@rebasepro/types 0.21.0 → 0.21.1

package/dist/types/auth_adapter.d.ts

@@ -247,7 +247,11 @@ export interface UserCreationPrepareResult {
     values: Record<string, unknown>;
     /** Cleartext password for post-save processing (email or admin display). */
     clearPassword?: string;
-    /** Whether the hook already handled the invitation (email, etc.). */
+    /**
+     * Whether the hook already handled the invitation (email, etc.). When
+     * `true`, `finalizeUserCreation` is skipped and `clearPassword` is returned
+     * to the admin as the temporary password.
+     */
     hookHandledEmail: boolean;
     /** Whether an invitation was sent (only relevant when hookHandledEmail is true). */
     invitationSent: boolean;
@@ -472,6 +476,12 @@ export interface AuthAdapter {
      * Handles post-save work: sending invitation emails, generating
      * password-reset tokens, or falling back to returning a temporary password.
      *
+     * Not called when `prepareUserCreation` reported `hookHandledEmail`. A
+     * create hook then owns delivery, and the response carries the
+     * `invitationSent` and `clearPassword` the prepare step returned. This
+     * holds for both ways of creating a user: a `POST` to the auth collection
+     * and `POST /admin/users`.
+     *
      * @param entity - The persisted entity (id + values).
      * @param clearPassword - The cleartext password from the prepare step (if any).
      * @returns Metadata for the API response (temporary password, invitation status).

package/dist/types/backend.d.ts

@@ -245,13 +245,20 @@ export interface RealtimeChannelsConfig {
  */
 export interface RealtimeProvider {
     /**
-     * Subscribe to collection changes
+     * Subscribe to collection changes.
+     *
+     * `onError` is called when a fetch behind the subscription fails, a
+     * refetch after a change included, with the error as it was thrown. It is
+     * not called for a fetch that newer rows have already overtaken, or after
+     * the subscription is gone. Without it, a subscriber whose fetch failed
+     * was told nothing and kept waiting for rows.
      */
-    subscribeToCollection(subscriptionId: string, config: CollectionSubscriptionConfig, callback?: (rows: Record<string, unknown>[]) => void): void;
+    subscribeToCollection(subscriptionId: string, config: CollectionSubscriptionConfig, callback?: (rows: Record<string, unknown>[]) => void, onError?: (error: unknown) => void): void;
     /**
-     * Subscribe to single entity changes
+     * Subscribe to single entity changes. `onError` as for
+     * {@link RealtimeProvider.subscribeToCollection}.
      */
-    subscribeToOne(subscriptionId: string, config: SingleSubscriptionConfig, callback?: (row: Record<string, unknown> | null) => void): void;
+    subscribeToOne(subscriptionId: string, config: SingleSubscriptionConfig, callback?: (row: Record<string, unknown> | null) => void, onError?: (error: unknown) => void): void;
     /**
      * Unsubscribe from a subscription
      */

package/dist/types/backup.d.ts

@@ -17,4 +17,11 @@ export interface BackupInfo {
     createdAt?: string;
     /** The kind of destination this backup was read from. */
     destinationKind: BackupDestinationKind;
+    /**
+     * Key of the `.globals.sql` sidecar written beside this dump, when there is
+     * one. It holds the database roles the dump's GRANTs and RLS policies name,
+     * and `rebase db restore` looks for it next to the `.dump` — so a copy of the
+     * backup needs both files. Absent when the dump was taken without it.
+     */
+    globalsKey?: string;
 }

package/dist/types/collections.d.ts

@@ -615,12 +615,16 @@ export interface AuthCollectionConfig {
     /** Set to true to mark this collection as the authentication collection. */
     enabled: boolean;
     /**
-     * Called when an admin creates a user via the collection REST API.
+     * Called when an admin creates a user, through the collection REST API or
+     * `POST /admin/users`.
      *
      * Default: generate password → hash → normalize email → save →
      *          send invitation email (or return temp password if no email configured).
      *
-     * Override to implement custom invitation flows, LDAP sync, etc.
+     * Override to implement custom invitation flows, LDAP sync, etc. The hook
+     * then owns delivery: Rebase sends no invitation of its own, and the
+     * response reports the hook's `invitationSent` and shows its
+     * `temporaryPassword` to the admin.
      */
     onCreateUser?: (values: Record<string, unknown>, ctx: AuthCollectionContext) => Promise<AuthCollectionCreateResult>;
     /**
@@ -628,6 +632,12 @@ export interface AuthCollectionConfig {
      *
      * Default: generate reset token → send email (or generate + return temp password).
      * Override for custom reset flows.
+     *
+     * Return a `temporaryPassword` to set one: Rebase hashes it with the
+     * configured algorithm, saves it as the account's password and shows it to
+     * the admin. The hook does not write it — its context has no way to. Return
+     * none when the hook sends its own link instead. Either way, the account's
+     * existing sessions are signed out.
      */
     onResetPassword?: (uid: string, ctx: AuthCollectionContext) => Promise<AuthCollectionResetResult>;
     /**
@@ -696,7 +706,11 @@ export interface AuthCollectionCreateResult {
  * @group Models
  */
 export interface AuthCollectionResetResult {
-    /** If set, shown to the admin. */
+    /**
+     * The account's new password. Rebase hashes and saves it, then shows it to
+     * the admin; leave it unset when the account keeps its password for now
+     * (for example, because the hook emailed a link).
+     */
     temporaryPassword?: string;
     /** Whether a reset email was sent. */
     invitationSent?: boolean;

package/dist/types/env_boolean.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Read a boolean environment variable — one spelling rule for every reader.
+ *
+ * `true`, `1`, `yes` and `on` are true; `false`, `0`, `no` and `off` are
+ * false. Case and surrounding whitespace are ignored. Anything else — unset,
+ * blank, or a value that spells neither — is `undefined`, so the caller's
+ * default decides and a typo lands on the side the caller chose:
+ *
+ * ```ts
+ * parseEnvBoolean(env.FORCE_LOCAL_STORAGE) === true            // off unless said
+ * parseEnvBoolean(env.REBASE_MCP_OPEN_REGISTRATION) !== false  // on unless said
+ * ```
+ *
+ * It exists because every reader used to spell this itself, and they
+ * disagreed. The reader that mattered tested the raw string for truthiness —
+ * `!process.env.FORCE_LOCAL_STORAGE` — and every non-empty string is truthy,
+ * so `FORCE_LOCAL_STORAGE=false`, written to say "there is no durable volume
+ * here", switched the production storage guard off and sent uploads to a
+ * container filesystem the next redeploy erased. Beside it, `=== "true"` made
+ * `DISABLE_DB_ROLE_SWITCHING=1` do nothing and `!== "false"` made
+ * `REBASE_MCP_OPEN_REGISTRATION=0` leave registration open.
+ *
+ * The boot schemas in `@rebasepro/server` (`loadEnv`, `loadBootEnv`) accept a
+ * strict subset — `true`, `false` and blank — and refuse any other value
+ * before the server starts. On that subset they read exactly what this reads,
+ * so a variable a schema declares and something else reads lazily cannot mean
+ * two different things.
+ *
+ * It lives in this package, with no dependencies, for the reason
+ * {@link storageEnvSuffix} does: the runtime, its drivers and the CLI all read
+ * these variables, and a second parser is a second chance to disagree.
+ *
+ * @group Models
+ */
+export declare function parseEnvBoolean(value: string | undefined): boolean | undefined;

package/dist/types/index.d.ts

@@ -20,6 +20,7 @@ export * from "./data_source.js";
 export * from "./resources.js";
 export * from "./resource_kinds.js";
 export * from "./storage_source.js";
+export * from "./env_boolean.js";
 export * from "./cron.js";
 export * from "./backup.js";
 export * from "./component_ref.js";

package/dist/types/websockets.d.ts

@@ -1,7 +1,12 @@
 export interface WebSocketErrorPayload {
+    /**
+     * `details` is what the REST envelope carries under the same name — for a
+     * collection-callback refusal, `{ stage, path }` naming the hook.
+     */
     error?: string | {
         message: string;
         code?: string;
+        details?: unknown;
     };
     message?: string;
     code?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/types",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Rebase type definitions — shared interfaces and controller types",
   "keywords": [
     "rebase",