@rebasepro/server 0.9.1-canary.ff338b5 → 0.10.0

package/dist/api/errors.d.ts

@@ -9,9 +9,24 @@ export declare class ApiError extends Error {
     readonly statusCode: number;
     readonly code: string;
     readonly details?: unknown;
-    constructor(statusCode: number, code: string, message: string, details?: unknown);
+    /**
+     * Whether this outcome is a routine part of normal operation rather than
+     * something an operator should look at. Expected errors log at debug; every
+     * other operational error logs at warn.
+     *
+     * The motivating case is `POST /auth/refresh` with no session: clients
+     * refresh on page load before they know whether one exists, so every
+     * anonymous page view is a 401 — correct, and not worth a warning line.
+     */
+    readonly expected: boolean;
+    constructor(statusCode: number, code: string, message: string, details?: unknown, expected?: boolean);
     static badRequest(message: string, code?: string, details?: unknown): ApiError;
     static unauthorized(message: string, code?: string): ApiError;
+    /**
+     * A 401 that is a normal outcome, not an incident — logged at debug.
+     * See {@link ApiError.expected}.
+     */
+    static unauthenticated(message: string, code?: string): ApiError;
     static forbidden(message: string, code?: string): ApiError;
     static notFound(message: string, code?: string): ApiError;
     static conflict(message: string, code?: string): ApiError;

package/dist/api/rest/write-validation.d.ts

@@ -12,8 +12,11 @@ import { CollectionConfig } from "@rebasepro/types";
  *   columns, so the set is exact);
  * - the foreign-key column behind an owning relation, which callers may write
  *   directly instead of through the relation property;
+ * - anything named in `options.extraKnownFields` — for an auth collection the
+ *   credential keys the auth adapter consumes before a row is ever built;
  * - nothing else. `id` in particular is not automatically known — see below.
  */
 export declare function assertKnownWriteFields(values: Record<string, unknown>, collection: CollectionConfig, options?: {
     rowIndex?: number;
+    extraKnownFields?: readonly string[];
 }): void;

package/dist/api/types.d.ts

@@ -1,5 +1,5 @@
 import { VectorSearchParams, LogicalCondition, FilterValues } from "@rebasepro/types";
-import { AuthResult } from "../auth/middleware";
+import type { AuthResult } from "../auth/middleware";
 import { DataDriver } from "@rebasepro/types";
 import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 /**
@@ -9,7 +9,7 @@ import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 export type HonoEnv = {
     Variables: {
         user?: AuthResult | {
-            userId?: string;
+            uid?: string;
             roles?: string[];
         };
         driver?: DataDriver;

package/dist/auth/admin-users-route.d.ts

@@ -3,10 +3,10 @@
  *
  * Mounts:
  *   GET /users
- *   GET /users/:userId
+ *   GET /users/:uid
  *   POST /users
- *   PUT /users/:userId
- *   DELETE /users/:userId
+ *   PUT /users/:uid
+ *   DELETE /users/:uid
  *   POST /bootstrap
  */
 import { Hono } from "hono";

package/dist/auth/auth-hooks.d.ts

@@ -135,7 +135,7 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    afterLogout?(userId: string): Promise<void>;
+    afterLogout?(uid: string): Promise<void>;
     /**
      * Called after successful MFA verification.
      *
@@ -143,12 +143,12 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    onMfaVerified?(userId: string, factorId: string): Promise<void>;
+    onMfaVerified?(uid: string, factorId: string): Promise<void>;
     /**
      * Customize JWT access token claims before signing.
      *
      * Return the modified claims object. The returned claims are merged
-     * into the JWT payload alongside standard claims (userId, roles).
+     * into the JWT payload alongside standard claims (uid, roles).
      *
      * @param claims - The default claims that would be included.
      * @param user - The authenticated user data.
@@ -178,14 +178,14 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    onPasswordReset?(userId: string): Promise<void>;
+    onPasswordReset?(uid: string): Promise<void>;
     /**
      * Called before a user is deleted.
      *
      * Throw an error to prevent deletion (e.g. for users with active
      * subscriptions, pending transactions, etc.).
      */
-    beforeUserDelete?(userId: string): Promise<void>;
+    beforeUserDelete?(uid: string): Promise<void>;
     /**
      * Called after a user is deleted.
      *
@@ -193,7 +193,7 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    afterUserDelete?(userId: string): Promise<void>;
+    afterUserDelete?(uid: string): Promise<void>;
     /**
      * Optional hook to customize or override the default user creation flow via the admin panel/REST API.
      * When provided, this replaces the built-in password generation, hashing, and invitation email logic.
@@ -212,7 +212,7 @@ export interface AuthHooks {
      * Optional hook to customize or override the default password reset flow via the admin panel.
      * When provided, this replaces the built-in password reset token generation, hashing, and email logic.
      */
-    onAdminResetPassword?(userId: string, ctx: {
+    onAdminResetPassword?(uid: string, ctx: {
         authRepo: AuthRepository;
         emailService?: EmailService;
         emailConfig?: EmailConfig;

package/dist/auth/interfaces.d.ts

@@ -40,7 +40,7 @@ export interface CreateUserData {
  */
 export interface UserIdentityData {
     id: string;
-    userId: string;
+    uid: string;
     provider: string;
     providerId: string;
     profileData?: Record<string, unknown> | null;
@@ -113,7 +113,7 @@ export interface CreateRoleData {
  */
 export interface RefreshTokenInfo {
     id: string;
-    userId: string;
+    uid: string;
     tokenHash: string;
     expiresAt: Date;
     createdAt: Date;
@@ -124,14 +124,14 @@ export interface RefreshTokenInfo {
  * Password reset token info
  */
 export interface PasswordResetTokenInfo {
-    userId: string;
+    uid: string;
     expiresAt: Date;
 }
 /**
  * Magic link token info
  */
 export interface MagicLinkTokenInfo {
-    userId: string;
+    uid: string;
     expiresAt: Date;
 }
 /**
@@ -185,11 +185,11 @@ export interface UserRepository {
     /**
      * Get all identities linked to a user
      */
-    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
+    getUserIdentities(uid: string): Promise<UserIdentityData[]>;
     /**
      * Link a new OAuth identity to a user
      */
-    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
+    linkUserIdentity(uid: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
     /**
      * Update a user
      */
@@ -225,23 +225,23 @@ export interface UserRepository {
     /**
      * Get roles for a user
      */
-    getUserRoles(userId: string): Promise<RoleData[]>;
+    getUserRoles(uid: string): Promise<RoleData[]>;
     /**
      * Get role IDs for a user
      */
-    getUserRoleIds(userId: string): Promise<string[]>;
+    getUserRoleIds(uid: string): Promise<string[]>;
     /**
      * Set roles for a user (replaces existing roles)
      */
-    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
+    setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     /**
      * Assign a specific role to a new user
      */
-    assignDefaultRole(userId: string, roleId: string): Promise<void>;
+    assignDefaultRole(uid: string, roleId: string): Promise<void>;
     /**
      * Get user with their roles
      */
-    getUserWithRoles(userId: string): Promise<{
+    getUserWithRoles(uid: string): Promise<{
         user: UserData;
         roles: RoleData[];
     } | null>;
@@ -280,7 +280,7 @@ export interface TokenRepository {
     /**
      * Create a new refresh token
      */
-    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
     /**
      * Find a refresh token by hash
      */
@@ -292,19 +292,19 @@ export interface TokenRepository {
     /**
      * Delete all refresh tokens for a user
      */
-    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
+    deleteAllRefreshTokensForUser(uid: string): Promise<void>;
     /**
      * List all refresh tokens for a user
      */
-    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
+    listRefreshTokensForUser(uid: string): Promise<RefreshTokenInfo[]>;
     /**
      * Delete a specific refresh token by its primary key ID
      */
-    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
+    deleteRefreshTokenById(id: string, uid: string): Promise<void>;
     /**
      * Create a password reset token
      */
-    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    createPasswordResetToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     /**
      * Find a valid (not expired, not used) password reset token by hash
      */
@@ -316,7 +316,7 @@ export interface TokenRepository {
     /**
      * Delete all password reset tokens for a user
      */
-    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
+    deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
     /**
      * Clean up expired tokens
      */
@@ -324,7 +324,7 @@ export interface TokenRepository {
     /**
      * Create a magic link token
      */
-    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    createMagicLinkToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     /**
      * Find a valid (not expired, not used) magic link token by hash
      */
@@ -339,7 +339,7 @@ export interface TokenRepository {
  */
 export interface MfaFactor {
     id: string;
-    userId: string;
+    uid: string;
     factorType: "totp";
     friendlyName?: string;
     verified: boolean;
@@ -361,7 +361,7 @@ export interface MfaChallengeInfo {
  */
 export interface RecoveryCode {
     id: string;
-    userId: string;
+    uid: string;
     usedAt?: Date;
 }
 /**
@@ -372,11 +372,11 @@ export interface MfaRepository {
     /**
      * Create a new MFA factor for a user
      */
-    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
+    createMfaFactor(uid: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
     /**
      * Get all MFA factors for a user
      */
-    getMfaFactors(userId: string): Promise<MfaFactor[]>;
+    getMfaFactors(uid: string): Promise<MfaFactor[]>;
     /**
      * Get a specific MFA factor by ID
      */
@@ -390,7 +390,7 @@ export interface MfaRepository {
     /**
      * Delete an MFA factor
      */
-    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
+    deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     /**
      * Create an MFA challenge
      */
@@ -406,23 +406,23 @@ export interface MfaRepository {
     /**
      * Create recovery codes for a user
      */
-    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
+    createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
     /**
      * Use a recovery code (mark as used)
      */
-    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
+    useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;
     /**
      * Get unused recovery code count for a user
      */
-    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
+    getUnusedRecoveryCodeCount(uid: string): Promise<number>;
     /**
      * Delete all recovery codes for a user
      */
-    deleteAllRecoveryCodes(userId: string): Promise<void>;
+    deleteAllRecoveryCodes(uid: string): Promise<void>;
     /**
      * Check if a user has any verified MFA factors
      */
-    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
+    hasVerifiedMfaFactors(uid: string): Promise<boolean>;
 }
 /**
  * Combined auth repository interface for convenience

package/dist/auth/jwt.d.ts

@@ -4,9 +4,14 @@ export interface JwtConfig {
     refreshExpiresIn?: string;
 }
 export interface AccessTokenPayload {
-    userId: string;
+    /**
+     * The user's id — the same spelling the domain model, the auth adapters and
+     * the RLS layer (`auth.uid()`) all use. Tokens minted before this rename
+     * carry `uid` instead, and older external IdPs may send `sub`;
+     * {@link verifyAccessToken} accepts all three and normalises to this.
+     */
+    uid: string;
     roles: string[];
-    uid?: string;
     /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
     aal?: "aal1" | "aal2";
     /** Email claim from the JWT, if present */
@@ -28,7 +33,7 @@ export declare function configureJwt(config: JwtConfig): void;
 /**
  * Generate an access token (short-lived, 1 hour by default)
  */
-export declare function generateAccessToken(userId: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
+export declare function generateAccessToken(uid: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
 /**
  * Get the expiration time of an access token in milliseconds from now
  */

package/dist/auth/magic-link-routes.d.ts

@@ -23,10 +23,10 @@ export declare function mountMagicLinkRoutes(deps: {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
         roleIds: string[];
         accessToken: string;
         refreshToken: string;
     }>;
-    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
 }): void;

package/dist/auth/mfa-routes.d.ts

@@ -4,4 +4,4 @@ import { HonoEnv } from "../api/types";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>): void;
+export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>): void;

package/dist/auth/middleware.d.ts

@@ -1,17 +1,17 @@
 import { MiddlewareHandler, Context } from "hono";
 import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt";
-import { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated
  * - `true` = authenticated as default user
- * - object with `userId` or `uid` = authenticated with user info
+ * - object with `uid` (or legacy `userId`) = authenticated with user info
  */
 export type AuthResult = boolean | null | undefined | {
-    userId?: string;
     uid?: string;
+    userId?: string;
     roles?: string[];
     [key: string]: unknown;
 };

package/dist/auth/reset-password-admin.d.ts

@@ -24,6 +24,6 @@ export interface ResetPasswordRouteConfig {
 /**
  * Create a standalone admin route for resetting user passwords.
  *
- * Mounts: POST /users/:userId/reset-password
+ * Mounts: POST /users/:uid/reset-password
  */
 export declare function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono<HonoEnv>;

package/dist/auth/session-routes.d.ts

@@ -18,12 +18,12 @@ interface SessionRoutesConfig {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
         roleIds: string[];
         accessToken: string;
         refreshToken: string;
     }>;
-    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
 }
 export declare function mountSessionRoutes(opts: SessionRoutesConfig): void;
 export {};