@rebasepro/cli 0.9.1-canary.a57c262 → 0.9.1-canary.a8dbf1c

package/dist/utils/package-manager.d.ts

@@ -20,13 +20,27 @@ export interface PMCommands {
     workspaceProtocol: string;
 }
 /**
- * Detect the package manager from the environment or the target directory.
+ * Whether pnpm is runnable on this machine.
+ *
+ * Used to decide whether a fresh project can be scaffolded with pnpm. Kept
+ * cheap and non-interactive (short timeout, output discarded) so it never
+ * hangs detection if a corepack shim misbehaves.
+ */
+export declare function isPnpmAvailable(): boolean;
+/**
+ * Detect the package manager for a Rebase project.
+ *
+ * Rebase recommends pnpm, so detection prefers it. Crucially, *how the CLI was
+ * invoked* (`npx` vs `pnpm dlx`, i.e. `npm_config_user_agent`) is deliberately
+ * ignored: running `npx @rebasepro/cli init` says nothing about how the user
+ * wants to manage the project they're creating, and letting it pin the scaffold
+ * to npm is what made every `npx`-invoked project an npm project.
  *
  * Detection order:
- * 1. Explicit override (if provided)
- * 2. `npm_config_user_agent` env var (set by npm/pnpm when running via `npx`/`pnpm dlx`)
- * 3. Lock-file presence in the target directory
- * 4. Default to pnpm (Rebase's recommended PM)
+ * 1. An existing lock file — an explicit choice we always respect
+ *    (`pnpm-lock.yaml` wins over `package-lock.json` when both are present).
+ * 2. pnpm, whenever it is installed.
+ * 3. npm, only as a fallback when pnpm is genuinely unavailable.
  */
 export declare function detectPackageManager(targetDir?: string): PackageManager;
 /** Build the command helpers for a given package manager. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.9.1-canary.a57c262",
+  "version": "0.9.1-canary.a8dbf1c",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/client": "0.9.1-canary.a57c262",
-    "@rebasepro/codegen": "0.9.1-canary.a57c262",
-    "@rebasepro/agent-skills": "0.9.1-canary.a57c262",
-    "@rebasepro/server-postgres": "0.9.1-canary.a57c262",
-    "@rebasepro/types": "0.9.1-canary.a57c262",
-    "@rebasepro/server": "0.9.1-canary.a57c262"
+    "@rebasepro/agent-skills": "0.9.1-canary.a8dbf1c",
+    "@rebasepro/client": "0.9.1-canary.a8dbf1c",
+    "@rebasepro/server": "0.9.1-canary.a8dbf1c",
+    "@rebasepro/codegen": "0.9.1-canary.a8dbf1c",
+    "@rebasepro/server-postgres": "0.9.1-canary.a8dbf1c",
+    "@rebasepro/types": "0.9.1-canary.a8dbf1c"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
@@ -66,6 +66,7 @@
     "test": "vitest run",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
     "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json && node ../../scripts/assert-build-output.mjs",
-    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
+    "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",
+    "typecheck:test": "tsc --noEmit -p tsconfig.test.json"
   }
 }

package/templates/overlays/baas/README.md

@@ -4,9 +4,27 @@ A headless Rebase backend: a REST API, auth, storage, realtime and backups over
 your PostgreSQL database.
 
 There are no collection files. The server reads your database schema at boot and
-serves every table, so the API follows your migrations — change the schema and
+serves your tables, so the API follows your migrations — change the schema and
 the endpoints change with it.
 
+## Serving a table
+
+A table is served once it has an authorization model: row-level security enabled
+plus at least one policy. Until then the server skips it — deliberately, so a new
+table is never exposed just by existing — and logs each table it skipped and why.
+
+```sql
+ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+CREATE POLICY your_table_owner ON your_table
+    FOR ALL USING (user_id = auth.uid());
+```
+
+`auth.uid()`, `auth.roles()` and `auth.jwt()` are provided by Rebase and read the
+identity of the authenticated request.
+
+To serve unprotected tables anyway (development only), set
+`baas: { unprotectedTables: "serve" }` in `backend/src/index.ts`.
+
 ## Run it
 
 ```bash

package/templates/overlays/baas/backend/package.json

@@ -7,7 +7,7 @@
     "scripts": {
         "dev": "tsx watch --include=\"./functions/**/*\" src/index.ts",
         "build": "tsc",
-        "start": "node dist/backend/src/index.js"
+        "start": "node dist/index.js"
     },
     "dependencies": {
         "@rebasepro/server": "workspace:*",

package/templates/overlays/baas/backend/src/index.ts

@@ -36,10 +36,26 @@ const allowedOrigins = isProduction
     })()
     : [];
 
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
 app.use("/*", cors({
     origin: (origin) => {
-        if (!isProduction) return origin || "*";
-        return allowedOrigins.includes(origin) ? origin : null;
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
     },
     credentials: true
 }));
@@ -149,7 +165,11 @@ pass: env.SMTP_PASS! }
         process.on("exit", cleanup);
 
         logger.info(`API running at http://localhost:${actualPort}`);
-        logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
+        // Docs are only mounted once there is something to document; with no
+        // servable tables the URL would 404, so don't advertise it.
+        if (backend.collectionRegistry.getCollections().length > 0) {
+            logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
+        }
     } else {
         server.listen(PORT, () => {
             logger.info(`API running at http://localhost:${PORT}`);

package/templates/overlays/baas/backend/tsconfig.json

@@ -5,6 +5,7 @@
     "moduleResolution": "node",
     "lib": ["ES2022"],
     "outDir": "./dist",
+    "rootDir": "./src",
     "strict": true,
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
@@ -14,5 +15,5 @@
     "declaration": true,
     "sourceMap": true
   },
-  "include": ["src/**/*", "drizzle.config.ts"]
+  "include": ["src/**/*"]
 }

package/templates/template/backend/src/env.ts

@@ -1,4 +1,5 @@
 import * as dotenv from "dotenv";
+import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { loadEnv } from "@rebasepro/server";
@@ -7,7 +8,35 @@ import { z } from "zod";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+/**
+ * Locate the project's `.env` by walking up the directory tree.
+ *
+ * A fixed relative path can't work in both modes: in dev this file runs from
+ * source at `backend/src/env.ts`, but the compiled output lives at
+ * `backend/dist/backend/src/env.js` — two directories deeper — so
+ * `../../.env` points at a file that doesn't exist in production. Walking up
+ * finds the root `.env` from either location.
+ */
+function findEnvFile(startDir: string): string | undefined {
+    let dir = startDir;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const candidate = path.join(dir, ".env");
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir) return undefined;
+        dir = parent;
+    }
+}
+
+// `rebase start` sets DOTENV_CONFIG_PATH to the project's .env; honor it first,
+// then fall back to searching up from this file. When neither is found (e.g. a
+// production host that injects env vars directly), skip dotenv entirely and let
+// the real process environment flow through.
+const envPath = process.env.DOTENV_CONFIG_PATH || findEnvFile(__dirname);
+if (envPath && fs.existsSync(envPath)) {
+    dotenv.config({ path: envPath });
+}
 
 export const env = loadEnv({
     extend: z.object({

package/templates/template/backend/src/index.ts

@@ -39,10 +39,26 @@ const allowedOrigins = isProduction
     })()
     : [];
 
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
 app.use("/*", cors({
     origin: (origin) => {
-        if (!isProduction) return origin || "*";
-        return allowedOrigins.includes(origin) ? origin : null;
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
     },
     credentials: true
 }));

package/templates/template/config/collections/presets/blank/index.ts

@@ -1,3 +1,5 @@
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [usersCollection];

package/templates/template/config/collections/presets/ecommerce/index.ts

@@ -1,6 +1,8 @@
 import productsCollection from "./products.js";
 import categoriesCollection from "./categories.js";
 import ordersCollection from "./orders.js";
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [productsCollection, categoriesCollection, ordersCollection, usersCollection];

package/templates/template/config/collections/users.ts

@@ -66,6 +66,7 @@ roles: ["admin"] }
             name: "Password Hash",
             type: "string",
             columnName: "password_hash",
+            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
@@ -85,6 +86,7 @@ roles: ["admin"] }
             name: "Email Verification Token",
             type: "string",
             columnName: "email_verification_token",
+            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }