@rebasepro/cli 0.11.1-canary.g8caabf3 → 0.11.1-canary.g95e61c2

package/dist/bundle.d.ts

@@ -1,4 +1,4 @@
-import { type NativeDependency, type RebaseBundleManifest, type RebaseBackendAppConfig } from "@rebasepro/types";
+import { type DeclaredStorageSources, type NativeDependency, type RebaseBundleManifest, type RebaseBackendAppConfig } from "@rebasepro/types";
 export declare const DEFAULT_BUNDLE_DIR = "dist-bundle";
 export interface BuildBundleOptions {
     projectRoot: string;
@@ -8,6 +8,13 @@ export interface BuildBundleOptions {
     outDir?: string;
     /** Runtime range from the manifest, recorded for compatibility checks. */
     runtimeRange: string;
+    /**
+     * The `storage` block of `rebase.json` — which buckets this project uses.
+     *
+     * Passed in rather than re-read here so `rebase.json` is parsed and validated
+     * once, by the command that owns it.
+     */
+    storage?: DeclaredStorageSources;
     /** Skip type checking. Faster, and strictly worse — for iteration only. */
     skipTypeCheck?: boolean;
     /** Skip regenerating the Drizzle schema from the collections. */
@@ -37,7 +44,7 @@ export interface BuildBundleResult {
  * says exactly how to proceed, while a false positive would hand back the crash
  * loop this exists to prevent.
  */
-export declare function detectStorageAuthorize(compiledConfigDir: string): boolean;
+export declare function detectStorageAuthorize(compiledConfigDir: string, depth?: number): boolean;
 /**
  * Detect native code in the dependency closure.
  *

package/dist/index.es.js

@@ -12,7 +12,7 @@ import crypto from "crypto";
 import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
-import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections } from "@rebasepro/types";
+import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, normalizeStorageSources, storageEnvSuffix } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
 import { createRequire } from "module";
 //#region src/utils/package-manager.ts
@@ -2338,17 +2338,90 @@ function validateManifest(raw) {
 		}
 		byPath.set(at, name);
 	}
+	const storage = validateStorageSources(raw.storage, issues);
 	if (issues.length > 0) return { issues };
 	return {
 		manifest: {
 			$schema: typeof raw.$schema === "string" ? raw.$schema : void 0,
 			rebase: raw.rebase,
-			apps
+			apps,
+			...storage ? { storage } : {}
 		},
 		issues
 	};
 }
 /**
+* Validate the `storage` block — which buckets this project uses.
+*
+* Absent means one default source, so `undefined` is a valid answer and not an
+* issue. Everything else is checked strictly, because each key here becomes the
+* suffix of a set of environment variables: a key that cannot become a variable
+* name, or two keys that become the *same* one, are failures worth catching
+* while someone is looking at the file rather than at a tenant serving one
+* bucket's files with another's credentials.
+*/
+function validateStorageSources(raw, issues) {
+	if (raw === void 0) return void 0;
+	if (!isRecord(raw)) {
+		issues.push({
+			path: "storage",
+			message: "must be an object keyed by storage source name"
+		});
+		return;
+	}
+	const sources = {};
+	for (const [key, value] of Object.entries(raw)) {
+		if (!isRecord(value)) {
+			issues.push({
+				path: `storage.${key}`,
+				message: "must be an object"
+			});
+			continue;
+		}
+		if (typeof value.engine !== "string" || value.engine.trim() === "") {
+			issues.push({
+				path: `storage.${key}.engine`,
+				message: "is required, e.g. \"s3\", \"gcs\" or \"local\""
+			});
+			continue;
+		}
+		if (value.transport !== void 0 && value.transport !== "server" && value.transport !== "direct") {
+			issues.push({
+				path: `storage.${key}.transport`,
+				message: "must be \"server\" or \"direct\""
+			});
+			continue;
+		}
+		if (value.label !== void 0 && typeof value.label !== "string") {
+			issues.push({
+				path: `storage.${key}.label`,
+				message: "must be a string"
+			});
+			continue;
+		}
+		try {
+			storageEnvSuffix(key);
+		} catch {
+			issues.push({
+				path: `storage.${key}`,
+				message: "name cannot become an environment variable suffix — use a name containing at least one letter or digit"
+			});
+			continue;
+		}
+		sources[key] = {
+			engine: value.engine,
+			...value.transport !== void 0 ? { transport: value.transport } : {},
+			...value.label !== void 0 ? { label: value.label } : {}
+		};
+	}
+	const collision = findStorageSuffixCollision(Object.keys(sources));
+	if (collision) issues.push({
+		path: `storage.${collision.b}`,
+		message: `maps to the same environment variable suffix ("${collision.suffix || "(none)"}") as "${collision.a}", so the two would read each other's configuration — rename one of them`
+	});
+	return Object.keys(sources).length > 0 ? sources : void 0;
+}
+/**
 * Infer a manifest from a directory that does not have one.
 *
 * This mirrors exactly what the template scaffolds, which is what makes adopting
@@ -3185,16 +3258,27 @@ async function writeBundleTsconfig(projectRoot, outDir, includes, skipTypeCheck)
 * says exactly how to proceed, while a false positive would hand back the crash
 * loop this exists to prevent.
 */
-function detectStorageAuthorize(compiledConfigDir) {
+function detectStorageAuthorize(compiledConfigDir, depth = 0) {
 	const indexPath = [
 		".js",
 		".mjs",
 		".ts"
 	].map((ext) => path.join(compiledConfigDir, `index${ext}`)).find((candidate) => fs.existsSync(candidate));
 	if (!indexPath) return false;
+	return moduleExportsStorageAuthorize(indexPath, depth);
+}
+/**
+* Whether one compiled module re-exports or defines `storageAuthorize`.
+*
+* Split out from {@link detectStorageAuthorize} so a wildcard re-export can be
+* followed. `export * from "./storage.js"` is an ordinary way to write a config
+* barrel, and treating it as "no hook" rejected deploys that were correct — with
+* a message telling the developer to add a hook they had already written.
+*/
+function moduleExportsStorageAuthorize(modulePath, depth) {
 	let source;
 	try {
-		source = fs.readFileSync(indexPath, "utf8");
+		source = fs.readFileSync(modulePath, "utf8");
 	} catch {
 		return false;
 	}
@@ -3203,9 +3287,48 @@ function detectStorageAuthorize(compiledConfigDir) {
 		const parts = entry.split(/\bas\b/);
 		return parts[parts.length - 1].trim();
 	}).includes("storageAuthorize")) return true;
+	if (depth < 3) for (const clause of source.matchAll(/\bexport\s*\*\s*from\s*["']([^"']+)["']/g)) {
+		const specifier = clause[1];
+		if (!specifier.startsWith(".")) continue;
+		const resolved = resolveRelativeModule(path.dirname(modulePath), specifier);
+		if (resolved && moduleExportsStorageAuthorize(resolved, depth + 1)) return true;
+	}
 	return false;
 }
 /**
+* Resolve a relative ESM specifier to a file on disk.
+*
+* Compiled output carries explicit `.js` extensions, but the same function reads
+* TypeScript sources during a source boot, where the specifier may be
+* extensionless or point at a directory index.
+*/
+function resolveRelativeModule(fromDir, specifier) {
+	const base = path.resolve(fromDir, specifier);
+	const candidates = [
+		base,
+		`${base}.js`,
+		`${base}.mjs`,
+		`${base}.ts`,
+		path.join(base, "index.js"),
+		path.join(base, "index.mjs"),
+		path.join(base, "index.ts")
+	];
+	for (const candidate of candidates) try {
+		if (fs.existsSync(candidate) && fs.statSync(candidate).isFile()) return candidate;
+	} catch {
+		continue;
+	}
+	if (/\.js$/.test(base)) {
+		const asTs = base.replace(/\.js$/, ".ts");
+		try {
+			if (fs.existsSync(asTs) && fs.statSync(asTs).isFile()) return asTs;
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+/**
 * Detect native code in the dependency closure.
 *
 * Walks declared runtime dependencies breadth-first through `node_modules`,
@@ -3559,6 +3682,9 @@ async function buildBundle(options) {
 	const declared = collectDeclaredDependencies(projectRoot);
 	const nativeModules = detectNativeDependencies(projectRoot, declared);
 	const declaresStorageAuthorize = detectStorageAuthorize(path.join(outDir, paths.config));
+	const storageSources = normalizeStorageSources(options.storage, void 0);
+	const collision = findStorageSuffixCollision(storageSources.map((s) => s.key));
+	if (collision) throw new Error(`Storage sources "${collision.a}" and "${collision.b}" in rebase.json both map to the environment variable suffix "${collision.suffix || "(none)"}", so they would read each other's configuration. Rename one of them.`);
 	const schemaOut = paths.schema.replace(/\.ts$/, ".js");
 	const relative = (target) => fs.existsSync(path.join(outDir, target)) ? target : void 0;
 	const manifest = {
@@ -3584,7 +3710,10 @@ async function buildBundle(options) {
 			native: nativeModules.length > 0,
 			nativeModules: nativeModules.length > 0 ? nativeModules : void 0
 		},
-		storage: { authorize: declaresStorageAuthorize },
+		storage: {
+			authorize: declaresStorageAuthorize,
+			...storageSources.length > 0 ? { sources: storageSources } : {}
+		},
 		deps: { declared },
 		build: {
 			cli: resolveCliVersion(),
@@ -4040,6 +4169,7 @@ async function buildCommand(rawArgs = []) {
 				app,
 				outDir: args["--out"],
 				runtimeRange: manifest.rebase,
+				storage: manifest.storage,
 				skipTypeCheck: args["--skip-type-check"],
 				skipSchema: args["--skip-schema"]
 			});
@@ -5976,6 +6106,7 @@ async function deployBundle(opts) {
 			appName: backend.name,
 			app: backend.app,
 			runtimeRange: loaded.manifest.rebase,
+			storage: loaded.manifest.storage,
 			skipTypeCheck: opts.skipTypeCheck,
 			log: (m) => console.log(chalk.gray(m))
 		})).outDir;