@rebasepro/cli 0.9.1-canary.f2f61da → 0.9.1-canary.fd3754b

package/dist/utils/package-manager.d.ts

@@ -20,27 +20,13 @@ export interface PMCommands {
     workspaceProtocol: string;
 }
 /**
- * Whether pnpm is runnable on this machine.
- *
- * Used to decide whether a fresh project can be scaffolded with pnpm. Kept
- * cheap and non-interactive (short timeout, output discarded) so it never
- * hangs detection if a corepack shim misbehaves.
- */
-export declare function isPnpmAvailable(): boolean;
-/**
- * Detect the package manager for a Rebase project.
- *
- * Rebase recommends pnpm, so detection prefers it. Crucially, *how the CLI was
- * invoked* (`npx` vs `pnpm dlx`, i.e. `npm_config_user_agent`) is deliberately
- * ignored: running `npx @rebasepro/cli init` says nothing about how the user
- * wants to manage the project they're creating, and letting it pin the scaffold
- * to npm is what made every `npx`-invoked project an npm project.
+ * Detect the package manager from the environment or the target directory.
  *
  * Detection order:
- * 1. An existing lock file — an explicit choice we always respect
- *    (`pnpm-lock.yaml` wins over `package-lock.json` when both are present).
- * 2. pnpm, whenever it is installed.
- * 3. npm, only as a fallback when pnpm is genuinely unavailable.
+ * 1. Explicit override (if provided)
+ * 2. `npm_config_user_agent` env var (set by npm/pnpm when running via `npx`/`pnpm dlx`)
+ * 3. Lock-file presence in the target directory
+ * 4. Default to pnpm (Rebase's recommended PM)
  */
 export declare function detectPackageManager(targetDir?: string): PackageManager;
 /** Build the command helpers for a given package manager. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.9.1-canary.f2f61da",
+  "version": "0.9.1-canary.fd3754b",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.9.1-canary.f2f61da",
-    "@rebasepro/client": "0.9.1-canary.f2f61da",
-    "@rebasepro/codegen": "0.9.1-canary.f2f61da",
-    "@rebasepro/server": "0.9.1-canary.f2f61da",
-    "@rebasepro/server-postgres": "0.9.1-canary.f2f61da",
-    "@rebasepro/types": "0.9.1-canary.f2f61da"
+    "@rebasepro/agent-skills": "0.9.1-canary.fd3754b",
+    "@rebasepro/codegen": "0.9.1-canary.fd3754b",
+    "@rebasepro/server": "0.9.1-canary.fd3754b",
+    "@rebasepro/types": "0.9.1-canary.fd3754b",
+    "@rebasepro/client": "0.9.1-canary.fd3754b",
+    "@rebasepro/server-postgres": "0.9.1-canary.fd3754b"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
@@ -65,7 +65,7 @@
   "scripts": {
     "test": "vitest run",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }
 }

package/templates/overlays/baas/README.md

@@ -4,27 +4,9 @@ A headless Rebase backend: a REST API, auth, storage, realtime and backups over
 your PostgreSQL database.
 
 There are no collection files. The server reads your database schema at boot and
-serves your tables, so the API follows your migrations — change the schema and
+serves every table, so the API follows your migrations — change the schema and
 the endpoints change with it.
 
-## Serving a table
-
-A table is served once it has an authorization model: row-level security enabled
-plus at least one policy. Until then the server skips it — deliberately, so a new
-table is never exposed just by existing — and logs each table it skipped and why.
-
-```sql
-ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
-CREATE POLICY your_table_owner ON your_table
-    FOR ALL USING (user_id = auth.uid());
-```
-
-`auth.uid()`, `auth.roles()` and `auth.jwt()` are provided by Rebase and read the
-identity of the authenticated request.
-
-To serve unprotected tables anyway (development only), set
-`baas: { unprotectedTables: "serve" }` in `backend/src/index.ts`.
-
 ## Run it
 
 ```bash

package/templates/overlays/baas/backend/package.json

@@ -5,9 +5,9 @@
     "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch --include=\"./functions/**/*\" src/index.ts",
+        "dev": "tsx watch src/index.ts",
         "build": "tsc",
-        "start": "node dist/index.js"
+        "start": "node dist/backend/src/index.js"
     },
     "dependencies": {
         "@rebasepro/server": "workspace:*",

package/templates/overlays/baas/backend/src/index.ts

@@ -36,26 +36,10 @@ const allowedOrigins = isProduction
     })()
     : [];
 
-// In dev we still restrict which origins are reflected. Because `credentials`
-// is enabled, reflecting an arbitrary Origin would let any website the
-// developer happens to visit make credentialed cross-origin requests to this
-// dev server (and read the responses) using the developer's session. So dev
-// reflects only localhost origins; requests with no Origin (curl, same-origin)
-// are unaffected.
-const isLocalhostOrigin = (origin: string): boolean => {
-    try {
-        const { hostname } = new URL(origin);
-        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-    } catch {
-        return false;
-    }
-};
-
 app.use("/*", cors({
     origin: (origin) => {
-        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
-        if (!origin) return "*";
-        return isLocalhostOrigin(origin) ? origin : null;
+        if (!isProduction) return origin || "*";
+        return allowedOrigins.includes(origin) ? origin : null;
     },
     credentials: true
 }));
@@ -165,11 +149,7 @@ pass: env.SMTP_PASS! }
         process.on("exit", cleanup);
 
         logger.info(`API running at http://localhost:${actualPort}`);
-        // Docs are only mounted once there is something to document; with no
-        // servable tables the URL would 404, so don't advertise it.
-        if (backend.collectionRegistry.getCollections().length > 0) {
-            logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
-        }
+        logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
     } else {
         server.listen(PORT, () => {
             logger.info(`API running at http://localhost:${PORT}`);

package/templates/overlays/baas/backend/tsconfig.json

@@ -5,7 +5,6 @@
     "moduleResolution": "node",
     "lib": ["ES2022"],
     "outDir": "./dist",
-    "rootDir": "./src",
     "strict": true,
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
@@ -15,5 +14,5 @@
     "declaration": true,
     "sourceMap": true
   },
-  "include": ["src/**/*"]
+  "include": ["src/**/*", "drizzle.config.ts"]
 }

package/templates/template/.env.example

@@ -7,21 +7,11 @@
 # Database connection string (required)
 # You can use PostgreSQL (postgresql://) or MongoDB (mongodb:// or mongodb+srv://).
 # The backend will automatically detect the database type.
-# sslmode=disable matches the local docker-compose database, which has no TLS;
-# schema tooling (atlas) would otherwise default to requiring SSL. Remove it
-# when pointing at a managed/cloud database.
-DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
+DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public
 # DATABASE_URL=mongodb://localhost:27017/rebase
 #
-# Seeing "SSL is not enabled on the server"? Something in your environment
-# asks for SSL — almost always a global PGSSLMODE=require
-# (set once for a cloud database, then inherited by every local project), or an
-# sslmode=require copied in with a connection string.
-#
-# Prefer unsetting PGSSLMODE for this project. Rebase deliberately does not
-# downgrade SSL for you when you have asked for it, not even on localhost:
-# quietly ignoring a security setting is worse than a clear failure. To opt out
-# explicitly for a local database, say so:
+# Local Postgres without SSL? If you see "SSL is not enabled on the server",
+# append &sslmode=disable to the connection string, e.g.:
 #   DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 
 # Separate admin connection string for migrations and schema operations (optional)

package/templates/template/backend/package.json

@@ -5,7 +5,7 @@
     "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch --include=\"../config/**/*\" --include=\"./functions/**/*\" src/index.ts",
+        "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
         "build": "rebase schema generate --collections ../config/collections && tsc",
         "start": "node dist/backend/src/index.js"
     },
@@ -15,13 +15,12 @@
         "@rebasepro/server-postgres": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "drizzle-orm": "^0.45.2",
-        "hono": "^4.12.25",
+        "hono": "^4.12.10",
         "@hono/node-server": "^1.19.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
         "dotenv": "^16.0.0",
-        "zod": "^4.4.3",
-        "ts-morph": "28.0.0"
+        "zod": "^4.4.3"
     },
     "devDependencies": {
         "@types/pg": "^8.6.5",

package/templates/template/backend/src/env.ts

@@ -1,5 +1,4 @@
 import * as dotenv from "dotenv";
-import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { loadEnv } from "@rebasepro/server";
@@ -8,35 +7,7 @@ import { z } from "zod";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-/**
- * Locate the project's `.env` by walking up the directory tree.
- *
- * A fixed relative path can't work in both modes: in dev this file runs from
- * source at `backend/src/env.ts`, but the compiled output lives at
- * `backend/dist/backend/src/env.js` — two directories deeper — so
- * `../../.env` points at a file that doesn't exist in production. Walking up
- * finds the root `.env` from either location.
- */
-function findEnvFile(startDir: string): string | undefined {
-    let dir = startDir;
-    // eslint-disable-next-line no-constant-condition
-    while (true) {
-        const candidate = path.join(dir, ".env");
-        if (fs.existsSync(candidate)) return candidate;
-        const parent = path.dirname(dir);
-        if (parent === dir) return undefined;
-        dir = parent;
-    }
-}
-
-// `rebase start` sets DOTENV_CONFIG_PATH to the project's .env; honor it first,
-// then fall back to searching up from this file. When neither is found (e.g. a
-// production host that injects env vars directly), skip dotenv entirely and let
-// the real process environment flow through.
-const envPath = process.env.DOTENV_CONFIG_PATH || findEnvFile(__dirname);
-if (envPath && fs.existsSync(envPath)) {
-    dotenv.config({ path: envPath });
-}
+dotenv.config({ path: path.resolve(__dirname, "../../.env") });
 
 export const env = loadEnv({
     extend: z.object({

package/templates/template/backend/src/index.ts

@@ -39,26 +39,10 @@ const allowedOrigins = isProduction
     })()
     : [];
 
-// In dev we still restrict which origins are reflected. Because `credentials`
-// is enabled, reflecting an arbitrary Origin would let any website the
-// developer happens to visit make credentialed cross-origin requests to this
-// dev server (and read the responses) using the developer's session. So dev
-// reflects only localhost origins; requests with no Origin (curl, same-origin)
-// are unaffected.
-const isLocalhostOrigin = (origin: string): boolean => {
-    try {
-        const { hostname } = new URL(origin);
-        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
-    } catch {
-        return false;
-    }
-};
-
 app.use("/*", cors({
     origin: (origin) => {
-        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
-        if (!origin) return "*";
-        return isLocalhostOrigin(origin) ? origin : null;
+        if (!isProduction) return origin || "*";
+        return allowedOrigins.includes(origin) ? origin : null;
     },
     credentials: true
 }));

package/templates/template/config/collections/presets/blank/index.ts

@@ -1,5 +1,3 @@
-// Resolves after `rebase init` copies this file into config/collections/,
-// next to the shared users.ts — not from inside presets/, which never runs.
-import usersCollection from "./users.js";
+import usersCollection from "../../users.js";
 
 export const collections = [usersCollection];

package/templates/template/config/collections/presets/ecommerce/index.ts

@@ -1,8 +1,6 @@
 import productsCollection from "./products.js";
 import categoriesCollection from "./categories.js";
 import ordersCollection from "./orders.js";
-// Resolves after `rebase init` copies this file into config/collections/,
-// next to the shared users.ts — not from inside presets/, which never runs.
-import usersCollection from "./users.js";
+import usersCollection from "../../users.js";
 
 export const collections = [productsCollection, categoriesCollection, ordersCollection, usersCollection];

package/templates/template/config/collections/users.ts

@@ -66,7 +66,6 @@ roles: ["admin"] }
             name: "Password Hash",
             type: "string",
             columnName: "password_hash",
-            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
@@ -86,7 +85,6 @@ roles: ["admin"] }
             name: "Email Verification Token",
             type: "string",
             columnName: "email_verification_token",
-            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }

package/templates/template/frontend/src/App.tsx

@@ -3,7 +3,8 @@ import React from "react";
 import "@fontsource/jetbrains-mono";
 import "@fontsource/rubik";
 
-import { Rebase, RebaseAuth, useRebaseAuthController } from "@rebasepro/app";
+import { useRebaseAuthController } from "@rebasepro/app";
+import { Rebase, RebaseAuth } from "@rebasepro/app";
 import { RebaseAdmin, RebaseShell } from "@rebasepro/admin";
 import { ErrorBoundary } from "@rebasepro/ui";
 import { RebaseStudio } from "@rebasepro/studio";

package/dist/commands/cloud/deployments.d.ts

@@ -1,39 +0,0 @@
-/** A deployment row, as the data API hands it back (camel or snake columns). */
-export interface DeploymentRow {
-    id: string | number;
-    status?: string;
-    createdAt?: string | Date;
-    created_at?: string | Date;
-    finishedAt?: string | Date;
-    finished_at?: string | Date;
-    imageUrl?: string;
-    image_url?: string;
-    rollbackOf?: string;
-    rollback_of?: string;
-    triggeredBy?: string;
-    triggered_by?: string;
-    triggerSource?: string;
-    trigger_source?: string;
-    triggeredByUserId?: string;
-    triggered_by_user_id?: string;
-    gitCommitHash?: string;
-    gitCommitMessage?: string;
-}
-export declare function deploymentImage(dep: DeploymentRow): string | null;
-/**
- * The backend's rule EXACTLY: a rollback is honoured only for a successful
- * deploy that recorded an image. Any other row 409s `deploy_not_rollbackable`.
- */
-export declare function isRollbackable(dep: DeploymentRow): boolean;
-/** finishedAt − createdAt in ms, or null (still running / missing / skewed). */
-export declare function deploymentDurationMs(dep: DeploymentRow): number | null;
-export declare function triggerInfo(dep: DeploymentRow): {
-    by: string;
-    source: string;
-    userId: string;
-};
-/** Shape one deployment row into the stable JSON view the CLI publishes. */
-export declare function deploymentView(dep: DeploymentRow): Record<string, unknown>;
-export declare function deploymentsListCommand(rawArgs: string[]): Promise<void>;
-export declare function rollbackCommand(rawArgs: string[]): Promise<void>;
-export declare function cancelCommand(rawArgs: string[]): Promise<void>;

package/dist/commands/cloud/domains.d.ts

@@ -1 +0,0 @@
-export declare function domainsCommand(action: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/cloud/env.d.ts

@@ -1,6 +0,0 @@
-export declare function envCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
-/** Parse `KEY=VALUE` or `KEY VALUE` from the positional operands. */
-export declare function parseEnvAssignment(operands: string[]): {
-    key: string;
-    value: string;
-} | null;

package/dist/commands/cloud/extensions.d.ts

@@ -1,3 +0,0 @@
-/** The identifier CREATE EXTENSION takes. `pgvector` is a common alias. */
-export declare function resolveExtensionAlias(name: string): string;
-export declare function extensionsCommand(action: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/cloud/power.d.ts

@@ -1,4 +0,0 @@
-type PowerAction = "start" | "stop" | "restart";
-export declare function powerCommand(action: PowerAction, rawArgs: string[]): Promise<void>;
-export declare function isPowerAction(v: string | undefined): v is PowerAction;
-export {};

package/dist/commands/cloud/settings.d.ts

@@ -1,8 +0,0 @@
-export declare function settingsCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
-/** Build the update patch from the flags actually supplied (pure/testable). */
-export declare function buildSettingsPatch(args: {
-    name?: string;
-    subdomain?: string;
-    repo?: string;
-    branch?: string;
-}): Record<string, string>;

package/templates/template/gitignore

@@ -1,31 +0,0 @@
-# Dependencies
-node_modules/
-
-# Build output
-dist/
-build/
-
-# Environment (secrets — .env.example is tracked)
-.env
-.env.local
-!.env.example
-
-# IDE
-.idea/
-.vscode/
-*.swp
-*.swo
-
-# OS
-.DS_Store
-Thumbs.db
-
-# Drizzle
-drizzle/meta/
-
-# Uploads
-uploads/
-
-# Rebase dev
-.rebase-dev-url
-.rebase-dev-port

package/templates/template/npmrc

@@ -1,10 +0,0 @@
-# Ensure pnpm links local workspace packages when version specifiers
-# like "*" are used (instead of the pnpm-specific "workspace:*" protocol).
-# This makes the project compatible with both pnpm and npm workspaces.
-link-workspace-packages=true
-
-# Disable automatic dependency check before running scripts to prevent background install failures in read-only environments
-verify-deps-before-run=false
-
-# Prevent pnpm from prompting for confirmation when purging modules in non-TTY environments (e.g. Docker, CI)
-confirm-modules-purge=false