@rebasepro/server 0.12.0 → 0.12.1-canary.gdfba2a1

package/dist/backend-CIxN4FVm.js

@@ -0,0 +1,15 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+//#region ../types/src/types/backend.ts
+/**
+* Type guard: does this admin support SQL operations?
+* @group Admin
+*/
+function isSQLAdmin(admin) {
+	return !!admin && typeof admin.executeSql === "function";
+}
+//#endregion
+export { isSQLAdmin as t };
+
+//# sourceMappingURL=backend-CIxN4FVm.js.map

package/dist/backend-CIxN4FVm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backend-CIxN4FVm.js","names":[],"sources":["../../types/src/types/backend.ts"],"sourcesContent":["import type { CollectionConfig, FilterValues, WhereFilterOp } from \"./collections\";\nimport type { AuthAdapter } from \"./auth_adapter\";\nimport type { HistoryConfig } from \"../controllers/client\";\nimport type { ChannelBusSetting } from \"./channel_bus\";\n\n// =============================================================================\n// DATABASE CONNECTION INTERFACES\n// =============================================================================\n\n/**\n * Abstract database connection interface.\n * Represents a connection to any database system.\n */\nexport interface DatabaseConnection {\n    /**\n     * Type identifier for this database (e.g., 'postgres', 'mongodb', 'mysql')\n     */\n    readonly type: string;\n\n    /**\n     * Whether the connection is currently active\n     */\n    readonly isConnected?: boolean;\n\n    /**\n     * Close the database connection and release resources.\n     */\n    close?(): Promise<void>;\n}\n\n// =============================================================================\n// QUERY BUILDING INTERFACES\n// =============================================================================\n\n/**\n * A single filter condition for database queries\n */\nexport interface QueryFilter {\n    field: string;\n    operator: WhereFilterOp;\n    value: unknown;\n}\n\n/**\n * Options for fetching a collection of entities\n */\nexport interface FetchCollectionOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    orderBy?: string;\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    offset?: number;\n    startAfter?: unknown;\n    searchString?: string;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for searching entities\n */\nexport interface SearchOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    orderBy?: string;\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    databaseId?: string;\n    collection?: CollectionConfig;\n}\n\n/**\n * Options for counting entities\n */\nexport interface CountOptions<M extends Record<string, unknown> = Record<string, unknown>> {\n    filter?: FilterValues<Extract<keyof M, string>>;\n    searchString?: string;\n    databaseId?: string;\n}\n\n/**\n * Abstract condition builder interface.\n * Implementations translate Rebase filter conditions to database-specific queries.\n *\n * Note: This interface can be implemented as instance methods or as a class with static methods.\n * For static implementations (like DrizzleConditionBuilder), use the ConditionBuilderStatic type.\n *\n * @template T The type of condition returned by the builder (e.g., SQL for PostgreSQL, Filter<Document> for MongoDB)\n */\nexport interface ConditionBuilder<T = unknown> {\n    /**\n     * Build filter conditions from Rebase FilterValues\n     */\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        collectionPath: string,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Build search conditions for text search\n     */\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n\n    /**\n     * Combine multiple conditions with AND operator\n     */\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n\n    /**\n     * Combine multiple conditions with OR operator\n     */\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n}\n\n/**\n * Static condition builder type for implementations using static methods.\n * Use this type when the class provides static methods rather than instance methods.\n *\n * @example\n * // DrizzleConditionBuilder satisfies this type\n * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;\n */\nexport type ConditionBuilderStatic<T = unknown> = {\n    buildFilterConditions<M extends Record<string, unknown>>(\n        filter: FilterValues<Extract<keyof M, string>>,\n        ...args: unknown[]\n    ): T[];\n    buildSearchConditions(\n        searchString: string,\n        properties: Record<string, unknown>,\n        ...args: unknown[]\n    ): T[];\n    combineConditionsWithAnd(conditions: T[]): T | undefined;\n    combineConditionsWithOr(conditions: T[]): T | undefined;\n};\n\n// =============================================================================\n// ENTITY REPOSITORY INTERFACES\n// =============================================================================\n\n/**\n * Abstract entity repository interface.\n * Handles all CRUD operations for entities in the database.\n *\n * Implementations should handle:\n * - Entity serialization/deserialization\n * - Relation resolution\n * - ID generation and conversion\n */\nexport interface DataRepository {\n    /**\n     * Fetch a single entity by ID\n     */\n    fetchOne<M extends Record<string, unknown>>(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown> | undefined>;\n\n    /**\n     * Fetch a collection of entities with optional filtering, ordering, and pagination\n     */\n    fetchCollection<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: FetchCollectionOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Search entities by text\n     */\n    searchRows<M extends Record<string, unknown>>(\n        collectionPath: string,\n        searchString: string,\n        options?: SearchOptions<M>\n    ): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Count entities in a collection\n     */\n    count<M extends Record<string, unknown>>(\n        collectionPath: string,\n        options?: CountOptions<M>\n    ): Promise<number>;\n\n    /**\n     * Save a entity (create or update)\n     */\n    save<M extends Record<string, unknown>>(\n        collectionPath: string,\n        values: Partial<M>,\n        id?: string | number,\n        databaseId?: string\n    ): Promise<Record<string, unknown>>;\n\n    /**\n     * Delete a entity by ID\n     */\n    delete(\n        collectionPath: string,\n        id: string | number,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Check if a field value is unique in a collection\n     */\n    checkUniqueField(\n        collectionPath: string,\n        fieldName: string,\n        value: unknown,\n        excludeEntityId?: string,\n        databaseId?: string\n    ): Promise<boolean>;\n\n}\n\n// =============================================================================\n// REALTIME INTERFACES\n// =============================================================================\n\n/**\n * Configuration for subscribing to a collection\n */\nexport interface CollectionSubscriptionConfig {\n    clientId: string;\n    path: string;\n    filter?: unknown;\n    orderBy?: string;\n    order?: \"desc\" | \"asc\";\n    limit?: number;\n    startAfter?: unknown;\n    databaseId?: string;\n    searchString?: string;\n}\n\n/**\n * Configuration for subscribing to a single entity\n */\nexport interface SingleSubscriptionConfig {\n    clientId: string;\n    path: string;\n    id: string | number;\n}\n\n/**\n * Opt-in retention for one set of broadcast channels.\n *\n * Retention is configured on the server and nowhere else. A channel is created\n * by whoever names it, so letting a client ask for its own history depth would\n * let any visitor commit the backend to unbounded storage; and presence-only or\n * notification-only channels — the overwhelming majority — must not pay for a\n * feature they never use. With no rules configured nothing is written, no table\n * is created, and broadcast behaves exactly as it did before history existed.\n */\nexport interface ChannelRetentionRule {\n    /**\n     * Channel name to match. Either exact (`\"doc:42\"`) or a trailing-`*` prefix\n     * (`\"doc:*\"`). Deliberately not a full glob or RegExp: this decides what\n     * gets written to disk, and a rule whose blast radius is not obvious at a\n     * glance is the wrong shape for that.\n     */\n    match: string;\n    /** Keep at most this many of the most recent messages per channel. */\n    limit?: number;\n    /**\n     * Keep messages for at most this long. Accepts a millisecond count or a\n     * short duration string (`\"30s\"`, `\"15m\"`, `\"24h\"`, `\"7d\"`).\n     */\n    ttl?: number | string;\n}\n\n/**\n * Server-side realtime options.\n *\n * The channel bus contract and its config live in `./channel_bus` so that a\n * transport shipped as its own package depends on the contract alone.\n */\nexport interface RealtimeChannelsConfig {\n    /**\n     * Retention rules, most specific first — the first match wins. Omitted or\n     * empty means no channel retains anything.\n     */\n    channels?: ChannelRetentionRule[];\n    /**\n     * How channel broadcast and presence reach other backend instances.\n     * Defaults to `{ type: \"memory\" }` — i.e. they don't.\n     */\n    bus?: ChannelBusSetting;\n}\n\n/**\n * Abstract realtime provider interface.\n * Handles real-time subscriptions and notifications for entity changes.\n */\nexport interface RealtimeProvider {\n    /**\n     * Subscribe to collection changes\n     */\n    subscribeToCollection(\n        subscriptionId: string,\n        config: CollectionSubscriptionConfig,\n        callback?: (rows: Record<string, unknown>[]) => void\n    ): void;\n\n    /**\n     * Subscribe to single entity changes\n     */\n    subscribeToOne(\n        subscriptionId: string,\n        config: SingleSubscriptionConfig,\n        callback?: (row: Record<string, unknown> | null) => void\n    ): void;\n\n    /**\n     * Unsubscribe from a subscription\n     */\n    unsubscribe(subscriptionId: string): void;\n\n    /**\n     * Notify all relevant subscribers of a entity update\n     */\n    notifyUpdate(\n        path: string,\n        id: string,\n        row: Record<string, unknown> | null,\n        databaseId?: string\n    ): Promise<void>;\n\n    /**\n     * Called when the HTTP server is ready and listening.\n     * Useful for providers that need the server address for callbacks.\n     */\n    onServerReady?(serverInfo: { port: number; hostname?: string }): void;\n\n    /**\n     * Gracefully shut down the realtime provider.\n     * Called during server shutdown to clean up resources.\n     */\n    destroy?(): Promise<void>;\n\n    /**\n     * Stop the internal LISTEN client (e.g., PostgreSQL LISTEN/NOTIFY).\n     * Called during graceful shutdown before closing database connections.\n     */\n    stopListening?(): Promise<void>;\n}\n\n// =============================================================================\n// COLLECTION REGISTRY INTERFACES\n// =============================================================================\n\n/**\n * Abstract collection registry interface.\n * Manages registration and lookup of entity collections.\n */\nexport interface CollectionRegistryInterface {\n    /**\n     * Register a collection\n     */\n    register(collection: CollectionConfig): void;\n\n    /**\n     * Get a collection by its path\n     */\n    getCollectionByPath(path: string): CollectionConfig | undefined;\n\n    /**\n     * Get all registered collections\n     */\n    getCollections(): CollectionConfig[];\n\n    /**\n     * Get the currently registered global callbacks, if any.\n     */\n    getGlobalCallbacks(): any | undefined;\n}\n\n// =============================================================================\n// DATA TRANSFORMER INTERFACES\n// =============================================================================\n\n/**\n * Abstract data transformer interface.\n * Handles serialization/deserialization between frontend and database formats.\n */\nexport interface DataTransformer {\n    /**\n     * Transform entity data for storage in the database\n     */\n    serializeToDatabase<M extends Record<string, unknown>>(\n        entity: M,\n        collection: CollectionConfig\n    ): Record<string, unknown>;\n\n    /**\n     * Transform database data back to entity format\n     */\n    deserializeFromDatabase<M extends Record<string, unknown>>(\n        data: Record<string, unknown>,\n        collection: CollectionConfig\n    ): Promise<M>;\n}\n\n// =============================================================================\n// DATABASE ADMIN — CAPABILITY-SPECIFIC INTERFACES (1.3)\n// =============================================================================\n\n/**\n * Administrative operations for SQL-based databases (PostgreSQL, MySQL, etc.).\n * Used by the SQL Editor, RLS Editor, and schema browser.\n *\n * @group Admin\n */\nexport interface SQLAdmin {\n    /**\n     * Execute raw SQL against the database.\n     */\n    executeSql(sql: string, options?: { database?: string; role?: string; params?: unknown[] }): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch the available databases on the server.\n     */\n    fetchAvailableDatabases?(): Promise<string[]>;\n\n    /**\n     * Fetch the available *native PostgreSQL* database roles (from `pg_roles`).\n     *\n     * These are connection-level roles — what the SQL editor can `SET ROLE` to,\n     * and what `SecurityRule.pgRoles` targets. They are NOT application roles;\n     * for those use {@link fetchApplicationRoles}.\n     */\n    fetchAvailableRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the *application-level* roles in use in this project.\n     *\n     * These are the strings stored on the users table's `roles` column and\n     * exposed to policies as `auth.roles()` — what `SecurityRule.roles`\n     * matches against. Distinct from {@link fetchAvailableRoles}; the two are\n     * not interchangeable.\n     */\n    fetchApplicationRoles?(): Promise<string[]>;\n\n    /**\n     * Fetch the current database name.\n     */\n    fetchCurrentDatabase?(): Promise<string | undefined>;\n}\n\n/**\n * Administrative operations for document-based databases (MongoDB, Firestore, etc.).\n * Used by future document administration tools.\n *\n * @group Admin\n */\nexport interface DocumentAdmin {\n    /**\n     * Execute an aggregation pipeline or equivalent query.\n     */\n    executeAggregate?(pipeline: Record<string, unknown>[]): Promise<Record<string, unknown>[]>;\n\n    /**\n     * Fetch statistics for a collection (document count, size, etc.).\n     */\n    fetchCollectionStats?(collectionName: string): Promise<{ count: number; sizeBytes?: number }>;\n}\n\n/**\n * Administrative operations for schema management.\n * Shared across SQL and document databases.\n *\n * @group Admin\n */\nexport interface SchemaAdmin {\n    /**\n     * Fetch database tables/collections not yet mapped to a Rebase collection.\n     */\n    fetchUnmappedTables?(mappedPaths?: string[]): Promise<string[]>;\n\n    /**\n     * Fetch column/field metadata for a single table/collection.\n     * The return type is generic — SQL backends return TableMetadata,\n     * document backends may return a different shape.\n     */\n    fetchTableMetadata?(tableName: string): Promise<unknown>;\n}\n\n/**\n * Metadata for a database branch.\n * @group Admin\n */\nexport interface BranchInfo {\n    /** Branch name (without prefix). */\n    name: string;\n    /** The database this branch was created from. */\n    parentDatabase: string;\n    /** When the branch was created. */\n    createdAt: Date;\n    /** Size in bytes, if available from the server. */\n    sizeBytes?: number;\n}\n\n/**\n * Administrative operations for database branching.\n * Allows creating isolated database copies for development/preview workflows.\n *\n * @group Admin\n */\nexport interface BranchAdmin {\n    /** Create a new branch (database copy) from the current or specified source database. */\n    createBranch(name: string, options?: { source?: string }): Promise<BranchInfo>;\n\n    /** Delete a branch database. Cannot delete the main/default database. */\n    deleteBranch(name: string): Promise<void>;\n\n    /** List all branches (databases that were created via branching). */\n    listBranches(): Promise<BranchInfo[]>;\n\n    /** Get info about a specific branch. */\n    getBranchInfo(name: string): Promise<BranchInfo | undefined>;\n}\n\n/**\n * Union type for all admin capabilities.\n * A backend may implement any combination of these interfaces.\n *\n * Use type guards (`isSQLAdmin`, `isDocumentAdmin`, `isSchemaAdmin`, `isBranchAdmin`)\n * to safely narrow the type before calling methods.\n *\n * @group Admin\n */\nexport type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin> & Partial<BranchAdmin>;\n\n/**\n * Type guard: does this admin support SQL operations?\n * @group Admin\n */\nexport function isSQLAdmin(admin: DatabaseAdmin | undefined): admin is SQLAdmin {\n    return !!admin && typeof (admin as SQLAdmin).executeSql === \"function\";\n}\n\n/**\n * Type guard: does this admin support document operations?\n * @group Admin\n */\nexport function isDocumentAdmin(admin: DatabaseAdmin | undefined): admin is DocumentAdmin {\n    return !!admin && (\n        typeof (admin as DocumentAdmin).executeAggregate === \"function\" ||\n        typeof (admin as DocumentAdmin).fetchCollectionStats === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support schema management?\n * @group Admin\n */\nexport function isSchemaAdmin(admin: DatabaseAdmin | undefined): admin is SchemaAdmin {\n    return !!admin && (\n        typeof (admin as SchemaAdmin).fetchUnmappedTables === \"function\" ||\n        typeof (admin as SchemaAdmin).fetchTableMetadata === \"function\"\n    );\n}\n\n/**\n * Type guard: does this admin support database branching?\n * @group Admin\n */\nexport function isBranchAdmin(admin: DatabaseAdmin | undefined): admin is BranchAdmin {\n    return !!admin && typeof (admin as BranchAdmin).createBranch === \"function\";\n}\n\n// =============================================================================\n// LIFECYCLE INTERFACES (1.4)\n// =============================================================================\n\n/**\n * Health check result returned by `healthCheck()`.\n * @group Lifecycle\n */\nexport interface HealthCheckResult {\n    /** Whether the backend is healthy and able to serve requests. */\n    healthy: boolean;\n    /** Round-trip latency to the database in milliseconds. */\n    latencyMs: number;\n    /** Optional details (e.g., pool stats, replication lag). */\n    details?: Record<string, unknown>;\n}\n\n/**\n * Lifecycle contract for backend components that hold resources\n * (database connections, WebSocket pools, timers, etc.).\n *\n * All methods are optional — simple backends (e.g., in-memory) can skip them.\n * @group Lifecycle\n */\nexport interface BackendLifecycle {\n    /**\n     * Initialize the backend: open connections, run migrations, seed data.\n     * Called once during startup. Idempotent.\n     */\n    initialize?(): Promise<void>;\n\n    /**\n     * Check whether the backend is healthy and reachable.\n     * Should be fast (< 1 s) and safe to call frequently.\n     */\n    healthCheck?(): Promise<HealthCheckResult>;\n\n    /**\n     * Gracefully shut down: close connections, flush buffers, cancel timers.\n     * After calling `destroy()`, no other methods should be called.\n     */\n    destroy?(): Promise<void>;\n}\n\n// =============================================================================\n// BACKEND FACTORY INTERFACES\n// =============================================================================\n\n/**\n * Configuration for creating a database backend\n */\nexport interface BackendConfig {\n    /**\n     * Type of database backend\n     */\n    type: string;\n\n    /**\n     * Database connection (implementation-specific)\n     */\n    connection: unknown;\n\n    /**\n     * Schema definition (implementation-specific, e.g., Drizzle schema for PostgreSQL)\n     */\n    schema?: unknown;\n}\n\n/**\n * A complete backend instance with all required services.\n *\n * Now includes optional lifecycle management and admin capabilities.\n */\nexport interface BackendInstance extends BackendLifecycle {\n    /**\n     * Entity repository for CRUD operations\n     */\n    entityRepository: DataRepository;\n\n    /**\n     * Realtime provider for subscriptions\n     */\n    realtimeProvider: RealtimeProvider;\n\n    /**\n     * Collection registry\n     */\n    collectionRegistry: CollectionRegistryInterface;\n\n    /**\n     * The underlying database connection\n     */\n    connection: DatabaseConnection;\n\n    /**\n     * Administrative operations (SQL, schema, documents).\n     * What's available depends on the backend type — use type guards\n     * (`isSQLAdmin`, `isSchemaAdmin`, etc.) to narrow.\n     */\n    admin?: DatabaseAdmin;\n}\n\n/**\n * Factory function type for creating backend instances\n */\nexport type BackendFactory<TConfig extends BackendConfig = BackendConfig> =\n    (config: TConfig) => BackendInstance;\n\n// =============================================================================\n// BACKEND BOOTSTRAPPER (1.2)\n// =============================================================================\n\n/**\n * A `BackendBootstrapper` encapsulates all driver-specific initialization logic.\n *\n * Instead of hard-coding Postgres setup into `initializeRebaseBackend()`,\n * each database backend provides its own bootstrapper that knows how to:\n * - Create the DataDriver from a config object\n * - Optionally initialize auth tables\n * - Optionally create a realtime service\n * - Mount driver-specific API routes\n *\n * The main `initializeRebaseBackend()` becomes a **coordinator** that iterates\n * registered bootstrappers, calls their hooks, and wires the results together.\n *\n * @group Backend\n *\n * @example\n * ```typescript\n * // Third-party MySQL bootstrapper\n * const mysqlBootstrapper: BackendBootstrapper = {\n *   type: \"mysql\",\n *   initializeDriver: async (config) => new MySQLDataDriver(config.connection),\n *   initializeRealtime: async (config) => new MySQLChangeStreamRealtime(config.connection),\n * };\n *\n * initializeRebaseBackend({\n *   ...config,\n *   bootstrappers: [postgresBootstrapper, mysqlBootstrapper]\n * });\n * ```\n */\nexport interface BackendBootstrapper {\n    /**\n     * Which driver type this bootstrapper handles.\n     * Must match the `type` field on the driver config object\n     * (e.g., `\"postgres\"`, `\"mongodb\"`, `\"mysql\"`).\n     */\n    type: string;\n\n    /**\n     * Unique identifier for this bootstrapper instance.\n     * Used to register the driver in the driver registry.\n     * Defaults to `type` if not set.\n     */\n    id?: string;\n\n    /**\n     * Whether this bootstrapper provides the default driver.\n     * When true, the coordinator uses this driver as the primary one.\n     */\n    isDefault?: boolean;\n\n    /**\n     * Run database migrations for this driver.\n     * Called by the coordinator after all drivers are initialized.\n     */\n    runMigrations?(config: unknown, driverResult: InitializedDriver): Promise<void>;\n\n    /**\n     * Create a DataDriver from the given config.\n     * This is the only **required** method.\n     */\n    initializeDriver(config: unknown): Promise<InitializedDriver>;\n\n    /**\n     * Initialize auth tables / services if this driver supports them.\n     * Return undefined if auth is not supported by this backend.\n     */\n    initializeAuth?(config: unknown, driverResult: InitializedDriver): Promise<BootstrappedAuth | undefined>;\n\n    /**\n     * Initialize history tables / services if this driver supports them.\n     * Return undefined if history is not supported by this backend.\n     */\n    initializeHistory?(config: HistoryConfig, driverResult: InitializedDriver): Promise<{ historyService: unknown } | undefined>;\n\n    /**\n     * Create a realtime provider for this driver.\n     * Return undefined if the driver does not support realtime.\n     */\n    initializeRealtime?(config: unknown, driverResult: InitializedDriver): Promise<RealtimeProvider | undefined>;\n\n    /**\n     * Mount any driver-specific HTTP routes (e.g., custom admin endpoints).\n     * Called after all drivers are initialized.\n     */\n    mountRoutes?(app: unknown, basePath: string, driverResult: InitializedDriver): void;\n\n    /**\n     * Return admin capabilities for this driver.\n     */\n    getAdmin?(driverResult: InitializedDriver): DatabaseAdmin | undefined;\n\n    /**\n     * Bring the database's collection tables up to date, additively.\n     *\n     * Optional because it is only meaningful for schema-ful drivers. A managed\n     * runtime boots a compiled project against a database it has never seen; auth\n     * tables are ensured on boot but collection tables were created by nothing,\n     * so every data request answered 500 on a missing relation. The CLI's `db\n     * push` cannot fill the gap — it needs Atlas, and the runtime image ships no\n     * CLI.\n     *\n     * Implementations MUST be additive-only: create missing tables, columns and\n     * enum types, and never drop, narrow or rewrite anything. This runs\n     * unattended against live customer data with nobody reading a diff, so the\n     * destructive half stays a deliberate migration.\n     */\n    ensureCollectionSchema?(\n        collections: unknown[],\n        driverResult: InitializedDriver,\n        log?: (message: string) => void\n    ): Promise<{ applied: number }>;\n\n    /**\n     * Initialize WebSocket server for realtime operations.\n     */\n    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import(\"../controllers/data_driver\").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeDriver()`.\n * @group Backend\n */\nexport interface InitializedDriver {\n    /** The DataDriver instance, ready for use. */\n    driver: import(\"../controllers/data_driver\").DataDriver;\n\n    /** The realtime service, if the driver created one during init. */\n    realtimeProvider?: RealtimeProvider;\n\n    /** A collection registry to register schema / tables into. */\n    collectionRegistry?: CollectionRegistryInterface;\n\n    /**\n     * Collections the driver derived from the live database schema.\n     *\n     * Set by drivers that introspect in `baas` mode; the server serves these\n     * instead of collections loaded from config files.\n     */\n    collections?: import(\"./collections\").CollectionConfig[];\n\n    /** The underlying database connection (for lifecycle management). */\n    connection?: DatabaseConnection;\n\n    /**\n     * Opaque handle that the bootstrapper can use in subsequent hooks\n     * (e.g., `initializeAuth`, `mountRoutes`) to access driver internals.\n     * Not used by the coordinator.\n     */\n    internals?: unknown;\n}\n\n/**\n * Result of `BackendBootstrapper.initializeAuth()`.\n * @group Backend\n */\nexport interface BootstrappedAuth {\n    /** User management service. */\n    userService: unknown;\n    /** Role management service (optional, roles are now simple strings). */\n    roleService?: unknown;\n    /** Email service (optional). */\n    emailService?: unknown;\n    /** Combined Auth Repository for unified token and user management. */\n    authRepository?: unknown;\n    /**\n     * Whether the auth schema in the database is one this runtime can serve.\n     *\n     * Folded into `healthCheck()` so a schema mismatch shows up as a degraded\n     * health response. Without it, a server whose auth is entirely broken still\n     * reports healthy — the database connection it probes is fine, and the\n     * mismatch is only discovered one failed login at a time.\n     */\n    schemaHealthCheck?(): Promise<AuthSchemaHealth>;\n}\n\n/**\n * Result of {@link BootstrappedAuth.schemaHealthCheck}.\n * @group Lifecycle\n */\nexport interface AuthSchemaHealth {\n    /** False when this runtime cannot be trusted to serve auth against this database. */\n    healthy: boolean;\n    /** Human-readable descriptions of each mismatch found. Empty when healthy. */\n    problems: string[];\n    /** Auth schema version recorded in the database, when it records one. */\n    databaseVersion?: number | null;\n    /** Auth schema version this runtime expects. */\n    runtimeVersion?: number;\n}\n"],"mappings":";;;;;;;;AA6hBA,SAAgB,WAAW,OAAqD;CAC5E,OAAO,CAAC,CAAC,SAAS,OAAQ,MAAmB,eAAe;AAChE"}

package/dist/backup-C3Bah7XZ.js

@@ -0,0 +1,163 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import { n as errorHandler, t as ApiError } from "./errors-BYAQztMf.js";
+import fs from "fs";
+import path from "path";
+import { Hono } from "hono";
+//#region src/backup/backup-common.ts
+/**
+* Storage-generic backup helpers used by the admin backup routes.
+*
+* These live in server (which owns {@link StorageController}) so the
+* admin API can list backups without depending on the Postgres driver —
+* `server` must not import from `server-postgres`. The `pg_dump`-side
+* copies of the tiny pure parsers live in `@rebasepro/server-postgres`;
+* keep the two in sync if the naming scheme ever changes.
+*/
+/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */
+function parseBackupDestination(out) {
+	const s3 = out.match(/^s3:\/\/([^/]+)\/?(.*)$/);
+	if (s3) return {
+		kind: "s3",
+		bucket: s3[1],
+		prefix: s3[2].replace(/\/+$/, "")
+	};
+	const gcs = out.match(/^gs:\/\/([^/]+)\/?(.*)$/);
+	if (gcs) return {
+		kind: "gcs",
+		bucket: gcs[1],
+		prefix: gcs[2].replace(/\/+$/, "")
+	};
+	return {
+		kind: "local",
+		path: out
+	};
+}
+/**
+* Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.
+* Returns `null` for names that don't match, so foreign objects are ignored.
+*/
+function parseBackupTimestamp(fileName) {
+	const match = (fileName.split("/").pop() ?? fileName).match(/-(\d{8})T(\d{6})Z\.dump$/);
+	if (!match) return null;
+	const [, ymd, hms] = match;
+	const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
+	const date = new Date(iso);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+/**
+* List the backups at a destination as {@link BackupInfo}, newest first.
+* Only `.dump` files are considered.
+*/
+async function listBackupObjects(dest, storage) {
+	if (dest.kind === "local") {
+		if (!fs.existsSync(dest.path)) return [];
+		const dir = fs.statSync(dest.path).isDirectory() ? dest.path : path.dirname(dest.path);
+		if (!fs.existsSync(dir)) return [];
+		return fs.readdirSync(dir).filter((f) => f.endsWith(".dump")).map((f) => {
+			const full = path.join(dir, f);
+			const st = fs.statSync(full);
+			const createdAt = parseBackupTimestamp(f) ?? st.mtime;
+			return {
+				key: full,
+				name: f,
+				sizeBytes: st.size,
+				createdAt: createdAt.toISOString(),
+				destinationKind: "local"
+			};
+		}).sort(byNewest);
+	}
+	if (!storage) return [];
+	return (await storage.listObjects(dest.prefix ? `${dest.prefix}/` : "", {
+		bucket: dest.bucket,
+		maxResults: 1e3
+	})).items.map((item) => item.fullPath).filter((key) => key.endsWith(".dump")).map((key) => {
+		const createdAt = parseBackupTimestamp(key);
+		return {
+			key,
+			name: key.split("/").pop() || key,
+			createdAt: createdAt ? createdAt.toISOString() : void 0,
+			destinationKind: dest.kind
+		};
+	}).sort(byNewest);
+}
+function byNewest(a, b) {
+	const ta = a.createdAt ? Date.parse(a.createdAt) : 0;
+	return (b.createdAt ? Date.parse(b.createdAt) : 0) - ta;
+}
+/** Read a single backup's bytes. Guards against path traversal for local. */
+async function readBackupBytes(dest, key, storage) {
+	if (dest.kind === "local") {
+		const dir = (fs.existsSync(dest.path) ? fs.statSync(dest.path) : null)?.isDirectory() ? dest.path : path.dirname(dest.path);
+		const resolvedDir = path.resolve(dir);
+		const resolved = path.resolve(key);
+		if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(".dump")) return null;
+		if (!fs.existsSync(resolved)) return null;
+		return {
+			bytes: new Uint8Array(fs.readFileSync(resolved)),
+			name: path.basename(resolved)
+		};
+	}
+	if (!storage) return null;
+	if (!key.endsWith(".dump")) return null;
+	const file = await storage.getObject(key, dest.bucket);
+	if (!file) return null;
+	return {
+		bytes: new Uint8Array(await file.arrayBuffer()),
+		name: key.split("/").pop() || key
+	};
+}
+//#endregion
+//#region src/backup/backup-routes.ts
+/**
+* Admin REST routes for the Backups panel.
+*
+* Routes (mounted under `/admin/backups`, admin-guarded by the caller):
+*   GET /            → list available backups
+*   GET /download    → download a backup's bytes (?key=…)
+*/
+function createBackupRoutes(config) {
+	const router = new Hono();
+	router.onError(errorHandler);
+	router.get("/", async (c) => {
+		const dest = config.getDestination();
+		if (!dest) return c.json({
+			backups: [],
+			destinationKind: "local",
+			configured: false
+		});
+		const backups = await listBackupObjects(dest, config.storage);
+		return c.json({
+			backups,
+			destinationKind: dest.kind,
+			configured: true
+		});
+	});
+	router.get("/download", async (c) => {
+		const dest = config.getDestination();
+		if (!dest) throw ApiError.badRequest("Backups are not configured (set BACKUP_DESTINATION).");
+		const key = c.req.query("key");
+		if (!key) throw ApiError.badRequest("Missing 'key' query parameter.");
+		const result = await readBackupBytes(dest, key, config.storage);
+		if (!result) throw ApiError.notFound(`Backup not found: ${key}`);
+		c.header("Content-Type", "application/octet-stream");
+		c.header("Content-Disposition", `attachment; filename="${result.name}"`);
+		return c.body(result.bytes);
+	});
+	return router;
+}
+//#endregion
+//#region src/backup/index.ts
+var backup_exports = /* @__PURE__ */ __exportAll({
+	createBackupRoutes: () => createBackupRoutes,
+	listBackupObjects: () => listBackupObjects,
+	parseBackupDestination: () => parseBackupDestination,
+	parseBackupTimestamp: () => parseBackupTimestamp,
+	readBackupBytes: () => readBackupBytes
+});
+//#endregion
+export { parseBackupTimestamp as a, parseBackupDestination as i, createBackupRoutes as n, readBackupBytes as o, listBackupObjects as r, backup_exports as t };
+
+//# sourceMappingURL=backup-C3Bah7XZ.js.map

package/dist/backup-C3Bah7XZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backup-C3Bah7XZ.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * Only `.dump` files are considered.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\"\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only .dump files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(\".dump\")) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!key.endsWith(\".dump\")) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;AAMA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;GACrB;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;EAC1B;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,SAAS,SAAS,OAAO,GAC1E,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,IAAI,SAAS,OAAO,GAAG,OAAO;CACnC,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;ACrGA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}

package/dist/boot/boot.d.ts

@@ -57,3 +57,23 @@ export declare function bootFromBundle(options?: BootOptions): Promise<BootedRun
  * bug and the trace is the point.
  */
 export declare function runFromBundle(options?: BootOptions): Promise<BootedRuntime>;
+/**
+ * Bring the database's collection tables up to date before serving.
+ *
+ * Delegates to whichever driver bootstrapped the default data source; a driver
+ * without `ensureCollectionSchema` (a schemaless one, or an older build) skips
+ * rather than failing, which is why this cannot break an existing deployment.
+ *
+ * Every path out of here says why, at info or louder. Guaranteeing the tables
+ * exist is this function's entire job, so "it declined, and said nothing" is the
+ * one outcome it must never produce: a deployment that skips comes up answering
+ * sign-in and 500ing every `/api/data/*` route, and the operator's only evidence
+ * is what these lines print. Silence here has already sent one investigation
+ * chasing a stale runtime image that was not stale.
+ *
+ * Failure is fatal on purpose. Booting anyway would produce exactly the state
+ * this exists to prevent — an app that answers sign-in and 500s every data
+ * request — and a crash-looping pod with the DDL error in its logs is a far
+ * better signal than a running one that silently cannot serve.
+ */
+export declare function ensureCollectionSchema(bundle: LoadedBundle, dataSources: InitializedDataSource[], env: RebaseBootEnv): Promise<void>;

package/dist/boot/fetch-bundle.d.ts

@@ -0,0 +1,43 @@
+/** Where the runtime is told to fetch its bundle from. */
+export declare const BUNDLE_URL_ENV = "REBASE_BUNDLE_URL";
+/** Bearer token for that fetch. Does not expire — see the module note. */
+export declare const BUNDLE_TOKEN_ENV = "REBASE_BUNDLE_TOKEN";
+export interface FetchBundleOptions {
+    url: string;
+    token?: string;
+    /** Where to unpack. Defaults to a fresh directory under the OS temp dir. */
+    destination?: string;
+    /** Injected for tests. */
+    fetchImpl?: typeof fetch;
+    /** Injected for tests. */
+    extract?: (tarball: string, destination: string) => Promise<void>;
+    /** How long the download may take before it is abandoned. */
+    timeoutMs?: number;
+}
+/**
+ * Whether this process should fetch its bundle rather than read one from disk.
+ *
+ * An explicit `REBASE_BUNDLE` — a path — always wins. A platform that mounted a
+ * bundle AND set a URL means somebody is mid-migration between the two, and the
+ * local copy is the one that is definitely there.
+ */
+export declare function shouldFetchBundle(env?: NodeJS.ProcessEnv): boolean;
+/**
+ * Download and unpack a bundle, returning the directory it landed in.
+ *
+ * Downloads to a file rather than streaming into `tar`, deliberately. A stream
+ * that dies mid-transfer leaves `tar` having successfully extracted a prefix of
+ * the archive and exiting 0 — the half-unpacked bundle this module exists to
+ * refuse. Writing the whole tarball first means a truncated download is caught
+ * by `tar` as a corrupt archive, which is an error.
+ */
+export declare function fetchBundle(options: FetchBundleOptions): Promise<string>;
+/**
+ * Find the bundle root inside an unpacked directory.
+ *
+ * Tolerates one level of nesting, because whether a tarball has a top-level
+ * directory depends on how it was created — `tar czf x.tgz dist-bundle` and
+ * `tar czf x.tgz -C dist-bundle .` produce different shapes from the same
+ * files, and both are things a build script does.
+ */
+export declare function bundleRootIn(directory: string): string | null;

package/dist/contract-routes-Dj8i5AiM.js

@@ -0,0 +1,264 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import "./src-_qQ3RNCK.js";
+import { t as logger } from "./logger-BYU66ENZ.js";
+import { Hono } from "hono";
+//#region ../types/src/types/project_manifest.ts
+/** Header carrying the schema version an SDK was generated from. */
+var SCHEMA_VERSION_HEADER = "x-rebase-schema";
+//#endregion
+//#region ../types/src/types/collection_contract.ts
+/** Depth limit for the walk — deep enough for real configs, finite for cyclic ones. */
+var MAX_DEPTH = 64;
+/**
+* Resolve whatever a `target` thunk returns down to a collection.
+*
+* A target may be the collection, a module namespace (when the authoring file
+* used `import * as`), or a default-export wrapper. All three appear in real
+* projects, and the SDK generator already unwraps them the same way.
+*/
+function unwrapTarget(value) {
+	if (!value || typeof value !== "object") return void 0;
+	const candidate = value;
+	if (candidate.default || candidate.__esModule) {
+		const inner = candidate.default;
+		if (inner && typeof inner === "object") return inner;
+	}
+	if (candidate.properties) return value;
+}
+/** The identity a serialized reference uses. Slug first — it is the routing key. */
+function refFor(collection) {
+	if (!collection) return void 0;
+	const withPath = collection;
+	return collection.slug || withPath.path || collection.name;
+}
+function toSerializable(value, seen, depth, state, key) {
+	if (depth > MAX_DEPTH) {
+		state.truncations++;
+		return;
+	}
+	if (typeof value === "function") {
+		if (key === "target") try {
+			const ref = refFor(unwrapTarget(value()));
+			return ref ? { __collectionRef: ref } : void 0;
+		} catch {
+			return;
+		}
+		return;
+	}
+	if (value === null || typeof value !== "object") return value;
+	if (value instanceof Date) return value.toISOString();
+	if (value instanceof RegExp) return value.source;
+	if (seen.has(value)) {
+		state.truncations++;
+		return;
+	}
+	const cached = state.memo.get(value);
+	if (cached !== void 0) return cached;
+	seen.add(value);
+	const truncationsBefore = state.truncations;
+	const memoize = (result) => {
+		if (result !== void 0 && state.truncations === truncationsBefore) state.memo.set(value, result);
+		return result;
+	};
+	try {
+		if (Array.isArray(value)) {
+			const items = value.map((item) => toSerializable(item, seen, depth + 1, state)).filter((item) => item !== void 0);
+			return memoize(value.length > 0 && items.length === 0 ? void 0 : items);
+		}
+		if ("$$typeof" in value) return void 0;
+		const entries = Object.entries(value);
+		const out = {};
+		for (const [k, v] of entries) {
+			const converted = toSerializable(v, seen, depth + 1, state, k);
+			if (converted !== void 0) out[k] = converted;
+		}
+		if (entries.length > 0 && Object.keys(out).length === 0) return void 0;
+		return memoize(out);
+	} finally {
+		seen.delete(value);
+	}
+}
+/**
+* Serialize collections for transport over the contract endpoint.
+*
+* Sorted by slug so the output — and therefore the schema hash computed from it
+* — does not depend on filesystem ordering.
+*/
+function serializeCollections(collections) {
+	return [...collections].sort((a, b) => String(a.slug ?? "").localeCompare(String(b.slug ?? ""))).map((collection) => toSerializable(withoutAdminBlock(collection), /* @__PURE__ */ new WeakSet(), 0, {
+		memo: /* @__PURE__ */ new WeakMap(),
+		truncations: 0
+	})).filter((c) => c !== void 0);
+}
+/**
+* Drop the admin block before the walk.
+*
+* Nothing downstream of serialization is an admin panel. The contract endpoint
+* feeds remote SDK generation, and `rebase build` writes the result into a bundle
+* manifest that only the backend runtime reads. The block would survive the walk
+* as a husk anyway — its React elements and component functions are dropped
+* individually — and that husk has two costs worth avoiding: it puts every custom
+* component's *file path* on an endpoint whose job is to describe data shapes, and
+* it grows a payload that is fetched and cached per project.
+*
+* Removing it here rather than at each call site means one chokepoint, so a future
+* consumer of `serializeCollections` cannot forget.
+*
+* Child collections carry their own block, so this recurses — stripping only the
+* top level was the mistake `stripNonClientFields` in the contract routes already
+* had to fix once for security rules.
+*/
+function withoutAdminBlock(collection) {
+	const { admin: _admin, ...rest } = collection;
+	const nested = rest;
+	if (Array.isArray(nested.subcollections)) nested.subcollections = nested.subcollections.map((child) => withoutAdminBlock(child));
+	return rest;
+}
+//#endregion
+//#region ../types/src/types/schema_version.ts
+/**
+* The schema version stamp.
+*
+* One function, used in three places that must agree or the whole drift-detection
+* story is noise: `rebase build` writes it into a bundle manifest, the runtime
+* serves it from the contract endpoint, and a generated SDK records the value it
+* was built from. If any two of those computed it differently, every client would
+* look permanently out of date.
+*
+* It covers **collections only** — the client's contract is the shape of the
+* data, so editing a hook or a server function must not invalidate every SDK in
+* every repository. That is a deliberate narrowing, not an oversight.
+*/
+/** Stable stringify: object keys sorted at every level, so key order cannot alter the hash. */
+function canonicalize(value) {
+	if (value === null || typeof value !== "object") return JSON.stringify(value) ?? "null";
+	if (Array.isArray(value)) return `[${value.map(canonicalize).join(",")}]`;
+	return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(",")}}`;
+}
+/**
+* Reduce a collection to the parts a generated client is actually built from.
+*
+* The version answers one question — "is this SDK stale?" — so it must change
+* exactly when the generated types could change, and never otherwise. Hashing a
+* whole collection fails both halves of that:
+*
+* - Security rules, callbacks, icons, groups and UI settings do not appear in a
+*   generated client, so including them reports perfectly current SDKs as stale.
+* - Worse, they are not stable *inputs*. The runtime applies default security
+*   rules when it loads collections, so the same source hashed before and after
+*   loading produced two different answers — a build-time stamp that could never
+*   match the server that served it.
+*
+* Codegen reads the slug (for the `Database` key and type names), the properties,
+* and the relations. That is the projection.
+*/
+function projectForCodegen(collection) {
+	const source = collection;
+	return {
+		slug: collection.slug ?? source.path,
+		properties: collection.properties,
+		relations: source.relations,
+		engine: source.engine,
+		dataSource: source.dataSource,
+		subcollections: source.subcollections?.map(projectForCodegen)
+	};
+}
+/**
+* Compute the canonical string a schema version hashes.
+*
+* Exposed separately so the hashing itself can differ by environment: Node has
+* `crypto`, and callers without it can still compare canonical forms directly.
+*/
+function canonicalSchemaPayload(collections) {
+	return canonicalize(serializeCollections(collections).map((collection) => projectForCodegen(collection)));
+}
+/**
+* A short, non-cryptographic digest of the canonical payload.
+*
+* FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a
+* security boundary: nothing trusts a schema version to prove anything, it only
+* answers "is this the same schema as before". A hand-rolled hash keeps this
+* module free of `node:crypto`, so the identical function runs in the browser,
+* in the CLI, and in the runtime — which is the property that actually matters.
+*/
+function computeSchemaVersion(collections) {
+	const payload = canonicalSchemaPayload(collections);
+	let h1 = 2166136261;
+	let h2 = 16777619;
+	for (let i = 0; i < payload.length; i++) {
+		const code = payload.charCodeAt(i);
+		h1 ^= code;
+		h1 = h1 + ((h1 << 1) + (h1 << 4) + (h1 << 7) + (h1 << 8) + (h1 << 24)) >>> 0;
+		h2 ^= code + i;
+		h2 = h2 + ((h2 << 1) + (h2 << 5) + (h2 << 9) + (h2 << 15) + (h2 << 24)) >>> 0;
+	}
+	const hex = (n) => n.toString(16).padStart(8, "0");
+	return `v1:${hex(h1)}${hex(h2)}`;
+}
+//#endregion
+//#region src/api/contract-routes.ts
+var contract_routes_exports = /* @__PURE__ */ __exportAll({ createContractRoutes: () => createContractRoutes });
+/**
+* Strip everything a client does not need from a serialized collection.
+*
+* The generator reads the slug, the properties and the relations. It never reads
+* a security rule — but `securityRules` carries the raw SQL of every RLS
+* predicate guarding the project, which is a description of the authorization
+* model rather than of the data shape. Publishing it to anyone who can generate
+* an SDK gives away more than the endpoint is for, so it is removed here rather
+* than trusted not to matter.
+*/
+function stripNonClientFields(collection) {
+	if (!collection || typeof collection !== "object") return collection;
+	const { securityRules: _securityRules, callbacks: _callbacks, ...rest } = collection;
+	if (Array.isArray(rest.subcollections)) rest.subcollections = rest.subcollections.map(stripNonClientFields);
+	return rest;
+}
+function createContractRoutes(config) {
+	const router = new Hono();
+	let cachedVersion;
+	const schemaVersionOf = (collections) => {
+		if (config.schemaVersion) return config.schemaVersion;
+		if (cachedVersion === void 0) cachedVersion = computeSchemaVersion(collections);
+		return cachedVersion;
+	};
+	router.get("/contract", (c) => {
+		const collections = config.collectionRegistry.getRawCollections();
+		const serialized = serializeCollections(collections).map(stripNonClientFields);
+		const schemaVersion = schemaVersionOf(collections);
+		const contract = {
+			schemaVersion,
+			runtime: {
+				version: config.runtimeVersion ?? "unknown",
+				contract: 1
+			},
+			collections: serialized,
+			collectionSlugs: collections.map((collection) => collection.slug).filter((slug) => Boolean(slug)).sort(),
+			generatedAt: (/* @__PURE__ */ new Date()).toISOString()
+		};
+		c.header(SCHEMA_VERSION_HEADER, schemaVersion);
+		return c.json(contract);
+	});
+	/**
+	* Cheap drift check.
+	*
+	* Deliberately unauthenticated and deliberately tiny: it returns a version
+	* string and nothing else. A CI job that only wants to know whether its
+	* generated SDK is stale should not need admin credentials, and a version
+	* stamp reveals nothing about the schema it stands for.
+	*/
+	router.get("/schema-version", (c) => {
+		const schemaVersion = schemaVersionOf(config.collectionRegistry.getRawCollections());
+		c.header(SCHEMA_VERSION_HEADER, schemaVersion);
+		return c.json({ schemaVersion });
+	});
+	logger.debug("Contract routes mounted");
+	return router;
+}
+//#endregion
+export { createContractRoutes as n, contract_routes_exports as t };
+
+//# sourceMappingURL=contract-routes-Dj8i5AiM.js.map