@rebasepro/server 0.9.1-canary.ff338b5 → 0.10.1-canary.14e53ae

package/bin/rebase-server.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * The Rebase runtime entrypoint.
+ *
+ * Runs a built project bundle. This is what the official `rebasepro/server`
+ * container image executes, and what a self-hosted deployment runs directly:
+ *
+ *     rebase-server ./dist-bundle
+ *     REBASE_BUNDLE=/bundle rebase-server
+ *
+ * The bundle is the project; this process is the engine. Keeping them separate
+ * is what allows the engine to be upgraded — a security patch, a performance
+ * fix — without rebuilding anyone's application.
+ */
+import { runFromBundle } from "../dist/index.es.js";
+
+const args = process.argv.slice(2);
+
+if (args[0] === "--help" || args[0] === "-h") {
+    console.log(`
+rebase-server — run a built Rebase project bundle
+
+Usage:
+  rebase-server [bundle-dir]
+
+Arguments:
+  bundle-dir            Path to the bundle. Defaults to $REBASE_BUNDLE, then ./dist-bundle
+
+Key environment variables:
+  DATABASE_URL          Connection string for the default database (required)
+  JWT_SECRET            Signing secret, >=32 chars (required in production)
+  PORT                  Port to bind (default 3001)
+  CORS_ORIGINS          Comma-separated allowed origins (required in production)
+  REBASE_METRICS        "true" to expose Prometheus metrics at /metrics
+  REBASE_MIGRATE_ON_BOOT  none | ensure  (collection tables: run 'rebase db push')
+
+Additional databases and buckets are configured by suffixing the variable with
+the source key, e.g. DATABASE_URL__ANALYTICS or S3_BUCKET__MEDIA.
+
+Docs: https://rebase.pro/docs/deployment/self-hosting/
+`.trim());
+    process.exit(0);
+}
+
+if (args[0] === "--version" || args[0] === "-v") {
+    const { readFileSync } = await import("node:fs");
+    const { fileURLToPath } = await import("node:url");
+    const { dirname, join } = await import("node:path");
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+    console.log(pkg.version);
+    process.exit(0);
+}
+
+await runFromBundle({ bundleDir: args[0] });

package/dist/api/contract-routes.d.ts

@@ -0,0 +1,36 @@
+import { Hono } from "hono";
+import { type CollectionConfig } from "@rebasepro/types";
+import type { HonoEnv } from "./types";
+/**
+ * The project contract endpoint.
+ *
+ * This is what makes a repository able to build against a project it does not
+ * contain. Without it, a typed client can only be generated from local
+ * collection *source*, which means every frontend must live in the same
+ * repository as the backend. Serving the contract turns that around: an app
+ * asks the project what its shape is, so a web app, a second web app and a
+ * mobile app can each live wherever they like and none of them needs to know
+ * about the others.
+ *
+ * Admin-gated. Collection definitions describe every table, column and relation
+ * in the project, including ones no security rule would ever expose — that is a
+ * map of the database, not public API documentation.
+ */
+export interface ContractRoutesConfig {
+    collectionRegistry: {
+        getRawCollections(): CollectionConfig[];
+    };
+    /**
+     * The schema version recorded at build time.
+     *
+     * Preferred over recomputing, so that what a client is told matches exactly
+     * what the bundle claims. It is recomputed only when a bundle did not record
+     * one — a `baas`-mode project derives its collections from the live database
+     * at boot, so there was nothing to hash when it was built.
+     */
+    schemaVersion?: string;
+    mode: "cms" | "baas";
+    /** Runtime package version, surfaced so a client can report what it built against. */
+    runtimeVersion?: string;
+}
+export declare function createContractRoutes(config: ContractRoutesConfig): Hono<HonoEnv>;

package/dist/api/errors.d.ts

@@ -9,9 +9,24 @@ export declare class ApiError extends Error {
     readonly statusCode: number;
     readonly code: string;
     readonly details?: unknown;
-    constructor(statusCode: number, code: string, message: string, details?: unknown);
+    /**
+     * Whether this outcome is a routine part of normal operation rather than
+     * something an operator should look at. Expected errors log at debug; every
+     * other operational error logs at warn.
+     *
+     * The motivating case is `POST /auth/refresh` with no session: clients
+     * refresh on page load before they know whether one exists, so every
+     * anonymous page view is a 401 — correct, and not worth a warning line.
+     */
+    readonly expected: boolean;
+    constructor(statusCode: number, code: string, message: string, details?: unknown, expected?: boolean);
     static badRequest(message: string, code?: string, details?: unknown): ApiError;
     static unauthorized(message: string, code?: string): ApiError;
+    /**
+     * A 401 that is a normal outcome, not an incident — logged at debug.
+     * See {@link ApiError.expected}.
+     */
+    static unauthenticated(message: string, code?: string): ApiError;
     static forbidden(message: string, code?: string): ApiError;
     static notFound(message: string, code?: string): ApiError;
     static conflict(message: string, code?: string): ApiError;

package/dist/api/rest/api-generator.d.ts

@@ -1,6 +1,7 @@
 import { Hono } from "hono";
 import { AuthAdapter, DataDriver, CollectionConfig } from "@rebasepro/types";
 import { HonoEnv } from "../types";
+import { type ListLimitOptions } from "./query-parser";
 /**
  * Lightweight REST API generator that leverages existing Rebase DataDriver.
  * Supports `include` query parameter for eager-loading relations via Drizzle.
@@ -12,8 +13,15 @@ export declare class RestApiGenerator {
     private router;
     private driver;
     private maxBulkRows;
+    private listLimits;
     private authAdapter?;
-    constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter, maxBulkRows?: number);
+    constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter, maxBulkRows?: number, listLimits?: ListLimitOptions);
+    /**
+     * Parse request query params into QueryOptions, applying this generator's
+     * list-pagination bounds (default page size + hard max limit) so no read
+     * path can be tricked into buffering an entire table into memory.
+     */
+    private parseQuery;
     /**
      * Generate REST routes using existing DataDriver
      */

package/dist/api/rest/query-parser.d.ts

@@ -1,6 +1,22 @@
 import { QueryOptions } from "../types";
 export declare const mapOperator: (op: string) => import("@rebasepro/types").WhereFilterOp | null;
+export { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from "@rebasepro/types";
+/**
+ * Overridable list-pagination bounds for {@link parseQueryOptions}. Without
+ * these, `GET /<collection>` with no `?limit` would buffer the ENTIRE table
+ * into a JS array + JSON response (a trivial OOM/DoS), and `?limit=100000000`
+ * would be honoured verbatim.
+ */
+export interface ListLimitOptions {
+    /**
+     * Page size used when the client sends no `?limit`. Applied to plain and
+     * text-search reads — a vector search falls back to its own default (10).
+     */
+    defaultLimit?: number;
+    /** Upper bound clamped onto any client-supplied `?limit`. */
+    maxLimit?: number;
+}
 /**
  * Parse query parameters into QueryOptions
  */
-export declare function parseQueryOptions(query: Record<string, unknown>): QueryOptions;
+export declare function parseQueryOptions(query: Record<string, unknown>, limits?: ListLimitOptions): QueryOptions;

package/dist/api/rest/write-validation.d.ts

@@ -12,8 +12,11 @@ import { CollectionConfig } from "@rebasepro/types";
  *   columns, so the set is exact);
  * - the foreign-key column behind an owning relation, which callers may write
  *   directly instead of through the relation property;
+ * - anything named in `options.extraKnownFields` — for an auth collection the
+ *   credential keys the auth adapter consumes before a row is ever built;
  * - nothing else. `id` in particular is not automatically known — see below.
  */
 export declare function assertKnownWriteFields(values: Record<string, unknown>, collection: CollectionConfig, options?: {
     rowIndex?: number;
+    extraKnownFields?: readonly string[];
 }): void;

package/dist/api/types.d.ts

@@ -1,5 +1,5 @@
 import { VectorSearchParams, LogicalCondition, FilterValues } from "@rebasepro/types";
-import { AuthResult } from "../auth/middleware";
+import type { AuthResult } from "../auth/middleware";
 import { DataDriver } from "@rebasepro/types";
 import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 /**
@@ -9,7 +9,7 @@ import type { ApiKeyMasked } from "../auth/api-keys/api-key-types";
 export type HonoEnv = {
     Variables: {
         user?: AuthResult | {
-            userId?: string;
+            uid?: string;
             roles?: string[];
         };
         driver?: DataDriver;

package/dist/auth/admin-users-route.d.ts

@@ -3,10 +3,10 @@
  *
  * Mounts:
  *   GET /users
- *   GET /users/:userId
+ *   GET /users/:uid
  *   POST /users
- *   PUT /users/:userId
- *   DELETE /users/:userId
+ *   PUT /users/:uid
+ *   DELETE /users/:uid
  *   POST /bootstrap
  */
 import { Hono } from "hono";

package/dist/auth/auth-hooks.d.ts

@@ -135,7 +135,7 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    afterLogout?(userId: string): Promise<void>;
+    afterLogout?(uid: string): Promise<void>;
     /**
      * Called after successful MFA verification.
      *
@@ -143,12 +143,12 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    onMfaVerified?(userId: string, factorId: string): Promise<void>;
+    onMfaVerified?(uid: string, factorId: string): Promise<void>;
     /**
      * Customize JWT access token claims before signing.
      *
      * Return the modified claims object. The returned claims are merged
-     * into the JWT payload alongside standard claims (userId, roles).
+     * into the JWT payload alongside standard claims (uid, roles).
      *
      * @param claims - The default claims that would be included.
      * @param user - The authenticated user data.
@@ -178,14 +178,14 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    onPasswordReset?(userId: string): Promise<void>;
+    onPasswordReset?(uid: string): Promise<void>;
     /**
      * Called before a user is deleted.
      *
      * Throw an error to prevent deletion (e.g. for users with active
      * subscriptions, pending transactions, etc.).
      */
-    beforeUserDelete?(userId: string): Promise<void>;
+    beforeUserDelete?(uid: string): Promise<void>;
     /**
      * Called after a user is deleted.
      *
@@ -193,7 +193,7 @@ export interface AuthHooks {
      *
      * This is fire-and-forget — errors are logged but do not fail the request.
      */
-    afterUserDelete?(userId: string): Promise<void>;
+    afterUserDelete?(uid: string): Promise<void>;
     /**
      * Optional hook to customize or override the default user creation flow via the admin panel/REST API.
      * When provided, this replaces the built-in password generation, hashing, and invitation email logic.
@@ -212,7 +212,7 @@ export interface AuthHooks {
      * Optional hook to customize or override the default password reset flow via the admin panel.
      * When provided, this replaces the built-in password reset token generation, hashing, and email logic.
      */
-    onAdminResetPassword?(userId: string, ctx: {
+    onAdminResetPassword?(uid: string, ctx: {
         authRepo: AuthRepository;
         emailService?: EmailService;
         emailConfig?: EmailConfig;

package/dist/auth/interfaces.d.ts

@@ -40,7 +40,7 @@ export interface CreateUserData {
  */
 export interface UserIdentityData {
     id: string;
-    userId: string;
+    uid: string;
     provider: string;
     providerId: string;
     profileData?: Record<string, unknown> | null;
@@ -113,25 +113,52 @@ export interface CreateRoleData {
  */
 export interface RefreshTokenInfo {
     id: string;
-    userId: string;
+    uid: string;
     tokenHash: string;
     expiresAt: Date;
     createdAt: Date;
     userAgent?: string | null;
     ipAddress?: string | null;
+    /**
+     * The sign-in this token descends from. Every token minted by rotating
+     * this one carries the same id.
+     *
+     * Optional because a custom {@link TokenRepository} written against an
+     * older release does not supply it; the refresh endpoint then treats the
+     * token as a session of one, which costs reuse tolerance but still works.
+     */
+    sessionId?: string;
+    /**
+     * Set when this token was superseded by a rotation. Being superseded is
+     * not an error — a client whose response was lost still holds it — so it
+     * stays usable to mint a sibling for a short window after this instant.
+     */
+    rotatedAt?: Date | null;
+    /** Hard kill (logout, remote session revoke). Never usable again. */
+    revoked?: boolean;
+    /** When the sign-in happened; carried across rotations, unlike createdAt. */
+    sessionStartedAt?: Date;
+}
+/**
+ * Identity of the sign-in a refresh token belongs to, threaded through
+ * rotation so descendants stay grouped.
+ */
+export interface RefreshTokenSession {
+    id: string;
+    startedAt: Date;
 }
 /**
  * Password reset token info
  */
 export interface PasswordResetTokenInfo {
-    userId: string;
+    uid: string;
     expiresAt: Date;
 }
 /**
  * Magic link token info
  */
 export interface MagicLinkTokenInfo {
-    userId: string;
+    uid: string;
     expiresAt: Date;
 }
 /**
@@ -185,11 +212,11 @@ export interface UserRepository {
     /**
      * Get all identities linked to a user
      */
-    getUserIdentities(userId: string): Promise<UserIdentityData[]>;
+    getUserIdentities(uid: string): Promise<UserIdentityData[]>;
     /**
      * Link a new OAuth identity to a user
      */
-    linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
+    linkUserIdentity(uid: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
     /**
      * Update a user
      */
@@ -225,23 +252,23 @@ export interface UserRepository {
     /**
      * Get roles for a user
      */
-    getUserRoles(userId: string): Promise<RoleData[]>;
+    getUserRoles(uid: string): Promise<RoleData[]>;
     /**
      * Get role IDs for a user
      */
-    getUserRoleIds(userId: string): Promise<string[]>;
+    getUserRoleIds(uid: string): Promise<string[]>;
     /**
      * Set roles for a user (replaces existing roles)
      */
-    setUserRoles(userId: string, roleIds: string[]): Promise<void>;
+    setUserRoles(uid: string, roleIds: string[]): Promise<void>;
     /**
      * Assign a specific role to a new user
      */
-    assignDefaultRole(userId: string, roleId: string): Promise<void>;
+    assignDefaultRole(uid: string, roleId: string): Promise<void>;
     /**
      * Get user with their roles
      */
-    getUserWithRoles(userId: string): Promise<{
+    getUserWithRoles(uid: string): Promise<{
         user: UserData;
         roles: RoleData[];
     } | null>;
@@ -278,9 +305,45 @@ export interface RoleRepository {
  */
 export interface TokenRepository {
     /**
-     * Create a new refresh token
+     * Create a new refresh token.
+     *
+     * `session` groups this token with the sign-in it descends from. It is
+     * optional so that repositories written against an older release keep
+     * satisfying this interface; implementations that ignore it degrade to one
+     * session per token.
+     */
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    /**
+     * Mark a token as superseded by a rotation, WITHOUT making it unusable.
+     *
+     * The distinction from deletion is the entire point: a client that never
+     * received the rotated response still holds this token, and must be able
+     * to present it and be recognised. Implementations that omit this method
+     * fall back to {@link TokenRepository.deleteRefreshToken}, which restores
+     * the old, lossy behaviour.
+     */
+    markRefreshTokenRotated?(tokenHash: string): Promise<void>;
+    /**
+     * Hard-kill every token of one sign-in (logout, remote session revoke).
+     * Unlike rotation this is final — no grace, no replay.
+     */
+    revokeRefreshTokenSession?(sessionId: string): Promise<void>;
+    /**
+     * Drop tokens of a session that were superseded before `supersededBefore`,
+     * plus anything already expired. Keeps rotation from growing a row per
+     * refresh forever; called opportunistically, never load-bearing.
+     */
+    pruneRefreshTokens?(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    /**
+     * The instant before which every session of this user is void, or null if
+     * none is set. See `users.tokens_valid_after`.
+     */
+    getTokensValidAfter?(uid: string): Promise<Date | null>;
+    /**
+     * Void every session that began before `at`. Set alongside deleting the
+     * user's tokens so a rotation racing the delete cannot survive it.
      */
-    createRefreshToken(userId: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    setTokensValidAfter?(uid: string, at: Date): Promise<void>;
     /**
      * Find a refresh token by hash
      */
@@ -292,19 +355,19 @@ export interface TokenRepository {
     /**
      * Delete all refresh tokens for a user
      */
-    deleteAllRefreshTokensForUser(userId: string): Promise<void>;
+    deleteAllRefreshTokensForUser(uid: string): Promise<void>;
     /**
      * List all refresh tokens for a user
      */
-    listRefreshTokensForUser(userId: string): Promise<RefreshTokenInfo[]>;
+    listRefreshTokensForUser(uid: string): Promise<RefreshTokenInfo[]>;
     /**
      * Delete a specific refresh token by its primary key ID
      */
-    deleteRefreshTokenById(id: string, userId: string): Promise<void>;
+    deleteRefreshTokenById(id: string, uid: string): Promise<void>;
     /**
      * Create a password reset token
      */
-    createPasswordResetToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    createPasswordResetToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     /**
      * Find a valid (not expired, not used) password reset token by hash
      */
@@ -316,7 +379,7 @@ export interface TokenRepository {
     /**
      * Delete all password reset tokens for a user
      */
-    deleteAllPasswordResetTokensForUser(userId: string): Promise<void>;
+    deleteAllPasswordResetTokensForUser(uid: string): Promise<void>;
     /**
      * Clean up expired tokens
      */
@@ -324,7 +387,7 @@ export interface TokenRepository {
     /**
      * Create a magic link token
      */
-    createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    createMagicLinkToken(uid: string, tokenHash: string, expiresAt: Date): Promise<void>;
     /**
      * Find a valid (not expired, not used) magic link token by hash
      */
@@ -339,7 +402,7 @@ export interface TokenRepository {
  */
 export interface MfaFactor {
     id: string;
-    userId: string;
+    uid: string;
     factorType: "totp";
     friendlyName?: string;
     verified: boolean;
@@ -361,7 +424,7 @@ export interface MfaChallengeInfo {
  */
 export interface RecoveryCode {
     id: string;
-    userId: string;
+    uid: string;
     usedAt?: Date;
 }
 /**
@@ -372,11 +435,11 @@ export interface MfaRepository {
     /**
      * Create a new MFA factor for a user
      */
-    createMfaFactor(userId: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
+    createMfaFactor(uid: string, factorType: "totp", secretEncrypted: string, friendlyName?: string): Promise<MfaFactor>;
     /**
      * Get all MFA factors for a user
      */
-    getMfaFactors(userId: string): Promise<MfaFactor[]>;
+    getMfaFactors(uid: string): Promise<MfaFactor[]>;
     /**
      * Get a specific MFA factor by ID
      */
@@ -390,7 +453,7 @@ export interface MfaRepository {
     /**
      * Delete an MFA factor
      */
-    deleteMfaFactor(factorId: string, userId: string): Promise<void>;
+    deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     /**
      * Create an MFA challenge
      */
@@ -406,23 +469,23 @@ export interface MfaRepository {
     /**
      * Create recovery codes for a user
      */
-    createRecoveryCodes(userId: string, codeHashes: string[]): Promise<void>;
+    createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
     /**
      * Use a recovery code (mark as used)
      */
-    useRecoveryCode(userId: string, codeHash: string): Promise<boolean>;
+    useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;
     /**
      * Get unused recovery code count for a user
      */
-    getUnusedRecoveryCodeCount(userId: string): Promise<number>;
+    getUnusedRecoveryCodeCount(uid: string): Promise<number>;
     /**
      * Delete all recovery codes for a user
      */
-    deleteAllRecoveryCodes(userId: string): Promise<void>;
+    deleteAllRecoveryCodes(uid: string): Promise<void>;
     /**
      * Check if a user has any verified MFA factors
      */
-    hasVerifiedMfaFactors(userId: string): Promise<boolean>;
+    hasVerifiedMfaFactors(uid: string): Promise<boolean>;
 }
 /**
  * Combined auth repository interface for convenience

package/dist/auth/jwt.d.ts

@@ -4,9 +4,14 @@ export interface JwtConfig {
     refreshExpiresIn?: string;
 }
 export interface AccessTokenPayload {
-    userId: string;
+    /**
+     * The user's id — the same spelling the domain model, the auth adapters and
+     * the RLS layer (`auth.uid()`) all use. Tokens minted before this rename
+     * carry `uid` instead, and older external IdPs may send `sub`;
+     * {@link verifyAccessToken} accepts all three and normalises to this.
+     */
+    uid: string;
     roles: string[];
-    uid?: string;
     /** Authentication Assurance Level: aal1 = password/oauth, aal2 = MFA verified */
     aal?: "aal1" | "aal2";
     /** Email claim from the JWT, if present */
@@ -28,7 +33,7 @@ export declare function configureJwt(config: JwtConfig): void;
 /**
  * Generate an access token (short-lived, 1 hour by default)
  */
-export declare function generateAccessToken(userId: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
+export declare function generateAccessToken(uid: string, roles: string[], aal?: "aal1" | "aal2", customClaims?: Record<string, unknown>): string;
 /**
  * Get the expiration time of an access token in milliseconds from now
  */
@@ -60,6 +65,23 @@ export declare function generateRefreshToken(): string;
  * Hash a refresh token for database storage (don't store raw tokens)
  */
 export declare function hashRefreshToken(token: string): string;
+/**
+ * The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
+ * rewrite any `Max-Age` beyond 400 days down to 400 days, so promising a
+ * browser more is not a stricter policy — it is a policy that differs from
+ * what is actually enforced, which is worse than knowing the ceiling.
+ */
+export declare const MAX_COOKIE_AGE_MS: number;
+/**
+ * How long a refresh token is valid for, in milliseconds.
+ *
+ * Every rotation issues a token with a fresh TTL, so this is a sliding window:
+ * a user who visits at all keeps their session indefinitely, and one who
+ * disappears loses it this long after their last visit. That is what both
+ * Firebase and Supabase do by default, and it is the behaviour people mean
+ * when they say they expect to still be signed in.
+ */
+export declare function getRefreshTokenTtlMs(): number;
 /**
  * Calculate refresh token expiration date
  */

package/dist/auth/magic-link-routes.d.ts

@@ -23,10 +23,10 @@ export declare function mountMagicLinkRoutes(deps: {
         isAnonymous?: boolean;
         metadata?: Record<string, unknown> | null;
     }, roleIds: string[], accessToken: string, refreshToken: string, providerId: string) => unknown;
-    createSessionAndTokens: (userId: string, userAgent: string, ipAddress: string) => Promise<{
+    createSessionAndTokens: (uid: string, userAgent: string, ipAddress: string) => Promise<{
         roleIds: string[];
         accessToken: string;
         refreshToken: string;
     }>;
-    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>;
+    applyTransformHook: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>;
 }): void;

package/dist/auth/mfa-routes.d.ts

@@ -4,4 +4,4 @@ import { HonoEnv } from "../api/types";
 import type { AuthModuleConfig } from "./routes";
 import { resolveAuthHooks } from "./auth-hooks";
 import type { AuthResponsePayload, TransformAuthResponseContext } from "@rebasepro/types";
-export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, userId: string) => Promise<AuthResponsePayload>): void;
+export declare function mountMfaRoutes(router: Hono<HonoEnv>, config: AuthModuleConfig, ops: ReturnType<typeof resolveAuthHooks>, parseBody: <T>(schema: z.ZodSchema<T>, body: unknown) => T, applyTransformHook?: (response: AuthResponsePayload, method: TransformAuthResponseContext["method"], request: Request, uid: string) => Promise<AuthResponsePayload>): void;

package/dist/auth/middleware.d.ts

@@ -1,17 +1,17 @@
 import { MiddlewareHandler, Context } from "hono";
 import { DataDriver } from "@rebasepro/types";
 import { AccessTokenPayload } from "./jwt";
-import { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types";
 import type { ApiKeyStore } from "./api-keys/api-key-store";
 /**
  * Result from a custom auth validator.
  * - `false`/`null`/`undefined` = not authenticated
  * - `true` = authenticated as default user
- * - object with `userId` or `uid` = authenticated with user info
+ * - object with `uid` (or legacy `userId`) = authenticated with user info
  */
 export type AuthResult = boolean | null | undefined | {
-    userId?: string;
     uid?: string;
+    userId?: string;
     roles?: string[];
     [key: string]: unknown;
 };

package/dist/auth/reset-password-admin.d.ts

@@ -24,6 +24,6 @@ export interface ResetPasswordRouteConfig {
 /**
  * Create a standalone admin route for resetting user passwords.
  *
- * Mounts: POST /users/:userId/reset-password
+ * Mounts: POST /users/:uid/reset-password
  */
 export declare function createResetPasswordRoute(config: ResetPasswordRouteConfig): Hono<HonoEnv>;

package/dist/auth/routes.d.ts

@@ -47,6 +47,22 @@ export interface AuthModuleConfig {
      * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
      */
     cookieAuth?: CookieAuthConfig;
+    /**
+     * How long a refresh token stays usable after it has been rotated away,
+     * in seconds. Default 10, matching GoTrue's `refresh_token_reuse_interval`.
+     *
+     * Rotation is only safe if the client is guaranteed to receive the
+     * replacement, and no network guarantees that. A pod rolls mid-response, a
+     * laptop suspends, a second tab boots at the same instant — and the client
+     * is left holding a token the database has moved past. Within this window
+     * that client is handed a fresh token of the same session instead of a
+     * 401, which is the difference between a hiccup and being silently signed
+     * out of an app you were using.
+     *
+     * Widen it if your clients are flaky or your deploys are long; the cost is
+     * how long a captured token stays useful to someone who copied it.
+     */
+    refreshTokenReuseIntervalSeconds?: number;
 }
 /**
  * Configuration for httpOnly refresh-token cookies.