined` would mean the logo never appeared in any
+* Rebase-run product.
+*/
+function isUnbranded(appName) {
+	return !appName || appName === DEFAULT_APP_NAME;
+}
+/**
+* Resolve the branding a template should render from the email config.
+*
+* The fallback is asymmetric on purpose. `appName` falls back to "Rebase"
+* because an unconfigured app has no better name to show. The *logo* is stricter:
+* an app that named itself "Acme" but set no `logoUrl` gets no logo at all,
+* because the alternative is mailing Acme's users a Rebase mark from Acme's
+* domain. Only an install that has not renamed itself is treated as Rebase's own.
+*/
+function resolveEmailBranding(config) {
+	const logoUrl = config?.logoUrl ?? (isUnbranded(config?.appName) ? REBASE_LOGO_URL : void 0);
+	return {
+		appName: config?.appName || DEFAULT_APP_NAME,
+		logoUrl: isMailableImageUrl(logoUrl) ? logoUrl : void 0
+	};
+}
+/**
+* The logo block that sits above the card in every default template.
+*
+* `width`/`height` are attributes as well as CSS because Outlook's Word renderer
+* ignores the style block. `alt` carries the app name, for screen readers and
+* for the very common case of a client that blocks remote images on a first
+* email from an unknown sender.
+*
+* The type styling on the `<img>` is what that blocked case falls back to: alt
+* text inherits it, and at the body's 16px "Rebase" overflows a 48px box and
+* renders as "Rebas". 12px plus `height: auto` — CSS the clients that block
+* images do read, while Outlook still sizes from the attributes — lets the name
+* through intact.
+*/
+function renderHeader(appName, logoUrl) {
+	if (!logoUrl) return raw("");
+	return html`
+        <div style="text-align: center; margin-bottom: 24px;">
+            <img src="${logoUrl}" width="48" height="48" alt="${appName}"
+                 style="display: inline-block; width: 48px; height: auto; border: 0; outline: none; text-decoration: none; font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, 'Helvetica Neue', Arial, sans-serif; font-size: 12px; color: #64748b;">
+        </div>
+`;
+}
+/**
 * Default password reset email template
 */
-function getPasswordResetTemplate(resetUrl, user, appName = "Rebase") {
+function getPasswordResetTemplate(resetUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
 	const greeting = getGreeting(user);
 	const subject = `Reset your ${appName} password`;
 	const body = html`
@@ -1575,7 +1656,7 @@ function getPasswordResetTemplate(resetUrl, user, appName = "Rebase") {
     <title>${subject}</title>
 </head>
 <body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Reset Your Password</h1>
             
@@ -1638,7 +1719,7 @@ Your password will remain unchanged.
 /**
 * Default email verification template
 */
-function getEmailVerificationTemplate(verifyUrl, user, appName = "Rebase") {
+function getEmailVerificationTemplate(verifyUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
 	const greeting = getGreeting(user);
 	const subject = `Verify your ${appName} email address`;
 	const body = html`
@@ -1650,7 +1731,7 @@ function getEmailVerificationTemplate(verifyUrl, user, appName = "Rebase") {
     <title>${subject}</title>
 </head>
 <body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Verify Your Email</h1>
             
@@ -1704,7 +1785,7 @@ If you didn't create an account with ${appName}, you can safely ignore this emai
 * Default user invitation email template
 * Sent when an admin creates a new user account
 */
-function getUserInvitationTemplate(setPasswordUrl, user, appName = "Rebase") {
+function getUserInvitationTemplate(setPasswordUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
 	const greeting = getGreeting(user);
 	const subject = `You've been invited to ${appName}`;
 	const body = html`
@@ -1716,7 +1797,7 @@ function getUserInvitationTemplate(setPasswordUrl, user, appName = "Rebase") {
     <title>${subject}</title>
 </head>
 <body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Welcome to ${appName}!</h1>
             
@@ -1778,7 +1859,7 @@ If you weren't expecting this invitation, you can safely ignore this email.
 * Default welcome email template
 * Sent automatically when a new user registers
 */
-function getWelcomeEmailTemplate(user, appName = "Rebase", loginUrl) {
+function getWelcomeEmailTemplate(user, appName = DEFAULT_APP_NAME, loginUrl, logoUrl) {
 	const greeting = getGreeting(user);
 	const url = loginUrl || "";
 	const subject = `¡Bienvenido/a a ${appName}!`;
@@ -1791,7 +1872,7 @@ function getWelcomeEmailTemplate(user, appName = "Rebase", loginUrl) {
     <title>${subject}</title>
 </head>
 <body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">¡Bienvenido/a a ${appName}!</h1>
             
@@ -1851,7 +1932,7 @@ Si tienes alguna pregunta, no dudes en contactarnos respondiendo a este correo.
 /**
 * Default magic link email template
 */
-function getMagicLinkTemplate(magicLinkUrl, user, appName = "Rebase") {
+function getMagicLinkTemplate(magicLinkUrl, user, appName = DEFAULT_APP_NAME, logoUrl) {
 	const greeting = getGreeting(user);
 	const subject = `Sign in to ${appName}`;
 	const body = html`
@@ -1863,7 +1944,7 @@ function getMagicLinkTemplate(magicLinkUrl, user, appName = "Rebase") {
     <title>${subject}</title>
 </head>
 <body style="margin: 0; padding: 0; background-color: #f8fafc;">
-    <div style="${styles.container}">
+    <div style="${styles.container}">${renderHeader(appName, logoUrl)}
         <div style="${styles.card}">
             <h1 style="${styles.heading}">Sign In to ${appName}</h1>
             
@@ -2054,7 +2135,7 @@ async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
 		const expiresAt = new Date(Date.now() + 1440 * 60 * 1e3);
 		await ctx.authRepo.createPasswordResetToken(entity.id, tokenHash, expiresAt);
 		const setPasswordUrl = `${ctx.emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
-		const appName = ctx.emailConfig?.appName || "Rebase";
+		const { appName, logoUrl } = resolveEmailBranding(ctx.emailConfig);
 		const templateFn = ctx.emailConfig?.templates?.userInvitation;
 		const emailContent = templateFn ? templateFn(setPasswordUrl, {
 			email: entity.values.email,
@@ -2062,7 +2143,7 @@ async function finalizeAdminUserCreation(entity, clearPassword, ctx) {
 		}) : getUserInvitationTemplate(setPasswordUrl, {
 			email: entity.values.email,
 			displayName: entity.values.displayName
-		}, appName);
+		}, appName, logoUrl);
 		await ctx.emailService.send({
 			to: entity.values.email,
 			subject: emailContent.subject,
@@ -2633,6 +2714,36 @@ var DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT = 3e3;
 function createDataRateLimiter(config = {}) {
 	const { windowMs = 900 * 1e3, apiKey: apiKeyLimit = 1e3, user: userLimit = 1e3, anonymous: anonLimit = 300, store = new MemoryRateLimitStore(windowMs) } = config;
 	const trustedProxyHops = resolveTrustedProxyHops(config.trustedProxyHops);
+	/**
+	* Who this request is, for bucketing only.
+	*
+	* `c.get("user")` is the answer whenever an auth middleware has already run.
+	* On the storage router it has not: the limiter is registered before
+	* `route("/")`, and the JWT middlewares live inside those routes, so a
+	* signed-in caller reached here indistinguishable from an anonymous one and
+	* was bucketed `ip:` at the anonymous allowance. Everyone behind one NAT
+	* shared 300 requests per window, and the admin panel — which mints a
+	* download token per file — spent them on a single page of thumbnails.
+	*
+	* Reading the token here rather than moving the limiter is deliberate. The
+	* limiter has to run *before* the routes to guard them, and pre-resolving
+	* the user into the context instead would change authorization: the storage
+	* adapter path enforces on `c.get("user")` when its own `verifyRequest`
+	* finds nobody, so seeding that key would let a Rebase-signed JWT satisfy a
+	* deployment that delegates auth to Firebase or Clerk. Nothing here writes
+	* to the context; an identity that fails to verify simply buckets by IP,
+	* exactly as before.
+	*/
+	const identify = (c) => {
+		const user = c.get("user");
+		if (user?.uid) return isAnonymousUid(user.uid) ? void 0 : user.uid;
+		if (!isJwtConfigured()) return void 0;
+		const token = extractBearerToken(c.req.header("authorization"));
+		if (token === void 0) return void 0;
+		const payload = verifyAccessToken(token);
+		if (!payload?.uid || isAnonymousUid(payload.uid)) return void 0;
+		return payload.uid;
+	};
 	return createRateLimiter({
 		windowMs,
 		store,
@@ -2640,16 +2751,14 @@ function createDataRateLimiter(config = {}) {
 		keyGenerator: (c) => {
 			const key = c.get("apiKey");
 			if (key) return `api-key:${key.id}`;
-			const user = c.get("user");
-			if (user?.uid && !isAnonymousUid(user.uid)) return `user:${user.uid}`;
+			const uid = identify(c);
+			if (uid) return `user:${uid}`;
 			return `ip:${defaultKeyGenerator(c, trustedProxyHops)}`;
 		},
 		resolveLimit: (c) => {
 			const key = c.get("apiKey");
 			if (key) return key.rate_limit ?? apiKeyLimit;
-			const user = c.get("user");
-			if (user?.uid && !isAnonymousUid(user.uid)) return userLimit;
-			return anonLimit;
+			return identify(c) ? userLimit : anonLimit;
 		}
 	});
 }
@@ -7627,7 +7736,7 @@ function mountMagicLinkRoutes(deps) {
 			const expiresAt = getMagicLinkExpiry();
 			await authRepo.createMagicLinkToken(user.id, tokenHash, expiresAt);
 			const magicLinkUrl = `${resolveEmailLinkBase(emailConfig, "magicLink")}/auth/magic-link?token=${token}`;
-			const appName = emailConfig?.appName || "Rebase";
+			const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 			const templateFn = emailConfig?.templates?.magicLink;
 			const emailContent = templateFn ? templateFn(magicLinkUrl, {
 				email: user.email,
@@ -7635,7 +7744,7 @@ function mountMagicLinkRoutes(deps) {
 			}) : getMagicLinkTemplate(magicLinkUrl, {
 				email: user.email,
 				displayName: user.displayName
-			}, appName);
+			}, appName, logoUrl);
 			try {
 				await emailService.send({
 					to: user.email,
@@ -7849,10 +7958,10 @@ function createAuthRoutes(config) {
 	*/
 	function sendWelcomeEmail(user) {
 		if (!isEmailConfigured()) return;
-		const appName = emailConfig?.appName || "Rebase";
+		const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 		const loginUrl = resolveEmailLinkBase(emailConfig, "resetPassword");
 		const templateFn = emailConfig?.templates?.welcomeEmail;
-		const emailContent = templateFn ? templateFn(user, appName) : getWelcomeEmailTemplate(user, appName, loginUrl ? `${loginUrl}/app` : void 0);
+		const emailContent = templateFn ? templateFn(user, appName) : getWelcomeEmailTemplate(user, appName, loginUrl ? `${loginUrl}/app` : void 0, logoUrl);
 		emailService.send({
 			to: user.email,
 			subject: emailContent.subject,
@@ -8123,7 +8232,7 @@ function createAuthRoutes(config) {
 			const expiresAt = getPasswordResetExpiry();
 			await authRepo.createPasswordResetToken(user.id, tokenHash, expiresAt);
 			const resetUrl = `${resolveEmailLinkBase(emailConfig, "resetPassword")}/reset-password?token=${token}`;
-			const appName = emailConfig?.appName || "Rebase";
+			const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 			const templateFn = emailConfig?.templates?.passwordReset;
 			const emailContent = templateFn ? templateFn(resetUrl, {
 				email: user.email,
@@ -8131,7 +8240,7 @@ function createAuthRoutes(config) {
 			}) : getPasswordResetTemplate(resetUrl, {
 				email: user.email,
 				displayName: user.displayName
-			}, appName);
+			}, appName, logoUrl);
 			try {
 				await emailService.send({
 					to: user.email,
@@ -8215,7 +8324,7 @@ function createAuthRoutes(config) {
 		const token = generateSecureToken();
 		await authRepo.setVerificationToken(user.id, hashToken(token));
 		const verifyUrl = `${resolveEmailLinkBase(emailConfig, "verifyEmail")}/verify-email?token=${token}`;
-		const appName = emailConfig?.appName || "Rebase";
+		const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 		const templateFn = emailConfig?.templates?.emailVerification;
 		const emailContent = templateFn ? templateFn(verifyUrl, {
 			email: user.email,
@@ -8223,7 +8332,7 @@ function createAuthRoutes(config) {
 		}) : getEmailVerificationTemplate(verifyUrl, {
 			email: user.email,
 			displayName: user.displayName
-		}, appName);
+		}, appName, logoUrl);
 		await emailService.send({
 			to: user.email,
 			subject: emailContent.subject,
@@ -8432,7 +8541,7 @@ function createResetPasswordRoute(config) {
 			const expiresAt = new Date(Date.now() + 3600 * 1e3);
 			await authRepo.createPasswordResetToken(existing.id, tokenHash, expiresAt);
 			const setPasswordUrl = `${emailConfig?.resetPasswordUrl || ""}/reset-password?token=${token}`;
-			const appName = emailConfig?.appName || "Rebase";
+			const { appName, logoUrl } = resolveEmailBranding(emailConfig);
 			const templateFn = emailConfig?.templates?.passwordReset;
 			const emailContent = templateFn ? templateFn(setPasswordUrl, {
 				email: existing.email,
@@ -8440,7 +8549,7 @@ function createResetPasswordRoute(config) {
 			}) : getPasswordResetTemplate(setPasswordUrl, {
 				email: existing.email,
 				displayName: existing.displayName
-			}, appName);
+			}, appName, logoUrl);
 			await emailService.send({
 				to: existing.email,
 				subject: emailContent.subject,
@@ -10697,6 +10806,6 @@ var auth_exports = /* @__PURE__ */ __exportAll({
 	verifyPassword: () => verifyPassword
 });
 //#endregion
-export { createAuthMiddleware as $, _coercedNumber as A, validatePasswordStrength as B, providerVerifiedEmail as C, resolveListLimitParam as Ct, _enum as D, ZodNumber as E, createEmailService as F, getPasswordResetTemplate as G, generateSecurePassword as H, assertEmailLinkBases as I, RawHtml as J, getUserInvitationTemplate as K, resolveEmailLinkBase as L, createDataRateLimiter as M, MemoryRateLimitStore as N, object as O, SMTPEmailService as P, createAdapterAuthMiddleware as Q, resolveAuthHooks as R, pkceTokenParams as S, parseQueryOptions as St, createBuiltinAuthAdapter as T, isPublicStoragePath as Tt, getEmailVerificationTemplate as U, verifyPassword as V, getMagicLinkTemplate as W, html as X, escapeHtml as Y, raw as Z, verifyOidcIdToken as _, httpMethodToOperation as _t, resolveRateLimitStoreKind as a, queryTokenAuth as at, createGoogleProvider as b, parseAggregateSelect as bt, createSlackProvider as c, createApiKeyPreAuth as ct, createDiscordProvider as d, isApiKeyToken as dt, createRequireAuth as et, createTwitterProvider as f, validateApiKey as ft, tryVerifyOidcIdToken as g, scopeDataDriver as gt, createMicrosoftProvider as h, SERVICE_IDENTITY as ht, createApiKeyStore as i, publicObjectAuth as it, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as j, string as k, createBitbucketProvider as l, createFunctionApiKeyGuard as lt, createAppleProvider as m, safeCompare as mt, createCustomAuthAdapter as n, fileTokenAuth as nt, createSqlRateLimitStore as o, requireAdmin as ot, createFacebookProvider as p, extractBearerToken as pt, getWelcomeEmailTemplate as q, createApiKeyRoutes as r, optionalAuth as rt, createSpotifyProvider as s, requireAuth as st, auth_exports as t, extractUserFromToken as tt, createGitLabProvider as u, createStorageApiKeyGuard as ut, createGitHubProvider as v, isOperationAllowed as vt, createJwksRoutes as w, PUBLIC_STORAGE_PREFIX as wt, oauthCodeFlowSchema as x, parseGroupBy as xt, createLinkedinProvider as y, orderByEntriesToTuples as yt, hashPassword as z };
+export { createAdapterAuthMiddleware as $, _coercedNumber as A, validatePasswordStrength as B, providerVerifiedEmail as C, parseQueryOptions as Ct, _enum as D, ZodNumber as E, isPublicStoragePath as Et, createEmailService as F, getPasswordResetTemplate as G, generateSecurePassword as H, assertEmailLinkBases as I, resolveEmailBranding as J, getUserInvitationTemplate as K, resolveEmailLinkBase as L, createDataRateLimiter as M, MemoryRateLimitStore as N, object as O, SMTPEmailService as P, raw as Q, resolveAuthHooks as R, pkceTokenParams as S, parseGroupBy as St, createBuiltinAuthAdapter as T, PUBLIC_STORAGE_PREFIX as Tt, getEmailVerificationTemplate as U, verifyPassword as V, getMagicLinkTemplate as W, escapeHtml as X, RawHtml as Y, html as Z, verifyOidcIdToken as _, scopeDataDriver as _t, resolveRateLimitStoreKind as a, publicObjectAuth as at, createGoogleProvider as b, orderByEntriesToTuples as bt, createSlackProvider as c, requireAuth as ct, createDiscordProvider as d, createStorageApiKeyGuard as dt, createAuthMiddleware as et, createTwitterProvider as f, isApiKeyToken as ft, tryVerifyOidcIdToken as g, SERVICE_IDENTITY as gt, createMicrosoftProvider as h, safeCompare as ht, createApiKeyStore as i, optionalAuth as it, DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT as j, string as k, createBitbucketProvider as l, createApiKeyPreAuth as lt, createAppleProvider as m, extractBearerToken as mt, createCustomAuthAdapter as n, extractUserFromToken as nt, createSqlRateLimitStore as o, queryTokenAuth as ot, createFacebookProvider as p, validateApiKey as pt, getWelcomeEmailTemplate as q, createApiKeyRoutes as r, fileTokenAuth as rt, createSpotifyProvider as s, requireAdmin as st, auth_exports as t, createRequireAuth as tt, createGitLabProvider as u, createFunctionApiKeyGuard as ut, createGitHubProvider as v, httpMethodToOperation as vt, createJwksRoutes as w, resolveListLimitParam as wt, oauthCodeFlowSchema as x, parseAggregateSelect as xt, createLinkedinProvider as y, isOperationAllowed as yt, hashPassword as z };
 
-//# sourceMappingURL=auth-DIKS1rsI.js.map
+//# sourceMappingURL=auth-5Et5mnUA.js.map