@rebasepro/cli 0.21.0 → 0.21.1

package/dist/manifest.d.ts

@@ -41,7 +41,7 @@ export declare function validateManifest(raw: unknown): {
  * else. It used to be inferred from the presence of `backend/src/index.ts`,
  * which every scaffolded project had whether or not it wanted its own server, so
  * projects predating the manifest silently landed on the custom runtime and paid
- * for it (see `docs/plans/cloud-deploy-workspace-vendoring.md`).
+ * for it.
  */
 export declare function synthesizeManifest(projectRoot: string): RebaseProjectManifest;
 export declare function manifestPath(projectRoot: string): string;

package/dist/upgrade.d.ts

@@ -0,0 +1,145 @@
+/** The dependency blocks a pin is moved in. `peerDependencies` is not one. */
+export declare const PIN_FIELDS: readonly ["dependencies", "devDependencies", "optionalDependencies"];
+export type PinField = typeof PIN_FIELDS[number];
+/** Every framework package lives under this scope. */
+export declare const FRAMEWORK_SCOPE = "@rebasepro/";
+/** The package whose published versions stand for the release as a whole. */
+export declare const RELEASE_PACKAGE = "@rebasepro/cli";
+/** Whether `value` is one exact version — `0.21.0`, `0.21.1-canary.g8c5a265`. */
+export declare function isExactVersion(value: string): boolean;
+/** An error that carries the `--json` envelope's code and a remedy. */
+export declare class UpgradeError extends Error {
+    readonly code: string;
+    readonly hint?: string | undefined;
+    constructor(message: string, code: string, hint?: string | undefined);
+}
+export type SpecClass = 
+/** A plain version, optionally `^` or `~`: moved, keeping the prefix. */
+{
+    kind: "movable";
+    prefix: "" | "^" | "~";
+    version: string;
+}
+/** A path on this machine. As a pin it is left alone; as an override it wins over every pin. */
+ | {
+    kind: "local";
+    protocol: "link:" | "file:" | "portal:";
+}
+/** Anything else, with the reason it is left alone. */
+ | {
+    kind: "other";
+    reason: string;
+};
+/**
+ * What a dependency spec is, as far as moving it goes.
+ *
+ * Only a plain version is moved, because only a plain version has an obvious
+ * answer: `^0.19.1` becomes `^0.21.0`. A `>=` floor, a `||` union or a partial
+ * `^0.19` could each be rewritten several ways, and a tag or a workspace link
+ * already means something other than "this release" — so each is reported with
+ * its reason and left as written.
+ */
+export declare function classifySpec(spec: string): SpecClass;
+/**
+ * The `@rebasepro/*` package an override key targets, or null.
+ *
+ * pnpm and npm key an override by name, optionally narrowed: `@rebasepro/x@<1`,
+ * `parent>@rebasepro/x`; yarn's `resolutions` by a path, `**\/@rebasepro/x`. The
+ * target is the last segment either way.
+ */
+export declare function overrideTarget(key: string): string | null;
+export interface ProjectFiles {
+    /** Absolute paths, in a stable order. */
+    packageJsons: string[];
+    workspaceYamls: string[];
+}
+/** Every `package.json` and `pnpm-workspace.yaml` under the project root. */
+export declare function discoverProjectFiles(projectRoot: string): ProjectFiles;
+export interface ChangedPin {
+    /** Relative to the project root, POSIX separators. */
+    file: string;
+    name: string;
+    field: PinField;
+    from: string;
+    to: string;
+}
+export interface SkippedSpec {
+    file: string;
+    name: string;
+    /** A dependency block, or the override block the entry sits in. */
+    field: string;
+    spec: string;
+    reason: string;
+}
+export type OverrideAction = "bumped" | "kept-local" | "removed-local";
+export interface OverrideFinding {
+    file: string;
+    /** The override key as written — `@rebasepro/types`, or a narrowed one. */
+    name: string;
+    spec: string;
+    action: OverrideAction;
+    /** The new value, for a bumped override. */
+    to?: string;
+}
+export interface UnreadableFile {
+    file: string;
+    reason: string;
+}
+export interface UpgradePlan {
+    target: string;
+    changed: ChangedPin[];
+    skipped: SkippedSpec[];
+    overrides: OverrideFinding[];
+    unreadable: UnreadableFile[];
+    /** The files whose content changes, with the new content. */
+    writes: Array<{
+        file: string;
+        absolute: string;
+        content: string;
+    }>;
+}
+export interface PlanOptions {
+    /** Remove `link:`/`file:` overrides of framework packages instead of reporting them. */
+    dropLocalOverrides?: boolean;
+}
+/**
+ * Work out every change the upgrade makes, without writing anything.
+ *
+ * `--dry-run` prints this; a real run writes `writes` and nothing else.
+ */
+export declare function planUpgrade(projectRoot: string, target: string, options?: PlanOptions): UpgradePlan;
+/** Write what the plan changes. Nothing else on disk is touched. */
+export declare function applyUpgradePlan(plan: UpgradePlan): void;
+export type Installer = "pnpm" | "npm" | "yarn" | "bun";
+/**
+ * The package manager this project installs with, from what is on disk.
+ *
+ * A lockfile is the project's own statement, so it wins. The search starts at
+ * the project root and walks up, because a project inside a workspace has its
+ * lockfile at the workspace root; it stops at the repository's root, so a stray
+ * lockfile in a home directory is never read as this project's choice. With no
+ * lockfile anywhere, a `pnpm-workspace.yaml` still says pnpm; otherwise npm,
+ * the one every Node install has.
+ */
+export declare function detectInstaller(projectRoot: string): Installer;
+/**
+ * The install command for each package manager — pnpm's and npm's from the
+ * helpers every other command uses, yarn's and bun's spelled the same way.
+ */
+export declare function installCommand(installer: Installer): [string, string[]];
+/**
+ * The exact version `--to` names.
+ *
+ * An exact version is used as written, with no network call: the control plane
+ * passes one when it rebuilds a project, and that rebuild must not depend on a
+ * registry lookup succeeding for anything but the install itself. Anything
+ * else is a dist-tag, asked of the registry through `npmView` — which runs npm
+ * in the project, so its `.npmrc` and the user's registry config apply.
+ */
+export declare function resolveTarget(requested: string, npmView: (spec: string) => Promise<string>): Promise<string>;
+/**
+ * Whether moving from `from` to `to` goes backwards, for the one-word note the
+ * summary prints. Prerelease identifiers compare as SemVer orders them: a
+ * release outranks its own prereleases.
+ */
+export declare function isDowngrade(from: string, to: string): boolean;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.21.0",
+  "version": "0.21.1",
   "description": "Developer tools for Rebase projects",
   "keywords": [
     "cli",
@@ -43,12 +43,12 @@
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
     "pg": "^8.22.0",
-    "@rebasepro/agent-skills": "0.21.0",
-    "@rebasepro/client": "0.21.0",
-    "@rebasepro/codegen": "0.21.0",
-    "@rebasepro/server": "0.21.0",
-    "@rebasepro/types": "0.21.0",
-    "@rebasepro/server-postgres": "0.21.0"
+    "@rebasepro/agent-skills": "0.21.1",
+    "@rebasepro/client": "0.21.1",
+    "@rebasepro/server": "0.21.1",
+    "@rebasepro/codegen": "0.21.1",
+    "@rebasepro/types": "0.21.1",
+    "@rebasepro/server-postgres": "0.21.1"
   },
   "devDependencies": {
     "@types/node": "^26.1.2",

package/templates/overlays/baas/README.md

@@ -9,9 +9,11 @@ the endpoints change with it.
 
 ## Serving a table
 
-A table is served once it has an authorization model: row-level security enabled
-plus at least one policy. Until then the server skips it — deliberately, so a new
-table is never exposed just by existing — and logs each table it skipped and why.
+A table is served once it has an authorization model: row-level security
+enabled. Until then the server skips it — deliberately, so a new table is never
+exposed just by existing — and logs each table it skipped and why. A table with
+row-level security on but no policy yet is served and returns no rows (the boot
+log names it); a policy is what opens it:
 
 ```sql
 ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;

package/templates/overlays/baas/ai-instructions.md

@@ -0,0 +1,40 @@
+# Rebase AI Coding Rules
+
+This is a **headless** Rebase project: a REST API, auth, storage and realtime over your PostgreSQL database, with no admin panel. There are no collection files and no generated schema — the server reads the database schema at boot and serves each table that has row-level security enabled. `README.md` shows the SQL.
+
+`.mcp.json` in this directory wires the Rebase MCP server up already — no login, no token: it reads `.rebase/state.json` while `pnpm dev` is running. For the full skills (auth, RLS, functions, storage, deployment), run `pnpm skills:install`, or `rebase skills install --agent <claude|cursor|windsurf|gemini|codex|kiro|copilot>` to pick one.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `pnpm dev` | The backend and the managed development database, together |
+| `rebase db url` | Print the connection string in use — it pipes straight into `psql` |
+| `pnpm db:migrate` | Apply the migration files in `backend/drizzle/migrations`. Needs your own PostgreSQL, not the managed development database |
+| `pnpm schema:introspect` | Existing tables → collection definitions in `config/collections/`. That directory ends headless mode; see rule 1 |
+| `pnpm generate:sdk` | Regenerate the typed client from `config/collections/` — so in a headless project it has nothing to read until you introspect |
+| `pnpm build` then `pnpm start` | Build the deployable bundle, then run it |
+| `pnpm skills:install` | Install the Rebase skills for your assistant |
+| `pnpm example` | Run `scripts/example.ts` against the running backend — the SDK, end to end |
+| `rebase doctor` | Checks the environment and the database connection — run this before guessing |
+| `rebase resources --write` | After declaring a database, bucket or topic in `config/resources.ts`: regenerate `rebase.resources.json` and commit it (`pnpm build` does this too) |
+| `pnpm deploy` | Deploys this project. Never run it; see below |
+
+## Never
+
+- **Never deploy.** `pnpm deploy`, `rebase cloud deploy`, `firebase deploy`, `gcloud run deploy` — print the command and let the human run it, even when the task list ends in "deploy" and the tests are green.
+- **Never edit `.env`.** It holds generated secrets and the connection string. Add a variable by asking, and document it in `.env.example`.
+- **Never edit `rebase.resources.json`.** It is generated from `config/resources.ts` — declare there, then `rebase resources --write`.
+- **Never pass `--allow-destructive`** to anything pointed at a database that is not the local development one. It drops columns and tables.
+- **Never read or write application rows with raw SQL or Drizzle from code.** The schema is SQL here; the data is not. That path skips validation, hooks and row-level security.
+
+## Core rules
+
+1. **The database is the schema.** Change it with SQL — `rebase db url` gives `psql` the connection string — or with migration files, then restart `pnpm dev`: the server reads the tables at boot. Do not create `config/collections/` to describe a table; a project with collection files serves those instead of reading the database, which is a different project (`README.md`, "Adding an admin UI later").
+2. **A table is served only with row-level security enabled.** Until then the server skips it and logs why — deliberately, so a table is never exposed just by existing — and with RLS on but no policy it is served and returns no rows. The policy *is* the authorization model: write the rule that says whose row it is, using the `rebase` schema's SQL functions `uid()`, `roles()` and `jwt()`, never a policy that admits everyone just to make rows appear.
+3. **Storage is not under row-level security.** `config/storage.ts` exports `storageAuthorize`, the whole access model for files, and a production deployment with file storage enabled refuses to boot without one. Change the rule there to match your application; do not delete it.
+4. **Use the SDK**: server-side that is `rebase.dataAsAdmin.<table>` for work done as the service identity, or `getDriver(c)` inside a function when the read should run as the caller. The server client has no plain `data` accessor — it is omitted precisely so that the choice of identity is written down.
+5. **Guard every custom route**: routes in `backend/functions/` are mounted **without** an auth requirement — webhook receivers need that — so each one is public until you guard it. Import `requireAuth` / `requireAdmin` from `@rebasepro/server/functions` and pass them in the route's own middleware slot (`app.post("/", requireAuth, handler)`), not via `app.use()`, which only covers routes declared below it. Reading `getUser(c)` is not a guard: an anonymous caller gets `undefined` and the handler still runs. See `backend/functions/hello.ts` for all three tiers.
+6. **In `backend/functions/`, always import from `@rebasepro/server/functions`** — never from `@rebasepro/server`. Both work today; the subpath is the portable one, and it also gives you the typed context accessors (`getUser`, `getDriver`, `requireDriver`) instead of casting `c.get("user")`. The package root is for a server entrypoint, not for route handlers.
+7. **Never read `process.env` at the top of a function file.** A module-scope read that comes back undefined throws at import time, and the loader reports that as a *skipped function* — the route simply 404s with no error attached to it. Read configuration inside the handler with `requireEnv(c, "NAME")`, or build a client once with `lazyResource(env => new Client(env.KEY))`.
+8. **Work that outlives the response goes in `waitUntil(c, promise)`**, not a floating promise. A floating promise is dropped when the process shuts down mid-deploy; `waitUntil` is what a graceful shutdown waits for.

package/templates/template/README.md

@@ -34,8 +34,8 @@ pnpm dev   # or: npm run dev
 ```
 
 That is the whole first run. `rebase dev` generates the Drizzle schema from
-`config/collections`, starts the database, creates the tables — including the
-example `posts`, `authors` and `tags` — and serves the API and the admin panel.
+`config/collections`, starts the database, creates a table for every collection
+declared there, and serves the API and the admin panel.
 
 `rebase dev` prints the two URLs it actually bound. The first account you
 register becomes the admin. `REBASE_ADMIN_EMAIL` and `REBASE_ADMIN_PASSWORD` in

package/templates/template/ai-instructions.md

@@ -1,6 +1,6 @@
 # Rebase AI Coding Rules
 
-`.mcp.json` in this directory wires the Rebase MCP server up already — no login, no token: it reads `.rebase/state.json` while `pnpm dev` is running. For the full skills (collections, auth, RLS, deployment, the UI kit), run `pnpm skills:install`, or `rebase skills install --agent <claude|cursor|windsurf|gemini>` to pick one.
+`.mcp.json` in this directory wires the Rebase MCP server up already — no login, no token: it reads `.rebase/state.json` while `pnpm dev` is running. For the full skills (collections, auth, RLS, deployment, the UI kit), run `pnpm skills:install`, or `rebase skills install --agent <claude|cursor|windsurf|gemini|codex|kiro|copilot>` to pick one.
 
 ## Commands
 
@@ -36,4 +36,4 @@
 5. **In `backend/functions/`, always import from `@rebasepro/server/functions`** — never from `@rebasepro/server`. Both work today; the subpath is the portable one, and it also gives you the typed context accessors (`getUser`, `getDriver`, `requireDriver`) instead of casting `c.get("user")`. The package root is for a server entrypoint, not for route handlers.
 6. **Never read `process.env` at the top of a function file.** A module-scope read that comes back undefined throws at import time, and the loader reports that as a *skipped function* — the route simply 404s with no error attached to it. Read configuration inside the handler with `requireEnv(c, "NAME")`, or build a client once with `lazyResource(env => new Client(env.KEY))`.
 7. **Work that outlives the response goes in `waitUntil(c, promise)`**, not a floating promise. A floating promise is dropped when the process shuts down mid-deploy; `waitUntil` is what a graceful shutdown waits for.
-8. **Build UI from the kit, never from scratch**: any custom view, home page, dashboard or entity tab must be composed from `@rebasepro/ui` components (`Card`, `Typography`, `Button`, `Chip`, `Alert`, …) and the theme's colour tokens (`text-surface-*`, `bg-surface-accent-*`, `text-primary`), with a `dark:` value beside every light one. Do **not** invent a palette, a type scale, or hand-written CSS: a hardcoded colour like `#111` is invisible in one of the two themes and nothing will catch it. The live reference ships in your `node_modules` — read `@rebasepro/app/src/components/Debug/UIReferenceView.tsx` before building a view, and see [Styling Custom UI](https://rebase.pro/docs/frontend/styling).
+8. **Build UI from the kit, never from scratch**: any custom view, home page, dashboard or entity tab must be composed from `@rebasepro/ui` components (`Card`, `Typography`, `Button`, `Chip`, `Alert`, …) and the theme's tokens. Backgrounds and borders take a surface by role — `bg-surface-frame`, `bg-surface-sheet`, `bg-surface-card`, `bg-surface-raised`, `bg-surface-field`, `bg-surface-well`, `border-hairline` — and those switch with the theme on their own, so they need no `dark:` pair; text takes `<Typography>` or `text-text-primary dark:text-text-primary-dark`. Do **not** invent a palette, a type scale, or hand-written CSS: a hardcoded colour like `#111` is invisible in one of the two themes and nothing will catch it. The roles and their reasoning are in `@rebasepro/ui/theme.css` in your `node_modules`; the live reference is `import { UIReferenceView } from "@rebasepro/app/debug"` — mount it on a route and look before building a view. See [Styling Custom UI](https://rebase.pro/docs/frontend/styling).