@rebasepro/server 0.10.0 → 0.10.1-canary.14e53ae

package/bin/rebase-server.js

@@ -0,0 +1,55 @@
+#!/usr/bin/env node
+/**
+ * The Rebase runtime entrypoint.
+ *
+ * Runs a built project bundle. This is what the official `rebasepro/server`
+ * container image executes, and what a self-hosted deployment runs directly:
+ *
+ *     rebase-server ./dist-bundle
+ *     REBASE_BUNDLE=/bundle rebase-server
+ *
+ * The bundle is the project; this process is the engine. Keeping them separate
+ * is what allows the engine to be upgraded — a security patch, a performance
+ * fix — without rebuilding anyone's application.
+ */
+import { runFromBundle } from "../dist/index.es.js";
+
+const args = process.argv.slice(2);
+
+if (args[0] === "--help" || args[0] === "-h") {
+    console.log(`
+rebase-server — run a built Rebase project bundle
+
+Usage:
+  rebase-server [bundle-dir]
+
+Arguments:
+  bundle-dir            Path to the bundle. Defaults to $REBASE_BUNDLE, then ./dist-bundle
+
+Key environment variables:
+  DATABASE_URL          Connection string for the default database (required)
+  JWT_SECRET            Signing secret, >=32 chars (required in production)
+  PORT                  Port to bind (default 3001)
+  CORS_ORIGINS          Comma-separated allowed origins (required in production)
+  REBASE_METRICS        "true" to expose Prometheus metrics at /metrics
+  REBASE_MIGRATE_ON_BOOT  none | ensure  (collection tables: run 'rebase db push')
+
+Additional databases and buckets are configured by suffixing the variable with
+the source key, e.g. DATABASE_URL__ANALYTICS or S3_BUCKET__MEDIA.
+
+Docs: https://rebase.pro/docs/deployment/self-hosting/
+`.trim());
+    process.exit(0);
+}
+
+if (args[0] === "--version" || args[0] === "-v") {
+    const { readFileSync } = await import("node:fs");
+    const { fileURLToPath } = await import("node:url");
+    const { dirname, join } = await import("node:path");
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkg = JSON.parse(readFileSync(join(here, "..", "package.json"), "utf8"));
+    console.log(pkg.version);
+    process.exit(0);
+}
+
+await runFromBundle({ bundleDir: args[0] });

package/dist/api/contract-routes.d.ts

@@ -0,0 +1,36 @@
+import { Hono } from "hono";
+import { type CollectionConfig } from "@rebasepro/types";
+import type { HonoEnv } from "./types";
+/**
+ * The project contract endpoint.
+ *
+ * This is what makes a repository able to build against a project it does not
+ * contain. Without it, a typed client can only be generated from local
+ * collection *source*, which means every frontend must live in the same
+ * repository as the backend. Serving the contract turns that around: an app
+ * asks the project what its shape is, so a web app, a second web app and a
+ * mobile app can each live wherever they like and none of them needs to know
+ * about the others.
+ *
+ * Admin-gated. Collection definitions describe every table, column and relation
+ * in the project, including ones no security rule would ever expose — that is a
+ * map of the database, not public API documentation.
+ */
+export interface ContractRoutesConfig {
+    collectionRegistry: {
+        getRawCollections(): CollectionConfig[];
+    };
+    /**
+     * The schema version recorded at build time.
+     *
+     * Preferred over recomputing, so that what a client is told matches exactly
+     * what the bundle claims. It is recomputed only when a bundle did not record
+     * one — a `baas`-mode project derives its collections from the live database
+     * at boot, so there was nothing to hash when it was built.
+     */
+    schemaVersion?: string;
+    mode: "cms" | "baas";
+    /** Runtime package version, surfaced so a client can report what it built against. */
+    runtimeVersion?: string;
+}
+export declare function createContractRoutes(config: ContractRoutesConfig): Hono<HonoEnv>;

package/dist/api/rest/api-generator.d.ts

@@ -1,6 +1,7 @@
 import { Hono } from "hono";
 import { AuthAdapter, DataDriver, CollectionConfig } from "@rebasepro/types";
 import { HonoEnv } from "../types";
+import { type ListLimitOptions } from "./query-parser";
 /**
  * Lightweight REST API generator that leverages existing Rebase DataDriver.
  * Supports `include` query parameter for eager-loading relations via Drizzle.
@@ -12,8 +13,15 @@ export declare class RestApiGenerator {
     private router;
     private driver;
     private maxBulkRows;
+    private listLimits;
     private authAdapter?;
-    constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter, maxBulkRows?: number);
+    constructor(collections: CollectionConfig[], driver: DataDriver, authAdapter?: AuthAdapter, maxBulkRows?: number, listLimits?: ListLimitOptions);
+    /**
+     * Parse request query params into QueryOptions, applying this generator's
+     * list-pagination bounds (default page size + hard max limit) so no read
+     * path can be tricked into buffering an entire table into memory.
+     */
+    private parseQuery;
     /**
      * Generate REST routes using existing DataDriver
      */

package/dist/api/rest/query-parser.d.ts

@@ -1,6 +1,22 @@
 import { QueryOptions } from "../types";
 export declare const mapOperator: (op: string) => import("@rebasepro/types").WhereFilterOp | null;
+export { DEFAULT_LIST_LIMIT, DEFAULT_VECTOR_LIST_LIMIT, MAX_LIST_LIMIT } from "@rebasepro/types";
+/**
+ * Overridable list-pagination bounds for {@link parseQueryOptions}. Without
+ * these, `GET /<collection>` with no `?limit` would buffer the ENTIRE table
+ * into a JS array + JSON response (a trivial OOM/DoS), and `?limit=100000000`
+ * would be honoured verbatim.
+ */
+export interface ListLimitOptions {
+    /**
+     * Page size used when the client sends no `?limit`. Applied to plain and
+     * text-search reads — a vector search falls back to its own default (10).
+     */
+    defaultLimit?: number;
+    /** Upper bound clamped onto any client-supplied `?limit`. */
+    maxLimit?: number;
+}
 /**
  * Parse query parameters into QueryOptions
  */
-export declare function parseQueryOptions(query: Record<string, unknown>): QueryOptions;
+export declare function parseQueryOptions(query: Record<string, unknown>, limits?: ListLimitOptions): QueryOptions;

package/dist/auth/interfaces.d.ts

@@ -119,6 +119,33 @@ export interface RefreshTokenInfo {
     createdAt: Date;
     userAgent?: string | null;
     ipAddress?: string | null;
+    /**
+     * The sign-in this token descends from. Every token minted by rotating
+     * this one carries the same id.
+     *
+     * Optional because a custom {@link TokenRepository} written against an
+     * older release does not supply it; the refresh endpoint then treats the
+     * token as a session of one, which costs reuse tolerance but still works.
+     */
+    sessionId?: string;
+    /**
+     * Set when this token was superseded by a rotation. Being superseded is
+     * not an error — a client whose response was lost still holds it — so it
+     * stays usable to mint a sibling for a short window after this instant.
+     */
+    rotatedAt?: Date | null;
+    /** Hard kill (logout, remote session revoke). Never usable again. */
+    revoked?: boolean;
+    /** When the sign-in happened; carried across rotations, unlike createdAt. */
+    sessionStartedAt?: Date;
+}
+/**
+ * Identity of the sign-in a refresh token belongs to, threaded through
+ * rotation so descendants stay grouped.
+ */
+export interface RefreshTokenSession {
+    id: string;
+    startedAt: Date;
 }
 /**
  * Password reset token info
@@ -278,9 +305,45 @@ export interface RoleRepository {
  */
 export interface TokenRepository {
     /**
-     * Create a new refresh token
+     * Create a new refresh token.
+     *
+     * `session` groups this token with the sign-in it descends from. It is
+     * optional so that repositories written against an older release keep
+     * satisfying this interface; implementations that ignore it degrade to one
+     * session per token.
+     */
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    /**
+     * Mark a token as superseded by a rotation, WITHOUT making it unusable.
+     *
+     * The distinction from deletion is the entire point: a client that never
+     * received the rotated response still holds this token, and must be able
+     * to present it and be recognised. Implementations that omit this method
+     * fall back to {@link TokenRepository.deleteRefreshToken}, which restores
+     * the old, lossy behaviour.
+     */
+    markRefreshTokenRotated?(tokenHash: string): Promise<void>;
+    /**
+     * Hard-kill every token of one sign-in (logout, remote session revoke).
+     * Unlike rotation this is final — no grace, no replay.
+     */
+    revokeRefreshTokenSession?(sessionId: string): Promise<void>;
+    /**
+     * Drop tokens of a session that were superseded before `supersededBefore`,
+     * plus anything already expired. Keeps rotation from growing a row per
+     * refresh forever; called opportunistically, never load-bearing.
+     */
+    pruneRefreshTokens?(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    /**
+     * The instant before which every session of this user is void, or null if
+     * none is set. See `users.tokens_valid_after`.
+     */
+    getTokensValidAfter?(uid: string): Promise<Date | null>;
+    /**
+     * Void every session that began before `at`. Set alongside deleting the
+     * user's tokens so a rotation racing the delete cannot survive it.
      */
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    setTokensValidAfter?(uid: string, at: Date): Promise<void>;
     /**
      * Find a refresh token by hash
      */

package/dist/auth/jwt.d.ts

@@ -65,6 +65,23 @@ export declare function generateRefreshToken(): string;
  * Hash a refresh token for database storage (don't store raw tokens)
  */
 export declare function hashRefreshToken(token: string): string;
+/**
+ * The longest a cookie can live. Chrome (since 104) and RFC 6265bis silently
+ * rewrite any `Max-Age` beyond 400 days down to 400 days, so promising a
+ * browser more is not a stricter policy — it is a policy that differs from
+ * what is actually enforced, which is worse than knowing the ceiling.
+ */
+export declare const MAX_COOKIE_AGE_MS: number;
+/**
+ * How long a refresh token is valid for, in milliseconds.
+ *
+ * Every rotation issues a token with a fresh TTL, so this is a sliding window:
+ * a user who visits at all keeps their session indefinitely, and one who
+ * disappears loses it this long after their last visit. That is what both
+ * Firebase and Supabase do by default, and it is the behaviour people mean
+ * when they say they expect to still be signed in.
+ */
+export declare function getRefreshTokenTtlMs(): number;
 /**
  * Calculate refresh token expiration date
  */

package/dist/auth/routes.d.ts

@@ -47,6 +47,22 @@ export interface AuthModuleConfig {
      * auth endpoints, and CORS must allow credentials (no `origin: "*"`).
      */
     cookieAuth?: CookieAuthConfig;
+    /**
+     * How long a refresh token stays usable after it has been rotated away,
+     * in seconds. Default 10, matching GoTrue's `refresh_token_reuse_interval`.
+     *
+     * Rotation is only safe if the client is guaranteed to receive the
+     * replacement, and no network guarantees that. A pod rolls mid-response, a
+     * laptop suspends, a second tab boots at the same instant — and the client
+     * is left holding a token the database has moved past. Within this window
+     * that client is handed a fresh token of the same session instead of a
+     * 401, which is the difference between a hiccup and being silently signed
+     * out of an app you were using.
+     *
+     * Widen it if your clients are flaky or your deploys are long; the cost is
+     * how long a captured token stays useful to someone who copied it.
+     */
+    refreshTokenReuseIntervalSeconds?: number;
 }
 /**
  * Configuration for httpOnly refresh-token cookies.

package/dist/boot/boot.d.ts

@@ -0,0 +1,59 @@
+import { type Server } from "http";
+import { Hono } from "hono";
+import { type RebaseBackendInstance } from "../init";
+import type { HonoEnv } from "../api/types";
+import { type RebaseBootEnv } from "./env";
+import { type LoadedBundle } from "./bundle";
+import { type InitializedDataSource } from "./driver";
+/** A running runtime, and the handle to stop it. */
+export interface BootedRuntime {
+    app: Hono<HonoEnv>;
+    server: Server;
+    backend: RebaseBackendInstance;
+    bundle: LoadedBundle;
+    env: RebaseBootEnv;
+    /** The port actually bound, which in development may not be the one asked for. */
+    port: number;
+    dataSources: InitializedDataSource[];
+    shutdown: () => Promise<void>;
+}
+export interface BootOptions {
+    /** Bundle directory. Defaults to `REBASE_BUNDLE` or `./dist-bundle`. */
+    bundleDir?: string;
+    /**
+     * A bundle that has already been resolved.
+     *
+     * `rebase dev` passes one built from source (see `createSourceBundle`), so
+     * development and production run the identical boot path rather than two
+     * implementations that drift apart.
+     */
+    bundle?: LoadedBundle;
+    /** Skip binding a port. Used by tests that drive `app.fetch` directly. */
+    listen?: boolean;
+    /** Install SIGTERM/SIGINT handlers. Off for tests. */
+    handleSignals?: boolean;
+}
+/**
+ * Boot a Rebase runtime from a built bundle.
+ *
+ * This is the entrypoint the official container image runs, and it is the same
+ * code path a self-hosted deployment uses — there is no separate "platform"
+ * runtime. Everything it does was previously the responsibility of a
+ * hand-written `backend/src/index.ts` in every project: wiring CORS and security
+ * headers, opening database connections, resolving storage, mounting health and
+ * metrics, serving the client bundle, and shutting all of it down cleanly.
+ *
+ * Moving it here is what makes a project's *code* separable from the *engine*
+ * that runs it: the bundle can then be handed to a newer runtime without being
+ * rebuilt, which is the precondition for patching a fleet.
+ */
+export declare function bootFromBundle(options?: BootOptions): Promise<BootedRuntime>;
+/**
+ * Boot and keep running, reporting failures the way a container should.
+ *
+ * A `BundleError` is a configuration problem with a known fix, so it prints the
+ * message and its hint without a stack trace — the stack is noise when the
+ * answer is "set DATABASE_URL". Anything else keeps its stack, because it is a
+ * bug and the trace is the point.
+ */
+export declare function runFromBundle(options?: BootOptions): Promise<BootedRuntime>;

package/dist/boot/bundle.d.ts

@@ -0,0 +1,134 @@
+import { type CollectionConfig, type CollectionCallbacks, type DataSourceDefinition, type RebaseBundleManifest, type StorageSourceDefinition } from "@rebasepro/types";
+import type { StorageAuthorize } from "../storage/types";
+/** Thrown when a bundle cannot be read, or claims a contract this runtime cannot honour. */
+export declare class BundleError extends Error {
+    readonly hint?: string | undefined;
+    constructor(message: string, hint?: string | undefined);
+}
+/** A bundle that has been located and whose manifest has been validated. */
+export interface LoadedBundle {
+    dir: string;
+    manifest: RebaseBundleManifest;
+    /** Absolute path to the compiled collections directory, when present. */
+    collectionsDir?: string;
+    functionsDir?: string;
+    cronsDir?: string;
+    /** Absolute path to built admin assets, when the admin panel is bundled. */
+    adminDir?: string;
+    /** Absolute path to built static assets to serve from this process. */
+    staticDir?: string;
+}
+/**
+ * Read and validate a bundle's manifest.
+ *
+ * The checks here are the runtime half of the compatibility contract, and they
+ * all fail loudly at boot rather than at the first request. A container that
+ * refuses to start is a deploy that rolls back; a container that starts and then
+ * misbehaves is an incident.
+ */
+export declare function readBundleManifest(bundleDir: string): RebaseBundleManifest;
+/**
+ * Locate a bundle and resolve every directory the runtime needs from it.
+ *
+ * Entry paths in the manifest are bundle-relative and are resolved here, once,
+ * so nothing downstream has to know the layout. A declared directory that does
+ * not exist is dropped with a warning rather than failing the boot: an empty
+ * `functions/` is a perfectly ordinary project, and refusing to start over one
+ * would be the runtime inventing a requirement the developer never stated.
+ */
+/**
+ * Resolve a bundle-relative entry, refusing anything that escapes the bundle.
+ *
+ * Applied to the entries that are `import()`ed — the schema, the config index,
+ * the users collection — and not only to the ones that are merely scanned. Those
+ * three *execute code*, so they are precisely the ones a malformed or hostile
+ * manifest would target, and leaving them unchecked while guarding the read-only
+ * paths would be defending the wrong door.
+ */
+export declare function resolveBundlePath(bundleDir: string, entry: string, label: string): string;
+export declare function loadBundle(bundleDir: string): LoadedBundle;
+/**
+ * The Drizzle schema a bundle ships: tables, enums and relations, as generated
+ * from the project's collections.
+ */
+export interface BundleSchemaExports {
+    tables?: Record<string, unknown>;
+    enums?: Record<string, unknown>;
+    relations?: Record<string, unknown>;
+}
+/**
+ * Import the bundle's Drizzle schema module.
+ *
+ * Returns `undefined` when the bundle declares none — `baas` mode introspects the
+ * live database instead of shipping a schema.
+ */
+export declare function loadBundleSchema(bundle: LoadedBundle): Promise<BundleSchemaExports | undefined>;
+/**
+ * Build a bundle view over a project's **source** directories.
+ *
+ * `rebase dev` runs TypeScript directly through tsx, so there is no compiled
+ * bundle to load — but everything downstream of loading (drivers, storage, auth,
+ * routes) should be identical, or development stops predicting production. This
+ * produces the same {@link LoadedBundle} shape from source paths, so the one boot
+ * path serves both.
+ *
+ * The schema version is left empty deliberately: nothing has been built, so
+ * there is no build-time answer, and the runtime computes one from the live
+ * collections instead.
+ */
+export declare function createSourceBundle(options: {
+    projectRoot: string;
+    config?: string;
+    collections?: string;
+    functions?: string;
+    crons?: string;
+    schema?: string;
+    mode?: "cms" | "baas" | "static";
+    app?: string;
+}): LoadedBundle;
+/**
+ * Declarations a bundle's config package exports alongside its collections.
+ *
+ * These describe *topology* — which databases and which buckets exist — so they
+ * belong to the project rather than to the environment. The environment then
+ * supplies credentials for each declared key. Splitting it this way is what lets
+ * a deploy be validated before it runs: the set of things needing configuration
+ * is known from the bundle, without reading anyone's secrets.
+ */
+export interface BundleConfigExports {
+    dataSources?: DataSourceDefinition[];
+    storageSources?: StorageSourceDefinition[];
+    /**
+     * Per-object storage access control.
+     *
+     * A function, so it can only come from the project's own code — there is no
+     * environment variable that could express "this user may read this key".
+     * Without a way to supply it, a production deployment with a bucket would be
+     * forced to choose between `STORAGE_PUBLIC_READ` (world-readable) and
+     * `STORAGE_ALLOW_ANY_AUTHENTICATED` (every signed-in user can read, overwrite
+     * and delete every other user's files) — the runtime would be making an
+     * insecure choice on the developer's behalf.
+     */
+    storageAuthorize?: StorageAuthorize;
+    /** Lifecycle callbacks applied to every collection. */
+    callbacks?: CollectionCallbacks;
+}
+/**
+ * Read the config package's `index` for declarations.
+ *
+ * Absent, empty or unreadable all mean the same thing: a single default database
+ * and a single default bucket. That is the overwhelmingly common project, and it
+ * must not be required to say so. A malformed export is reported and ignored
+ * rather than fatal — a typo in an optional declaration should not take down a
+ * server whose collections are fine.
+ */
+export declare function loadBundleConfigExports(bundle: LoadedBundle): Promise<BundleConfigExports>;
+/**
+ * Import the collection that backs authentication.
+ *
+ * Auth needs to know which table holds users. The bundle names the module; the
+ * convention (`collections/users`) covers every project that did not rename it.
+ * Returning `undefined` is valid — a `baas`-mode project has no config package,
+ * and the auth bootstrapper falls back to its own default users table.
+ */
+export declare function loadUsersCollection(bundle: LoadedBundle): Promise<CollectionConfig | undefined>;

package/dist/boot/driver.d.ts

@@ -0,0 +1,57 @@
+import type { BackendBootstrapper } from "@rebasepro/types";
+import type { ResolvedDataSourceConfig } from "./sources";
+/** The connection handle a driver hands back. */
+export interface DatabaseConnection {
+    db: unknown;
+    /**
+     * Present for pool-based drivers. Closed during shutdown, and used to probe
+     * the source for health — `query` lives here, not on the connection itself.
+     */
+    pool?: {
+        end: () => Promise<void>;
+        query?: (sql: string) => Promise<unknown>;
+    };
+    /** Some drivers expose a query directly instead of via a pool. */
+    query?: (sql: string) => Promise<unknown>;
+    connectionString?: string;
+}
+/**
+ * Run a trivial query against a source, to see whether it answers.
+ *
+ * Returns `undefined` when the driver exposes no way to ask — a driver that
+ * cannot be probed must not be reported as unhealthy, only as unknown.
+ */
+export declare function probeDataSource(source: InitializedDataSource): Promise<{
+    healthy: boolean;
+    error?: string;
+} | undefined>;
+/** One initialized data source: its bootstrapper plus the handle to close. */
+export interface InitializedDataSource {
+    key: string;
+    engine: string;
+    driverPackage: string;
+    bootstrapper: BackendBootstrapper;
+    connection: DatabaseConnection;
+}
+export interface BundleSchema {
+    tables?: Record<string, unknown>;
+    enums?: Record<string, unknown>;
+    relations?: Record<string, unknown>;
+}
+/**
+ * Build a driver for one data source.
+ *
+ * Only the default source receives the bundle's Drizzle schema: the schema
+ * describes the tables generated from this project's collections, which live in
+ * the default database. Handing it to a secondary source would tell that
+ * driver's adapter about tables it does not have.
+ */
+export declare function initializeDataSource(source: ResolvedDataSourceConfig, schema: BundleSchema | undefined, resolveFrom?: string[]): Promise<InitializedDataSource>;
+/**
+ * Build drivers for every resolved data source.
+ *
+ * Sequential on purpose: a failure on the second source should not leave a
+ * half-opened pool from a third racing behind it, and the log then reads in the
+ * order a human would expect.
+ */
+export declare function initializeDataSources(sources: ResolvedDataSourceConfig[], schema: BundleSchema | undefined, resolveFrom?: string[]): Promise<InitializedDataSource[]>;

package/dist/boot/env.d.ts

@@ -0,0 +1,129 @@
+import { z } from "zod";
+import { type RebaseEnv } from "../env";
+/**
+ * The environment a bundle-booted runtime understands.
+ *
+ * This extends the base {@link loadEnv} schema with the variables an application
+ * used to declare for itself in its own `env.ts`. They live here now because the
+ * runtime, not the application, is what reads them: a project ships a bundle and
+ * a set of environment variables, and everything either side needs to agree on
+ * has to be part of the contract rather than a convention each project reinvents.
+ */
+declare const bootEnvExtension: z.ZodObject<{
+    SMTP_HOST: z.ZodOptional<z.ZodString>;
+    SMTP_PORT: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
+    SMTP_SECURE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    SMTP_USER: z.ZodOptional<z.ZodString>;
+    SMTP_PASS: z.ZodOptional<z.ZodString>;
+    SMTP_FROM: z.ZodOptional<z.ZodString>;
+    SMTP_NAME: z.ZodOptional<z.ZodString>;
+    APP_NAME: z.ZodDefault<z.ZodString>;
+    REBASE_SERVE_STATIC: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    REBASE_MIGRATE_ON_BOOT: z.ZodOptional<z.ZodEnum<{
+        "": "";
+        push: "push";
+        none: "none";
+        ensure: "ensure";
+    }>>;
+    REBASE_METRICS: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    REBASE_METRICS_TOKEN: z.ZodOptional<z.ZodString>;
+    LOG_LEVEL: z.ZodOptional<z.ZodEnum<{
+        "": "";
+        debug: "debug";
+        info: "info";
+        warn: "warn";
+        error: "error";
+    }>>;
+    STORAGE_PUBLIC_READ: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    STORAGE_ALLOW_ANY_AUTHENTICATED: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_REQUIRE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_ALLOW_USER_LOOKUP: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_COOKIE_SAME_SITE: z.ZodOptional<z.ZodEnum<{
+        "": "";
+        Strict: "Strict";
+        Lax: "Lax";
+        None: "None";
+    }>>;
+    AUTH_DEFAULT_ROLE: z.ZodOptional<z.ZodString>;
+    GITHUB_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    GITHUB_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    MICROSOFT_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    MICROSOFT_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    REBASE_BASE_PATH: z.ZodDefault<z.ZodString>;
+    REBASE_ENABLE_SWAGGER: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    REBASE_MAX_BODY_SIZE: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    REBASE_COMPRESSION: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    REBASE_HISTORY: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    CORS_ORIGINS: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RebaseBootEnv = RebaseEnv & z.infer<typeof bootEnvExtension>;
+/**
+ * Load and validate the environment for a bundle boot.
+ *
+ * Does not read `.env` files — that is the deployment's job (a container gets
+ * real environment variables; `rebase dev` and `rebase start` load dotenv before
+ * calling in).
+ */
+export declare function loadBootEnv(): RebaseBootEnv;
+/**
+ * Whether an origin is a loopback address.
+ *
+ * In development the runtime reflects only localhost origins. It cannot reflect
+ * an arbitrary `Origin`, because credentials are enabled: any site the developer
+ * happened to visit could otherwise make credentialed requests against the dev
+ * server with the developer's session and read the responses.
+ */
+export declare function isLocalhostOrigin(origin: string): boolean;
+/** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
+export type CorsOriginResolver = (origin: string) => string | null;
+/**
+ * Build the CORS origin policy.
+ *
+ * Production serves an explicit allow-list and nothing else. `loadEnv` already
+ * refuses to start a production process with neither `CORS_ORIGINS` nor
+ * `FRONTEND_URL`, so an empty list here can only mean the values were blank
+ * strings — still worth failing on, because the alternative is an API that
+ * quietly rejects its own frontend.
+ */
+export declare function resolveCorsOrigin(env: RebaseBootEnv): CorsOriginResolver;
+export {};