@rebasepro/server 0.11.1-canary.gfd39654 → 0.12.0

package/dist/api/contract-routes.d.ts

@@ -29,7 +29,6 @@ export interface ContractRoutesConfig {
      * at boot, so there was nothing to hash when it was built.
      */
     schemaVersion?: string;
-    mode: "cms" | "baas";
     /** Runtime package version, surfaced so a client can report what it built against. */
     runtimeVersion?: string;
 }

package/dist/auth/api-keys/api-key-types.d.ts

@@ -1,26 +1,15 @@
 /**
  * Type definitions for Service API Keys.
  *
- * API keys provide machine-to-machine authentication for scripts, cron jobs,
- * and third-party integrations. Each key is scoped to specific collections
- * and operations via the `ApiKeyPermission` model.
+ * The wire contract — permissions, the masked key, the create/update payloads —
+ * lives in `@rebasepro/types`, because the client SDK needs the same shapes and
+ * the two declarations had already drifted apart. Only {@link ApiKey}, the
+ * database row carrying `key_hash`, is server-side and stays here.
  *
  * @module
  */
-/**
- * A single permission entry scoping an API key to a collection and set of operations.
- *
- * Use `"*"` as the collection value to grant access to all collections
- * (and all custom functions). Custom functions are addressed with the
- * `functions` namespace: `"functions"` grants every function,
- * `"functions/<name>"` grants a single one.
- */
-export interface ApiKeyPermission {
-    /** Collection slug, `"functions"`/`"functions/<name>"`, or `"*"` for everything. */
-    collection: string;
-    /** Allowed operations on the collection. */
-    operations: ("read" | "write" | "delete")[];
-}
+import type { ApiKeyPermission } from "@rebasepro/types";
+export type { ApiKeyPermission, ApiKeyMasked, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest } from "@rebasepro/types";
 /**
  * Full database row for an API key.
  * The `key_hash` is never exposed via the API — only stored for lookup.
@@ -54,56 +43,3 @@ export interface ApiKey {
     expires_at: string | null;
     revoked_at: string | null;
 }
-/**
- * Masked version of an API key, safe for API responses.
- * Omits `key_hash` and shows only the prefix.
- */
-export interface ApiKeyMasked {
-    id: string;
-    name: string;
-    key_prefix: string;
-    permissions: ApiKeyPermission[];
-    /** When true, the key is granted the `admin` role (admin routes + RLS `default_admin` policies). */
-    admin: boolean;
-    rate_limit: number | null;
-    created_by: string;
-    created_at: string;
-    updated_at: string;
-    last_used_at: string | null;
-    expires_at: string | null;
-    revoked_at: string | null;
-}
-/**
- * Request body for creating a new API key.
- */
-export interface CreateApiKeyRequest {
-    name: string;
-    permissions: ApiKeyPermission[];
-    /** When true, grants the `admin` role (admin routes + RLS `default_admin` policies). */
-    admin?: boolean;
-    /** Requests per 15-minute window. Omit or `null` to use the server default (1000/window). */
-    rate_limit?: number | null;
-    /** ISO-8601 expiration timestamp. Omit for no expiration. */
-    expires_at?: string | null;
-}
-/**
- * Request body for updating an existing API key.
- * All fields are optional — only provided fields are updated.
- */
-export interface UpdateApiKeyRequest {
-    name?: string;
-    permissions?: ApiKeyPermission[];
-    /** When true, grants the `admin` role (admin routes + RLS `default_admin` policies). */
-    admin?: boolean;
-    rate_limit?: number | null;
-    expires_at?: string | null;
-}
-/**
- * Returned exactly once when a key is created.
- * The `key` field contains the full plaintext key — it is never stored
- * or returned again after creation.
- */
-export interface ApiKeyWithSecret extends ApiKeyMasked {
-    /** Full plaintext API key (e.g. `rk_live_abc123...`). */
-    key: string;
-}

package/dist/auth/builtin-auth-adapter.d.ts

@@ -28,6 +28,17 @@ export interface BuiltinAuthAdapterConfig {
     emailConfig?: EmailConfig;
     /** Whether to allow new user registration. */
     allowRegistration?: boolean;
+    /**
+     * Hard kill switch: block self-registration outright, including the
+     * first-user bootstrap window that an empty database would otherwise open.
+     *
+     * Was declared on the route module and read by both config endpoints, but
+     * never plumbed through here — so nothing a user of the framework could
+     * write ever reached it, and the tests that covered it passed only because
+     * they built `createAuthRoutes` directly, bypassing this adapter (the sole
+     * wiring path a real backend uses).
+     */
+    disableSelfRegistration?: boolean;
     /** Whether to expose the authenticated email→minimal-profile lookup route. */
     allowUserLookup?: boolean;
     /** Default role to assign to new users. */

package/dist/auth/registration-policy.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Whether a registration may proceed — computed in exactly one place.
+ *
+ * This predicate had drifted across three independent implementations, which is
+ * the shape the bug always takes: one endpoint *advertises* that registration is
+ * open, another *enforces* that it is closed, and the user lands on a form that
+ * can only ever 403.
+ *
+ *   1. `POST /auth/register` (routes.ts) — enforces.
+ *   2. `GET /auth/config` (session-routes.ts) — advertises.
+ *   3. `getCapabilities()` (builtin-auth-adapter.ts) — also advertises, and is
+ *      the one that actually answers `GET /auth/config` on a real backend:
+ *      `init.ts` registers that path directly *before* mounting the auth router,
+ *      so Hono resolves it first and the session-routes copy never runs for it.
+ *
+ * Two of the three had already been fixed for the empty-database case when the
+ * third was still returning `allowRegistration || needsSetup` — missing the kill
+ * switch entirely. The fix is not to correct the third copy but to delete all
+ * three: every caller now goes through this function, so the next term added
+ * here reaches every surface at once.
+ *
+ * The rule itself:
+ *
+ *   - `disableSelfRegistration` is absolute. It blocks even the first user, for
+ *     operators who provision accounts out of band and never want a public
+ *     first-come-first-admin window.
+ *   - Otherwise an **empty** user table always admits the first registration,
+ *     which auto-promotes to admin. Without this a backend deployed with
+ *     `allowRegistration: false` is a dead end: `POST /admin/bootstrap` needs an
+ *     authenticated caller, and an empty database cannot produce one.
+ *   - Otherwise `allowRegistration` decides, as it always did.
+ */
+export interface RegistrationPolicy {
+    /** The hard kill switch. Blocks registration including first-user bootstrap. */
+    disableSelfRegistration?: boolean;
+    /** Steady-state self-registration, once at least one user exists. */
+    allowRegistration?: boolean;
+    /**
+     * True when the user table is empty — the bootstrap window.
+     *
+     * Callers that already know this (the config endpoints compute it to report
+     * `needsSetup`) pass it directly. `POST /auth/register` must not: it serves
+     * anonymous callers, so it checks {@link isSteadyStateRegistrationOpen}
+     * first and only pays for the count when that says no.
+     */
+    needsSetup: boolean;
+}
+/** The full predicate, for callers that already know whether setup is needed. */
+export declare function isRegistrationOpen(policy: RegistrationPolicy): boolean;
+/**
+ * The same predicate with the bootstrap window assumed closed.
+ *
+ * Exists so `POST /auth/register` can reject the common case without counting
+ * rows. A `false` here does **not** mean "refuse" — it means "the answer depends
+ * on whether the table is empty, so now go and look".
+ */
+export declare function isSteadyStateRegistrationOpen(policy: Omit<RegistrationPolicy, "needsSetup">): boolean;

package/dist/boot/bundle.d.ts

@@ -13,10 +13,23 @@ export interface LoadedBundle {
     collectionsDir?: string;
     functionsDir?: string;
     cronsDir?: string;
-    /** Absolute path to built admin assets, when the admin panel is bundled. */
-    adminDir?: string;
-    /** Absolute path to built static assets to serve from this process. */
-    staticDir?: string;
+    /**
+     * Built static apps to serve from this process, in mount order.
+     *
+     * A list, not a single directory: one process serves a site at `/` and an
+     * admin at `/admin`. Entries whose directory is missing are dropped with a
+     * warning, so a partially-built bundle still boots its API.
+     */
+    staticApps: LoadedStaticApp[];
+}
+/** One built static app inside a loaded bundle, with an absolute directory. */
+export interface LoadedStaticApp {
+    /** Public base path, e.g. `/` or `/admin`. */
+    path: string;
+    /** Absolute path to the built assets. */
+    dir: string;
+    /** Serve `index.html` for unmatched paths under `path`. */
+    spa: boolean;
 }
 /**
  * Read and validate a bundle's manifest.
@@ -83,7 +96,6 @@ export declare function createSourceBundle(options: {
     functions?: string;
     crons?: string;
     schema?: string;
-    mode?: "cms" | "baas" | "static";
     app?: string;
 }): LoadedBundle;
 /**

package/dist/boot/driver.d.ts

@@ -1,7 +1,16 @@
 import type { BackendBootstrapper } from "@rebasepro/types";
 import type { ResolvedDataSourceConfig } from "./sources";
-/** The connection handle a driver hands back. */
-export interface DatabaseConnection {
+/**
+ * The connection handle a driver hands back at boot: the client object, the
+ * pool to close on shutdown, and how to probe it.
+ *
+ * Named `DatabaseConnection` until that collided with `DatabaseConnection` in
+ * `@rebasepro/types` — an abstract `{ type, isConnected, close() }` that
+ * `MongoDBConnection` implements. The two share no field, and both are public:
+ * one is re-exported from `@rebasepro/server`'s index, the other from
+ * `@rebasepro/types`, packages that are installed together.
+ */
+export interface DriverConnection {
     db: unknown;
     /**
      * Present for pool-based drivers. Closed during shutdown, and used to probe
@@ -31,7 +40,7 @@ export interface InitializedDataSource {
     engine: string;
     driverPackage: string;
     bootstrapper: BackendBootstrapper;
-    connection: DatabaseConnection;
+    connection: DriverConnection;
 }
 export interface BundleSchema {
     tables?: Record<string, unknown>;
@@ -55,3 +64,8 @@ export declare function initializeDataSource(source: ResolvedDataSourceConfig, s
  * order a human would expect.
  */
 export declare function initializeDataSources(sources: ResolvedDataSourceConfig[], schema: BundleSchema | undefined, resolveFrom?: string[]): Promise<InitializedDataSource[]>;
+/**
+ * @deprecated Use {@link DriverConnection}. This name collides with
+ * `DatabaseConnection` from `@rebasepro/types`, which is a different shape.
+ */
+export type DatabaseConnection = DriverConnection;

package/dist/boot/env.d.ts

@@ -78,11 +78,11 @@ declare const bootEnvExtension: z.ZodObject<{
     MICROSOFT_CLIENT_ID: z.ZodOptional<z.ZodString>;
     MICROSOFT_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
     REBASE_BASE_PATH: z.ZodDefault<z.ZodString>;
-    REBASE_ENABLE_SWAGGER: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+    REBASE_ENABLE_SWAGGER: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
         "": "";
         true: "true";
         false: "false";
-    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
     REBASE_MAX_BODY_SIZE: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
     REBASE_COMPRESSION: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
@@ -115,6 +115,20 @@ export declare function loadBootEnv(): RebaseBootEnv;
  */
 export declare function isLocalhostOrigin(origin: string): boolean;
 /** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
+/**
+ * Whether this process serves the OpenAPI docs.
+ *
+ * An explicit `REBASE_ENABLE_SWAGGER` wins in either direction. Left unset, the
+ * docs follow the environment: on in development, where they are part of how a
+ * scaffolded project is meant to be explored, and off in production, where the
+ * spec enumerates every collection and field to anyone who asks for it.
+ *
+ * Returning `undefined` for development is the point rather than an oversight —
+ * it hands the decision to the server's own policy in `init/docs.ts`, which also
+ * knows to withhold the Swagger UI while still serving the spec. Two defaults
+ * that can disagree about the same route is the bug this replaces.
+ */
+export declare function resolveEnableSwagger(env: RebaseBootEnv): boolean | undefined;
 export type CorsOriginResolver = (origin: string) => string | null;
 /**
  * Build the CORS origin policy.

package/dist/boot/sources.d.ts

@@ -30,8 +30,21 @@ export type EnvBag = Record<string, string | undefined>;
  *
  * The default key maps to no suffix at all, which is what keeps every existing
  * single-database deployment working untouched.
+ *
+ * The rule itself lives in `@rebasepro/types` so the CLI and any control plane
+ * derive identical names from identical keys; this wrapper exists only to raise
+ * it as a `BundleError`, which is what the rest of boot reports failures as.
  */
 export declare function envSuffixForKey(key: string, defaultKey: string): string;
+/**
+ * Guard against two distinct keys collapsing onto the same variable name.
+ *
+ * `media-cdn` and `media_cdn` are different source keys but the same suffix, and
+ * without this check one of them would silently read the other's configuration.
+ */
+export declare function assertDistinctSuffixes(definitions: {
+    key: string;
+}[], defaultKey: string, what: string): void;
 /** A data source resolved to everything needed to build a driver for it. */
 export interface ResolvedDataSourceConfig {
     /** Data-source key — becomes the driver-registry id collections route by. */
@@ -75,3 +88,21 @@ export declare function resolveStorageBackend(env: EnvBag, key: string, engineHi
  * they just had no way to be configured from the environment.
  */
 export declare function resolveStorageSources(env: EnvBag, definitions: StorageSourceDefinition[] | undefined, defaultBasePath: string): Record<string, BackendStorageConfig> | undefined;
+/**
+ * Read a project's declared storage sources from its `rebase.json`.
+ *
+ * A managed bundle carries its topology in `manifest.json`, resolved at build
+ * time. A **custom** runtime has no manifest — it builds its own image and its
+ * own entrypoint — so without this it would have to re-declare in code what
+ * `rebase.json` already says, and the two would drift. Since a custom image
+ * contains the repository anyway, reading the file it already ships is what
+ * keeps one declaration authoritative for both runtimes.
+ *
+ * Walks up from `startDir` because an entrypoint lives at `backend/src` in the
+ * scaffolded layout and somewhere else in a hand-rolled one. A missing,
+ * unreadable or malformed file means "declared nothing" — one default source —
+ * which is the correct reading of every project that predates this and must
+ * never be an error: a storage declaration is optional, and failing to boot a
+ * whole backend over an absent optional file would be the worse bug.
+ */
+export declare function loadDeclaredStorageSources(startDir: string, levels?: number): StorageSourceDefinition[];

package/dist/collections/loader.d.ts

@@ -1,4 +1,5 @@
 import { CollectionConfig, SecurityRule } from "@rebasepro/types";
+import { type ValidateCollectionConfigOptions } from "./validate-config";
 /**
  * The one definition of "the collections".
  *
@@ -35,5 +36,14 @@ export declare function applyCollectionDefaults(collections: CollectionConfig[],
  * configuration error, and continuing produces the worst outcome available: an
  * API missing a route, or a policy file missing a table, with a successful exit
  * code. Both read as "no data" rather than as a failure.
+ *
+ * Every collection is strict-parsed on the way out — see `validate-config` for
+ * why a key that moved is fatal and a key nobody recognises only warns. It
+ * happens here, at the one definition of "the collections", so the runtime, the
+ * schema generator, the policy generator and the doctor all see the same
+ * verdict rather than three of them silently accepting a config the fourth
+ * rejects.
  */
-export declare function loadCollectionsFromDirectory(source: string): Promise<CollectionConfig[]>;
+export declare function loadCollectionsFromDirectory(source: string, options?: {
+    validate?: false | ValidateCollectionConfigOptions;
+}): Promise<CollectionConfig[]>;

package/dist/collections/validate-config.d.ts

@@ -0,0 +1,70 @@
+/**
+ * A strict parse of every collection config, run at boot.
+ *
+ * Nothing used to check these files. A config written against an older version
+ * loaded clean, and whichever keys had moved since were simply ignored — no
+ * warning, no log line, no failed boot. The collection still served rows, so
+ * the only signal was the feature quietly not being there: an icon that never
+ * appeared, a relation that answered `[]`, a `readOnly` field the panel let you
+ * edit. The renames are not the problem; a rename with no runtime signal is.
+ *
+ * Two severities, because two different things are being detected:
+ *
+ * - A **known-removed or known-renamed key** is high-confidence and actionable —
+ *   we know what it used to mean and what replaced it. That is an error, and
+ *   refusing to boot is the point. A minute of downtime beats a week of "where
+ *   did my icons go".
+ * - An **unrecognised key** is not. Configs legitimately carry extra metadata,
+ *   and a key we do not know may simply be newer than this list. That warns,
+ *   loudly, and escalates to an error only when asked
+ *   (`REBASE_STRICT_COLLECTION_CONFIG=error`, or an explicit option).
+ *
+ * Everything is reported in one pass. Someone migrating a project wants the
+ * whole list once, not fifty-five sequential boots.
+ *
+ * This is not `validateCollectionJson` in `@rebasepro/admin`. That one parses a
+ * JSON string pasted into the panel's import dialog and checks value *shapes*
+ * against the flat `AdminCollection` view model. This one checks key *identity*
+ * against the authoring contract, on live objects, in a package that may not
+ * import the admin. The two answer different questions about different types,
+ * and merging them would mean the server depending on the admin panel.
+ */
+/** How an unrecognised key is treated. */
+export type UnknownKeyPolicy = "warn" | "error" | "off";
+export interface ConfigProblem {
+    severity: "error" | "warning";
+    /** Dotted path into the config, e.g. `posts.properties.author`. */
+    path: string;
+    message: string;
+}
+export interface ValidateCollectionConfigOptions {
+    /**
+     * What to do with a key that is in no known list. Defaults to the
+     * `REBASE_STRICT_COLLECTION_CONFIG` environment variable, and to `"warn"`
+     * when that is unset.
+     */
+    unknownKeys?: UnknownKeyPolicy;
+}
+/**
+ * Read the unknown-key policy from the environment.
+ *
+ * `REBASE_STRICT_COLLECTION_CONFIG` accepts `error`/`strict`/`1`/`true` to
+ * escalate, `off`/`0`/`false` to silence, and anything else warns.
+ */
+export declare function unknownKeyPolicyFromEnv(env?: Record<string, string | undefined>): UnknownKeyPolicy;
+/**
+ * Every problem across every collection, in one pass.
+ *
+ * Pure: it logs nothing and throws nothing, so callers that want to render the
+ * list themselves (the doctor, a test) can.
+ */
+export declare function findCollectionConfigProblems(collections: readonly unknown[], options?: ValidateCollectionConfigOptions): ConfigProblem[];
+/**
+ * Warn about everything questionable, then refuse to boot if anything is wrong.
+ *
+ * Warnings are logged even when there are errors: someone migrating wants the
+ * whole picture in one run, and the second-most annoying thing after a broken
+ * boot is a boot that breaks again on something it could have told you the
+ * first time.
+ */
+export declare function assertCollectionConfigs(collections: readonly unknown[], options?: ValidateCollectionConfigOptions): void;

package/dist/cron/cron-scheduler.d.ts

@@ -77,6 +77,15 @@ export declare class CronScheduler {
      * a `skipped: true` result rather than running concurrently.
      */
     triggerJob(id: string): Promise<CronJobLogEntry | undefined>;
+    /**
+     * Warn once at start when the process looks like it is running on a
+     * platform that freezes or evicts instances between requests, where the
+     * in-process timers this scheduler relies on never fire.
+     *
+     * Advisory only: any failure here is swallowed so a detection bug can
+     * never take a production boot down.
+     */
+    private warnIfScaleToZero;
     /**
      * Schedule the next execution for a job.
      *

package/dist/cron/index.d.ts

@@ -4,4 +4,5 @@ export { defineCron } from "./define-cron";
 export { CronScheduler, validateCronExpression } from "./cron-scheduler";
 export { createCronRoutes } from "./cron-routes";
 export { createCronStore } from "./cron-store";
+export { detectFreezableRuntime, buildScaleToZeroWarning, CRON_ALWAYS_ON_ENV } from "./scale-to-zero";
 export type { CronStore } from "./cron-store";

package/dist/cron/scale-to-zero.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Scale-to-zero detection for the cron scheduler.
+ *
+ * The scheduler drives jobs with in-process `setTimeout`. That works on any
+ * always-running instance, but on a platform that freezes or evicts the
+ * container between requests (Cloud Run with `--min-instances=0`, AWS Lambda,
+ * Vercel functions) the timers simply never fire — the process boots, logs the
+ * jobs as registered, and silently runs nothing.
+ *
+ * None of these platforms expose their scaling floor to the container, so this
+ * detection is a heuristic: it identifies the *platform*, not the setting. It
+ * is a warning only — it must never influence boot.
+ *
+ * Environment variables used here were verified against vendor documentation:
+ *  - `K_SERVICE` / `K_REVISION` / `K_CONFIGURATION` — Cloud Run services
+ *    (Cloud Run container contract; no variable exposes min-instances).
+ *  - `CLOUD_RUN_JOB` — Cloud Run jobs (same contract).
+ *  - `AWS_LAMBDA_FUNCTION_NAME` — reserved AWS Lambda runtime variable.
+ *  - `VERCEL=1` — Vercel system environment variable, available at runtime.
+ *  - `KUBERNETES_SERVICE_HOST` — injected into every pod by the kubelet. Used
+ *    as an *exclusion*: a Deployment pod runs continuously, and Knative on
+ *    Kubernetes also sets `K_SERVICE`, so a pod is never warned about.
+ */
+/** Environment variable that permanently silences the scale-to-zero warning. */
+export declare const CRON_ALWAYS_ON_ENV = "REBASE_CRON_ALWAYS_ON";
+/** The subset of `process.env` this module reads. */
+export type EnvLike = Record<string, string | undefined>;
+export interface FreezableRuntime {
+    /** Human-readable platform name, used verbatim in the warning. */
+    platform: string;
+    /** Names of the environment variables that identified the platform. */
+    signals: string[];
+}
+/** Minimal shape of a registered job needed to build the warning. */
+export interface WarnableJob {
+    id: string;
+    enabled: boolean;
+}
+export interface ScaleToZeroWarning {
+    message: string;
+    data: Record<string, unknown>;
+}
+/**
+ * Identify a runtime whose instances can be frozen or torn down between
+ * requests. Returns `undefined` when the platform is unknown or known to run
+ * continuously.
+ */
+export declare function detectFreezableRuntime(env?: EnvLike): FreezableRuntime | undefined;
+/**
+ * Build the boot-time warning, or `undefined` when it does not apply.
+ *
+ * Fires only when all of the following hold:
+ *  1. `NODE_ENV=production` — a laptop or CI run is not at risk.
+ *  2. At least one *enabled* job is registered — nothing to lose otherwise.
+ *  3. The environment looks like a freezable platform (see above).
+ *  4. `REBASE_CRON_ALWAYS_ON` is not set to a truthy value.
+ */
+export declare function buildScaleToZeroWarning(jobs: WarnableJob[], env?: EnvLike): ScaleToZeroWarning | undefined;

package/dist/env.d.ts

@@ -22,6 +22,11 @@ declare const rebaseEnvSchema: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    DISABLE_SELF_REGISTRATION: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false" | undefined>>;
     ALLOW_LOCALHOST_IN_PRODUCTION: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
         "": "";
         true: "true";

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export { initializeRebaseBackend, isAuthAdapter, isDatabaseAdapter } from "./ini
 export type { RebaseBackendConfig, RebaseBackendInstance, RebaseAuthConfig, BaasOptions } from "./init";
 export { rebase, _setRebaseMock, _resetRebaseMock } from "./singleton";
 export { loadCollectionsFromDirectory, applyCollectionDefaults, type CollectionDefaults } from "./collections/loader";
+export { assertCollectionConfigs, findCollectionConfigProblems, unknownKeyPolicyFromEnv, type ConfigProblem, type UnknownKeyPolicy, type ValidateCollectionConfigOptions } from "./collections/validate-config";
 export * from "./db/interfaces";
 export * from "./auth/interfaces";
 export { requireAuth, requireAdmin, optionalAuth, queryTokenAuth, fileTokenAuth, extractUserFromToken, hashPassword, verifyPassword, validatePasswordStrength, generateSecurePassword, resolveAuthHooks, createBuiltinAuthAdapter, createCustomAuthAdapter, createGoogleProvider, createLinkedinProvider, createGitHubProvider, createMicrosoftProvider, createAppleProvider, createFacebookProvider, createTwitterProvider, createDiscordProvider, createGitLabProvider, createBitbucketProvider, createSlackProvider, createSpotifyProvider, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed, safeCompare } from "./auth";
@@ -32,6 +33,7 @@ export { loadEnv } from "./env";
 export type { RebaseEnv } from "./env";
 export * from "./types";
 export * from "./services/driver-registry";
+export * from "./services/webhook-service";
 export { cleanupDevPortFile, listenWithPortRetry } from "./utils/dev-port";
 export { serveSPA } from "./serve-spa";
 export { installShutdownHandlers } from "./init/shutdown";
@@ -43,10 +45,10 @@ export type { LoadedBundle, BundleConfigExports } from "./boot/bundle";
 export { loadBootEnv, resolveCorsOrigin, isLocalhostOrigin } from "./boot/env";
 export type { RebaseBootEnv, CorsOriginResolver } from "./boot/env";
 export { resolveAuthOptions, resolveEmailOptions } from "./boot/options";
-export { envSuffixForKey, resolveDataSources, resolveStorageSources, resolveStorageBackend } from "./boot/sources";
+export { envSuffixForKey, assertDistinctSuffixes, loadDeclaredStorageSources, resolveDataSources, resolveStorageSources, resolveStorageBackend } from "./boot/sources";
 export type { ResolvedDataSourceConfig, EnvBag } from "./boot/sources";
 export { initializeDataSource, initializeDataSources } from "./boot/driver";
-export type { InitializedDataSource, DatabaseConnection, BundleSchema } from "./boot/driver";
+export type { InitializedDataSource, DriverConnection, DatabaseConnection, BundleSchema } from "./boot/driver";
 export { MetricsRegistry, createMetricsMiddleware, createMetricsRoutes, classifySurface } from "./metrics";
 export type { MetricSurface, MetricsHandle } from "./metrics";
 export { createContractRoutes } from "./api/contract-routes";