@rebasepro/cli 0.0.1-canary.f81da60 → 0.0.1-canary.fc811d7

package/templates/template/backend/functions/hello.ts

@@ -1,6 +1,4 @@
-import { Hono } from "hono";
-import type { HonoEnv } from "@rebasepro/server-core";
-import { rebase } from "@rebasepro/server-core";
+import { defineFunction } from "@rebasepro/server";
 
 /**
  * Example custom function route.
@@ -12,41 +10,47 @@ import { rebase } from "@rebasepro/server-core";
  * Call from the client SDK:
  *   const result = await client.call("functions/hello", { name: "World" });
  *
- * This is a standard Hono app — use any Hono middleware,
- * define any HTTP methods, access the request/response directly.
+ * Authored with `defineFunction`, which hands you a pre-typed Hono app
+ * (so `c.get("user")` / `c.get("driver")` are typed) and the `rebase`
+ * singleton via the injected context — use any Hono middleware, define any
+ * HTTP methods, access the request/response directly.
  *
- * The `rebase` singleton gives you admin-level access to all
- * app-scoped services (data, auth, storage, email) from anywhere.
- * For request-scoped / RLS-scoped access, use c.get("user") and c.get("driver").
+ * `rebase.dataAsAdmin` gives you admin-level access to your data and
+ * **bypasses RLS** — use it only for trusted admin work. For request-scoped /
+ * RLS-scoped data access, use c.get("user") and c.get("driver"), which carry
+ * the caller's identity. (`rebase` also exposes auth, storage, email.)
  */
-const app = new Hono<HonoEnv>();
+export default defineFunction((app, { rebase }) => {
+    void rebase; // available for dataAsAdmin/auth/storage/email — see commented usage below
 
-app.post("/", async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    const user = c.get("user");
+    app.post("/", async (c) => {
+        const body = await c.req.json().catch(() => ({}));
+        const user = c.get("user");
 
-    const userId = (user && typeof user === "object" && "userId" in user)
-        ? user.userId
-        : "anonymous";
+        const userId = (user && typeof user === "object" && "userId" in user)
+            ? user.userId
+            : "anonymous";
 
-    // Access any Rebase service — just import and use:
-    // await rebase.email?.send({
-    //     to: "admin@example.com",
-    //     subject: "Function called",
-    //     html: `<p>Hello from ${userId}!</p>`,
-    // });
-    //
-    // const authors = await rebase.data.authors.find({ limit: 5 });
+        // Access any Rebase service via the injected `rebase`:
+        // await rebase.email.send({
+        //     to: "admin@example.com",
+        //     subject: "Function called",
+        //     html: `<p>Hello from ${userId}!</p>`,
+        // });
+        //
+        // Admin-scoped data (bypasses RLS — trusted work only):
+        // const authors = await rebase.dataAsAdmin.authors.find({ limit: 5 });
+        // For user-scoped data (RLS applies), use the request-scoped driver
+        // (c.get("driver")), which carries the caller's identity.
 
-    return c.json({
-        message: `Hello, ${body.name || "World"}!`,
-        user: userId
+        return c.json({
+            message: `Hello, ${body.name || "World"}!`,
+            user: userId
+        });
     });
-});
 
-app.get("/", (c) => {
-    return c.json({ status: "ok",
-endpoint: "hello" });
+    app.get("/", (c) => {
+        return c.json({ status: "ok",
+            endpoint: "hello" });
+    });
 });
-
-export default app;

package/templates/template/backend/package.json

@@ -6,26 +6,26 @@
     "type": "module",
     "scripts": {
         "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
-        "build": "tsc --noEmit",
-        "start": "tsx src/index.ts"
+        "build": "rebase schema generate --collections ../config/collections && tsc",
+        "start": "node dist/backend/src/index.js"
     },
     "dependencies": {
-        "{{PROJECT_NAME}}-config": "workspace:*",
-        "@rebasepro/server-core": "workspace:*",
-        "@rebasepro/server-postgresql": "workspace:*",
-        "drizzle-orm": "^0.44.4",
+        "{{PROJECT_NAME}}-config": "*",
+        "@rebasepro/server": "workspace:*",
+        "@rebasepro/server-postgres": "workspace:*",
+        "@rebasepro/types": "workspace:*",
+        "drizzle-orm": "^0.45.2",
         "hono": "^4.12.10",
         "@hono/node-server": "^1.19.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
-        "zod": "^3.22.4",
-        "dotenv": "^16.0.0"
+        "dotenv": "^16.0.0",
+        "zod": "^4.4.3"
     },
     "devDependencies": {
         "@types/pg": "^8.6.5",
         "@types/node": "^20.10.5",
         "@types/ws": "^8.5.10",
-        "drizzle-kit": "^0.31.4",
         "tsx": "^4.20.6",
         "typescript": "^5.9.2"
     }

package/templates/template/backend/src/env.ts

@@ -1,52 +1,23 @@
-import { z } from "zod";
 import * as dotenv from "dotenv";
 import path from "path";
 import { fileURLToPath } from "url";
+import { loadEnv } from "@rebasepro/server";
+import { z } from "zod";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 dotenv.config({ path: path.resolve(__dirname, "../../.env") });
 
-const envSchema = z.object({
-    NODE_ENV: z.enum(["development", "production", "test"]).default("development"),
-    PORT: z.string().default("3001").transform(Number),
-    DATABASE_URL: z.string().url("DATABASE_URL must be a valid URL"),
-    ADMIN_CONNECTION_STRING: z.string().url().optional(),
-    JWT_SECRET: z.string().min(32, "JWT_SECRET must be at least 32 characters long"),
-    JWT_ACCESS_EXPIRES_IN: z.string().default("1h"),
-    JWT_REFRESH_EXPIRES_IN: z.string().default("30d"),
-    GOOGLE_CLIENT_ID: z.string().optional(),
-    ALLOW_REGISTRATION: z.enum(["true", "false", ""]).default("false").transform(v => v === "true"),
-    CORS_ORIGINS: z.string().optional(),
-    FRONTEND_URL: z.string().optional(),
-    DB_POOL_MAX: z.string().default("20").transform(Number),
-    DB_POOL_IDLE_TIMEOUT: z.string().default("30000").transform(Number),
-    DB_POOL_CONNECT_TIMEOUT: z.string().default("10000").transform(Number),
-    FORCE_LOCAL_STORAGE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
-    STORAGE_TYPE: z.enum(["local", "s3"]).default("local"),
-    STORAGE_PATH: z.string().optional(),
-    S3_BUCKET: z.string().optional(),
-    S3_REGION: z.string().optional(),
-    S3_ACCESS_KEY_ID: z.string().optional(),
-    S3_SECRET_ACCESS_KEY: z.string().optional(),
-    S3_ENDPOINT: z.string().url().optional(),
-    S3_FORCE_PATH_STYLE: z.enum(["true", "false", ""]).optional().transform(v => v === "true"),
-    /**
-     * Service key for admin-level script / server-to-server authentication.
-     * When set, scripts can send `Authorization: Bearer <key>` to get admin access.
-     * Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"
-     */
-    REBASE_SERVICE_KEY: z.string().min(32, "REBASE_SERVICE_KEY must be at least 32 characters").optional()
-}).superRefine((data, ctx) => {
-    if (data.NODE_ENV === "production" && !data.CORS_ORIGINS && !data.FRONTEND_URL) {
-        ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: "CORS_ORIGINS or FRONTEND_URL must be set in production to secure the API.",
-            path: ["CORS_ORIGINS"]
-        });
-    }
+export const env = loadEnv({
+    extend: z.object({
+        SMTP_HOST: z.string().optional(),
+        SMTP_PORT: z.string().default("587").transform(Number),
+        SMTP_SECURE: z.enum(["true", "false", ""]).default("false").transform(v => v === "true"),
+        SMTP_USER: z.string().optional(),
+        SMTP_PASS: z.string().optional(),
+        SMTP_FROM: z.string().optional(),
+        SMTP_NAME: z.string().optional(),
+        APP_NAME: z.string().default("Rebase")
+    })
 });
-
-// Parse and export
-export const env = envSchema.parse(process.env);

package/templates/template/backend/src/index.ts

@@ -7,25 +7,36 @@ import path from "path";
 import { fileURLToPath } from "url";
 import {
     initializeRebaseBackend,
+    installShutdownHandlers,
     serveSPA,
     HonoEnv,
     listenWithPortRetry,
     cleanupDevPortFile,
     logger
-} from "@rebasepro/server-core";
-import { createPostgresDatabaseConnection, createPostgresBootstrapper } from "@rebasepro/server-postgresql";
-import { enums, relations, tables } from "./schema.generated";
-import { env } from "./env";
+} from "@rebasepro/server";
+import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
+import { enums, relations, tables } from "./schema.generated.js";
+import { env } from "./env.js";
+import usersCollection from "../../config/collections/users.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 // ─── App ─────────────────────────────────────────────────────────────
-const app = new Hono<HonoEnv>();
+const app: Hono<HonoEnv> = new Hono<HonoEnv>();
 
 const isProduction = env.NODE_ENV === "production";
 const allowedOrigins = isProduction
-    ? (env.CORS_ORIGINS || env.FRONTEND_URL || "https://yourdomain.com").split(",").map(s => s.trim())
+    ? (() => {
+        const origins = env.CORS_ORIGINS || env.FRONTEND_URL;
+        if (!origins) {
+            throw new Error(
+                "CORS_ORIGINS or FRONTEND_URL must be set in production. " +
+                "Example: CORS_ORIGINS=https://yourdomain.com"
+            );
+        }
+        return origins.split(",").map(s => s.trim());
+    })()
     : [];
 
 app.use("/*", cors({
@@ -54,26 +65,47 @@ async function startServer() {
         functionsDir: path.resolve(__dirname, "../functions"),
         server,
         app,
-        bootstrappers: [
-            createPostgresBootstrapper({
-                connection: db,
-                schema: { tables,
+        database: createPostgresAdapter({
+            connection: db,
+            schema: { tables,
 enums,
 relations },
-                adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
-                connectionString
-            })
-        ],
+            adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
+            connectionString
+        }),
         auth: {
+            collection: usersCollection,
             jwtSecret,
             accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
             refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
             serviceKey: env.REBASE_SERVICE_KEY,
+            // Cookie-based auth: the refresh token is stored in an httpOnly
+            // cookie (not readable by JS) instead of localStorage, so it is
+            // not exposed to XSS. The frontend opts in via
+            // `authFlowMode: "cookie"` on createRebaseClient. Requires CORS
+            // `credentials: true` (set above).
+            cookieAuth: { sameSite: "Lax" },
             google: env.GOOGLE_CLIENT_ID
                 ? { clientId: env.GOOGLE_CLIENT_ID }
                 : undefined,
-            seedDefaultRoles: true,
-            allowRegistration: env.ALLOW_REGISTRATION
+            allowRegistration: env.ALLOW_REGISTRATION,
+            email: env.SMTP_HOST
+                ? {
+                    from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
+                    smtp: {
+                        host: env.SMTP_HOST,
+                        port: env.SMTP_PORT,
+                        secure: env.SMTP_SECURE,
+                        auth: env.SMTP_USER
+                            ? { user: env.SMTP_USER,
+pass: env.SMTP_PASS! }
+                            : undefined,
+                        name: env.SMTP_NAME
+                    },
+                    appName: env.APP_NAME,
+                    resetPasswordUrl: env.FRONTEND_URL
+                }
+                : undefined
         },
         storage: env.STORAGE_TYPE === "s3"
             ? {
@@ -111,7 +143,7 @@ relations },
     if (!isProduction) {
         // Dev mode: retry the next port if the current one is in use
         const projectRoot = path.resolve(__dirname, "../..");
-        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot });
+        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot, serviceKey: env.REBASE_SERVICE_KEY });
 
         // Clean up port file on exit
         const cleanup = () => cleanupDevPortFile(projectRoot);
@@ -127,17 +159,11 @@ relations },
     }
 
     // ─── Graceful Shutdown ───────────────────────────────────────────────
-    // Uses the framework's built-in shutdown() which drains connections,
-    // stops the cron scheduler, and force-exits after 15s timeout.
-    const gracefulShutdown = async (signal: string) => {
-        logger.info(`Received ${signal}, shutting down...`);
-        await backend.shutdown();
-        await pool.end();
-        logger.info("Database pool closed");
-        process.exit(0);
-    };
-    process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
-    process.on("SIGINT", () => gracefulShutdown("SIGINT"));
+    // Drains HTTP, stops crons, tears down realtime, then closes the pool.
+    // Guards against double signals and force-exits if shutdown hangs.
+    installShutdownHandlers(backend, {
+        onCleanup: () => pool.end()
+    });
 }
 
 startServer().catch(err => {

package/templates/template/config/collections/authors.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const authorsCollection: EntityCollection = {
+const authorsCollection: CollectionConfig = {
     name: "Authors",
     singularName: "Author",
     slug: "authors",

package/templates/template/config/collections/index.ts

@@ -1,5 +1,26 @@
-import postsCollection from "./posts";
-import authorsCollection from "./authors";
-import tagsCollection from "./tags";
+import postsCollection from "./posts.js";
+import authorsCollection from "./authors.js";
+import tagsCollection from "./tags.js";
+import usersCollection from "./users.js";
+import type { SecurityRule } from "@rebasepro/types";
 
-export const collections = [postsCollection, authorsCollection, tagsCollection];
+export const collections = [postsCollection, authorsCollection, tagsCollection, usersCollection];
+
+/**
+ * Applied to any collection in this directory that declares no
+ * `securityRules` of its own: anyone can read, only admins can write.
+ *
+ * These live here, next to the collections, because `rebase db push`
+ * generates the Postgres policies from these files — that is what actually
+ * enforces access. A default declared on the server could never reach the
+ * database.
+ *
+ * A collection that declares neither its own rules nor inherits these is
+ * locked by default: admin-only.
+ */
+export const defaultSecurityRules: SecurityRule[] = [
+    { operation: "select",
+access: "public" },
+    { operations: ["insert", "update", "delete"],
+roles: ["admin"] }
+];

package/templates/template/config/collections/posts.ts

@@ -1,8 +1,8 @@
-import { EntityCollection } from "@rebasepro/types";
-import authorsCollection from "./authors";
-import tagsCollection from "./tags";
+import { CollectionConfig } from "@rebasepro/types";
+import authorsCollection from "./authors.js";
+import tagsCollection from "./tags.js";
 
-const postsCollection: EntityCollection = {
+const postsCollection: CollectionConfig = {
     name: "Posts",
     singularName: "Post",
     slug: "posts",
@@ -12,9 +12,7 @@ const postsCollection: EntityCollection = {
         id: {
             name: "ID",
             type: "number",
-            validation: {
-                required: true
-            }
+            isId: "increment"
         },
         title: {
             name: "Title",
@@ -26,7 +24,9 @@ const postsCollection: EntityCollection = {
         content: {
             name: "Content",
             type: "string",
-            multiline: true
+            ui: {
+                markdown: true
+            }
         },
         status: {
             name: "Status",
@@ -52,40 +52,20 @@ const postsCollection: EntityCollection = {
         author: {
             name: "Author",
             type: "relation",
-            relationName: "author",
-            relation: {
-                relationName: "author",
-                cardinality: "one",
-                direction: "owning",
-                target: () => authorsCollection
-            }
-        },
-        tags: {
-            name: "Tags",
-            type: "relation",
-            relationName: "tags",
-            relation: {
-                relationName: "tags",
-                cardinality: "many",
-                direction: "owning",
-                target: () => tagsCollection
-            }
-        }
-    },
-    relations: [
-        {
             relationName: "author",
             target: () => authorsCollection,
             cardinality: "one",
             direction: "owning"
         },
-        {
+        tags: {
+            name: "Tags",
+            type: "relation",
             relationName: "tags",
             target: () => tagsCollection,
             cardinality: "many",
             direction: "owning"
         }
-    ]
+    }
 };
 
 export default postsCollection;

package/templates/template/config/collections/presets/blank/index.ts

@@ -0,0 +1,3 @@
+import usersCollection from "../../users.js";
+
+export const collections = [usersCollection];

package/templates/template/config/collections/presets/ecommerce/categories.ts

@@ -0,0 +1,40 @@
+import { CollectionConfig } from "@rebasepro/types";
+
+const categoriesCollection: CollectionConfig = {
+    name: "Categories",
+    singularName: "Category",
+    slug: "categories",
+    table: "categories",
+    icon: "Category",
+    properties: {
+        id: {
+            name: "ID",
+            type: "number",
+            isId: "increment"
+        },
+        name: {
+            name: "Name",
+            type: "string",
+            validation: { required: true }
+        },
+        slug: {
+            name: "Slug",
+            type: "string",
+            validation: { required: true }
+        },
+        description: {
+            name: "Description",
+            type: "string",
+            ui: {
+                multiline: true
+            }
+        },
+        icon: {
+            name: "Icon",
+            type: "string"
+        }
+    },
+    propertiesOrder: ["id", "name", "slug", "description", "icon"]
+};
+
+export default categoriesCollection;

package/templates/template/config/collections/presets/ecommerce/index.ts

@@ -0,0 +1,6 @@
+import productsCollection from "./products.js";
+import categoriesCollection from "./categories.js";
+import ordersCollection from "./orders.js";
+import usersCollection from "../../users.js";
+
+export const collections = [productsCollection, categoriesCollection, ordersCollection, usersCollection];

package/templates/template/config/collections/presets/ecommerce/orders.ts

@@ -0,0 +1,66 @@
+import { CollectionConfig } from "@rebasepro/types";
+
+const ordersCollection: CollectionConfig = {
+    name: "Orders",
+    singularName: "Order",
+    slug: "orders",
+    table: "orders",
+    icon: "Receipt",
+    properties: {
+        id: {
+            name: "ID",
+            type: "number",
+            isId: "increment"
+        },
+        customerEmail: {
+            name: "Customer Email",
+            type: "string",
+            columnName: "customer_email",
+            validation: { required: true }
+        },
+        status: {
+            name: "Status",
+            type: "string",
+            enum: [
+                { id: "pending",
+label: "Pending",
+color: "gray" },
+                { id: "processing",
+label: "Processing",
+color: "blue" },
+                { id: "shipped",
+label: "Shipped",
+color: "orange" },
+                { id: "delivered",
+label: "Delivered",
+color: "green" },
+                { id: "cancelled",
+label: "Cancelled",
+color: "red" }
+            ]
+        },
+        total: {
+            name: "Total",
+            type: "number",
+            validation: { required: true }
+        },
+        notes: {
+            name: "Notes",
+            type: "string",
+            ui: {
+                multiline: true
+            }
+        },
+        createdAt: {
+            name: "Created At",
+            type: "date",
+            columnName: "created_at",
+            autoValue: "on_create",
+            ui: {
+                readOnly: true
+            }
+        }
+    }
+};
+
+export default ordersCollection;

package/templates/template/config/collections/presets/ecommerce/products.ts

@@ -0,0 +1,64 @@
+import { CollectionConfig } from "@rebasepro/types";
+import categoriesCollection from "./categories.js";
+
+const productsCollection: CollectionConfig = {
+    name: "Products",
+    singularName: "Product",
+    slug: "products",
+    table: "products",
+    icon: "ShoppingCart",
+    properties: {
+        id: {
+            name: "ID",
+            type: "number",
+            isId: "increment"
+        },
+        name: {
+            name: "Name",
+            type: "string",
+            validation: { required: true }
+        },
+        description: {
+            name: "Description",
+            type: "string",
+            ui: {
+                markdown: true
+            }
+        },
+        price: {
+            name: "Price",
+            type: "number",
+            validation: { required: true }
+        },
+        image: {
+            name: "Image",
+            type: "string",
+            storage: { storagePath: "product_images/" }
+        },
+        status: {
+            name: "Status",
+            type: "string",
+            enum: [
+                { id: "draft",
+label: "Draft",
+color: "gray" },
+                { id: "active",
+label: "Active",
+color: "green" },
+                { id: "archived",
+label: "Archived",
+color: "orange" }
+            ]
+        },
+        category: {
+            name: "Category",
+            type: "relation",
+            relationName: "category",
+            target: () => categoriesCollection,
+            cardinality: "one",
+            direction: "owning"
+        }
+    }
+};
+
+export default productsCollection;

package/templates/template/config/collections/tags.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const tagsCollection: EntityCollection = {
+const tagsCollection: CollectionConfig = {
     name: "Tags",
     singularName: "Tag",
     slug: "tags",
@@ -10,9 +10,7 @@ const tagsCollection: EntityCollection = {
         id: {
             name: "ID",
             type: "number",
-            validation: {
-                required: true
-            }
+            isId: "increment"
         },
         name: {
             name: "Tag Name",