@rebasepro/cli 0.24.0 → 0.24.1-canary.g19596ef

package/templates/generated-schemas/blank.ts

@@ -0,0 +1,40 @@
+// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.
+
+import { boolean, jsonb, pgPolicy, pgSchema, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { relations as drizzleRelations, sql } from 'drizzle-orm';
+
+export const rebaseSchema = pgSchema("rebase");
+
+
+export const users = rebaseSchema.table("users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    email: text("email").unique().notNull(),
+    displayName: text("display_name"),
+    photoURL: text("photo_url"),
+    roles: text("roles").array(),
+    passwordHash: text("password_hash"),
+    emailVerified: boolean("email_verified").default(sql`FALSE`),
+    emailVerificationToken: text("email_verification_token"),
+    emailVerificationSentAt: timestamp("email_verification_sent_at", { withTimezone: true, mode: 'string' }),
+    metadata: jsonb("metadata").default(sql`'{}'::jsonb`),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`),
+    updatedAt: timestamp("updated_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("users_select_5f32f06", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_self_read", { as: "permissive", for: "select", to: ["public"], using: sql`(id)::text = (SELECT rebase.uid())` }),
+    pgPolicy("users_require_admin_write_insert", { as: "restrictive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_update", { as: "restrictive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_delete", { as: "restrictive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const tables = { users };
+export const enums = {  };
+export const relations = {  };
+

package/templates/generated-schemas/blog.ts

@@ -0,0 +1,127 @@
+// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.
+
+import { type AnyPgColumn, boolean, index, integer, jsonb, pgEnum, pgPolicy, pgSchema, pgTable, primaryKey, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { relations as drizzleRelations, sql } from 'drizzle-orm';
+
+export const rebaseSchema = pgSchema("rebase");
+
+export const postsStatus = pgEnum("posts_status", ["draft", "review", "published"]);
+
+export const authors = pgTable("authors", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull(),
+    picture: text("picture")
+}, (table) => ([
+    pgPolicy("authors_select_841c287", { as: "permissive", for: "select", to: ["public"], using: sql`true` }),
+    pgPolicy("authors_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("authors_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("authors_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("authors_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("authors_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("authors_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("authors_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const posts = pgTable("posts", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    title: text("title").notNull(),
+    content: text("content"),
+    status: postsStatus("status"),
+    authorId: integer("author_id").references((): AnyPgColumn => authors.id, { onDelete: "set null" })
+}, (table) => ([
+    index("posts_author_id_ix_00ad191").on(table.authorId.asc().nullsLast()),
+    pgPolicy("posts_select_841c287", { as: "permissive", for: "select", to: ["public"], using: sql`true` }),
+    pgPolicy("posts_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("posts_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("posts_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("posts_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const postsTags = pgTable("posts_tags", {
+    post_id: integer("post_id").notNull().references((): AnyPgColumn => posts.id, { onDelete: "cascade" }),
+    tag_id: integer("tag_id").notNull().references((): AnyPgColumn => tags.id, { onDelete: "cascade" }),
+}, (table) => ([
+    primaryKey({ columns: [table.post_id, table.tag_id] }),
+    index("posts_tags_tag_id_ix_d4456f1").on(table.tag_id.asc().nullsLast()),
+    pgPolicy("posts_tags_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("posts_tags_default_edge_read", { as: "permissive", for: "select", to: ["public"], using: sql`(EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE "_ex0".id = "public"."posts_tags".post_id)) AND (EXISTS (SELECT 1 FROM "public"."tags" "_ex1" WHERE "_ex1".id = "public"."posts_tags".tag_id))` }),
+    pgPolicy("posts_tags_default_edge_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))` }),
+    pgPolicy("posts_tags_default_edge_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))`, withCheck: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))` }),
+    pgPolicy("posts_tags_default_edge_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`EXISTS (SELECT 1 FROM "public"."posts" "_ex0" WHERE ("_ex0".id = "public"."posts_tags".post_id) AND ((SELECT (string_to_array(rebase.roles(), ',') && ARRAY['admin']))))` }),
+])).enableRLS();
+
+export const tags = pgTable("tags", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull()
+}, (table) => ([
+    pgPolicy("tags_select_841c287", { as: "permissive", for: "select", to: ["public"], using: sql`true` }),
+    pgPolicy("tags_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("tags_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("tags_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("tags_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("tags_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("tags_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("tags_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const users = rebaseSchema.table("users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    email: text("email").unique().notNull(),
+    displayName: text("display_name"),
+    photoURL: text("photo_url"),
+    roles: text("roles").array(),
+    passwordHash: text("password_hash"),
+    emailVerified: boolean("email_verified").default(sql`FALSE`),
+    emailVerificationToken: text("email_verification_token"),
+    emailVerificationSentAt: timestamp("email_verification_sent_at", { withTimezone: true, mode: 'string' }),
+    metadata: jsonb("metadata").default(sql`'{}'::jsonb`),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`),
+    updatedAt: timestamp("updated_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("users_select_5f32f06", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_self_read", { as: "permissive", for: "select", to: ["public"], using: sql`(id)::text = (SELECT rebase.uid())` }),
+    pgPolicy("users_require_admin_write_insert", { as: "restrictive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_update", { as: "restrictive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_delete", { as: "restrictive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const postsRelations = drizzleRelations(posts, ({ one, many }) => ({
+    "author": one(authors, {
+        fields: [posts.authorId],
+        references: [authors.id],
+        relationName: "posts_authorId"
+    }),
+    "tags": many(postsTags, { relationName: "tags" })
+}));
+
+export const postsTagsRelations = drizzleRelations(postsTags, ({ one, many }) => ({
+    "post_id": one(posts, {
+        fields: [postsTags.post_id],
+        references: [posts.id],
+        relationName: "tags"
+    }),
+    "tag_id": one(tags, {
+        fields: [postsTags.tag_id],
+        references: [tags.id],
+        relationName: "posts_tags_tag_id"
+    })
+}));
+
+export const tables = { authors, posts, postsTags, tags, users };
+export const enums = { postsStatus };
+export const relations = { postsRelations, postsTagsRelations };
+

package/templates/generated-schemas/ecommerce.ts

@@ -0,0 +1,93 @@
+// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.
+
+import { type AnyPgColumn, boolean, index, integer, jsonb, numeric, pgEnum, pgPolicy, pgSchema, pgTable, text, timestamp, uuid } from 'drizzle-orm/pg-core';
+import { relations as drizzleRelations, sql } from 'drizzle-orm';
+
+export const rebaseSchema = pgSchema("rebase");
+
+export const ordersStatus = pgEnum("orders_status", ["pending", "processing", "shipped", "delivered", "cancelled"]);
+export const productsStatus = pgEnum("products_status", ["draft", "active", "archived"]);
+
+export const categories = pgTable("categories", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull(),
+    slug: text("slug").notNull(),
+    description: text("description"),
+    icon: text("icon")
+}, (table) => ([
+    pgPolicy("categories_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("categories_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("categories_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("categories_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const orders = pgTable("orders", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    customerEmail: text("customer_email").notNull(),
+    status: ordersStatus("status"),
+    total: numeric("total").notNull(),
+    notes: text("notes"),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("orders_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("orders_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("orders_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("orders_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const products = pgTable("products", {
+    id: integer("id").generatedByDefaultAsIdentity().primaryKey(),
+    name: text("name").notNull(),
+    description: text("description"),
+    price: numeric("price").notNull(),
+    image: text("image"),
+    status: productsStatus("status"),
+    categoryId: integer("category_id").references((): AnyPgColumn => categories.id, { onDelete: "set null" })
+}, (table) => ([
+    index("products_category_id_ix_066548f").on(table.categoryId.asc().nullsLast()),
+    pgPolicy("products_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("products_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("products_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("products_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const users = rebaseSchema.table("users", {
+    id: uuid("id").primaryKey().defaultRandom(),
+    email: text("email").unique().notNull(),
+    displayName: text("display_name"),
+    photoURL: text("photo_url"),
+    roles: text("roles").array(),
+    passwordHash: text("password_hash"),
+    emailVerified: boolean("email_verified").default(sql`FALSE`),
+    emailVerificationToken: text("email_verification_token"),
+    emailVerificationSentAt: timestamp("email_verification_sent_at", { withTimezone: true, mode: 'string' }),
+    metadata: jsonb("metadata").default(sql`'{}'::jsonb`),
+    createdAt: timestamp("created_at", { withTimezone: true, mode: 'string' }).default(sql`now()`),
+    updatedAt: timestamp("updated_at", { withTimezone: true, mode: 'string' }).default(sql`now()`)
+}, (table) => ([
+    pgPolicy("users_select_5f32f06", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_insert_3561e70_0", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_update_3561e70_1", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])`, withCheck: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_delete_3561e70_2", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT string_to_array(rebase.roles(), ',') && ARRAY['admin'])` }),
+    pgPolicy("users_default_admin_read", { as: "permissive", for: "select", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_insert", { as: "permissive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_update", { as: "permissive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_admin_write_delete", { as: "permissive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_default_self_read", { as: "permissive", for: "select", to: ["public"], using: sql`(id)::text = (SELECT rebase.uid())` }),
+    pgPolicy("users_require_admin_write_insert", { as: "restrictive", for: "insert", to: ["public"], withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_update", { as: "restrictive", for: "update", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))`, withCheck: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+    pgPolicy("users_require_admin_write_delete", { as: "restrictive", for: "delete", to: ["public"], using: sql`(SELECT (rebase.uid() IS NULL) OR (string_to_array(rebase.roles(), ',') && ARRAY['admin']))` }),
+])).enableRLS();
+
+export const productsRelations = drizzleRelations(products, ({ one, many }) => ({
+    "category": one(categories, {
+        fields: [products.categoryId],
+        references: [categories.id],
+        relationName: "products_categoryId"
+    })
+}));
+
+export const tables = { categories, orders, products, users };
+export const enums = { ordersStatus, productsStatus };
+export const relations = { productsRelations };
+

package/templates/overlays/baas/config/package.json

@@ -16,6 +16,7 @@
     "@rebasepro/types": "workspace:*"
   },
   "devDependencies": {
+    "@types/node": "^22.19.4",
     "typescript": "^6.0.3"
   },
   "exports": {

package/templates/overlays/baas/package.json

@@ -22,6 +22,7 @@
     "devDependencies": {
         "@rebasepro/cli": "workspace:*",
         "@rebasepro/types": "workspace:*",
+        "@types/node": "^22.19.4",
         "tsx": "^4.20.6",
         "typescript": "^6.0.3"
     },

package/templates/template/.env.example

@@ -161,14 +161,20 @@ VITE_API_URL=
 # In production, "local" means NO file storage: uploads answer
 # 501 STORAGE_NOT_CONFIGURED instead of landing on a container filesystem that
 # is erased on the next redeploy. Configure a bucket below to switch it on, or
-# set FORCE_LOCAL_STORAGE=true if a durable volume really is mounted at
-# STORAGE_PATH (the generated docker-compose.yml does exactly that).
+# set FORCE_LOCAL_STORAGE=true if a durable volume really holds STORAGE_PATH
+# (the generated docker-compose.yml does exactly that). Mount it on the parent
+# of STORAGE_PATH: a named local bucket keeps its files beside it, in
+# <STORAGE_PATH>__<key>, and those belong on the volume too.
 #
 # STORAGE_TYPE=local
 
 # --- Local filesystem (default — great for dev and single-server deployments) --
-# STORAGE_PATH=./uploads
-# FORCE_LOCAL_STORAGE=true      # Only with a durable volume mounted at STORAGE_PATH
+# Unset, files land in <project>/uploads, under `rebase dev` and in the server
+# `rebase eject` writes alike. A relative path is read from the directory the
+# server runs in: the project root under `rebase dev`, backend/ after
+# `rebase eject`. So ./uploads names two places, and an absolute path one.
+# STORAGE_PATH=/absolute/path/to/uploads
+# FORCE_LOCAL_STORAGE=true      # Only with a durable volume holding STORAGE_PATH
 
 # --- S3-compatible (AWS S3, Cloudflare R2, MinIO, Hetzner Object Storage, Backblaze B2) ---
 # STORAGE_TYPE=s3

package/templates/template/README.md

@@ -40,7 +40,7 @@ every collection declared there, and serves the API and the admin panel.
 `rebase dev` prints the two URLs it actually bound. The first account you
 register becomes the admin. `REBASE_ADMIN_EMAIL` and `REBASE_ADMIN_PASSWORD` in
 `.env` are ignored here and read by the production boot below, where that window
-is shut — see [Self-hosting](#self-hosting-with-docker).
+is shut — see [Self-hosting](#self-hosting).
 
 Ports are **derived from this project's path**, not fixed at 3001/5173, so
 several Rebase projects can run at once without colliding. That is why the URL
@@ -53,9 +53,10 @@ built bundle). Pin a port with `rebase dev --port 3001` if you need a stable one
 Uncomment `DATABASE_URL` in `.env` and run `pnpm dev` again. Nothing else
 changes. A `DATABASE_URL` that is already set is never touched.
 
-With your own database you also get the migration commands, which the managed
-one cannot offer — they plan changes with Atlas, which needs a second empty
-database to compare against, and PGlite serves exactly one:
+The migration commands work on either database. They plan changes with Atlas,
+which needs a second empty database to compare against: beside your own
+database Rebase makes one, and on the managed one, which serves exactly one,
+the command starts a throwaway in-memory PGlite:
 
 ```bash
 pnpm run db:push
@@ -81,12 +82,18 @@ docker compose up -d db
 │   └── src/            # Generated database schema
 ├── config/             # Shared collection definitions
 │   └── collections/    # Schema-as-Code TypeScript files
+├── scripts/            # Scripts that call the API, e.g. example.ts
 ├── rebase.json         # Which apps this repository contains
 ├── docker-compose.yml  # Self-hosting stack (Postgres + the Rebase runtime)
 ├── .env.example        # Environment variable reference
+├── tsconfig.json       # Typechecks scripts/ only
 └── package.json        # Root workspace config
 ```
 
+Each workspace typechecks on its own, with its own `tsconfig.json`:
+`cd backend && npx tsc --noEmit`, and the same in `config/` and `frontend/`.
+`tsc --noEmit` at the root checks `scripts/`.
+
 There is no Dockerfile, and that is deliberate: `rebase build` produces a
 **bundle** — your compiled collections, functions, crons and admin assets — and
 the published `rebasepro/server` image boots it. The artifact you self-host is

package/templates/template/ai-instructions.md

@@ -7,7 +7,8 @@
 | Command | What it does |
 |---|---|
 | `pnpm dev` | Backend, frontend and the managed development database, together |
-| `pnpm schema:generate` then `pnpm db:push` | The same loop with `pnpm dev` not running, plus the changes boot leaves alone: collections → Drizzle schema → development database |
+| `pnpm schema:generate` then `pnpm generate:sdk` | The same loop with `pnpm dev` not running: collections → Drizzle schema and SDK types. The next boot creates what is missing |
+| `pnpm db:push` | The changes boot leaves alone (a rename, a narrowed type, a removed field), on the managed development database as on your own PostgreSQL |
 | `pnpm db:generate` then `pnpm db:migrate` | The production path — write the migration file, then apply it |
 | `pnpm schema:introspect` | The other direction: existing tables → collection definitions |
 | `pnpm generate:sdk` | Regenerate the typed client in `generated/sdk/` from the collections. `pnpm dev` already does this on start and on every save; the script is for CI and for when `pnpm dev` is not running |
@@ -30,7 +31,7 @@
 ## Core rules
 
 1. **Schema-as-code**: define and edit collections in `config/collections/` with `defineCollection` from `@rebasepro/cms-types`, one collection per file, default-exported. Every file in that directory is loaded — by the backend, the admin panel and the SDK generator — whether or not `index.ts` lists it: the barrel is a sort order for the admin navigation (and holds `defaultSecurityRules`), not a registry. To remove a collection, delete its file. Never hand-edit generated schemas or Postgres tables.
-2. **Applying a collection change**: while `pnpm dev` is running, saving a file in `config/collections/` is the whole step — it regenerates `backend/src/schema.generated.ts` and the SDK types in `generated/sdk/`, restarts the backend, and boot creates the tables and columns that are missing. With `pnpm dev` stopped, that is `pnpm schema:generate` and `pnpm generate:sdk`. `pnpm db:push` is only for what boot deliberately leaves alone — a renamed column, a narrowed type, a removed field — and it needs your own PostgreSQL, not the managed development database. In production the pair is `pnpm db:generate` then `pnpm db:migrate`.
+2. **Applying a collection change**: while `pnpm dev` is running, saving a file in `config/collections/` is the whole step — it regenerates `backend/src/schema.generated.ts` and the SDK types in `generated/sdk/`, restarts the backend, and boot creates the tables and columns that are missing. With `pnpm dev` stopped, that is `pnpm schema:generate` and `pnpm generate:sdk`. `pnpm db:push` is only for what boot deliberately leaves alone — a renamed column, a narrowed type, a removed field — on the managed development database as on your own PostgreSQL. In production the pair is `pnpm db:generate` then `pnpm db:migrate`.
 3. **Use the SDK**: server-side that is `rebase.dataAsAdmin.<slug>` for work done as the service identity, or `getDriver(c)` inside a function when the read should run as the caller. The server client has no plain `data` accessor — it is omitted precisely so that the choice of identity is written down.
 4. **Guard every custom route**: routes in `backend/functions/` are mounted **without** an auth requirement — webhook receivers need that — so each one is public until you guard it. Import `requireAuth` / `requireAdmin` from `@rebasepro/server/functions` and pass them in the route's own middleware slot (`app.post("/", requireAuth, handler)`), not via `app.use()`, which only covers routes declared below it. Reading `getUser(c)` is not a guard: an anonymous caller gets `undefined` and the handler still runs. See `backend/functions/hello.ts` for all three tiers.
 5. **In `backend/functions/`, always import from `@rebasepro/server/functions`** — never from `@rebasepro/server`. Both work today; the subpath is the portable one, and it also gives you the typed context accessors (`getUser`, `getDriver`, `requireDriver`) instead of casting `c.get("user")`. The package root is for a server entrypoint, not for route handlers.

package/templates/template/config/resources.ts

@@ -43,12 +43,13 @@ export const main = database();
  * export const files = bucket({ engine: "s3" });
  * export const media = bucket("media", { engine: "s3" });
  *
- * One of them has to be the one an upload reaches when the property names no
- * `storageSource` — the default-keyed `bucket()` above, or a named bucket
- * marked `bucket("media", { engine: "s3", default: true })`. A project of named
- * buckets with no default refuses to boot rather than have one chosen for it:
- * that choice used to be made by declaration order, and it came out differently
- * in development and in production.
+ * An upload whose property names no `storageSource` goes to the default
+ * bucket, which keeps its own variables — `STORAGE_PATH` (else `./uploads`),
+ * `S3_BUCKET` / `GCS_BUCKET` — whatever you declare here, so adding
+ * `bucket("media")` never moves the files already there. To send those
+ * uploads to a named bucket instead, mark it:
+ * `bucket("media", { engine: "s3", default: true })`. Two buckets may not
+ * share a directory or a bucket; boot refuses if they would.
  *
  * Point a property at it by handle — the same name, spelled once:
  *

package/templates/template/docker-compose.yml

@@ -147,7 +147,13 @@ services:
       # container filesystem is destroyed on the next deploy and every uploaded
       # file goes with it. Switch to STORAGE_TYPE=s3 or gcs and drop both lines
       # if you move storage off-box.
-      STORAGE_PATH: /uploads
+      #
+      # The volume is mounted at /storage, one level above STORAGE_PATH, because
+      # every bucket you declare in config/resources.ts gets a directory beside
+      # this one: bucket("media") is /storage/uploads__media. Mounted at
+      # /storage/uploads itself, the volume would hold the default bucket only,
+      # and every other bucket's files would go with the container.
+      STORAGE_PATH: /storage/uploads
       FORCE_LOCAL_STORAGE: "true"
     volumes:
       # Your built project. `rebase build` installs its declared dependencies
@@ -156,10 +162,10 @@ services:
       # that runs after it. Drop the `:ro` if you build with `--no-vendor`: the
       # runtime installs at every start instead, and needs to write here.
       - ./dist-bundle:/bundle:ro
-      - uploads:/uploads
+      - storage:/storage
 
 volumes:
   postgres_data:
     driver: local
-  uploads:
+  storage:
     driver: local

package/templates/template/frontend/vite.config.ts

@@ -30,9 +30,9 @@ export default defineConfig({
             "@remix-run/router"
         ]
     },
-    esbuild: {
-        logOverride: { "this-is-undefined-in-esm": "silent" }
-    },
+    // No `esbuild` block: Vite 8 transforms with oxc and ignores it, and
+    // having one made every `rebase dev` and build print "Both esbuild and oxc
+    // options were set".
     build: {
         minify: true,
         outDir: "./dist",
@@ -42,6 +42,8 @@ export default defineConfig({
         // successful JS transform, so the build fails at the very end.
         target: "es2022",
         sourcemap: true,
+        // The admin's own chunks are already code-split and the warning names only them, never this project's code.
+        chunkSizeWarningLimit: Infinity,
         rollupOptions: {
             output: {
                 // These rules are copied in rather than taken from
@@ -75,6 +77,14 @@ export default defineConfig({
                     // anchor a heavy one to the critical path.
                     if (id.includes("commonjsHelpers") || id.includes("commonjs-dynamic-modules")) return "vendor-commonjs-helpers";
 
+                    // Small libraries the entry needs, named before the heavy groups. A name
+                    // takes the unassigned dependencies of its modules with it, so
+                    // `prism-react-renderer` took `clsx` — which the kit imports statically — and
+                    // the entry imported 85 kB of syntax highlighter for a 633-byte helper;
+                    // React core landed in `vendor-dnd` the same way.
+                    if (/[\\/]node_modules[\\/](react|scheduler|use-sync-external-store)[\\/]/.test(id)) return "vendor-react";
+                    if (/[\\/]node_modules[\\/]clsx[\\/]/.test(id)) return "vendor-clsx";
+
                     if (id.includes("exceljs")) return "vendor-exceljs";
                     if (id.includes("prosemirror")) return "vendor-prosemirror";
                     if (id.includes("monaco-editor") || id.includes("@monaco-editor")) return "vendor-monaco";

package/templates/template/package.json

@@ -27,6 +27,7 @@
         "@rebasepro/cli": "workspace:*",
         "@rebasepro/mcp": "workspace:*",
         "@rebasepro/types": "workspace:*",
+        "@types/node": "^22.19.4",
         "tsx": "^4.20.6",
         "typescript": "^6.0.3"
     },

package/templates/template/scripts/example.ts

@@ -30,7 +30,8 @@ import { createRebaseClient } from "@rebasepro/client";
 // import { collectionsDictionary, type Database } from "../generated/sdk/database.types";
 
 // Load .env from project root (same file the backend uses)
-dotenv.config({ path: path.resolve(process.cwd(), ".env") });
+// `quiet`: dotenv 17 otherwise prints its own advertisement banner.
+dotenv.config({ path: path.resolve(process.cwd(), ".env"), quiet: true });
 
 // ─── Resolve Backend URL ─────────────────────────────────────────────
 let baseUrl = process.env.REBASE_URL;

package/templates/template/tsconfig.json

@@ -0,0 +1,25 @@
+{
+  // The project root's own program: `scripts/`, which no workspace compiles.
+  //
+  // frontend/, backend/ and config/ each typecheck on their own, with the
+  // tsconfig in that folder — `cd backend && tsc --noEmit` — and this file
+  // does not reach into them: it would compile their code under options that
+  // are not theirs. Without it, `tsc --noEmit` here printed tsc's help and
+  // exited 0, which reads as a passing check of nothing.
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    // Pinned, as every workspace's tsconfig is: unset, tsc sweeps every
+    // `node_modules/@types` it can reach, the pnpm virtual store included.
+    "types": ["node"]
+  },
+  "include": ["scripts/**/*"]
+}