@supabase/lite 0.8.0 → 0.8.1-next.2

package/dist/index.d.ts

@@ -1,17 +1,17 @@
 import * as _supabase_supabase_js from '@supabase/supabase-js';
 import { SupabaseClientOptions } from '@supabase/supabase-js';
-import { D as DefaultSchema, S as Schema } from './index-xv_pDjEt.js';
+import { D as DefaultSchema, S as Schema } from './index-DKO3OQpz.js';
 import { Connection, ConnectionMigrator, MaybePromise as MaybePromise$1, SchemaDiffResult, PlanStep, PlanResult, IConnectionConfig, Dialect as Dialect$2, IntrospectResult as IntrospectResult$1, TransactionOptions } from '@supabase/lite';
 import * as hono_hono_base from 'hono/hono-base';
 import * as hono_utils_http_status from 'hono/utils/http-status';
 import * as hono_utils_types from 'hono/utils/types';
 import * as hono_types from 'hono/types';
 import * as hono from 'hono';
-import { MiddlewareHandler, Context } from 'hono';
+import { Context, MiddlewareHandler } from 'hono';
 import { Kysely, KyselyPlugin } from 'kysely';
 import { ReadableStream as ReadableStream$1 } from 'node:stream/web';
-import { a as CacheDriver, b as CacheSetOptions, W as Where, c as IntrospectResult, M as MigrateScope, A as AnyAST, V as VarsContext, T as TransactionOptions$1, C as Connection$1 } from './Connection-D9UUTsjg.js';
-export { d as AST, e as ASTType, f as AggregateFunction, B as BaseAST, g as BodyResult, h as CheckConstraintInfo, i as ColumnDef, j as ColumnDiff, k as ColumnInfo, l as ColumnRef, m as CommentInfo, n as ConnectionContextOptions, o as ConnectionMigrator, p as CustomTypesInfo, D as DataLossError, q as DataLossWarning, r as DeleteAST, s as Dialect, t as DiffResult, E as EmbedDef, u as EmbedTransform, v as ExplainOptions, F as FiltersResult, w as ForeignKeyDiff, x as ForeignKeyInfo, y as FunctionInfo, H as HeadersResult, I as IConnectionConfig, z as IndexDiff, G as IndexInfo, J as InsertAST, K as IntrospectOptions, L as JoinDef, N as JoinMap, O as Meta, P as MigrationError, Q as OrderEntry, R as PlanResult, S as PlanStep, U as PlanStepType, X as PreferToken, Y as PrimaryKeyInfo, Z as Qb, _ as QbDelete, $ as QbInsert, a0 as QbSelect, a1 as QbUpdate, a2 as QueryAST, a3 as QueryParamsResult, a4 as RelationNotFoundError, a5 as RouteResult, a6 as RpcAST, a7 as RpcResult, a8 as SchemaDiffResult, a9 as SelectEntry, aa as SelectResult, ab as TableDiff, ac as TableInfo, ad as TextSearchValue, ae as TransformsResult, af as TranslatorConfig, ag as TriggerInfo, ah as UniqueConstraintInfo, ai as UpdateAST, aj as UpsertAST, ak as UpsertResult, al as ViewInfo, am as ViewOptionsMetadata, an as WhereValue, ao as isRef } from './Connection-D9UUTsjg.js';
+import { a as CacheDriver, b as CacheSetOptions, W as Where, c as IntrospectResult, M as MigrateScope, A as AnyAST, V as VarsContext, T as TransactionOptions$1, C as Connection$1 } from './Connection-ZWTDByQ5.js';
+export { d as AST, e as ASTType, f as AggregateFunction, B as BaseAST, g as BodyResult, h as CheckConstraintInfo, i as ColumnDef, j as ColumnDiff, k as ColumnInfo, l as ColumnRef, m as CommentInfo, n as ConnectionContextOptions, o as ConnectionMigrator, p as CustomTypesInfo, D as DataLossError, q as DataLossWarning, r as DeleteAST, s as Dialect, t as DiffResult, E as EmbedDef, u as EmbedTransform, v as ExplainOptions, F as FiltersResult, w as ForeignKeyDiff, x as ForeignKeyInfo, y as FunctionInfo, H as HeadersResult, I as IConnectionConfig, z as IndexDiff, G as IndexInfo, J as InsertAST, K as IntrospectOptions, L as JoinDef, N as JoinMap, O as Meta, P as MigrationError, Q as OrderEntry, R as PlanResult, S as PlanStep, U as PlanStepType, X as PreferToken, Y as PrimaryKeyInfo, Z as Qb, _ as QbDelete, $ as QbInsert, a0 as QbSelect, a1 as QbUpdate, a2 as QueryAST, a3 as QueryParamsResult, a4 as RelationNotFoundError, a5 as RouteResult, a6 as RpcAST, a7 as RpcResult, a8 as SchemaDiffResult, a9 as SelectEntry, aa as SelectResult, ab as TableDiff, ac as TableInfo, ad as TextSearchValue, ae as TransformsResult, af as TranslatorConfig, ag as TriggerInfo, ah as UniqueConstraintInfo, ai as UpdateAST, aj as UpsertAST, ak as UpsertResult, al as ViewInfo, am as ViewOptionsMetadata, an as WhereValue, ao as isRef } from './Connection-ZWTDByQ5.js';
 import { ParseResult } from 'libpg-query';
 import { DeparserOptions } from 'pgsql-deparser';
 import 'jsonv-ts';
@@ -88,6 +88,26 @@ interface IdentitiesTable {
     created_at: string;
     updated_at: string;
 }
+interface FlowStateTable {
+    id: string;
+    user_id: string | null;
+    auth_code: string | null;
+    authentication_method: string;
+    code_challenge_method: string | null;
+    code_challenge: string | null;
+    provider_type: string;
+    provider_access_token: string | null;
+    provider_refresh_token: string | null;
+    auth_code_issued_at: string | null;
+    invite_token: string | null;
+    referrer: string | null;
+    oauth_client_state_id: string | null;
+    linking_target_id: string | null;
+    email_optional: boolean;
+    created_at: string;
+    updated_at: string;
+}
+type NewFlowState = Pick<FlowStateTable, "id" | "authentication_method" | "provider_type"> & Partial<Pick<FlowStateTable, "user_id" | "auth_code" | "code_challenge_method" | "code_challenge" | "invite_token" | "referrer" | "oauth_client_state_id" | "linking_target_id" | "email_optional">>;
 interface UserResponse {
     id: string;
     aud: string;
@@ -149,14 +169,28 @@ interface AuthConfig {
         otp_length?: number;
         otp_expiry?: number;
         smtp?: {
-            sender_name?: string;
+            enabled?: boolean;
+            host?: string;
+            port?: number;
+            user?: string;
+            pass?: string;
             admin_email?: string;
+            sender_name?: string;
         };
         template?: Partial<Record<EmailTemplateType, EmailTemplateConfig>>;
     };
     enable_confirmations?: boolean;
     site_url?: string;
     additional_redirect_urls?: string[];
+    external?: Record<string, {
+        enabled?: boolean;
+        client_id?: string;
+        secret?: string;
+        url?: string;
+        redirect_uri?: string;
+        skip_nonce_check?: boolean;
+        email_optional?: boolean;
+    }>;
 }
 type EmailTemplateType = "invite" | "confirmation" | "recovery" | "magic_link" | "email_change";
 interface EmailTemplateConfig {
@@ -165,12 +199,28 @@ interface EmailTemplateConfig {
 }
 
 type Dialect$1 = "postgres" | "sqlite";
+/** Bound `Connection#runInTransaction` — see db/Connection.ts for why this
+ * indirection exists (DO storage has no BEGIN/COMMIT over kysely). */
+type TransactionRunner = <T>(fn: (trx: Kysely<any>) => Promise<T>) => Promise<T>;
 declare class AuthRepository {
     private db;
     private dialect;
+    private runInTransaction;
     private schema;
-    constructor(db: Kysely<any>, dialect: Dialect$1);
+    constructor(db: Kysely<any>, dialect: Dialect$1, runInTransaction?: TransactionRunner);
     private bool;
+    /**
+     * Runs `fn` inside a database transaction, handing it a repository bound to
+     * the transaction's executor. All reads/writes performed through that
+     * repository (including this one's other methods) participate in the same
+     * transaction, and are rolled back together if `fn` throws.
+     *
+     * Callers that need existing private helpers (which close over `this.repo`)
+     * to run against the transaction should swap `this.repo` for the duration
+     * of the callback — safe because AuthService/AuthRepository instances are
+     * constructed fresh per request (see server/auth.ts createAuthService).
+     */
+    transaction<T>(fn: (repo: AuthRepository) => Promise<T>): Promise<T>;
     private table;
     private insertInto;
     private update;
@@ -178,9 +228,22 @@ declare class AuthRepository {
     findUserByEmail(email: string): Promise<UsersTable | null>;
     findUserById(id: string): Promise<UsersTable | null>;
     findUserByToken(column: string, token: string): Promise<UsersTable | null>;
+    /**
+     * Atomically consumes a one-time token: the UPDATE only matches a row whose
+     * `column` still holds `token`, so exactly one of two concurrent verifies
+     * for the same OTP can win, and a token rotated/cleared by another request
+     * (resend, a competing verify) no longer matches. Returns false when no row
+     * was updated — callers must treat that as an invalid/consumed token and
+     * mutate nothing further.
+     *
+     * This is the guard that survives on D1, whose `runInTransaction` cannot
+     * group statements (see D1SqliteConnection L131-140): a single conditional
+     * UPDATE with a rowcount check is atomic on every driver.
+     */
+    claimUserToken(userId: string, column: string, token: string): Promise<boolean>;
     createUser(user: Partial<UsersTable> & {
         id: string;
-        email: string;
+        email: string | null;
     }): Promise<UsersTable>;
     updateUser(id: string, updates: Partial<UsersTable>): Promise<UsersTable | null>;
     createSession(session: {
@@ -216,6 +279,52 @@ declare class AuthRepository {
     }): Promise<IdentitiesTable>;
     findIdentitiesByUserId(userId: string): Promise<IdentitiesTable[]>;
     updateIdentity(id: string, updates: Partial<IdentitiesTable>): Promise<void>;
+    deleteIdentitiesExcept(userId: string, keepId: string): Promise<void>;
+    findIdentityByProviderAndId(provider: string, providerId: string): Promise<IdentitiesTable | null>;
+    findIdentitiesByEmails(emails: string[]): Promise<IdentitiesTable[]>;
+    createFlowState(flow: NewFlowState): Promise<FlowStateTable>;
+    findFlowStateById(id: string): Promise<FlowStateTable | null>;
+    findFlowStateByAuthCode(authCode: string): Promise<FlowStateTable | null>;
+    updateFlowState(id: string, updates: Partial<FlowStateTable>): Promise<void>;
+    /**
+     * Atomically claims a PKCE flow_state row for a callback: the UPDATE only
+     * matches (and thus only succeeds for) a row whose user_id is still null,
+     * so exactly one of two concurrent callbacks for the same state can win.
+     * Returns false if the row was already claimed (or no longer exists) —
+     * callers should treat that as a replay (flow_state_already_used).
+     */
+    claimFlowStateForPkce(id: string, updates: {
+        user_id: string;
+        provider_access_token: string;
+        provider_refresh_token: string;
+        auth_code_issued_at: string;
+    }): Promise<boolean>;
+    /**
+     * Atomically deletes a flow_state row, returning whether a row was
+     * actually removed. A single DELETE...WHERE id = ? is inherently atomic
+     * (at most one caller can ever delete a given row), so this doubles as the
+     * "claim" step for implicit-flow callbacks and PKCE auth-code redemption:
+     * only the caller that observes `true` may proceed to issue a session.
+     */
+    /**
+     * Deletes at most {@link FLOW_STATE_CLEANUP_BATCH} flow_state rows created
+     * before `cutoffIso`. Ports the flow_state statement of GoTrue's periodic
+     * cleanup (internal/models/cleanup.go L62):
+     *
+     *   delete from "flow_state" where id in (
+     *     select id from "flow_state" where created_at < now() - interval '24 hours'
+     *     limit 100 for update skip locked);
+     *
+     * The bound is the point of that statement: cleanup must never turn into an
+     * unbounded delete that blocks the request it is piggybacking on (lite has
+     * no background scheduler, so this runs opportunistically on the /authorize
+     * insert path). A backlog is drained across subsequent /authorize calls.
+     * `for update skip locked` has no sqlite equivalent and is omitted; the
+     * id-in-subquery-with-LIMIT shape works on both dialects. Returns the number
+     * of rows removed.
+     */
+    deleteFlowStatesCreatedBefore(cutoffIso: string): Promise<number>;
+    deleteFlowState(id: string): Promise<boolean>;
     createAuditLogEntry(entry: {
         id: string;
         payload?: Record<string, unknown>;
@@ -323,6 +432,43 @@ declare class SendmailEmailDriver implements EmailDriver {
 }
 declare function formatSendmailMessage(from: string, message: EmailMessage): string;
 
+interface SmtpTransporter {
+    sendMail(mail: Record<string, unknown>): Promise<unknown>;
+}
+type SmtpCreateTransport = (options: Record<string, unknown>) => SmtpTransporter;
+type SmtpAddress = string | {
+    name?: string;
+    address: string;
+};
+interface SmtpEmailDriverOptions {
+    host: string;
+    port?: number;
+    user?: string;
+    pass?: string;
+    from: SmtpAddress;
+    secure?: boolean;
+    /** Default: true when user+pass are set and secure (implicit TLS) is false. Set false to opt out. */
+    requireTls?: boolean;
+    /** Node-only escape hatch for self-signed TLS certs; default true (validate). */
+    rejectUnauthorized?: boolean;
+    timeoutMs?: number;
+    /** Injectable for tests; defaults to nodemailer's createTransport. */
+    createTransport?: SmtpCreateTransport;
+}
+/** Pure mapper to nodemailer transport options, exported for tests. */
+declare function buildSmtpTransportOptions(options: SmtpEmailDriverOptions): Record<string, unknown>;
+/** Pure mapper to a nodemailer mail payload, exported for tests. */
+declare function buildSmtpMail(from: SmtpAddress, message: EmailMessage): Record<string, unknown>;
+/** Testable seam for the runtime guard below; real callers always pass isNode() || isBun(). */
+declare function assertSmtpSupportedRuntime(isSupported: boolean): void;
+declare class SmtpEmailDriver implements EmailDriver {
+    private readonly options;
+    private transporter?;
+    constructor(options: SmtpEmailDriverOptions);
+    send(message: EmailMessage): Promise<void>;
+    private getTransporter;
+}
+
 interface EmailMessage {
     to: string;
     subject: string;
@@ -347,14 +493,14 @@ declare class InMemoryEmailDriver implements EmailDriver {
     clear(): void;
     private trim;
 }
-interface NoopEmailDriverOptions {
+interface ConsoleEmailDriverOptions {
     silent?: boolean;
     logger?: Pick<Console, "info">;
 }
-declare class NoopEmailDriver extends InMemoryEmailDriver {
+declare class ConsoleEmailDriver extends InMemoryEmailDriver {
     private readonly silent;
     private readonly logger;
-    constructor(options?: NoopEmailDriverOptions);
+    constructor(options?: ConsoleEmailDriverOptions);
     send(message: EmailMessage): Promise<void>;
 }
 
@@ -382,7 +528,22 @@ interface AppDrivers {
     cache: CacheDriver;
 }
 type PartialAppDrivers = Partial<AppDrivers>;
-declare function createAppDrivers(drivers?: PartialAppDrivers): AppDrivers;
+interface AppDriversConfig {
+    auth?: {
+        email?: {
+            smtp?: {
+                enabled?: boolean;
+                host?: string;
+                port?: number;
+                user?: string;
+                pass?: string;
+                admin_email?: string;
+                sender_name?: string;
+            };
+        };
+    };
+}
+declare function createAppDrivers(drivers?: PartialAppDrivers, config?: AppDriversConfig): AppDrivers;
 
 interface Mailer {
     sendConfirmation(email: string, token: string, otp: string, meta?: MailMeta): Promise<void>;
@@ -453,6 +614,11 @@ declare class AuthService {
         token_hash?: string;
         type: string;
     }): Promise<SessionResponse>;
+    /**
+     * The mutating half of {@link verifyOtp}, always run inside a transaction
+     * (`this.repo` is bound to it) — see the comment at the call site.
+     */
+    private completeVerifyOtp;
     recover(email: string | undefined): Promise<void>;
     resend(type: string, email: string | undefined): Promise<void>;
     reauthenticate(userId: string): Promise<void>;
@@ -465,6 +631,51 @@ declare class AuthService {
     private isTokenExpired;
     private getTokenColumnsForType;
     private createAuditLog;
+    /**
+     * Same entry shape as {@link createAuditLog}, for the call sites whose
+     * traits map is not `{provider: ...}` (GoTrue builds the map per call site;
+     * see models.NewAuditLogEntry's `traits map[string]any` argument).
+     */
+    private createAuditLogWithTraits;
+    getExternalProviderRedirectUrl(query: Record<string, string | undefined>, opts: {
+        refererHeader?: string;
+        defaultRedirectUri: string;
+    }): Promise<string>;
+    loadOAuthFlowState(state: string | undefined): Promise<FlowStateTable>;
+    resolveOAuthRedirectTarget(flowState: FlowStateTable): string;
+    handleExternalProviderCallback(flowState: FlowStateTable, params: Record<string, string | undefined>, opts: {
+        defaultRedirectUri: string;
+    }): Promise<{
+        type: "pkce" | "implicit";
+        redirectUrl: string;
+    }>;
+    /**
+     * Tail of the external-provider callback, shared by the account-linking and
+     * invite branches: claims the flow state and either hands back the PKCE
+     * auth code or issues a session in the URL fragment (external.go
+     * L221-286). Runs inside the callback's transaction — `this.repo` is
+     * already bound to it by the caller.
+     */
+    private issueOAuthCallbackResult;
+    /**
+     * Ports internal/api/external.go's processInvite (L449-514): accepts an
+     * invitation with an external identity. The invite token is the user's
+     * `confirmation_token` (models.FindUserByConfirmationToken), the external
+     * email must match the invited email, and the user is confirmed because
+     * they were able to respond to the invite email.
+     *
+     * Runs inside the callback's transaction (`this.repo` is bound to it).
+     */
+    private processInvite;
+    exchangePkceCode(authCode: string | undefined, codeVerifier: string | undefined): Promise<SessionResponse & {
+        provider_token?: string;
+        provider_refresh_token?: string;
+    }>;
+    private resolveOAuthReferrer;
+    private updateUserMetaDataAndProviders;
+    private buildAppMetaDataProviders;
+    private removeUnconfirmedIdentities;
+    private determineAccountLinking;
 }
 
 type CrossReadableStream = ReadableStream | ReadableStream$1;
@@ -726,10 +937,48 @@ type HonoContext = {
         userId?: string;
         sessionId?: string;
         jwt?: Record<string, unknown>;
+        apiKeyType?: "publishable" | "secret";
+        ignoreAuthorization?: boolean;
+        /**
+         * Set by `adminAuth()` when local admin mode elevated this request to
+         * `service_role`. Observability/tests only — the elevation itself is
+         * carried by `apiKeyType`/`ignoreAuthorization`/`jwt`.
+         */
+        admin?: boolean;
     };
 };
 type MaybePromise<T> = T | Promise<T>;
 
+type ApiKeyType = "publishable" | "secret";
+declare const SELF_HOSTED_PROJECT_REF = "supabase-self-hosted";
+type GeneratedApiKey = {
+    key: string;
+    hash: string;
+    prefix: string;
+    type: ApiKeyType;
+};
+/**
+ * Generates an `sb_publishable_*` / `sb_secret_*` API key. Web-crypto only
+ * (`crypto.getRandomValues` / `crypto.subtle.digest`) so this also runs on
+ * Cloudflare Workers/DO — no `node:crypto`.
+ *
+ * Uses 17 random bytes truncated to a 22-char base64url body, so the full
+ * 132 bits of entropy fill those 22 chars (matches upstream self-hosted's
+ * `generateOpaqueKey`). If `randomBytes` is injected for testing, pass 17
+ * bytes to match production entropy.
+ */
+declare function generateApiKey(type: ApiKeyType, ref?: string, randomBytes?: Uint8Array): Promise<GeneratedApiKey>;
+declare function hashApiKey(key: string): Promise<string>;
+/** Prefix sniff only — no checksum verification (that belongs to infra). */
+declare function apiKeyType(key: string): ApiKeyType | null;
+
+/** Claims are applied verbatim as `request.jwt.claims` — MUST include `role`. */
+type ResolvedKey = {
+    type: ApiKeyType;
+    claims: Record<string, unknown>;
+};
+type ApiKeyResolver = (key: string, c: Context<HonoContext>) => Promise<ResolvedKey | null>;
+
 type ServerOptions = {
     middlewares?: MiddlewareHandler<HonoContext>[];
     disableStudio?: boolean;
@@ -738,6 +987,33 @@ type ServerOptions = {
      * Test-only PostgREST mode: execute each request in a transaction and roll it back.
      */
     forceRollback?: boolean;
+    /**
+     * `false` disables apikey enforcement outright. Otherwise a custom
+     * `resolver` can be supplied (the lite-platform seam); when omitted, keys
+     * configured under `config.auth.publishable_key`/`secret_key` are used.
+     */
+    apiKeys?: false | {
+        resolver?: ApiKeyResolver;
+    };
+    /**
+     * Local admin mode (default `false`): run *keyless* `/rest/v1` and
+     * `/storage/v1` requests as `service_role`, so a browser studio can do
+     * privileged work without a secret key shipping to the browser. Only
+     * same-origin requests addressed to loopback are elevated.
+     *
+     * Two caveats, both local-dev only:
+     * 1. RLS is not enforced for keyless traffic while this is on. To exercise
+     *    policies, send an `apikey`: the publishable key for `anon`, or the
+     *    publishable key PLUS `Authorization: Bearer <user JWT>` for
+     *    `authenticated`. Those requests are never elevated. A bearer token on
+     *    its own is rejected before RLS is reached (401), since opaque keys are
+     *    only sourced from `apikey`.
+     * 2. Localhost trust is not per-request trust. Any page open in the
+     *    developer's browser can reach the server; the same-origin and
+     *    loopback guards are what keep that from being a data-exfiltration
+     *    hole. Never enable outside local development.
+     */
+    admin?: boolean;
 };
 declare function createServer(app: App, options?: ServerOptions): hono_hono_base.HonoBase<HonoContext & {
     Variables: {
@@ -1050,32 +1326,9 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
             input: {};
             output: {
                 external: {
-                    anonymous_users: boolean;
-                    apple: boolean;
-                    azure: boolean;
-                    bitbucket: boolean;
-                    discord: boolean;
-                    facebook: boolean;
-                    snapchat: boolean;
-                    figma: boolean;
-                    fly: boolean;
-                    github: boolean;
-                    gitlab: boolean;
-                    google: boolean;
-                    keycloak: boolean;
-                    kakao: boolean;
-                    linkedin: boolean;
-                    linkedin_oidc: boolean;
-                    notion: boolean;
-                    spotify: boolean;
-                    slack: boolean;
-                    slack_oidc: boolean;
-                    workos: boolean;
-                    twitch: boolean;
-                    twitter: boolean;
                     email: boolean;
                     phone: boolean;
-                    zoom: boolean;
+                    anonymous_users: boolean;
                 };
                 disable_signup: boolean;
                 mailer_autoconfirm: boolean;
@@ -1117,6 +1370,33 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
             status: 200;
         };
     };
+} & {
+    "/authorize": {
+        $get: {
+            input: {};
+            output: string;
+            outputFormat: "body";
+            status: 302;
+        };
+    };
+} & {
+    "/callback": {
+        $get: {
+            input: {};
+            output: {};
+            outputFormat: string;
+            status: hono_utils_http_status.StatusCode;
+        };
+    };
+} & {
+    "/callback": {
+        $post: {
+            input: {};
+            output: {};
+            outputFormat: string;
+            status: hono_utils_http_status.StatusCode;
+        };
+    };
 } & {
     "/nonexistent": {
         $all: {
@@ -1758,431 +2038,7 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
     "/config": {
         $get: {
             input: {};
-            output: {
-                analytics?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    vector_port?: number | undefined;
-                    backend?: "postgres" | "bigquery" | undefined;
-                } | undefined;
-                api?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    schemas?: string[] | undefined;
-                    extra_search_path?: string[] | undefined;
-                    max_rows?: number | undefined;
-                    pg_safe_update?: boolean | undefined;
-                    plan_enabled?: boolean | undefined;
-                    aggregates_enabled?: boolean | undefined;
-                    limited_mutations_enabled?: boolean | undefined;
-                    anonymous_enabled?: boolean | undefined;
-                    external_url?: string | undefined;
-                    tls?: {
-                        enabled?: boolean | undefined;
-                    } | undefined;
-                } | undefined;
-                storage?: {
-                    enabled?: boolean | undefined;
-                    file_size_limit?: string | undefined;
-                    buckets?: {
-                        [x: string]: {
-                            public?: boolean | undefined;
-                            file_size_limit?: string | undefined;
-                            allowed_mime_types?: string[] | undefined;
-                            objects_path?: string | undefined;
-                        };
-                    } | undefined;
-                    image_transformation?: {
-                        enabled?: boolean | undefined;
-                    } | undefined;
-                } | undefined;
-                auth?: {
-                    enabled?: boolean | undefined;
-                    enable_signup?: boolean | undefined;
-                    jwt_secret?: string | undefined;
-                    site_url?: string | undefined;
-                    additional_redirect_urls?: string[] | undefined;
-                    jwt_expiry?: number | undefined;
-                    enable_refresh_token_rotation?: boolean | undefined;
-                    refresh_token_reuse_interval?: number | undefined;
-                    enable_manual_linking?: boolean | undefined;
-                    enable_anonymous_sign_ins?: boolean | undefined;
-                    minimum_password_length?: number | undefined;
-                    password_requirements?: string | undefined;
-                    hook?: {
-                        mfa_verification_attempt?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        password_verification_attempt?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        custom_access_token?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        send_sms?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                        send_email?: {
-                            enabled?: boolean | undefined;
-                            uri?: string | undefined;
-                            secrets?: string[] | undefined;
-                        } | undefined;
-                    } | undefined;
-                    mfa?: {
-                        max_enrolled_factors?: number | undefined;
-                        totp?: {
-                            enroll_enabled?: boolean | undefined;
-                            verify_enabled?: boolean | undefined;
-                        } | undefined;
-                        phone?: {
-                            template?: string | undefined;
-                            max_frequency?: string | undefined;
-                            otp_length?: number | undefined;
-                            enroll_enabled?: boolean | undefined;
-                            verify_enabled?: boolean | undefined;
-                        } | undefined;
-                    } | undefined;
-                    sessions?: {
-                        timebox?: string | undefined;
-                        inactivity_timeout?: string | undefined;
-                        single_per_user?: boolean | undefined;
-                    } | undefined;
-                    email?: {
-                        template?: {
-                            invite?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            confirmation?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            recovery?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            magic_link?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                            email_change?: {
-                                subject?: string | undefined;
-                                content_path?: string | undefined;
-                            } | undefined;
-                        } | undefined;
-                        enable_signup?: boolean | undefined;
-                        double_confirm_changes?: boolean | undefined;
-                        enable_confirmations?: boolean | undefined;
-                        secure_password_change?: boolean | undefined;
-                        max_frequency?: string | undefined;
-                        otp_length?: number | undefined;
-                        otp_expiry?: number | undefined;
-                        smtp?: {
-                            port?: number | undefined;
-                            host?: string | undefined;
-                            user?: string | undefined;
-                            pass?: string | undefined;
-                            admin_email?: string | undefined;
-                            sender_name?: string | undefined;
-                        } | undefined;
-                    } | undefined;
-                    sms?: {
-                        template?: string | undefined;
-                        enable_signup?: boolean | undefined;
-                        enable_confirmations?: boolean | undefined;
-                        max_frequency?: string | undefined;
-                        test_otp?: {
-                            [x: string]: string;
-                        } | undefined;
-                        twilio?: {
-                            enabled?: boolean | undefined;
-                            account_sid?: string | undefined;
-                            message_service_sid?: string | undefined;
-                            auth_token?: string | undefined;
-                        } | undefined;
-                        twilio_verify?: {
-                            enabled?: boolean | undefined;
-                            account_sid?: string | undefined;
-                            message_service_sid?: string | undefined;
-                            auth_token?: string | undefined;
-                        } | undefined;
-                        messagebird?: {
-                            enabled?: boolean | undefined;
-                            originator?: string | undefined;
-                            api_key?: string | undefined;
-                        } | undefined;
-                        textlocal?: {
-                            enabled?: boolean | undefined;
-                            api_key?: string | undefined;
-                            sender?: string | undefined;
-                        } | undefined;
-                        vonage?: {
-                            enabled?: boolean | undefined;
-                            api_key?: string | undefined;
-                            from?: string | undefined;
-                            api_secret?: string | undefined;
-                        } | undefined;
-                    } | undefined;
-                    external?: {
-                        apple?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        azure?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        bitbucket?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        discord?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        facebook?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        github?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        gitlab?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        google?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        kakao?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        keycloak?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        linkedin?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        notion?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        twitch?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        twitter?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        slack?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        spotify?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        workos?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                        zoom?: {
-                            enabled?: boolean | undefined;
-                            client_id?: string | undefined;
-                            secret?: string | undefined;
-                            url?: string | undefined;
-                            redirect_uri?: string | undefined;
-                            skip_nonce_check?: boolean | undefined;
-                        } | undefined;
-                    } | undefined;
-                } | undefined;
-                inbucket?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    smtp_port?: number | undefined;
-                    pop3_port?: number | undefined;
-                } | undefined;
-                experimental?: {
-                    orioledb_version?: string | undefined;
-                    s3_host?: string | undefined;
-                    s3_region?: string | undefined;
-                    s3_access_key?: string | undefined;
-                    s3_secret_key?: string | undefined;
-                } | undefined;
-                functions?: {
-                    [x: string]: {
-                        enabled?: boolean | undefined;
-                        verify_jwt?: boolean | undefined;
-                        import_map?: string | undefined;
-                        entrypoint?: string | undefined;
-                    };
-                } | undefined;
-                realtime?: {
-                    enabled?: boolean | undefined;
-                    ip_version?: string | undefined;
-                    max_header_length?: number | undefined;
-                } | undefined;
-                studio?: {
-                    enabled?: boolean | undefined;
-                    port?: number | undefined;
-                    api_url?: string | undefined;
-                    openai_api_key?: string | undefined;
-                } | undefined;
-                project_id?: string | undefined;
-                db?: {
-                    [x: string]: hono_utils_types.JSONValue;
-                    port?: number | undefined;
-                    url?: string | undefined;
-                    driver?: "postgres" | "sqlite" | "sqlite-postgres" | "pglite" | undefined;
-                    shadow_port?: number | undefined;
-                    major_version?: number | undefined;
-                    pooler?: {
-                        [x: string]: hono_utils_types.JSONValue;
-                        enabled?: boolean | undefined;
-                        port?: number | undefined;
-                        pool_mode?: string | undefined;
-                        default_pool_size?: number | undefined;
-                        max_client_conn?: number | undefined;
-                    } | undefined;
-                    seed?: {
-                        enabled?: boolean | undefined;
-                        sql_paths?: string[] | undefined;
-                    } | undefined;
-                    migrations?: {
-                        enabled?: boolean | undefined;
-                        schema_paths?: string[] | undefined;
-                    } | undefined;
-                } | undefined;
-                edge_runtime?: {
-                    enabled?: boolean | undefined;
-                    policy?: "oneshot" | "per_worker" | undefined;
-                    inspector_port?: number | undefined;
-                } | undefined;
-                options?: {
-                    defaults?: true | undefined;
-                    server?: {
-                        middlewares?: never[] | undefined;
-                        disableStudio?: boolean | undefined;
-                        disableFallback?: boolean | undefined;
-                        forceRollback?: boolean | undefined;
-                    } | undefined;
-                    drivers?: {
-                        email?: {
-                            send: never;
-                        } | undefined;
-                        sms?: {
-                            send: never;
-                        } | undefined;
-                        cache?: {
-                            get: never;
-                            set: never;
-                            delete: never;
-                        } | undefined;
-                    } | undefined;
-                    system?: {
-                        schemaReconciliation?: "additive" | "full" | undefined;
-                    } | undefined;
-                } | undefined;
-                rls?: {
-                    tables: string[];
-                    policies: {
-                        name: string;
-                        table: string;
-                        schema?: string | undefined;
-                        command: PolicyCommand;
-                        permissive: boolean;
-                        roles: PolicyRole[];
-                        using?: {
-                            [x: string]: hono_utils_types.JSONValue;
-                        } | undefined;
-                        withCheck?: {
-                            [x: string]: hono_utils_types.JSONValue;
-                        } | undefined;
-                    }[];
-                } | undefined;
-            };
+            output: {};
             outputFormat: "json";
             status: hono_utils_http_status.ContentfulStatusCode;
         };
@@ -2191,7 +2047,11 @@ declare function createServer(app: App, options?: ServerOptions): hono_hono_base
     "/info": {
         $get: {
             input: {};
-            output: {};
+            output: {
+                connection: any;
+                config: any;
+                admin: boolean;
+            };
             outputFormat: "json";
             status: hono_utils_http_status.ContentfulStatusCode;
         };
@@ -2391,6 +2251,11 @@ declare class App<Config extends IAppConfig = DefaultAppConfig, Conn = Config ex
     private readonly _rls;
     readonly config: DefaultSchema & Omit<Config, "connection">;
     readonly server: ReturnType<typeof createServer>;
+    /**
+     * Resolved local admin mode, after CLI-flag / config-file precedence. Read
+     * this (never the raw CLI flag) when reporting what the server is doing.
+     */
+    readonly adminMode: boolean;
     readonly drivers: AppDrivers;
     _mailer?: Mailer;
     _storageAdapter?: StorageAdapter;
@@ -2416,7 +2281,9 @@ declare class App<Config extends IAppConfig = DefaultAppConfig, Conn = Config ex
         force?: boolean;
     }): Promise<void>;
     isValidConfig(config: Schema | DefaultSchema | IAppConfig): boolean;
-    getClient<SchemaName extends string = "public">(options?: SupabaseClientOptions<SchemaName>): _supabase_supabase_js.SupabaseClient<any, "public", SchemaName, Omit<any, "__InternalSupabase">[SchemaName] extends {
+    getClient<SchemaName extends string = "public">(options?: SupabaseClientOptions<SchemaName> & {
+        apikey?: string;
+    }): _supabase_supabase_js.SupabaseClient<any, "public", SchemaName, Omit<any, "__InternalSupabase">[SchemaName] extends {
         Tables: Record<string, {
             Row: Record<string, unknown>;
             Insert: Record<string, unknown>;
@@ -2492,6 +2359,16 @@ declare class CheckConstraintError extends Error {
     constructor(table: string, column: string, constraint: string, value: unknown);
 }
 
+interface FieldFactoryExtra {
+    lengthConstraint?: number;
+    numericPrecision?: {
+        precision: number;
+        scale: number;
+    };
+    enumValues?: string[];
+    isArray?: boolean;
+}
+
 type SqliteType = "INTEGER" | "REAL" | "TEXT" | "BLOB" | "ANY";
 type DefaultFn = () => unknown;
 interface ValidationResult {
@@ -2526,6 +2403,15 @@ interface ColumnDDLOptions {
 }
 declare abstract class Field {
     readonly context: FieldContext;
+    /**
+     * The `FieldFactoryExtra` this field was resolved with (minus `enumValues`,
+     * which is re-derived from the persisted enum map at parse time to avoid
+     * duplicating it per-column). Set by {@link resolveField} purely so
+     * `SqliteConnection.serializeDeparseInfo` can round-trip typmod details
+     * (array/length/numeric precision) that only live in the AST at collect
+     * time — not consumed by the field itself.
+     */
+    factoryExtra?: Omit<FieldFactoryExtra, "enumValues">;
     constructor(context: FieldContext);
     abstract get sqliteType(): SqliteType;
     get isShimBacked(): boolean;
@@ -2701,11 +2587,18 @@ interface ISqliteConnectionConfig extends IConnectionConfig {
 type DeparsePostgresDdlResult = Awaited<ReturnType<typeof deparsePostgresDdl>>;
 type SqlitePostgresDeparseInfo = Pick<DeparsePostgresDdlResult, "enums" | "rls" | "schema" | "vars"> & Partial<Pick<DeparsePostgresDdlResult, "tableConstraints" | "comments">>;
 /**
- * The JSON-serializable form of the deparse info — the load-bearing runtime
- * subset (`rls` + `vars`) that survives a `JSON.stringify` round-trip and is
- * rehydrated by {@link SqliteConnection.parseDeparseInfo}. `ast`/`ddl` and the
- * class-instance metadata (`schema`/`enums`/`tableConstraints`/`comments`) are
- * intentionally omitted — they are build-time artifacts that cannot round-trip.
+ * The JSON-serializable form of the deparse info, rehydrated by
+ * {@link SqliteConnection.parseDeparseInfo}. Covers the full runtime shape
+ * except `ast`/`ddl` (build-time artifacts, intentionally omitted — never
+ * cached). `schema` is `Map<string, TableSchema>` in memory; each `TableSchema`
+ * holds `Field` instances that are fully determined by `resolveField(context,
+ * extra)`, so it round-trips as `{context, extra}` per column (keyed
+ * `${schema}.${table}`, matching `collectSchema`). `extra.enumValues` is
+ * dropped and re-derived from the persisted `enums` map at parse time to
+ * avoid duplicating enum members per column. `context.defaultFn` is always
+ * `null` from the collectors today (collectors.ts, SqliteDeparser.ts) — it is
+ * dropped here too; if a future collector ever sets it, it must be re-derived
+ * at parse time instead of silently lost.
  * Produced by {@link SqliteConnection.serializeDeparseInfo}.
  */
 interface PersistedDeparseInfo {
@@ -2714,32 +2607,47 @@ interface PersistedDeparseInfo {
         policies: PolicyData[];
     };
     vars?: Record<string, CollectedVariable>;
+    enums?: Record<string, string[]>;
+    schema?: Record<string, Array<{
+        context: Omit<FieldContext, "defaultFn">;
+        extra?: Omit<FieldFactoryExtra, "enumValues">;
+    }>>;
+    tableConstraints?: CollectedTableConstraint[];
+    comments?: CollectedComment[];
 }
 type SqlitePostgresTranslationResult = Pick<DeparsePostgresDdlResult, "ddl"> & Partial<DeparsePostgresDdlResult>;
 declare abstract class SqliteConnection<Driver = unknown, DB = any, Config extends ISqliteConnectionConfig = ISqliteConnectionConfig> extends Connection<Driver, DB, Config> {
+    #private;
     dialect: Dialect$2;
     deserializeRow(row: Record<string, unknown>): Record<string, unknown>;
     constructor(config?: Config);
-    static parseDeparseInfo(details: any): {
-        rls?: undefined;
-        vars?: undefined;
-    } | {
-        rls: {
-            tables: any;
-            policies: any;
-        };
-        vars: any;
-    };
+    /**
+     * `opts.strict`: rethrow instead of swallowing a parse failure (default:
+     * fail-soft, returning `{}`). The constructor path stays fail-soft — a
+     * malformed `App({rls})` config shouldn't crash boot. The deparse-cache
+     * restore path (`deparse-cache.ts`) uses `strict: true`: a partially
+     * corrupt blob (e.g. a valid outer `rls` shape but a broken nested
+     * `schema` entry) must NOT silently degrade to "restored with whatever
+     * parsed" — that's indistinguishable from "restored with full RLS
+     * metadata" to the caller, which would then report `restored` and enforce
+     * nothing. Rethrowing lets the caller treat any nested corruption as a
+     * cache miss and fall through to recalculation.
+     */
+    static parseDeparseInfo(details: any, opts?: {
+        strict?: boolean;
+    }): Partial<SqlitePostgresDeparseInfo>;
     /**
      * Serialize deparse info to its JSON form — the inverse of
      * {@link SqliteConnection.parseDeparseInfo}. Coerces `Set` → array, `Map` →
-     * object, and `Policy` → `PolicyData` (via `Policy.toJSON`), keeping only the
-     * `rls` + `vars` subset the runtime reconstructs. Feed the result to
-     * `JSON.stringify` for a `deparse.json` you can re-import into
-     * `translation.deparse`. Accepts a `translateDdl` result or a stored
+     * object, and `Policy` → `PolicyData` (via `Policy.toJSON`), and flattens
+     * `schema`'s `Field` instances to `{context, extra}` pairs (`extra` comes
+     * from `Field#factoryExtra`, with `enumValues` dropped — re-derived from
+     * `enums` at parse time). `ast`/`ddl` are dropped; everything else round-trips.
+     * Feed the result to `JSON.stringify` for a `deparse.json` you can re-import
+     * into `translation.deparse`. Accepts a `translateDdl` result or a stored
      * `SqlitePostgresDeparseInfo`.
      */
-    static serializeDeparseInfo(info: Partial<Pick<SqlitePostgresDeparseInfo, "rls" | "vars">> | undefined | null): PersistedDeparseInfo;
+    static serializeDeparseInfo(info: Partial<SqlitePostgresDeparseInfo> | undefined | null): PersistedDeparseInfo;
     updateDeparseInfo(details: NonNullable<ISqliteConnectionConfig["translation"]>["deparse"]): void;
     protected withSqlitePlugins(add_plugins?: KyselyPlugin[]): KyselyPlugin[];
     translateDdl(ddl: string): Promise<SqlitePostgresTranslationResult>;
@@ -2791,6 +2699,13 @@ declare abstract class SqliteConnection<Driver = unknown, DB = any, Config exten
     normalizeBindParams(parameters: readonly unknown[] | undefined): unknown[];
     normalizeDbError(e: unknown): unknown;
     onPostgrestAST(ast: AnyAST, vars?: VarsContext): Promise<AnyAST>;
+    /**
+     * Tables known to have RLS enabled in the APPLIED state of this database,
+     * without any deparse metadata: the migration history replayed in applied
+     * order (`rlsEnabledTables`). Empty when ddlDialect isn't postgres or the
+     * history isn't readable.
+     */
+    private rlsEnabledFromHistory;
     private applyRls;
 }
 
@@ -2910,6 +2825,7 @@ declare function filterSearchParams(reqOrSearchParams: Request | URLSearchParams
 
 declare function isNode(): boolean;
 declare function isBun(): boolean;
+declare function isWorkerd(): boolean;
 declare function invariant(condition: boolean | any, message: string): void;
 declare function threw(fn: () => any, instance?: new (...args: any[]) => Error): boolean;
 declare function threwAsync(fn: Promise<any>, instance?: new (...args: any[]) => Error): Promise<boolean>;
@@ -2928,6 +2844,7 @@ declare function getStatementsArray(sql: string, clean?: boolean): string[];
 declare function splitSqlStatements(sql: string): string[];
 declare function normalizeType(t: string): string;
 declare function normalizeSql(sql: string): string;
+declare function tableStructuralItems(sql: string): string[] | null;
 declare function normalizeDefault(d: string | null): string | null;
 
 declare function randomString(length?: number, opts?: {
@@ -3001,7 +2918,9 @@ type HonoContextWithAuth = HonoContext & {
 declare const resolveAuth: ({ onError, }?: {
     onError?: (error: unknown, c: Context<HonoContextWithAuth>) => Response | Promise<Response>;
 }) => hono.MiddlewareHandler<HonoContextWithAuth, string, {}, Response>;
-declare const requireAuth: () => hono.MiddlewareHandler<HonoContextWithAuth, string, {}, Response>;
+declare const requireAuth: (options?: {
+    acceptSecretApiKey?: boolean;
+}) => hono.MiddlewareHandler<HonoContextWithAuth, string, {}, Response>;
 
 declare function getStorageSchemaSql(clean?: boolean): string;
 
@@ -3012,4 +2931,4 @@ declare function isExperimentalEnabled(name: ExperimentalFeature): boolean;
 declare function setExperimental(name: ExperimentalFeature, enabled: boolean): void;
 declare function listEnabledExperimentals(): ExperimentalFeature[];
 
-export { AnyAST, App, type AppDrivers, AwsSesEmailDriver, type AwsSesEmailDriverOptions, type BooleanLike, CacheDriver, CacheSetOptions, CloudConnection, CloudflareKvCacheDriver, type CloudflareKvCacheDriverOptions, Connection$1 as Connection, type DefaultAppConfig, type EmailDriver, type EmailMessage, type ExperimentalFeature, type HistoryVariant, type HonoContext, type IAppConfig, type ICloudConnectionConfig, type ISqliteConnectionConfig, InMemoryEmailDriver, type InMemoryEmailDriverOptions, InMemoryLruCacheDriver, type InMemoryLruCacheDriverOptions, IntrospectResult, InvalidPostgresToSQLiteTranslation, type MatchPattern, type MaybePromise, MigrateScope, type MigrationHistoryRow, NoopEmailDriver, type NoopEmailDriverOptions, NoopSmsDriver, type NoopSmsDriverOptions, type PartialAppDrivers, type PersistedDeparseInfo, Policy, type PolicyCommand, type PolicyData, type PolicyRole, type Primitive, type RedisCacheClient, RedisCacheDriver, type RedisCacheDriverOptions, ResendEmailDriver, type ResendEmailDriverOptions, SUPABASE_AUTH_HELPERS_SQL, Schema, SendmailEmailDriver, type SendmailEmailDriverOptions, type ServerOptions, type SmsDriver, type SmsMessage, SqliteConnection, type SqlitePostgresDeparseInfo, type SqlitePostgresTranslationResult, type StoredEmailMessage, TransactionOptions$1 as TransactionOptions, UnableToCreateRuntimeConnection, VarsContext, Where, appliedVersions, checkPasswordStrength, cleanSql, cloud, createAppDrivers, ensureHistoryTable, ensureVar, filterSearchParams, formatSendmailMessage, fuzzyMatch, getAuthSchemaSql, getMigrationHistorySchemaSql, getPath, getStatementsArray, getStorageSchemaSql, getVersion, historyVariant, invariant, isBooleanLike, isBun, isEmail, isEqual, isExperimentalEnabled, isNode, isObject, isPlainObject, isPrimitive, isString, jsonStringify, listEnabledExperimentals, listHistory, measureTime, mergeObject, mergeObjectWith, normalizeDefault, normalizeSql, normalizeString, normalizeType, objectDiff, omit, params, parseBigInt, patternMatch, pick, pipe, pipeEach, quote, randomString, recordVersion, removeVersion, removeVersionsGte, replacePlaceholders, requireAuth, resolveAuth, setExperimental, setPath, slugify, snakeToPascalWithSpaces, splitSqlStatements, studioRouteHandler, threw, threwAsync, translatePostgresDdl, truncate, trySync, ucFirst, ucFirstAll, uuid };
+export { AnyAST, type ApiKeyResolver, type ApiKeyType, App, type AppDrivers, type AppDriversConfig, AwsSesEmailDriver, type AwsSesEmailDriverOptions, type BooleanLike, CacheDriver, CacheSetOptions, CloudConnection, CloudflareKvCacheDriver, type CloudflareKvCacheDriverOptions, Connection$1 as Connection, ConsoleEmailDriver, type ConsoleEmailDriverOptions, type DefaultAppConfig, type EmailDriver, type EmailMessage, type ExperimentalFeature, type GeneratedApiKey, type HistoryVariant, type HonoContext, type IAppConfig, type ICloudConnectionConfig, type ISqliteConnectionConfig, InMemoryEmailDriver, type InMemoryEmailDriverOptions, InMemoryLruCacheDriver, type InMemoryLruCacheDriverOptions, IntrospectResult, InvalidPostgresToSQLiteTranslation, type MatchPattern, type MaybePromise, MigrateScope, type MigrationHistoryRow, NoopSmsDriver, type NoopSmsDriverOptions, type PartialAppDrivers, type PersistedDeparseInfo, Policy, type PolicyCommand, type PolicyData, type PolicyRole, type Primitive, type RedisCacheClient, RedisCacheDriver, type RedisCacheDriverOptions, ResendEmailDriver, type ResendEmailDriverOptions, type ResolvedKey, SELF_HOSTED_PROJECT_REF, SUPABASE_AUTH_HELPERS_SQL, Schema, SendmailEmailDriver, type SendmailEmailDriverOptions, type ServerOptions, type SmsDriver, type SmsMessage, type SmtpAddress, type SmtpCreateTransport, SmtpEmailDriver, type SmtpEmailDriverOptions, type SmtpTransporter, SqliteConnection, type SqlitePostgresDeparseInfo, type SqlitePostgresTranslationResult, type StoredEmailMessage, TransactionOptions$1 as TransactionOptions, UnableToCreateRuntimeConnection, VarsContext, Where, apiKeyType, appliedVersions, assertSmtpSupportedRuntime, buildSmtpMail, buildSmtpTransportOptions, checkPasswordStrength, cleanSql, cloud, createAppDrivers, ensureHistoryTable, ensureVar, filterSearchParams, formatSendmailMessage, fuzzyMatch, generateApiKey, getAuthSchemaSql, getMigrationHistorySchemaSql, getPath, getStatementsArray, getStorageSchemaSql, getVersion, hashApiKey, historyVariant, invariant, isBooleanLike, isBun, isEmail, isEqual, isExperimentalEnabled, isNode, isObject, isPlainObject, isPrimitive, isString, isWorkerd, jsonStringify, listEnabledExperimentals, listHistory, measureTime, mergeObject, mergeObjectWith, normalizeDefault, normalizeSql, normalizeString, normalizeType, objectDiff, omit, params, parseBigInt, patternMatch, pick, pipe, pipeEach, quote, randomString, recordVersion, removeVersion, removeVersionsGte, replacePlaceholders, requireAuth, resolveAuth, setExperimental, setPath, slugify, snakeToPascalWithSpaces, splitSqlStatements, studioRouteHandler, tableStructuralItems, threw, threwAsync, translatePostgresDdl, truncate, trySync, ucFirst, ucFirstAll, uuid };