@rebasepro/types 0.22.0 → 0.23.0

package/dist/types/auth_adapter.d.ts

@@ -490,6 +490,40 @@ export interface AuthAdapter {
         id: string;
         values: Record<string, unknown>;
     }, clearPassword?: string): Promise<UserCreationFinalizeResult>;
+    /**
+     * Check, and put in stored form, updates to rows of the auth collection
+     * that arrive through the data API — `PATCH /<users>/:id`, `PATCH /bulk`,
+     * `_batch`, the realtime socket.
+     *
+     * Those rows are the users, so an update to one is user administration,
+     * and has to hold to what the admin user routes hold to: no update that
+     * leaves the project without an administrator, and an email stored the
+     * way sign-in looks it up. Throws to refuse; the updates are judged
+     * together, so a bulk demotion of every admin is refused even though each
+     * row alone would pass.
+     *
+     * If not implemented, the values are written as they arrived.
+     *
+     * @returns Each update's values, as they should be written, in order.
+     */
+    prepareUserUpdates?(updates: ReadonlyArray<{
+        uid: string;
+        values: Record<string, unknown>;
+    }>): Promise<Record<string, unknown>[]>;
+    /**
+     * Check a deletion of these users through the data API before any row goes,
+     * and run the hooks that may veto it (`beforeUserDelete`). Throws to
+     * refuse — for one that would leave the project without an administrator,
+     * among others.
+     *
+     * If not implemented, the rows are deleted as any other.
+     */
+    prepareUserDeletions?(uids: readonly string[]): Promise<void>;
+    /**
+     * After those users' rows are deleted through the data API: end their
+     * sessions and run the after-delete hooks (`afterUserDelete`).
+     */
+    finalizeUserDeletions?(uids: readonly string[]): Promise<void>;
     /**
      * A static secret key for server-to-server / script authentication.
      *

package/dist/types/backend.d.ts

@@ -350,11 +350,18 @@ export interface DataTransformer {
 export interface SQLAdmin {
     /**
      * Execute raw SQL against the database.
+     *
+     * `isolateSession` runs it on a connection of its own and resets that
+     * connection's session state — role, session authorization, settings —
+     * before it is reused. For SQL a person wrote (the Studio editor), which
+     * may `SET ROLE` and must not leave that on a pooled connection the
+     * server's own queries use next.
      */
     executeSql(sql: string, options?: {
         database?: string;
         role?: string;
         params?: unknown[];
+        isolateSession?: boolean;
     }): Promise<Record<string, unknown>[]>;
     /**
      * Fetch the available databases on the server.
@@ -579,6 +586,47 @@ export interface BackendInstance extends BackendLifecycle {
  * Factory function type for creating backend instances
  */
 export type BackendFactory<TConfig extends BackendConfig = BackendConfig> = (config: TConfig) => BackendInstance;
+/**
+ * A caller of the data API as its rate limiter buckets one outside an HTTP
+ * request: a realtime socket's frame, counted in the same bucket the same
+ * person's HTTP requests are.
+ * @group Backend
+ */
+export interface DataRateLimitCaller {
+    /**
+     * The signed-in user's uid. Absent, or the anonymous principal, buckets
+     * the caller by address at the anonymous allowance.
+     */
+    uid?: string;
+    /**
+     * A header of the request that opened the connection, by lower-case name:
+     * the proxy headers an address is read from when proxies are declared.
+     */
+    header(name: string): string | undefined;
+    /** The address the connection comes from. */
+    socketAddress?: string;
+}
+/**
+ * The data API's request limits, handed to the realtime socket so its frames
+ * carry the ones an HTTP request to the same rows does.
+ * @group Backend
+ */
+export interface RealtimeSocketLimits {
+    /**
+     * The largest frame accepted, in bytes — the data API's body limit. `0` or
+     * less for none. Defaults to the server's default body limit.
+     */
+    maxPayload?: number;
+    /**
+     * Count one data request from `caller` in the data API's per-caller
+     * buckets and say whether it is allowed; `null` for a caller who is not
+     * limited. Absent when the deployment has rate limiting off.
+     */
+    dataRateLimit?: (caller: DataRateLimitCaller) => Promise<{
+        allowed: boolean;
+        retryAfterMs: number;
+    } | null>;
+}
 /**
  * A `BackendBootstrapper` encapsulates all driver-specific initialization logic.
  *
@@ -784,7 +832,7 @@ export interface BackendBootstrapper {
     /**
      * Initialize WebSocket server for realtime operations.
      */
-    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import("../controllers/data_driver.js").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;
+    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import("../controllers/data_driver.js").DataDriver, config?: unknown, authAdapter?: AuthAdapter, limits?: RealtimeSocketLimits): Promise<void> | void;
 }
 /**
  * Result of `BackendBootstrapper.initializeDriver()`.

package/dist/types/cron.d.ts

@@ -43,7 +43,9 @@ export interface CronJobDefinition {
     enabled?: boolean;
     /**
      * Maximum number of seconds the handler may run before being
-     * considered timed-out. Default: 300 (5 min).
+     * considered timed-out. Default: 300 (5 min). `Infinity` means no
+     * timeout. Zero, a negative number or `NaN` is refused when the job
+     * loads, and the job is listed as rejected.
      */
     timeoutSeconds?: number;
     /**
@@ -95,7 +97,8 @@ export interface CronJobContext {
     /** A simple logger scoped to this job run. */
     log: (...args: unknown[]) => void;
     /**
-     * Aborted when the run exceeds `timeoutSeconds`.
+     * Aborted when the run exceeds `timeoutSeconds`, or when the server
+     * shuts down and the run has not finished within the shutdown's wait.
      *
      * The timeout has always stopped the scheduler *waiting* — it loses the
      * race and the run is recorded as failed. It has never stopped the handler:

package/dist/types/database_adapter.d.ts

@@ -21,7 +21,7 @@
  */
 import type { DataDriver } from "../controllers/data_driver.js";
 import type { CollectionConfig } from "./collections.js";
-import type { CollectionRegistryInterface, DatabaseAdmin, InitializedDriver, RealtimeProvider, BootstrappedAuth } from "./backend.js";
+import type { CollectionRegistryInterface, DatabaseAdmin, InitializedDriver, RealtimeProvider, RealtimeSocketLimits, BootstrappedAuth } from "./backend.js";
 import type { HistoryConfig } from "../controllers/client.js";
 /**
  * A `DatabaseAdapter` provides data persistence for Rebase.
@@ -73,8 +73,12 @@ export interface DatabaseAdapter {
      * already passed it, so it was dropped at every adapter that routed through
      * here — turning an adapter-authenticated server's socket into one that
      * accepted every client as already authenticated.
+     *
+     * `limits` are the data API's body and per-caller rate limits, for the
+     * socket's frames: it serves the same rows, and without them a frame had
+     * neither. Forwarded for the same reason `adapter` is.
      */
-    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: DataDriver, config?: unknown, adapter?: import("./auth_adapter.js").AuthAdapter): Promise<void> | void;
+    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: DataDriver, config?: unknown, adapter?: import("./auth_adapter.js").AuthAdapter, limits?: RealtimeSocketLimits): Promise<void> | void;
     /**
      * Ask the database whether it is there, before boot's first real query. See
      * `BackendBootstrapper.verifyConnection` for the contract.

package/dist/types/postgres_introspection.d.ts

@@ -56,8 +56,18 @@ export interface TableJunctionInfo {
  */
 export interface TablePolicyInfo {
     policy_name: string;
+    /**
+     * The policy's `TO` list — *database* roles, `public` for every
+     * connection — as `pg_policies.roles` reports it.
+     */
     roles: string[];
+    /** `SELECT`, `INSERT`, `UPDATE`, `DELETE` or `ALL`, as `pg_policies.cmd` reports it. */
     cmd: string;
+    /**
+     * `pg_policies.permissive`. Absent means `PERMISSIVE`, Postgres's own
+     * default.
+     */
+    permissive?: "PERMISSIVE" | "RESTRICTIVE";
     qual?: string;
     with_check?: string;
 }

package/dist/types/schema_editing.d.ts

@@ -24,7 +24,7 @@
  *   changing a type, moving a primary key.
  */
 export type SchemaChangeVerdict = "safe" | "diverges" | "needs-migration";
-export type SchemaChangeKind = "add-collection" | "remove-collection" | "add-property" | "remove-property" | "change-property-type" | "rename-column" | "add-enum-value" | "remove-enum-value" | "change-required" | "change-primary-key";
+export type SchemaChangeKind = "add-collection" | "remove-collection" | "add-property" | "remove-property" | "change-property-type" | "rename-column" | "add-enum-value" | "remove-enum-value" | "change-required" | "change-primary-key" | "rename-table";
 export interface SchemaChange {
     kind: SchemaChangeKind;
     verdict: SchemaChangeVerdict;
@@ -106,7 +106,7 @@ export interface SchemaChangePlan {
 export interface WithheldSchemaConstraint {
     /** `schema.table.column`. */
     target: string;
-    kind: "not-null";
+    kind: "not-null" | "unique";
     /** What is in the way, naming the obstacle rather than the rule. */
     reason: string;
     /** What would make it applicable. */

package/dist/types/security_rules.d.ts

@@ -53,7 +53,7 @@ export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all
  *
  * @group Models
  */
-export type SecurityRule = OwnerSecurityRule | PublicSecurityRule | StructuredSecurityRule | RawSQLSecurityRule | RolesOnlySecurityRule;
+export type SecurityRule = OwnerSecurityRule | PublicSecurityRule | StructuredSecurityRule | RawSQLSecurityRule | RawSQLCheckOnlySecurityRule | RolesOnlySecurityRule;
 /**
  * Shared fields for all SecurityRule variants.
  * @group Models
@@ -297,6 +297,33 @@ export interface RawSQLSecurityRule extends SecurityRuleBase {
     condition?: never;
     check?: never;
 }
+/**
+ * Security rule with a raw SQL `WITH CHECK` clause and no `USING` clause — the
+ * shape of every INSERT policy, which checks the row being written and has no
+ * existing row to filter.
+ *
+ * On an operation that takes a `USING` clause, the missing one grants no rows,
+ * as a Postgres policy without one does.
+ *
+ * @example
+ * // Anyone may insert a row they own
+ * { operation: "insert", withCheck: "{owner_id} = rebase.uid()" }
+ *
+ * @group Models
+ */
+export interface RawSQLCheckOnlySecurityRule extends SecurityRuleBase {
+    /**
+     * Raw SQL expression for the `WITH CHECK` clause.
+     * This controls which *new/updated* row values are allowed.
+     * Applied to INSERT and UPDATE.
+     */
+    withCheck: string;
+    using?: never;
+    ownerField?: never;
+    access?: never;
+    condition?: never;
+    check?: never;
+}
 /**
  * Security rule that only filters by application roles, without any
  * row-level condition (USING/WITH CHECK).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/types",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Rebase type definitions — shared interfaces and controller types",
   "keywords": [
     "rebase",
@@ -46,7 +46,7 @@
     "@types/node": "^26.1.2",
     "@types/object-hash": "^3.0.6",
     "@types/react-measure": "^2.0.12",
-    "hono": "^4.13.0",
+    "hono": "^4.13.5",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12",
     "typescript": "^6.0.3",