@rebasepro/server 0.23.0 → 0.24.0

package/dist/auth/impersonation.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Running a request as another user: the `x-rebase-impersonate` header, and
+ * the `impersonate` field of the realtime socket's `AUTHENTICATE`.
+ *
+ * It exists for an administrator checking what one user can see and do — "can
+ * B read A's rows, can B write them?" — against the real policies, from
+ * Studio's API explorer and JS editor. A granted request runs as one of B's
+ * own would: B's uid, B's roles as they are now, B's guest flag and the claims
+ * a token minted for B now would carry reach `withAuth`, so the statement runs
+ * as `rebase_user` with B's identity and every policy is evaluated for B.
+ *
+ * Who may: a signed-in administrator, on their own session, judged on their
+ * roles as the database has them now rather than as their token claims. Never
+ * an API key — not a personal key whose owner is an administrator either — and
+ * never the service key. Impersonation is a person checking on another person,
+ * and the audit line has to name one.
+ *
+ * Where: the data API, custom functions and the realtime socket. Every other
+ * route refuses the header ({@link refuseUnhonouredImpersonation}).
+ *
+ * Fail closed: a request asking to act as someone either runs as the user it
+ * names or is refused. It never runs as its caller, because that is the
+ * failure this exists to end — a response showing the administrator's rows
+ * under a label saying they were B's.
+ *
+ * @module
+ */
+import type { Context, MiddlewareHandler } from "hono";
+import { type AuthenticatedUser, type DataDriver } from "@rebasepro/types";
+import type { HonoEnv } from "../api/types.js";
+import { ApiError } from "../api/errors.js";
+/** How the caller authenticated, as far as impersonation is concerned. */
+export type ImpersonationCredential = "session" | "api-key" | "service-key" | "none";
+/** How the auth in use turns a uid into a request identity — `AuthAdapter.resolveUser`. */
+export type ImpersonationUserResolver = (uid: string) => Promise<AuthenticatedUser | null>;
+export interface ImpersonationRequest {
+    /** The uid the request asked to act as, as sent. */
+    requestedUid: string;
+    /** What the caller presented. Only a `session` may impersonate. */
+    credential: ImpersonationCredential;
+    /** The caller, as their credential verified. */
+    caller?: {
+        uid: string;
+        roles: readonly string[];
+    };
+    /** Absent when the auth in use has no `resolveUser`: then nobody may. */
+    resolveUser?: ImpersonationUserResolver;
+    /**
+     * Where the request came in, for the security audit line — or absent to
+     * write none, for a decision that only re-confirms one already logged
+     * (the socket re-asks before every frame).
+     */
+    audit?: Record<string, unknown>;
+}
+/** The answer to a request to act as another user. */
+export type ImpersonationDecision = {
+    granted: AuthenticatedUser;
+    impersonator: string;
+} | {
+    refused: ApiError;
+};
+/**
+ * Decide whether this caller may act as the user they named, and who that
+ * user is now.
+ *
+ * The one decision both doors take — the HTTP data plane through
+ * {@link applyImpersonation}, the realtime socket at `AUTHENTICATE` and before
+ * every frame after it. The caller is judged before the named user is looked
+ * up, so the answer to a caller who may not impersonate says nothing about
+ * whether the uid exists.
+ *
+ * Throws when a lookup fails: that is not an answer about anyone, and each
+ * door refuses it its own way.
+ */
+export declare function decideImpersonation(request: ImpersonationRequest): Promise<ImpersonationDecision>;
+export interface ImpersonationOptions {
+    /** What the caller presented. Only a `session` may impersonate. */
+    credential: ImpersonationCredential;
+    /** The unscoped delegate the request's driver was scoped from. */
+    driver: DataDriver;
+    /** The auth adapter's `resolveUser`. Absent: the header is refused for everyone. */
+    resolveUser?: ImpersonationUserResolver;
+}
+/**
+ * Honour or refuse this request's {@link IMPERSONATE_HEADER}.
+ *
+ * Called by the data-plane auth middlewares once the caller is on the context
+ * and its driver is scoped. When the header names a user the caller may act
+ * as, the context's `user` and `driver` are replaced with that user's and
+ * `impersonator` names the caller.
+ *
+ * @returns The refusal to send, or `undefined` to carry on — as the caller
+ *          when the header is absent, as the named user when it was granted.
+ */
+export declare function applyImpersonation(c: Context<HonoEnv>, { credential, driver, resolveUser }: ImpersonationOptions): Promise<Response | undefined>;
+/**
+ * Refuse {@link IMPERSONATE_HEADER} on every route that does not honour it.
+ *
+ * Only the data API and custom functions run a request as another user; the
+ * rest — storage, auth, the admin surfaces — authenticate the caller and
+ * ignore the header. Ignored, a request asking to act as B would be answered
+ * as the administrator who sent it, which is the one outcome impersonation
+ * must never have. Mounted ahead of every route, so a surface added later is
+ * refused until it is listed here as honouring the header.
+ *
+ * @param honouredMounts - The mount points whose auth middleware applies the
+ *        header (`/api/data`, `/api/functions`). A path is under one when it
+ *        is the mount itself or continues it with a `/`.
+ */
+export declare function refuseUnhonouredImpersonation(honouredMounts: readonly string[]): MiddlewareHandler<HonoEnv>;

package/dist/auth/index.d.ts

@@ -49,8 +49,10 @@ export { createSqlRateLimitStore } from "./sql-rate-limit-store.js";
 export type { SqlRateLimitStoreOptions } from "./sql-rate-limit-store.js";
 export { resolveRateLimitStoreKind, RateLimitStoreConfigurationError } from "./resolve-rate-limit-store.js";
 export type { RateLimitStoreKind, RateLimitStoreEnv } from "./resolve-rate-limit-store.js";
-export { createApiKeyStore, createApiKeyRoutes, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed } from "./api-keys/index.js";
-export type { ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./api-keys/index.js";
+export { createApiKeyStore, createApiKeyRoutes, createPersonalKeyRoutes, isApiKeyToken, resolveApiKey, validateApiKey, httpMethodToOperation } from "./api-keys/index.js";
+export type { ApiKey, ApiKeyKind, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, CreatePersonalKeyRequest, UpdateApiKeyRequest, ApiKeyStore, DataOperation, KeyTargets } from "./api-keys/index.js";
+export { requireScope, requireScopeByMethod, hasScope, callerScopes, getAccessModel, configureAccess, accessModelFromCollections, AccessModelError } from "./access.js";
+export type { KeyOwnerResolver } from "./access.js";
 export { createBuiltinAuthAdapter } from "./builtin-auth-adapter.js";
 export type { BuiltinAuthAdapterConfig } from "./builtin-auth-adapter.js";
 export { createCustomAuthAdapter } from "./custom-auth-adapter.js";

package/dist/auth/interfaces.d.ts

@@ -19,6 +19,11 @@ export interface UserData {
     emailVerificationToken?: string | null;
     emailVerificationSentAt?: Date | null;
     isAnonymous?: boolean;
+    /**
+     * An administrator switched the account off: no sign-in, no refresh, and
+     * no token it already holds is honoured. See `setUserDisabled`.
+     */
+    disabled?: boolean;
     metadata?: Record<string, unknown>;
     createdAt: Date;
     updatedAt: Date;
@@ -35,6 +40,16 @@ export interface CreateUserData {
     isAnonymous?: boolean;
     metadata?: Record<string, unknown>;
 }
+/**
+ * An address change waiting for its confirmation link. See
+ * {@link UserRepository.setPendingEmailChange}.
+ */
+export interface PendingEmailChange {
+    /** The address the account is moving to, normalized. */
+    email: string;
+    /** When the link was mailed; it is refused 24 hours after this. */
+    sentAt: Date;
+}
 /**
  * User Identity Data (OAuth accounts linked to user)
  */
@@ -92,36 +107,6 @@ export interface OAuthProvider<T = unknown> {
      */
     verify(payload: T): Promise<OAuthProviderProfile | null>;
 }
-/**
- * Role data structure
- */
-export interface RoleData {
-    id: string;
-    name: string;
-    isAdmin: boolean;
-    defaultPermissions: {
-        read?: boolean;
-        create?: boolean;
-        edit?: boolean;
-        delete?: boolean;
-    } | null;
-    collectionPermissions: Record<string, {
-        read?: boolean;
-        create?: boolean;
-        edit?: boolean;
-        delete?: boolean;
-    }> | null;
-}
-/**
- * Data for creating a new role
- */
-export interface CreateRoleData {
-    id: string;
-    name: string;
-    isAdmin?: boolean;
-    defaultPermissions?: RoleData["defaultPermissions"];
-    collectionPermissions?: RoleData["collectionPermissions"];
-}
 /**
  * Refresh token info
  */
@@ -161,6 +146,31 @@ export interface RefreshTokenInfo {
      * that do not store it; both read as `aal1`, the restrictive value.
      */
     aal?: "aal1" | "aal2";
+    /**
+     * How the session was signed in — `"password"`, `"anonymous"`,
+     * `"magic-link"`, `"otp"`, `"mfa"` or a provider id such as `"google"`.
+     * See {@link RefreshTokenSession.method}. Absent on rows written before
+     * the column existed, which read as `"password"`.
+     */
+    method?: string;
+}
+/**
+ * What {@link TokenRepository.getAccountAccessState} reads about an account
+ * that exists.
+ */
+export interface AccountAccessState {
+    /** The account's roles as the database has them now. */
+    roles: string[];
+    /** The revocation watermark: sessions that began before it are void. */
+    tokensValidAfter: Date | null;
+    /**
+     * Whether the session asked about has a refresh token that is not
+     * revoked. `undefined` when no session was asked about, or the store
+     * cannot tell (a refresh-token table without session grouping).
+     */
+    sessionActive?: boolean;
+    /** The account is switched off (`UserData.disabled`). */
+    disabled?: boolean;
 }
 /**
  * Identity of the sign-in a refresh token belongs to, threaded through
@@ -179,6 +189,14 @@ export interface RefreshTokenSession {
      * assurance level is a property of the *sign-in*, not of the account.
      */
     aal?: "aal1" | "aal2";
+    /**
+     * How the session was signed in: what `providerId` says in every auth
+     * response for it. Written at sign-in and carried across rotations like
+     * {@link aal}, because a refresh is not a sign-in and has nothing else to
+     * read it from — answering `"password"` there turned a Google session into
+     * a password one an access-token lifetime after it began.
+     */
+    method?: string;
     /**
      * The hash of the token this one replaces, when it is minted by rotating
      * one. A repository that honours it writes the new token only while that
@@ -216,7 +234,11 @@ export interface ListUsersOptions {
     limit?: number;
     /** Number of results to skip (default 0) */
     offset?: number;
-    /** Search term — matches against email and displayName (case-insensitive) */
+    /**
+     * Search term — a case-insensitive substring of the email, the display
+     * name, any role the user holds, or the uid. (The Postgres store matches
+     * all four; the Mongo store, email and display name.)
+     */
     search?: string;
     /** Field to sort by (default "createdAt") */
     orderBy?: string;
@@ -319,10 +341,6 @@ export interface UserRepository {
      * Find user by email verification token
      */
     getUserByVerificationToken(token: string): Promise<UserData | null>;
-    /**
-     * Get roles for a user
-     */
-    getUserRoles(uid: string): Promise<RoleData[]>;
     /**
      * Get role IDs for a user
      */
@@ -340,34 +358,45 @@ export interface UserRepository {
      */
     getUserWithRoles(uid: string): Promise<{
         user: UserData;
-        roles: RoleData[];
+        roles: string[];
     } | null>;
-}
-/**
- * Abstract role repository interface.
- * Handles all role-related database operations.
- */
-export interface RoleRepository {
-    /**
-     * Get a role by ID
-     */
-    getRoleById(id: string): Promise<RoleData | null>;
-    /**
-     * List all roles
-     */
-    listRoles(): Promise<RoleData[]>;
     /**
-     * Create a new role
+     * Switch an account off, or back on. Off, it cannot sign in or refresh,
+     * and the tokens it holds are refused (`judgeAccessToken`). Optional: a
+     * repository without it cannot disable accounts, and the admin route says
+     * so rather than pretending.
      */
-    createRole(data: CreateRoleData): Promise<RoleData>;
+    setUserDisabled?(uid: string, disabled: boolean): Promise<void>;
     /**
-     * Update a role
-     */
-    updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
+     * Record the address an account is moving to and the hash of the token
+     * mailed there, stamped now — or with `null`, drop it. One per account: a
+     * new request replaces the last, and its link stops working.
+     *
+     * Nothing is reserved by it. The address stays free for anyone to
+     * register until the link is followed, because a pending change that held
+     * it would let any account lock a stranger out of signing up with their
+     * own address.
+     */
+    setPendingEmailChange?(uid: string, change: {
+        email: string;
+        tokenHash: string;
+    } | null): Promise<void>;
+    /** The account's pending change, if it has one. */
+    getPendingEmailChange?(uid: string): Promise<PendingEmailChange | null>;
+    /** The account whose pending change `tokenHash` confirms, with the change. */
+    findPendingEmailChange?(tokenHash: string): Promise<{
+        user: UserData;
+        change: PendingEmailChange;
+    } | null>;
     /**
-     * Delete a role
+     * Move the account onto its pending address, in one write that holds only
+     * while `tokenHash` is still that change's token: the address becomes the
+     * account's, verified, and the pending change and any outstanding
+     * verification token are cleared. `null` when the token no longer names
+     * the change (confirmed already, replaced, cancelled). An address another
+     * account holds by then is a 409 `EMAIL_EXISTS`, as `updateUser` answers.
      */
-    deleteRole(id: string): Promise<void>;
+    applyPendingEmailChange?(uid: string, tokenHash: string): Promise<UserData | null>;
 }
 /**
  * Abstract token repository interface.
@@ -418,6 +447,24 @@ export interface TokenRepository {
      * user's tokens so a rotation racing the delete cannot survive it.
      */
     setTokensValidAfter?(uid: string, at: Date): Promise<void>;
+    /**
+     * Everything an access token is judged against, in one read — or `null`
+     * when there is no such account.
+     *
+     * An access token is a bearer credential minted up to an hour ago, and the
+     * account it names may since have been deleted, revoked or demoted. Every
+     * door that honours one asks this before it does: the data plane, the admin
+     * gates, the realtime socket on every frame. See `judgeAccessToken`.
+     *
+     * `sessionId` is the token's `sid`: when given, the state also says
+     * whether that sign-in is still live, which is how signing one device out
+     * reaches the access token that device holds.
+     *
+     * Optional. Without it the judge composes the answer from
+     * `getUserWithRoles` and `getTokensValidAfter`, two reads instead of one,
+     * and cannot see one revoked session — only every session at once.
+     */
+    getAccountAccessState?(uid: string, sessionId?: string): Promise<AccountAccessState | null>;
     /**
      * Find a refresh token by hash
      */
@@ -455,7 +502,11 @@ export interface TokenRepository {
      */
     deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
     /**
-     * Clean up expired tokens
+     * Delete every token past its expiry: reset links, magic links and email
+     * codes, refresh tokens, and whatever else the repository keeps that
+     * expires. A token is refused when presented whether or not this has run,
+     * so it is housekeeping, not revocation. The server calls it once an hour
+     * on one instance of the fleet (`startExpiredTokenSweep`).
      */
     deleteExpiredTokens(): Promise<void>;
     /**
@@ -613,5 +664,5 @@ export interface MfaRepository {
 /**
  * Combined auth repository interface for convenience
  */
-export interface AuthRepository extends UserRepository, RoleRepository, TokenRepository, MfaRepository {
+export interface AuthRepository extends UserRepository, TokenRepository, MfaRepository {
 }

package/dist/auth/jwt.d.ts

@@ -61,6 +61,23 @@ export interface AccessTokenPayload {
      * comparison and the watermark was read on exactly one path — refresh.
      */
     iat?: number;
+    /**
+     * When the token expires, in seconds since the epoch — the standard `exp`
+     * claim. Carried through because a socket authenticated with this token
+     * has to stop honouring it at this instant, and has no request to refuse.
+     */
+    exp?: number;
+    /**
+     * The sign-in this token was minted for: the session id its refresh
+     * tokens share, carried across every rotation.
+     *
+     * What lets one device be signed out — `POST /auth/logout`,
+     * `DELETE /auth/sessions/:id` — reach that device's access token rather
+     * than only its refresh token, and what lets `GET /auth/sessions` mark the
+     * caller's own session. Absent on tokens minted before it existed; those
+     * keep working until they expire, judged by the watermark alone.
+     */
+    sid?: string;
     /** Email claim from the JWT, if present */
     email?: string;
     /** Display name claim from the JWT, if present */
@@ -89,6 +106,14 @@ export interface AccessTokenPayload {
      */
     claims?: Record<string, unknown>;
 }
+/**
+ * The custom half of a verified token, or nothing when there is none.
+ *
+ * Exported for the one other place that builds a request identity's claims
+ * without a token to verify — `resolveUser`, which reads what a token minted
+ * now would carry — so both drop the same identity claims.
+ */
+export declare function customClaimsOf(decoded: Record<string, unknown>): Record<string, unknown> | undefined;
 /**
  * Configure JWT settings - call this during initialization.
  * Validates the secret strength to prevent deployment with default/weak secrets.
@@ -105,6 +130,12 @@ export declare function configureJwt(config: JwtConfig): void;
 export declare function getJwks(): {
     keys: PublicJwk[];
 };
+/**
+ * The secret `configureJwt` was given, or undefined before it is called. For
+ * `mfa-crypto.ts`, which falls back to it when no MFA key is set — the secret
+ * passed in code, not only the one in `JWT_SECRET`.
+ */
+export declare function configuredJwtSecret(): string | undefined;
 /** Is this backend signing access tokens asymmetrically? */
 export declare function hasAsymmetricSigningKey(): boolean;
 /**
@@ -128,7 +159,12 @@ export declare function generateAccessToken(uid: string, roles: string[], aal?:
  * account. Written into the token so the RLS identity and the WebSocket
  * path can tell the two apart without a database lookup.
  */
-isAnonymous?: boolean): Promise<string>;
+isAnonymous?: boolean, 
+/**
+ * The sign-in this token belongs to — see {@link AccessTokenPayload.sid}.
+ * Every token the auth routes mint carries one.
+ */
+sessionId?: string): Promise<string>;
 /**
  * Get the expiration time of an access token in milliseconds from now
  */
@@ -165,7 +201,8 @@ export declare function getAccessTokenExpiry(): number;
  */
 export declare function verifyAccessToken(token: string): Promise<AccessTokenPayload | null>;
 /**
- * Generate a random refresh token (long-lived, 30 days by default)
+ * Generate a random refresh token. Long-lived: 400 days by default, sliding —
+ * see {@link getRefreshTokenTtlMs}.
  */
 export declare function generateRefreshToken(): string;
 /**
@@ -236,6 +273,13 @@ export interface DownloadTokenPayload {
      * existed are read.
      */
     storageId: string;
+    /**
+     * An opaque mark of the user who minted the token, for rate limiting only:
+     * a read that spends the token is charged to that user's allowance rather
+     * than to the reader's address. A hash, because the token travels in a URL.
+     * Absent for a token minted for nobody.
+     */
+    rl?: string;
 }
 /**
  * Generate a short-lived download token scoped to a specific file path or prefix
@@ -254,7 +298,9 @@ export interface DownloadTokenPayload {
  * site that forgets to pass a named source produces a default-scoped token,
  * which fails closed at `/file/*` rather than over-granting.
  */
-export declare function generateDownloadToken(path: string, expiresInSeconds?: number, storageId?: string | null): Promise<string>;
+export declare function generateDownloadToken(path: string, expiresInSeconds?: number, storageId?: string | null, 
+/** The user minting it, so the reads it buys are charged to them. */
+principal?: string | null): Promise<string>;
 /**
  * Verify and decode a download token.
  *

package/dist/auth/magic-link-routes.d.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import type { MiddlewareHandler } from "hono";
-import type { AuthModuleConfig } from "./routes.js";
+import type { AuthModuleConfig, CreateSessionAndTokens } from "./routes.js";
 import type { ResolvedAuthHooks } from "./auth-hooks.js";
 import type { HonoEnv } from "../api/types.js";
 import { z } from "zod";
@@ -24,11 +24,7 @@ export declare function mountMagicLinkRoutes(deps: {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
-        roleIds: string[];
-        accessToken: string;
-        refreshToken: string;
-    }>;
+    createSessionAndTokens: CreateSessionAndTokens;
     applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
     /**
      * Built by the caller so a misconfiguration fails the boot once, rather

package/dist/auth/mfa-routes.d.ts

@@ -1,7 +1,7 @@
 import { Hono, type MiddlewareHandler } from "hono";
 import { z } from "zod";
 import { HonoEnv } from "../api/types.js";
-import type { AuthModuleConfig } from "./routes.js";
+import type { AuthModuleConfig, CreateSessionAndTokens } from "./routes.js";
 import { resolveAuthHooks } from "./auth-hooks.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
 interface MfaRoutesConfig {
@@ -27,14 +27,7 @@ interface MfaRoutesConfig {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string, options?: {
-        skipMfaGate?: boolean;
-        aal?: "aal1" | "aal2";
-    }) => Promise<{
-        roleIds: string[];
-        accessToken: string;
-        refreshToken: string;
-    }>;
+    createSessionAndTokens: CreateSessionAndTokens;
     applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
 }
 export declare function mountMfaRoutes(opts: MfaRoutesConfig): void;

package/dist/auth/middleware.d.ts

@@ -1,5 +1,5 @@
 import { MiddlewareHandler, Context } from "hono";
-import type { AuthRepository } from "./interfaces.js";
+import { type AccessJudgeRepository } from "./token-revocation.js";
 import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt.js";
 import type { HonoEnv } from "../api/types.js";
@@ -131,11 +131,15 @@ export declare function createRequireAuth(options?: {
      * invalidated by `logout` or a password reset stops working on admin routes
      * too, not just on the data plane.
      */
-    revocationRepo?: Pick<AuthRepository, "getTokensValidAfter">;
+    revocationRepo?: AccessJudgeRepository;
 }): MiddlewareHandler<HonoEnv>;
 /**
- * Middleware that requires the user to have an admin or schema-admin role.
- * Must be used AFTER requireAuth or on a route where user is guaranteed.
+ * Middleware that requires the user to hold the `admin` role, which holds
+ * every scope. Must be used AFTER requireAuth or on a route where user is
+ * guaranteed.
+ *
+ * Prefer `requireScope` from `./access` for anything a scope names: a scope
+ * can be granted to a narrower role and to a key, and `admin` cannot.
  */
 export declare const requireAdmin: MiddlewareHandler<HonoEnv>;
 /**
@@ -197,6 +201,14 @@ export declare const queryTokenAuth: MiddlewareHandler<HonoEnv>;
  * requested object path is public, it sets a minimal "public" principal so the
  * downstream `requireAuth` gate lets the read through. Private paths are left
  * untouched, so they still require a valid token.
+ *
+ * Public means the object the route will serve is public, so the decision is
+ * made on that object's canonical key, derived by the route's own function
+ * (`requestedStorageObject`). It used to be made on the raw path, through a
+ * check that strips a `scheme://`: `notes://public/secret.txt` read as
+ * `public/secret.txt` here while the route served the private
+ * `notes:/public/secret.txt`, and the authorize hook — not asked about this
+ * principal — never saw it.
  */
 export declare const publicObjectAuth: MiddlewareHandler<HonoEnv>;
 /**
@@ -217,7 +229,7 @@ export declare const publicObjectAuth: MiddlewareHandler<HonoEnv>;
  * Hono routes the request, so this comparison already runs on a resolved path.
  * But that is a guarantee of the runtime rather than of this code, and it is
  * one line to not depend on it. The same rule already guards the public-object
- * path — see `isPublicStoragePath`.
+ * path — see `isPublicStorageKey`.
  */
 export declare function isPathMatch(requested: string, allowed: string): boolean;
 /**

package/dist/auth/otp-routes.d.ts

@@ -42,7 +42,7 @@
 import { Hono } from "hono";
 import type { MiddlewareHandler } from "hono";
 import { z } from "zod";
-import type { AuthModuleConfig } from "./routes.js";
+import type { AuthModuleConfig, CreateSessionAndTokens } from "./routes.js";
 import type { ResolvedAuthHooks } from "./auth-hooks.js";
 import type { HonoEnv } from "../api/types.js";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
@@ -78,11 +78,7 @@ export declare function mountOtpRoutes(deps: {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
-        roleIds: string[];
-        accessToken: string;
-        refreshToken: string;
-    }>;
+    createSessionAndTokens: CreateSessionAndTokens;
     applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
     /** Built by the caller, as for magic link. Absent when captcha is off. */
     captchaMiddleware?: MiddlewareHandler<HonoEnv>;

package/dist/auth/passwordless-signup.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Sign-up by magic link or email code (`auth.magicLinkCreatesUsers`).
+ *
+ * Both passwordless doors refuse an address with no account — silently, so
+ * they do not say which addresses have one. A passwordless-only app then had
+ * no way to create accounts at all. With the option on, and registration open,
+ * an unknown address gets an account at request time — no password, unverified
+ * — and the link or code mailed to it is what proves the address and signs it
+ * in, exactly as for an existing account. Supabase's `shouldCreateUser`.
+ *
+ * @module
+ */
+import type { AuthModuleConfig } from "./routes.js";
+import type { ResolvedAuthHooks } from "./auth-hooks.js";
+import type { UserData } from "./interfaces.js";
+/**
+ * The account a passwordless request for `email` should mail, creating it
+ * when the deployment lets passwordless requests sign people up. `null` when
+ * there is none and none may be made — the caller answers as for any unknown
+ * address.
+ *
+ * Registration's controls hold: the kill switch, `allowRegistration` (with no
+ * first-user exception: the first admin is made by registering or by the
+ * operator, never by whoever asks for a link first), `beforeUserCreate`,
+ * `afterUserCreate` and the default role.
+ */
+export declare function accountForPasswordlessRequest(config: AuthModuleConfig, ops: ResolvedAuthHooks, email: string): Promise<UserData | null>;