@rebasepro/server 0.16.0 → 0.16.1-canary.g701140a

package/dist/api/contract-routes.d.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import { type CollectionConfig } from "@rebasepro/types";
-import type { HonoEnv } from "./types";
+import type { HonoEnv } from "./types.js";
 /**
  * The project contract endpoint.
  *

package/dist/api/errors.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorHandler } from "hono";
-import type { HonoEnv } from "./types";
+import type { HonoEnv } from "./types.js";
 /**
  * Standardized API error class.
  * Throw this from any route handler — the errorHandler middleware

package/dist/api/index.d.ts

@@ -2,6 +2,6 @@
  * API generation infrastructure for Rebase
  * Automatically generates REST APIs from CollectionConfig definitions
  */
-export * from "./rest";
-export * from "./types";
-export * from "./errors";
+export * from "./rest/index.js";
+export * from "./types.js";
+export * from "./errors.js";

package/dist/api/logs-routes.d.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import type { MiddlewareHandler } from "hono";
-import type { HonoEnv } from "./types";
+import type { HonoEnv } from "./types.js";
 export interface LogEntry {
     id: string;
     timestamp: string;

package/dist/api/rest/api-generator.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { AuthAdapter, DataDriver, CollectionConfig } from "@rebasepro/types";
-import { HonoEnv } from "../types";
-import { type ListLimitOptions } from "./query-parser";
+import { HonoEnv } from "../types.js";
+import { type ListLimitOptions } from "./query-parser.js";
 /**
  * Lightweight REST API generator that leverages existing Rebase DataDriver.
  * Supports `include` query parameter for eager-loading relations via Drizzle.

package/dist/api/rest/index.d.ts

@@ -1 +1 @@
-export * from "./api-generator";
+export * from "./api-generator.js";

package/dist/api/rest/query-parser.d.ts

@@ -1,5 +1,5 @@
 import type { ListLimitBounds, OrderByTuple } from "@rebasepro/types";
-import { QueryOptions } from "../types";
+import { QueryOptions } from "../types.js";
 export declare const mapOperator: (op: string) => import("@rebasepro/types").WhereFilterOp | null;
 type OrderByEntry = {
     field: string;

package/dist/api/schema-editor-routes.d.ts

@@ -1,3 +1,3 @@
 import { Hono } from "hono";
-import { HonoEnv } from "./types";
+import { HonoEnv } from "./types.js";
 export declare function createSchemaEditorRoutes(collectionsDir: string): Hono<HonoEnv>;

package/dist/api/types.d.ts

@@ -1,7 +1,6 @@
-import { VectorSearchParams, LogicalCondition, FilterValues } from "@rebasepro/types";
-import type { AuthResult } from "../auth/middleware";
-import { DataDriver } from "@rebasepro/types";
-import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
+import type { VectorSearchParams, LogicalCondition, FilterValues, DataDriver } from "@rebasepro/types";
+import type { AuthResult } from "../auth/middleware.js";
+import type { ApiKeyMasked } from "../auth/api-keys/api-key-types.js";
 /**
  * Hono Environment Variables
  * Passed to generic Hono<HonoEnv> to type `c.get()`

package/dist/auth/adapter-middleware.d.ts

@@ -18,8 +18,8 @@
  */
 import type { MiddlewareHandler, Context } from "hono";
 import type { DataDriver, AuthAdapter } from "@rebasepro/types";
-import type { HonoEnv } from "../api/types";
-import type { ApiKeyStore } from "./api-keys/api-key-store";
+import type { HonoEnv } from "../api/types.js";
+import type { ApiKeyStore } from "./api-keys/api-key-store.js";
 export interface AdapterAuthMiddlewareOptions {
     /** The auth adapter to delegate verification to. */
     adapter: AuthAdapter;

package/dist/auth/admin-roles-route.d.ts

@@ -4,8 +4,8 @@
  * Mounts: GET /roles
  */
 import { Hono } from "hono";
-import type { AuthRepository } from "./interfaces";
-import type { HonoEnv } from "../api/types";
+import type { AuthRepository } from "./interfaces.js";
+import type { HonoEnv } from "../api/types.js";
 export interface AdminRolesRouteConfig {
     authRepo: AuthRepository;
     serviceKey?: string;

package/dist/auth/admin-user-ops.d.ts

@@ -9,9 +9,9 @@
  * 2. Backend-level hook (`AuthHooks.onAdminCreateUser`) — global override
  * 3. Built-in default — framework fallback
  */
-import type { AuthRepository } from "./interfaces";
-import type { EmailService, EmailConfig } from "../email";
-import type { ResolvedAuthHooks } from "./auth-hooks";
+import type { AuthRepository } from "./interfaces.js";
+import type { EmailService, EmailConfig } from "../email/index.js";
+import type { ResolvedAuthHooks } from "./auth-hooks.js";
 import type { AuthCollectionConfig } from "@rebasepro/types";
 /**
  * Generate a cryptographically secure random password that meets strength requirements.

package/dist/auth/admin-users-route.d.ts

@@ -10,10 +10,10 @@
  *   POST /bootstrap
  */
 import { Hono } from "hono";
-import type { AuthRepository } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import type { EmailService, EmailConfig } from "../email";
-import type { HonoEnv } from "../api/types";
+import type { AuthRepository } from "./interfaces.js";
+import type { AuthHooks } from "./auth-hooks.js";
+import type { EmailService, EmailConfig } from "../email/index.js";
+import type { HonoEnv } from "../api/types.js";
 import type { AuthCollectionConfig } from "@rebasepro/types";
 export interface AdminUsersRouteConfig {
     authRepo: AuthRepository;

package/dist/auth/api-keys/api-key-middleware.d.ts

@@ -23,8 +23,8 @@
  */
 import type { Context, MiddlewareHandler } from "hono";
 import type { DataDriver } from "@rebasepro/types";
-import type { HonoEnv } from "../../api/types";
-import type { ApiKeyStore } from "./api-key-store";
+import type { HonoEnv } from "../../api/types.js";
+import type { ApiKeyStore } from "./api-key-store.js";
 /**
  * Check whether a token looks like a Rebase API key.
  */

package/dist/auth/api-keys/api-key-permission-guard.d.ts

@@ -7,7 +7,7 @@
  *
  * @module
  */
-import type { ApiKeyPermission } from "./api-key-types";
+import type { ApiKeyPermission } from "./api-key-types.js";
 /** Operations that map to HTTP methods. */
 export type ApiKeyOperation = "read" | "write" | "delete";
 /**

package/dist/auth/api-keys/api-key-routes.d.ts

@@ -8,8 +8,8 @@
  * @module
  */
 import { Hono } from "hono";
-import type { HonoEnv } from "../../api/types";
-import type { ApiKeyStore } from "./api-key-store";
+import type { HonoEnv } from "../../api/types.js";
+import type { ApiKeyStore } from "./api-key-store.js";
 export interface ApiKeyRouteOptions {
     store: ApiKeyStore;
     serviceKey?: string;

package/dist/auth/api-keys/api-key-store.d.ts

@@ -8,7 +8,7 @@
  * @module
  */
 import type { DataDriver } from "@rebasepro/types";
-import type { ApiKey, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
+import type { ApiKey, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types.js";
 export interface ApiKeyStore {
     /** Ensure the `rebase.api_keys` table exists. Called once on startup. */
     ensureTable(): Promise<void>;

package/dist/auth/api-keys/index.d.ts

@@ -6,12 +6,12 @@
  *
  * @module
  */
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types";
-export { createApiKeyStore } from "./api-key-store";
-export type { ApiKeyStore } from "./api-key-store";
-export { isApiKeyToken, validateApiKey, createApiKeyPreAuth, createFunctionApiKeyGuard, createStorageApiKeyGuard } from "./api-key-middleware";
-export type { ApiKeyAuthOptions } from "./api-key-middleware";
-export { httpMethodToOperation, isOperationAllowed, isFunctionAllowed, isStorageAllowed } from "./api-key-permission-guard";
-export type { ApiKeyOperation } from "./api-key-permission-guard";
-export { createApiKeyRoutes } from "./api-key-routes";
-export type { ApiKeyRouteOptions } from "./api-key-routes";
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "./api-key-types.js";
+export { createApiKeyStore } from "./api-key-store.js";
+export type { ApiKeyStore } from "./api-key-store.js";
+export { isApiKeyToken, validateApiKey, createApiKeyPreAuth, createFunctionApiKeyGuard, createStorageApiKeyGuard } from "./api-key-middleware.js";
+export type { ApiKeyAuthOptions } from "./api-key-middleware.js";
+export { httpMethodToOperation, isOperationAllowed, isFunctionAllowed, isStorageAllowed } from "./api-key-permission-guard.js";
+export type { ApiKeyOperation } from "./api-key-permission-guard.js";
+export { createApiKeyRoutes } from "./api-key-routes.js";
+export type { ApiKeyRouteOptions } from "./api-key-routes.js";

package/dist/auth/apple-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /** Extra field Apple's client sends that no other provider has. */
 export interface AppleCodeFlowPayload extends OAuthCodeFlowPayload {
     /**

package/dist/auth/auth-hooks.d.ts

@@ -36,9 +36,9 @@
  * };
  * ```
  */
-import type { PasswordValidationResult } from "./password";
-import type { AuthRepository, UserData, CreateUserData } from "./interfaces";
-import type { EmailService, EmailConfig } from "../email";
+import type { PasswordValidationResult } from "./password.js";
+import type { AuthRepository, UserData, CreateUserData } from "./interfaces.js";
+import type { EmailService, EmailConfig } from "../email/index.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 /**
  * Authentication method identifier for lifecycle hooks.

package/dist/auth/bitbucket-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Bitbucket OAuth Provider integration (OAuth 2.0 consumer).
  */

package/dist/auth/builtin-auth-adapter.d.ts

@@ -10,9 +10,10 @@
  * present the same functionality through the pluggable `AuthAdapter` contract.
  */
 import type { AuthAdapter } from "@rebasepro/types";
-import type { AuthRepository, OAuthProvider } from "./interfaces";
-import type { AuthHooks } from "./auth-hooks";
-import type { EmailService, EmailConfig } from "../email";
+import type { CaptchaConfig } from "./captcha.js";
+import type { AuthRepository, OAuthProvider } from "./interfaces.js";
+import type { AuthHooks } from "./auth-hooks.js";
+import type { EmailService, EmailConfig } from "../email/index.js";
 /**
  * Configuration for the built-in Rebase auth adapter.
  *
@@ -50,6 +51,8 @@ export interface BuiltinAuthAdapterConfig {
     allowAnonymous?: boolean;
     /** Whether to expose the authenticated email→minimal-profile lookup route. */
     allowUserLookup?: boolean;
+    /** Bot protection for the auth routes. See `captcha.ts`. */
+    captcha?: CaptchaConfig;
     /** Default role to assign to new users. */
     defaultRole?: string;
     /** OAuth providers to register. */
@@ -65,7 +68,7 @@ export interface BuiltinAuthAdapterConfig {
     /** Enable magic link (passwordless email) login. Requires email service. */
     enableMagicLink?: boolean;
     /** Opt-in httpOnly cookie mode for refresh tokens. */
-    cookieAuth?: import("./routes").CookieAuthConfig;
+    cookieAuth?: import("./routes.js").CookieAuthConfig;
 }
 /**
  * Create the built-in Rebase auth adapter.

package/dist/auth/captcha.d.ts

@@ -0,0 +1,86 @@
+import type { MiddlewareHandler } from "hono";
+import { HonoEnv } from "../api/types.js";
+/** The two providers whose verify endpoints share this exact shape. */
+export type CaptchaProvider = "turnstile" | "hcaptcha";
+export interface CaptchaVerifyRequest {
+    token: string;
+    /** The caller's address, which both providers accept as a cross-check. */
+    remoteIp?: string;
+}
+export interface CaptchaVerifyResult {
+    success: boolean;
+    /** Provider error codes, for the log line. Never returned to the caller. */
+    errorCodes?: string[];
+}
+export type CaptchaVerifier = (request: CaptchaVerifyRequest) => Promise<CaptchaVerifyResult>;
+export interface CaptchaConfig {
+    /** Off unless set. */
+    enabled?: boolean;
+    provider?: CaptchaProvider;
+    /** The provider's secret. Required when enabled, unless `verify` is given. */
+    secret?: string;
+    /**
+     * Which routes to protect. Defaults to the three that send mail or create
+     * accounts: `register`, `forgotPassword`, `magicLink`.
+     *
+     * `login` is deliberately not on by default. A challenge on every sign-in is
+     * a tax on every real user, and credential stuffing is what the rate limiter
+     * and account lockout are for.
+     */
+    routes?: CaptchaRoute[];
+    /**
+     * Where the token is read from. Defaults to the `captchaToken` field of the
+     * JSON body, with the `cf-turnstile-response` / `h-captcha-response` header
+     * accepted as a fallback.
+     */
+    tokenField?: string;
+    /** Override the verifier. Supplying it makes `secret` unnecessary. */
+    verify?: CaptchaVerifier;
+    /** Milliseconds before a verification attempt is abandoned. Default 5000. */
+    timeoutMs?: number;
+}
+export type CaptchaRoute = "register" | "login" | "forgotPassword" | "magicLink";
+export declare const DEFAULT_CAPTCHA_ROUTES: CaptchaRoute[];
+/**
+ * The built-in verifier: a form post, which is the whole protocol.
+ *
+ * A non-200, a timeout or a malformed body are all "not verified" rather than
+ * exceptions — the caller cannot distinguish them and should not be told which
+ * one happened.
+ */
+export declare function createHttpCaptchaVerifier(options: {
+    provider: CaptchaProvider;
+    secret: string;
+    timeoutMs?: number;
+    fetchImpl?: typeof fetch;
+}): CaptchaVerifier;
+/**
+ * Resolve a config into a verifier, or explain why it cannot be used.
+ *
+ * Returns `undefined` when the feature is off. Throws when it is on but
+ * unusable — a misconfigured challenge must not boot as an absent one, because
+ * the whole point is that it is there.
+ */
+export declare function resolveCaptchaVerifier(config: CaptchaConfig | undefined): CaptchaVerifier | undefined;
+/** Read the challenge token out of a request, body field first, then headers. */
+export declare function extractCaptchaToken(c: Parameters<MiddlewareHandler<HonoEnv>>[0], field: string): Promise<string | undefined>;
+/**
+ * Middleware refusing a request whose challenge is missing or unverified.
+ *
+ * The response says only that the challenge failed. Which of "absent",
+ * "malformed", "already used" or "provider unreachable" it was is a log line,
+ * because telling a script which one it hit is telling it how to get closer.
+ */
+export declare function createCaptchaMiddleware(options: {
+    verify: CaptchaVerifier;
+    tokenField?: string;
+    /** Named in the log so a failure says which route refused. */
+    route: CaptchaRoute;
+}): MiddlewareHandler<HonoEnv>;
+/**
+ * A middleware per protected route, or an empty map when the feature is off.
+ *
+ * Routes not named get nothing at all rather than a pass-through, so an unnamed
+ * route costs exactly what it did before.
+ */
+export declare function buildCaptchaMiddlewares(config: CaptchaConfig | undefined): Partial<Record<CaptchaRoute, MiddlewareHandler<HonoEnv>>>;

package/dist/auth/cookie-utils.d.ts

@@ -1,7 +1,7 @@
 import type { Context } from "hono";
 import type { AuthResponsePayload } from "@rebasepro/types";
-import type { HonoEnv } from "../api/types";
-import type { CookieAuthConfig } from "./routes";
+import type { HonoEnv } from "../api/types.js";
+import type { CookieAuthConfig } from "./routes.js";
 /**
  * Cookie auth helpers for httpOnly refresh tokens.
  */

package/dist/auth/discord-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Discord OAuth2 Provider integration.
  *

package/dist/auth/facebook-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Facebook / Meta OAuth Provider integration.
  *

package/dist/auth/github-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a GitHub OAuth Provider integration.
  *

package/dist/auth/gitlab-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a GitLab OAuth Provider integration.
  * Works with both GitLab.com and self-hosted instances.

package/dist/auth/google-oauth.d.ts

@@ -1,4 +1,4 @@
-import type { OAuthProvider } from "./interfaces";
+import type { OAuthProvider } from "./interfaces.js";
 export interface GoogleUserInfo {
     googleId: string;
     email: string;

package/dist/auth/index.d.ts

@@ -1,54 +1,56 @@
-export * from "./interfaces";
-export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt";
-export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt";
-export { createJwksRoutes } from "./jwks-routes";
-export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys";
-export { hashPassword, verifyPassword, validatePasswordStrength } from "./password";
-export { safeCompare } from "./crypto-utils";
-export type { PasswordValidationResult } from "./password";
-export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks";
-export { resolveAuthHooks } from "./auth-hooks";
-export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops";
-export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops";
-export { createGoogleProvider } from "./google-oauth";
-export type { GoogleProviderConfig } from "./google-oauth";
-export { createLinkedinProvider } from "./linkedin-oauth";
-export { createGitHubProvider } from "./github-oauth";
-export { createMicrosoftProvider } from "./microsoft-oauth";
-export { createAppleProvider } from "./apple-oauth";
-export { createFacebookProvider } from "./facebook-oauth";
-export { createTwitterProvider } from "./twitter-oauth";
-export { createDiscordProvider } from "./discord-oauth";
-export { createGitLabProvider } from "./gitlab-oauth";
-export { createBitbucketProvider } from "./bitbucket-oauth";
-export { createSlackProvider } from "./slack-oauth";
-export { createSpotifyProvider } from "./spotify-oauth";
-export type { AppleCodeFlowPayload } from "./apple-oauth";
-export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow";
-export type { OAuthCodeFlowPayload } from "./oauth-code-flow";
-export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token";
-export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token";
-export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy";
-export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy";
-export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware";
-export type { AuthMiddlewareOptions, AuthResult } from "./middleware";
-export { createAuthRoutes } from "./routes";
-export type { AuthModuleConfig, CookieAuthConfig } from "./routes";
-export { mountMagicLinkRoutes } from "./magic-link-routes";
-export { createResetPasswordRoute } from "./reset-password-admin";
-export type { ResetPasswordRouteConfig } from "./reset-password-admin";
-export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter";
-export type { DataRateLimitConfig } from "./rate-limiter";
-export { MemoryRateLimitStore } from "./rate-limit-store";
-export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store";
-export { createSqlRateLimitStore } from "./sql-rate-limit-store";
-export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store";
-export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store";
-export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store";
-export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys";
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys";
-export { createBuiltinAuthAdapter } from "./builtin-auth-adapter";
-export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter";
-export { createCustomAuthAdapter } from "./custom-auth-adapter";
-export { createAdapterAuthMiddleware } from "./adapter-middleware";
-export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware";
+export * from "./interfaces.js";
+export { configureJwt, isJwtConfigured, generateAccessToken, verifyAccessToken, generateRefreshToken, hashRefreshToken, getRefreshTokenExpiry, getAccessTokenExpiry, generateDownloadToken, verifyDownloadToken, getJwks, hasAsymmetricSigningKey } from "./jwt.js";
+export type { JwtConfig, AccessTokenPayload, DownloadTokenPayload } from "./jwt.js";
+export { createJwksRoutes } from "./jwks-routes.js";
+export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk } from "./jwt-keys.js";
+export { hashPassword, verifyPassword, validatePasswordStrength } from "./password.js";
+export { safeCompare } from "./crypto-utils.js";
+export type { PasswordValidationResult } from "./password.js";
+export type { AuthHooks, AuthMethod, ResolvedAuthHooks } from "./auth-hooks.js";
+export { resolveAuthHooks } from "./auth-hooks.js";
+export { generateSecurePassword, generateSecureToken, hashToken, prepareAdminUserValues, finalizeAdminUserCreation } from "./admin-user-ops.js";
+export type { AdminUserContext, AdminUserPrepareResult } from "./admin-user-ops.js";
+export { createGoogleProvider } from "./google-oauth.js";
+export type { GoogleProviderConfig } from "./google-oauth.js";
+export { createLinkedinProvider } from "./linkedin-oauth.js";
+export { createGitHubProvider } from "./github-oauth.js";
+export { createMicrosoftProvider } from "./microsoft-oauth.js";
+export { createAppleProvider } from "./apple-oauth.js";
+export { createFacebookProvider } from "./facebook-oauth.js";
+export { createTwitterProvider } from "./twitter-oauth.js";
+export { createDiscordProvider } from "./discord-oauth.js";
+export { createGitLabProvider } from "./gitlab-oauth.js";
+export { createBitbucketProvider } from "./bitbucket-oauth.js";
+export { createSlackProvider } from "./slack-oauth.js";
+export { createSpotifyProvider } from "./spotify-oauth.js";
+export type { AppleCodeFlowPayload } from "./apple-oauth.js";
+export { oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail } from "./oauth-code-flow.js";
+export type { OAuthCodeFlowPayload } from "./oauth-code-flow.js";
+export { verifyOidcIdToken, tryVerifyOidcIdToken } from "./oidc-id-token.js";
+export type { OidcIdTokenClaims, VerifyOidcIdTokenOptions } from "./oidc-id-token.js";
+export { decideOAuthAutoLink, isRedirectUriAllowed } from "./oauth-signin-policy.js";
+export type { AutoLinkDecision, AutoLinkRefusal } from "./oauth-signin-policy.js";
+export { requireAuth, requireAdmin, optionalAuth, extractUserFromToken, createAuthMiddleware, queryTokenAuth, fileTokenAuth } from "./middleware.js";
+export type { AuthMiddlewareOptions, AuthResult } from "./middleware.js";
+export { createAuthRoutes } from "./routes.js";
+export type { AuthModuleConfig, CookieAuthConfig } from "./routes.js";
+export { mountMagicLinkRoutes } from "./magic-link-routes.js";
+export { buildCaptchaMiddlewares, createCaptchaMiddleware, createHttpCaptchaVerifier, resolveCaptchaVerifier, DEFAULT_CAPTCHA_ROUTES } from "./captcha.js";
+export type { CaptchaConfig, CaptchaProvider, CaptchaRoute, CaptchaVerifier, CaptchaVerifyRequest, CaptchaVerifyResult } from "./captcha.js";
+export { createResetPasswordRoute } from "./reset-password-admin.js";
+export type { ResetPasswordRouteConfig } from "./reset-password-admin.js";
+export { createRateLimiter, defaultAuthLimiter, strictAuthLimiter, createDataRateLimiter, apiKeyKeyGenerator } from "./rate-limiter.js";
+export type { DataRateLimitConfig } from "./rate-limiter.js";
+export { MemoryRateLimitStore } from "./rate-limit-store.js";
+export type { RateLimitStore, RateLimitDecision } from "./rate-limit-store.js";
+export { createSqlRateLimitStore } from "./sql-rate-limit-store.js";
+export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store.js";
+export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store.js";
+export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store.js";
+export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys/index.js";
+export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys/index.js";
+export { createBuiltinAuthAdapter } from "./builtin-auth-adapter.js";
+export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter.js";
+export { createCustomAuthAdapter } from "./custom-auth-adapter.js";
+export { createAdapterAuthMiddleware } from "./adapter-middleware.js";
+export type { AdapterAuthMiddlewareOptions } from "./adapter-middleware.js";

package/dist/auth/jwks-routes.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types.js";
 /**
  * `GET /.well-known/jwks.json` — the public keys that verify this issuer's
  * access tokens.

package/dist/auth/jwt.d.ts

@@ -1,4 +1,4 @@
-import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys";
+import { type JwtSigningKeyConfig, type PublicJwk } from "./jwt-keys.js";
 export interface JwtConfig {
     secret: string;
     accessExpiresIn?: string;

package/dist/auth/linkedin-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 export interface LinkedinUserInfo {
     linkedinId: string;
     email: string;

package/dist/auth/magic-link-routes.d.ts

@@ -1,7 +1,8 @@
 import { Hono } from "hono";
-import type { AuthModuleConfig } from "./routes";
-import type { ResolvedAuthHooks } from "./auth-hooks";
-import type { HonoEnv } from "../api/types";
+import type { MiddlewareHandler } from "hono";
+import type { AuthModuleConfig } from "./routes.js";
+import type { ResolvedAuthHooks } from "./auth-hooks.js";
+import type { HonoEnv } from "../api/types.js";
 import { z } from "zod";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 /**
@@ -29,4 +30,10 @@ export declare function mountMagicLinkRoutes(deps: {
         refreshToken: string;
     }>;
     applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
+    /**
+     * Built by the caller so a misconfiguration fails the boot once, rather
+     * than being resolved again here. Absent when captcha is off, or when
+     * `magicLink` is not among the protected routes.
+     */
+    captchaMiddleware?: MiddlewareHandler<HonoEnv>;
 }): void;

package/dist/auth/mfa-gate.d.ts

@@ -12,7 +12,7 @@
  *
  * @module
  */
-import type { AuthRepository } from "./interfaces";
+import type { AuthRepository } from "./interfaces.js";
 /** Error code a client watches for to switch a sign-in into its second step. */
 export declare const MFA_REQUIRED_CODE = "MFA_REQUIRED";
 /** Shape carried in `error.details` of an {@link MFA_REQUIRED_CODE} response. */

package/dist/auth/mfa-routes.d.ts

@@ -1,8 +1,8 @@
 import { Hono } from "hono";
 import { z } from "zod";
-import { HonoEnv } from "../api/types";
-import type { AuthModuleConfig } from "./routes";
-import { resolveAuthHooks } from "./auth-hooks";
+import { HonoEnv } from "../api/types.js";
+import type { AuthModuleConfig } from "./routes.js";
+import { resolveAuthHooks } from "./auth-hooks.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 interface MfaRoutesConfig {
     router: Hono<HonoEnv>;

package/dist/auth/microsoft-oauth.d.ts

@@ -1,5 +1,5 @@
-import type { OAuthProvider } from "./interfaces";
-import { type OAuthCodeFlowPayload } from "./oauth-code-flow";
+import type { OAuthProvider } from "./interfaces.js";
+import { type OAuthCodeFlowPayload } from "./oauth-code-flow.js";
 /**
  * Creates a Microsoft / Entra ID (Azure AD) OAuth Provider integration.
  *