@rebasepro/types 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/types/resources.d.ts

@@ -0,0 +1,197 @@
+/**
+ * The resource graph: one declaration site for every named thing a project needs.
+ *
+ * ## The rule
+ *
+ * **Every named resource is declared with a constructor in config code.** A
+ * database, a bucket, a topic and whatever kind comes next are all spelled the
+ * same way, so "where do I declare my second one" has one answer instead of one
+ * answer per kind.
+ *
+ * ```ts
+ * export const main    = database("main");
+ * export const media   = bucket("media", { transport: "direct" });
+ * export const signups = topic<SignupEvent>("signups");
+ * ```
+ *
+ * ## Declaration is not binding
+ *
+ * A declaration says a resource *exists* and what shape it has. It never says
+ * how to reach it — that is a property of the environment, not of the project,
+ * and it differs between a laptop, a self-hosted box and a tenant in the cloud.
+ * Binding lives in `@rebasepro/server`'s boot path, reading environment
+ * variables or an infrastructure config file, and it keys off the logical name
+ * declared here.
+ *
+ * This split is the whole point. Before it, storage topology was hand-written
+ * into `rebase.json` while database topology lived in TypeScript, and the
+ * boundary between them was a fact about what the control plane could read
+ * before a build — a platform implementation detail that a developer had no way
+ * to derive. Worse, storage could be declared in *both* places, and the merge
+ * silently kept the JSON's engine and discarded the code's.
+ *
+ * ## Why a registry rather than a fixed union
+ *
+ * Kinds register themselves. Adding pub/sub, a cache or a search index must not
+ * require editing a manifest schema, a validator and three switch statements —
+ * that cost is exactly why the last two kinds ended up in different homes.
+ */
+/** How a client reaches a resource. */
+export type ResourceTransport = 
+/** Through the backend. The default, and the only one that needs no client SDK. */
+"server"
+/** A provider SDK talks to the resource directly; the backend is not in the path. */
+ | "direct";
+/**
+ * A resource kind, as registered.
+ *
+ * `engines` is an allowlist rather than documentation. An unrecognised engine
+ * used to be a free string that passed every check and failed later, further
+ * from the typo that caused it — `"s2"` for `"s3"` reached the runtime. Anything
+ * genuinely outside the list is spelled `custom:<id>`, which says so at the call
+ * site instead of looking like a typo.
+ */
+export interface ResourceKindSpec {
+    /** The kind's name, as it appears in a declaration and in the graph. */
+    kind: string;
+    /** Engines this kind ships with. `custom:<id>` is always additionally valid. */
+    engines: readonly string[];
+    /** Used when a declaration names none. */
+    defaultEngine: string;
+    /**
+     * Environment variable base names this kind binds from, in the order a
+     * binder should try them. A resource keyed `analytics` reads
+     * `<BASE>__ANALYTICS`; the default-keyed resource reads `<BASE>` unsuffixed,
+     * so a single-resource project configured the obvious way declares nothing.
+     */
+    envBases: readonly string[];
+    /**
+     * The subset of `envBases` that matters for a given engine.
+     *
+     * The binder reads every base and takes whichever is set — harmless, and it
+     * keeps binding tolerant. A GENERATOR cannot be that relaxed: `rebase eject
+     * infra` writing S3_BUCKET, GCS_BUCKET, STORAGE_BUCKET and
+     * STORAGE_PUBLIC_URL for a `local` bucket hands somebody four variables of
+     * which three are noise, and a config file full of irrelevant keys is one
+     * nobody reads carefully.
+     *
+     * Keyed by engine; an engine with no entry falls back to all of them, which
+     * is the honest answer for one this package has never heard of.
+     */
+    envBasesByEngine?: Readonly<Record<string, readonly string[]>>;
+    /** Option keys this kind accepts beyond the common ones, for validation. */
+    optionKeys?: readonly string[];
+    /**
+     * Whether a project implicitly has one of these even when it declares
+     * nothing. True for databases — a backend without one is not a backend —
+     * and false for topics, where zero is the normal number.
+     */
+    implicitDefault?: boolean;
+}
+/** The key a resource takes when a project declares only one of its kind. */
+export declare const DEFAULT_RESOURCE_KEY = "(default)";
+/** A declared resource, as it appears in the graph. */
+export interface ResourceDeclaration {
+    kind: string;
+    /** Unique within its kind. What a binder looks up and what an env suffix is built from. */
+    key: string;
+    engine: string;
+    transport: ResourceTransport;
+    label?: string;
+    /** Kind-specific options, validated against the kind's `optionKeys`. */
+    options: Readonly<Record<string, unknown>>;
+}
+/**
+ * The value a constructor returns.
+ *
+ * Carries its own declaration so config code can hold it and pass it around,
+ * and stringifies to its key so it drops into the places that still take one.
+ * Collections name a data source by string today; a handle works there without
+ * the collection API having to change, which keeps this a config redesign
+ * rather than a rewrite of the data layer.
+ */
+export interface ResourceHandle extends ResourceDeclaration {
+    toString(): string;
+}
+/** Whether a value is a resource handle rather than a plain string key. */
+export declare function isResourceHandle(value: unknown): value is ResourceHandle;
+/** The key a resource reference names, whether it is a handle or already a key. */
+export declare function resourceKeyOf(ref: string | ResourceHandle): string;
+/** Register a resource kind. Idempotent for an identical spec; throws on a conflicting one. */
+export declare function registerResourceKind(spec: ResourceKindSpec): void;
+/** Every registered kind, for validators and for `rebase doctor`. */
+export declare function resourceKinds(): ResourceKindSpec[];
+/** One registered kind, or undefined. */
+export declare function resourceKind(kind: string): ResourceKindSpec | undefined;
+/** Options every kind accepts. */
+export interface DeclareOptions {
+    engine?: string;
+    transport?: ResourceTransport;
+    label?: string;
+    [option: string]: unknown;
+}
+/** Whether an engine is one the kind knows, or an explicit `custom:` opt-out. */
+export declare function isValidEngine(spec: ResourceKindSpec, engine: string): boolean;
+/**
+ * Declare a resource. The primitive every kind's constructor is built from.
+ *
+ * Redeclaring the same `kind:key` with a *different* shape throws rather than
+ * merging. Merging is what the old storage path did, and it silently discarded
+ * one of the two engines — a declaration accepted and then ignored, which is
+ * the failure this whole model exists to remove. Redeclaring it identically is
+ * fine: a config module evaluated twice must not be an error.
+ */
+export declare function declareResource(kind: string, key?: string, options?: DeclareOptions): ResourceHandle;
+/** Every declared resource, in declaration order, optionally filtered by kind. */
+export declare function declaredResources(kind?: string): ResourceDeclaration[];
+/**
+ * Forget every declaration, keeping registered kinds.
+ *
+ * For tests and for a CLI that evaluates more than one project in a process.
+ * Kinds survive because they are registered by module import, which will not
+ * happen a second time.
+ */
+export declare function resetDeclaredResources(): void;
+/**
+ * The env-var suffix a resource's bindings use: `__ANALYTICS` for `analytics`,
+ * and nothing at all for the default-keyed one.
+ *
+ * The default takes no suffix so that a project with one database configured
+ * through plain `DATABASE_URL` keeps working having declared nothing — the
+ * overwhelmingly common project must not have to say so.
+ */
+export declare function resourceEnvSuffix(key: string): string;
+/**
+ * Two resources of a kind whose keys differ but whose env suffixes do not.
+ *
+ * `media-files` and `media_files` both become `__MEDIA_FILES`, so one would
+ * silently read the other's configuration. Returned rather than thrown so the
+ * caller can report it with the rest of a validation pass.
+ */
+export declare function findEnvSuffixCollision(keys: readonly string[]): {
+    a: string;
+    b: string;
+    suffix: string;
+} | null;
+/**
+ * The whole graph, as recorded in a manifest and read by a host.
+ *
+ * `version` is the graph format, not the project's. A host reading a graph it
+ * does not understand must say so rather than provision half of it.
+ */
+export interface ResourceGraph {
+    version: 1;
+    resources: ResourceDeclaration[];
+}
+/** The current graph format version. */
+export declare const RESOURCE_GRAPH_VERSION: 1;
+/** Build a graph from the current declarations, sorted for a stable diff. */
+export declare function buildResourceGraph(): ResourceGraph;
+/**
+ * The environment variables worth writing for a resource, given its engine.
+ *
+ * Falls back to every base the kind reads when the engine is unknown — a
+ * `custom:` engine gets the full list rather than an empty one, because
+ * guessing narrow would silently omit the variable it actually needs.
+ */
+export declare function envBasesForResource(declaration: ResourceDeclaration): readonly string[];

package/dist/types/schema_editing.d.ts

@@ -0,0 +1,127 @@
+/**
+ * The vocabulary a live schema change is described in.
+ *
+ * Declared here, and nowhere else, because two packages that must not import
+ * each other both need it: `@rebasepro/server-postgres` decides what a change
+ * means and renders the files it needs, while `@rebasepro/server` commits those
+ * files and serves the routes. Neither can reach the other — the server is
+ * engine-agnostic by design — so the shared kernel holds the shapes and the
+ * driver is detected structurally through {@link SchemaEditingAdmin}.
+ *
+ * Nothing here executes anything. These are the nouns.
+ */
+/**
+ * What a change will do to a live database.
+ *
+ * - `safe` — the boot-time ensure path expresses it, and the result matches the
+ *   configuration.
+ * - `diverges` — the ensure path applies *something*, but the database will not
+ *   match what the configuration declares, and nothing reports it. This is the
+ *   category worth having: adding a required property to a populated table
+ *   yields a nullable column, and adding a value to an existing enum yields
+ *   nothing at all. Both read as success.
+ * - `needs-migration` — the ensure path cannot express it. Dropping anything,
+ *   changing a type, moving a primary key.
+ */
+export type SchemaChangeVerdict = "safe" | "diverges" | "needs-migration";
+export type SchemaChangeKind = "add-collection" | "remove-collection" | "add-property" | "remove-property" | "change-property-type" | "rename-column" | "add-enum-value" | "remove-enum-value" | "change-required" | "change-primary-key";
+export interface SchemaChange {
+    kind: SchemaChangeKind;
+    verdict: SchemaChangeVerdict;
+    /** Collection slug. */
+    collection: string;
+    /** Property name, where the change is to one. */
+    property?: string;
+    /** One line, specific: what changed and what it will do. */
+    detail: string;
+    /** What to do instead, when the verdict is not `safe`. */
+    remedy?: string;
+}
+export interface ClassifiedSchemaChanges {
+    changes: SchemaChange[];
+    /** The worst verdict present, or `safe` for an empty diff. */
+    verdict: SchemaChangeVerdict;
+    /** True only when every change is `safe` — the one case an editor may apply. */
+    applicable: boolean;
+}
+/**
+ * Where a project's generated schema artifacts live, relative to the **project**
+ * root — which is the repository root only when the project is the whole
+ * repository.
+ *
+ * Here rather than in the Postgres package because it is a contract, not an
+ * engine detail: `@rebasepro/server` has to derive these for a project in a
+ * subdirectory, and it cannot import a driver to do it.
+ */
+export interface SchemaCommitPaths {
+    /** Drizzle schema, imported by the backend. */
+    schemaFile: string;
+    /** Declarative DDL, what `db push` applies and Atlas diffs against. */
+    ddlFile: string;
+    policiesFile: string;
+    searchFile: string;
+}
+export declare const DEFAULT_COMMIT_PATHS: SchemaCommitPaths;
+/** One file the commit writes, as content rather than as a path on a disk. */
+export interface SchemaChangeFile {
+    path: string;
+    contents: string;
+}
+/**
+ * Everything a change needs written and run.
+ *
+ * Computed without touching a disk or a network. The database is *read* — what
+ * a change means depends on what is already there, and a plan that guessed
+ * would be guessing about whether the statements it returns will be accepted.
+ */
+export interface SchemaChangePlan {
+    /** Every file the commit writes — collection source and generated artifacts. */
+    files: SchemaChangeFile[];
+    /** The additive DDL this change adds, in dependency order. */
+    statements: string[];
+    classified: ClassifiedSchemaChanges;
+    /** A commit message describing the change rather than announcing one. */
+    message: string;
+    /**
+     * Constraints the configuration asks for that these statements do not
+     * carry, and why.
+     *
+     * Almost always empty. When it is not, it is the part the person confirming
+     * needs to read: the change will apply, and the database will still not
+     * enforce something the configuration says — a required property over a
+     * table that already holds rows with no value for it. Optional so a plan
+     * from an engine that does not distinguish these cases stays valid.
+     */
+    withheldConstraints?: WithheldSchemaConstraint[];
+}
+/** A constraint a plan asks for and does not apply. */
+export interface WithheldSchemaConstraint {
+    /** `schema.table.column`. */
+    target: string;
+    kind: "not-null";
+    /** What is in the way, naming the obstacle rather than the rule. */
+    reason: string;
+    /** What would make it applicable. */
+    remedy: string;
+}
+/**
+ * An admin that can plan a schema change.
+ *
+ * Planning only. Applying is `executeSql`, which every SQL admin already has,
+ * and committing belongs to whatever holds the repository — keeping those three
+ * apart is what lets the same plan be committed locally on a developer's machine
+ * and through a GitHub App from a cloud tenant.
+ *
+ * @group Admin
+ */
+export interface SchemaEditingAdmin {
+    /**
+     * Decide what the change means and render everything it needs.
+     *
+     * Rejects when the change is not applicable, carrying the classification so
+     * a caller can say which change was the problem.
+     */
+    planSchemaChange(before: unknown[], after: unknown[], options?: {
+        paths?: Partial<SchemaCommitPaths>;
+    }): Promise<SchemaChangePlan>;
+}

package/dist/types/schema_version.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionConfig } from "./collections";
+import type { CollectionConfig } from "./collections.js";
 /**
  * Compute the canonical string a schema version hashes.
  *

package/dist/types/security_rules.d.ts

@@ -15,7 +15,7 @@
  * them with `getPolicyNamesForRule`/`getEffectiveSecurityRules` rather than
  * matching on `rule.name`.
  */
-import type { PolicyExpression } from "./policy";
+import type { PolicyExpression } from "./policy.js";
 /**
  * SQL operation that a policy applies to.
  * @group Models

package/dist/types/storage_source.d.ts

@@ -54,6 +54,33 @@ export interface StorageSourceDefinition {
      * `"gcs"`, `"firebase"`, `"azure"`, or a custom id).
      */
     engine: string;
+    /**
+     * The credential set this source signs with, when several sources share one.
+     *
+     * ## What it is for
+     *
+     * Every binding a bucket needs is read per key — `S3_BUCKET__MEDIA`,
+     * `S3_ACCESS_KEY_ID__MEDIA`, and so on. That is right for the bucket *name*,
+     * which is different for every source by definition, and wrong for the
+     * credentials, which usually are not: fifteen buckets on one MinIO install
+     * meant fifteen copies of the same endpoint, access key and secret — ninety
+     * variables where eighteen would do, and one key rotation became fifteen
+     * paired edits where a single missed one fails at upload time with an opaque
+     * signing error.
+     *
+     * Naming an account here lets the *account-scoped* bindings fall back to
+     * `<BASE>__<ACCOUNT>` when no per-key value is set. The bucket name never
+     * falls back: it is what distinguishes one source from another.
+     *
+     * ## Why it does not fall back to the bare variable
+     *
+     * A source with no `account` reads only its own suffixed names, exactly as
+     * before — so every project that predates this is wire-identical. The
+     * unsuffixed `S3_ACCESS_KEY_ID` belongs to the *default* source, and letting
+     * a named bucket inherit it would mean a typo'd key silently signs with
+     * another source's credentials. Two forms, both explicit, opt-in.
+     */
+    account?: string;
     /**
      * How the frontend reaches this storage. Defaults to `"server"`.
      *

package/dist/users/index.d.ts

@@ -1 +1 @@
-export * from "./user";
+export * from "./user.js";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/types",
   "type": "module",
-  "version": "0.16.0",
+  "version": "0.16.1-canary.g0d7af95",
   "description": "Rebase type definitions — shared interfaces and controller types",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -88,7 +88,7 @@
   },
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && node ../../tooling/scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest --passWithNoTests",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"

package/src/controllers/client.ts

@@ -300,7 +300,7 @@ export interface RebaseClient<DB = unknown> {
     /** Unified Authentication layer */
     auth: AuthClient;
 
-    /** Unified Storage layer (default storage source, backward-compatible) */
+    /** Unified Storage layer — the default storage source. */
     storage?: StorageSource;
 
     /** Registry of all named storage sources for multi-backend support */
@@ -437,6 +437,19 @@ export interface RebaseServerClient<DB = unknown> extends Omit<RebaseClient<DB>,
      * Execute raw SQL against the database. Always present server-side for SQL
      * engines. Values interpolated into the query should be passed via
      * `params`, referenced as `$1`, `$2`, … placeholders in the query text.
+     *
+     * **Runtime note.** This is the one accessor on this object that is not
+     * portable. It runs on the database owner connection over a TCP socket, so
+     * it is available wherever the framework holds that connection — every Node
+     * deployment, self-hosted or managed — and not on a host that has no
+     * sockets and no business holding owner credentials.
+     *
+     * Nothing about that is a problem for a Node deployment, and it is not a
+     * reason to avoid it there. It is a reason not to build a function's *only*
+     * data path on it if that function may later move: `c.get("driver")` and
+     * `rebase.dataAsAdmin` go over the same wire wherever they run. A function
+     * that genuinely needs raw SQL can ask `runtimeKey()` and degrade, rather
+     * than discovering it at the call.
      */
     sql(query: string, options?: { database?: string; role?: string; params?: unknown[] }): Promise<Record<string, unknown>[]>;
 }

package/src/controllers/data.ts

@@ -3,15 +3,6 @@ import type { ComputedSortField, SearchMatch } from "../types/search";
 import { Entity, EntityValues } from "../types/entities";
 import { WhereFilterOp, FieldPath, FilterValues, OrderBySpec } from "../types/filter-operators";
 
-/**
- * Operator-blind filter value: whatever the column holds, a list of it, or null.
- *
- * @deprecated Superseded by {@link WhereValueFor}, which correlates the value
- * with the operator. Kept exported because it is public API and downstream code
- * annotates with it; every `where()` overload in this file uses `WhereValueFor`.
- */
-export type WhereValue<T> = T | T[] | null;
-
 /**
  * The element type of an array column, and the column's own type otherwise.
  *

package/src/controllers/email.ts

@@ -20,6 +20,51 @@ export interface EmailSendOptions {
     text?: string;
     /** Optional reply-to address. */
     replyTo?: string;
+    /**
+     * Additional headers, verbatim.
+     *
+     * The reason this exists is that several things a real sender must do are
+     * only expressible as headers, and without a passthrough an application had
+     * to choose between not doing them and not using this interface:
+     *
+     * - `List-Unsubscribe` and `List-Unsubscribe-Post`, which give a mail client
+     *   its own one-click opt-out. The large providers weigh their presence when
+     *   deciding whether bulk mail reaches an inbox at all.
+     * - `In-Reply-To` and `References`, without which a reply is a new thread.
+     *
+     * **Values are validated, not escaped.** A value containing CR or LF is
+     * rejected rather than sanitised, because a newline in a header value ends
+     * the header and starts a new one — so a field built from user input is an
+     * injection point for `Bcc:` and anything else. Rejecting is the only safe
+     * response: silently stripping the newline would deliver a message the
+     * caller did not write, and neither would tell them.
+     */
+    headers?: Record<string, string>;
+}
+
+/**
+ * What the provider reported about a message it accepted.
+ *
+ * Every field is optional because not every backend reports them: a custom
+ * `sendEmail` function that posts to an HTTP API may know nothing beyond "no
+ * error". An absent `messageId` therefore means "not reported", never "not
+ * sent" — the absence of an id is not a delivery failure, which is signalled by
+ * a thrown error.
+ */
+export interface EmailSendResult {
+    /**
+     * The message's RFC 5322 Message-ID, **without** angle brackets.
+     *
+     * Stripped because this is an identifier to store and compare — against a
+     * reply's `In-Reply-To`, most often — and a value that sometimes carries
+     * brackets and sometimes does not is a bug waiting in every comparison.
+     * Re-add them when writing it into a header: `<${messageId}>`.
+     */
+    messageId?: string;
+    /** Recipients the provider accepted, when it says. */
+    accepted?: string[];
+    /** Recipients the provider refused, when it says. A non-empty list is not an error. */
+    rejected?: string[];
 }
 
 /**
@@ -29,8 +74,16 @@ export interface EmailSendOptions {
  * provider — consumers only interact through this interface.
  */
 export interface EmailService {
-    /** Send a single email. */
-    send(options: EmailSendOptions): Promise<void>;
+    /**
+     * Send a single email.
+     *
+     * Resolves with what the provider reported (see {@link EmailSendResult});
+     * throws on failure. It returned `void` before 0.17: an application that
+     * sent a message had no way to learn the id the server assigned it, so
+     * threading a reply back to the message that prompted it was impossible
+     * through this interface. Callers that do not care may still ignore it.
+     */
+    send(options: EmailSendOptions): Promise<EmailSendResult>;
     /** Returns `true` when the service has valid credentials / is ready to send. */
     isConfigured(): boolean;
     /** Verify connection/credentials with the email provider. */

package/src/controllers/index.ts

@@ -2,7 +2,6 @@ export * from "./collection_registry";
 export * from "./auth_state";
 
 export * from "./data";
-export * from "./database_admin";
 export * from "./data_driver";
 
 export * from "./effective_role";

package/src/controllers/storage.ts

@@ -68,11 +68,11 @@ export interface UploadFileResult {
     /**
      * Fully qualified storage URL for the uploaded file.
      *
-     * For example: `s3://my-bucket/path/to/file.png`.
-     *
-     * This is optional for backwards compatibility.
+     * For example: `s3://my-bucket/path/to/file.png`. Every controller in the
+     * framework returns one — S3, GCS and local alike — and a caller that stores
+     * the reference needs it, so it is part of the result rather than a maybe.
      */
-    storageUrl?: string;
+    storageUrl: string;
 }
 
 /**

package/src/types/admin_block.ts

@@ -71,8 +71,7 @@ export const ADMIN_COLLECTION_KEYS = [
     "selectionController",
     "selectionEnabled",
     "sideDialogWidth",
-    "sort",
-    "titleProperty"
+    "sort"
 ] as const;
 
 /** A key of a collection's `admin` block. @group Models */

package/src/types/auth_adapter.ts

@@ -83,8 +83,16 @@ export interface AuthAdapterCapabilities {
 
     /** Supports email/password login. */
     emailPasswordLogin: boolean;
-    /** Supports new user registration. */
-    registration: boolean;
+    /**
+     * Whether self-registration is open **right now**.
+     *
+     * A runtime answer, not a static feature list: the built-in adapter also
+     * reports `true` during the first-user bootstrap window (an empty user
+     * table) and `false` the moment `disableSelfRegistration` is set. Whatever
+     * this says, `POST /auth/register` does — both read the same predicate, so
+     * the UI can never be sent to a form that can only 403.
+     */
+    registrationEnabled: boolean;
     /**
      * Supports the end-user password reset flow (emailing a reset link).
      *
@@ -113,12 +121,15 @@ export interface AuthAdapterCapabilities {
     /** Supports passwordless magic link login. */
     magicLink: boolean;
     /**
-     * Whether `POST /auth/anonymous` will mint a credential-less session.
+     * Supports passwordless sign-in with a six-digit code sent by email.
      *
-     * Optional so an external adapter that predates the key keeps typechecking;
-     * absent means "this adapter does not offer anonymous sign-in".
+     * Optional so that an external adapter written before this existed still
+     * satisfies the interface; absent reads as "no", which is what an adapter
+     * that has never heard of the flow means.
      */
-    anonymousLogin?: boolean;
+    emailOtp?: boolean;
+    /** Whether `POST /auth/anonymous` will mint a credential-less session. */
+    anonymousLogin: boolean;
     /** List of enabled OAuth provider IDs (e.g. `["google", "github"]`). */
     enabledProviders: string[];
 
@@ -134,9 +145,6 @@ export interface AuthAdapterCapabilities {
      * Only applicable for built-in auth.
      */
     needsSetup?: boolean;
-
-    /** Whether new user registration is enabled (may differ from `registration` capability at runtime). */
-    registrationEnabled?: boolean;
 }
 
 // ─── User Management ────────────────────────────────────────────────────────
@@ -311,7 +319,7 @@ export interface TransformAuthResponseContext {
     /** The authenticated user's ID. */
     uid: string;
     /** The auth method that triggered this response. */
-    method: "login" | "register" | "oauth" | "refresh" | "anonymous" | "magic-link" | "mfa";
+    method: "login" | "register" | "oauth" | "refresh" | "anonymous" | "magic-link" | "otp" | "mfa";
     /** The raw HTTP request (for reading headers, IP, etc.). */
     request: Request;
 }

package/src/types/backend.ts

@@ -4,6 +4,7 @@ import type { LogicalCondition } from "../controllers/data";
 import type { AuthAdapter } from "./auth_adapter";
 import type { HistoryConfig } from "../controllers/client";
 import type { ChannelBusSetting } from "./channel_bus";
+import type { SchemaEditingAdmin } from "./schema_editing";
 
 // =============================================================================
 // DATABASE CONNECTION INTERFACES
@@ -564,7 +565,23 @@ export interface BranchAdmin {
  *
  * @group Admin
  */
-export type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin> & Partial<BranchAdmin>;
+export type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin>
+    & Partial<BranchAdmin> & Partial<SchemaEditingAdmin>;
+
+/**
+ * Type guard: can this admin plan a live schema change?
+ *
+ * Planning is engine-specific — it renders DDL, a Drizzle schema and the
+ * declarative SQL artifacts — so the implementation lives in the driver
+ * package. The server detects the capability structurally, exactly as it does
+ * for SQL, rather than importing an engine it is supposed to know nothing
+ * about.
+ *
+ * @group Admin
+ */
+export function isSchemaEditingAdmin(admin: DatabaseAdmin | undefined): admin is SchemaEditingAdmin {
+    return !!admin && typeof (admin as SchemaEditingAdmin).planSchemaChange === "function";
+}
 
 /**
  * Type guard: does this admin support SQL operations?