@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/templates/eject/backend/src/index.ts

@@ -36,6 +36,22 @@ import usersCollection from "../../config/collections/users";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
+/**
+ * The project root: the nearest directory holding `rebase.json`.
+ *
+ * Walked up to rather than counted, because this file runs from two depths —
+ * `backend/src` under `rebase dev`, `backend/dist/backend/src` compiled — and
+ * a fixed `../..` from the compiled file is `backend/dist`, where local uploads
+ * then landed and the next build wiped them.
+ */
+function findProjectRoot(from: string): string {
+    for (let dir = from; ; dir = path.dirname(dir)) {
+        if (fs.existsSync(path.join(dir, "rebase.json"))) return dir;
+        if (path.dirname(dir) === dir) return path.resolve(from, "../..");
+    }
+}
+const projectRoot = findProjectRoot(__dirname);
+
 // Which databases and buckets this project has, read from the declarations in
 // `config/resources.ts`. One declaration site, so this process, the platform
 // and the frontend all read the same list. A project that declares none gets
@@ -81,7 +97,24 @@ app.use("/*", cors({
         if (!origin) return "*";
         return isLocalhostOrigin(origin) ? origin : null;
     },
-    credentials: true
+    credentials: true,
+    // A frontend on another origin reads only the response headers named here.
+    // Without `ETag` the SDK's `etagOf(row)` is always undefined there, and an
+    // `ifMatch` write silently goes out unconditional; without `Retry-After`
+    // and `X-Request-ID` a 429 or an error loses what it reports.
+    exposeHeaders: [
+        "ETag",
+        "Retry-After",
+        "X-Request-ID",
+        "X-RateLimit-Limit",
+        "X-RateLimit-Remaining",
+        "X-RateLimit-Reset",
+        "Preference-Applied",
+        // A resumable upload: where it lives, how far it got, what was stored.
+        "Location",
+        "Upload-Offset",
+        "Rebase-Upload-Result"
+    ]
 }));
 
 app.use("/*", secureHeaders());
@@ -106,7 +139,11 @@ const resolvedDataSources = resolveDataSources(process.env, dataSources);
 async function startServer() {
     const jwtSecret = env.JWT_SECRET;
     const PORT = env.PORT;
-    const server = createServer(getRequestListener(app.fetch));
+    // 64 KB of request line plus headers, as the Rebase runtime takes, not
+    // Node's 16 KB: a vector search's embedding travels in `?vector=`, and
+    // 768 dimensions of it are already 17 KB of URL. (The SDK sends a vector
+    // search in a POST body; this is for a URL built by hand.)
+    const server = createServer({ maxHeaderSize: 64 * 1024 }, getRequestListener(app.fetch));
 
     // `backend/crons` holds the scheduled jobs — nightly backups among them.
     // Passed only when the directory exists, because a configured `cronsDir`
@@ -204,7 +241,9 @@ pass: env.SMTP_PASS! }
         storage: resolveStorageSources(
             process.env,
             storageSources,
-            path.resolve(__dirname, "../../uploads")
+            // `<project>/uploads`, from source and compiled alike — where
+            // `rebase dev` keeps them too. `STORAGE_PATH` overrides it.
+            path.join(projectRoot, "uploads")
         ),
         // Storage is not under row-level security, so this hook IS its access
         // model — the server refuses to boot in production without one, because
@@ -278,7 +317,6 @@ pass: env.SMTP_PASS! }
 
     if (!isProduction) {
         // Dev mode: retry the next port if the current one is in use
-        const projectRoot = path.resolve(__dirname, "../..");
         const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot, serviceKey: env.REBASE_SERVICE_KEY });
 
         // Clean up port file on exit

package/templates/eject/docker-compose.custom.yml

@@ -63,17 +63,21 @@ services:
       # served from.
       # {{/frontend}}
       CORS_ORIGINS: ${CORS_ORIGINS:?set CORS_ORIGINS to the origin you browse to}
-      # A durable named volume, which is the case this flag acknowledges.
-      STORAGE_PATH: /uploads
+      # A durable named volume, which is the case this flag acknowledges. It is
+      # mounted at /storage, one level above STORAGE_PATH, because every bucket
+      # declared in config/resources.ts gets a directory beside this one —
+      # bucket("media") is /storage/uploads__media — and all of them belong on
+      # the volume. The Dockerfile creates /storage for the `rebase` user.
+      STORAGE_PATH: /storage/uploads
       FORCE_LOCAL_STORAGE: "true"
     depends_on:
       db:
         condition: service_healthy
     volumes:
-      - uploads:/uploads
+      - storage:/storage
 
 volumes:
   postgres_data:
     driver: local
-  uploads:
+  storage:
     driver: local

package/templates/generated-schemas/blank.ts

@@ -0,0 +1,40 @@
+// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.
+
+import { boolean, jsonb, pgPolicy, pgSchema, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { relations as drizzleRelations, sql } from 'drizzle-orm';
+
+export const rebaseSchema = pgSchema("rebase");
+
+
+export const users = rebaseSchema.table("users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    email: text("email").unique().notNull(),
+    displayName: text("display_name"),
+    photoURL: text("photo_url"),
+    roles: text("roles").array(),
+    passwordHash: text("password_hash"),
+    emailVerified: boolean("email_verified").default(sql`FALSE`),
+    emailVerificationToken: text("email_verification_token"),
+    emailVerificationSentAt: timestamp("email_verification_sent_at", { withTimezone: true, mode: 'string' }),
+    metadata: jsonb("metadata").default(sql`'{}'::jsonb`),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`),
+    updatedAt: timestamp("updated_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("users_select_5f32f06", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_self_read", { as: "permissive", for: "select", to: ["public"], using: sql`(id)::text = (SELECT rebase.uid())` }),
+    pgPolicy("users_require_admin_write_insert", { as: "restrictive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_update", { as: "restrictive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_delete", { as: "restrictive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const tables = { users };
+export const enums = {  };
+export const relations = {  };
+

package/templates/generated-schemas/blog.ts

@@ -0,0 +1,127 @@
+// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.
+
+import { type AnyPgColumn, boolean, index, integer, jsonb, pgEnum, pgPolicy, pgSchema, pgTable, primaryKey, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { relations as drizzleRelations, sql } from 'drizzle-orm';
+
+export const rebaseSchema = pgSchema("rebase");
+
+export const postsStatus = pgEnum("posts_status", ["draft", "review", "published"]);
+
+export const authors = pgTable("authors", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull(),
+    picture: text("picture")
+}, (table) => ([
+    pgPolicy("authors_select_841c287", { as: "permissive", for: "select", to: ["public"], using: sql`true` }),
+    pgPolicy("authors_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("authors_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("authors_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("authors_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("authors_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("authors_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("authors_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const posts = pgTable("posts", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    title: text("title").notNull(),
+    content: text("content"),
+    status: postsStatus("status"),
+    authorId: integer("author_id").references((): AnyPgColumn => authors.id, { onDelete: "set null" })
+}, (table) => ([
+    index("posts_author_id_ix_00ad191").on(table.authorId.asc().nullsLast()),
+    pgPolicy("posts_select_841c287", { as: "permissive", for: "select", to: ["public"], using: sql`true` }),
+    pgPolicy("posts_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("posts_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("posts_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("posts_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const postsTags = pgTable("posts_tags", {
+    post_id: integer("post_id").notNull().references((): AnyPgColumn => posts.id, { onDelete: "cascade" }),
+    tag_id: integer("tag_id").notNull().references((): AnyPgColumn => tags.id, { onDelete: "cascade" }),
+}, (table) => ([
+    primaryKey({ columns: [table.post_id, table.tag_id] }),
+    index("posts_tags_tag_id_ix_d4456f1").on(table.tag_id.asc().nullsLast()),
+    pgPolicy("posts_tags_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_edge_read", { as: "permissive", for: "select", to: ["public"], using: sql`(EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE "_ex0".id = "public"."posts_tags".post_id)) AND (EXISTS (SELECT 1 FROM "public"."tags" "_ex1" WHERE "_ex1".id = "public"."posts_tags".tag_id))` }),
+    pgPolicy("posts_tags_default_edge_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))` }),
+    pgPolicy("posts_tags_default_edge_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))`, withCheck: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))` }),
+    pgPolicy("posts_tags_default_edge_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))` }),
+])).enableRLS();
+
+export const tags = pgTable("tags", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull()
+}, (table) => ([
+    pgPolicy("tags_select_841c287", { as: "permissive", for: "select", to: ["public"], using: sql`true` }),
+    pgPolicy("tags_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("tags_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("tags_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("tags_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("tags_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("tags_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("tags_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const users = rebaseSchema.table("users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    email: text("email").unique().notNull(),
+    displayName: text("display_name"),
+    photoURL: text("photo_url"),
+    roles: text("roles").array(),
+    passwordHash: text("password_hash"),
+    emailVerified: boolean("email_verified").default(sql`FALSE`),
+    emailVerificationToken: text("email_verification_token"),
+    emailVerificationSentAt: timestamp("email_verification_sent_at", { withTimezone: true, mode: 'string' }),
+    metadata: jsonb("metadata").default(sql`'{}'::jsonb`),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`),
+    updatedAt: timestamp("updated_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("users_select_5f32f06", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_self_read", { as: "permissive", for: "select", to: ["public"], using: sql`(id)::text = (SELECT rebase.uid())` }),
+    pgPolicy("users_require_admin_write_insert", { as: "restrictive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_update", { as: "restrictive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_delete", { as: "restrictive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const postsRelations = drizzleRelations(posts, ({ one, many }) => ({
+    "author": one(authors, {
+        fields: [posts.authorId],
+        references: [authors.id],
+        relationName: "posts_authorId"
+    }),
+    "tags": many(postsTags, { relationName: "tags" })
+}));
+
+export const postsTagsRelations = drizzleRelations(postsTags, ({ one, many }) => ({
+    "post_id": one(posts, {
+        fields: [postsTags.post_id],
+        references: [posts.id],
+        relationName: "tags"
+    }),
+    "tag_id": one(tags, {
+        fields: [postsTags.tag_id],
+        references: [tags.id],
+        relationName: "posts_tags_tag_id"
+    })
+}));
+
+export const tables = { authors, posts, postsTags, tags, users };
+export const enums = { postsStatus };
+export const relations = { postsRelations, postsTagsRelations };
+

package/templates/generated-schemas/ecommerce.ts

@@ -0,0 +1,93 @@
+// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.
+
+import { type AnyPgColumn, boolean, index, integer, jsonb, numeric, pgEnum, pgPolicy, pgSchema, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { relations as drizzleRelations, sql } from 'drizzle-orm';
+
+export const rebaseSchema = pgSchema("rebase");
+
+export const ordersStatus = pgEnum("orders_status", ["pending", "processing", "shipped", "delivered", "cancelled"]);
+export const productsStatus = pgEnum("products_status", ["draft", "active", "archived"]);
+
+export const categories = pgTable("categories", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull(),
+    description: text("description"),
+    icon: text("icon")
+}, (table) => ([
+    pgPolicy("categories_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("categories_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("categories_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("categories_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const orders = pgTable("orders", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    customerEmail: text("customer_email").notNull(),
+    status: ordersStatus("status"),
+    total: numeric("total").notNull(),
+    notes: text("notes"),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("orders_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("orders_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("orders_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("orders_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const products = pgTable("products", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull(),
+    description: text("description"),
+    price: numeric("price").notNull(),
+    image: text("image"),
+    status: productsStatus("status"),
+    categoryId: integer("category_id").references((): AnyPgColumn => categories.id, { onDelete: "set null" })
+}, (table) => ([
+    index("products_category_id_ix_066548f").on(table.categoryId.asc().nullsLast()),
+    pgPolicy("products_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("products_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("products_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("products_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const users = rebaseSchema.table("users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    email: text("email").unique().notNull(),
+    displayName: text("display_name"),
+    photoURL: text("photo_url"),
+    roles: text("roles").array(),
+    passwordHash: text("password_hash"),
+    emailVerified: boolean("email_verified").default(sql`FALSE`),
+    emailVerificationToken: text("email_verification_token"),
+    emailVerificationSentAt: timestamp("email_verification_sent_at", { withTimezone: true, mode: 'string' }),
+    metadata: jsonb("metadata").default(sql`'{}'::jsonb`),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`),
+    updatedAt: timestamp("updated_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("users_select_5f32f06", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_self_read", { as: "permissive", for: "select", to: ["public"], using: sql`(id)::text = (SELECT rebase.uid())` }),
+    pgPolicy("users_require_admin_write_insert", { as: "restrictive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_update", { as: "restrictive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_delete", { as: "restrictive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const productsRelations = drizzleRelations(products, ({ one, many }) => ({
+    "category": one(categories, {
+        fields: [products.categoryId],
+        references: [categories.id],
+        relationName: "products_categoryId"
+    })
+}));
+
+export const tables = { categories, orders, products, users };
+export const enums = { ordersStatus, productsStatus };
+export const relations = { productsRelations };
+

package/templates/overlays/baas/ai-instructions.md

@@ -12,7 +12,7 @@ This is a **headless** Rebase project: a REST API, auth, storage and realtime ov
 | `rebase db url` | Print the connection string in use — it pipes straight into `psql` |
 | `pnpm db:migrate` | Apply the migration files in `backend/drizzle/migrations`. Needs your own PostgreSQL, not the managed development database |
 | `pnpm schema:introspect` | Existing tables → collection definitions in `config/collections/`. That directory ends headless mode; see rule 1 |
-| `pnpm generate:sdk` | Regenerate the typed client from `config/collections/` — so in a headless project it has nothing to read until you introspect |
+| `pnpm generate:sdk` | Regenerate the typed client from `config/collections/` — so in a headless project it has nothing to read until you introspect. Once there are collections, `pnpm dev` does this on start and on every save; the script is for CI and for when `pnpm dev` is not running |
 | `pnpm build` then `pnpm start` | Build the deployable bundle, then run it |
 | `pnpm skills:install` | Install the Rebase skills for your assistant |
 | `pnpm example` | Run `scripts/example.ts` against the running backend — the SDK, end to end |

package/templates/overlays/baas/config/package.json

@@ -16,6 +16,7 @@
     "@rebasepro/types": "workspace:*"
   },
   "devDependencies": {
+    "@types/node": "^22.19.4",
     "typescript": "^6.0.3"
   },
   "exports": {

package/templates/overlays/baas/config/storage.ts

@@ -1,4 +1,4 @@
-import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
+import type { StorageAuthorize } from "@rebasepro/types";
 
 /**
  * Who may do what to files in storage.
@@ -39,7 +39,7 @@ import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
  *
  * ```ts
  * export const storageAuthorize: StorageAuthorize = async ({ key, user, operation, data }) => {
- *     if (operation === "read" && isPublicStoragePath(key)) return true;
+ *     if (operation === "read" && key.startsWith("public/")) return true;
  *     if (!user) return false;
  *     const row = (await data?.collection("attachments").find({
  *         where: { storage_key: ["==", key] }, limit: 1
@@ -55,7 +55,9 @@ import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
  */
 export const storageAuthorize: StorageAuthorize = ({ key, user, operation }) => {
     // The `public/` prefix is the framework's convention for world-readable objects.
-    if (operation === "read" && isPublicStoragePath(key)) {
+    // `key` is the canonical key the server serves, so a prefix test is exact:
+    // `default/public/x` is a private object in a folder named `default`.
+    if (operation === "read" && key.startsWith("public/")) {
         return true;
     }
 

package/templates/overlays/baas/package.json

@@ -22,6 +22,7 @@
     "devDependencies": {
         "@rebasepro/cli": "workspace:*",
         "@rebasepro/types": "workspace:*",
+        "@types/node": "^22.19.4",
         "tsx": "^4.20.6",
         "typescript": "^6.0.3"
     },

package/templates/template/.cursorrules

@@ -1,3 +1,3 @@
 # Rebase AI Rules
 Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).
-Install the Rebase skills for this assistant: `rebase skills install --agent cursor`.
+The Rebase skills for this assistant live in `.cursor/rules/`. If they are not there yet, install them, with the Rebase MCP server: `rebase skills install --agent cursor --mcp`.

package/templates/template/.env.example

@@ -51,10 +51,12 @@ DATABASE_URL=postgresql://rebase_app:changeme@localhost:5432/rebase?options=-c%2
 # DB_POOL_CONNECT_TIMEOUT=10000
 
 # ── Server ────────────────────────────────────────────────────────────────────
-# Used by `rebase start` (production). `rebase dev` IGNORES this and binds a
+# Used by `rebase start`. `rebase dev` IGNORES this and binds a
 # port derived from the project path, so several projects can run at once —
 # trust the URL `rebase dev` prints, or pin one with `rebase dev --port 3001`.
 PORT=3001
+# `rebase start` runs in this mode too, and warns that it is not a production
+# server: set NODE_ENV=production (here or in the shell) for one.
 NODE_ENV=development
 # Allow connecting to localhost / 127.0.0.1 in production mode (for local testing of prod builds)
 # ALLOW_LOCALHOST_IN_PRODUCTION=false
@@ -159,14 +161,20 @@ VITE_API_URL=
 # In production, "local" means NO file storage: uploads answer
 # 501 STORAGE_NOT_CONFIGURED instead of landing on a container filesystem that
 # is erased on the next redeploy. Configure a bucket below to switch it on, or
-# set FORCE_LOCAL_STORAGE=true if a durable volume really is mounted at
-# STORAGE_PATH (the generated docker-compose.yml does exactly that).
+# set FORCE_LOCAL_STORAGE=true if a durable volume really holds STORAGE_PATH
+# (the generated docker-compose.yml does exactly that). Mount it on the parent
+# of STORAGE_PATH: a named local bucket keeps its files beside it, in
+# <STORAGE_PATH>__<key>, and those belong on the volume too.
 #
 # STORAGE_TYPE=local
 
 # --- Local filesystem (default — great for dev and single-server deployments) --
-# STORAGE_PATH=./uploads
-# FORCE_LOCAL_STORAGE=true      # Only with a durable volume mounted at STORAGE_PATH
+# Unset, files land in <project>/uploads, under `rebase dev` and in the server
+# `rebase eject` writes alike. A relative path is read from the directory the
+# server runs in: the project root under `rebase dev`, backend/ after
+# `rebase eject`. So ./uploads names two places, and an absolute path one.
+# STORAGE_PATH=/absolute/path/to/uploads
+# FORCE_LOCAL_STORAGE=true      # Only with a durable volume holding STORAGE_PATH
 
 # --- S3-compatible (AWS S3, Cloudflare R2, MinIO, Hetzner Object Storage, Backblaze B2) ---
 # STORAGE_TYPE=s3
@@ -222,7 +230,7 @@ VITE_API_URL=
 # BACKUP_DESTINATION=./backups        # local path, or s3://bucket/prefix / gs://bucket/prefix
 # BACKUP_RETENTION_DAYS=14            # delete backups older than N days (unset/0 ⇒ keep all)
 # BACKUP_KEEP_MINIMUM=3               # always retain at least N most-recent backups
-# PG_DUMP_PATH=                       # override pg_dump binary (must match server major version)
+# PG_DUMP_PATH=                       # override pg_dump binary (server's major version or newer)
 # PG_RESTORE_PATH=                    # override pg_restore binary
 
 # ── Admin Service Key (optional) ──────────────────────────────────────────────
@@ -250,9 +258,11 @@ VITE_API_URL=
 # unset. To upgrade, change this and restart — your bundle is untouched.
 REBASE_VERSION=latest
 
-# What boot does about versioned migrations in `backend/migrations`.
-#   ensure   create missing tables and columns from your collections (the default)
-#   migrate  run the migration files, then ensure
-#   off      neither
+# Whether boot provisions the schema your collections describe.
+#   ensure   create missing tables, columns and enum types, additively (the default)
+#   none     leave the schema alone
+# Any other value refuses to boot. Boot never runs migration files: the ones
+# `rebase db generate` writes to `backend/drizzle/migrations` are applied with
+# `rebase db migrate`.
 # REBASE_MIGRATE_ON_BOOT=ensure
 

package/templates/template/.github/copilot-instructions.md

@@ -1,3 +1,3 @@
 # Rebase AI Rules
 Please refer to and follow the instructions defined in [ai-instructions.md](../ai-instructions.md).
-Install the Rebase skills for this assistant: `rebase skills install --agent copilot`.
+The Rebase skills for this assistant live in `.github/instructions/`. If they are not there yet, install them, with the Rebase MCP server: `rebase skills install --agent copilot --mcp`.

package/templates/template/.mcp.json

@@ -1,8 +1,8 @@
 {
     "mcpServers": {
         "rebase": {
-            "command": "npx",
-            "args": ["-y", "@rebasepro/mcp"],
+            "command": "pnpm",
+            "args": ["exec", "rebase-mcp"],
             "env": {
                 "REBASE_PROJECT_DIR": "."
             }

package/templates/template/.windsurfrules

@@ -1,3 +1,3 @@
 # Rebase AI Rules
 Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).
-Install the Rebase skills for this assistant: `rebase skills install --agent windsurf`.
+The Rebase skills for this assistant live in `.windsurf/rules/`. If they are not there yet, install them, with the Rebase MCP server: `rebase skills install --agent windsurf --mcp`.

package/templates/template/AGENTS.md

@@ -1,3 +1,3 @@
 # Rebase AI Rules
 Please refer to and follow the instructions defined in [ai-instructions.md](ai-instructions.md).
-Install the Rebase skills for this assistant: `rebase skills install --agent codex`.
+The Rebase skills for this assistant live in `.agents/skills/`. If they are not there yet, install them, with the Rebase MCP server: `rebase skills install --agent codex --mcp`.

package/templates/template/CLAUDE.md

@@ -1,3 +1,3 @@
 # Rebase AI Rules
 Please refer to and follow the instructions defined in [ai-instructions.md](./ai-instructions.md).
-Install the Rebase skills for this assistant: `rebase skills install --agent claude`.
+The Rebase skills for this assistant live in `.claude/skills/`. If they are not there yet, install them, with the Rebase MCP server: `rebase skills install --agent claude --mcp`.