@rebasepro/cli 0.7.0 → 0.9.0

package/dist/utils/project.d.ts

@@ -35,6 +35,21 @@ export declare function resolveLocalBin(projectRoot: string, binName: string): s
  * Resolve the tsx binary. Checks backend node_modules first, then root.
  */
 export declare function resolveTsx(projectRoot: string): string | null;
+/**
+ * Validate that a resolved tsx binary actually has an intact installation.
+ *
+ * `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
+ * exists. If the pnpm content-addressable store was cleaned or a previous
+ * install was interrupted, the symlink can exist while critical files inside
+ * the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
+ * confusing MODULE_NOT_FOUND error at runtime.
+ *
+ * This function follows the symlink, walks up to find the tsx package root
+ * (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
+ * is present. Returns `null` when the installation looks healthy, or an
+ * error description string when it appears corrupted.
+ */
+export declare function validateTsxInstallation(tsxBinPath: string): string | null;
 /**
  * Require the project root or exit with a helpful error.
  */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -13,12 +13,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "scripts": {
-    "test": "vitest run",
-    "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json",
-    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
-  },
   "keywords": [
     "cli",
     "create-rebase-app",
@@ -31,17 +25,17 @@
   "author": "rebase.pro",
   "license": "MIT",
   "dependencies": {
-    "@rebasepro/agent-skills": "workspace:*",
-    "@rebasepro/sdk-generator": "workspace:*",
-    "@rebasepro/server-core": "workspace:*",
-    "@rebasepro/server-postgresql": "workspace:*",
-    "@rebasepro/types": "workspace:*",
     "arg": "^5.0.2",
     "chalk": "^5.6.2",
     "dotenv": "^17.4.2",
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
-    "jiti": "^2.7.0"
+    "jiti": "^2.7.0",
+    "@rebasepro/agent-skills": "0.9.0",
+    "@rebasepro/sdk-generator": "0.9.0",
+    "@rebasepro/server-core": "0.9.0",
+    "@rebasepro/types": "0.9.0",
+    "@rebasepro/server-postgresql": "0.9.0"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
@@ -67,10 +61,10 @@
     "url": "https://github.com/rebasepro/rebase.git",
     "directory": "packages/cli"
   },
-  "pnpm": {
-    "onlyBuiltDependencies": [
-      "esbuild",
-      "sharp"
-    ]
+  "scripts": {
+    "test": "vitest run",
+    "test:e2e": "vitest run --config vitest.e2e.config.ts",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json",
+    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }
-}
+}

package/templates/template/.env.example

@@ -9,6 +9,10 @@
 # The backend will automatically detect the database type.
 DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public
 # DATABASE_URL=mongodb://localhost:27017/rebase
+#
+# Local Postgres without SSL? If you see "SSL is not enabled on the server",
+# append &sslmode=disable to the connection string, e.g.:
+#   DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 
 # Separate admin connection string for migrations and schema operations (optional)
 # Falls back to DATABASE_URL if not set

package/templates/template/backend/Dockerfile

@@ -14,12 +14,12 @@ ENV PATH="$PNPM_HOME:$PATH"
 RUN corepack enable
 
 # Native dependencies for bcrypt, pg, etc.
-RUN apk add --no-cache python3 make g++
+RUN apk add --no-cache python3 make g++ curl ca-certificates
 
 WORKDIR /app
 
 # Copy workspace root files first (cache-friendly layer)
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
 
 # Copy workspace packages
 COPY backend ./backend
@@ -41,6 +41,7 @@ FROM node:22-alpine AS runtime
 ENV PNPM_HOME="/pnpm"
 ENV PATH="$PNPM_HOME:$PATH"
 ENV NODE_ENV=production
+ENV CI=true
 
 RUN corepack enable
 
@@ -50,7 +51,7 @@ RUN addgroup -g 1001 rebase && adduser -u 1001 -G rebase -s /bin/sh -D rebase
 WORKDIR /app
 
 # Copy only production artifacts
-COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml ./
+COPY --from=builder /app/package.json /app/pnpm-lock.yaml /app/pnpm-workspace.yaml /app/.npmrc ./
 COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/backend ./backend
 COPY --from=builder /app/config ./config

package/templates/template/backend/functions/hello.ts

@@ -1,6 +1,4 @@
-import { Hono } from "hono";
-import type { HonoEnv } from "@rebasepro/server-core";
-import { rebase } from "@rebasepro/server-core";
+import { defineFunction } from "@rebasepro/server-core";
 
 /**
  * Example custom function route.
@@ -12,41 +10,47 @@ import { rebase } from "@rebasepro/server-core";
  * Call from the client SDK:
  *   const result = await client.call("functions/hello", { name: "World" });
  *
- * This is a standard Hono app — use any Hono middleware,
- * define any HTTP methods, access the request/response directly.
+ * Authored with `defineFunction`, which hands you a pre-typed Hono app
+ * (so `c.get("user")` / `c.get("driver")` are typed) and the `rebase`
+ * singleton via the injected context — use any Hono middleware, define any
+ * HTTP methods, access the request/response directly.
  *
- * The `rebase` singleton gives you admin-level access to all
- * app-scoped services (data, auth, storage, email) from anywhere.
- * For request-scoped / RLS-scoped access, use c.get("user") and c.get("driver").
+ * `rebase.dataAsAdmin` gives you admin-level access to your data and
+ * **bypasses RLS** — use it only for trusted admin work. For request-scoped /
+ * RLS-scoped data access, use c.get("user") and c.get("driver"), which carry
+ * the caller's identity. (`rebase` also exposes auth, storage, email.)
  */
-const app = new Hono<HonoEnv>();
+export default defineFunction((app, { rebase }) => {
+    void rebase; // available for dataAsAdmin/auth/storage/email — see commented usage below
 
-app.post("/", async (c) => {
-    const body = await c.req.json().catch(() => ({}));
-    const user = c.get("user");
+    app.post("/", async (c) => {
+        const body = await c.req.json().catch(() => ({}));
+        const user = c.get("user");
 
-    const userId = (user && typeof user === "object" && "userId" in user)
-        ? user.userId
-        : "anonymous";
+        const userId = (user && typeof user === "object" && "userId" in user)
+            ? user.userId
+            : "anonymous";
 
-    // Access any Rebase service — just import and use:
-    // await rebase.email?.send({
-    //     to: "admin@example.com",
-    //     subject: "Function called",
-    //     html: `<p>Hello from ${userId}!</p>`,
-    // });
-    //
-    // const authors = await rebase.data.authors.find({ limit: 5 });
+        // Access any Rebase service via the injected `rebase`:
+        // await rebase.email.send({
+        //     to: "admin@example.com",
+        //     subject: "Function called",
+        //     html: `<p>Hello from ${userId}!</p>`,
+        // });
+        //
+        // Admin-scoped data (bypasses RLS — trusted work only):
+        // const authors = await rebase.dataAsAdmin.authors.find({ limit: 5 });
+        // For user-scoped data (RLS applies), use the request-scoped driver
+        // (c.get("driver")), which carries the caller's identity.
 
-    return c.json({
-        message: `Hello, ${body.name || "World"}!`,
-        user: userId
+        return c.json({
+            message: `Hello, ${body.name || "World"}!`,
+            user: userId
+        });
     });
-});
 
-app.get("/", (c) => {
-    return c.json({ status: "ok",
-endpoint: "hello" });
+    app.get("/", (c) => {
+        return c.json({ status: "ok",
+            endpoint: "hello" });
+    });
 });
-
-export default app;

package/templates/template/backend/package.json

@@ -14,13 +14,15 @@
         "@rebasepro/server-core": "workspace:*",
         "@rebasepro/server-postgresql": "workspace:*",
         "@rebasepro/admin": "workspace:*",
+        "@rebasepro/types": "workspace:*",
         "drizzle-orm": "^0.45.2",
         "hono": "^4.12.10",
         "@hono/node-server": "^1.19.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
         "react-compiler-runtime": "^1.0.0",
-        "dotenv": "^16.0.0"
+        "dotenv": "^16.0.0",
+        "zod": "^4.4.3"
     },
     "devDependencies": {
         "@types/pg": "^8.6.5",

package/templates/template/backend/src/env.ts

@@ -1,7 +1,8 @@
 import * as dotenv from "dotenv";
 import path from "path";
 import { fileURLToPath } from "url";
-import { loadEnv, z } from "@rebasepro/server-core";
+import { loadEnv } from "@rebasepro/server-core";
+import { z } from "zod";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);

package/templates/template/backend/src/index.ts

@@ -7,6 +7,7 @@ import path from "path";
 import { fileURLToPath } from "url";
 import {
     initializeRebaseBackend,
+    installShutdownHandlers,
     serveSPA,
     HonoEnv,
     listenWithPortRetry,
@@ -88,10 +89,15 @@ relations },
             accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
             refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
             serviceKey: env.REBASE_SERVICE_KEY,
+            // Cookie-based auth: the refresh token is stored in an httpOnly
+            // cookie (not readable by JS) instead of localStorage, so it is
+            // not exposed to XSS. The frontend opts in via
+            // `authFlowMode: "cookie"` on createRebaseClient. Requires CORS
+            // `credentials: true` (set above).
+            cookieAuth: { sameSite: "Lax" },
             google: env.GOOGLE_CLIENT_ID
                 ? { clientId: env.GOOGLE_CLIENT_ID }
                 : undefined,
-            seedDefaultRoles: true,
             allowRegistration: env.ALLOW_REGISTRATION,
             email: env.SMTP_HOST
                 ? {
@@ -164,17 +170,11 @@ pass: env.SMTP_PASS! }
     }
 
     // ─── Graceful Shutdown ───────────────────────────────────────────────
-    // Uses the framework's built-in shutdown() which drains connections,
-    // stops the cron scheduler, and force-exits after 15s timeout.
-    const gracefulShutdown = async (signal: string) => {
-        logger.info(`Received ${signal}, shutting down...`);
-        await backend.shutdown();
-        await pool.end();
-        logger.info("Database pool closed");
-        process.exit(0);
-    };
-    process.on("SIGTERM", () => gracefulShutdown("SIGTERM"));
-    process.on("SIGINT", () => gracefulShutdown("SIGINT"));
+    // Drains HTTP, stops crons, tears down realtime, then closes the pool.
+    // Guards against double signals and force-exits if shutdown hangs.
+    installShutdownHandlers(backend, {
+        onCleanup: () => pool.end()
+    });
 }
 
 startServer().catch(err => {

package/templates/template/config/collections/authors.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const authorsCollection: EntityCollection = {
+const authorsCollection: CollectionConfig = {
     name: "Authors",
     singularName: "Author",
     slug: "authors",

package/templates/template/config/collections/posts.ts

@@ -1,8 +1,8 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 import authorsCollection from "./authors.js";
 import tagsCollection from "./tags.js";
 
-const postsCollection: EntityCollection = {
+const postsCollection: CollectionConfig = {
     name: "Posts",
     singularName: "Post",
     slug: "posts",
@@ -24,7 +24,9 @@ const postsCollection: EntityCollection = {
         content: {
             name: "Content",
             type: "string",
-            markdown: true
+            ui: {
+                markdown: true
+            }
         },
         status: {
             name: "Status",

package/templates/template/config/collections/presets/ecommerce/categories.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const categoriesCollection: EntityCollection = {
+const categoriesCollection: CollectionConfig = {
     name: "Categories",
     singularName: "Category",
     slug: "categories",
@@ -25,7 +25,9 @@ const categoriesCollection: EntityCollection = {
         description: {
             name: "Description",
             type: "string",
-            multiline: true
+            ui: {
+                multiline: true
+            }
         },
         icon: {
             name: "Icon",

package/templates/template/config/collections/presets/ecommerce/orders.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const ordersCollection: EntityCollection = {
+const ordersCollection: CollectionConfig = {
     name: "Orders",
     singularName: "Order",
     slug: "orders",
@@ -47,7 +47,9 @@ color: "red" }
         notes: {
             name: "Notes",
             type: "string",
-            multiline: true
+            ui: {
+                multiline: true
+            }
         },
         createdAt: {
             name: "Created At",

package/templates/template/config/collections/presets/ecommerce/products.ts

@@ -1,7 +1,7 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 import categoriesCollection from "./categories.js";
 
-const productsCollection: EntityCollection = {
+const productsCollection: CollectionConfig = {
     name: "Products",
     singularName: "Product",
     slug: "products",
@@ -21,7 +21,9 @@ const productsCollection: EntityCollection = {
         description: {
             name: "Description",
             type: "string",
-            markdown: true
+            ui: {
+                markdown: true
+            }
         },
         price: {
             name: "Price",

package/templates/template/config/collections/tags.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-const tagsCollection: EntityCollection = {
+const tagsCollection: CollectionConfig = {
     name: "Tags",
     singularName: "Tag",
     slug: "tags",

package/templates/template/config/collections/users.ts

@@ -1,6 +1,6 @@
-import type { EntityCollection } from "@rebasepro/types";
+import type { CollectionConfig } from "@rebasepro/types";
 
-const usersCollection: EntityCollection = {
+const usersCollection: CollectionConfig = {
     name: "Users",
     singularName: "User",
     slug: "users",
@@ -44,7 +44,9 @@ roles: ["admin"] }
             name: "Photo URL",
             type: "string",
             columnName: "photo_url",
-            url: "image"
+            ui: {
+                url: "image"
+            }
         },
         roles: {
             name: "Roles",

package/templates/template/frontend/Dockerfile

@@ -17,14 +17,16 @@ RUN apk add --no-cache python3 make g++
 WORKDIR /app
 
 # Copy workspace root files
-COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
+COPY package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc ./
 
 # Copy workspace packages
 COPY frontend ./frontend
 COPY config ./config
 
-# Install dependencies
-RUN pnpm install --frozen-lockfile
+# Install dependencies (skip scripts to avoid @ariga/atlas binary download,
+# which is a backend-only dependency that may fail on certain platforms)
+RUN pnpm install --frozen-lockfile --ignore-scripts
+RUN pnpm rebuild esbuild
 
 # Build config first, then frontend
 RUN pnpm --filter "*-config" run build

package/templates/template/frontend/src/App.tsx

@@ -17,7 +17,10 @@ const GOOGLE_CLIENT_ID = import.meta.env.VITE_GOOGLE_CLIENT_ID;
 
 export function App() {
     const rebaseClient = React.useMemo(() => createRebaseClient({
-        baseUrl: API_URL
+        baseUrl: API_URL,
+        // Store the refresh token in an httpOnly cookie (XSS-safe) rather than
+        // localStorage. The backend issues it via `auth.cookieAuth`.
+        auth: { authFlowMode: "cookie" }
     }), []);
 
     const authController = useRebaseAuthController({

package/templates/template/frontend/vite.config.ts

@@ -7,6 +7,20 @@ import { rebaseCollectionsPlugin } from "@rebasepro/core/vitePlugin";
 
 export default defineConfig({
     envDir: path.resolve(__dirname, ".."),
+    // Force a single copy of React and React Router across the app and all
+    // @rebasepro/* packages. Without this, a locally `link:`ed Rebase checkout
+    // resolves its own copies of react-router, producing "multiple copies of
+    // React" and "useBlocker must be used within a data router" errors in the
+    // admin. Safe to keep for npm-installed setups too.
+    resolve: {
+        dedupe: [
+            "react",
+            "react-dom",
+            "react-router",
+            "react-router-dom",
+            "@remix-run/router"
+        ]
+    },
     esbuild: {
         logOverride: { "this-is-undefined-in-esm": "silent" }
     },

package/templates/template/package.json

@@ -24,6 +24,7 @@
     },
     "devDependencies": {
         "@rebasepro/cli": "workspace:*",
+        "@rebasepro/types": "workspace:*",
         "concurrently": "^8.2.2",
         "typescript": "^5.9.2"
     },
@@ -33,7 +34,8 @@
     "pnpm": {
         "onlyBuiltDependencies": [
             "esbuild",
-            "sharp"
+            "sharp",
+            "@ariga/atlas"
         ]
     }
 }

package/templates/template/pnpm-workspace.yaml

@@ -7,5 +7,7 @@ blockExoticSubdeps: false
 minimumReleaseAge: 0
 allowBuilds:
   esbuild: true
+  sharp: true
+  "@ariga/atlas": true
   "{{PROJECT_NAME}}-config": true
 

package/templates/template/scripts/example.ts

@@ -3,7 +3,7 @@
  *
  * Scripts run OUTSIDE the server and need explicit authentication.
  * Use a Service Key (set in .env as REBASE_SERVICE_KEY) to get admin
- * access — similar to a Firebase Service Account credential.
+ * access — similar to a Service Account credential.
  *
  * Usage:
  *   # With local dev server running (`pnpm dev` in another terminal):