@rebasepro/cli 0.0.1-canary.4d4fb3e → 0.0.1-canary.5584634

package/templates/template/README.md

@@ -66,7 +66,7 @@ Backend (Hono + PostgreSQL) on port 3001, frontend (Vite + React) on port 5173.
 │   ├── Dockerfile      # Multi-stage production build
 │   ├── functions/      # Custom API endpoints (auto-discovered)
 │   └── src/
-├── shared/             # Shared collection definitions
+├── config/             # Shared collection definitions
 │   └── collections/    # Schema-as-Code TypeScript files
 ├── docker-compose.yml  # Production stack (Postgres + Backend + Frontend)
 ├── .env.template       # Environment variable template
@@ -92,7 +92,7 @@ Call from the client SDK: `client.call("functions/hello", { name: "World" })`
 
 ### Shared Collections
 
-Collections are defined once in `shared/collections/` and used by both the frontend and backend. This ensures your schema stays in sync across the stack.
+Collections are defined once in `config/collections/` and used by both the frontend and backend. This ensures your schema stays in sync across the stack.
 
 ## Production Deployment
 

package/templates/template/backend/Dockerfile

@@ -7,7 +7,7 @@
 #   docker run -p 3001:3001 --env-file .env my-app-backend
 
 # ── Stage 1: Install + Build ─────────────────────────────────────────
-FROM node:24-alpine AS builder
+FROM node:22-alpine AS builder
 
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
@@ -23,20 +23,20 @@ COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
 # Copy workspace packages
 COPY backend ./backend
-COPY shared ./shared
+COPY config ./config
 
 # Install all deps (including devDependencies for build)
 RUN pnpm install --frozen-lockfile
 
-# Build shared first, then backend
-RUN pnpm --filter "*-shared" run build
+# Build config first, then backend
+RUN pnpm --filter "*-config" run build
 RUN pnpm --filter "*-backend" run build
 
 # Prune dev dependencies for a smaller runtime
 RUN pnpm install --frozen-lockfile --prod
 
 # ── Stage 2: Production Runtime ──────────────────────────────────────
-FROM node:24-alpine AS runtime
+FROM node:22-alpine AS runtime
 
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
@@ -53,7 +53,7 @@ WORKDIR /app
 COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml ./
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/backend ./backend
-COPY --from=builder /app/shared ./shared
+COPY --from=builder /app/config ./config
 
 # Create uploads directory
 RUN mkdir -p /app/backend/uploads && chown -R rebase:rebase /app

package/templates/template/backend/drizzle.config.ts

@@ -7,8 +7,9 @@ if (!process.env.DATABASE_URL) {
     throw new Error("DATABASE_URL is not set. Make sure .env file exists in the project root and contains DATABASE_URL");
 }
 
-// Extract table names from the generated schema
-// This ensures drizzle-kit ONLY manages tables defined in the schema
+// Extract table names from the generated schema.
+// This ensures drizzle-kit ONLY manages tables defined in the schema.
+// Any tables in the database that are NOT part of the Rebase schema are left untouched.
 const tableNames = Object.values(tables).map(table => getTableName(table as Table));
 
 export default defineConfig({
@@ -18,5 +19,16 @@ export default defineConfig({
     dbCredentials: {
         url: process.env.DATABASE_URL
     },
-    tablesFilter: tableNames
+    // Only manage tables defined in the generated schema.
+    // Unmapped tables in the database are completely ignored.
+    tablesFilter: tableNames,
+    // Restrict drizzle-kit to the public schema only — tables in other schemas
+    // (e.g. extensions, custom schemas) are never touched.
+    schemaFilter: ["public"],
+    // Prevent drizzle-kit from managing roles not defined in the schema
+    entities: {
+        roles: false
+    },
+    // If PostGIS or other extensions create helper tables, ignore them
+    extensionsFilters: ["postgis"]
 });

package/templates/template/backend/functions/hello.ts

@@ -1,4 +1,6 @@
 import { Hono } from "hono";
+import type { HonoEnv } from "@rebasepro/server-core";
+import { rebase } from "@rebasepro/server-core";
 
 /**
  * Example custom function route.
@@ -12,23 +14,39 @@ import { Hono } from "hono";
  *
  * This is a standard Hono app — use any Hono middleware,
  * define any HTTP methods, access the request/response directly.
- * The authenticated user and RLS-scoped driver are available
- * via c.get("user") and c.get("driver").
+ *
+ * The `rebase` singleton gives you admin-level access to all
+ * app-scoped services (data, auth, storage, email) from anywhere.
+ * For request-scoped / RLS-scoped access, use c.get("user") and c.get("driver").
  */
-const app = new Hono();
+const app = new Hono<HonoEnv>();
 
 app.post("/", async (c) => {
     const body = await c.req.json().catch(() => ({}));
-    const user = c.get("user") as any;
+    const user = c.get("user");
+
+    const userId = (user && typeof user === "object" && "userId" in user)
+        ? user.userId
+        : "anonymous";
+
+    // Access any Rebase service — just import and use:
+    // await rebase.email?.send({
+    //     to: "admin@example.com",
+    //     subject: "Function called",
+    //     html: `<p>Hello from ${userId}!</p>`,
+    // });
+    //
+    // const authors = await rebase.data.authors.find({ limit: 5 });
 
     return c.json({
         message: `Hello, ${body.name || "World"}!`,
-        user: user?.userId || "anonymous",
+        user: userId
     });
 });
 
 app.get("/", (c) => {
-    return c.json({ status: "ok", endpoint: "hello" });
+    return c.json({ status: "ok",
+endpoint: "hello" });
 });
 
 export default app;

package/templates/template/backend/package.json

@@ -5,12 +5,12 @@
     "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch --watch=\"../shared/**/*\" src/index.ts",
+        "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
         "build": "tsc --noEmit",
         "start": "tsx src/index.ts"
     },
     "dependencies": {
-        "{{PROJECT_NAME}}-shared": "0.0.1",
+        "{{PROJECT_NAME}}-config": "workspace:*",
         "@rebasepro/server-core": "workspace:*",
         "@rebasepro/server-postgresql": "workspace:*",
         "drizzle-orm": "^0.44.4",

package/templates/template/backend/src/env.ts

@@ -0,0 +1,52 @@
+import { z } from "zod";
+import * as dotenv from "dotenv";
+import path from "path";
+import { fileURLToPath } from "url";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+
+const envSchema = z.object({
+    NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
+    PORT: z.string().default("3001").transform(Number),
+    DATABASE_URL: z.string().url("DATABASE_URL must be a valid URL"),
+    ADMIN_CONNECTION_STRING: z.string().url().optional(),
+    JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters long"),
+    JWT_ACCESS_EXPIRES_IN: z.string().default("1h"),
+    JWT_REFRESH_EXPIRES_IN: z.string().default("30d"),
+    GOOGLE_CLIENT_ID: z.string().optional(),
+    ALLOW_REGISTRATION: z.enum(["true", "false", ""]).default("false").transform(v => v === "true"),
+    CORS_ORIGINS: z.string().optional(),
+    FRONTEND_URL: z.string().optional(),
+    DB_POOL_MAX: z.string().default("20").transform(Number),
+    DB_POOL_IDLE_TIMEOUT: z.string().default("30000").transform(Number),
+    DB_POOL_CONNECT_TIMEOUT: z.string().default("10000").transform(Number),
+    FORCE_LOCAL_STORAGE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
+    STORAGE_TYPE: z.enum(["local", "s3"]).default("local"),
+    STORAGE_PATH: z.string().optional(),
+    S3_BUCKET: z.string().optional(),
+    S3_REGION: z.string().optional(),
+    S3_ACCESS_KEY_ID: z.string().optional(),
+    S3_SECRET_ACCESS_KEY: z.string().optional(),
+    S3_ENDPOINT: z.string().url().optional(),
+    S3_FORCE_PATH_STYLE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
+    /**
+     * Service key for admin-level script / server-to-server authentication.
+     * When set, scripts can send `Authorization: Bearer <key>` to get admin access.
+     * Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"
+     */
+    REBASE_SERVICE_KEY: z.string().min(32, "REBASE_SERVICE_KEY must be at least 32 characters").optional()
+}).superRefine((data, ctx) => {
+    if (data.NODE_ENV === "production" && !data.CORS_ORIGINS && !data.FRONTEND_URL) {
+        ctx.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "CORS_ORIGINS or FRONTEND_URL must be set in production to secure the API.",
+            path: ["CORS_ORIGINS"]
+        });
+    }
+});
+
+// Parse and export
+export const env = envSchema.parse(process.env);

package/templates/template/backend/src/index.ts

@@ -8,88 +8,140 @@ import { fileURLToPath } from "url";
 import {
     initializeRebaseBackend,
     serveSPA,
-    HonoEnv
+    HonoEnv,
+    listenWithPortRetry,
+    cleanupDevPortFile,
+    logger
 } from "@rebasepro/server-core";
 import { createPostgresDatabaseConnection, createPostgresBootstrapper } from "@rebasepro/server-postgresql";
 import { enums, relations, tables } from "./schema.generated";
-import * as dotenv from "dotenv";
+import { env } from "./env";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-dotenv.config({ path: path.resolve(__dirname, "../../.env") });
-
 // ─── App ─────────────────────────────────────────────────────────────
 const app = new Hono<HonoEnv>();
 
+const isProduction = env.NODE_ENV === "production";
+const allowedOrigins = isProduction
+    ? (env.CORS_ORIGINS || env.FRONTEND_URL || "https://yourdomain.com").split(",").map(s => s.trim())
+    : [];
+
 app.use("/*", cors({
-    origin: process.env.NODE_ENV === "production"
-        ? [process.env.FRONTEND_URL || "https://yourdomain.com"]
-        : ["http://localhost:5173", "http://localhost:3000"],
+    origin: (origin) => {
+        if (!isProduction) return origin || "*";
+        return allowedOrigins.includes(origin) ? origin : null;
+    },
     credentials: true
 }));
 
 app.use("/*", secureHeaders());
 
 // ─── Database ────────────────────────────────────────────────────────
-const databaseUrl = process.env.DATABASE_URL;
-if (!databaseUrl) throw new Error("DATABASE_URL is not set");
+const databaseUrl = env.DATABASE_URL;
 
-const { db, connectionString } = createPostgresDatabaseConnection(databaseUrl);
+const { db, pool, connectionString } = createPostgresDatabaseConnection(databaseUrl);
 
 // ─── Start ───────────────────────────────────────────────────────────
 async function startServer() {
-    const jwtSecret = process.env.JWT_SECRET;
-    if (!jwtSecret) throw new Error("JWT_SECRET is not set");
-
-    const PORT = parseInt(process.env.PORT || "3001", 10);
+    const jwtSecret = env.JWT_SECRET;
+    const PORT = env.PORT;
     const server = createServer(getRequestListener(app.fetch));
 
     const backend = await initializeRebaseBackend({
-        collectionsDir: path.resolve(__dirname, "../../shared/collections"),
+        collectionsDir: path.resolve(__dirname, "../../config/collections"),
         functionsDir: path.resolve(__dirname, "../functions"),
         server,
         app,
         bootstrappers: [
             createPostgresBootstrapper({
                 connection: db,
-                schema: { tables, enums, relations },
-                adminConnectionString: process.env.ADMIN_CONNECTION_STRING || databaseUrl,
+                schema: { tables,
+enums,
+relations },
+                adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
                 connectionString
             })
         ],
         auth: {
             jwtSecret,
-            accessExpiresIn: process.env.JWT_ACCESS_EXPIRES_IN || "1h",
-            refreshExpiresIn: process.env.JWT_REFRESH_EXPIRES_IN || "30d",
-            google: process.env.GOOGLE_CLIENT_ID
-                ? { clientId: process.env.GOOGLE_CLIENT_ID }
+            accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
+            refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
+            serviceKey: env.REBASE_SERVICE_KEY,
+            google: env.GOOGLE_CLIENT_ID
+                ? { clientId: env.GOOGLE_CLIENT_ID }
                 : undefined,
             seedDefaultRoles: true,
-            allowRegistration: process.env.ALLOW_REGISTRATION === "true"
+            allowRegistration: env.ALLOW_REGISTRATION
         },
-        storage: {
-            type: "local",
-            basePath: path.resolve(__dirname, "../../uploads")
-        },
-        history: true,
+        storage: env.STORAGE_TYPE === "s3"
+            ? {
+                type: "s3",
+                bucket: env.S3_BUCKET!,
+                region: env.S3_REGION || "auto",
+                accessKeyId: env.S3_ACCESS_KEY_ID || "",
+                secretAccessKey: env.S3_SECRET_ACCESS_KEY || "",
+                endpoint: env.S3_ENDPOINT,
+                forcePathStyle: env.S3_FORCE_PATH_STYLE
+            }
+            : {
+                type: "local",
+                basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
+            },
+        history: true
     });
 
-    // ─── Your routes ─────────────────────────────────────────────
-    app.get("/health", (c) => c.json({ status: "ok" }));
+    // ─── Health check ─────────────────────────────────────────────
+    app.get("/health", async (c) => {
+        const result = await backend.healthCheck();
+        const status = result.healthy ? 200 : 503;
+        return c.json({
+            status: result.healthy ? "ok" : "degraded",
+            latencyMs: result.latencyMs,
+            ...(result.details ? { details: result.details } : {})
+        }, status);
+    });
 
     // Serve the frontend in production
-    if (process.env.NODE_ENV === "production") {
+    if (isProduction) {
         serveSPA(app, { frontendPath: path.join(__dirname, "../../frontend/dist") });
     }
 
-    server.listen(PORT, () => {
-        console.log(`🚀 Server running at http://localhost:${PORT}`);
-    });
+    if (!isProduction) {
+        // Dev mode: retry the next port if the current one is in use
+        const projectRoot = path.resolve(__dirname, "../..");
+        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot });
+
+        // Clean up port file on exit
+        const cleanup = () => cleanupDevPortFile(projectRoot);
+        process.on("SIGINT", cleanup);
+        process.on("SIGTERM", cleanup);
+        process.on("exit", cleanup);
+
+        logger.info(`Server running at http://localhost:${actualPort}`);
+    } else {
+        server.listen(PORT, () => {
+            logger.info(`Server running at http://localhost:${PORT}`);
+        });
+    }
+
+    // ─── Graceful Shutdown ───────────────────────────────────────────────
+    // Uses the framework's built-in shutdown() which drains connections,
+    // stops the cron scheduler, and force-exits after 15s timeout.
+    const gracefulShutdown = async (signal: string) => {
+        logger.info(`Received ${signal}, shutting down...`);
+        await backend.shutdown();
+        await pool.end();
+        logger.info("Database pool closed");
+        process.exit(0);
+    };
+    process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
+    process.on("SIGINT", () => gracefulShutdown("SIGINT"));
 }
 
 startServer().catch(err => {
-    console.error("Failed to start server:", err);
+    logger.error("Failed to start server", { error: err instanceof Error ? err : new Error(String(err)) });
     process.exit(1);
 });
 

package/templates/template/backend/tsconfig.json

@@ -15,5 +15,5 @@
     "sourceMap": true,
     "jsx": "preserve"
   },
-  "include": ["src/**/*", "../shared/**/*", "drizzle.config.ts"]
+  "include": ["src/**/*", "../config/**/*", "drizzle.config.ts"]
 }

package/templates/template/config/collections/authors.ts

@@ -0,0 +1,45 @@
+import { EntityCollection } from "@rebasepro/types";
+
+const authorsCollection: EntityCollection = {
+    name: "Authors",
+    singularName: "Author",
+    slug: "authors",
+    table: "authors",
+    icon: "Person",
+    properties: {
+        id: {
+            name: "ID",
+            type: "number",
+            isId: "increment"
+        },
+        name: {
+            name: "Name",
+            type: "string",
+            validation: {
+                required: true
+            }
+        },
+        email: {
+            name: "Email",
+            type: "string",
+            validation: {
+                required: true
+            }
+        },
+        picture: {
+            name: "Picture",
+            type: "string",
+            storage: {
+                storagePath: "author_pictures/"
+            }
+        }
+    },
+    propertiesOrder: [
+        "id",
+        "name",
+        "email",
+        "picture"
+    ]
+};
+
+export default authorsCollection;

package/templates/template/config/collections/index.ts

@@ -0,0 +1,5 @@
+import postsCollection from "./posts";
+import authorsCollection from "./authors";
+import tagsCollection from "./tags";
+
+export const collections = [postsCollection, authorsCollection, tagsCollection];

package/templates/template/{shared → config}/collections/posts.ts

@@ -1,4 +1,6 @@
 import { EntityCollection } from "@rebasepro/types";
+import authorsCollection from "./authors";
+import tagsCollection from "./tags";
 
 const postsCollection: EntityCollection = {
     name: "Posts",
@@ -46,8 +48,44 @@ const postsCollection: EntityCollection = {
                     color: "greenLight"
                 }
             ]
+        },
+        author: {
+            name: "Author",
+            type: "relation",
+            relationName: "author",
+            relation: {
+                relationName: "author",
+                cardinality: "one",
+                direction: "owning",
+                target: () => authorsCollection
+            }
+        },
+        tags: {
+            name: "Tags",
+            type: "relation",
+            relationName: "tags",
+            relation: {
+                relationName: "tags",
+                cardinality: "many",
+                direction: "owning",
+                target: () => tagsCollection
+            }
+        }
+    },
+    relations: [
+        {
+            relationName: "author",
+            target: () => authorsCollection,
+            cardinality: "one",
+            direction: "owning"
+        },
+        {
+            relationName: "tags",
+            target: () => tagsCollection,
+            cardinality: "many",
+            direction: "owning"
         }
-    }
+    ]
 };
 
 export default postsCollection;

package/templates/template/config/collections/tags.ts

@@ -0,0 +1,27 @@
+import { EntityCollection } from "@rebasepro/types";
+
+const tagsCollection: EntityCollection = {
+    name: "Tags",
+    singularName: "Tag",
+    slug: "tags",
+    table: "tags",
+    icon: "Tag",
+    properties: {
+        id: {
+            name: "ID",
+            type: "number",
+            validation: {
+                required: true
+            }
+        },
+        name: {
+            name: "Tag Name",
+            type: "string",
+            validation: {
+                required: true
+            }
+        }
+    }
+};
+
+export default tagsCollection;

package/templates/template/{shared → config}/package.json

@@ -1,5 +1,5 @@
 {
-    "name": "{{PROJECT_NAME}}-shared",
+    "name": "{{PROJECT_NAME}}-config",
     "version": "1.0.0",
     "description": "Shared collections for frontend and backend",
     "main": "dist/index.js",

package/templates/template/docker-compose.yml

@@ -63,6 +63,7 @@ services:
       PORT: "3001"
       ALLOW_REGISTRATION: ${ALLOW_REGISTRATION:-false}
       FRONTEND_URL: ${FRONTEND_URL:-http://localhost}
+      CORS_ORIGINS: ${CORS_ORIGINS:-}
       # Optional Google OAuth
       GOOGLE_CLIENT_ID: ${GOOGLE_CLIENT_ID:-}
       # Optional SMTP
@@ -73,6 +74,17 @@ services:
       SMTP_PASS: ${SMTP_PASS:-}
       SMTP_FROM: ${SMTP_FROM:-}
       APP_NAME: ${APP_NAME:-Rebase}
+      # Storage
+      STORAGE_TYPE: ${STORAGE_TYPE:-local}
+      STORAGE_PATH: ${STORAGE_PATH:-/app/backend/uploads}
+      S3_BUCKET: ${S3_BUCKET:-}
+      S3_REGION: ${S3_REGION:-}
+      S3_ACCESS_KEY_ID: ${S3_ACCESS_KEY_ID:-}
+      S3_SECRET_ACCESS_KEY: ${S3_SECRET_ACCESS_KEY:-}
+      S3_ENDPOINT: ${S3_ENDPOINT:-}
+      S3_FORCE_PATH_STYLE: ${S3_FORCE_PATH_STYLE:-}
+      # Service key for scripts & server-to-server admin access
+      REBASE_SERVICE_KEY: ${REBASE_SERVICE_KEY:-}
     depends_on:
       db:
         condition: service_healthy

package/templates/template/frontend/Dockerfile

@@ -21,13 +21,13 @@ COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
 
 # Copy workspace packages
 COPY frontend ./frontend
-COPY shared ./shared
+COPY config ./config
 
 # Install dependencies
 RUN pnpm install --frozen-lockfile
 
-# Build shared first, then frontend
-RUN pnpm --filter "*-shared" run build
+# Build config first, then frontend
+RUN pnpm --filter "*-config" run build
 RUN pnpm --filter "*-frontend" run build
 
 # ── Stage 2: Serve with nginx ────────────────────────────────────────

package/templates/template/frontend/package.json

@@ -8,12 +8,12 @@
         "@rebasepro/core": "workspace:*",
         "@rebasepro/plugin-data-enhancement": "workspace:*",
         "@rebasepro/client": "workspace:*",
-        "@rebasepro/cms": "workspace:*",
+        "@rebasepro/admin": "workspace:*",
         "@rebasepro/studio": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "@rebasepro/ui": "workspace:*",
         "@fontsource/jetbrains-mono": "^5.2.5",
-        "{{PROJECT_NAME}}-shared": "0.0.1",
+        "{{PROJECT_NAME}}-config": "workspace:*",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "react-router": "^7.0.0",