@rebasepro/types 0.8.0 → 0.9.1-canary.09aaf62

package/src/types/index.ts

@@ -26,6 +26,7 @@ export * from "./entity_views";
 export * from "./data_source";
 export * from "./storage_source";
 export * from "./cron";
+export * from "./backup";
 export * from "./component_ref";
 export * from "./auth_adapter";
 export * from "./database_adapter";

package/src/types/modify_collections.tsx

@@ -1,6 +1,6 @@
-import { EntityCollection } from "./collections";
+import { CollectionConfig } from "./collections";
 
 export type ModifyCollectionProps = {
-    collection: EntityCollection,
+    collection: CollectionConfig,
     parentPaths: string[],
 };

package/src/types/plugins.tsx

@@ -1,6 +1,6 @@
 import React, { PropsWithChildren } from "react";
 
-import type { EntityCollection, CollectionActionsProps, EntityTableController, SelectionController } from "./collections";
+import type { CollectionConfig, CollectionActionsProps, EntityTableController, SelectionController } from "./collections";
 import type { EntityStatus } from "./entities";
 import type { InferPropertyType, Property } from "./properties";
 import type { FormContext } from "./entity_views";
@@ -181,19 +181,19 @@ export interface PluginHooks {
     /**
      * Modify a single collection before it is rendered (synchronous).
      */
-    modifyCollection?: (collection: EntityCollection) => EntityCollection;
+    modifyCollection?: (collection: CollectionConfig) => CollectionConfig;
 
     /**
      * Async version of modifyCollection — supports fetching remote config.
      * Runs during navigation resolution. If provided alongside `modifyCollection`,
      * the sync version runs first, then the async version.
      */
-    modifyCollectionAsync?: (collection: EntityCollection) => Promise<EntityCollection>;
+    modifyCollectionAsync?: (collection: CollectionConfig) => Promise<CollectionConfig>;
 
     /**
      * Modify, add or remove collections.
      */
-    injectCollections?: (collections: EntityCollection[]) => EntityCollection[];
+    injectCollections?: (collections: CollectionConfig[]) => CollectionConfig[];
 
     /**
      * Callback called when columns are reordered via drag and drop.
@@ -202,7 +202,7 @@ export interface PluginHooks {
         fullPath: string;
         parentCollectionSlugs: string[];
         parentEntityIds: string[];
-        collection: EntityCollection;
+        collection: CollectionConfig;
         newPropertiesOrder: string[];
     }) => void;
 
@@ -213,7 +213,7 @@ export interface PluginHooks {
         fullPath: string;
         parentCollectionSlugs: string[];
         parentEntityIds: string[];
-        collection: EntityCollection;
+        collection: CollectionConfig;
         kanbanColumnProperty: string;
         newColumnsOrder: string[];
     }) => void;
@@ -291,7 +291,7 @@ export interface FieldBuilderConfig {
  * Props passed to home page collection card action components.
  * @group Models
  */
-export interface PluginHomePageActionsProps<EP extends object = object, M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User, EC extends EntityCollection<M> = EntityCollection<M>> {
+export interface PluginHomePageActionsProps<EP extends object = object, M extends Record<string, unknown> = Record<string, unknown>, USER extends User = User, EC extends CollectionConfig<M> = CollectionConfig<M>> {
     slug: string;
     collection: EC;
     context: RebaseContext<USER>;
@@ -301,7 +301,7 @@ export interface PluginHomePageActionsProps<EP extends object = object, M extend
  * Props passed to form action components in entity edit/form views.
  * @group Models
  */
-export interface PluginFormActionProps<USER extends User = User, EC extends EntityCollection = EntityCollection> {
+export interface PluginFormActionProps<USER extends User = User, EC extends CollectionConfig = CollectionConfig> {
     entityId?: string | number;
     path: string;
     parentCollectionSlugs: string[];
@@ -318,7 +318,7 @@ export interface PluginFormActionProps<USER extends User = User, EC extends Enti
  * Parameters passed to the field builder wrap function.
  * @group Models
  */
-export type PluginFieldBuilderParams<M extends Record<string, unknown> = Record<string, unknown>, EC extends EntityCollection<M> = EntityCollection<M>> = {
+export type PluginFieldBuilderParams<M extends Record<string, unknown> = Record<string, unknown>, EC extends CollectionConfig<M> = CollectionConfig<M>> = {
     fieldConfigId: string;
     propertyKey: string;
     property: Property;

package/src/types/policy.ts

@@ -27,8 +27,28 @@ export type PolicyExpression =
     | RolesOverlapPolicyExpression
     | RolesContainPolicyExpression
     | AuthenticatedPolicyExpression
+    | ServerContextPolicyExpression
+    | ExistsInPolicyExpression
     | RawPolicyExpression;
 
+/**
+ * The id a request without a logged-in user reports as `auth.uid()`.
+ *
+ * A user-context request always sets `app.user_id`: blank would read back as
+ * `NULL`, and `NULL` is how the trusted server context is recognised, so an
+ * anonymous visitor would be promoted to server privileges. The driver
+ * therefore substitutes this sentinel at the single chokepoint where the GUC
+ * is set.
+ *
+ * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+ * tautology on the user path** — it is true for anonymous visitors too. Use
+ * {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
+ * in", and {@link policy.serverContext} to mean "the trusted server context".
+ *
+ * @group Models
+ */
+export const ANONYMOUS_USER_ID = "anonymous";
+
 /** Always allows. Compiles to `true`. @group Models */
 export interface TruePolicyExpression {
     kind: "true";
@@ -42,13 +62,13 @@ export interface FalsePolicyExpression {
 /** Logical AND — every operand must pass. @group Models */
 export interface AndPolicyExpression {
     kind: "and";
-    operands: PolicyExpression[];
+    operands: readonly PolicyExpression[];
 }
 
 /** Logical OR — at least one operand must pass. @group Models */
 export interface OrPolicyExpression {
     kind: "or";
-    operands: PolicyExpression[];
+    operands: readonly PolicyExpression[];
 }
 
 /** Logical negation. @group Models */
@@ -78,7 +98,7 @@ export interface ComparePolicyExpression {
  */
 export interface RolesOverlapPolicyExpression {
     kind: "rolesOverlap";
-    roles: string[];
+    roles: readonly string[];
 }
 
 /**
@@ -88,17 +108,85 @@ export interface RolesOverlapPolicyExpression {
  */
 export interface RolesContainPolicyExpression {
     kind: "rolesContain";
-    roles: string[];
+    roles: readonly string[];
 }
 
 /**
- * True when there is an authenticated user (`auth.uid() IS NOT NULL`).
+ * True when a signed-in user is making the request. Compiles to
+ * `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'`.
+ *
+ * Both halves are load-bearing. `IS NOT NULL` excludes the server context;
+ * the {@link ANONYMOUS_USER_ID} comparison excludes anonymous visitors, who
+ * *do* carry a non-null `auth.uid()`. Checking only `IS NOT NULL` grants to
+ * everyone — see {@link ANONYMOUS_USER_ID}.
+ *
+ * `policy.not(policy.authenticated())` therefore means "anonymous visitor or
+ * the server context". To single out the server context, use
+ * {@link ServerContextPolicyExpression}.
  * @group Models
  */
 export interface AuthenticatedPolicyExpression {
     kind: "authenticated";
 }
 
+/**
+ * True only in the trusted **server context** — the built-in flows that run
+ * without a user (signup, migrations, `dataAsAdmin`) set no user GUC, so
+ * `auth.uid()` is `NULL` for them and only for them. Compiles to
+ * `auth.uid() IS NULL`.
+ *
+ * This is what lets the owner connection satisfy a policy even under FORCE RLS.
+ * It is deliberately a primitive rather than `not(authenticated())`: the two
+ * meant the same thing while `authenticated` ignored {@link ANONYMOUS_USER_ID},
+ * and conflating them is what turns a server-only grant into an anonymous one.
+ *
+ * The JavaScript evaluator always returns `false` for this node — a client is
+ * never the server context.
+ * @group Models
+ */
+export interface ServerContextPolicyExpression {
+    kind: "serverContext";
+}
+
+/**
+ * Membership / relational access: true when at least one row exists in another
+ * collection (a join/membership table) matching `where`. This is what lets you
+ * scope reads to "rows whose team the caller belongs to" without an N+1
+ * per-row lookup — it compiles to a single correlated `EXISTS` subquery.
+ *
+ * Inside `where`, {@link FieldPolicyOperand} (`policy.field`) references a column
+ * of the joined collection, while {@link OuterFieldPolicyOperand}
+ * (`policy.outerField`) references a column of the row being checked (the outer
+ * table under RLS). Combine with {@link AuthUidPolicyOperand} to correlate to
+ * the caller.
+ *
+ * @example
+ * ```ts
+ * // documents visible only to members of the document's team:
+ * policy.existsIn({
+ *   collection: "team_members",
+ *   where: policy.and(
+ *     policy.compare(policy.field("team_id"), "eq", policy.outerField("team_id")),
+ *     policy.compare(policy.field("user_id"), "eq", policy.authUid()),
+ *   ),
+ * })
+ * // → EXISTS (SELECT 1 FROM team_members _ex0
+ * //           WHERE _ex0.team_id = documents.team_id AND _ex0.user_id = auth.uid())
+ * ```
+ *
+ * Postgres-authoritative: like {@link RawPolicyExpression}, the JavaScript
+ * evaluator treats it as *unknown* (it cannot run a subquery client-side), so
+ * enforcement is always the database's.
+ * @group Models
+ */
+export interface ExistsInPolicyExpression {
+    kind: "existsIn";
+    /** Slug of the collection to search (the join / membership table). */
+    collection: string;
+    /** Condition evaluated against the joined collection's rows. */
+    where: PolicyExpression;
+}
+
 /**
  * A raw PostgreSQL boolean expression — the full-power escape hatch.
  *
@@ -118,6 +206,7 @@ export interface RawPolicyExpression {
  */
 export type PolicyOperand =
     | FieldPolicyOperand
+    | OuterFieldPolicyOperand
     | LiteralPolicyOperand
     | AuthUidPolicyOperand
     | AuthRolesPolicyOperand;
@@ -129,6 +218,18 @@ export interface FieldPolicyOperand {
     name: string;
 }
 
+/**
+ * A column value on the *outer* row when used inside {@link ExistsInPolicyExpression}
+ * — i.e. the row the RLS policy is being evaluated for, referenced from within the
+ * subquery. Outside an `existsIn` it is equivalent to {@link FieldPolicyOperand}.
+ * @group Models
+ */
+export interface OuterFieldPolicyOperand {
+    kind: "outerField";
+    /** The property/column name on the outer collection. */
+    name: string;
+}
+
 /** A constant value. @group Models */
 export interface LiteralPolicyOperand {
     kind: "literal";
@@ -157,16 +258,20 @@ export interface AuthRolesPolicyOperand {
 export const policy = {
     true: (): TruePolicyExpression => ({ kind: "true" }),
     false: (): FalsePolicyExpression => ({ kind: "false" }),
-    and: (...operands: PolicyExpression[]): AndPolicyExpression => ({ kind: "and", operands }),
-    or: (...operands: PolicyExpression[]): OrPolicyExpression => ({ kind: "or", operands }),
+    and: (...operands: readonly PolicyExpression[]): AndPolicyExpression => ({ kind: "and", operands: operands as PolicyExpression[] }),
+    or: (...operands: readonly PolicyExpression[]): OrPolicyExpression => ({ kind: "or", operands: operands as PolicyExpression[] }),
     not: (operand: PolicyExpression): NotPolicyExpression => ({ kind: "not", operand }),
     compare: (left: PolicyOperand, op: PolicyCompareOperator, right: PolicyOperand): ComparePolicyExpression =>
         ({ kind: "compare", op, left, right }),
-    rolesOverlap: (roles: string[]): RolesOverlapPolicyExpression => ({ kind: "rolesOverlap", roles }),
-    rolesContain: (roles: string[]): RolesContainPolicyExpression => ({ kind: "rolesContain", roles }),
+    rolesOverlap: (roles: readonly string[]): RolesOverlapPolicyExpression => ({ kind: "rolesOverlap", roles: roles as string[] }),
+    rolesContain: (roles: readonly string[]): RolesContainPolicyExpression => ({ kind: "rolesContain", roles: roles as string[] }),
     authenticated: (): AuthenticatedPolicyExpression => ({ kind: "authenticated" }),
+    serverContext: (): ServerContextPolicyExpression => ({ kind: "serverContext" }),
+    existsIn: (args: { collection: string; where: PolicyExpression }): ExistsInPolicyExpression =>
+        ({ kind: "existsIn", collection: args.collection, where: args.where }),
     raw: (sql: string): RawPolicyExpression => ({ kind: "raw", sql }),
     field: (name: string): FieldPolicyOperand => ({ kind: "field", name }),
+    outerField: (name: string): OuterFieldPolicyOperand => ({ kind: "outerField", name }),
     literal: (value: string | number | boolean | null): LiteralPolicyOperand => ({ kind: "literal", value }),
     authUid: (): AuthUidPolicyOperand => ({ kind: "authUid" }),
     authRoles: (): AuthRolesPolicyOperand => ({ kind: "authRoles" })

package/src/types/properties.ts

@@ -2,10 +2,10 @@ import type { ComponentRef } from "./component_ref";
 
 import type { Entity, EntityReference, EntityRelation, EntityValues, GeoPoint, Vector } from "./entities";
 import type { JoinStep, OnAction, Relation } from "./relations";
-import type { EntityCollection, FilterValues } from "./collections";
+import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections";
 import type { ColorKey, ColorScheme } from "./chips";
 import type { AuthController } from "../controllers/auth";
-import type { EntityAfterReadProps, EntityBeforeSaveProps } from "./entity_callbacks";
+import type { AfterReadProps, BeforeSaveProps } from "./entity_callbacks";
 import type { User } from "../users";
 
 /**
@@ -16,7 +16,7 @@ export type PropertyCallbacks<T = unknown, M extends Record<string, unknown> = R
     /**
      * Callback used after fetching data, to transform the value before rendering
      */
-    afterRead?(props: Omit<EntityAfterReadProps<M, USER>, "entity"> & {
+    afterRead?(props: Omit<AfterReadProps<M, USER>, "entity"> & {
         value: T;
         entity: Entity<M> | undefined;
     }): Promise<T> | T;
@@ -25,7 +25,7 @@ export type PropertyCallbacks<T = unknown, M extends Record<string, unknown> = R
      * Callback used before saving, after validation.
      * You can modify the value before it's saved.
      */
-    beforeSave?(props: Omit<EntityBeforeSaveProps<M, USER>, "values"> & {
+    beforeSave?(props: Omit<BeforeSaveProps<M, USER>, "values"> & {
         value: T;
         previousValue: T | undefined;
         values: Partial<M>;
@@ -164,6 +164,33 @@ export interface BaseUIConfig<CustomProps = unknown> {
     customProps?: CustomProps;
     Field?: ComponentRef<any>;
     Preview?: ComponentRef<any>;
+
+    /**
+     * Narrow the filter operators offered for this property in collection
+     * filter UIs (table header filters and the Filters dialog).
+     *
+     * The final offered set is the **intersection** of the engine's
+     * capabilities, the property-type defaults, and this list — you can only
+     * *restrict*, never enable an operator the underlying engine cannot run.
+     *
+     * Pass an empty array to disable filtering on this property entirely.
+     *
+     * @example
+     * // Email column: exact match, contains, and null check only
+     * ui: { filterOperators: ["==", "ilike", "is-null"] }
+     */
+    filterOperators?: readonly WhereFilterOp[];
+
+    /**
+     * Replace the filter field rendered for this property in collection
+     * filter UIs. The component receives `FilterFieldBindingProps`
+     * (property, resolved `operators`, `value`, `setValue`, …).
+     *
+     * Takes precedence over the collection-level
+     * `components["Collection.FilterField"]` override and the built-in
+     * per-type filter fields.
+     */
+    Filter?: ComponentRef<any>;
 }
 
 export interface BaseProperty<CustomProps = unknown> {
@@ -204,6 +231,20 @@ export interface BaseProperty<CustomProps = unknown> {
      */
     validation?: PropertyValidationSchema;
 
+    /**
+     * Never include this column in an API response.
+     *
+     * For secrets the server must store and read but no client should ever
+     * receive — password hashes, verification tokens. The value is still
+     * written and queryable server-side; it is stripped from every row the API
+     * serves, for every caller, including admins and service keys.
+     *
+     * This is a server-side guarantee, unlike `ui.hideFromCollection`, which
+     * only stops the admin panel from *rendering* a field and leaves it in the
+     * JSON payload.
+     */
+    excludeFromApi?: boolean;
+
     // NOTE: `defaultValue` is intentionally NOT on BaseProperty.
     // Each concrete property type (StringProperty, NumberProperty, etc.)
     // defines its own typed `defaultValue` for compile-time safety.
@@ -492,7 +533,7 @@ export interface ReferenceUIConfig extends BaseUIConfig {
 }
 
 /**
- * A pointer to an entity, stored **as a value** on the row (id + path, and
+ * A pointer to a entity, stored **as a value** on the row (id + path, and
  * optionally a `driver`/`databaseId` for cross-datasource pointers).
  *
  * This is the native primitive of **document databases** — it maps 1:1 to a
@@ -511,7 +552,7 @@ export interface ReferenceProperty extends BaseProperty {
     ui?: ReferenceUIConfig;
     type: "reference";
     /**
-     * Default value for new entities. Must be an EntityReference.
+     * Default value for new entities. Must be a EntityReference.
      */
     defaultValue?: EntityReference;
     /**
@@ -575,7 +616,7 @@ export interface RelationProperty extends BaseProperty {
     ui?: RelationUIConfig;
     type: "relation";
     /**
-     * Default value for new entities. Must be an EntityRelation or array of EntityRelation.
+     * Default value for new entities. Must be a EntityRelation or array of EntityRelation.
      */
     defaultValue?: EntityRelation | EntityRelation[];
     /**
@@ -596,7 +637,7 @@ export interface RelationProperty extends BaseProperty {
      * When set, the framework treats this property as a self-contained relation
      * definition and no separate `relations[]` entry is needed.
      */
-    target?: string | (() => EntityCollection | string);
+    target?: string | (() => CollectionConfig | string);
 
     /**
      * Whether this property references one or many records.
@@ -664,7 +705,7 @@ export interface RelationProperty extends BaseProperty {
     /**
      * Overrides applied to the target collection when rendered as a subcollection tab.
      */
-    overrides?: Partial<EntityCollection>;
+    overrides?: Partial<CollectionConfig>;
 
     // ─── Framework-managed fields ───
 
@@ -1006,6 +1047,14 @@ export type StorageConfig = {
      */
     storageSource?: string;
 
+    /**
+     * Store files for this property as **public**: they are placed under the
+     * public prefix and served via stable, token-less, permanent, CDN-cacheable
+     * URLs (safe to persist and hotlink). Use for public assets like avatars or
+     * storefront images. Defaults to `false` (private, short-lived signed URLs).
+     */
+    public?: boolean;
+
     /**
      * File MIME types that can be uploaded to this reference. Don't specify for
      * all.

package/src/types/relations.ts

@@ -1,4 +1,4 @@
-import type { EntityCollection } from "./collections";
+import type { CollectionConfig } from "./collections";
 
 /**
  * @group Models
@@ -20,7 +20,7 @@ export interface Relation {
     /**
      * The final collection you want to retrieve records from.
      */
-    target: (() => EntityCollection) | any;
+    target: (() => CollectionConfig) | any;
 
     /**
      * The nature of the relationship, determining if one or many records are returned.
@@ -282,7 +282,7 @@ export interface Relation {
      */
     onDelete?: OnAction;
 
-    overrides?: Partial<EntityCollection>;
+    overrides?: Partial<CollectionConfig>;
 
     validation?: {
         required?: boolean;

package/src/types/slots.tsx

@@ -1,5 +1,5 @@
 import React from "react";
-import type { CollectionActionsProps, EntityTableController, SelectionController, EntityCollection } from "./collections";
+import type { CollectionActionsProps, EntityTableController, SelectionController, CollectionConfig } from "./collections";
 import type { Entity } from "./entities";
 import type { PluginFormActionProps, PluginGenericProps, PluginHomePageActionsProps, PluginHomePageAdditionalCardsProps } from "./plugins";
 import type { Property } from "./properties";
@@ -128,7 +128,7 @@ export interface NavigationSlotProps {
  */
 export interface CollectionToolbarProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     tableController: EntityTableController;
@@ -141,7 +141,7 @@ export interface CollectionToolbarProps {
  */
 export interface CollectionEmptyStateProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     canCreate: boolean;
@@ -159,7 +159,7 @@ export interface CollectionHeaderActionProps {
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     onHover: boolean;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     tableController: EntityTableController;
 }
 
@@ -171,7 +171,7 @@ export interface CollectionAddColumnProps {
     path: string;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
-    collection: EntityCollection;
+    collection: CollectionConfig;
     tableController: EntityTableController;
 }
 
@@ -181,7 +181,7 @@ export interface CollectionAddColumnProps {
  */
 export interface CollectionErrorProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs?: string[];
     parentEntityIds?: string[];
     error: Error;
@@ -192,7 +192,7 @@ export interface CollectionErrorProps {
  * @group Plugins
  */
 export interface KanbanSetupProps {
-    collection: EntityCollection;
+    collection: CollectionConfig;
     fullPath: string;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
@@ -203,7 +203,7 @@ export interface KanbanSetupProps {
  * @group Plugins
  */
 export interface KanbanAddColumnProps {
-    collection: EntityCollection;
+    collection: CollectionConfig;
     fullPath: string;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
@@ -214,14 +214,14 @@ export interface KanbanAddColumnProps {
 
 /**
  * Props for `entity.row.actions` slot.
- * Rendered for each row in an entity collection table.
+ * Rendered for each row in a entity collection table.
  * @group Plugins
  */
 export interface EntityRowActionsProps {
     entity: Entity;
     entityId: string;
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     selectionController: SelectionController;
@@ -238,7 +238,7 @@ export interface EntityFieldSlotProps {
     property: Property;
     path: string;
     entityId?: string | number;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     context: RebaseContext;
 }
 
@@ -249,7 +249,7 @@ export interface EntityFieldSlotProps {
  */
 export interface CollectionFilterPanelProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
     tableController: EntityTableController;
@@ -290,7 +290,7 @@ export interface ShellToolbarProps {
  */
 export interface CollectionInsightsSlotProps {
     path: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     parentCollectionSlugs: string[];
     parentEntityIds: string[];
 }
@@ -302,6 +302,6 @@ export interface CollectionInsightsSlotProps {
  */
 export interface HomeCardInsightSlotProps {
     slug: string;
-    collection: EntityCollection;
+    collection: CollectionConfig;
     context: RebaseContext;
 }

package/src/types/translations.ts

@@ -7,7 +7,7 @@ export type DeepPartial<T> = T extends object
     : T;
 
 /**
- * All user-visible strings used internally by @rebasepro/core.
+ * All user-visible strings used internally by @rebasepro/app.
  * Pass a `DeepPartial<RebaseTranslations>` via the `translations` prop
  * on your Rebase entry-point component to override any key, or to add
  * a new locale.
@@ -549,6 +549,7 @@ export interface RebaseTranslations {
     invitation_sent_title?: string;
     temporary_password?: string;
     temporary_password_description?: string;
+    temporary_password_email_failed_description?: string;
     copy_password?: string;
     password_copied?: string;
 
@@ -560,6 +561,9 @@ export interface RebaseTranslations {
     reset_password?: string;
     reset_password_success?: string;
     reset_password_confirmation?: string;
+    reset_password_send_email?: string;
+    reset_password_set_manually?: string;
+    reset_password_set_manually_description?: string;
     error_resetting_password?: string;
 
     /** Permission-denied empty states */

package/src/types/user_management_delegate.ts

@@ -10,8 +10,14 @@ export interface UserCreationResult<USER extends User = User> {
     /** Whether an invitation email was sent to the user */
     invitationSent: boolean;
     /**
-     * Temporary password (only present when email service is not configured).
-     * This is returned one-time and should be shown to the admin to share manually.
+     * Temporary password, present when no invitation email could be delivered —
+     * either because no email service is configured, or because delivery failed
+     * (see `emailDeliveryFailed`). Returned one-time, to be shared manually.
      */
     temporaryPassword?: string;
+    /**
+     * Whether an email service was configured but delivery failed, causing the
+     * fallback to `temporaryPassword`. Absent when no email service is configured.
+     */
+    emailDeliveryFailed?: boolean;
 }