@rebasepro/server 0.11.0 → 0.11.1-canary.g8caabf3

package/dist/api/contract-routes.d.ts

@@ -29,7 +29,6 @@ export interface ContractRoutesConfig {
      * at boot, so there was nothing to hash when it was built.
      */
     schemaVersion?: string;
-    mode: "cms" | "baas";
     /** Runtime package version, surfaced so a client can report what it built against. */
     runtimeVersion?: string;
 }

package/dist/boot/bundle.d.ts

@@ -13,10 +13,23 @@ export interface LoadedBundle {
     collectionsDir?: string;
     functionsDir?: string;
     cronsDir?: string;
-    /** Absolute path to built admin assets, when the admin panel is bundled. */
-    adminDir?: string;
-    /** Absolute path to built static assets to serve from this process. */
-    staticDir?: string;
+    /**
+     * Built static apps to serve from this process, in mount order.
+     *
+     * A list, not a single directory: one process serves a site at `/` and an
+     * admin at `/admin`. Entries whose directory is missing are dropped with a
+     * warning, so a partially-built bundle still boots its API.
+     */
+    staticApps: LoadedStaticApp[];
+}
+/** One built static app inside a loaded bundle, with an absolute directory. */
+export interface LoadedStaticApp {
+    /** Public base path, e.g. `/` or `/admin`. */
+    path: string;
+    /** Absolute path to the built assets. */
+    dir: string;
+    /** Serve `index.html` for unmatched paths under `path`. */
+    spa: boolean;
 }
 /**
  * Read and validate a bundle's manifest.
@@ -83,7 +96,6 @@ export declare function createSourceBundle(options: {
     functions?: string;
     crons?: string;
     schema?: string;
-    mode?: "cms" | "baas" | "static";
     app?: string;
 }): LoadedBundle;
 /**

package/dist/index.d.ts

@@ -32,6 +32,7 @@ export { loadEnv } from "./env";
 export type { RebaseEnv } from "./env";
 export * from "./types";
 export * from "./services/driver-registry";
+export * from "./services/webhook-service";
 export { cleanupDevPortFile, listenWithPortRetry } from "./utils/dev-port";
 export { serveSPA } from "./serve-spa";
 export { installShutdownHandlers } from "./init/shutdown";

package/dist/index.es.js

@@ -3,7 +3,7 @@ import process from "process";
 __createRequire(import.meta.url);
 import { i as __toESM, n as __exportAll } from "./chunk-DSJWtz9O.js";
 import { C as RebaseClientError, S as RebaseApiError, _ as toCanonicalOp, a as DEFAULT_DATA_SOURCE_KEY, b as GeoPoint, f as isPostgresCollectionConfig, i as DEFAULT_STORAGE_SOURCE_KEY, n as serializeCollections, r as SCHEMA_VERSION_HEADER, s as isSQLAdmin, t as computeSchemaVersion, u as getCollectionDataPath, v as EntityReference, x as Vector, y as EntityRelation } from "./src-BYbxB4PR.js";
-import { a as deserializeFilter, c as serializeLogicalCondition, d as resolveDataSource, f as findRelation, h as toSnakeCase, i as buildSdkData, l as CollectionRegistry, m as buildCompositeId, n as serializeOrderBy, o as deserializeLogicalCondition, p as resolveCollectionRelations, r as buildRoutedRebaseData, s as serializeFilter, t as deserializeOrderBy, u as createDataSourceRegistry } from "./src-q6_elgGZ.js";
+import { a as deserializeFilter, c as serializeLogicalCondition, d as resolveDataSource, f as findRelation, h as toSnakeCase, i as buildSdkData, l as CollectionRegistry, m as buildCompositeId, n as serializeOrderBy, o as deserializeLogicalCondition, p as resolveCollectionRelations, r as buildRoutedRebaseData, s as serializeFilter, t as deserializeOrderBy, u as createDataSourceRegistry } from "./src-DjtcIpz3.js";
 import { t as logger } from "./logger-BYU66ENZ.js";
 import { a as generateRefreshToken, c as getRefreshTokenTtlMs, d as verifyAccessToken, f as verifyDownloadToken, i as generateDownloadToken, l as hashRefreshToken, n as configureJwt, o as getAccessTokenExpiry, p as require_jsonwebtoken, r as generateAccessToken, s as getRefreshTokenExpiry, t as MAX_COOKIE_AGE_MS } from "./jwt-D-eI6TTu.js";
 import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
@@ -765,7 +765,14 @@ var TABLE$2 = "\"rebase\".\"idempotency_keys\"";
 * by a scheduled job — there is no cron guaranteed to be running.
 */
 var TTL_HOURS = 24;
-/** The principal a key belongs to; anonymous and service writes share a sentinel. */
+/**
+* The principal a key belongs to; anonymous and service writes share a sentinel.
+*
+* The NUL is written as an escape, not as a raw byte in the source. The
+* sentinel itself is deliberate — a uid can never contain one — but written
+* literally it makes this file test as binary, and every repo-wide grep then
+* skips all 124 lines of it silently. Identical at runtime.
+*/
 function principal(uid) {
 	return uid && uid.length > 0 ? uid : "\0anon";
 }
@@ -11970,7 +11977,7 @@ function assertStorageAccessControlConfigured(state, isProduction) {
 //#region src/init/docs.ts
 async function mountOpenApiDocs(app, basePath, enableSwagger, activeCollections, requireAuth) {
 	if (enableSwagger === false || activeCollections.length === 0) return;
-	const { generateOpenApiSpec } = await import("./openapi-generator-CeOnlAJ3.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-Bi3kcf6D.js");
 	app.get(`${basePath}/docs`, (c) => {
 		const spec = generateOpenApiSpec(activeCollections, {
 			basePath,
@@ -17553,13 +17560,37 @@ function createEmailService(config) {
 }
 //#endregion
 //#region src/singleton.ts
-var _instance = null;
+/**
+* The backing instance lives on a process-global slot, NOT in a module-local
+* variable — because more than one copy of this module can be loaded into one
+* process, and a module-local would leave every copy but the booting one dead.
+*
+* That is the normal layout under the managed runtime, not an edge case: the
+* image ships the framework at `/app/node_modules`, while a project's bundle
+* installs its own dependencies into `/bundle/node_modules` — and every custom
+* function imports `defineFunction` from `@rebasepro/server`, which resolves to
+* the bundle's transitively-installed copy. `initializeRebaseBackend()` then ran
+* against `/app`'s copy while every function held `/bundle`'s, so `rebase.data`,
+* `rebase.storage` and `rebase.dataAsAdmin` threw "server not initialized yet"
+* on EVERY request, forever, in an otherwise healthy process.
+*
+* `Symbol.for` is the fix because its registry is per-process rather than
+* per-module: whichever copy boots publishes here, and every other copy — same
+* version or not — reads the same live client.
+*/
+var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
+function getInstance() {
+	return globalThis[INSTANCE_SLOT] ?? null;
+}
+function setInstance(client) {
+	globalThis[INSTANCE_SLOT] = client;
+}
 /**
 * @internal Called once during server initialization to set the backing instance.
 * This is invoked by `initializeRebaseBackend()` — never call it manually.
 */
 function _initRebase(client) {
-	_instance = client;
+	setInstance(client);
 }
 /**
 * @internal Allows overriding the underlying instance for unit testing.
@@ -17567,17 +17598,17 @@ function _initRebase(client) {
 */
 function _setRebaseMock(mockInstance) {
 	if (process.env.NODE_ENV !== "test") throw new Error("_setRebaseMock can only be called in a test environment (NODE_ENV=test).");
-	_instance = {
-		..._instance || {},
+	setInstance({
+		...getInstance() || {},
 		...mockInstance
-	};
+	});
 }
 /**
 * @internal Resets the singleton instance, useful for afterEach() in test suites.
 */
 function _resetRebaseMock() {
 	if (process.env.NODE_ENV !== "test") throw new Error("_resetRebaseMock can only be called in a test environment.");
-	_instance = null;
+	setInstance(null);
 }
 /**
 * The server-side Rebase singleton.
@@ -17616,8 +17647,9 @@ function _resetRebaseMock() {
 */
 var rebase = new Proxy({}, {
 	get(_, prop) {
-		if (!_instance) throw new Error(`rebase.${String(prop)}: server not initialized yet. The singleton is available after Rebase starts — don't call it at import time.`);
-		return _instance[prop];
+		const instance = getInstance();
+		if (!instance) throw new Error(`rebase.${String(prop)}: server not initialized yet. The singleton is available after Rebase starts — don't call it at import time.`);
+		return instance[prop];
 	},
 	set(_, prop) {
 		throw new Error(`Cannot set rebase.${String(prop)} directly. The singleton is read-only. Use _initRebase() during server startup.`);
@@ -17664,21 +17696,16 @@ async function _initializeRebaseBackend(config) {
 	const dataSourceRegistry = createDataSourceRegistry(config.dataSources);
 	collectionRegistry.setDataSources(dataSourceRegistry);
 	if (config.callbacks) collectionRegistry.setGlobalCallbacks(config.callbacks);
-	const mode = config.mode ?? "cms";
-	logger.info(mode === "baas" ? "Starting in baas mode — collections derived from the database schema" : "Starting in cms mode — collections from config");
 	let activeCollections = config.collections || [];
-	if (mode === "baas") {
-		if (activeCollections.length > 0 || config.collectionsDir) {
-			logger.warn("Ignoring configured collections: baas mode derives them from the database schema. Remove `collections`/`collectionsDir`, or use mode: \"cms\" to serve them.");
-			activeCollections = [];
-		}
-	} else if (config.collectionsDir && activeCollections.length === 0) {
+	if (config.collectionsDir && activeCollections.length === 0) {
 		activeCollections = await loadCollectionsFromDirectory(config.collectionsDir);
 		logger.info("Auto-discovered collections", {
 			count: activeCollections.length,
 			dir: config.collectionsDir
 		});
 	}
+	const introspectCollections = activeCollections.length === 0;
+	logger.info(introspectCollections ? "No collections declared — deriving them from the database schema" : "Serving declared collections");
 	const realtimeServices = {};
 	const delegates = {};
 	let bootstrappers = config.bootstrappers || [];
@@ -17706,16 +17733,16 @@ async function _initializeRebaseBackend(config) {
 		const driverResult = await bootstrapper.initializeDriver({
 			collections: activeCollections,
 			collectionRegistry,
-			mode,
+			introspectCollections,
 			baas: config.baas
 		});
 		delegates[b.id || bootstrapper.type] = driverResult.driver;
-		if (mode === "baas") {
+		if (introspectCollections) {
 			const driverName = b.id || bootstrapper.type;
-			if (!driverResult.collections) throw new Error(`Driver "${driverName}" does not support baas mode: it cannot derive collections from the database schema. Use mode: "cms" and declare collections explicitly, or use a driver that implements introspection (e.g. @rebasepro/server-postgres).`);
+			if (!driverResult.collections) throw new Error(`Driver "${driverName}" cannot derive collections from the database schema, and this project declared none. Declare collections, or use a driver that implements introspection (e.g. @rebasepro/server-postgres).`);
 			if (driverResult.collections.length === 0) logger.warn(`Driver "${driverName}" found no tables to serve. The data API will not be mounted. Create tables (migrations, SQL, any tool) and restart.`);
 		}
-		if (driverResult.collections?.length) activeCollections = [...activeCollections, ...driverResult.collections];
+		if (introspectCollections && driverResult.collections?.length) activeCollections = [...activeCollections, ...driverResult.collections];
 		if ((b.id || bootstrapper.type) === defaultDriverId || !defaultDriverResult) defaultDriverResult = driverResult;
 		if (bootstrapper.initializeRealtime) {
 			const realtime = await bootstrapper.initializeRealtime({}, driverResult);
@@ -17958,7 +17985,7 @@ async function _initializeRebaseBackend(config) {
 		if (apiKeyPreAuth) router.use("/*", apiKeyPreAuth);
 		router.use("/*", createRequireAuth({ serviceKey: internalServiceKey }), requireAdmin);
 	};
-	const schemaEditorEnabled = config.schemaEditor ?? (!!config.collectionsDir && process.env.NODE_ENV !== "production" && mode === "cms");
+	const schemaEditorEnabled = config.schemaEditor ?? (!!config.collectionsDir && !introspectCollections && process.env.NODE_ENV !== "production");
 	if (schemaEditorEnabled && !config.collectionsDir) logger.warn("schemaEditor is enabled but no collectionsDir is set — the schema editor has nowhere to write. Skipping.");
 	if (schemaEditorEnabled && config.collectionsDir) {
 		let editorModule;
@@ -18215,7 +18242,6 @@ async function _initializeRebaseBackend(config) {
 		contractRouter.route("/", createContractRoutes({
 			collectionRegistry,
 			schemaVersion: config.schemaVersion,
-			mode,
 			runtimeVersion: config.runtimeVersion
 		}));
 		config.app.route(`${basePath}/meta`, contractRouter);
@@ -19465,6 +19491,102 @@ function loadEnv(options) {
 	return env;
 }
 //#endregion
+//#region src/services/webhook-service.ts
+var WebhookDispatcher = class {
+	webhooks = [];
+	maxRetries = 3;
+	retryDelays = [
+		1e3,
+		5e3,
+		15e3
+	];
+	/** Register webhooks to watch */
+	setWebhooks(webhooks) {
+		this.webhooks = webhooks.filter((w) => w.enabled);
+	}
+	/** Called when a entity changes — checks if any webhook matches */
+	async onEntityChange(table, event, id, entity, previousEntity) {
+		const matchingWebhooks = this.webhooks.filter((w) => w.table === table && w.events.includes(event));
+		if (matchingWebhooks.length === 0) return [];
+		const results = [];
+		for (const webhook of matchingWebhooks) {
+			const payload = {
+				type: event,
+				table,
+				record: entity,
+				old_record: event === "UPDATE" ? previousEntity : void 0,
+				schema: "public",
+				timestamp: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			const result = await this.deliverWithRetry(webhook, event, payload);
+			results.push(result);
+		}
+		return results;
+	}
+	async deliverWithRetry(webhook, event, payload) {
+		for (let attempt = 1; attempt <= this.maxRetries; attempt++) {
+			const result = await this.deliver(webhook, event, payload, attempt);
+			if (result.success) return result;
+			if (attempt < this.maxRetries) await new Promise((r) => setTimeout(r, this.retryDelays[attempt - 1]));
+			else return result;
+		}
+		return {
+			webhookId: webhook.id,
+			event,
+			payload,
+			statusCode: 0,
+			responseBody: "Max retries exceeded",
+			success: false,
+			attemptNumber: this.maxRetries
+		};
+	}
+	async deliver(webhook, event, payload, attemptNumber) {
+		const body = JSON.stringify(payload);
+		const headers = {
+			"Content-Type": "application/json",
+			"X-Webhook-Id": webhook.id,
+			"X-Webhook-Event": event,
+			"X-Webhook-Delivery": randomUUID$1(),
+			"X-Webhook-Attempt": String(attemptNumber),
+			...webhook.headers || {}
+		};
+		if (webhook.secret) headers["X-Webhook-Signature"] = `sha256=${createHmac("sha256", webhook.secret).update(body).digest("hex")}`;
+		try {
+			const controller = new AbortController();
+			const timeout = setTimeout(() => controller.abort(), 1e4);
+			const response = await fetch(webhook.url, {
+				method: "POST",
+				headers,
+				body,
+				signal: controller.signal
+			});
+			clearTimeout(timeout);
+			const responseBody = await response.text().catch(() => "");
+			const success = response.status >= 200 && response.status < 300;
+			return {
+				webhookId: webhook.id,
+				event,
+				payload,
+				statusCode: response.status,
+				responseBody: responseBody.slice(0, 1e3),
+				success,
+				attemptNumber
+			};
+		} catch (error) {
+			const message = error instanceof Error ? error.message : String(error);
+			return {
+				webhookId: webhook.id,
+				event,
+				payload,
+				statusCode: 0,
+				responseBody: message.slice(0, 1e3),
+				success: false,
+				attemptNumber
+			};
+		}
+	}
+};
+//#endregion
 //#region src/utils/dev-port.ts
 var MAX_PORT_ATTEMPTS = 20;
 /** Filename written next to the project `.env` so the CLI can read it. */
@@ -19606,6 +19728,21 @@ function writeStateFile(projectRoot, port, serviceKey) {
 //#endregion
 //#region src/serve-spa.ts
 /**
+* Is `requestPath` the excluded path `prefix`, or something beneath it?
+*
+* Segment-aware on purpose. A plain `startsWith` reads "/api" as excluding
+* "/apidocs", and "/admin" as excluding "/administrators" — both ordinary
+* client-side routes of the app rooted at "/", both then answered with a 404
+* because the SPA fallback declined them and nothing else claims the path.
+* `apiBasePath` is always in the exclusion list, so this reached single-app
+* setups too, not just the multi-app ones the list was added for.
+*/
+function isUnderPath(requestPath, prefix) {
+	const trimmed = prefix.replace(/\/+$/, "");
+	if (trimmed === "") return true;
+	return requestPath === trimmed || requestPath.startsWith(`${trimmed}/`);
+}
+/**
 * Serve a Single Page Application from an Hono app.
 *
 * @internal Not part of the stable public API. Exported only because the
@@ -19615,21 +19752,30 @@ function writeStateFile(projectRoot, port, serviceKey) {
 * may change without a major version bump.
 */
 function serveSPA(app, config) {
-	const { frontendPath, apiBasePath = "/api", excludePaths = [], indexFile = "index.html" } = config;
+	const { frontendPath, apiBasePath = "/api", excludePaths = [], indexFile = "index.html", spa = true } = config;
+	const rawBase = config.basePath ?? "/";
+	const basePath = rawBase !== "/" ? rawBase.replace(/\/+$/, "") : "/";
+	const isRoot = basePath === "/";
 	if (!fs$2.existsSync(frontendPath)) {
 		logger.warn(`⚠️ Frontend build path does not exist: ${frontendPath}`);
 		logger.warn("   SPA serving is disabled. Build your frontend first.");
 		return;
 	}
-	app.use("/*", responseCompression());
-	app.use("/*", serveStatic({
+	const scope = isRoot ? "/*" : `${basePath}/*`;
+	app.use(scope, responseCompression());
+	app.use(scope, serveStatic({
 		root: path$1.relative(process.cwd(), frontendPath),
-		precompressed: true
+		precompressed: true,
+		...isRoot ? {} : { rewriteRequestPath: (p) => p.slice(basePath.length) || "/" }
 	}));
+	if (!spa) {
+		logger.info(`✅ Static serving enabled at ${basePath} from: ${frontendPath}`);
+		return;
+	}
 	const allExcludePaths = [apiBasePath, ...excludePaths];
 	let cachedHtml = null;
-	app.get("*", async (c, next) => {
-		if (allExcludePaths.some((p) => c.req.path.startsWith(p))) return next();
+	app.get(scope, async (c, next) => {
+		if (allExcludePaths.some((p) => isUnderPath(c.req.path, p))) return next();
 		const indexPath = path$1.join(frontendPath, indexFile);
 		if (!cachedHtml) try {
 			cachedHtml = await fsp.readFile(indexPath, "utf-8");
@@ -19639,7 +19785,7 @@ function serveSPA(app, config) {
 		}
 		return c.html(cachedHtml);
 	});
-	logger.info(`✅ SPA serving enabled from: ${frontendPath}`);
+	logger.info(`✅ SPA serving enabled at ${basePath} from: ${frontendPath}`);
 }
 //#endregion
 //#region src/boot/bundle.ts
@@ -19654,6 +19800,36 @@ var BundleError = class extends Error {
 };
 var MANIFEST_FILENAME = "manifest.json";
 /**
+* Bring a format-1 manifest up to the shape the rest of this runtime expects.
+*
+* Old bundles booting on a new runtime is the case the format version exists to
+* protect, so this is not a courtesy — it is the contract. A project built
+* before the rename ships `mode` and a single `entry.static` directory string,
+* and without this it would boot with no `kind` (so every gate keyed on
+* `kind === "backend"` would skip) and an `entry.static` the loader would try to
+* iterate as a list.
+*
+* In place, and only ever filling in what is absent, so a format-2 manifest
+* passes through untouched.
+*/
+function upgradeLegacyManifest(manifest) {
+	const legacy = manifest;
+	if (!legacy.kind) legacy.kind = legacy.mode === "static" ? "static" : "backend";
+	const entry = legacy.entry;
+	if (!entry) return;
+	if (typeof entry.static === "string") entry.static = [{
+		path: "/",
+		dir: entry.static,
+		spa: true
+	}];
+	else if (!entry.static && typeof entry.admin === "string") entry.static = [{
+		path: "/",
+		dir: entry.admin,
+		spa: true
+	}];
+	delete entry.admin;
+}
+/**
 * Read and validate a bundle's manifest.
 *
 * The checks here are the runtime half of the compatibility contract, and they
@@ -19671,7 +19847,8 @@ function readBundleManifest(bundleDir) {
 		throw new BundleError(`${manifestPath} is not valid JSON: ${err instanceof Error ? err.message : String(err)}`);
 	}
 	if (typeof manifest.bundleFormat !== "number") throw new BundleError(`${manifestPath} is missing "bundleFormat".`);
-	if (manifest.bundleFormat > 1) throw new BundleError(`This bundle uses format ${manifest.bundleFormat}, but this runtime understands up to 1.`, "Upgrade the runtime image, or rebuild the bundle with a matching CLI.");
+	if (manifest.bundleFormat > 2) throw new BundleError(`This bundle uses format ${manifest.bundleFormat}, but this runtime understands up to 2.`, "Upgrade the runtime image, or rebuild the bundle with a matching CLI.");
+	upgradeLegacyManifest(manifest);
 	const contract = manifest.runtime?.contract;
 	if (typeof contract === "number" && contract !== 1) throw new BundleError(`This bundle targets runtime contract v${contract}, but this runtime implements v1.`, contract > 1 ? "Upgrade the runtime image to a version that implements the newer contract." : "Rebuild the bundle against the current runtime (`rebase build`), or run a runtime image from the previous major.");
 	return manifest;
@@ -19720,8 +19897,14 @@ function loadBundle(bundleDir) {
 		collectionsDir: entry.collections ? resolveEntry(entry.collections, "collections") : entry.config ? resolveEntry(path.join(entry.config, "collections"), "collections") : void 0,
 		functionsDir: resolveEntry(entry.functions, "functions"),
 		cronsDir: resolveEntry(entry.crons, "crons"),
-		adminDir: resolveEntry(entry.admin, "admin"),
-		staticDir: resolveEntry(entry.static, "static")
+		staticApps: (entry.static ?? []).map((item) => {
+			const resolved = resolveEntry(item.dir, `static app "${item.path}"`);
+			return resolved ? {
+				path: item.path,
+				dir: resolved,
+				spa: item.spa !== false
+			} : void 0;
+		}).filter((item) => item !== void 0).sort((a, b) => b.path.length - a.path.length)
 	};
 }
 /**
@@ -19770,7 +19953,7 @@ function createSourceBundle(options) {
 	return {
 		dir,
 		manifest: {
-			bundleFormat: 1,
+			bundleFormat: 2,
 			runtime: {
 				range: `^1`,
 				builtAgainst: "source",
@@ -19778,7 +19961,7 @@ function createSourceBundle(options) {
 			},
 			schemaVersion: "",
 			app: options.app ?? "backend",
-			mode: options.mode ?? "cms",
+			kind: "backend",
 			entry: {
 				config: options.config ?? configDir,
 				collections: collectionsDir,
@@ -19797,8 +19980,7 @@ function createSourceBundle(options) {
 		collectionsDir: resolve(collectionsDir),
 		functionsDir: resolve(options.functions),
 		cronsDir: resolve(options.crons),
-		adminDir: void 0,
-		staticDir: void 0
+		staticApps: []
 	};
 }
 /**
@@ -20741,11 +20923,11 @@ async function bootFromBundle(options = {}) {
 	const devRoot = process.env.REBASE_DEV_PROJECT_ROOT || process.cwd();
 	logger.info("Loaded bundle", {
 		app: bundle.manifest.app,
-		mode: bundle.manifest.mode,
+		kind: bundle.manifest.kind,
 		schemaVersion: bundle.manifest.schemaVersion,
 		builtAgainst: bundle.manifest.runtime?.builtAgainst
 	});
-	if (bundle.manifest.mode === "static") return bootStaticApp(bundle, devRoot, options);
+	if (bundle.manifest.kind === "static") return bootStaticApp(bundle, devRoot, options);
 	const env = loadBootEnv();
 	const isProduction = env.NODE_ENV === "production";
 	const configExports = await loadBundleConfigExports(bundle);
@@ -20775,7 +20957,6 @@ async function bootFromBundle(options = {}) {
 		server,
 		app,
 		basePath: env.REBASE_BASE_PATH,
-		mode: bundle.manifest.mode ?? "cms",
 		collectionsDir: bundle.collectionsDir,
 		functionsDir: bundle.functionsDir,
 		cronsDir: bundle.cronsDir,
@@ -20821,20 +21002,24 @@ async function bootFromBundle(options = {}) {
 		if (!env.REBASE_METRICS_TOKEN) logger.warn("Metrics are enabled without REBASE_METRICS_TOKEN — /metrics is readable by anyone who can reach this port. Set a token, or keep the port on a private network.");
 		app.route("/metrics", createMetricsRoutes(metrics.registry, env.REBASE_METRICS_TOKEN));
 	}
-	if (env.REBASE_SERVE_STATIC) {
-		const staticRoot = bundle.staticDir ?? bundle.adminDir;
-		if (staticRoot) {
-			logger.info("Serving static assets", { path: staticRoot });
-			serveSPA(app, {
-				frontendPath: staticRoot,
-				apiBasePath: env.REBASE_BASE_PATH,
-				excludePaths: [
-					"/health",
-					"/livez",
-					"/metrics"
-				]
-			});
-		}
+	if (env.REBASE_SERVE_STATIC) for (const staticApp of bundle.staticApps) {
+		const siblings = bundle.staticApps.filter((other) => other !== staticApp).map((other) => other.path).filter((other) => other !== "/");
+		logger.info("Serving static assets", {
+			path: staticApp.dir,
+			at: staticApp.path
+		});
+		serveSPA(app, {
+			frontendPath: staticApp.dir,
+			basePath: staticApp.path,
+			apiBasePath: env.REBASE_BASE_PATH,
+			excludePaths: [
+				"/health",
+				"/livez",
+				"/metrics",
+				...siblings
+			],
+			spa: staticApp.spa
+		});
 	}
 	let port = env.PORT;
 	if (options.listen !== false) if (isProduction) {
@@ -20886,8 +21071,7 @@ async function bootFromBundle(options = {}) {
 * backend — the only difference is what the bundle contains.
 */
 async function bootStaticApp(bundle, devRoot, options) {
-	const staticRoot = bundle.staticDir ?? bundle.adminDir;
-	if (!staticRoot) throw new BundleError("A static bundle declares no assets to serve.", "Its manifest has `mode: \"static\"` but no `entry.static` — rebuild the app with `rebase build`.");
+	if (bundle.staticApps.length === 0) throw new BundleError("A static bundle declares no assets to serve.", "Its manifest has `kind: \"static\"` but no `entry.static` — rebuild the app with `rebase build`.");
 	const isProduction = process.env.NODE_ENV === "production";
 	const requestedPort = Number(process.env.PORT ?? "3001") || 3001;
 	const basePath = process.env.REBASE_BASE_PATH || "/api";
@@ -20907,19 +21091,26 @@ async function bootStaticApp(bundle, devRoot, options) {
 		latencyMs: 0
 	}));
 	if (metrics) app.route("/metrics", createMetricsRoutes(metrics.registry, metricsToken));
-	logger.info("Serving static app", {
-		app: bundle.manifest.app,
-		path: staticRoot
-	});
-	serveSPA(app, {
-		frontendPath: staticRoot,
-		apiBasePath: basePath,
-		excludePaths: [
-			"/health",
-			"/livez",
-			"/metrics"
-		]
-	});
+	for (const staticApp of bundle.staticApps) {
+		const siblings = bundle.staticApps.filter((other) => other !== staticApp).map((other) => other.path).filter((other) => other !== "/");
+		logger.info("Serving static app", {
+			app: bundle.manifest.app,
+			path: staticApp.dir,
+			at: staticApp.path
+		});
+		serveSPA(app, {
+			frontendPath: staticApp.dir,
+			basePath: staticApp.path,
+			apiBasePath: basePath,
+			excludePaths: [
+				"/health",
+				"/livez",
+				"/metrics",
+				...siblings
+			],
+			spa: staticApp.spa
+		});
+	}
 	let port = requestedPort;
 	if (options.listen !== false) if (isProduction) {
 		await new Promise((resolve, reject) => {
@@ -20997,7 +21188,8 @@ async function ensureCollectionSchema(bundle, dataSources, env) {
 		logger.info("REBASE_MIGRATE_ON_BOOT=none — leaving the database schema untouched.");
 		return;
 	}
-	if ((bundle.manifest.mode ?? "cms") !== "cms") return;
+	if (bundle.manifest.kind !== "backend") return;
+	if (!bundle.manifest.entry?.config) return;
 	if (!bundle.collectionsDir) return;
 	const primary = dataSources[0];
 	if (!primary?.bootstrapper.ensureCollectionSchema) return;
@@ -21043,7 +21235,6 @@ function createContractRoutes(config) {
 				version: config.runtimeVersion ?? "unknown",
 				contract: 1
 			},
-			mode: config.mode,
 			collections: serialized,
 			collectionSlugs: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)).sort(),
 			generatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -21062,15 +21253,12 @@ function createContractRoutes(config) {
 	router.get("/schema-version", (c) => {
 		const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());
 		c.header(SCHEMA_VERSION_HEADER, schemaVersion);
-		return c.json({
-			schemaVersion,
-			mode: config.mode
-		});
+		return c.json({ schemaVersion });
 	});
 	logger.debug("Contract routes mounted");
 	return router;
 }
 //#endregion
-export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
+export { ApiError, BundleError, CronScheduler, DEFAULT_DRIVER_ID, DEFAULT_MAX_FILE_SIZE, DEFAULT_STORAGE_ID, DOCUMENT_MIME_TYPES, DefaultDriverRegistry, DefaultStorageRegistry, GCSStorageController, IMAGE_MIME_TYPES, LocalStorageController, MetricsRegistry, S3StorageController, SMTPEmailService, TransformCache, TusHandler, WebhookDispatcher, _resetRebaseMock, _setRebaseMock, applyCollectionDefaults, authJwt, authRoles, authUid, bootFromBundle, classifySurface, cleanupDevPortFile, createAppleProvider, createBackupRoutes, createBitbucketProvider, createBuiltinAuthAdapter, createContractRoutes, createCronRoutes, createCronStore, createCustomAuthAdapter, createDiscordProvider, createEmailService, createFacebookProvider, createFunctionRoutes, createGitHubProvider, createGitLabProvider, createGoogleProvider, createHistoryRoutes, createLinkedinProvider, createMetricsMiddleware, createMetricsRoutes, createMicrosoftProvider, createSlackProvider, createSourceBundle, createSpotifyProvider, createStorageController, createStorageRoutes, createTwitterProvider, defineCron, defineFunction, envSuffixForKey, errorHandler, extractUserFromToken, fileTokenAuth, generateSecurePassword, getEmailVerificationTemplate, getMagicLinkTemplate, getPasswordResetTemplate, getUserInvitationTemplate, getWelcomeEmailTemplate, hashPassword, httpMethodToOperation, initializeDataSource, initializeDataSources, initializeRebaseBackend, installShutdownHandlers, isApiKeyToken, isAuthAdapter, isDatabaseAdapter, isLocalhostOrigin, isOperationAllowed, isRebaseApiError, isTransformableImage, listBackupObjects, listenWithPortRetry, loadBootEnv, loadBundle, loadBundleConfigExports, loadBundleSchema, loadCollectionsFromDirectory, loadCronJobsFromDirectory, loadEnv, loadFunctionsFromDirectory, loadUsersCollection, logger, optionalAuth, parseBackupDestination, parseBackupTimestamp, parseTransformOptions, queryTokenAuth, readBackupBytes, readBundleManifest, rebase, requireAdmin, requireAuth, resolveAuthHooks, resolveAuthOptions, resolveCorsOrigin, resolveDataSources, resolveEmailOptions, resolveStorageBackend, resolveStorageSources, runFromBundle, safeCompare, serveSPA, transformImage, validateApiKey, validateCronExpression, validatePasswordStrength, verifyPassword };
 
 //# sourceMappingURL=index.es.js.map