@rebasepro/cli 0.13.0 → 0.13.1-canary.g06dbe5b

package/dist/manifest.d.ts

@@ -54,7 +54,22 @@ export declare function manifestExists(projectRoot: string): boolean;
  * available behaviour.
  */
 export declare function loadManifest(projectRoot: string): LoadedManifest;
-/** Write a manifest, with a trailing newline so it plays well with other tools. */
+/**
+ * Write a manifest, with a trailing newline so it plays well with other tools.
+ *
+ * **Every key on disk survives.** This used to emit exactly `$schema`, `rebase`
+ * and `apps`, so a rewrite deleted the rest of the file — and two commands with
+ * no visible relationship to either key rewrite it: `rebase eject` and
+ * `rebase apps init --force`. A repository that had committed
+ * `"telemetry": false` lost its opt-out, and a multi-bucket project lost its
+ * whole `storage` block, in a commit whose stated change was `runtime: custom`.
+ *
+ * So: the caller's manifest wins for what it models, the file supplies the rest.
+ * `storage` and `telemetry` fall back to the file because the callers that
+ * synthesize a manifest (`apps init --force`) cannot know them — they are
+ * authored, not inferred — and unknown top-level keys are copied verbatim
+ * rather than listed, since a hand-listed set loses the next key too.
+ */
 export declare function writeManifest(projectRoot: string, manifest: RebaseProjectManifest): string;
 /** Find the single backend app, if this repository declares one. */
 export declare function findBackendApp(manifest: RebaseProjectManifest): {

package/dist/telemetry/payload.d.ts

@@ -31,7 +31,7 @@
  */
 export declare const TELEMETRY_SCHEMA_VERSION = 1;
 /** The events the CLI reports. Closed set — a name not listed cannot be sent. */
-export type TelemetryEventName = "cli.init" | "cli.dev" | "cli.deploy" | "cli.schema_generate" | "cli.db_push" | "cli.error";
+export type TelemetryEventName = "cli.init" | "cli.dev" | "cli.deploy" | "cli.schema" | "cli.db" | "cli.error";
 /** A single non-free-text value. */
 export type TelemetryValue = string | number | boolean;
 export type TelemetryEvent = {

package/dist/utils/args.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Argument parsing for the commands that take positional arguments.
+ *
+ * Every command in the small group used to parse its own line the same way:
+ * `arg(spec, { argv: rawArgs.slice(4), permissive: true })`, then read `_[0]`
+ * and `_[1]`. Both halves of that are wrong in a way that costs data.
+ *
+ *  - **`permissive: true` turns an unknown flag into a positional.** `arg`
+ *    pushes an undeclared flag into `_` as a bare token, so `_[1]` is whatever
+ *    came second on the line, flag or not. `rebase auth reset-password
+ *    bob@example.com --debug` set Bob's password to the literal `--debug` — and
+ *    `--debug` is what `bin/rebase.js` prints after *every* failure as the thing
+ *    to re-run with, so the single most likely next keystroke after a failed
+ *    reset was the one that reset the account to a two-word string.
+ *  - **`slice(4)` assumes the command words are at fixed indices.** They are
+ *    not: a flag before the command shifts everything, so `rebase --debug auth
+ *    reset-password bob@example.com NewPass1!` read the email as
+ *    `reset-password` and the password as `bob@example.com`.
+ *
+ * So: parse the *whole* line — `rawArgs` is `process.argv` — against a spec
+ * strictly, with no permissive mode. `arg` then consumes every flag wherever it
+ * appears and rejects the ones nobody declared, which leaves `_` holding the
+ * command words followed by the real positionals, in order and at a known
+ * offset. An unrecognised flag becomes an error naming the command's help,
+ * which is the only safe answer: the alternative is guessing that it was meant
+ * as a value.
+ *
+ * `commands/cloud/index.ts` resolves its positionals against its own spec for
+ * the same reason; this is that idea for the commands whose positionals are
+ * credentials rather than resource names.
+ */
+import arg from "arg";
+/**
+ * Flags accepted on top of whatever a command declares.
+ *
+ * `--debug` is read by `bin/rebase.js` off `process.argv` and never by a
+ * command, but it has to be *declared* somewhere or strict parsing rejects the
+ * exact flag the CLI tells people to add. `--help`/`-h` are answered by each
+ * command's dispatcher before any work happens.
+ */
+export declare const GLOBAL_COMMAND_FLAGS: {
+    readonly "--debug": BooleanConstructor;
+    readonly "--help": BooleanConstructor;
+    readonly "-h": "--help";
+};
+export interface ParsedCommand<S extends arg.Spec> {
+    /** The declared flags, as `arg` resolved them. */
+    flags: arg.Result<S>;
+    /** What is left after the command words — never a flag. */
+    positionals: string[];
+    /** `--help` or `-h` appeared anywhere on the line. */
+    help: boolean;
+}
+/** Did the line ask for help? Answered before dispatch, never by a handler. */
+export declare function wantsHelp(rawArgs: string[]): boolean;
+/**
+ * Resolve a command's flags and positionals from the full `process.argv`.
+ *
+ * `commandWords` is how many words name the command itself — 2 for
+ * `auth reset-password`, 1 for `start` — and is applied to the *parsed*
+ * positionals rather than to `argv`, so a flag placed before the command no
+ * longer shifts them.
+ *
+ * `command` names the command in error messages, e.g. `auth reset-password`.
+ *
+ * Throws on an unknown flag, on a positional that looks like a flag, and on
+ * more positionals than the command takes. `bin/rebase.js` turns each into a
+ * one-line `✗ …` and exit 1.
+ */
+export declare function parseCommandArgs<S extends arg.Spec>({ spec, rawArgs, commandWords, command, maxPositionals }: {
+    spec: S;
+    rawArgs: string[];
+    commandWords: number;
+    command: string;
+    maxPositionals?: number;
+}): ParsedCommand<S>;

package/dist/utils/collection-drift.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Would `loadCollectionsFromDirectory` load this file?
+ *
+ * Mirrors that loader's own `isCollectionFile` plus its flat (non-recursive)
+ * scan. `relativePath` is relative to the collections directory, as `fs.watch`
+ * reports it.
+ */
+export declare function isLoadedCollectionFile(relativePath: string): boolean;
+/**
+ * Does this collection source declare anything a SQL toolchain would own?
+ *
+ * The fallback order matches `resolveDataSource`: an explicit `engine` wins,
+ * and a collection that only names a `dataSource` is resolved as if the key
+ * were the engine — which is what that function does when no registry is
+ * available, and the CLI has none. An engine nobody recognises counts as
+ * relational, for the reason `isRelationalCollection` gives.
+ *
+ * A file declaring several collections is SQL-affecting if *any* of them is.
+ */
+export declare function declaresRelationalCollection(rawSource: string): boolean;
+/**
+ * Can this edit have changed the generated SQL schema?
+ *
+ * Answers `true` when it cannot tell — an unreadable file is a reason to warn,
+ * not a reason to go quiet.
+ */
+export declare function affectsSqlSchema(collectionsDir: string, relativePath: string): boolean;

package/dist/utils/project.d.ts

@@ -34,6 +34,26 @@ export declare function findFrontendDir(projectRoot: string): string | null;
  * Find the .env file. Checks the project root first, then backend.
  */
 export declare function findEnvFile(projectRoot: string): string | null;
+/**
+ * Read the project's `.env` into a plain object.
+ *
+ * One reader, because there were four: `dotenv` in `start`, a hand-rolled
+ * `indexOf("=")` loop in `api-keys`, a single-key regex in `auth`, and its own
+ * splitting in `cloud env`. `dotenv` is a declared dependency of this package,
+ * so the other three existed for no reason and disagreed with the correct one
+ * on the two things people actually write in a `.env`:
+ *
+ *   - `export KEY=value`, which the hand-rolled parser keyed as
+ *     `export KEY` — so the command reported the key as unset while it was
+ *     right there in the file;
+ *   - `KEY=value # comment`, whose comment travelled into the value and then
+ *     into an `Authorization` header, coming back as a 401 with nothing
+ *     pointing at the cause.
+ *
+ * Returns `{}` when the project has no `.env`, so callers can treat "absent"
+ * and "empty" alike.
+ */
+export declare function readEnvFile(projectRoot: string): Record<string, string>;
 /**
  * Resolve a binary from the project's node_modules/.bin.
  * Checks backend, root, parent monorepo root, then falls back to PATH.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.13.0",
+  "version": "0.13.1-canary.g06dbe5b",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.13.0",
-    "@rebasepro/client": "0.13.0",
-    "@rebasepro/codegen": "0.13.0",
-    "@rebasepro/types": "0.13.0",
-    "@rebasepro/server": "0.13.0",
-    "@rebasepro/server-postgres": "0.13.0"
+    "@rebasepro/agent-skills": "0.13.1-canary.g06dbe5b",
+    "@rebasepro/client": "0.13.1-canary.g06dbe5b",
+    "@rebasepro/codegen": "0.13.1-canary.g06dbe5b",
+    "@rebasepro/server-postgres": "0.13.1-canary.g06dbe5b",
+    "@rebasepro/server": "0.13.1-canary.g06dbe5b",
+    "@rebasepro/types": "0.13.1-canary.g06dbe5b"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

package/templates/eject/Dockerfile

@@ -7,7 +7,12 @@
 # not reach this project.
 #
 # Assumes pnpm, which is what `rebase init` scaffolds a workspace for. On npm,
-# swap the three pnpm lines below for `npm ci` and `npm run build --workspace`.
+# every line below that mentions pnpm has to change — the `pnpm install` and
+# `pnpm --filter … run build` lines become `npm ci` and
+# `npm run build --workspace <package>`, `CMD ["pnpm", "start"]` becomes
+# `CMD ["npm", "start"]`, and the two `COPY` lines that name `pnpm-lock.yaml`
+# and `pnpm-workspace.yaml` have to name `package-lock.json` instead. Those
+# COPYs fail first, before any of the build lines runs.
 #
 # Build context: the project root (where pnpm-workspace.yaml lives)
 # Usage:
@@ -33,15 +38,31 @@ WORKDIR /app
 # Copy workspace root files first (cache-friendly layer)
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
 
-# Copy workspace packages
+# Copy workspace packages. Every workspace the lockfile has an importer for,
+# so `--frozen-lockfile` below sees the same set of packages it was written from.
 COPY backend ./backend
 COPY config ./config
+# {{#frontend}}
+COPY frontend ./frontend
+# {{/frontend}}
+
+# The entrypoint reads rebase.json at boot — it is where this project declares
+# its storage buckets, so that the platform, the console and this process all
+# read one list. An image without it boots believing nothing was declared, and
+# every upload lands in the wrong bucket or 501s.
+COPY rebase.json ./
 
 # Install all deps (including devDependencies for build)
 RUN pnpm install --frozen-lockfile
 
-# Build config first, then backend
+# Build config first, then the rest: both the frontend and the backend import it.
 RUN pnpm --filter "*-config" run build
+# {{#frontend}}
+# The image serves the built site itself (see the `serveSPA` call in
+# backend/src/index.ts), so the frontend is built here rather than deployed
+# separately. Vite reads no API URL: same origin, same container.
+RUN pnpm --filter "*-frontend" run build
+# {{/frontend}}
 RUN pnpm --filter "*-backend" run build
 
 # Prune dev dependencies for a smaller runtime
@@ -63,10 +84,14 @@ RUN addgroup -g 1001 rebase && adduser -u 1001 -G rebase -s /bin/sh -D rebase
 WORKDIR /app
 
 # Copy only production artifacts
-COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/.npmrc ./
+COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/.npmrc /app/rebase.json ./
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/backend ./backend
 COPY --from=builder /app/config ./config
+# {{#frontend}}
+# The built site only — its sources and devDependencies stay in the builder.
+COPY --from=builder /app/frontend/dist ./frontend/dist
+# {{/frontend}}
 
 # Create uploads directory
 RUN mkdir -p /app/backend/uploads && chown -R rebase:rebase /app

package/templates/eject/backend/src/index.ts

@@ -3,12 +3,15 @@ import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
 import { createServer } from "http";
+import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import {
     initializeRebaseBackend,
     installShutdownHandlers,
+    // {{#frontend}}
     serveSPA,
+    // {{/frontend}}
     HonoEnv,
     listenWithPortRetry,
     cleanupDevPortFile,
@@ -17,10 +20,14 @@ import {
     logger
 } from "@rebasepro/server";
 import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
+// {{#collections}}
 import { enums, relations, tables } from "./schema.generated.js";
+// {{/collections}}
 import { storageAuthorize } from "../../config/storage.js";
 import { env } from "./env.js";
+// {{#collections}}
 import usersCollection from "../../config/collections/users.js";
+// {{/collections}}
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -86,21 +93,44 @@ async function startServer() {
     const PORT = env.PORT;
     const server = createServer(getRequestListener(app.fetch));
 
+    // `backend/crons` holds the scheduled jobs — nightly backups among them.
+    // Passed only when the directory exists, because a configured `cronsDir`
+    // with nothing in it mounts the cron routes and warns at every boot.
+    // Sibling-relative like `functionsDir`: both compile alongside this file, so
+    // the same path is right from source and from `backend/dist/backend/src`.
+    const cronsDir = path.resolve(__dirname, "../crons");
+
     const backend = await initializeRebaseBackend({
+        // {{#collections}}
         collectionsDir: path.resolve(__dirname, "../../config/collections"),
+        // {{/collections}}
+        // {{^collections}}
+        // No `collectionsDir`: this project declares no collections in code, so
+        // the server derives them from the live database schema at boot —
+        // exactly what the managed runtime did for it.
+        // {{/collections}}
         functionsDir: path.resolve(__dirname, "../functions"),
+        cronsDir: fs.existsSync(cronsDir) ? cronsDir : undefined,
         server,
         app,
         database: createPostgresAdapter({
             connection: db,
+            // {{#collections}}
             schema: { tables,
 enums,
 relations },
+            // {{/collections}}
             adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
             connectionString
         }),
         auth: {
+            // {{#collections}}
             collection: usersCollection,
+            // {{/collections}}
+            // {{^collections}}
+            // No users collection is declared here, so auth falls back to its
+            // own default users table — the same fallback a headless bundle gets.
+            // {{/collections}}
             jwtSecret,
             accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
             refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
@@ -173,9 +203,13 @@ pass: env.SMTP_PASS! }
     //
     // `requireAuth` answers 401 without a valid token; `requireAdmin` answers
     // 403 without the `admin` role and must follow `requireAuth`. Note that
-    // `c.get("driver")` — the RLS-scoped driver — is only set inside the Rebase
-    // routers, so out here reach for `rebase.dataAsAdmin`, which **bypasses
-    // RLS** and therefore belongs behind one of those guards.
+    // `c.get("driver")` — the driver carrying the caller's identity — is only
+    // set inside the Rebase routers, so out here reach for
+    // `rebase.dataAsAdmin`. That one is **admin-scoped, not an RLS bypass**: it
+    // runs as `{ uid: "service", roles: ["admin"] }` and your policies still
+    // apply, evaluated against that identity — which is exactly an admin's
+    // reach, and therefore belongs behind one of those guards. (`rebase.sql()`
+    // is the real bypass: owner connection, no policies.)
 
     // ─── Health check ─────────────────────────────────────────────
     // Deliberately public: an orchestrator's probe has no token to send.
@@ -189,10 +223,20 @@ pass: env.SMTP_PASS! }
         }, status);
     });
 
-    // Serve the frontend in production
+    // {{#frontend}}
+    // Serve the frontend in production.
+    //
+    // Four levels up, not two: in production this file runs compiled, from
+    // `backend/dist/backend/src`. The paths above are the same in both modes
+    // because `config/` is compiled alongside this file; `frontend/dist` is not
+    // in the compiled tree at all, so it stays where the repository put it.
+    // `serveSPA` only warns when the path is wrong, which is why the Dockerfile
+    // that builds this image also copies `frontend` — verify a mount by
+    // fetching `/`, never by reading the log.
     if (isProduction) {
-        serveSPA(app, { frontendPath: path.join(__dirname, "../../frontend/dist") });
+        serveSPA(app, { frontendPath: path.resolve(__dirname, "../../../../frontend/dist") });
     }
+    // {{/frontend}}
 
     if (!isProduction) {
         // Dev mode: retry the next port if the current one is in use

package/templates/eject/docker-compose.custom.yml

@@ -25,7 +25,7 @@ services:
     image: postgres:18-alpine
     restart: unless-stopped
     environment:
-      POSTGRES_USER: rebase
+      POSTGRES_USER: rebase_app
       POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-changeme}
       POSTGRES_DB: rebase
     ports:
@@ -33,7 +33,7 @@ services:
     volumes:
       - postgres_data:/var/lib/postgresql
     healthcheck:
-      test: ["CMD-SHELL", "pg_isready -U rebase -d rebase"]
+      test: ["CMD-SHELL", "pg_isready -U rebase_app -d rebase"]
       interval: 5s
       timeout: 5s
       retries: 10
@@ -48,12 +48,20 @@ services:
       - "${PORT:-3001}:3001"
     env_file: .env
     environment:
-      DATABASE_URL: postgresql://rebase:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
-      ADMIN_CONNECTION_STRING: postgresql://rebase:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
+      DATABASE_URL: postgresql://rebase_app:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
+      ADMIN_CONNECTION_STRING: postgresql://rebase_app:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
       NODE_ENV: production
       PORT: "3001"
+      # {{#frontend}}
       # Your entrypoint serves the built frontend itself (see the `serveSPA`
-      # call in backend/src/index.ts), so this is one container, same origin.
+      # call in backend/src/index.ts, and the frontend build stage in the
+      # Dockerfile), so this is one container, same origin.
+      # {{/frontend}}
+      # {{^frontend}}
+      # This image serves the API only — there is no frontend workspace in this
+      # project — so CORS_ORIGINS has to list the origins your clients are
+      # served from.
+      # {{/frontend}}
       CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS to the origin you browse to}
       # A durable named volume, which is the case this flag acknowledges.
       STORAGE_PATH: /uploads

package/templates/overlays/baas/backend/tsconfig.json

@@ -21,5 +21,10 @@
   //
   // No `rootDir`: it would have to be `.` for both, and letting tsc infer the
   // common root gets there without a second place to keep in sync.
-  "include": ["src/**/*", "functions/**/*"]
+  //
+  // `crons/` too: `rebase build` compiles it through a generated tsconfig, but
+  // an ejected project builds with *this* file, so leaving it out meant an
+  // ejected server had no compiled jobs to load and silently stopped running
+  // every schedule.
+  "include": ["src/**/*", "functions/**/*", "crons/**/*"]
 }

package/templates/template/.env.example

@@ -10,7 +10,7 @@
 # sslmode=disable matches the local docker-compose database, which has no TLS;
 # schema tooling (atlas) would otherwise default to requiring SSL. Remove it
 # when pointing at a managed/cloud database.
-DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
+DATABASE_URL=postgresql://rebase_app:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 # DATABASE_URL=mongodb://localhost:27017/rebase
 #
 # Seeing "SSL is not enabled on the server"? Something in your environment
@@ -22,7 +22,7 @@ DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20sea
 # downgrade SSL for you when you have asked for it, not even on localhost:
 # quietly ignoring a security setting is worse than a clear failure. To opt out
 # explicitly for a local database, say so:
-#   DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
+#   DATABASE_URL=postgresql://rebase_app:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 
 # Separate admin connection string for migrations and schema operations (optional)
 # Falls back to DATABASE_URL if not set
@@ -77,9 +77,18 @@ FRONTEND_URL=http://localhost:5173
 # GOOGLE_CLIENT_ID=
 
 # ── Frontend (Vite) ──────────────────────────────────────────────────────────
-# For production builds. In dev, `rebase dev` injects the backend port it
+# Leave this EMPTY unless your API lives on a different origin than the site.
+#
+# Empty means "same origin as the page", which is what a deployed build wants:
+# the frontend is served by the backend it talks to, and a same-origin bundle
+# keeps working when you add a custom domain. A value here is baked in at BUILD
+# time — `vite build` reads this file (frontend/vite.config.ts sets
+# `envDir: ".."`), so a stray `http://localhost:3001` follows the bundle into
+# production and points every request at the machine that ran the build.
+#
+# In dev you need nothing here either: `rebase dev` injects the backend port it
 # actually bound, overriding this — see the PORT note above.
-VITE_API_URL=http://localhost:3001
+VITE_API_URL=
 # VITE_GOOGLE_CLIENT_ID=
 
 # ── Storage ───────────────────────────────────────────────────────────────────

package/templates/template/backend/functions/hello.ts

@@ -30,10 +30,14 @@ import { defineFunction, requireAuth, requireAdmin } from "@rebasepro/server";
  * slot over `app.use("/*", requireAuth)`: `use()` only covers routes declared
  * *below* it, so a route appended later above it is silently unprotected.
  *
- * `rebase.dataAsAdmin` gives you admin-level access to your data and
- * **bypasses RLS** — use it only for trusted admin work. For request-scoped /
- * RLS-scoped data access, use c.get("user") and c.get("driver"), which carry
- * the caller's identity. (`rebase` also exposes auth, storage, email.)
+ * `rebase.dataAsAdmin` gives you admin-level access to your data: it runs as
+ * `{ uid: "service", roles: ["admin"] }`, which is **admin-scoped, not an RLS
+ * bypass** — your policies are still evaluated, just against that identity. So
+ * `policy.serverContext()` is false for it (that arm means "no uid at all"),
+ * and anything an `admin` user can reach, it can reach too. For request-scoped
+ * data access use c.get("user") and c.get("driver"), which carry the caller's
+ * identity. `rebase.sql()` is the real bypass — owner connection, no policies.
+ * (`rebase` also exposes auth, storage, email.)
  */
 export default defineFunction((app, { rebase }) => {
     void rebase; // available for dataAsAdmin/auth/storage/email — see commented usage below

package/templates/template/backend/tsconfig.json

@@ -36,5 +36,10 @@
   // unnoticed until runtime. The inferred common root is already the project
   // root because of `../config`, so this adds no `rootDir` and moves nothing
   // that dist/ already contains.
-  "include": ["src/**/*", "functions/**/*", "../config/**/*", "drizzle.config.ts"]
+  //
+  // `crons/` for the same reason, and for one more: `rebase build` compiles it
+  // through a generated tsconfig, but an ejected project builds with *this*
+  // file — so leaving crons out meant an ejected server had no compiled jobs to
+  // load and stopped running every schedule, nightly backups included.
+  "include": ["src/**/*", "functions/**/*", "crons/**/*", "../config/**/*", "drizzle.config.ts"]
 }

package/templates/template/config/package.json

@@ -16,6 +16,7 @@
     "@rebasepro/types": "workspace:*"
   },
   "devDependencies": {
+    "@types/node": "^20.19.41",
     "typescript": "^5.9.2"
   },
   "exports": {

package/templates/template/docker-compose.yml

@@ -33,7 +33,7 @@ services:
     image: postgres:18-alpine
     restart: unless-stopped
     environment:
-      POSTGRES_USER: rebase
+      POSTGRES_USER: rebase_app
       POSTGRES_PASSWORD: ${DATABASE_PASSWORD:-changeme}
       POSTGRES_DB: rebase
     # Published so `rebase db push` can reach it from the host. Remove this
@@ -47,7 +47,7 @@ services:
       # The runtime must not start before the database can answer, or its first
       # boot fails on a connection refused and the container restarts for no
       # reason a reader would understand.
-      test: ["CMD-SHELL", "pg_isready -U rebase -d rebase"]
+      test: ["CMD-SHELL", "pg_isready -U rebase_app -d rebase"]
       interval: 5s
       timeout: 5s
       retries: 10
@@ -75,8 +75,8 @@ services:
     ports:
       - "${PORT:-3001}:3001"
     environment:
-      DATABASE_URL: postgresql://rebase:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
-      ADMIN_CONNECTION_STRING: postgresql://rebase:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
+      DATABASE_URL: postgresql://rebase_app:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
+      ADMIN_CONNECTION_STRING: postgresql://rebase_app:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
       JWT_SECRET: ${JWT_SECRET:?set JWT_SECRET in .env — `rebase init` generates one}
       REBASE_SERVICE_KEY: ${REBASE_SERVICE_KEY:?set REBASE_SERVICE_KEY in .env — `rebase init` generates one}
       NODE_ENV: production