@rebasepro/app 0.17.3 → 0.18.1

package/dist/vitePlugin.d.ts

@@ -58,3 +58,25 @@ export declare function rebaseCollectionsPlugin(options: RebaseCollectionsPlugin
         map: ReturnType<MagicString["generateMap"]>;
     } | null;
 };
+/**
+ * How the admin's dependencies are split into cached chunks.
+ *
+ * This was sixty-five lines copied verbatim into every scaffold's
+ * `vite.config.ts`, comments and all — which meant every project got a frozen
+ * snapshot of a decision that keeps being revised. When we learned that naming
+ * `lucide-react` welded 822 kB of icons into the preload set, the fix landed
+ * in the template and in nothing already generated.
+ *
+ * A name here says these modules travel TOGETHER. It does not say they travel
+ * late: a chunk becomes a static dependency of the entry — and so a
+ * `modulepreload` in index.html — the moment any one module in it is
+ * statically reachable. Naming a library that is only partly lazy therefore
+ * drags the lazy part onto the critical path. Read the two exceptions below
+ * before adding a line.
+ *
+ * @example
+ * ```ts
+ * build: { rollupOptions: { output: { manualChunks: rebaseManualChunks } } }
+ * ```
+ */
+export declare function rebaseManualChunks(id: string): string | undefined;

package/dist/vitePlugin.js

@@ -2,6 +2,13 @@ import path from "path";
 import ts from "typescript";
 import MagicString from "magic-string";
 const LAZY_COMPONENT_KEYS = /* @__PURE__ */ new Set(["Field", "Preview", "Builder", "Filter"]);
+function isInsideCallbacksBlock(node) {
+  const objectLiteral = node.parent;
+  if (!objectLiteral || !ts.isObjectLiteralExpression(objectLiteral)) return false;
+  const owner = objectLiteral.parent;
+  if (!owner || !ts.isPropertyAssignment(owner)) return false;
+  return getPropertyName(owner) === "callbacks";
+}
 function walkAST(node, visitor) {
   visitor(node);
   node.forEachChild((child) => walkAST(child, visitor));
@@ -25,7 +32,14 @@ function transformCollectionSource(code, id) {
   let replaced = false;
   walkAST(sourceFile, (node) => {
     if (!ts.isPropertyAssignment(node)) return;
-    const propName = getPropertyName(node);
+    const name = getPropertyName(node);
+    if (name && isInsideCallbacksBlock(node)) {
+      const value = node.initializer;
+      ms.overwrite(value.getStart(sourceFile), value.getEnd(), "undefined");
+      replaced = true;
+      return;
+    }
+    const propName = name;
     if (!propName || !LAZY_COMPONENT_KEYS.has(propName)) return;
     const init = node.initializer;
     if (!ts.isStringLiteral(init)) return;
@@ -122,7 +136,32 @@ function rebaseCollectionsPlugin(options) {
     }
   };
 }
+function rebaseManualChunks(id) {
+  if (id.includes("commonjsHelpers") || id.includes("commonjs-dynamic-modules")) return "vendor-commonjs-helpers";
+  if (id.includes("exceljs")) return "vendor-exceljs";
+  if (id.includes("prosemirror")) return "vendor-prosemirror";
+  if (id.includes("monaco-editor") || id.includes("@monaco-editor")) return "vendor-monaco";
+  if (id.includes("@xyflow") || id.includes("dagre")) return "vendor-xyflow";
+  if (id.includes("@dnd-kit")) return "vendor-dnd";
+  if (id.includes("prism-react-renderer")) return "vendor-prism";
+  if (id.includes("markdown-it")) return "vendor-markdown";
+  if (id.includes("react-dropzone")) return "vendor-dropzone";
+  if (id.includes("date-fns/locale")) return void 0;
+  if (id.includes("date-fns")) return "vendor-datefns";
+  if (id.includes("fuse.js")) return "vendor-fuse";
+  if (id.includes("node_modules/react-dom/")) return "vendor-react-dom";
+  if (id.includes("node_modules/react-router") || id.includes("node_modules/@remix-run")) return "vendor-react-router";
+  if (id.includes("node_modules/@radix-ui/")) return "vendor-radix";
+  if (id.includes("node_modules/framer-motion/")) return "vendor-framer-motion";
+  if (id.includes("node_modules/zod/")) return "vendor-zod";
+  if (id.includes("node_modules/i18next") || id.includes("node_modules/react-i18next")) return "vendor-i18next";
+  if (id.includes("node_modules/@floating-ui/")) return "vendor-floating-ui";
+  if (id.includes("node_modules/tailwind-merge/")) return "vendor-tailwind-merge";
+  if (id.includes("node_modules/notistack/")) return "vendor-notistack";
+  return void 0;
+}
 export {
   rebaseCollectionsPlugin,
+  rebaseManualChunks,
   transformCollectionSource
 };

package/package.json

@@ -1,45 +1,56 @@
 {
   "name": "@rebasepro/app",
-  "type": "module",
-  "version": "0.17.3",
+  "version": "0.18.1",
   "description": "Rebase core — framework-agnostic runtime for data-driven admin panels",
-  "funding": {
-    "url": "https://github.com/sponsors/rebaseco"
+  "keywords": [
+    "rebase",
+    "cms",
+    "admin",
+    "admin panel",
+    "typescript",
+    "headless",
+    "headless cms",
+    "content manager"
+  ],
+  "homepage": "https://rebase.pro",
+  "bugs": {
+    "url": "https://github.com/rebasepro/rebase/issues"
   },
-  "author": "Rebase",
-  "license": "MIT",
   "repository": {
     "type": "git",
     "url": "https://github.com/rebasepro/rebase.git",
     "directory": "packages/app"
   },
+  "funding": {
+    "url": "https://github.com/sponsors/rebasepro"
+  },
+  "license": "MIT",
+  "author": "Rebase",
+  "type": "module",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
   "types": "./dist/index.d.ts",
-  "source": "src/index.ts",
   "engines": {
     "node": ">=22.22.0"
   },
-  "keywords": [
-    "rebase",
-    "cms",
-    "admin",
-    "admin panel",
-    "typescript",
-    "headless",
-    "headless cms",
-    "content manager"
-  ],
   "exports": {
     ".": {
       "types": "./dist/index.d.ts",
       "development": "./dist/index.es.js",
-      "import": "./dist/index.es.js"
+      "import": "./dist/index.es.js",
+      "default": "./dist/index.es.js"
+    },
+    "./debug": {
+      "types": "./dist/debug/index.d.ts",
+      "development": "./dist/debug.js",
+      "import": "./dist/debug.js",
+      "default": "./dist/debug.js"
     },
     "./vitePlugin": {
       "types": "./dist/vitePlugin.d.ts",
       "development": "./dist/vitePlugin.js",
-      "import": "./dist/vitePlugin.js"
+      "import": "./dist/vitePlugin.js",
+      "default": "./dist/vitePlugin.js"
     },
     "./package.json": "./package.json"
   },
@@ -52,18 +63,18 @@
     "magic-string": "^0.30.0",
     "notistack": "^3.0.2",
     "react-i18next": "^17.0.11",
-    "@rebasepro/cms-types": "0.17.3",
-    "@rebasepro/common": "0.17.3",
-    "@rebasepro/forms": "0.17.3",
-    "@rebasepro/types": "0.17.3",
-    "@rebasepro/ui": "0.17.3",
-    "@rebasepro/utils": "0.17.3"
+    "@rebasepro/forms": "0.18.1",
+    "@rebasepro/cms-types": "0.18.1",
+    "@rebasepro/common": "0.18.1",
+    "@rebasepro/ui": "0.18.1",
+    "@rebasepro/types": "0.18.1",
+    "@rebasepro/utils": "0.18.1"
   },
   "peerDependencies": {
-    "react": ">=19.2.7",
-    "react-dom": ">=19.2.7",
+    "react": "^19.2.7",
+    "react-dom": "^19.2.7",
     "react-router": "^8.3.0",
-    "typescript": ">=5.0.0"
+    "typescript": "^6.0.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
@@ -88,8 +99,7 @@
     "vite": "^8.1.5"
   },
   "files": [
-    "dist",
-    "src"
+    "dist"
   ],
   "gitHead": "d935eefa5aa8d1009a2398cfac2c1e4ee9aeb6b6",
   "publishConfig": {
@@ -135,9 +145,10 @@
   },
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && pnpm exec esbuild src/vitePlugin.ts --platform=node --format=esm --outfile=dist/vitePlugin.js && node ../../tooling/scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && pnpm exec esbuild src/vitePlugin.ts --platform=node --format=esm --outfile=dist/vitePlugin.js && pnpm exec esbuild src/debug/index.ts --bundle --format=esm --jsx=automatic --external:react --external:react-dom --external:react/jsx-runtime --external:@rebasepro/* --outfile=dist/debug.js && node ../../tooling/scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest --passWithNoTests",
+    "test:watch": "jest --watch",
     "clean": "rm -rf dist && find ./src \\( -name '*.js' -o -name '*.d.ts' \\) -type f | xargs rm -f",
     "generateIcons": "ts-node --esm src/icons/generateIcons.ts"
   }

package/src/auth/api.ts

@@ -1,134 +0,0 @@
-/**
- * Auth-config fetch helper for the Rebase React frontend.
- *
- * The former per-endpoint auth client (login, register, refresh, OAuth,
- * sessions, …) has been removed: `useRebaseAuthController` now delegates to
- * the headless SDK's `client.auth` (from `@rebasepro/client`), which is the
- * single source of truth for the auth session. The only piece that remains
- * here is the unauthenticated `/api/auth/config` probe used to detect
- * bootstrap mode and enabled providers before a session exists.
- */
-
-import { RebaseApiError } from "@rebasepro/types";
-import type { AuthAdapterCapabilities } from "@rebasepro/types";
-import { DEFAULT_API_PATH } from "../hooks/ApiConfigContext";
-
-async function handleResponse<T>(response: Response): Promise<T> {
-    let data: Record<string, unknown>;
-    try {
-        data = await response.json();
-    } catch (parseError) {
-        // Response wasn't JSON - could be network error or server issue
-        throw new RebaseApiError(
-            `Server returned non-JSON response (status: ${response.status})`,
-            { status: response.status, code: "PARSE_ERROR" }
-        );
-    }
-
-    if (!response.ok) {
-        throw new RebaseApiError(
-            (data as Record<string, Record<string, string>>).error?.message || "Request failed",
-            {
-                status: response.status,
-                code: (data as Record<string, Record<string, string>>).error?.code || "UNKNOWN_ERROR"
-            }
-        );
-    }
-
-    return data as T;
-}
-
-/**
- * Wrapper for fetch that catches generic network failures (like server down)
- * and translates them to a {@link RebaseApiError} with code `NETWORK_ERROR`.
- */
-async function fetchWithHandling(input: RequestInfo | URL, init?: RequestInit): Promise<Response> {
-    try {
-        return await fetch(input, init);
-    } catch (error: unknown) {
-        if (error instanceof TypeError && error.message.includes("Failed to fetch")) {
-            throw new RebaseApiError(
-                "Failed to connect to the backend server. The backend might be down or failed to initialize (e.g., database connection timeout).",
-                { code: "NETWORK_ERROR", cause: error }
-            );
-        }
-        throw new RebaseApiError(
-            "Network error: " + (error instanceof Error ? error.message : String(error)),
-            { code: "NETWORK_ERROR", cause: error }
-        );
-    }
-}
-
-/**
- * What `GET /api/auth/config` answers.
- *
- * The wire contract is declared once, in `@rebasepro/types`, and re-exported
- * here under the name this module uses. Three near-copies of it used to exist —
- * this one listed an `emailServiceEnabled` flag no backend sends, and marked as
- * optional fields every backend always returns.
- */
-export type AuthConfigResponse = AuthAdapterCapabilities;
-
-/**
- * Cache container for `fetchAuthConfig` — holds both the inflight promise
- * (to deduplicate concurrent calls) and the cached result.
- */
-export interface AuthConfigCache {
-    cached: AuthConfigResponse | null;
-    inflight: Promise<AuthConfigResponse> | null;
-}
-
-/**
- * Create a fresh `AuthConfigCache` instance.
- * Callers own the cache object and pass it into `fetchAuthConfig` / `clearAuthConfigCache`.
- */
-export function createAuthConfigCache(): AuthConfigCache {
-    return { cached: null, inflight: null };
-}
-
-/**
- * Fetch auth configuration / status from the backend
- * This is an unauthenticated endpoint used to detect bootstrap mode.
- *
- * Results are cached for the session lifetime.
- * Concurrent calls are deduplicated: only one network request is made
- * and all callers share the same promise.
- */
-export async function fetchAuthConfig(
-    apiUrl: string,
-    cache: AuthConfigCache,
-    /** The backend's `basePath`; only needed if it is not the default. */
-    apiPath: string = DEFAULT_API_PATH
-): Promise<AuthConfigResponse> {
-    if (cache.cached) {
-        return cache.cached;
-    }
-
-    if (cache.inflight) {
-        return cache.inflight;
-    }
-
-    cache.inflight = (async () => {
-        const response = await fetchWithHandling(`${apiUrl.replace(/\/+$/, "")}${apiPath}/auth/config`, {
-            method: "GET",
-            headers: { "Content-Type": "application/json" }
-        });
-        return handleResponse<AuthConfigResponse>(response);
-    })();
-
-    try {
-        const result = await cache.inflight;
-        cache.cached = result;
-        return result;
-    } finally {
-        cache.inflight = null;
-    }
-}
-
-/**
- * Clear the cached auth config (e.g. on logout or for testing).
- */
-export function clearAuthConfigCache(cache: AuthConfigCache): void {
-    cache.cached = null;
-    cache.inflight = null;
-}

package/src/auth/index.ts

@@ -1,26 +0,0 @@
-/**
- * Authentication controller for Rebase frontends.
- *
- * Provides the `useRebaseAuthController` hook and API utilities for
- * communicating with a Rebase backend's JWT auth endpoints.
- *
- * The generic LoginView and RebaseAuth components that render on top of this
- * controller are in `../components`. Both are re-exported from the package
- * root, which is where applications should import them from.
- */
-
-// Types
-export type {
-    RebaseAuthController,
-    RebaseAuthControllerProps,
-    User,
-    AuthTokens,
-    DeviceSession,
-    AuthResponse,
-    RefreshResponse
-} from "./types";
-
-export { useRebaseAuthController } from "./useRebaseAuthController";
-// API utilities
-export { fetchAuthConfig, clearAuthConfigCache, createAuthConfigCache } from "./api";
-export type { AuthConfigResponse, AuthConfigCache } from "./api";

package/src/auth/types.ts

@@ -1,115 +0,0 @@
-import { User, AuthTokens, DeviceSession, RebaseSession, AuthChangeEvent } from "@rebasepro/types";
-import { AuthController } from "@rebasepro/cms-types";
-import type { AuthConfigResponse } from "./api";
-
-// Re-export canonical types so the auth entry point stays self-contained. `User`
-// joins them because the controller hands one back and a consumer installs
-// `@rebasepro/app` alone — `@rebasepro/types` is this package's dependency, not
-// theirs, so it is not a specifier they can import from.
-export type { User, AuthTokens, DeviceSession };
-
-/**
- * Auth controller that extends the base AuthController
- * with additional methods for email/password and Google login
- */
-export type RebaseAuthController = AuthController & {
-    /** Login with Google — accepts an ID token, access token, or authorization code payload */
-    googleLogin: (payload: { idToken: string } | { accessToken: string } | { code: string; redirectUri: string }) => Promise<void>;
-    /** Generic OAuth login — works with any provider. Posts payload to /auth/{providerId}. */
-    oauthLogin: (providerId: string, payload: Record<string, unknown>) => Promise<void>;
-    /** Login with email and password */
-    emailPasswordLogin: (email: string, password: string) => Promise<void>;
-    /** Register a new user */
-    register: (email: string, password: string, displayName?: string) => Promise<void>;
-    /** Skip login (for anonymous access if enabled) */
-    skipLogin: () => void;
-    /** Whether login was skipped */
-    loginSkipped: boolean;
-    /** Error from auth provider (login failure details) */
-    authProviderError: Error | null;
-    /** True when there are no users in the system — first-user bootstrap mode */
-    needsSetup: boolean;
-    /** Whether new user registration is enabled (always true during setup) */
-    registrationEnabled: boolean;
-    /** Request password reset email */
-    forgotPassword: (email: string) => Promise<void>;
-    /** Reset password using token from email */
-    resetPassword: (token: string, password: string) => Promise<void>;
-    /** Change password for authenticated user */
-    changePassword: (oldPassword: string, newPassword: string) => Promise<void>;
-    /** Update user profile */
-    updateProfile: (displayName?: string, photoURL?: string) => Promise<User>;
-    /** Fetch active sessions */
-    fetchSessions: () => Promise<DeviceSession[]>;
-    /** Revoke a session */
-    revokeSession: (sessionId: string) => Promise<void>;
-    /** Revoke all active sessions */
-    revokeAllSessions: () => Promise<void>;
-    /** Get internal API URL */
-    getApiUrl?: () => string | undefined;
-    /** Clear the current auth provider error */
-    clearError: () => void;
-    /** Set or clear the auth provider error */
-    setAuthProviderError: (error: Error | null) => void;
-}
-
-/**
- * Structural type for the subset of `client.auth` (from `@rebasepro/client`)
- * that the React hook delegates to. Avoids a hard dependency on
- * `@rebasepro/client` while remaining fully type-safe.
- */
-export interface ClientAuth {
-    getSession(): RebaseSession | null;
-    onAuthStateChange(callback: (event: AuthChangeEvent, session: RebaseSession | null) => void): () => void;
-    isInitialized(): Promise<void>;
-    getAuthConfig(): Promise<AuthConfigResponse>;
-    signInWithEmail(email: string, password: string): Promise<unknown>;
-    signOut(): Promise<void>;
-    refreshSession(): Promise<RebaseSession>;
-    signUp(email: string, password: string, displayName?: string): Promise<unknown>;
-    signInWithGoogle(payload: { idToken: string } | { accessToken: string } | { code: string; redirectUri: string }): Promise<unknown>;
-    signInWithOAuth(providerId: string, payload: Record<string, unknown>): Promise<unknown>;
-    resetPasswordForEmail(email: string): Promise<unknown>;
-    resetPassword(token: string, password: string): Promise<unknown>;
-    changePassword(oldPassword: string, newPassword: string): Promise<unknown>;
-    updateUser(updates: { displayName?: string; photoURL?: string }): Promise<User>;
-    getSessions(): Promise<DeviceSession[]>;
-    revokeSession(sessionId: string): Promise<unknown>;
-    revokeAllSessions(): Promise<unknown>;
-}
-
-/**
- * Props for useRebaseAuthController hook
- */
-export interface RebaseAuthControllerProps {
-    /** The Rebase Client instance */
-    client?: {
-        baseUrl?: string;
-        resolveToken?: () => Promise<string | null>;
-        setAuthTokenGetter?: (getter: () => Promise<string | null>) => void;
-        setOnUnauthorized?: (handler: () => Promise<boolean>) => void;
-        ws?: { setAuthTokenGetter: (getter: () => Promise<string | null>) => void };
-        auth?: ClientAuth;
-    };
-    /** Google OAuth client ID (optional, enables Google login) */
-    googleClientId?: string;
-    /** Callback when user signs out */
-    onSignOut?: () => void;
-    /** Define roles for a user after login */
-    defineRolesFor?: (user: User) => Promise<string[] | undefined> | string[] | undefined;
-}
-
-/**
- * Auth response from backend login/register endpoints
- */
-export interface AuthResponse {
-    user: User;
-    tokens: AuthTokens;
-}
-
-/**
- * Response from token refresh endpoint
- */
-export interface RefreshResponse {
-    tokens: AuthTokens;
-}