@rebasepro/cli 0.9.0 → 0.9.1-canary.0de22e0

package/dist/utils/package-manager.d.ts

@@ -20,13 +20,27 @@ export interface PMCommands {
     workspaceProtocol: string;
 }
 /**
- * Detect the package manager from the environment or the target directory.
+ * Whether pnpm is runnable on this machine.
+ *
+ * Used to decide whether a fresh project can be scaffolded with pnpm. Kept
+ * cheap and non-interactive (short timeout, output discarded) so it never
+ * hangs detection if a corepack shim misbehaves.
+ */
+export declare function isPnpmAvailable(): boolean;
+/**
+ * Detect the package manager for a Rebase project.
+ *
+ * Rebase recommends pnpm, so detection prefers it. Crucially, *how the CLI was
+ * invoked* (`npx` vs `pnpm dlx`, i.e. `npm_config_user_agent`) is deliberately
+ * ignored: running `npx @rebasepro/cli init` says nothing about how the user
+ * wants to manage the project they're creating, and letting it pin the scaffold
+ * to npm is what made every `npx`-invoked project an npm project.
  *
  * Detection order:
- * 1. Explicit override (if provided)
- * 2. `npm_config_user_agent` env var (set by npm/pnpm when running via `npx`/`pnpm dlx`)
- * 3. Lock-file presence in the target directory
- * 4. Default to pnpm (Rebase's recommended PM)
+ * 1. An existing lock file — an explicit choice we always respect
+ *    (`pnpm-lock.yaml` wins over `package-lock.json` when both are present).
+ * 2. pnpm, whenever it is installed.
+ * 3. npm, only as a fallback when pnpm is genuinely unavailable.
  */
 export declare function detectPackageManager(targetDir?: string): PackageManager;
 /** Build the command helpers for a given package manager. */

package/dist/utils/project.d.ts

@@ -11,7 +11,7 @@ export declare function findProjectRoot(startDir?: string): string | null;
  */
 export declare function findBackendDir(projectRoot: string): string | null;
 /**
- * Detect the active backend plugin (e.g. @rebasepro/server-postgresql) from the backend's package.json.
+ * Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.
  */
 export declare function getActiveBackendPlugin(backendDir: string): string | null;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.9.0",
+  "version": "0.9.1-canary.0de22e0",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,11 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.9.0",
-    "@rebasepro/sdk-generator": "0.9.0",
-    "@rebasepro/server-core": "0.9.0",
-    "@rebasepro/types": "0.9.0",
-    "@rebasepro/server-postgresql": "0.9.0"
+    "@rebasepro/agent-skills": "0.9.1-canary.0de22e0",
+    "@rebasepro/client": "0.9.1-canary.0de22e0",
+    "@rebasepro/server-postgres": "0.9.1-canary.0de22e0",
+    "@rebasepro/types": "0.9.1-canary.0de22e0",
+    "@rebasepro/server": "0.9.1-canary.0de22e0",
+    "@rebasepro/codegen": "0.9.1-canary.0de22e0"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
@@ -64,7 +65,7 @@
   "scripts": {
     "test": "vitest run",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json && node ../../scripts/assert-build-output.mjs",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }
 }

package/templates/overlays/baas/README.md

@@ -0,0 +1,55 @@
+# {{PROJECT_NAME}}
+
+A headless Rebase backend: a REST API, auth, storage, realtime and backups over
+your PostgreSQL database.
+
+There are no collection files. The server reads your database schema at boot and
+serves your tables, so the API follows your migrations — change the schema and
+the endpoints change with it.
+
+## Serving a table
+
+A table is served once it has an authorization model: row-level security enabled
+plus at least one policy. Until then the server skips it — deliberately, so a new
+table is never exposed just by existing — and logs each table it skipped and why.
+
+```sql
+ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+CREATE POLICY your_table_owner ON your_table
+    FOR ALL USING (user_id = auth.uid());
+```
+
+`auth.uid()`, `auth.roles()` and `auth.jwt()` are provided by Rebase and read the
+identity of the authenticated request.
+
+To serve unprotected tables anyway (development only), set
+`baas: { unprotectedTables: "serve" }` in `backend/src/index.ts`.
+
+## Run it
+
+```bash
+pnpm install
+pnpm dev
+```
+
+- API: `http://localhost:3001/api/data/<table>`
+- Docs: `http://localhost:3001/api/swagger`
+- Health: `http://localhost:3001/health`
+
+Set `DATABASE_URL` in `.env` to point at your database.
+
+## Use it from an app
+
+```ts
+import { createRebaseClient } from "@rebasepro/client";
+
+const rebase = createRebaseClient({ baseUrl: "http://localhost:3001" });
+const posts = await rebase.data.collection("posts").find();
+```
+
+## Adding an admin UI later
+
+Nothing here locks you out of it. Switch `mode` to `"cms"` in
+`backend/src/index.ts`, add a `config/collections` directory, and add a frontend
+that renders them. See MODULAR-ARCHITECTURE.md in the Rebase repo for the three
+adoption modes.

package/templates/overlays/baas/backend/package.json

@@ -0,0 +1,31 @@
+{
+    "name": "{{PROJECT_NAME}}-backend",
+    "version": "1.0.0",
+    "description": "Rebase BaaS — headless PostgreSQL API",
+    "main": "src/index.ts",
+    "type": "module",
+    "scripts": {
+        "dev": "tsx watch --include=\"./functions/**/*\" src/index.ts",
+        "build": "tsc",
+        "start": "node dist/index.js"
+    },
+    "dependencies": {
+        "@rebasepro/server": "workspace:*",
+        "@rebasepro/server-postgres": "workspace:*",
+        "@rebasepro/types": "workspace:*",
+        "drizzle-orm": "^0.45.2",
+        "hono": "^4.12.10",
+        "@hono/node-server": "^1.19.12",
+        "pg": "^8.11.3",
+        "ws": "^8.16.0",
+        "dotenv": "^16.0.0",
+        "zod": "^4.4.3"
+    },
+    "devDependencies": {
+        "@types/pg": "^8.6.5",
+        "@types/node": "^20.10.5",
+        "@types/ws": "^8.5.10",
+        "tsx": "^4.20.6",
+        "typescript": "^5.9.2"
+    }
+}

package/templates/overlays/baas/backend/src/index.ts

@@ -0,0 +1,192 @@
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { secureHeaders } from "hono/secure-headers";
+import { getRequestListener } from "@hono/node-server";
+import { createServer } from "http";
+import path from "path";
+import { fileURLToPath } from "url";
+import {
+    initializeRebaseBackend,
+    installShutdownHandlers,
+    HonoEnv,
+    listenWithPortRetry,
+    cleanupDevPortFile,
+    logger
+} from "@rebasepro/server";
+import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
+import { env } from "./env.js";
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+
+// ─── App ─────────────────────────────────────────────────────────────
+const app: Hono<HonoEnv> = new Hono<HonoEnv>();
+
+const isProduction = env.NODE_ENV === "production";
+const allowedOrigins = isProduction
+    ? (() => {
+        const origins = env.CORS_ORIGINS || env.FRONTEND_URL;
+        if (!origins) {
+            throw new Error(
+                "CORS_ORIGINS or FRONTEND_URL must be set in production. " +
+                "Example: CORS_ORIGINS=https://yourdomain.com"
+            );
+        }
+        return origins.split(",").map(s => s.trim());
+    })()
+    : [];
+
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
+app.use("/*", cors({
+    origin: (origin) => {
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
+    },
+    credentials: true
+}));
+
+app.use("/*", secureHeaders());
+
+// ─── Database ────────────────────────────────────────────────────────
+const databaseUrl = env.DATABASE_URL;
+
+const { db, pool, connectionString } = createPostgresDatabaseConnection(databaseUrl);
+
+// ─── Start ───────────────────────────────────────────────────────────
+async function startServer() {
+    const jwtSecret = env.JWT_SECRET;
+    const PORT = env.PORT;
+    const server = createServer(getRequestListener(app.fetch));
+
+    const backend = await initializeRebaseBackend({
+        // BaaS mode: every RLS-protected table is served over REST. There are
+        // no collection files to write or keep in sync — change the schema with
+        // a migration and the API follows.
+        //
+        // Your database's own row-level security is the whole authorization
+        // model here: requests run as the `rebase_user` role, so a table
+        // without RLS has no rules at all and is not served. Protect one with:
+        //   ALTER TABLE mytable ENABLE ROW LEVEL SECURITY;
+        //   CREATE POLICY mytable_read ON mytable FOR SELECT TO public USING (true);
+        mode: "baas",
+        functionsDir: path.resolve(__dirname, "../functions"),
+        server,
+        app,
+        database: createPostgresAdapter({
+            connection: db,
+            adminConnectionString: env.ADMIN_CONNECTION_STRING || databaseUrl,
+            connectionString
+        }),
+        auth: {
+            // No `collection` here: BaaS mode has no collection files, and the
+            // auth adapter owns its own user tables.
+            jwtSecret,
+            accessExpiresIn: env.JWT_ACCESS_EXPIRES_IN,
+            refreshExpiresIn: env.JWT_REFRESH_EXPIRES_IN,
+            serviceKey: env.REBASE_SERVICE_KEY,
+            cookieAuth: { sameSite: "Lax" },
+            google: env.GOOGLE_CLIENT_ID
+                ? { clientId: env.GOOGLE_CLIENT_ID }
+                : undefined,
+            allowRegistration: env.ALLOW_REGISTRATION,
+            email: env.SMTP_HOST
+                ? {
+                    from: env.SMTP_FROM || `${env.APP_NAME} <noreply@rebase.pro>`,
+                    smtp: {
+                        host: env.SMTP_HOST,
+                        port: env.SMTP_PORT,
+                        secure: env.SMTP_SECURE,
+                        auth: env.SMTP_USER
+                            ? { user: env.SMTP_USER,
+pass: env.SMTP_PASS! }
+                            : undefined,
+                        name: env.SMTP_NAME
+                    },
+                    appName: env.APP_NAME,
+                    resetPasswordUrl: env.FRONTEND_URL
+                }
+                : undefined
+        },
+        storage: env.STORAGE_TYPE === "s3"
+            ? {
+                type: "s3",
+                bucket: env.S3_BUCKET!,
+                region: env.S3_REGION || "auto",
+                accessKeyId: env.S3_ACCESS_KEY_ID || "",
+                secretAccessKey: env.S3_SECRET_ACCESS_KEY || "",
+                endpoint: env.S3_ENDPOINT,
+                forcePathStyle: env.S3_FORCE_PATH_STYLE
+            }
+            : {
+                type: "local",
+                basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
+            },
+        history: true,
+        enableSwagger: true
+    });
+
+    // ─── Health check ─────────────────────────────────────────────
+    app.get("/health", async (c) => {
+        const result = await backend.healthCheck();
+        const status = result.healthy ? 200 : 503;
+        return c.json({
+            status: result.healthy ? "ok" : "degraded",
+            latencyMs: result.latencyMs,
+            ...(result.details ? { details: result.details } : {})
+        }, status);
+    });
+
+    // No serveSPA: this is a headless API. Point any frontend at it over HTTP.
+
+    if (!isProduction) {
+        // Dev mode: retry the next port if the current one is in use
+        const projectRoot = path.resolve(__dirname, "../..");
+        const actualPort = await listenWithPortRetry(server, PORT, { portFileDir: projectRoot, serviceKey: env.REBASE_SERVICE_KEY });
+
+        // Clean up port file on exit
+        const cleanup = () => cleanupDevPortFile(projectRoot);
+        process.on("SIGINT", cleanup);
+        process.on("SIGTERM", cleanup);
+        process.on("exit", cleanup);
+
+        logger.info(`API running at http://localhost:${actualPort}`);
+        // Docs are only mounted once there is something to document; with no
+        // servable tables the URL would 404, so don't advertise it.
+        if (backend.collectionRegistry.getCollections().length > 0) {
+            logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
+        }
+    } else {
+        server.listen(PORT, () => {
+            logger.info(`API running at http://localhost:${PORT}`);
+        });
+    }
+
+    // ─── Graceful Shutdown ───────────────────────────────────────────────
+    // Drains HTTP, stops crons, tears down realtime, then closes the pool.
+    // Guards against double signals and force-exits if shutdown hangs.
+    installShutdownHandlers(backend, {
+        onCleanup: () => pool.end()
+    });
+}
+
+startServer().catch(err => {
+    logger.error("Failed to start server", { error: err instanceof Error ? err : new Error(String(err)) });
+    process.exit(1);
+});
+
+export { app };

package/templates/overlays/baas/backend/tsconfig.json

@@ -0,0 +1,19 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "node",
+    "lib": ["ES2022"],
+    "outDir": "./dist",
+    "rootDir": "./src",
+    "strict": true,
+    "esModuleInterop": true,
+    "allowSyntheticDefaultImports": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "resolveJsonModule": true,
+    "declaration": true,
+    "sourceMap": true
+  },
+  "include": ["src/**/*"]
+}

package/templates/overlays/baas/package.json

@@ -0,0 +1,42 @@
+{
+    "name": "{{PROJECT_NAME}}",
+    "version": "1.0.0",
+    "description": "Rebase BaaS — headless PostgreSQL API",
+    "private": true,
+    "type": "module",
+    "workspaces": [
+        "backend"
+    ],
+    "scripts": {
+        "dev": "rebase dev",
+        "build": "rebase build",
+        "start": "rebase start",
+        "db:migrate": "rebase db migrate",
+        "schema:introspect": "rebase schema introspect",
+        "generate:sdk": "rebase generate-sdk",
+        "skills:install": "rebase skills install",
+        "example": "tsx scripts/example.ts",
+        "deploy": "rebase build && rebase start"
+    },
+    "devDependencies": {
+        "@rebasepro/cli": "workspace:*",
+        "@rebasepro/types": "workspace:*",
+        "concurrently": "^8.2.2",
+        "tsx": "^4.20.6",
+        "typescript": "^5.9.2"
+    },
+    "dependencies": {
+        "@rebasepro/client": "workspace:*",
+        "dotenv": "^16.0.0"
+    },
+    "engines": {
+        "node": ">=18.0.0"
+    },
+    "pnpm": {
+        "onlyBuiltDependencies": [
+            "esbuild",
+            "sharp",
+            "@ariga/atlas"
+        ]
+    }
+}

package/templates/overlays/baas/pnpm-workspace.yaml

@@ -0,0 +1,9 @@
+packages:
+  - "backend"
+linkWorkspacePackages: true
+blockExoticSubdeps: false
+minimumReleaseAge: 0
+allowBuilds:
+  esbuild: true
+  sharp: true
+  "@ariga/atlas": true

package/templates/template/.env.example

@@ -7,11 +7,21 @@
 # Database connection string (required)
 # You can use PostgreSQL (postgresql://) or MongoDB (mongodb:// or mongodb+srv://).
 # The backend will automatically detect the database type.
-DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public
+# sslmode=disable matches the local docker-compose database, which has no TLS;
+# schema tooling (atlas) would otherwise default to requiring SSL. Remove it
+# when pointing at a managed/cloud database.
+DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 # DATABASE_URL=mongodb://localhost:27017/rebase
 #
-# Local Postgres without SSL? If you see "SSL is not enabled on the server",
-# append &sslmode=disable to the connection string, e.g.:
+# Seeing "SSL is not enabled on the server"? Something in your environment
+# asks for SSL — almost always a global PGSSLMODE=require
+# (set once for a cloud database, then inherited by every local project), or an
+# sslmode=require copied in with a connection string.
+#
+# Prefer unsetting PGSSLMODE for this project. Rebase deliberately does not
+# downgrade SSL for you when you have asked for it, not even on localhost:
+# quietly ignoring a security setting is worse than a clear failure. To opt out
+# explicitly for a local database, say so:
 #   DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 
 # Separate admin connection string for migrations and schema operations (optional)
@@ -97,6 +107,18 @@ VITE_API_URL=http://localhost:3001
 # For native GCS SDK or other providers (Azure Blob, etc.), implement the
 # StorageController interface and pass it directly in your backend config.
 
+# ── Backups (optional) ────────────────────────────────────────────────────────
+# Manual backups: `rebase db backup --out ./backups` (or an s3://… URL).
+# Scheduled backups: set BACKUP_SCHEDULE and add a cron file in backend/crons
+# that default-exports createBackupCron (from @rebasepro/server-postgres).
+# Backups contain secrets & PII — use a PRIVATE destination with encryption-at-rest.
+# BACKUP_SCHEDULE=0 3 * * *           # cron expression; unset ⇒ scheduled backups off
+# BACKUP_DESTINATION=./backups        # local path, or s3://bucket/prefix / gs://bucket/prefix
+# BACKUP_RETENTION_DAYS=14            # delete backups older than N days (unset/0 ⇒ keep all)
+# BACKUP_KEEP_MINIMUM=3               # always retain at least N most-recent backups
+# PG_DUMP_PATH=                       # override pg_dump binary (must match server major version)
+# PG_RESTORE_PATH=                    # override pg_restore binary
+
 # ── Admin Service Key (optional) ──────────────────────────────────────────────
 # When set, scripts authenticate with: Authorization: Bearer <key>
 # Generate with: node -e "console.log(require('crypto').randomBytes(48).toString('base64'))"

package/templates/template/backend/functions/hello.ts

@@ -1,4 +1,4 @@
-import { defineFunction } from "@rebasepro/server-core";
+import { defineFunction } from "@rebasepro/server";
 
 /**
  * Example custom function route.

package/templates/template/backend/package.json

@@ -5,24 +5,23 @@
     "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
+        "dev": "tsx watch --include=\"../config/**/*\" --include=\"./functions/**/*\" src/index.ts",
         "build": "rebase schema generate --collections ../config/collections && tsc",
         "start": "node dist/backend/src/index.js"
     },
     "dependencies": {
         "{{PROJECT_NAME}}-config": "*",
-        "@rebasepro/server-core": "workspace:*",
-        "@rebasepro/server-postgresql": "workspace:*",
-        "@rebasepro/admin": "workspace:*",
+        "@rebasepro/server": "workspace:*",
+        "@rebasepro/server-postgres": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "drizzle-orm": "^0.45.2",
-        "hono": "^4.12.10",
+        "hono": "^4.12.25",
         "@hono/node-server": "^1.19.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
-        "react-compiler-runtime": "^1.0.0",
         "dotenv": "^16.0.0",
-        "zod": "^4.4.3"
+        "zod": "^4.4.3",
+        "ts-morph": "28.0.0"
     },
     "devDependencies": {
         "@types/pg": "^8.6.5",

package/templates/template/backend/src/env.ts

@@ -1,13 +1,42 @@
 import * as dotenv from "dotenv";
+import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
-import { loadEnv } from "@rebasepro/server-core";
+import { loadEnv } from "@rebasepro/server";
 import { z } from "zod";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+/**
+ * Locate the project's `.env` by walking up the directory tree.
+ *
+ * A fixed relative path can't work in both modes: in dev this file runs from
+ * source at `backend/src/env.ts`, but the compiled output lives at
+ * `backend/dist/backend/src/env.js` — two directories deeper — so
+ * `../../.env` points at a file that doesn't exist in production. Walking up
+ * finds the root `.env` from either location.
+ */
+function findEnvFile(startDir: string): string | undefined {
+    let dir = startDir;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const candidate = path.join(dir, ".env");
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir) return undefined;
+        dir = parent;
+    }
+}
+
+// `rebase start` sets DOTENV_CONFIG_PATH to the project's .env; honor it first,
+// then fall back to searching up from this file. When neither is found (e.g. a
+// production host that injects env vars directly), skip dotenv entirely and let
+// the real process environment flow through.
+const envPath = process.env.DOTENV_CONFIG_PATH || findEnvFile(__dirname);
+if (envPath && fs.existsSync(envPath)) {
+    dotenv.config({ path: envPath });
+}
 
 export const env = loadEnv({
     extend: z.object({

package/templates/template/backend/src/index.ts

@@ -13,9 +13,8 @@ import {
     listenWithPortRetry,
     cleanupDevPortFile,
     logger
-} from "@rebasepro/server-core";
-import type { SecurityRule } from "@rebasepro/types";
-import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgresql";
+} from "@rebasepro/server";
+import { createPostgresDatabaseConnection, createPostgresAdapter } from "@rebasepro/server-postgres";
 import { enums, relations, tables } from "./schema.generated.js";
 import { env } from "./env.js";
 import usersCollection from "../../config/collections/users.js";
@@ -40,10 +39,26 @@ const allowedOrigins = isProduction
     })()
     : [];
 
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
 app.use("/*", cors({
     origin: (origin) => {
-        if (!isProduction) return origin || "*";
-        return allowedOrigins.includes(origin) ? origin : null;
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
     },
     credentials: true
 }));
@@ -61,15 +76,6 @@ async function startServer() {
     const PORT = env.PORT;
     const server = createServer(getRequestListener(app.fetch));
 
-    // Default security rules for collections that don't define their own.
-    // Authenticated users can read all rows; only admins can write.
-    const defaultSecurityRules: SecurityRule[] = [
-        { operation: "select",
-access: "public" },
-        { operations: ["insert", "update", "delete"],
-roles: ["admin"] }
-    ];
-
     const backend = await initializeRebaseBackend({
         collectionsDir: path.resolve(__dirname, "../../config/collections"),
         functionsDir: path.resolve(__dirname, "../functions"),
@@ -131,8 +137,7 @@ pass: env.SMTP_PASS! }
                 type: "local",
                 basePath: env.STORAGE_PATH || path.resolve(__dirname, "../../uploads")
             },
-        history: true,
-        defaultSecurityRules
+        history: true
     });
 
     // ─── Health check ─────────────────────────────────────────────

package/templates/template/config/collections/index.ts

@@ -2,5 +2,25 @@ import postsCollection from "./posts.js";
 import authorsCollection from "./authors.js";
 import tagsCollection from "./tags.js";
 import usersCollection from "./users.js";
+import type { SecurityRule } from "@rebasepro/types";
 
 export const collections = [postsCollection, authorsCollection, tagsCollection, usersCollection];
+
+/**
+ * Applied to any collection in this directory that declares no
+ * `securityRules` of its own: anyone can read, only admins can write.
+ *
+ * These live here, next to the collections, because `rebase db push`
+ * generates the Postgres policies from these files — that is what actually
+ * enforces access. A default declared on the server could never reach the
+ * database.
+ *
+ * A collection that declares neither its own rules nor inherits these is
+ * locked by default: admin-only.
+ */
+export const defaultSecurityRules: SecurityRule[] = [
+    { operation: "select",
+access: "public" },
+    { operations: ["insert", "update", "delete"],
+roles: ["admin"] }
+];

package/templates/template/config/collections/presets/blank/index.ts

@@ -1,3 +1,5 @@
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [usersCollection];