@rebasepro/cli 0.9.1-canary.fd3754b → 0.9.1-canary.ff338b5

package/dist/utils/package-manager.d.ts

@@ -20,13 +20,27 @@ export interface PMCommands {
     workspaceProtocol: string;
 }
 /**
- * Detect the package manager from the environment or the target directory.
+ * Whether pnpm is runnable on this machine.
+ *
+ * Used to decide whether a fresh project can be scaffolded with pnpm. Kept
+ * cheap and non-interactive (short timeout, output discarded) so it never
+ * hangs detection if a corepack shim misbehaves.
+ */
+export declare function isPnpmAvailable(): boolean;
+/**
+ * Detect the package manager for a Rebase project.
+ *
+ * Rebase recommends pnpm, so detection prefers it. Crucially, *how the CLI was
+ * invoked* (`npx` vs `pnpm dlx`, i.e. `npm_config_user_agent`) is deliberately
+ * ignored: running `npx @rebasepro/cli init` says nothing about how the user
+ * wants to manage the project they're creating, and letting it pin the scaffold
+ * to npm is what made every `npx`-invoked project an npm project.
  *
  * Detection order:
- * 1. Explicit override (if provided)
- * 2. `npm_config_user_agent` env var (set by npm/pnpm when running via `npx`/`pnpm dlx`)
- * 3. Lock-file presence in the target directory
- * 4. Default to pnpm (Rebase's recommended PM)
+ * 1. An existing lock file — an explicit choice we always respect
+ *    (`pnpm-lock.yaml` wins over `package-lock.json` when both are present).
+ * 2. pnpm, whenever it is installed.
+ * 3. npm, only as a fallback when pnpm is genuinely unavailable.
  */
 export declare function detectPackageManager(targetDir?: string): PackageManager;
 /** Build the command helpers for a given package manager. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.9.1-canary.fd3754b",
+  "version": "0.9.1-canary.ff338b5",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,12 +31,12 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.9.1-canary.fd3754b",
-    "@rebasepro/codegen": "0.9.1-canary.fd3754b",
-    "@rebasepro/server": "0.9.1-canary.fd3754b",
-    "@rebasepro/types": "0.9.1-canary.fd3754b",
-    "@rebasepro/client": "0.9.1-canary.fd3754b",
-    "@rebasepro/server-postgres": "0.9.1-canary.fd3754b"
+    "@rebasepro/agent-skills": "0.9.1-canary.ff338b5",
+    "@rebasepro/codegen": "0.9.1-canary.ff338b5",
+    "@rebasepro/server": "0.9.1-canary.ff338b5",
+    "@rebasepro/types": "0.9.1-canary.ff338b5",
+    "@rebasepro/server-postgres": "0.9.1-canary.ff338b5",
+    "@rebasepro/client": "0.9.1-canary.ff338b5"
   },
   "devDependencies": {
     "@types/node": "^25.9.3",
@@ -65,7 +65,7 @@
   "scripts": {
     "test": "vitest run",
     "test:e2e": "vitest run --config vitest.e2e.config.ts",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.json && node ../../scripts/assert-build-output.mjs",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"
   }
 }

package/templates/overlays/baas/README.md

@@ -4,9 +4,27 @@ A headless Rebase backend: a REST API, auth, storage, realtime and backups over
 your PostgreSQL database.
 
 There are no collection files. The server reads your database schema at boot and
-serves every table, so the API follows your migrations — change the schema and
+serves your tables, so the API follows your migrations — change the schema and
 the endpoints change with it.
 
+## Serving a table
+
+A table is served once it has an authorization model: row-level security enabled
+plus at least one policy. Until then the server skips it — deliberately, so a new
+table is never exposed just by existing — and logs each table it skipped and why.
+
+```sql
+ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;
+CREATE POLICY your_table_owner ON your_table
+    FOR ALL USING (user_id = auth.uid());
+```
+
+`auth.uid()`, `auth.roles()` and `auth.jwt()` are provided by Rebase and read the
+identity of the authenticated request.
+
+To serve unprotected tables anyway (development only), set
+`baas: { unprotectedTables: "serve" }` in `backend/src/index.ts`.
+
 ## Run it
 
 ```bash

package/templates/overlays/baas/backend/package.json

@@ -5,9 +5,9 @@
     "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch src/index.ts",
+        "dev": "tsx watch --include=\"./functions/**/*\" src/index.ts",
         "build": "tsc",
-        "start": "node dist/backend/src/index.js"
+        "start": "node dist/index.js"
     },
     "dependencies": {
         "@rebasepro/server": "workspace:*",

package/templates/overlays/baas/backend/src/index.ts

@@ -36,10 +36,26 @@ const allowedOrigins = isProduction
     })()
     : [];
 
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
 app.use("/*", cors({
     origin: (origin) => {
-        if (!isProduction) return origin || "*";
-        return allowedOrigins.includes(origin) ? origin : null;
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
     },
     credentials: true
 }));
@@ -149,7 +165,11 @@ pass: env.SMTP_PASS! }
         process.on("exit", cleanup);
 
         logger.info(`API running at http://localhost:${actualPort}`);
-        logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
+        // Docs are only mounted once there is something to document; with no
+        // servable tables the URL would 404, so don't advertise it.
+        if (backend.collectionRegistry.getCollections().length > 0) {
+            logger.info(`API docs at http://localhost:${actualPort}/api/swagger`);
+        }
     } else {
         server.listen(PORT, () => {
             logger.info(`API running at http://localhost:${PORT}`);

package/templates/overlays/baas/backend/tsconfig.json

@@ -5,6 +5,7 @@
     "moduleResolution": "node",
     "lib": ["ES2022"],
     "outDir": "./dist",
+    "rootDir": "./src",
     "strict": true,
     "esModuleInterop": true,
     "allowSyntheticDefaultImports": true,
@@ -14,5 +15,5 @@
     "declaration": true,
     "sourceMap": true
   },
-  "include": ["src/**/*", "drizzle.config.ts"]
+  "include": ["src/**/*"]
 }

package/templates/template/.env.example

@@ -7,11 +7,21 @@
 # Database connection string (required)
 # You can use PostgreSQL (postgresql://) or MongoDB (mongodb:// or mongodb+srv://).
 # The backend will automatically detect the database type.
-DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public
+# sslmode=disable matches the local docker-compose database, which has no TLS;
+# schema tooling (atlas) would otherwise default to requiring SSL. Remove it
+# when pointing at a managed/cloud database.
+DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 # DATABASE_URL=mongodb://localhost:27017/rebase
 #
-# Local Postgres without SSL? If you see "SSL is not enabled on the server",
-# append &sslmode=disable to the connection string, e.g.:
+# Seeing "SSL is not enabled on the server"? Something in your environment
+# asks for SSL — almost always a global PGSSLMODE=require
+# (set once for a cloud database, then inherited by every local project), or an
+# sslmode=require copied in with a connection string.
+#
+# Prefer unsetting PGSSLMODE for this project. Rebase deliberately does not
+# downgrade SSL for you when you have asked for it, not even on localhost:
+# quietly ignoring a security setting is worse than a clear failure. To opt out
+# explicitly for a local database, say so:
 #   DATABASE_URL=postgresql://rebase:changeme@localhost:5432/rebase?options=-c%20search_path=public&sslmode=disable
 
 # Separate admin connection string for migrations and schema operations (optional)

package/templates/template/backend/package.json

@@ -5,7 +5,7 @@
     "main": "src/index.ts",
     "type": "module",
     "scripts": {
-        "dev": "tsx watch --watch=\"../config/**/*\" src/index.ts",
+        "dev": "tsx watch --include=\"../config/**/*\" --include=\"./functions/**/*\" src/index.ts",
         "build": "rebase schema generate --collections ../config/collections && tsc",
         "start": "node dist/backend/src/index.js"
     },
@@ -15,12 +15,13 @@
         "@rebasepro/server-postgres": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "drizzle-orm": "^0.45.2",
-        "hono": "^4.12.10",
+        "hono": "^4.12.25",
         "@hono/node-server": "^1.19.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
         "dotenv": "^16.0.0",
-        "zod": "^4.4.3"
+        "zod": "^4.4.3",
+        "ts-morph": "28.0.0"
     },
     "devDependencies": {
         "@types/pg": "^8.6.5",

package/templates/template/backend/src/env.ts

@@ -1,4 +1,5 @@
 import * as dotenv from "dotenv";
+import fs from "fs";
 import path from "path";
 import { fileURLToPath } from "url";
 import { loadEnv } from "@rebasepro/server";
@@ -7,7 +8,35 @@ import { z } from "zod";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-dotenv.config({ path: path.resolve(__dirname, "../../.env") });
+/**
+ * Locate the project's `.env` by walking up the directory tree.
+ *
+ * A fixed relative path can't work in both modes: in dev this file runs from
+ * source at `backend/src/env.ts`, but the compiled output lives at
+ * `backend/dist/backend/src/env.js` — two directories deeper — so
+ * `../../.env` points at a file that doesn't exist in production. Walking up
+ * finds the root `.env` from either location.
+ */
+function findEnvFile(startDir: string): string | undefined {
+    let dir = startDir;
+    // eslint-disable-next-line no-constant-condition
+    while (true) {
+        const candidate = path.join(dir, ".env");
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir) return undefined;
+        dir = parent;
+    }
+}
+
+// `rebase start` sets DOTENV_CONFIG_PATH to the project's .env; honor it first,
+// then fall back to searching up from this file. When neither is found (e.g. a
+// production host that injects env vars directly), skip dotenv entirely and let
+// the real process environment flow through.
+const envPath = process.env.DOTENV_CONFIG_PATH || findEnvFile(__dirname);
+if (envPath && fs.existsSync(envPath)) {
+    dotenv.config({ path: envPath });
+}
 
 export const env = loadEnv({
     extend: z.object({

package/templates/template/backend/src/index.ts

@@ -39,10 +39,26 @@ const allowedOrigins = isProduction
     })()
     : [];
 
+// In dev we still restrict which origins are reflected. Because `credentials`
+// is enabled, reflecting an arbitrary Origin would let any website the
+// developer happens to visit make credentialed cross-origin requests to this
+// dev server (and read the responses) using the developer's session. So dev
+// reflects only localhost origins; requests with no Origin (curl, same-origin)
+// are unaffected.
+const isLocalhostOrigin = (origin: string): boolean => {
+    try {
+        const { hostname } = new URL(origin);
+        return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname === "[::1]";
+    } catch {
+        return false;
+    }
+};
+
 app.use("/*", cors({
     origin: (origin) => {
-        if (!isProduction) return origin || "*";
-        return allowedOrigins.includes(origin) ? origin : null;
+        if (isProduction) return allowedOrigins.includes(origin) ? origin : null;
+        if (!origin) return "*";
+        return isLocalhostOrigin(origin) ? origin : null;
     },
     credentials: true
 }));

package/templates/template/config/collections/presets/blank/index.ts

@@ -1,3 +1,5 @@
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [usersCollection];

package/templates/template/config/collections/presets/ecommerce/index.ts

@@ -1,6 +1,8 @@
 import productsCollection from "./products.js";
 import categoriesCollection from "./categories.js";
 import ordersCollection from "./orders.js";
-import usersCollection from "../../users.js";
+// Resolves after `rebase init` copies this file into config/collections/,
+// next to the shared users.ts — not from inside presets/, which never runs.
+import usersCollection from "./users.js";
 
 export const collections = [productsCollection, categoriesCollection, ordersCollection, usersCollection];

package/templates/template/config/collections/users.ts

@@ -66,6 +66,7 @@ roles: ["admin"] }
             name: "Password Hash",
             type: "string",
             columnName: "password_hash",
+            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }
@@ -85,6 +86,7 @@ roles: ["admin"] }
             name: "Email Verification Token",
             type: "string",
             columnName: "email_verification_token",
+            excludeFromApi: true,
             ui: {
                 hideFromCollection: true,
                 disabled: { hidden: true }

package/templates/template/frontend/src/App.tsx

@@ -3,8 +3,7 @@ import React from "react";
 import "@fontsource/jetbrains-mono";
 import "@fontsource/rubik";
 
-import { useRebaseAuthController } from "@rebasepro/app";
-import { Rebase, RebaseAuth } from "@rebasepro/app";
+import { Rebase, RebaseAuth, useRebaseAuthController } from "@rebasepro/app";
 import { RebaseAdmin, RebaseShell } from "@rebasepro/admin";
 import { ErrorBoundary } from "@rebasepro/ui";
 import { RebaseStudio } from "@rebasepro/studio";

package/templates/template/gitignore

@@ -0,0 +1,31 @@
+# Dependencies
+node_modules/
+
+# Build output
+dist/
+build/
+
+# Environment (secrets — .env.example is tracked)
+.env
+.env.local
+!.env.example
+
+# IDE
+.idea/
+.vscode/
+*.swp
+*.swo
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Drizzle
+drizzle/meta/
+
+# Uploads
+uploads/
+
+# Rebase dev
+.rebase-dev-url
+.rebase-dev-port

package/templates/template/npmrc

@@ -0,0 +1,10 @@
+# Ensure pnpm links local workspace packages when version specifiers
+# like "*" are used (instead of the pnpm-specific "workspace:*" protocol).
+# This makes the project compatible with both pnpm and npm workspaces.
+link-workspace-packages=true
+
+# Disable automatic dependency check before running scripts to prevent background install failures in read-only environments
+verify-deps-before-run=false
+
+# Prevent pnpm from prompting for confirmation when purging modules in non-TTY environments (e.g. Docker, CI)
+confirm-modules-purge=false