@rebasepro/cli 0.13.1-canary.gf57a27e → 0.14.0

package/dist/manifest.d.ts

@@ -54,7 +54,22 @@ export declare function manifestExists(projectRoot: string): boolean;
  * available behaviour.
  */
 export declare function loadManifest(projectRoot: string): LoadedManifest;
-/** Write a manifest, with a trailing newline so it plays well with other tools. */
+/**
+ * Write a manifest, with a trailing newline so it plays well with other tools.
+ *
+ * **Every key on disk survives.** This used to emit exactly `$schema`, `rebase`
+ * and `apps`, so a rewrite deleted the rest of the file — and two commands with
+ * no visible relationship to either key rewrite it: `rebase eject` and
+ * `rebase apps init --force`. A repository that had committed
+ * `"telemetry": false` lost its opt-out, and a multi-bucket project lost its
+ * whole `storage` block, in a commit whose stated change was `runtime: custom`.
+ *
+ * So: the caller's manifest wins for what it models, the file supplies the rest.
+ * `storage` and `telemetry` fall back to the file because the callers that
+ * synthesize a manifest (`apps init --force`) cannot know them — they are
+ * authored, not inferred — and unknown top-level keys are copied verbatim
+ * rather than listed, since a hand-listed set loses the next key too.
+ */
 export declare function writeManifest(projectRoot: string, manifest: RebaseProjectManifest): string;
 /** Find the single backend app, if this repository declares one. */
 export declare function findBackendApp(manifest: RebaseProjectManifest): {

package/dist/utils/args.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Argument parsing for the commands that take positional arguments.
+ *
+ * Every command in the small group used to parse its own line the same way:
+ * `arg(spec, { argv: rawArgs.slice(4), permissive: true })`, then read `_[0]`
+ * and `_[1]`. Both halves of that are wrong in a way that costs data.
+ *
+ *  - **`permissive: true` turns an unknown flag into a positional.** `arg`
+ *    pushes an undeclared flag into `_` as a bare token, so `_[1]` is whatever
+ *    came second on the line, flag or not. `rebase auth reset-password
+ *    bob@example.com --debug` set Bob's password to the literal `--debug` — and
+ *    `--debug` is what `bin/rebase.js` prints after *every* failure as the thing
+ *    to re-run with, so the single most likely next keystroke after a failed
+ *    reset was the one that reset the account to a two-word string.
+ *  - **`slice(4)` assumes the command words are at fixed indices.** They are
+ *    not: a flag before the command shifts everything, so `rebase --debug auth
+ *    reset-password bob@example.com NewPass1!` read the email as
+ *    `reset-password` and the password as `bob@example.com`.
+ *
+ * So: parse the *whole* line — `rawArgs` is `process.argv` — against a spec
+ * strictly, with no permissive mode. `arg` then consumes every flag wherever it
+ * appears and rejects the ones nobody declared, which leaves `_` holding the
+ * command words followed by the real positionals, in order and at a known
+ * offset. An unrecognised flag becomes an error naming the command's help,
+ * which is the only safe answer: the alternative is guessing that it was meant
+ * as a value.
+ *
+ * `commands/cloud/index.ts` resolves its positionals against its own spec for
+ * the same reason; this is that idea for the commands whose positionals are
+ * credentials rather than resource names.
+ */
+import arg from "arg";
+/**
+ * Flags accepted on top of whatever a command declares.
+ *
+ * `--debug` is read by `bin/rebase.js` off `process.argv` and never by a
+ * command, but it has to be *declared* somewhere or strict parsing rejects the
+ * exact flag the CLI tells people to add. `--help`/`-h` are answered by each
+ * command's dispatcher before any work happens.
+ */
+export declare const GLOBAL_COMMAND_FLAGS: {
+    readonly "--debug": BooleanConstructor;
+    readonly "--help": BooleanConstructor;
+    readonly "-h": "--help";
+};
+export interface ParsedCommand<S extends arg.Spec> {
+    /** The declared flags, as `arg` resolved them. */
+    flags: arg.Result<S>;
+    /** What is left after the command words — never a flag. */
+    positionals: string[];
+    /** `--help` or `-h` appeared anywhere on the line. */
+    help: boolean;
+}
+/** Did the line ask for help? Answered before dispatch, never by a handler. */
+export declare function wantsHelp(rawArgs: string[]): boolean;
+/**
+ * Resolve a command's flags and positionals from the full `process.argv`.
+ *
+ * `commandWords` is how many words name the command itself — 2 for
+ * `auth reset-password`, 1 for `start` — and is applied to the *parsed*
+ * positionals rather than to `argv`, so a flag placed before the command no
+ * longer shifts them.
+ *
+ * `command` names the command in error messages, e.g. `auth reset-password`.
+ *
+ * Throws on an unknown flag, on a positional that looks like a flag, and on
+ * more positionals than the command takes. `bin/rebase.js` turns each into a
+ * one-line `✗ …` and exit 1.
+ */
+export declare function parseCommandArgs<S extends arg.Spec>({ spec, rawArgs, commandWords, command, maxPositionals }: {
+    spec: S;
+    rawArgs: string[];
+    commandWords: number;
+    command: string;
+    maxPositionals?: number;
+}): ParsedCommand<S>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.13.1-canary.gf57a27e",
+  "version": "0.14.0",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.13.1-canary.gf57a27e",
-    "@rebasepro/client": "0.13.1-canary.gf57a27e",
-    "@rebasepro/codegen": "0.13.1-canary.gf57a27e",
-    "@rebasepro/server": "0.13.1-canary.gf57a27e",
-    "@rebasepro/server-postgres": "0.13.1-canary.gf57a27e",
-    "@rebasepro/types": "0.13.1-canary.gf57a27e"
+    "@rebasepro/agent-skills": "0.14.0",
+    "@rebasepro/server": "0.14.0",
+    "@rebasepro/codegen": "0.14.0",
+    "@rebasepro/client": "0.14.0",
+    "@rebasepro/server-postgres": "0.14.0",
+    "@rebasepro/types": "0.14.0"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

package/templates/eject/Dockerfile

@@ -7,7 +7,12 @@
 # not reach this project.
 #
 # Assumes pnpm, which is what `rebase init` scaffolds a workspace for. On npm,
-# swap the three pnpm lines below for `npm ci` and `npm run build --workspace`.
+# every line below that mentions pnpm has to change — the `pnpm install` and
+# `pnpm --filter … run build` lines become `npm ci` and
+# `npm run build --workspace <package>`, `CMD ["pnpm", "start"]` becomes
+# `CMD ["npm", "start"]`, and the two `COPY` lines that name `pnpm-lock.yaml`
+# and `pnpm-workspace.yaml` have to name `package-lock.json` instead. Those
+# COPYs fail first, before any of the build lines runs.
 #
 # Build context: the project root (where pnpm-workspace.yaml lives)
 # Usage:
@@ -33,15 +38,31 @@ WORKDIR /app
 # Copy workspace root files first (cache-friendly layer)
 COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
 
-# Copy workspace packages
+# Copy workspace packages. Every workspace the lockfile has an importer for,
+# so `--frozen-lockfile` below sees the same set of packages it was written from.
 COPY backend ./backend
 COPY config ./config
+# {{#frontend}}
+COPY frontend ./frontend
+# {{/frontend}}
+
+# The entrypoint reads rebase.json at boot — it is where this project declares
+# its storage buckets, so that the platform, the console and this process all
+# read one list. An image without it boots believing nothing was declared, and
+# every upload lands in the wrong bucket or 501s.
+COPY rebase.json ./
 
 # Install all deps (including devDependencies for build)
 RUN pnpm install --frozen-lockfile
 
-# Build config first, then backend
+# Build config first, then the rest: both the frontend and the backend import it.
 RUN pnpm --filter "*-config" run build
+# {{#frontend}}
+# The image serves the built site itself (see the `serveSPA` call in
+# backend/src/index.ts), so the frontend is built here rather than deployed
+# separately. Vite reads no API URL: same origin, same container.
+RUN pnpm --filter "*-frontend" run build
+# {{/frontend}}
 RUN pnpm --filter "*-backend" run build
 
 # Prune dev dependencies for a smaller runtime
@@ -63,10 +84,14 @@ RUN addgroup -g 1001 rebase && adduser -u 1001 -G rebase -s /bin/sh -D rebase
 WORKDIR /app
 
 # Copy only production artifacts
-COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/.npmrc ./
+COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/.npmrc /app/rebase.json ./
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/backend ./backend
 COPY --from=builder /app/config ./config
+# {{#frontend}}
+# The built site only — its sources and devDependencies stay in the builder.
+COPY --from=builder /app/frontend/dist ./frontend/dist
+# {{/frontend}}
 
 # Create uploads directory
 RUN mkdir -p /app/backend/uploads && chown -R rebase:rebase /app

package/templates/eject/backend/src/index.ts

@@ -1,14 +1,17 @@
-import { Hono } from "hono";
+import { Hono, type Context } from "hono";
 import { cors } from "hono/cors";
 import { secureHeaders } from "hono/secure-headers";
 import { getRequestListener } from "@hono/node-server";
 import { createServer } from "http";
+import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import {
     initializeRebaseBackend,
     installShutdownHandlers,
+    // {{#frontend}}
     serveSPA,
+    // {{/frontend}}
     HonoEnv,
     listenWithPortRetry,
     cleanupDevPortFile,
@@ -17,10 +20,14 @@ import {
     logger
 } from "@rebasepro/server";
 import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
+// {{#collections}}
 import { enums, relations, tables } from "./schema.generated.js";
+// {{/collections}}
 import { storageAuthorize } from "../../config/storage.js";
 import { env } from "./env.js";
+// {{#collections}}
 import usersCollection from "../../config/collections/users.js";
+// {{/collections}}
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -86,21 +93,44 @@ async function startServer() {
     const PORT = env.PORT;
     const server = createServer(getRequestListener(app.fetch));
 
+    // `backend/crons` holds the scheduled jobs — nightly backups among them.
+    // Passed only when the directory exists, because a configured `cronsDir`
+    // with nothing in it mounts the cron routes and warns at every boot.
+    // Sibling-relative like `functionsDir`: both compile alongside this file, so
+    // the same path is right from source and from `backend/dist/backend/src`.
+    const cronsDir = path.resolve(__dirname, "../crons");
+
     const backend = await initializeRebaseBackend({
+        // {{#collections}}
         collectionsDir: path.resolve(__dirname, "../../config/collections"),
+        // {{/collections}}
+        // {{^collections}}
+        // No `collectionsDir`: this project declares no collections in code, so
+        // the server derives them from the live database schema at boot —
+        // exactly what the managed runtime did for it.
+        // {{/collections}}
         functionsDir: path.resolve(__dirname, "../functions"),
+        cronsDir: fs.existsSync(cronsDir) ? cronsDir : undefined,
         server,
         app,
         database: createPostgresAdapter({
             connection: db,
+            // {{#collections}}
             schema: { tables,
 enums,
 relations },
+            // {{/collections}}
             adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
             connectionString
         }),
         auth: {
+            // {{#collections}}
             collection: usersCollection,
+            // {{/collections}}
+            // {{^collections}}
+            // No users collection is declared here, so auth falls back to its
+            // own default users table — the same fallback a headless bundle gets.
+            // {{/collections}}
             jwtSecret,
             accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
             refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
@@ -173,13 +203,23 @@ pass: env.SMTP_PASS! }
     //
     // `requireAuth` answers 401 without a valid token; `requireAdmin` answers
     // 403 without the `admin` role and must follow `requireAuth`. Note that
-    // `c.get("driver")` — the RLS-scoped driver — is only set inside the Rebase
-    // routers, so out here reach for `rebase.dataAsAdmin`, which **bypasses
-    // RLS** and therefore belongs behind one of those guards.
+    // `c.get("driver")` — the driver carrying the caller's identity — is only
+    // set inside the Rebase routers, so out here reach for
+    // `rebase.dataAsAdmin`. That one is **admin-scoped, not an RLS bypass**: it
+    // runs as `{ uid: "service", roles: ["admin"] }` and your policies still
+    // apply, evaluated against that identity — which is exactly an admin's
+    // reach, and therefore belongs behind one of those guards. (`rebase.sql()`
+    // is the real bypass: owner connection, no policies.)
 
     // ─── Health check ─────────────────────────────────────────────
     // Deliberately public: an orchestrator's probe has no token to send.
-    app.get("/health", async (c) => {
+    //
+    // Answered on both paths. `/health` is what an orchestrator probes and what
+    // the generated `docker-compose.yml` already points at, so it stays.
+    // `/api/health` is where a developer looks first, because every other route
+    // this server has is under `/api` — and a reverse proxy that forwards only
+    // `/api` to the backend can reach nothing else.
+    const healthCheck = async (c: Context<HonoEnv>) => {
         const result = await backend.healthCheck();
         const status = result.healthy ? 200 : 503;
         return c.json({
@@ -187,12 +227,24 @@ pass: env.SMTP_PASS! }
             latencyMs: result.latencyMs,
             ...(result.details ? { details: result.details } : {})
         }, status);
-    });
+    };
+    app.get("/health", healthCheck);
+    app.get("/api/health", healthCheck);
 
-    // Serve the frontend in production
+    // {{#frontend}}
+    // Serve the frontend in production.
+    //
+    // Four levels up, not two: in production this file runs compiled, from
+    // `backend/dist/backend/src`. The paths above are the same in both modes
+    // because `config/` is compiled alongside this file; `frontend/dist` is not
+    // in the compiled tree at all, so it stays where the repository put it.
+    // `serveSPA` only warns when the path is wrong, which is why the Dockerfile
+    // that builds this image also copies `frontend` — verify a mount by
+    // fetching `/`, never by reading the log.
     if (isProduction) {
-        serveSPA(app, { frontendPath: path.join(__dirname, "../../frontend/dist") });
+        serveSPA(app, { frontendPath: path.resolve(__dirname, "../../../../frontend/dist") });
     }
+    // {{/frontend}}
 
     if (!isProduction) {
         // Dev mode: retry the next port if the current one is in use

package/templates/eject/docker-compose.custom.yml

@@ -52,8 +52,16 @@ services:
       ADMIN_CONNECTION_STRING: postgresql://rebase_app:${DATABASE_PASSWORD:-changeme}@db:5432/rebase?options=-c%20search_path=public
       NODE_ENV: production
       PORT: "3001"
+      # {{#frontend}}
       # Your entrypoint serves the built frontend itself (see the `serveSPA`
-      # call in backend/src/index.ts), so this is one container, same origin.
+      # call in backend/src/index.ts, and the frontend build stage in the
+      # Dockerfile), so this is one container, same origin.
+      # {{/frontend}}
+      # {{^frontend}}
+      # This image serves the API only — there is no frontend workspace in this
+      # project — so CORS_ORIGINS has to list the origins your clients are
+      # served from.
+      # {{/frontend}}
       CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS to the origin you browse to}
       # A durable named volume, which is the case this flag acknowledges.
       STORAGE_PATH: /uploads

package/templates/overlays/baas/backend/tsconfig.json

@@ -21,5 +21,10 @@
   //
   // No `rootDir`: it would have to be `.` for both, and letting tsc infer the
   // common root gets there without a second place to keep in sync.
-  "include": ["src/**/*", "functions/**/*"]
+  //
+  // `crons/` too: `rebase build` compiles it through a generated tsconfig, but
+  // an ejected project builds with *this* file, so leaving it out meant an
+  // ejected server had no compiled jobs to load and silently stopped running
+  // every schedule.
+  "include": ["src/**/*", "functions/**/*", "crons/**/*"]
 }

package/templates/overlays/baas/config/index.ts

@@ -10,6 +10,15 @@
  * a deployment with file storage enabled serves every user's files to every
  * signed-in user. The server refuses to boot in that state, and this is the
  * export it looks for.
+ *
+ * It depends on `@rebasepro/common` for one thing: `defineCollection`, which
+ * `rebase schema introspect` writes its output against. A plain
+ * `const x: PostgresCollectionConfig = { … }` annotation widens the property
+ * keys to `string`, so nothing checks the keys named elsewhere in the config —
+ * and the keys an introspected collection has are precisely the ones nobody
+ * typed and nobody remembers. `common` is the headless half of the pair: the
+ * same key inference the admin layer's builder gives a CMS project, with no
+ * admin surface and no React.
  */
 
 export { storageAuthorize } from "./storage.js";

package/templates/overlays/baas/config/package.json

@@ -12,6 +12,7 @@
     "clean": "rm -rf dist"
   },
   "dependencies": {
+    "@rebasepro/common": "workspace:*",
     "@rebasepro/types": "workspace:*"
   },
   "devDependencies": {

package/templates/template/backend/functions/hello.ts

@@ -30,10 +30,14 @@ import { defineFunction, requireAuth, requireAdmin } from "@rebasepro/server";
  * slot over `app.use("/*", requireAuth)`: `use()` only covers routes declared
  * *below* it, so a route appended later above it is silently unprotected.
  *
- * `rebase.dataAsAdmin` gives you admin-level access to your data and
- * **bypasses RLS** — use it only for trusted admin work. For request-scoped /
- * RLS-scoped data access, use c.get("user") and c.get("driver"), which carry
- * the caller's identity. (`rebase` also exposes auth, storage, email.)
+ * `rebase.dataAsAdmin` gives you admin-level access to your data: it runs as
+ * `{ uid: "service", roles: ["admin"] }`, which is **admin-scoped, not an RLS
+ * bypass** — your policies are still evaluated, just against that identity. So
+ * `policy.serverContext()` is false for it (that arm means "no uid at all"),
+ * and anything an `admin` user can reach, it can reach too. For request-scoped
+ * data access use c.get("user") and c.get("driver"), which carry the caller's
+ * identity. `rebase.sql()` is the real bypass — owner connection, no policies.
+ * (`rebase` also exposes auth, storage, email.)
  */
 export default defineFunction((app, { rebase }) => {
     void rebase; // available for dataAsAdmin/auth/storage/email — see commented usage below

package/templates/template/backend/tsconfig.json

@@ -36,5 +36,10 @@
   // unnoticed until runtime. The inferred common root is already the project
   // root because of `../config`, so this adds no `rootDir` and moves nothing
   // that dist/ already contains.
-  "include": ["src/**/*", "functions/**/*", "../config/**/*", "drizzle.config.ts"]
+  //
+  // `crons/` for the same reason, and for one more: `rebase build` compiles it
+  // through a generated tsconfig, but an ejected project builds with *this*
+  // file — so leaving crons out meant an ejected server had no compiled jobs to
+  // load and stopped running every schedule, nightly backups included.
+  "include": ["src/**/*", "functions/**/*", "crons/**/*", "../config/**/*", "drizzle.config.ts"]
 }

package/templates/template/frontend/vite.config.ts

@@ -36,7 +36,28 @@ export default defineConfig({
         rollupOptions: {
             output: {
                 manualChunks(id) {
-                    // Heavy vendor libraries — split into individually cached chunks
+                    // Heavy vendor libraries — split into individually cached chunks.
+                    //
+                    // A name here says these modules travel TOGETHER. It does not
+                    // say they travel late: a chunk becomes a static dependency of
+                    // the entry — and so a `modulepreload` in index.html — the
+                    // moment any one module in it is statically reachable. Naming
+                    // a library that is only partly lazy therefore drags the lazy
+                    // part onto the critical path. Read the two exceptions below
+                    // before adding a line.
+
+                    // @rollup/plugin-commonjs emits its shared helpers as two
+                    // virtual modules ("\0commonjsHelpers.js" and
+                    // "\0commonjs-dynamic-modules") that every CommonJS
+                    // dependency reaches, the entry's included. They match no
+                    // rule below, so Rollup parks them in one of the chunks
+                    // that use them — and it chose `vendor-exceljs`, which
+                    // meant the entry statically imported 940 kB of
+                    // spreadsheet reader to get a ten-line `require` shim.
+                    // Give the helpers a chunk of their own so they can never
+                    // anchor a heavy one to the critical path.
+                    if (id.includes("commonjsHelpers") || id.includes("commonjs-dynamic-modules")) return "vendor-commonjs-helpers";
+
                     if (id.includes("exceljs")) return "vendor-exceljs";
                     if (id.includes("prosemirror")) return "vendor-prosemirror";
                     if (id.includes("monaco-editor") || id.includes("@monaco-editor")) return "vendor-monaco";
@@ -45,6 +66,10 @@ export default defineConfig({
                     if (id.includes("prism-react-renderer")) return "vendor-prism";
                     if (id.includes("markdown-it")) return "vendor-markdown";
                     if (id.includes("react-dropzone")) return "vendor-dropzone";
+                    // date-fns core only. The ~77 locales are imported one at a
+                    // time by the admin's date preview; sharing a chunk name with
+                    // the core would make all of them eager again.
+                    if (id.includes("date-fns/locale")) return undefined;
                     if (id.includes("date-fns")) return "vendor-datefns";
                     if (id.includes("fuse.js")) return "vendor-fuse";
                     if (id.includes("node_modules/react-dom/")) return "vendor-react-dom";
@@ -56,7 +81,13 @@ export default defineConfig({
                     if (id.includes("node_modules/@floating-ui/")) return "vendor-floating-ui";
                     if (id.includes("node_modules/tailwind-merge/")) return "vendor-tailwind-merge";
                     if (id.includes("node_modules/notistack/")) return "vendor-notistack";
-                    if (id.includes("node_modules/lucide-react/")) return "vendor-lucide-react";
+
+                    // lucide-react has no line on purpose. The ~130 icons the
+                    // chrome imports by name are static; the by-name lookup map
+                    // is fetched on demand. One chunk name cannot hold both apart,
+                    // and naming it welded 822 kB of icons into the preload set.
+                    // Left to Rollup, the named icons land in the entry and the
+                    // map gets its own async chunk.
 
                     return undefined;
                 }