@rebasepro/server 0.16.0 → 0.16.1-canary.g2d1aec8

package/dist/schema-edit/local-git-repository.d.ts

@@ -0,0 +1,28 @@
+import type { SchemaEditRepository } from "./apply-schema-change.js";
+export interface LocalGitOptions {
+    /** Absolute path to the working tree the collections live in. */
+    root: string;
+    /**
+     * Who the commit is attributed to. Defaults to the repository's own git
+     * config, which is right for a developer's machine and wrong for a server
+     * — a panel edit should say which account made it.
+     */
+    author?: {
+        name: string;
+        email: string;
+    };
+}
+export declare class GitCommandError extends Error {
+    constructor(command: string, detail: string);
+}
+/**
+ * The top of the working tree containing `startDir`, or undefined.
+ *
+ * Resolved by asking git rather than by walking for a `.git`, because a
+ * worktree's `.git` is a file and a submodule's is neither where nor what a
+ * naive walk expects.
+ */
+export declare function findRepositoryRoot(startDir: string): Promise<string | undefined>;
+/** True when `root` is inside a git working tree. */
+export declare function isGitRepository(root: string): Promise<boolean>;
+export declare function createLocalGitRepository(options: LocalGitOptions): SchemaEditRepository;

package/dist/schema-edit/project-root.d.ts

@@ -0,0 +1,29 @@
+import { type SchemaCommitPaths } from "@rebasepro/types";
+/**
+ * The nearest ancestor of `startDir` holding a `rebase.json`.
+ *
+ * Bounded, like the storage-source loader it mirrors: an unbounded walk from a
+ * misconfigured path climbs to the filesystem root and reads whatever it finds
+ * there. `undefined` when there is none, which is a project that predates the
+ * file — the caller then keeps the historical behaviour rather than guessing.
+ */
+/**
+ * Where a scaffolded project keeps its collection source, project-relative.
+ *
+ * A bundle's own collections directory is compiled output, so nothing on the
+ * running machine points at this. A deployment committing to a repository states
+ * it, and this is the default it states nothing against.
+ */
+export declare const DEFAULT_COLLECTIONS_PATH = "config/collections";
+export declare function findProjectRoot(startDir: string, levels?: number): string | undefined;
+/**
+ * The generated-artifact paths for a project, expressed relative to the
+ * repository that will hold the commit.
+ *
+ * Returns `undefined` when there is nothing to correct — no project marker, or
+ * a project that *is* the repository — so the caller passes no override and the
+ * defaults stand. Saying "no change needed" is different from saying
+ * "the change is a no-op prefix", and only the first leaves the existing
+ * behaviour untouched for every project that already worked.
+ */
+export declare function commitPathsFor(collectionsDir: string, repositoryRoot: string): Partial<SchemaCommitPaths> | undefined;

package/dist/schema-edit/remote-source.d.ts

@@ -0,0 +1,25 @@
+import type { SchemaChangeFile } from "@rebasepro/types";
+import type { SchemaEditRepository } from "./apply-schema-change.js";
+export interface RemoteSourceOptions {
+    repository: SchemaEditRepository;
+    /**
+     * Where the collection *source* lives in the repository, as a repo-relative
+     * posix path — `config/collections`, or `app/config/collections` for a
+     * project in a subdirectory.
+     *
+     * Not derivable from the bundle: its `collectionsDir` points at compiled
+     * output, which is a different directory holding different files.
+     */
+    collectionsPath: string;
+    /** Applies the edit. Injected so this module needs no `ts-morph`. */
+    edit: (collectionsDir: string, collectionId: string, collection: Record<string, unknown>) => Promise<void>;
+}
+/**
+ * Fetch, rewrite, and return the changed file — without leaving anything behind.
+ *
+ * The scratch directory is removed on every path, including the failing one. It
+ * holds a copy of the customer's collection source, and a temp directory that
+ * accumulates those on a long-running server is a slow leak of exactly the
+ * thing worth not leaking.
+ */
+export declare function rewriteRemoteCollection(options: RemoteSourceOptions, collectionId: string, collection: Record<string, unknown>): Promise<SchemaChangeFile[]>;

package/dist/schema-edit/schema-edit-permissions.d.ts

@@ -0,0 +1,129 @@
+/**
+ * Who may plan a schema change, and who may apply one.
+ *
+ * Being an admin is one privilege. Applying a schema change is two: it alters
+ * the database, and it writes a commit into the project's repository under
+ * somebody's name. `requireAdmin` in front of both routes answers the first
+ * question and never asks the second.
+ *
+ * `admin-roles.ts` says the rest of it: `schema-admin` is administrative
+ * "by any definition that matters", and "if a genuinely lesser role is added
+ * later, it does not belong in this list — it belongs in a capability check of
+ * its own". This is that check.
+ *
+ * ## The split that matters is not between roles
+ *
+ * It is between a person and a machine.
+ *
+ * `plan` has no side effects. It reads the collections, reads the database
+ * catalogue, and answers what would happen. Anyone already through the admin
+ * gate may do it, and a CI job that wants to know whether a proposed collection
+ * change is applicable is a *good* use of this API.
+ *
+ * `apply` commits. The commit carries an author, and the author is the point —
+ * the code that builds it says so: a schema change with an author and a diff in
+ * the project's history is the thing worth having, and an anonymous one is just
+ * a commit. A service key has no author. `api-key:7c3f…` has no author. Letting
+ * either write to the project's source produces exactly the unattributable
+ * history the feature exists to replace, and does it with a credential that is
+ * likely to be sitting in a CI environment variable.
+ *
+ * So machines plan by default and do not apply. An operator who genuinely wants
+ * an automated schema change — a migration pipeline, say — turns it on
+ * deliberately and gets a commit that says plainly which key made it.
+ */
+/** What a caller is allowed to do with the live schema editor. */
+export interface SchemaEditCapabilities {
+    /** Preview a change. No side effects. */
+    plan: boolean;
+    /** Commit the change and run the DDL. */
+    apply: boolean;
+    /**
+     * Why `apply` is denied, when it is and `plan` is not.
+     *
+     * Carried so the panel can grey out the button *and say why*, rather than
+     * letting somebody read a plan, decide, press, and only then be refused.
+     */
+    reason?: string;
+    /** A stable code for the refusal, for clients that branch rather than read. */
+    code?: string;
+}
+/** The kind of caller, which is what the `apply` decision turns on. */
+export type PrincipalKind = "person" | "machine" | "anonymous";
+export interface SchemaEditPrincipal {
+    kind: PrincipalKind;
+    /** Empty for an anonymous caller. */
+    uid: string;
+    roles: string[];
+    /** How the machine identified itself, for the refusal message. */
+    machineKind?: "service-key" | "api-key";
+}
+/** Read the caller off the request context's `user`. */
+export declare function classifyPrincipal(user: unknown): SchemaEditPrincipal;
+/**
+ * A repository that is not on this machine.
+ *
+ * Configured by a deployment running built output — every Cloud tenant, and any
+ * self-host serving a bundle. Without it, live schema editing needs the source
+ * on disk and refuses when there is none.
+ */
+export interface RemoteRepositoryConfig {
+    kind: "github";
+    owner: string;
+    repo: string;
+    /** Defaults to `main`. */
+    branch?: string;
+    /**
+     * Where the collection **source** lives in that repository, repo-relative.
+     * Defaults to `config/collections`.
+     *
+     * Not derivable from the running bundle, whose collections directory holds
+     * compiled output — a different directory with different files.
+     */
+    collectionsPath?: string;
+    /**
+     * A GitHub App installation, or a token.
+     *
+     * The app is for a control plane holding one key across many projects; the
+     * token is for a single self-hoster who would otherwise have to stand one
+     * up to let their own server commit to their own repository.
+     */
+    auth: {
+        kind: "app";
+        appId: string;
+        privateKey: string;
+        installationId: string;
+    } | {
+        kind: "token";
+        token: string;
+    };
+}
+export interface SchemaEditPolicy {
+    /**
+     * Let a service key or an API key commit a schema change.
+     *
+     * Off by default. On, the commit is attributed to the credential rather
+     * than to a person, and says so — see {@link machineCommitAuthor}.
+     */
+    allowMachineApply?: boolean;
+}
+/**
+ * What this caller may do.
+ *
+ * Assumes the admin gate has already run — this refines that decision rather
+ * than replacing it, and an anonymous caller should never have reached here.
+ * Handled anyway, because a capability function that trusts its caller to have
+ * checked is one bad refactor away from granting everything.
+ */
+export declare function schemaEditCapabilities(principal: SchemaEditPrincipal, policy?: SchemaEditPolicy): SchemaEditCapabilities;
+/**
+ * The git identity for a machine that has been allowed to apply.
+ *
+ * Named for what it is. An operator reading `git log` a month from now should
+ * be able to tell a change somebody made from one a pipeline made, and a
+ * credential wearing a person-shaped name is how that distinction is lost.
+ */
+export declare function machineCommitAuthor(principal: SchemaEditPrincipal): {
+    name: string;
+    email: string;
+};

package/dist/schema-editor-routes-yh2cQcdJ.js

@@ -0,0 +1,44 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { n as errorHandler } from "./errors-D_LwNKRM.js";
+import { AstSchemaEditor } from "./ast-schema-editor-BpFYpT38.js";
+import { Hono } from "hono";
+//#region src/api/schema-editor-routes.ts
+function createSchemaEditorRoutes(collectionsDir) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	const editor = new AstSchemaEditor(collectionsDir);
+	router.post("/property/save", async (c) => {
+		const { collectionId, propertyKey, propertyConfig } = await c.req.json();
+		await editor.saveProperty(collectionId, propertyKey, propertyConfig);
+		return c.json({ success: true });
+	});
+	router.post("/property/delete", async (c) => {
+		const { collectionId, propertyKey } = await c.req.json();
+		await editor.deleteProperty(collectionId, propertyKey);
+		return c.json({ success: true });
+	});
+	/**
+	* `partial: true` means "this payload is what changed", not "this is the
+	* collection". Without it a one-key patch — which is what adding a column
+	* posts — is read as a whole-collection save and deletes everything it does
+	* not mention, `securityRules` included. Absent, it defaults to a full save,
+	* so an older panel keeps the behaviour it was written against.
+	*/
+	router.post("/collection/save", async (c) => {
+		const { collectionId, collectionData, partial } = await c.req.json();
+		await editor.saveCollection(collectionId, collectionData, { partial: partial === true });
+		return c.json({ success: true });
+	});
+	router.post("/collection/delete", async (c) => {
+		const { collectionId } = await c.req.json();
+		await editor.deleteCollection(collectionId);
+		return c.json({ success: true });
+	});
+	return router;
+}
+//#endregion
+export { createSchemaEditorRoutes };
+
+//# sourceMappingURL=schema-editor-routes-yh2cQcdJ.js.map

package/dist/schema-editor-routes-yh2cQcdJ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-editor-routes-yh2cQcdJ.js","names":[],"sources":["../src/api/schema-editor-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport { AstSchemaEditor } from \"./ast-schema-editor\";\nimport { errorHandler } from \"./errors\";\nimport { HonoEnv } from \"./types\";\n\nexport function createSchemaEditorRoutes(collectionsDir: string): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n    const editor = new AstSchemaEditor(collectionsDir);\n\n    router.post(\"/property/save\", async (c) => {\n        const body = await c.req.json();\n        const { collectionId, propertyKey, propertyConfig } = body;\n        await editor.saveProperty(collectionId, propertyKey, propertyConfig);\n        return c.json({ success: true });\n    });\n\n    router.post(\"/property/delete\", async (c) => {\n        const body = await c.req.json();\n        const { collectionId, propertyKey } = body;\n        await editor.deleteProperty(collectionId, propertyKey);\n        return c.json({ success: true });\n    });\n\n    /**\n     * `partial: true` means \"this payload is what changed\", not \"this is the\n     * collection\". Without it a one-key patch — which is what adding a column\n     * posts — is read as a whole-collection save and deletes everything it does\n     * not mention, `securityRules` included. Absent, it defaults to a full save,\n     * so an older panel keeps the behaviour it was written against.\n     */\n    router.post(\"/collection/save\", async (c) => {\n        const body = await c.req.json();\n        const { collectionId, collectionData, partial } = body;\n        await editor.saveCollection(collectionId, collectionData, { partial: partial === true });\n        return c.json({ success: true });\n    });\n\n    router.post(\"/collection/delete\", async (c) => {\n        const body = await c.req.json();\n        const { collectionId } = body;\n        await editor.deleteCollection(collectionId);\n        return c.json({ success: true });\n    });\n\n    return router;\n}\n\n"],"mappings":";;;;;;;AAKA,SAAgB,yBAAyB,gBAAuC;CAC5E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAC3B,MAAM,SAAS,IAAI,gBAAgB,cAAc;CAEjD,OAAO,KAAK,kBAAkB,OAAO,MAAM;EAEvC,MAAM,EAAE,cAAc,aAAa,mBAAmB,MADnC,EAAE,IAAI,KAAK;EAE9B,MAAM,OAAO,aAAa,cAAc,aAAa,cAAc;EACnE,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO,KAAK,oBAAoB,OAAO,MAAM;EAEzC,MAAM,EAAE,cAAc,gBAAgB,MADnB,EAAE,IAAI,KAAK;EAE9B,MAAM,OAAO,eAAe,cAAc,WAAW;EACrD,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;;;;;;;;CASD,OAAO,KAAK,oBAAoB,OAAO,MAAM;EAEzC,MAAM,EAAE,cAAc,gBAAgB,YAAY,MAD/B,EAAE,IAAI,KAAK;EAE9B,MAAM,OAAO,eAAe,cAAc,gBAAgB,EAAE,SAAS,YAAY,KAAK,CAAC;EACvF,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO,KAAK,sBAAsB,OAAO,MAAM;EAE3C,MAAM,EAAE,iBAAiB,MADN,EAAE,IAAI,KAAK;EAE9B,MAAM,OAAO,iBAAiB,YAAY;EAC1C,OAAO,EAAE,KAAK,EAAE,SAAS,KAAK,CAAC;CACnC,CAAC;CAED,OAAO;AACX"}

package/dist/services/webhook-service.d.ts

@@ -1,4 +1,4 @@
-import type { JobQueueClient } from "../jobs/types";
+import type { JobQueueClient } from "../jobs/types.js";
 /**
  * The task name a queued webhook delivery is stored under.
  *

package/dist/singleton.d.ts

@@ -1,4 +1,11 @@
 import type { RebaseServerClient } from "@rebasepro/types";
+/**
+ * @internal Register the per-call resolver described on {@link RESOLVER_SLOT}.
+ *
+ * For runtime adapters, not for application code. Pass `null` to unregister.
+ * Returns the previous resolver so an adapter can restore it.
+ */
+export declare function _setRebaseResolver(resolve: (() => RebaseServerClient | null) | null): (() => RebaseServerClient | null) | null;
 /**
  * @internal Called once during server initialization to set the backing instance.
  * This is invoked by `initializeRebaseBackend()` — never call it manually.

package/dist/storage/GCSStorageController.d.ts

@@ -5,7 +5,7 @@
  * optional peer dependency — users who don't need GCS never pay for the
  * import cost or need it installed.
  */
-import { StorageController, GCSStorageConfig } from "./types";
+import { StorageController, GCSStorageConfig } from "./types.js";
 import { UploadFileProps, UploadFileResult, DownloadConfig, StorageListResult } from "@rebasepro/types";
 /**
  * Google Cloud Storage implementation of `StorageController`.

package/dist/storage/LocalStorageController.d.ts

@@ -1,7 +1,7 @@
 /**
  * Local filesystem storage controller
  */
-import { StorageController, LocalStorageConfig } from "./types";
+import { StorageController, LocalStorageConfig } from "./types.js";
 import { UploadFileProps, UploadFileResult, DownloadConfig, StorageListResult } from "@rebasepro/types";
 /**
  * Bucket used when a call names none.

package/dist/storage/S3StorageController.d.ts

@@ -1,7 +1,7 @@
 /**
  * S3-compatible storage controller (works with AWS S3 and MinIO)
  */
-import { S3StorageConfig, StorageController } from "./types";
+import { S3StorageConfig, StorageController } from "./types.js";
 import { DownloadConfig, StorageListResult, UploadFileProps, UploadFileResult } from "@rebasepro/types";
 /**
  * S3-compatible storage implementation

package/dist/storage/cache-headers.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Cache and revalidation headers for served objects.
+ *
+ * ## Why every byte still goes through the process
+ *
+ * `routes.ts` deliberately proxies rather than redirecting to a signed URL —
+ * mixed content and unreachable VPC endpoints, both documented there. That
+ * decision stands. What it cost was caching: a proxied response only caches as
+ * well as its headers say, and the local path sent none at all, so every load
+ * of every image re-read the file and re-sent the body.
+ *
+ * This module is the headers. It does not change where bytes come from; it
+ * lets the client stop asking for them.
+ *
+ * ## Why `immutable` is wrong here, and was
+ *
+ * The remote path sent `public, max-age=3600, immutable`, and the transform
+ * paths sent it with `max-age=31536000`. `immutable` is a promise that the body
+ * at this URL will never change. A storage key can be overwritten — `putObject`
+ * on an existing key is an ordinary operation — so the promise is false for
+ * every object this server serves, and the symptom is an upload that replaces a
+ * file which then does not visibly change for an hour, or a year.
+ *
+ * Revalidation replaces it. With a validator the client asks "still this one?"
+ * and gets a 304 with no body, which costs a round trip instead of a transfer.
+ *
+ * ## Why `public` was a leak
+ *
+ * The same header said `public` for every object, including one that required
+ * authentication to fetch. `public` is explicit permission for a *shared* cache
+ * — a CDN, a corporate proxy — to store the response and serve it to somebody
+ * else. Private objects are now `private`, which is the directive that says a
+ * browser may keep it but a shared cache may not.
+ */
+import type { Context } from "hono";
+/**
+ * A weak validator built from size and modification time.
+ *
+ * Weak (`W/`) because it is not a digest of the body: two different bodies of
+ * the same length written in the same millisecond would collide. That is the
+ * same trade nginx makes for static files, and the alternative — hashing every
+ * object on every request — costs more than it saves for content this server is
+ * already streaming from somewhere else.
+ */
+export declare function buildEntityTag(size: number, lastModifiedMs: number): string;
+export interface ObjectValidators {
+    etag: string;
+    /** RFC 9110 date, second-resolution. */
+    lastModified: string;
+    lastModifiedMs: number;
+}
+export declare function objectValidators(size: number, lastModifiedMs: number): ObjectValidators;
+export interface CacheControlOptions {
+    /**
+     * Whether a *shared* cache may store this. True only for objects that need
+     * no credentials to fetch.
+     */
+    isPublic: boolean;
+    /**
+     * How long a client may reuse the response without asking. Short by
+     * default, because the object behind it is mutable.
+     */
+    maxAgeSeconds: number;
+    /**
+     * Public responses only: how long a stale copy may be served while a
+     * revalidation happens in the background. Shared caches honour it; it turns
+     * the revalidation round trip into something the user does not wait for.
+     */
+    staleWhileRevalidateSeconds?: number;
+}
+export declare function cacheControl(options: CacheControlOptions): string;
+/**
+ * Whether the request already holds this exact representation.
+ *
+ * `If-None-Match` wins outright when present: it is an exact validator, whereas
+ * `If-Modified-Since` has second resolution and is only consulted in its
+ * absence — again the order RFC 9110 requires.
+ */
+export declare function isNotModified(c: Context, validators: ObjectValidators): boolean;
+/**
+ * Put the validators and the cache policy on a response.
+ *
+ * Applied to the 304 as well as the 200: a 304 that omits them tells the client
+ * nothing about how long the answer holds, so the next load revalidates again
+ * immediately and the round trip repeats forever.
+ */
+export declare function applyCacheHeaders(c: Context, validators: ObjectValidators, options: CacheControlOptions): void;

package/dist/storage/index.d.ts

@@ -11,17 +11,17 @@
  * For other providers (Azure Blob, etc.), implement the
  * `StorageController` interface and pass the instance directly to the `storage` config.
  */
-export * from "./types";
-export { LocalStorageController } from "./LocalStorageController";
-export { S3StorageController } from "./S3StorageController";
-export { GCSStorageController } from "./GCSStorageController";
-export { createStorageRoutes } from "./routes";
-export type { StorageRoutesConfig } from "./routes";
-export * from "./storage-registry";
-export { parseTransformOptions, transformImage, isTransformableImage, TransformCache } from "./image-transform";
-export type { ImageTransformOptions } from "./image-transform";
-export { TusHandler } from "./tus-handler";
-import { BackendStorageConfig, StorageController } from "./types";
+export * from "./types.js";
+export { LocalStorageController } from "./LocalStorageController.js";
+export { S3StorageController } from "./S3StorageController.js";
+export { GCSStorageController } from "./GCSStorageController.js";
+export { createStorageRoutes } from "./routes.js";
+export type { StorageRoutesConfig } from "./routes.js";
+export * from "./storage-registry.js";
+export { parseTransformOptions, transformImage, isTransformableImage, TransformCache } from "./image-transform.js";
+export type { ImageTransformOptions } from "./image-transform.js";
+export { TusHandler } from "./tus-handler.js";
+import { BackendStorageConfig, StorageController } from "./types.js";
 /**
  * Create a storage controller from a config object.
  *

package/dist/storage/policies.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Declarative access control for storage.
+ *
+ * Storage is not under row-level security, so `storageAuthorize` — a hook, a
+ * piece of imperative code — was the whole access-control model. That is the one
+ * place the claim "security lives in the database" does not hold, and it shows
+ * in the shape of the alternative: without a hook, **any authenticated caller
+ * may read, overwrite, delete or list any key they can name**, because storage
+ * keys share one flat namespace.
+ *
+ * A policy list says the same things declaratively, and can be read without
+ * running it:
+ *
+ * ```ts
+ * storagePolicies: [
+ *     { path: "public/**", operations: ["read"], allow: "public" },
+ *     { path: "users/:uid/**", allow: ({ params, user }) => user?.uid === params.uid }
+ * ]
+ * ```
+ *
+ * ## Deny by default, and why that is the whole design
+ *
+ * A key matched by no policy is refused. That makes every widening an explicit,
+ * reviewable line, and it makes a mistake in this module fail *closed* — a
+ * pattern that fails to match denies access rather than granting it. Authz code
+ * that fails open is worth more to an attacker than the feature is to anyone
+ * else, so the bias is deliberate and absolute.
+ *
+ * ## The hook remains, as an escape hatch and not as a fallback
+ *
+ * Ownership frequently lives in a row rather than in a key, which no pattern can
+ * express. So when policies match nothing, an explicit `storageAuthorize` is
+ * consulted before the request is refused. Present, it can widen; absent, the
+ * answer is no. Policies never *narrow* what the hook allowed and the hook never
+ * overrides a policy denial — each can only say yes, which keeps "who allowed
+ * this?" answerable by reading either one alone.
+ */
+import type { StorageAuthorize, StorageAuthorizeContext, StorageOperation } from "@rebasepro/types";
+/** Everything a predicate is told, plus whatever the path captured. */
+export interface StoragePolicyContext extends StorageAuthorizeContext {
+    /** Segments captured by `:name` placeholders in the matched path. */
+    params: Record<string, string>;
+}
+export type StoragePolicyPredicate = (ctx: StoragePolicyContext) => boolean | Promise<boolean>;
+export interface StoragePolicy {
+    /**
+     * A key pattern, matched segment by segment against the sanitized key.
+     *
+     * - a literal segment matches itself
+     * - `*` matches exactly one segment
+     * - `:name` matches one segment and captures it
+     * - `**` matches the rest of the key, including nothing, and is only
+     *   allowed as the final segment
+     */
+    path: string;
+    /** Which operations this grants. Defaults to every one of them. */
+    operations?: StorageOperation[];
+    /**
+     * Who it grants to.
+     *
+     * - `"public"` — anyone, signed in or not
+     * - `"authenticated"` — any caller with a uid
+     * - a predicate — anything else, given the captured params and the user
+     */
+    allow: "public" | "authenticated" | StoragePolicyPredicate;
+}
+export declare class StoragePolicyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Compile a policy list into a {@link StorageAuthorize}.
+ *
+ * Compiled once, at boot, so a malformed pattern fails the start rather than the
+ * first upload. `fallback` is an explicit `storageAuthorize`, consulted only
+ * when no policy matched.
+ */
+export declare function compileStoragePolicies(policies: StoragePolicy[], fallback?: StorageAuthorize): StorageAuthorize;
+/**
+ * The access-control function for a configuration, or `undefined` when it
+ * declares none.
+ *
+ * Kept separate from {@link compileStoragePolicies} so `init` has one call to
+ * make and one thing to reason about: policies, a hook, both, or neither.
+ */
+export declare function resolveStorageAccessControl(config: {
+    storagePolicies?: StoragePolicy[];
+    storageAuthorize?: StorageAuthorize;
+}): StorageAuthorize | undefined;

package/dist/storage/range.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Byte-range requests for served objects.
+ *
+ * Without `Accept-Ranges`, a browser will not offer to seek in an audio or
+ * video element served from here: it has no way to ask for the middle of a file,
+ * so scrubbing means fetching the whole thing from the start, and on a long
+ * recording it means fetching it again for every seek. Safari goes further and
+ * refuses to play a `<video>` at all unless the first response is a `206`.
+ *
+ * So this is not a performance nicety. For media it is the difference between a
+ * player that works and one that does not.
+ *
+ * ## What is implemented, and what is refused
+ *
+ * A single range — `bytes=0-499`, `bytes=500-`, `bytes=-500`. That is what every
+ * browser sends for media playback.
+ *
+ * Multiple ranges in one request (`bytes=0-99,200-299`) are **not** served.
+ * Answering them means composing a `multipart/byteranges` body, and nothing that
+ * matters sends them; a server may always answer a range request with the whole
+ * `200` instead, which is what happens here. Refusing to guess is better than a
+ * half-implemented multipart encoder.
+ *
+ * An unsatisfiable range — one starting past the end of the object — is a `416`
+ * with a `Content-Range: bytes /<size>`, as RFC 9110 requires. Answering `200`
+ * there would hand a player the whole file when it asked for a byte that does
+ * not exist, and it would never notice.
+ */
+/** A resolved, inclusive byte range within an object of known size. */
+export interface ByteRange {
+    start: number;
+    /** Inclusive, as the header is. */
+    end: number;
+    /** `end - start + 1`. */
+    length: number;
+}
+export type RangeParse = 
+/** No `Range` header, or one this server declines to honour. Serve `200`. */
+{
+    kind: "none";
+}
+/** Serve `206` with this range. */
+ | {
+    kind: "range";
+    range: ByteRange;
+}
+/** Serve `416`. The range cannot be satisfied for an object of this size. */
+ | {
+    kind: "unsatisfiable";
+};
+/**
+ * Parse a `Range` header against an object of `size` bytes.
+ *
+ * Deliberately conservative: anything malformed, multi-range, or in a unit other
+ * than bytes resolves to `none`, which serves the whole object. A range request
+ * answered with `200` is always legal; a range answered wrongly is a corrupted
+ * download.
+ */
+export declare function parseRange(header: string | undefined, size: number): RangeParse;
+/** The `Content-Range` for a served range. */
+export declare function contentRange(range: ByteRange, size: number): string;
+/** The `Content-Range` for a `416`, which names the size and no range. */
+export declare function unsatisfiableContentRange(size: number): string;

package/dist/storage/routes.d.ts

@@ -7,10 +7,10 @@
  * is used.
  */
 import { Hono } from "hono";
-import { StorageController, type StorageAuthorize, type StorageAuthorizeData } from "./types";
-import { type StorageRegistry } from "./storage-registry";
+import { StorageController, type StorageAuthorize, type StorageAuthorizeData } from "./types.js";
+import { type StorageRegistry } from "./storage-registry.js";
 import { type StorageSourceDefinition, type AuthAdapter } from "@rebasepro/types";
-import { HonoEnv } from "../api/types";
+import { HonoEnv } from "../api/types.js";
 /**
  * Decide what to actually serve for a stored content type.
  *

package/dist/storage/storage-registry.d.ts

@@ -10,7 +10,7 @@
  * - String properties use `storageId` in their config to specify which storage to use
  * - Properties without `storageId` fallback to "(default)"
  */
-import { StorageController } from "./types";
+import { StorageController } from "./types.js";
 /**
  * The default storage identifier used when:
  * - A single storage controller is provided (not a map)

package/dist/storage/tus-handler.d.ts

@@ -8,8 +8,8 @@
  * @see https://tus.io/protocols/resumable-upload
  */
 import type { Context } from "hono";
-import type { StorageController } from "./types";
-import { type StorageRegistry } from "./storage-registry";
+import type { StorageController } from "./types.js";
+import { type StorageRegistry } from "./storage-registry.js";
 /**
  * TUS resumable upload handler.
  *