@rebasepro/cli 0.23.0 → 0.24.1-canary.g56af4a4

package/templates/template/ai-instructions.md

@@ -7,10 +7,11 @@
 | Command | What it does |
 |---|---|
 | `pnpm dev` | Backend, frontend and the managed development database, together |
-| `pnpm schema:generate` then `pnpm db:push` | The same loop with `pnpm dev` not running, plus the changes boot leaves alone: collections → Drizzle schema → development database |
+| `pnpm schema:generate` then `pnpm generate:sdk` | The same loop with `pnpm dev` not running: collections → Drizzle schema and SDK types. The next boot creates what is missing |
+| `pnpm db:push` | The changes boot leaves alone (a rename, a narrowed type, a removed field). Needs your own PostgreSQL in `DATABASE_URL`; it refuses the managed development database |
 | `pnpm db:generate` then `pnpm db:migrate` | The production path — write the migration file, then apply it |
 | `pnpm schema:introspect` | The other direction: existing tables → collection definitions |
-| `pnpm generate:sdk` | Regenerate the typed client from the collections |
+| `pnpm generate:sdk` | Regenerate the typed client in `generated/sdk/` from the collections. `pnpm dev` already does this on start and on every save; the script is for CI and for when `pnpm dev` is not running |
 | `pnpm build` then `pnpm start` | Build the deployable bundle, then run it |
 | `pnpm skills:install` | Install the Rebase skills for your assistant |
 | `pnpm example` | Run `scripts/example.ts` against the running backend — the SDK, end to end |
@@ -29,8 +30,8 @@
 
 ## Core rules
 
-1. **Schema-as-code**: define and edit collections in `config/collections/` with `defineCollection` from `@rebasepro/cms-types`, and register each one in that directory's `index.ts` — a collection missing from the barrel does not exist. Never hand-edit generated schemas or Postgres tables.
-2. **Applying a collection change**: while `pnpm dev` is running, saving a file in `config/collections/` is the whole step — it regenerates `backend/src/schema.generated.ts`, restarts the backend, and boot creates the tables and columns that are missing. With `pnpm dev` stopped, that is `pnpm schema:generate`. `pnpm db:push` is only for what boot deliberately leaves alone — a renamed column, a narrowed type, a removed field, junction-table RLS — and it needs your own PostgreSQL, not the managed development database. In production the pair is `pnpm db:generate` then `pnpm db:migrate`.
+1. **Schema-as-code**: define and edit collections in `config/collections/` with `defineCollection` from `@rebasepro/cms-types`, one collection per file, default-exported. Every file in that directory is loaded — by the backend, the admin panel and the SDK generator — whether or not `index.ts` lists it: the barrel is a sort order for the admin navigation (and holds `defaultSecurityRules`), not a registry. To remove a collection, delete its file. Never hand-edit generated schemas or Postgres tables.
+2. **Applying a collection change**: while `pnpm dev` is running, saving a file in `config/collections/` is the whole step — it regenerates `backend/src/schema.generated.ts` and the SDK types in `generated/sdk/`, restarts the backend, and boot creates the tables and columns that are missing. With `pnpm dev` stopped, that is `pnpm schema:generate` and `pnpm generate:sdk`. `pnpm db:push` is only for what boot deliberately leaves alone — a renamed column, a narrowed type, a removed field — and it needs your own PostgreSQL, not the managed development database. In production the pair is `pnpm db:generate` then `pnpm db:migrate`.
 3. **Use the SDK**: server-side that is `rebase.dataAsAdmin.<slug>` for work done as the service identity, or `getDriver(c)` inside a function when the read should run as the caller. The server client has no plain `data` accessor — it is omitted precisely so that the choice of identity is written down.
 4. **Guard every custom route**: routes in `backend/functions/` are mounted **without** an auth requirement — webhook receivers need that — so each one is public until you guard it. Import `requireAuth` / `requireAdmin` from `@rebasepro/server/functions` and pass them in the route's own middleware slot (`app.post("/", requireAuth, handler)`), not via `app.use()`, which only covers routes declared below it. Reading `getUser(c)` is not a guard: an anonymous caller gets `undefined` and the handler still runs. See `backend/functions/hello.ts` for all three tiers.
 5. **In `backend/functions/`, always import from `@rebasepro/server/functions`** — never from `@rebasepro/server`. Both work today; the subpath is the portable one, and it also gives you the typed context accessors (`getUser`, `getDriver`, `requireDriver`) instead of casting `c.get("user")`. The package root is for a server entrypoint, not for route handlers.

package/templates/template/backend/functions/hello.ts

@@ -47,6 +47,14 @@ import {
  * slot over `app.use("/*", requireAuth)`: `use()` only covers routes declared
  * *below* it, so a route appended later above it is silently unprotected.
  *
+ * An API key is a caller too. It reaches this file only if it holds the
+ * `functions:invoke` scope (or `functions:invoke:hello`), it passes
+ * `requireAuth`, and a service key created with `--roles admin` passes
+ * `requireAdmin`. To let a key do one thing here and not another, declare a
+ * scope under `auth.scopes` on the users collection and add
+ * `requireScope("reports:read")` to that route — every signed-in person holds
+ * every app scope, so it narrows keys, not people.
+ *
  * `rebase.dataAsAdmin` gives you admin-level access to your data: it runs as
  * `{ uid: "service", roles: ["admin"] }`, which is **admin-scoped, not an RLS
  * bypass** — your policies are still evaluated, just against that identity. So

package/templates/template/backend/package.json

@@ -4,7 +4,7 @@
     "description": "Rebase backend with PostgreSQL",
     "type": "module",
     "scripts": {
-        "build": "rebase schema generate --collections ../config/collections && tsc && rebase normalize-imports dist"
+        "build": "rebase schema generate && tsc && rebase normalize-imports dist"
     },
     "dependencies": {
         "@ariga/atlas": "^1.2.3",

package/templates/template/config/storage.ts

@@ -1,4 +1,4 @@
-import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
+import type { StorageAuthorize } from "@rebasepro/types";
 
 /**
  * Who may do what to files in storage.
@@ -37,7 +37,7 @@ import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
  *
  * ```ts
  * export const storageAuthorize: StorageAuthorize = async ({ key, user, operation, data }) => {
- *     if (operation === "read" && isPublicStoragePath(key)) return true;
+ *     if (operation === "read" && key.startsWith("public/")) return true;
  *     if (!user) return false;
  *
  *     // Writes land under the caller's own prefix.
@@ -66,7 +66,9 @@ import { isPublicStoragePath, type StorageAuthorize } from "@rebasepro/types";
 export const storageAuthorize: StorageAuthorize = ({ key, user, operation }) => {
     // The `public/` prefix is the framework's convention for world-readable
     // objects, and it is what signed download URLs for public assets rely on.
-    if (operation === "read" && isPublicStoragePath(key)) {
+    // `key` is the canonical key the server serves, so a prefix test is exact:
+    // `default/public/x` is a private object in a folder named `default`.
+    if (operation === "read" && key.startsWith("public/")) {
         return true;
     }
 

package/templates/template/docker-compose.yml

@@ -15,7 +15,7 @@
 #   docker compose up         # boot creates the tables it is missing
 #
 # `rebase db push` is the separate step for what boot deliberately leaves
-# alone: junction-table RLS, and any change that is not purely additive.
+# alone: any change that is not purely additive.
 #
 # One container then serves the API at /api and the admin at / — same origin, so
 # there is no CORS to configure between them and no second web server.
@@ -132,12 +132,12 @@ services:
       DISABLE_SELF_REGISTRATION: ${DISABLE_SELF_REGISTRATION:-true}
 
       # `ensure` (the default) creates missing tables and columns at boot —
-      # your collections' as well as auth's — and is additive only: nothing is
-      # dropped, narrowed or rewritten, because that must never happen as a
-      # side effect of a container restart.
+      # your collections' as well as auth's — with their row-level security,
+      # and is additive only: nothing is dropped, narrowed or rewritten,
+      # because that must never happen as a side effect of a container restart.
       #
-      # `rebase db push` is still what applies the rest: junction-table RLS on
-      # many-to-many relations, and any change that is not purely additive.
+      # `rebase db push` is still what applies the rest: any change that is not
+      # purely additive.
       # Set this to `none` to take a deployment out of provisioning entirely.
       REBASE_MIGRATE_ON_BOOT: ${REBASE_MIGRATE_ON_BOOT:-ensure}
 

package/templates/template/frontend/vite.config.ts

@@ -30,9 +30,9 @@ export default defineConfig({
             "@remix-run/router"
         ]
     },
-    esbuild: {
-        logOverride: { "this-is-undefined-in-esm": "silent" }
-    },
+    // No `esbuild` block: Vite 8 transforms with oxc and ignores it, and
+    // having one made every `rebase dev` and build print "Both esbuild and oxc
+    // options were set".
     build: {
         minify: true,
         outDir: "./dist",
@@ -75,6 +75,14 @@ export default defineConfig({
                     // anchor a heavy one to the critical path.
                     if (id.includes("commonjsHelpers") || id.includes("commonjs-dynamic-modules")) return "vendor-commonjs-helpers";
 
+                    // Small libraries the entry needs, named before the heavy groups. A name
+                    // takes the unassigned dependencies of its modules with it, so
+                    // `prism-react-renderer` took `clsx` — which the kit imports statically — and
+                    // the entry imported 85 kB of syntax highlighter for a 633-byte helper;
+                    // React core landed in `vendor-dnd` the same way.
+                    if (/[\\/]node_modules[\\/](react|scheduler|use-sync-external-store)[\\/]/.test(id)) return "vendor-react";
+                    if (/[\\/]node_modules[\\/]clsx[\\/]/.test(id)) return "vendor-clsx";
+
                     if (id.includes("exceljs")) return "vendor-exceljs";
                     if (id.includes("prosemirror")) return "vendor-prosemirror";
                     if (id.includes("monaco-editor") || id.includes("@monaco-editor")) return "vendor-monaco";

package/templates/template/gitignore

@@ -11,8 +11,13 @@ build/
 !.env.example
 
 # IDE
+#
+# `.vscode/*` rather than `.vscode/`: git cannot re-include a file inside an
+# ignored directory, and `.vscode/mcp.json` is the Rebase MCP server
+# `rebase init --agent copilot` registers for the whole team.
 .idea/
-.vscode/
+.vscode/*
+!.vscode/mcp.json
 *.swp
 *.swo
 

package/templates/template/package.json

@@ -13,11 +13,11 @@
         "dev": "rebase dev",
         "build": "rebase build",
         "start": "rebase start",
-        "db:generate": "rebase db generate --collections ../config/collections",
+        "db:generate": "rebase db generate",
         "db:migrate": "rebase db migrate",
         "schema:introspect": "rebase schema introspect",
-        "db:push": "rebase db push --collections ../config/collections",
-        "schema:generate": "rebase schema generate --collections ../config/collections",
+        "db:push": "rebase db push",
+        "schema:generate": "rebase schema generate",
         "generate:sdk": "rebase generate-sdk",
         "skills:install": "rebase skills install",
         "example": "tsx scripts/example.ts",
@@ -25,6 +25,7 @@
     },
     "devDependencies": {
         "@rebasepro/cli": "workspace:*",
+        "@rebasepro/mcp": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "tsx": "^4.20.6",
         "typescript": "^6.0.3"

package/templates/template/scripts/example.ts

@@ -23,13 +23,15 @@ import fs from "node:fs";
 import path from "node:path";
 import * as dotenv from "dotenv";
 import { createRebaseClient } from "@rebasepro/client";
-// Optional: fully typed collections. `rebase generate-sdk` writes these under
-// ./generated/sdk — the dictionary is what maps a hyphenated slug to the
-// property name, so a client built without it 404s at runtime.
+// Optional: fully typed collections. `rebase dev` writes these under
+// ./generated/sdk (`rebase generate-sdk` outside it) — the dictionary is what
+// maps a hyphenated slug to the property name, so a client built without it
+// 404s at runtime.
 // import { collectionsDictionary, type Database } from "../generated/sdk/database.types";
 
 // Load .env from project root (same file the backend uses)
-dotenv.config({ path: path.resolve(process.cwd(), ".env") });
+// `quiet`: dotenv 17 otherwise prints its own advertisement banner.
+dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
 
 // ─── Resolve Backend URL ─────────────────────────────────────────────
 let baseUrl = process.env.REBASE_URL;

package/dist/branch-pointer-dBiClJ0p.js

@@ -1,111 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import path from "path";
-import fs from "fs";
-//#region src/dev-db/branch-pointer.ts
-/**
-* Which database branch this checkout is working on.
-*
-* `rebase db branch create` made a full copy of the database in about a second
-* and then stopped one step short of being a feature: there was no `switch`, no
-* `--branch` on `rebase dev`, and nothing wrote the branch anywhere a command
-* would read it. The only way to *use* a branch was to hand-edit
-* `DATABASE_URL`, and the documentation claimed otherwise — "the CLI updates
-* your local development configuration" — which it did not; the `.env` was
-* byte-identical afterwards.
-*
-* This is that missing step, and the shape of it is chosen to avoid three
-* things:
-*
-* 1. **It does not touch `.env`.** That file holds secrets, comments and the
-*    developer's own ordering, and a command that rewrites it in place will
-*    eventually lose something that was not its business. The branch is
-*    recorded beside the other per-checkout state in `.rebase/`, which is
-*    already gitignored — a branch is a fact about one machine, never about
-*    the project.
-*
-* 2. **It stores a name, not a connection string.** The credentials stay in
-*    exactly one place; the URL is derived by swapping the database name on
-*    the base one at resolution time. A stored URL would be a second copy of
-*    the password, and would go stale the moment `.env` changed.
-*
-* 3. **It does not outrank an explicit instruction.** `--database-url` and a
-*    `DATABASE_URL` in the shell are more immediate and more specific than a
-*    switch made yesterday, so they still win. The pointer sits directly above
-*    the project's `.env`: it is a deliberate, persistent choice, and `.env` is
-*    the project default it is meant to override. Anything less and `switch`
-*    would silently do nothing on every project that sets `DATABASE_URL` —
-*    which is every project not using the managed database.
-*/
-var branch_pointer_exports = /* @__PURE__ */ __exportAll({
-	BRANCH_DB_PREFIX: () => "rb_",
-	branchDatabaseName: () => branchDatabaseName,
-	branchPointerPath: () => branchPointerPath,
-	branchUrl: () => branchUrl,
-	clearActiveBranch: () => clearActiveBranch,
-	databaseNameOf: () => databaseNameOf,
-	readActiveBranch: () => readActiveBranch,
-	writeActiveBranch: () => writeActiveBranch
-});
-/** Where the pointer lives, next to the rest of the per-checkout state. */
-function branchPointerPath(projectRoot) {
-	return path.join(projectRoot, ".rebase", "branch.json");
-}
-function branchDatabaseName(name) {
-	return `rb_${name}`;
-}
-/** Read the active branch, or null when the checkout is on the main database. */
-function readActiveBranch(projectRoot) {
-	try {
-		const raw = fs.readFileSync(branchPointerPath(projectRoot), "utf-8");
-		const parsed = JSON.parse(raw);
-		if (typeof parsed.name !== "string" || typeof parsed.database !== "string") return null;
-		if (!parsed.name || !parsed.database) return null;
-		return {
-			name: parsed.name,
-			database: parsed.database
-		};
-	} catch {
-		return null;
-	}
-}
-function writeActiveBranch(projectRoot, branch) {
-	const file = branchPointerPath(projectRoot);
-	fs.mkdirSync(path.dirname(file), { recursive: true });
-	fs.writeFileSync(file, `${JSON.stringify(branch, null, 2)}\n`, "utf-8");
-}
-/** Return to the main database. Absent is success — this is idempotent. */
-function clearActiveBranch(projectRoot) {
-	fs.rmSync(branchPointerPath(projectRoot), { force: true });
-}
-/**
-* The base connection string with its database swapped for the branch's.
-*
-* Everything else is carried across untouched — credentials, host, port, and
-* the query string, which is load-bearing here: `?sslmode=disable` is what a
-* local Docker Postgres needs, and dropping it turns a switch into a TLS error
-* that says nothing about branches.
-*
-* Returns null for a connection string that cannot be parsed, so the caller can
-* say so plainly rather than emitting a mangled URL that fails later.
-*/
-function branchUrl(baseUrl, database) {
-	try {
-		const url = new URL(baseUrl);
-		url.pathname = `/${database}`;
-		return url.toString();
-	} catch {
-		return null;
-	}
-}
-/** The database name in a connection string, for reporting what you are on. */
-function databaseNameOf(connectionString) {
-	try {
-		return new URL(connectionString).pathname.replace(/^\//, "") || null;
-	} catch {
-		return null;
-	}
-}
-//#endregion
-export { branch_pointer_exports as n, readActiveBranch as r, branchUrl as t };
-
-//# sourceMappingURL=branch-pointer-dBiClJ0p.js.map

package/dist/branch-pointer-dBiClJ0p.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"branch-pointer-dBiClJ0p.js","names":[],"sources":["../src/dev-db/branch-pointer.ts"],"sourcesContent":["/**\n * Which database branch this checkout is working on.\n *\n * `rebase db branch create` made a full copy of the database in about a second\n * and then stopped one step short of being a feature: there was no `switch`, no\n * `--branch` on `rebase dev`, and nothing wrote the branch anywhere a command\n * would read it. The only way to *use* a branch was to hand-edit\n * `DATABASE_URL`, and the documentation claimed otherwise — \"the CLI updates\n * your local development configuration\" — which it did not; the `.env` was\n * byte-identical afterwards.\n *\n * This is that missing step, and the shape of it is chosen to avoid three\n * things:\n *\n * 1. **It does not touch `.env`.** That file holds secrets, comments and the\n *    developer's own ordering, and a command that rewrites it in place will\n *    eventually lose something that was not its business. The branch is\n *    recorded beside the other per-checkout state in `.rebase/`, which is\n *    already gitignored — a branch is a fact about one machine, never about\n *    the project.\n *\n * 2. **It stores a name, not a connection string.** The credentials stay in\n *    exactly one place; the URL is derived by swapping the database name on\n *    the base one at resolution time. A stored URL would be a second copy of\n *    the password, and would go stale the moment `.env` changed.\n *\n * 3. **It does not outrank an explicit instruction.** `--database-url` and a\n *    `DATABASE_URL` in the shell are more immediate and more specific than a\n *    switch made yesterday, so they still win. The pointer sits directly above\n *    the project's `.env`: it is a deliberate, persistent choice, and `.env` is\n *    the project default it is meant to override. Anything less and `switch`\n *    would silently do nothing on every project that sets `DATABASE_URL` —\n *    which is every project not using the managed database.\n */\n\nimport fs from \"fs\";\nimport path from \"path\";\n\n/** Where the pointer lives, next to the rest of the per-checkout state. */\nexport function branchPointerPath(projectRoot: string): string {\n    return path.join(projectRoot, \".rebase\", \"branch.json\");\n}\n\nexport interface ActiveBranch {\n    /** The name the developer typed. */\n    name: string;\n    /** The PostgreSQL database that name refers to. */\n    database: string;\n}\n\n/**\n * The prefix `BranchService` puts on every branch database.\n *\n * Duplicated from the driver rather than imported because the CLI must answer\n * \"which database\" without loading a database driver — `rebase dev` reads this\n * before it knows which plugin the project uses. It is covered by a test that\n * fails if the driver's prefix moves.\n */\nexport const BRANCH_DB_PREFIX = \"rb_\";\n\nexport function branchDatabaseName(name: string): string {\n    return `${BRANCH_DB_PREFIX}${name}`;\n}\n\n/** Read the active branch, or null when the checkout is on the main database. */\nexport function readActiveBranch(projectRoot: string): ActiveBranch | null {\n    try {\n        const raw = fs.readFileSync(branchPointerPath(projectRoot), \"utf-8\");\n        const parsed = JSON.parse(raw) as Partial<ActiveBranch>;\n        if (typeof parsed.name !== \"string\" || typeof parsed.database !== \"string\") return null;\n        if (!parsed.name || !parsed.database) return null;\n\n        return { name: parsed.name, database: parsed.database };\n    } catch {\n        // Absent is the common case and is not an error. A corrupt file is\n        // treated the same way: the answer is \"no branch\", which is the state\n        // the developer can always get back to with `branch switch --off`.\n        return null;\n    }\n}\n\nexport function writeActiveBranch(projectRoot: string, branch: ActiveBranch): void {\n    const file = branchPointerPath(projectRoot);\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    fs.writeFileSync(file, `${JSON.stringify(branch, null, 2)}\\n`, \"utf-8\");\n}\n\n/** Return to the main database. Absent is success — this is idempotent. */\nexport function clearActiveBranch(projectRoot: string): void {\n    fs.rmSync(branchPointerPath(projectRoot), { force: true });\n}\n\n/**\n * The base connection string with its database swapped for the branch's.\n *\n * Everything else is carried across untouched — credentials, host, port, and\n * the query string, which is load-bearing here: `?sslmode=disable` is what a\n * local Docker Postgres needs, and dropping it turns a switch into a TLS error\n * that says nothing about branches.\n *\n * Returns null for a connection string that cannot be parsed, so the caller can\n * say so plainly rather than emitting a mangled URL that fails later.\n */\nexport function branchUrl(baseUrl: string, database: string): string | null {\n    try {\n        const url = new URL(baseUrl);\n        // `pathname` keeps its leading slash; a URL with no database at all\n        // still gets one, which is what connecting to a named branch means.\n        url.pathname = `/${database}`;\n\n        return url.toString();\n    } catch {\n        return null;\n    }\n}\n\n/** The database name in a connection string, for reporting what you are on. */\nexport function databaseNameOf(connectionString: string): string | null {\n    try {\n        const name = new URL(connectionString).pathname.replace(/^\\//, \"\");\n\n        return name || null;\n    } catch {\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,SAAgB,kBAAkB,aAA6B;CAC3D,OAAO,KAAK,KAAK,aAAa,WAAW,aAAa;AAC1D;AAmBA,SAAgB,mBAAmB,MAAsB;CACrD,OAAO,MAAsB;AACjC;;AAGA,SAAgB,iBAAiB,aAA0C;CACvE,IAAI;EACA,MAAM,MAAM,GAAG,aAAa,kBAAkB,WAAW,GAAG,OAAO;EACnE,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IAAI,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,aAAa,UAAU,OAAO;EACnF,IAAI,CAAC,OAAO,QAAQ,CAAC,OAAO,UAAU,OAAO;EAE7C,OAAO;GAAE,MAAM,OAAO;GAAM,UAAU,OAAO;EAAS;CAC1D,QAAQ;EAIJ,OAAO;CACX;AACJ;AAEA,SAAgB,kBAAkB,aAAqB,QAA4B;CAC/E,MAAM,OAAO,kBAAkB,WAAW;CAC1C,GAAG,UAAU,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CACpD,GAAG,cAAc,MAAM,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,KAAK,OAAO;AAC1E;;AAGA,SAAgB,kBAAkB,aAA2B;CACzD,GAAG,OAAO,kBAAkB,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7D;;;;;;;;;;;;AAaA,SAAgB,UAAU,SAAiB,UAAiC;CACxE,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,OAAO;EAG3B,IAAI,WAAW,IAAI;EAEnB,OAAO,IAAI,SAAS;CACxB,QAAQ;EACJ,OAAO;CACX;AACJ;;AAGA,SAAgB,eAAe,kBAAyC;CACpE,IAAI;EAGA,OAFa,IAAI,IAAI,gBAAgB,CAAC,CAAC,SAAS,QAAQ,OAAO,EAExD,KAAQ;CACnB,QAAQ;EACJ,OAAO;CACX;AACJ"}

package/dist/constraints-DKGbNfUW.js

@@ -1,48 +0,0 @@
-//#region src/dev-db/constraints.ts
-/**
-* Extensions to hand PGlite's constructor.
-*
-* `CREATE EXTENSION` alone cannot install these — PGlite resolves them from
-* bundles supplied at construction time, so anything missing here is missing
-* from the database no matter what the migration says.
-*
-* The module is spelled out per extension rather than derived from the name,
-* because they do not all live in the same place: the two contrib ones are
-* subpaths of PGlite itself, and pgvector is a package of its own. Deriving the
-* path is what left `vector` off this list — `@electric-sql/pglite/contrib/vector`
-* does not exist, so a project declaring a `{ type: "vector" }` property could
-* not use the managed dev database at all.
-*/
-var PGLITE_EXTENSIONS = [
-	{
-		name: "pg_trgm",
-		module: "@electric-sql/pglite/contrib/pg_trgm",
-		export: "pg_trgm"
-	},
-	{
-		name: "unaccent",
-		module: "@electric-sql/pglite/contrib/unaccent",
-		export: "unaccent"
-	},
-	{
-		name: "vector",
-		module: "@electric-sql/pglite-pgvector",
-		export: "vector"
-	}
-];
-/**
-* Announced at startup, every time, rather than discovered.
-*
-* A developer who does not know realtime is off will read the silence as a bug
-* in their own code, which is a worse outcome than not offering the managed
-* database at all.
-*/
-var MANAGED_LIMITATIONS = [{
-	id: "concurrency",
-	summary: "Requests are served one at a time. Behaviour is correct but serialized, so lock contention and job-queue concurrency cannot be reproduced here.",
-	remedy: "Reproduce concurrency against a real Postgres: rebase dev --docker"
-}];
-//#endregion
-export { PGLITE_EXTENSIONS as n, MANAGED_LIMITATIONS as t };
-
-//# sourceMappingURL=constraints-DKGbNfUW.js.map

package/dist/constraints-DKGbNfUW.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"constraints-DKGbNfUW.js","names":[],"sources":["../src/dev-db/constraints.ts"],"sourcesContent":["/**\n * What PGlite can and cannot do as a development database, measured rather\n * than assumed.\n *\n * Everything in this directory is shaped by four facts, each established by\n * running it against `@electric-sql/pglite` 0.5.6 and\n * `@electric-sql/pglite-socket` 0.2.9 rather than by reading their docs. They\n * are recorded here because two of them are silent failures — the kind that\n * make a developer lose an evening to a feature that reports success and does\n * nothing.\n *\n * 1. **It is really PostgreSQL 18.3.** `select version()` over the socket\n *    returns `PostgreSQL 18.3 (PGlite 0.5.6) on wasm32`, which is the same\n *    major as the `postgres:18-alpine` the eject template ships. So a dev\n *    database here and a compose database there are the same Postgres, and\n *    schema behaviour does not diverge between them.\n *\n * 2. **`pg_trgm` and `unaccent` are available**, which is what search\n *    collections need. They are not installed by a bare `CREATE EXTENSION`,\n *    though — PGlite ships them as separate bundles that must be passed to the\n *    constructor, and without that `CREATE EXTENSION pg_trgm` fails with\n *    `extension \"pg_trgm\" is not available`. {@link PGLITE_EXTENSIONS} is that\n *    list, and it has to stay in step with what the schema generator emits.\n *\n * 3. **RLS is enforced exactly as it is on a real server.** With\n *    `SET LOCAL ROLE \"rebase_user\"` inside a transaction — which is how\n *    `PostgresBackendDriver` isolates every request — `current_user` becomes\n *    the restricted role, `session_user` stays the owner, and a policy using\n *    `current_setting('app.tenant')` filters rows correctly, including under\n *    `FORCE ROW LEVEL SECURITY`. Measured: an owner saw 3 rows and the\n *    role-switched transaction saw 2, with the cross-tenant probe returning 0.\n *    This is the one that mattered most: a dev database that quietly failed to\n *    apply RLS would give false confidence about the product's central claim.\n *\n * 4. **Concurrency is the real limit, and it fails badly.** PGlite is a single\n *    session, and `PGLiteSocketServer` multiplexes connections onto it. Two\n *    pooled clients that hold *overlapping transactions* deadlock — not error,\n *    hang — which is precisely what a request-per-transaction server does under\n *    any concurrent load. {@link MANAGED_POOL_MAX} is the answer: one client\n *    connection, so requests queue in the pool instead of deadlocking in the\n *    multiplexer. Measured: with a pool of 1, four concurrent queries and a\n *    role-switched RLS transaction all pass; with a pool of 5 the same script\n *    hangs indefinitely.\n *\n * 5. **LISTEN/NOTIFY needed repairing, and now works.** A notification is an\n *    asynchronous message with no request to answer, and the multiplexer hands\n *    it to whichever socket is reading rather than to the one that issued\n *    `LISTEN` — so a dedicated listener connection, which is exactly how the\n *    realtime engine works, received nothing while the *writer* received\n *    notifications it never asked for. `notification-proxy.ts` corrects that by\n *    copying every `NotificationResponse` frame to every client, which for a\n *    single-session database is simply the truth. Realtime therefore works\n *    against the managed database, with no change to the server: it does\n *    ordinary `LISTEN` over ordinary libpq.\n */\n\n/** One extension bundle, and where to import it from. */\nexport interface PgliteExtension {\n    /** The name `CREATE EXTENSION` uses, and the key PGlite is handed. */\n    name: string;\n    /** Module the bundle is imported from. */\n    module: string;\n    /** The named export carrying the bundle. */\n    export: string;\n}\n\n/**\n * Extensions to hand PGlite's constructor.\n *\n * `CREATE EXTENSION` alone cannot install these — PGlite resolves them from\n * bundles supplied at construction time, so anything missing here is missing\n * from the database no matter what the migration says.\n *\n * The module is spelled out per extension rather than derived from the name,\n * because they do not all live in the same place: the two contrib ones are\n * subpaths of PGlite itself, and pgvector is a package of its own. Deriving the\n * path is what left `vector` off this list — `@electric-sql/pglite/contrib/vector`\n * does not exist, so a project declaring a `{ type: \"vector\" }` property could\n * not use the managed dev database at all.\n */\nexport const PGLITE_EXTENSIONS: readonly PgliteExtension[] = [\n    { name: \"pg_trgm\", module: \"@electric-sql/pglite/contrib/pg_trgm\", export: \"pg_trgm\" },\n    { name: \"unaccent\", module: \"@electric-sql/pglite/contrib/unaccent\", export: \"unaccent\" },\n    { name: \"vector\", module: \"@electric-sql/pglite-pgvector\", export: \"vector\" }\n];\n\n/**\n * Client connections the managed database tolerates: exactly one.\n *\n * Not a tuning choice. Two concurrent transactions over the socket\n * multiplexer deadlock, and a request-per-transaction server produces those\n * the moment two requests overlap. One connection converts that deadlock into\n * ordinary queueing, which is slower and correct.\n */\nexport const MANAGED_POOL_MAX = 1;\n\n/**\n * Connections the socket server will accept.\n *\n * Above {@link MANAGED_POOL_MAX} so that a second *non-transactional* client —\n * `rebase db push` in another terminal while `rebase dev` runs — is refused\n * with a connection error rather than corrupting the multiplexer. The pool\n * limit is what prevents overlapping transactions; this only stops a stampede.\n */\nexport const MANAGED_SERVER_MAX_CONNECTIONS = 4;\n\n/** What a managed PGlite database cannot do, in the words the user needs. */\nexport interface ManagedLimitation {\n    /** Stable id, so a warning can be suppressed or tested for. */\n    id: string;\n    /** One line, naming the feature rather than the mechanism. */\n    summary: string;\n    /** What to do instead. Always a concrete command. */\n    remedy: string;\n}\n\n/**\n * Announced at startup, every time, rather than discovered.\n *\n * A developer who does not know realtime is off will read the silence as a bug\n * in their own code, which is a worse outcome than not offering the managed\n * database at all.\n */\nexport const MANAGED_LIMITATIONS: readonly ManagedLimitation[] = [\n    {\n        id: \"concurrency\",\n        summary:\n            \"Requests are served one at a time. Behaviour is correct but serialized, so \" +\n            \"lock contention and job-queue concurrency cannot be reproduced here.\",\n        remedy: \"Reproduce concurrency against a real Postgres: rebase dev --docker\"\n    }\n] as const;\n"],"mappings":";;;;;;;;;;;;;;;AAgFA,IAAa,oBAAgD;CACzD;EAAE,MAAM;EAAW,QAAQ;EAAwC,QAAQ;CAAU;CACrF;EAAE,MAAM;EAAY,QAAQ;EAAyC,QAAQ;CAAW;CACxF;EAAE,MAAM;EAAU,QAAQ;EAAiC,QAAQ;CAAS;AAChF;;;;;;;;AAuCA,IAAa,sBAAoD,CAC7D;CACI,IAAI;CACJ,SACI;CAEJ,QAAQ;AACZ,CACJ"}