@rebasepro/cli 0.10.1-canary.8650626 → 0.10.1-canary.8d27c46

package/dist/bundle.d.ts

@@ -20,6 +20,24 @@ export interface BuildBundleResult {
     manifest: RebaseBundleManifest;
     collectionCount: number;
 }
+/**
+ * Whether the compiled config package exports a `storageAuthorize` hook.
+ *
+ * Recorded in the manifest so a host can refuse a deploy that would enable file
+ * storage with no access model, rather than let the runtime's boot guard turn it
+ * into a crash loop the developer cannot read.
+ *
+ * Read from the *compiled* index, deliberately: that is the exact module the
+ * runtime imports and reads the export off, so this cannot disagree with what
+ * actually happens at boot. It is a textual check rather than an import because
+ * a freshly built bundle cannot resolve its own dependencies until it is
+ * deployed — the same reason schema hashing reads source.
+ *
+ * Errs toward `false`: a missed detection costs a deploy rejection whose message
+ * says exactly how to proceed, while a false positive would hand back the crash
+ * loop this exists to prevent.
+ */
+export declare function detectStorageAuthorize(compiledConfigDir: string): boolean;
 /**
  * Detect native code in the dependency closure.
  *
@@ -80,6 +98,41 @@ export declare function buildBundle(options: BuildBundleOptions): Promise<BuildB
  * manifest — no compilation, no dependency closure (a static bundle installs
  * nothing at boot).
  */
+/**
+ * Fold a built static app into a backend bundle, so one runtime serves both.
+ *
+ * ## Why this exists
+ *
+ * A managed tenant runs one pod, and `bootFromBundle` on the backend path already
+ * knows how to serve a SPA — it looks for `entry.static` and mounts `serveSPA`
+ * last, behind `REBASE_SERVE_STATIC`. What was missing was anything putting the
+ * assets there.
+ *
+ * The consequence was not subtle. A project whose custom image served its website
+ * at `/` and its API at `/api` — the shape the scaffolded template produces — lost
+ * the website the moment it moved to the managed runtime: the API answered
+ * perfectly and every page 404'd. Managed could not be a drop-in replacement for
+ * custom while the frontend simply vanished.
+ *
+ * Folding restores parity with the container it replaces, which is the only
+ * honest baseline. It is deliberately the FIRST implementation and not the last:
+ * a static app on its own bucket behind a CDN is better for cache behaviour and
+ * lets the frontend deploy independently. But that needs infrastructure that does
+ * not exist yet, and "your site is gone" is not an acceptable state to leave a
+ * project in while it gets built.
+ *
+ * The trade it makes, stated plainly: frontend and backend now deploy together
+ * and the bundle carries the built assets. For a project that was shipping both
+ * in one image already, that is exactly what it had.
+ */
+export declare function foldStaticIntoBundle(options: {
+    /** The backend bundle directory, already written. */
+    bundleDir: string;
+    /** Directory of built frontend assets (the static app's `output`). */
+    assetsDir: string;
+}): {
+    fileCount: number;
+};
 export declare function buildStaticBundle(options: {
     projectRoot: string;
     appName: string;

package/dist/commands/cloud/bundle-deploy.d.ts

@@ -23,6 +23,31 @@ export declare function bundleDeployBody(input: {
     manifest: RebaseBundleManifest;
     app?: string;
     message?: string;
+    /**
+     * Every app this repository declares in `rebase.json`, so the platform can
+     * register the whole set rather than only the one being deployed.
+     */
+    declaredApps?: DeclaredApp[];
 }): Record<string, unknown>;
+/** An app as `rebase.json` declares it, reduced to what the registry stores. */
+export interface DeclaredApp {
+    name: string;
+    type: string;
+}
+/**
+ * The apps a project manifest declares.
+ *
+ * A deploy only ever ships ONE app's bundle, so the trigger alone could never
+ * tell the platform that the repository also contains a web frontend and an
+ * admin panel — and the Apps page, whose whole job is to show the set, listed a
+ * single entry called "backend". Sending the declared set fixes that without
+ * pretending the others are deployed: the platform registers them, and their
+ * status says what is actually true.
+ */
+export declare function declaredAppsFrom(manifest: {
+    apps?: Record<string, {
+        type?: string;
+    }>;
+} | null | undefined): DeclaredApp[];
 /** Upload a bundle archive; returns the control-plane bundle id. */
 export declare function uploadBundle(url: string, token: string, projectId: string, tarPath: string): Promise<string>;

package/dist/fold-static.d.ts

@@ -0,0 +1,46 @@
+/** The apps section of a project manifest, as much of it as folding needs. */
+export interface FoldableManifest {
+    apps?: Record<string, {
+        type?: string;
+        build?: string;
+        output?: string;
+    }>;
+}
+export interface FoldOptions {
+    projectRoot: string;
+    manifest: FoldableManifest;
+    /** The backend bundle directory, already written. */
+    bundleDir: string;
+    /** Skip running the app's own build command; fold what is already built. */
+    skipBuild?: boolean;
+    log?: (message: string) => void;
+}
+export interface FoldOutcome {
+    appName: string;
+    fileCount: number;
+}
+/**
+ * Which static app, if any, should be served by the backend.
+ *
+ * Exactly one `static` app is folded. With several, folding would have to choose,
+ * and silently picking one of two websites is worse than doing nothing — so it
+ * declines and names what it saw. Pure, so the decision is testable without a
+ * filesystem.
+ */
+export declare function selectFoldableApp(manifest: FoldableManifest): {
+    app?: {
+        name: string;
+        build?: string;
+        output?: string;
+    };
+    /** Why nothing will be folded, when that is the answer. */
+    reason?: string;
+};
+/**
+ * Build the project's frontend and fold it into the backend bundle.
+ *
+ * Throws rather than exiting, so the caller decides whether a missing frontend
+ * should fail its command — a `build` may reasonably want to stop, and so should
+ * a deploy, but that is not this function's call to make.
+ */
+export declare function foldFrontendIntoBundle(options: FoldOptions): Promise<FoldOutcome | null>;

package/dist/index.es.js

@@ -2981,6 +2981,43 @@ async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck)
 	return tsconfigPath;
 }
 /**
+* Whether the compiled config package exports a `storageAuthorize` hook.
+*
+* Recorded in the manifest so a host can refuse a deploy that would enable file
+* storage with no access model, rather than let the runtime's boot guard turn it
+* into a crash loop the developer cannot read.
+*
+* Read from the *compiled* index, deliberately: that is the exact module the
+* runtime imports and reads the export off, so this cannot disagree with what
+* actually happens at boot. It is a textual check rather than an import because
+* a freshly built bundle cannot resolve its own dependencies until it is
+* deployed — the same reason schema hashing reads source.
+*
+* Errs toward `false`: a missed detection costs a deploy rejection whose message
+* says exactly how to proceed, while a false positive would hand back the crash
+* loop this exists to prevent.
+*/
+function detectStorageAuthorize(compiledConfigDir) {
+	const indexPath = [
+		".js",
+		".mjs",
+		".ts"
+	].map((ext) => path.join(compiledConfigDir, `index${ext}`)).find((candidate) => fs.existsSync(candidate));
+	if (!indexPath) return false;
+	let source;
+	try {
+		source = fs.readFileSync(indexPath, "utf8");
+	} catch {
+		return false;
+	}
+	if (/\bexport\s+(?:async\s+)?(?:const|let|var|function)\s+storageAuthorize\b/.test(source)) return true;
+	for (const clause of source.matchAll(/\bexport\s*\{([^}]*)\}/g)) if (clause[1].split(",").map((entry) => {
+		const parts = entry.split(/\bas\b/);
+		return parts[parts.length - 1].trim();
+	}).includes("storageAuthorize")) return true;
+	return false;
+}
+/**
 * Detect native code in the dependency closure.
 *
 * Walks declared runtime dependencies breadth-first through `node_modules`,
@@ -3297,6 +3334,7 @@ async function buildBundle(options) {
 	}
 	const declared = collectDeclaredDependencies(projectRoot);
 	const nativeModules = detectNativeDependencies(projectRoot, declared);
+	const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));
 	const schemaOut = paths.schema.replace(/\.ts$/, ".js");
 	const relative = (target) => fs.existsSync(path.join(outDir, target)) ? target : void 0;
 	const manifest = {
@@ -3322,6 +3360,7 @@ async function buildBundle(options) {
 			native: nativeModules.length > 0,
 			nativeModules: nativeModules.length > 0 ? nativeModules : void 0
 		},
+		storage: { authorize: declaresStorageAuthorize },
 		deps: { declared },
 		build: {
 			cli: resolveCliVersion(),
@@ -3356,6 +3395,59 @@ async function buildBundle(options) {
 * manifest — no compilation, no dependency closure (a static bundle installs
 * nothing at boot).
 */
+/**
+* Fold a built static app into a backend bundle, so one runtime serves both.
+*
+* ## Why this exists
+*
+* A managed tenant runs one pod, and `bootFromBundle` on the backend path already
+* knows how to serve a SPA — it looks for `entry.static` and mounts `serveSPA`
+* last, behind `REBASE_SERVE_STATIC`. What was missing was anything putting the
+* assets there.
+*
+* The consequence was not subtle. A project whose custom image served its website
+* at `/` and its API at `/api` — the shape the scaffolded template produces — lost
+* the website the moment it moved to the managed runtime: the API answered
+* perfectly and every page 404'd. Managed could not be a drop-in replacement for
+* custom while the frontend simply vanished.
+*
+* Folding restores parity with the container it replaces, which is the only
+* honest baseline. It is deliberately the FIRST implementation and not the last:
+* a static app on its own bucket behind a CDN is better for cache behaviour and
+* lets the frontend deploy independently. But that needs infrastructure that does
+* not exist yet, and "your site is gone" is not an acceptable state to leave a
+* project in while it gets built.
+*
+* The trade it makes, stated plainly: frontend and backend now deploy together
+* and the bundle carries the built assets. For a project that was shipping both
+* in one image already, that is exactly what it had.
+*/
+function foldStaticIntoBundle(options) {
+	const { bundleDir, assetsDir } = options;
+	const manifestPath = path.join(bundleDir, "manifest.json");
+	if (!fs.existsSync(manifestPath)) throw new Error(`No manifest at ${manifestPath} — build the backend bundle first.`);
+	if (!fs.existsSync(assetsDir)) throw new Error(`No built assets at ${assetsDir}.`);
+	const staticOut = path.join(bundleDir, "static");
+	fs.rmSync(staticOut, {
+		recursive: true,
+		force: true
+	});
+	fs.mkdirSync(staticOut, { recursive: true });
+	fs.cpSync(assetsDir, staticOut, { recursive: true });
+	let fileCount = 0;
+	const count = (dir) => {
+		for (const entry of fs.readdirSync(dir, { withFileTypes: true })) if (entry.isDirectory()) count(path.join(dir, entry.name));
+		else fileCount++;
+	};
+	count(staticOut);
+	const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	manifest.entry = {
+		...manifest.entry,
+		static: "static"
+	};
+	fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 2)}\n`, "utf8");
+	return { fileCount };
+}
 function buildStaticBundle(options) {
 	const { projectRoot, appName, assetsDir, outDir, runtimeRange } = options;
 	cleanOutDir(projectRoot, outDir);
@@ -3478,6 +3570,76 @@ function resolveCliVersion() {
 	return "unknown";
 }
 //#endregion
+//#region src/fold-static.ts
+/**
+* Folding a project's frontend into its backend bundle.
+*
+* Shared by `rebase build` and `rebase cloud deploy` deliberately. It lived in
+* the build *command* first, and `deploy` rebuilds the bundle itself — so a
+* deploy silently produced a bundle without the frontend, packed 164 KB where
+* 39 MB was expected, and the site 404'd on the managed runtime exactly as if
+* folding had never been written. Two callers building the same artefact must
+* share the step that completes it.
+*
+* Why fold at all: `bootFromBundle` already serves a SPA from `entry.static`
+* behind `REBASE_SERVE_STATIC` (default on). A managed tenant runs one pod, so
+* putting the built site in the bundle gives it the shape a custom container
+* already had — site at `/`, API at `/api` — which is the only honest baseline
+* for calling the managed runtime a drop-in replacement.
+*/
+/**
+* Which static app, if any, should be served by the backend.
+*
+* Exactly one `static` app is folded. With several, folding would have to choose,
+* and silently picking one of two websites is worse than doing nothing — so it
+* declines and names what it saw. Pure, so the decision is testable without a
+* filesystem.
+*/
+function selectFoldableApp(manifest) {
+	const statics = Object.entries(manifest.apps ?? {}).filter(([, app]) => app?.type === "static").map(([name, app]) => ({
+		name,
+		build: app?.build,
+		output: app?.output
+	}));
+	if (statics.length === 0) return {};
+	if (statics.length > 1) return { reason: `${statics.length} static apps (${statics.map((s) => s.name).join(", ")}) — none folded in. Pick one to serve from the backend, or host them separately.` };
+	const only = statics[0];
+	if (!only.output) return { reason: `"${only.name}" declares no output directory — not folded in.` };
+	return { app: only };
+}
+/**
+* Build the project's frontend and fold it into the backend bundle.
+*
+* Throws rather than exiting, so the caller decides whether a missing frontend
+* should fail its command — a `build` may reasonably want to stop, and so should
+* a deploy, but that is not this function's call to make.
+*/
+async function foldFrontendIntoBundle(options) {
+	const { projectRoot, manifest, bundleDir, skipBuild } = options;
+	const log = options.log ?? ((m) => console.log(m));
+	const { app, reason } = selectFoldableApp(manifest);
+	if (reason) {
+		log(chalk.yellow(`    ⚠ ${reason}`));
+		return null;
+	}
+	if (!app) return null;
+	if (app.build && !skipBuild) await execa(app.build, {
+		cwd: projectRoot,
+		stdio: "inherit",
+		shell: true
+	});
+	const assetsDir = path.join(projectRoot, app.output);
+	if (!fs.existsSync(assetsDir)) throw new Error(`"${app.name}" declared output "${app.output}" does not exist after building — the bundle would ship without a frontend.`);
+	const { fileCount } = foldStaticIntoBundle({
+		bundleDir,
+		assetsDir
+	});
+	return {
+		appName: app.name,
+		fileCount
+	};
+}
+//#endregion
 //#region src/commands/build.ts
 /**
 * CLI command: rebase build [app...]
@@ -3518,6 +3680,8 @@ async function buildCommand(rawArgs = []) {
 		"--out": String,
 		"--skip-type-check": Boolean,
 		"--skip-schema": Boolean,
+		"--no-static": Boolean,
+		"--skip-static-build": Boolean,
 		"--legacy": Boolean,
 		"--help": Boolean,
 		"-h": "--help"
@@ -3588,6 +3752,19 @@ async function buildCommand(rawArgs = []) {
 				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
 				console.log(chalk.dim("      These cannot run on the managed runtime. See `rebase doctor`."));
 			}
+			if (!args["--no-static"]) {
+				const folded = await foldFrontendIntoBundle({
+					projectRoot,
+					manifest,
+					bundleDir: result.outDir,
+					skipBuild: args["--skip-static-build"] === true,
+					log: (m) => console.log(m)
+				}).catch((err) => {
+					console.error(chalk.red(`    ✗ ${err instanceof Error ? err.message : String(err)}`));
+					process.exit(1);
+				});
+				if (folded) console.log(chalk.green(`    ✓ ${folded.appName} folded in`) + chalk.dim(` (${folded.fileCount} file(s) → served at /)`));
+			}
 		} else if (app.type === "static" || app.type === "admin") await buildAssetApp(projectRoot, name, app, manifest.runtime, args["--out"]);
 		else if (app.type === "custom") console.log(chalk.dim("  custom container — built at deploy time from its Dockerfile"));
 		console.log("");
@@ -4732,7 +4909,7 @@ async function linkCommand(rawArgs) {
 			})).data;
 			if (projects.length === 0) fail("No projects found for your account.", `Create one with ${chalk.bold("rebase cloud projects create")}.`);
 			const { picked } = await inquirer.prompt([{
-				type: "list",
+				type: "select",
 				name: "picked",
 				message: "Select a project to link:",
 				choices: projects.map((p) => ({
@@ -4776,7 +4953,7 @@ async function selectOrgCommand(rawArgs) {
 		let chosen = target ? orgs.find((o) => String(o.id) === target || o.slug === target) : void 0;
 		if (!chosen && !target) {
 			const { picked } = await inquirer.prompt([{
-				type: "list",
+				type: "select",
 				name: "picked",
 				message: "Select the active organization:",
 				choices: orgs.map((o) => ({
@@ -5053,6 +5230,7 @@ function packBundle(bundleDir, outPath) {
 		const child = spawn("tar", [
 			"-czf",
 			outPath,
+			"--no-xattrs",
 			"--exclude",
 			"node_modules",
 			"-C",
@@ -5084,9 +5262,28 @@ function bundleDeployBody(input) {
 		app: input.app ?? input.manifest.app ?? "backend",
 		client: "cli",
 		frameworkVersion: input.manifest.runtime?.builtAgainst,
+		...input.declaredApps?.length ? { declaredApps: input.declaredApps } : {},
 		...input.message ? { message: input.message } : {}
 	};
 }
+/**
+* The apps a project manifest declares.
+*
+* A deploy only ever ships ONE app's bundle, so the trigger alone could never
+* tell the platform that the repository also contains a web frontend and an
+* admin panel — and the Apps page, whose whole job is to show the set, listed a
+* single entry called "backend". Sending the declared set fixes that without
+* pretending the others are deployed: the platform registers them, and their
+* status says what is actually true.
+*/
+function declaredAppsFrom(manifest) {
+	const apps = manifest?.apps;
+	if (!apps || typeof apps !== "object") return [];
+	return Object.entries(apps).filter(([name]) => name.trim().length > 0).map(([name, value]) => ({
+		name,
+		type: String(value?.type ?? "custom")
+	}));
+}
 /** Upload a bundle archive; returns the control-plane bundle id. */
 async function uploadBundle(url, token, projectId, tarPath) {
 	const bytes = fs.readFileSync(tarPath);
@@ -5238,6 +5435,17 @@ async function deployBundle(opts) {
 			runtimeRange: loaded.manifest.runtime,
 			log: (m) => console.log(chalk.gray(m))
 		})).outDir;
+		try {
+			const folded = await foldFrontendIntoBundle({
+				projectRoot,
+				manifest: loaded.manifest,
+				bundleDir,
+				log: (m) => console.log(m)
+			});
+			if (folded) console.log(chalk.gray(`  folded ${folded.appName} in (${folded.fileCount} file(s), served at /)`));
+		} catch (err) {
+			fail(err instanceof Error ? err.message : String(err), "Fix the frontend build, or pass --no-static to deploy the API alone.");
+		}
 	}
 	const manifest = readBundleManifest(bundleDir);
 	if (manifest.hooks?.native) {
@@ -5261,11 +5469,16 @@ async function deployBundle(opts) {
 	}
 	console.log("");
 	console.log(`  🚀 Triggering managed deployment for ${chalk.bold(projectRef)} (schema ${manifest.schemaVersion})...`);
+	let declaredApps = [];
+	try {
+		declaredApps = declaredAppsFrom(loadManifest(process.cwd()).manifest);
+	} catch {}
 	const body = bundleDeployBody({
 		projectId,
 		bundleId,
 		manifest,
-		message: opts.message
+		message: opts.message,
+		declaredApps
 	});
 	try {
 		const res = await client.functions.invoke("deploy", body);
@@ -5688,7 +5901,7 @@ async function createDatabase(rawArgs) {
 	let type = args["--type"];
 	if (!type) {
 		const { picked } = await inquirer.prompt([{
-			type: "list",
+			type: "select",
 			name: "picked",
 			message: "Database type:",
 			choices: [{
@@ -8926,6 +9139,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, devCommand, doctorCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map