@rebasepro/server 0.13.1-canary.gef9608c → 0.14.0

package/dist/function-loader-DDS1v7YX.js

@@ -0,0 +1,139 @@
+import { createRequire as __createRequire } from "module";
+import "process";
+__createRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import { t as logger } from "./logger-DfvF_8r-.js";
+import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
+import * as fs$1 from "fs";
+import * as path$1 from "path";
+import { pathToFileURL } from "url";
+//#region src/functions/function-loader.ts
+var function_loader_exports = /* @__PURE__ */ __exportAll({
+	loadFunctionsFromDirectory: () => loadFunctionsFromDirectory,
+	loadFunctionsWithDiagnostics: () => loadFunctionsWithDiagnostics
+});
+/**
+* Extensions the bundler compiles (or a developer might reasonably write) that
+* this loader cannot import. `rebase build` globs `functions/**\/*.ts`, so the
+* build's idea of "a function file" is strictly wider than the runtime's — the
+* worst direction for a mismatch to go. Anything listed here is reported as a
+* problem instead of vanishing; non-code files (`.md`, `.json`, `.txt`) stay
+* silent, because a README next to your functions is not a mistake.
+*/
+var UNSUPPORTED_CODE_EXTENSIONS = [
+	".mts",
+	".cts",
+	".tsx",
+	".jsx",
+	".mjs",
+	".cjs"
+];
+/**
+* Auto-discover Hono route files from a directory.
+*
+* Each file should default-export a Hono app (or router).
+* The filename (without extension) becomes the mount path:
+*   `functions/send-invoice.ts` → mounted at `/send-invoice`
+*
+* This mirrors how `loadCollectionsFromDirectory` works for collections.
+*
+* Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the
+* caller also needs to report what did not.
+*/
+async function loadFunctionsFromDirectory(directory, importModule = nativeDynamicImport) {
+	return (await loadFunctionsWithDiagnostics(directory, importModule)).functions;
+}
+/**
+* {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.
+*
+* Never throws: a single malformed function must not crash server boot. The
+* caller decides what to do with `problems` — `init.ts` mounts the router
+* regardless and surfaces the count on the listing endpoint.
+*/
+async function loadFunctionsWithDiagnostics(directory, importModule = nativeDynamicImport) {
+	const functions = [];
+	const problems = [];
+	if (!fs$1.existsSync(directory)) return {
+		functions,
+		problems
+	};
+	const entries = fs$1.readdirSync(directory, { withFileTypes: true });
+	for (const entry of entries) {
+		const file = entry.name;
+		if (entry.isDirectory()) {
+			if (file.startsWith(".") || file === "node_modules") continue;
+			logger.warn(`[functions] ${file}/: subdirectory ignored. Functions are loaded from the top level of ${directory} only, so nothing under ${file}/ is served. Move the file up (or flatten the name: \`admin/users.ts\` → \`admin-users.ts\`).`);
+			problems.push(`${file}/ (subdirectory — functions are not loaded recursively)`);
+			continue;
+		}
+		const extension = path$1.extname(file);
+		if (!file.startsWith(".") && !file.includes(".test.") && UNSUPPORTED_CODE_EXTENSIONS.includes(extension)) {
+			logger.warn(`[functions] ${file}: ${extension} files are not loaded. Rename it to .ts (or .js) to serve it.`);
+			problems.push(`${file} (unsupported extension ${extension})`);
+			continue;
+		}
+		if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.startsWith(".") && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") {
+			const filePath = path$1.join(directory, file);
+			try {
+				const fileUrl = pathToFileURL(filePath).href;
+				const exported = (await importModule(fileUrl)).default;
+				if (!exported) {
+					logger.warn(`[functions] ${file}: no default export. Skipping.`);
+					problems.push(`${file} (no default export)`);
+					continue;
+				}
+				if (isHonoLike(exported)) {
+					const name = path$1.basename(file, path$1.extname(file));
+					functions.push({
+						name,
+						app: exported
+					});
+					logger.debug(`⚡ Loaded function route: ${name}`);
+					continue;
+				}
+				if (typeof exported === "function") {
+					const result = exported();
+					if (isHonoLike(result)) {
+						const name = path$1.basename(file, path$1.extname(file));
+						functions.push({
+							name,
+							app: result
+						});
+						logger.debug(`⚡ Loaded function route: ${name}`);
+						continue;
+					}
+				}
+				const exportType = typeof exported;
+				const keys = exported && typeof exported === "object" ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(", ") : "N/A";
+				logger.warn(`[functions] ${file}: default export is not a Hono app or factory. Skipping.\n  export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : ""}\n  prototype methods: ${keys}\n  Hint: ensure the function exports a Hono app created with the same hono version as the server.
+  Author with \`defineFunction(...)\` from @rebasepro/server for a typed, checked contract.
+  The loader checks for .fetch() and .routes — any Hono-compatible app will work.`);
+				problems.push(`${file} (not a Hono app or factory)`);
+			} catch (err) {
+				const message = err instanceof Error ? err.message : String(err);
+				logger.error(`[functions] Failed to load ${file}: ${message}`);
+				problems.push(`${file} (threw: ${message})`);
+			}
+		}
+	}
+	if (problems.length > 0) logger.warn(`[functions] ${problems.length} function file(s) were skipped and will NOT be served:\n` + problems.map((p) => `  - ${p}`).join("\n") + "\n  Fix these or author them with `defineFunction(...)` for a typed, compile-checked contract.");
+	return {
+		functions,
+		problems
+	};
+}
+/**
+* Duck-type check for Hono apps.
+* We avoid `instanceof Hono` because different Hono versions
+* installed in the user's project vs. our dependencies will
+* not share the same prototype, causing false negatives.
+*/
+function isHonoLike(obj) {
+	if (!obj || typeof obj !== "object") return false;
+	const record = obj;
+	return typeof record.fetch === "function" && Array.isArray(record.routes);
+}
+//#endregion
+export { loadFunctionsFromDirectory as n, function_loader_exports as t };
+
+//# sourceMappingURL=function-loader-DDS1v7YX.js.map

package/dist/function-loader-DDS1v7YX.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-loader-DDS1v7YX.js","names":[],"sources":["../src/functions/function-loader.ts"],"sourcesContent":["import * as fs from \"fs\";\nimport * as path from \"path\";\nimport { pathToFileURL } from \"url\";\nimport { Hono } from \"hono\";\nimport { logger } from \"../utils/logger.js\";\nimport { nativeDynamicImport, type ModuleImporter } from \"../utils/dynamic-import.js\";\n\nexport interface LoadedFunction {\n    /** Endpoint name derived from filename (e.g., \"send-invoice\") */\n    name: string;\n    /** The Hono sub-app to mount */\n    app: Hono<import(\"hono\").Env>;\n}\n\n/** What a directory of function files produced: what mounted, and what did not. */\nexport interface LoadedFunctions {\n    /** The functions that will be served. */\n    functions: LoadedFunction[];\n    /**\n     * One entry per file the loader saw and did **not** mount, each already\n     * phrased as `<name> (<reason>)`. Returned rather than only logged so the\n     * running server can say what is missing — a boot log line is not reachable\n     * from `GET /api/functions`.\n     */\n    problems: string[];\n}\n\n/**\n * Extensions the bundler compiles (or a developer might reasonably write) that\n * this loader cannot import. `rebase build` globs `functions/**\\/*.ts`, so the\n * build's idea of \"a function file\" is strictly wider than the runtime's — the\n * worst direction for a mismatch to go. Anything listed here is reported as a\n * problem instead of vanishing; non-code files (`.md`, `.json`, `.txt`) stay\n * silent, because a README next to your functions is not a mistake.\n */\nconst UNSUPPORTED_CODE_EXTENSIONS = [\".mts\", \".cts\", \".tsx\", \".jsx\", \".mjs\", \".cjs\"];\n\n/**\n * Auto-discover Hono route files from a directory.\n *\n * Each file should default-export a Hono app (or router).\n * The filename (without extension) becomes the mount path:\n *   `functions/send-invoice.ts` → mounted at `/send-invoice`\n *\n * This mirrors how `loadCollectionsFromDirectory` works for collections.\n *\n * Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the\n * caller also needs to report what did not.\n */\nexport async function loadFunctionsFromDirectory(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunction[]> {\n    return (await loadFunctionsWithDiagnostics(directory, importModule)).functions;\n}\n\n/**\n * {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.\n *\n * Never throws: a single malformed function must not crash server boot. The\n * caller decides what to do with `problems` — `init.ts` mounts the router\n * regardless and surfaces the count on the listing endpoint.\n */\nexport async function loadFunctionsWithDiagnostics(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunctions> {\n    const functions: LoadedFunction[] = [];\n    // Aggregate problem files so a broken function surfaces as one loud\n    // summary line, not just a warning buried per-file. We still don't throw:\n    // a single malformed function must not crash server boot.\n    const problems: string[] = [];\n\n    if (!fs.existsSync(directory)) {\n        return { functions, problems };\n    }\n\n    // `withFileTypes` so a directory entry is a *reported* skip rather than a\n    // filter miss. `readdirSync(dir)` returned bare names, and a subdirectory\n    // simply failed the `.ts`/`.js` test — so `functions/admin/users.ts` was\n    // compiled by `rebase build`, shipped in the bundle, and then dropped at\n    // boot without a single log line.\n    const entries = fs.readdirSync(directory, { withFileTypes: true });\n    for (const entry of entries) {\n        const file = entry.name;\n\n        if (entry.isDirectory()) {\n            // Dot-directories are tooling (`.git`, `.turbo`), not intent.\n            if (file.startsWith(\".\") || file === \"node_modules\") continue;\n            logger.warn(\n                `[functions] ${file}/: subdirectory ignored. Functions are loaded from the top level of ` +\n                `${directory} only, so nothing under ${file}/ is served. Move the file up (or flatten the ` +\n                \"name: `admin/users.ts` → `admin-users.ts`).\"\n            );\n            problems.push(`${file}/ (subdirectory — functions are not loaded recursively)`);\n            continue;\n        }\n\n        const extension = path.extname(file);\n        if (\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            UNSUPPORTED_CODE_EXTENSIONS.includes(extension)\n        ) {\n            logger.warn(\n                `[functions] ${file}: ${extension} files are not loaded. Rename it to .ts (or .js) to serve it.`\n            );\n            problems.push(`${file} (unsupported extension ${extension})`);\n            continue;\n        }\n\n        if (\n            (file.endsWith(\".ts\") || file.endsWith(\".js\")) &&\n            // Dotfiles: notably macOS bsdtar AppleDouble sidecars (`._foo.ts`),\n            // binary blobs that cannot be imported.\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            !file.endsWith(\".d.ts\") &&\n            file !== \"index.ts\" &&\n            file !== \"index.js\"\n        ) {\n            const filePath = path.join(directory, file);\n            try {\n                const fileUrl = pathToFileURL(filePath).href;\n\n                const mod = await importModule(fileUrl);\n\n                const exported = mod.default;\n\n                if (!exported) {\n                    logger.warn(`[functions] ${file}: no default export. Skipping.`);\n                    problems.push(`${file} (no default export)`);\n                    continue;\n                }\n\n                // Accept a Hono instance — use duck-typing to handle different\n                // Hono versions which may not share the same prototype.\n                if (isHonoLike(exported)) {\n                    const name = path.basename(file, path.extname(file));\n                    functions.push({ name,\napp: exported as Hono });\n                    logger.debug(`⚡ Loaded function route: ${name}`);\n                    continue;\n                }\n\n                // Also accept a factory function that returns a Hono instance\n                if (typeof exported === \"function\") {\n                    const result = exported();\n                    if (isHonoLike(result)) {\n                        const name = path.basename(file, path.extname(file));\n                        functions.push({ name,\napp: result as Hono });\n                        logger.debug(`⚡ Loaded function route: ${name}`);\n                        continue;\n                    }\n                }\n\n                // Provide actionable diagnostics\n                const exportType = typeof exported;\n                const keys = exported && typeof exported === \"object\"\n                    ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(\", \")\n                    : \"N/A\";\n                logger.warn(\n                    `[functions] ${file}: default export is not a Hono app or factory. Skipping.\\n` +\n                    `  export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : \"\"}\\n` +\n                    `  prototype methods: ${keys}\\n` +\n                    \"  Hint: ensure the function exports a Hono app created with the same hono version as the server.\\n\" +\n                    \"  Author with `defineFunction(...)` from @rebasepro/server for a typed, checked contract.\\n\" +\n                    \"  The loader checks for .fetch() and .routes — any Hono-compatible app will work.\"\n                );\n                problems.push(`${file} (not a Hono app or factory)`);\n            } catch (err: unknown) {\n                const message =\n                    err instanceof Error ? err.message : String(err);\n                logger.error(`[functions] Failed to load ${file}: ${message}`);\n                problems.push(`${file} (threw: ${message})`);\n            }\n        }\n    }\n\n    if (problems.length > 0) {\n        logger.warn(\n            `[functions] ${problems.length} function file(s) were skipped and will NOT be served:\\n` +\n            problems.map((p) => `  - ${p}`).join(\"\\n\") + \"\\n\" +\n            \"  Fix these or author them with `defineFunction(...)` for a typed, compile-checked contract.\"\n        );\n    }\n\n    return { functions, problems };\n}\n\n/**\n * Duck-type check for Hono apps.\n * We avoid `instanceof Hono` because different Hono versions\n * installed in the user's project vs. our dependencies will\n * not share the same prototype, causing false negatives.\n */\nfunction isHonoLike(obj: unknown): boolean {\n    if (!obj || typeof obj !== \"object\") return false;\n    // Hono instances always have .fetch() and .routes\n    const record = obj as Record<string, unknown>;\n    return (\n        typeof record.fetch === \"function\" &&\n        Array.isArray(record.routes)\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAM,8BAA8B;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AAAM;;;;;;;;;;;;;AAcnF,eAAsB,2BAClB,WACA,eAA+B,qBACN;CACzB,QAAQ,MAAM,6BAA6B,WAAW,YAAY,EAAA,CAAG;AACzE;;;;;;;;AASA,eAAsB,6BAClB,WACA,eAA+B,qBACP;CACxB,MAAM,YAA8B,CAAC;CAIrC,MAAM,WAAqB,CAAC;CAE5B,IAAI,CAAC,KAAG,WAAW,SAAS,GACxB,OAAO;EAAE;EAAW;CAAS;CAQjC,MAAM,UAAU,KAAG,YAAY,WAAW,EAAE,eAAe,KAAK,CAAC;CACjE,KAAK,MAAM,SAAS,SAAS;EACzB,MAAM,OAAO,MAAM;EAEnB,IAAI,MAAM,YAAY,GAAG;GAErB,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,gBAAgB;GACrD,OAAO,KACH,eAAe,KAAK,sEACjB,UAAU,0BAA0B,KAAK,8FAEhD;GACA,SAAS,KAAK,GAAG,KAAK,wDAAwD;GAC9E;EACJ;EAEA,MAAM,YAAY,OAAK,QAAQ,IAAI;EACnC,IACI,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,4BAA4B,SAAS,SAAS,GAChD;GACE,OAAO,KACH,eAAe,KAAK,IAAI,UAAU,8DACtC;GACA,SAAS,KAAK,GAAG,KAAK,0BAA0B,UAAU,EAAE;GAC5D;EACJ;EAEA,KACK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK,MAG5C,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,CAAC,KAAK,SAAS,OAAO,KACtB,SAAS,cACT,SAAS,YACX;GACE,MAAM,WAAW,OAAK,KAAK,WAAW,IAAI;GAC1C,IAAI;IACA,MAAM,UAAU,cAAc,QAAQ,CAAC,CAAC;IAIxC,MAAM,YAAW,MAFC,aAAa,OAAO,EAAA,CAEjB;IAErB,IAAI,CAAC,UAAU;KACX,OAAO,KAAK,eAAe,KAAK,+BAA+B;KAC/D,SAAS,KAAK,GAAG,KAAK,qBAAqB;KAC3C;IACJ;IAIA,IAAI,WAAW,QAAQ,GAAG;KACtB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;KACnD,UAAU,KAAK;MAAE;MACrC,KAAK;KAAiB,CAAC;KACH,OAAO,MAAM,4BAA4B,MAAM;KAC/C;IACJ;IAGA,IAAI,OAAO,aAAa,YAAY;KAChC,MAAM,SAAS,SAAS;KACxB,IAAI,WAAW,MAAM,GAAG;MACpB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;MACnD,UAAU,KAAK;OAAE;OACzC,KAAK;MAAe,CAAC;MACG,OAAO,MAAM,4BAA4B,MAAM;MAC/C;KACJ;IACJ;IAGA,MAAM,aAAa,OAAO;IAC1B,MAAM,OAAO,YAAY,OAAO,aAAa,WACvC,OAAO,oBAAoB,OAAO,eAAe,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,IAClF;IACN,OAAO,KACH,eAAe,KAAK,2EACF,aAAa,UAAU,aAAa,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,GAAG,yBAC5E,KAAK;;kFAIjC;IACA,SAAS,KAAK,GAAG,KAAK,6BAA6B;GACvD,SAAS,KAAc;IACnB,MAAM,UACF,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IACnD,OAAO,MAAM,8BAA8B,KAAK,IAAI,SAAS;IAC7D,SAAS,KAAK,GAAG,KAAK,WAAW,QAAQ,EAAE;GAC/C;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAClB,OAAO,KACH,eAAe,SAAS,OAAO,4DAC/B,SAAS,KAAK,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,gGAEjD;CAGJ,OAAO;EAAE;EAAW;CAAS;AACjC;;;;;;;AAQA,SAAS,WAAW,KAAuB;CACvC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAE5C,MAAM,SAAS;CACf,OACI,OAAO,OAAO,UAAU,cACxB,MAAM,QAAQ,OAAO,MAAM;AAEnC"}

package/dist/{function-routes-C0cLIy3N.js → function-routes-Btcez1T-.js}

@@ -10,14 +10,26 @@ var function_routes_exports = /* @__PURE__ */ __exportAll({ createFunctionRoutes
 *
 * Each function is mounted at `/<function-name>`, preserving
 * whatever HTTP methods and middleware the Hono sub-app defines.
+*
+* @param functions What loaded. May be empty — the router still mounts, so
+*   "no functions are served" answers 200 with an empty list instead of 404.
+* @param skipped How many files the loader saw and could not serve. Reported
+*   as a count and a pointer to the log, not as filenames: the listing is
+*   reachable anonymously, and the per-file reasons carry import errors.
 */
-function createFunctionRoutes(functions) {
+function createFunctionRoutes(functions, skipped = 0) {
 	const router = new Hono();
 	router.get("/", (c) => {
-		return c.json({ functions: functions.map((fn) => ({
-			name: fn.name,
-			endpoint: `/functions/${fn.name}`
-		})) });
+		return c.json({
+			functions: functions.map((fn) => ({
+				name: fn.name,
+				endpoint: `/functions/${fn.name}`
+			})),
+			...skipped > 0 && {
+				skipped,
+				note: `${skipped} function file(s) failed to load and are NOT served — see the server log for the reason.`
+			}
+		});
 	});
 	for (const fn of functions) router.route(`/${fn.name}`, fn.app);
 	return router;
@@ -25,4 +37,4 @@ function createFunctionRoutes(functions) {
 //#endregion
 export { function_routes_exports as n, createFunctionRoutes as t };
 
-//# sourceMappingURL=function-routes-C0cLIy3N.js.map
+//# sourceMappingURL=function-routes-Btcez1T-.js.map

package/dist/function-routes-Btcez1T-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-routes-Btcez1T-.js","names":[],"sources":["../src/functions/function-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport { HonoEnv } from \"../api/types\";\nimport { LoadedFunction } from \"./function-loader\";\n\n/**\n * Mount all loaded function routes under a single Hono router.\n *\n * Each function is mounted at `/<function-name>`, preserving\n * whatever HTTP methods and middleware the Hono sub-app defines.\n *\n * @param functions What loaded. May be empty — the router still mounts, so\n *   \"no functions are served\" answers 200 with an empty list instead of 404.\n * @param skipped How many files the loader saw and could not serve. Reported\n *   as a count and a pointer to the log, not as filenames: the listing is\n *   reachable anonymously, and the per-file reasons carry import errors.\n */\nexport function createFunctionRoutes(\n    functions: LoadedFunction[],\n    skipped = 0\n): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n\n    // Listing endpoint: GET / → list available functions\n    router.get(\"/\", (c) => {\n        return c.json({\n            functions: functions.map((fn) => ({\n                name: fn.name,\n                endpoint: `/functions/${fn.name}`\n            })),\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} function file(s) failed to load and are NOT served — see the server log for the reason.`\n            })\n        });\n    });\n\n    for (const fn of functions) {\n        router.route(`/${fn.name}`, fn.app);\n    }\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,qBACZ,WACA,UAAU,GACG;CACb,MAAM,SAAS,IAAI,KAAc;CAGjC,OAAO,IAAI,MAAM,MAAM;EACnB,OAAO,EAAE,KAAK;GACV,WAAW,UAAU,KAAK,QAAQ;IAC9B,MAAM,GAAG;IACT,UAAU,cAAc,GAAG;GAC/B,EAAE;GACF,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAED,KAAK,MAAM,MAAM,WACb,OAAO,MAAM,IAAI,GAAG,QAAQ,GAAG,GAAG;CAGtC,OAAO;AACX"}

package/dist/functions/define-function.d.ts

@@ -15,11 +15,27 @@ export interface RebaseFunctionContext {
      * The server-side Rebase singleton (`dataAsAdmin`, `auth`, `storage`,
      * `email`, `sql`).
      *
-     * `rebase.dataAsAdmin` runs with **admin privileges and bypasses RLS** — use
-     * it only for trusted admin work. For user-scoped queries inside a handler,
-     * use the request `driver` (`c.var.driver`), which carries the caller's
-     * identity so RLS applies. (`rebase.data` no longer exists on this type —
-     * `dataAsAdmin` is the only name for the admin-scoped accessor.)
+     * `rebase.dataAsAdmin` runs as the service identity
+     * `{ uid: "service", roles: ["admin"] }` — **admin-scoped, not an RLS
+     * bypass**. Policies are still evaluated; it passes the default ones
+     * through their `rolesOverlap(['admin'])` arm, the same arm an application
+     * user holding the `admin` role passes. Two things follow:
+     *
+     * - `policy.serverContext()` (`auth.uid() IS NULL`) is **false** here. A
+     *   collection with `disableDefaultPolicies: true` whose write rule is
+     *   `serverContext()` will refuse these writes with `42501`, and reads
+     *   against a hand-written admin policy that does not name the `admin` role
+     *   return zero rows with a 200.
+     * - Do not read it as "nobody else can reach these rows". Whatever an
+     *   `admin`-roled user can reach, this can, and vice versa.
+     *
+     * `rebase.sql()` is the true bypass: it runs on the owner connection and
+     * never goes through `withAuth`.
+     *
+     * For user-scoped queries inside a handler, use the request `driver`
+     * (`c.var.driver`), which carries the caller's identity. (`rebase.data` no
+     * longer exists on this type — `dataAsAdmin` is the only name for the
+     * admin-scoped accessor.)
      */
     rebase: RebaseServerClient;
 }
@@ -41,7 +57,10 @@ export interface RebaseFunctionContext {
  * export default defineFunction((app, { rebase }) => {
  *     app.use("/*", requireAuth);
  *     app.get("/home", async (c) => {
- *         const [stats] = await rebase.sql!(`SELECT count(*) AS n FROM orders`);
+ *         // `rebase.sql` runs on the owner connection: no RLS, no policies,
+ *         // every row. It is the most privileged thing in this context —
+ *         // more so than `dataAsAdmin`, which is merely admin-scoped.
+ *         const [stats] = await rebase.sql(`SELECT count(*) AS n FROM orders`);
  *         return c.json({ orders: Number(stats.n) });
  *     });
  * });

package/dist/functions/function-loader.d.ts

@@ -6,6 +6,18 @@ export interface LoadedFunction {
     /** The Hono sub-app to mount */
     app: Hono<import("hono").Env>;
 }
+/** What a directory of function files produced: what mounted, and what did not. */
+export interface LoadedFunctions {
+    /** The functions that will be served. */
+    functions: LoadedFunction[];
+    /**
+     * One entry per file the loader saw and did **not** mount, each already
+     * phrased as `<name> (<reason>)`. Returned rather than only logged so the
+     * running server can say what is missing — a boot log line is not reachable
+     * from `GET /api/functions`.
+     */
+    problems: string[];
+}
 /**
  * Auto-discover Hono route files from a directory.
  *
@@ -14,5 +26,16 @@ export interface LoadedFunction {
  *   `functions/send-invoice.ts` → mounted at `/send-invoice`
  *
  * This mirrors how `loadCollectionsFromDirectory` works for collections.
+ *
+ * Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the
+ * caller also needs to report what did not.
  */
 export declare function loadFunctionsFromDirectory(directory: string, importModule?: ModuleImporter): Promise<LoadedFunction[]>;
+/**
+ * {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.
+ *
+ * Never throws: a single malformed function must not crash server boot. The
+ * caller decides what to do with `problems` — `init.ts` mounts the router
+ * regardless and surfaces the count on the listing endpoint.
+ */
+export declare function loadFunctionsWithDiagnostics(directory: string, importModule?: ModuleImporter): Promise<LoadedFunctions>;

package/dist/functions/function-routes.d.ts

@@ -6,5 +6,11 @@ import { LoadedFunction } from "./function-loader";
  *
  * Each function is mounted at `/<function-name>`, preserving
  * whatever HTTP methods and middleware the Hono sub-app defines.
+ *
+ * @param functions What loaded. May be empty — the router still mounts, so
+ *   "no functions are served" answers 200 with an empty list instead of 404.
+ * @param skipped How many files the loader saw and could not serve. Reported
+ *   as a count and a pointer to the log, not as filenames: the listing is
+ *   reachable anonymously, and the per-file reasons carry import errors.
  */
-export declare function createFunctionRoutes(functions: LoadedFunction[]): Hono<HonoEnv>;
+export declare function createFunctionRoutes(functions: LoadedFunction[], skipped?: number): Hono<HonoEnv>;

package/dist/functions/request-timeout.d.ts

@@ -0,0 +1,34 @@
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "../api/types";
+/** Default ceiling for a custom function request, in milliseconds. */
+export declare const DEFAULT_FUNCTIONS_TIMEOUT_MS = 30000;
+/**
+ * Resolve the functions request timeout from config, then env, then the default.
+ *
+ * `0` (or any non-positive number) disables the ceiling — for a deployment
+ * whose proxy already imposes one, or a function that legitimately streams for
+ * minutes.
+ */
+export declare function resolveFunctionsTimeoutMs(configured?: number): number;
+/**
+ * A per-request ceiling for the custom functions router.
+ *
+ * Custom functions are the one router that runs code the framework did not
+ * write, and nothing else in the stack bounds how long that code takes: the
+ * Node server is constructed without `requestTimeout`/`headersTimeout`, so a
+ * handler awaiting a promise that never settles — a `fetch` to an unreachable
+ * third party with no `AbortSignal`, a query on a wedged connection — holds its
+ * socket and its request object until the client gives up. On the managed
+ * runtime the process is shared between tenants, so that is not only the slow
+ * caller's problem.
+ *
+ * The handler is **not** cancelled — it cannot be, there is no cancellation
+ * token to hand user code. What is bounded is the client-visible request: after
+ * `ms` the caller gets a 504 and the socket is released, and the handler's
+ * eventual result is dropped. It is a ceiling, not a kill switch, and the exact
+ * number matters far less than its existence.
+ *
+ * Mounted in front of the auth middleware rather than behind it, so a wedged
+ * driver — the failure that also hangs `withAuth()` — is covered too.
+ */
+export declare function createFunctionsRequestTimeout(ms: number): MiddlewareHandler<HonoEnv>;

package/dist/history/history-routes.d.ts

@@ -19,5 +19,11 @@ export interface HistoryService {
 export declare function createHistoryRoutes(params: {
     historyService: HistoryService;
     registry: BackendCollectionRegistry;
+    /**
+     * The unscoped driver, still accepted so the call in `init.ts` and any
+     * embedder's keeps compiling — and deliberately not read. Every read and
+     * write on these routes goes through the request-scoped driver instead;
+     * see {@link authorizeEntityRead}.
+     */
     driver: DataDriver;
 }): Hono<HonoEnv>;

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { loadCollectionsFromDirectory, applyCollectionDefaults, type CollectionD
 export { assertCollectionConfigs, findCollectionConfigProblems, unknownKeyPolicyFromEnv, type ConfigProblem, type UnknownKeyPolicy, type ValidateCollectionConfigOptions } from "./collections/validate-config";
 export * from "./db/interfaces";
 export * from "./auth/interfaces";
-export { requireAuth, requireAdmin, optionalAuth, queryTokenAuth, fileTokenAuth, extractUserFromToken, hashPassword, verifyPassword, validatePasswordStrength, generateSecurePassword, resolveAuthHooks, createBuiltinAuthAdapter, createCustomAuthAdapter, createGoogleProvider, createLinkedinProvider, createGitHubProvider, createMicrosoftProvider, createAppleProvider, createFacebookProvider, createTwitterProvider, createDiscordProvider, createGitLabProvider, createBitbucketProvider, createSlackProvider, createSpotifyProvider, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed, safeCompare } from "./auth";
+export { requireAuth, requireAdmin, optionalAuth, queryTokenAuth, fileTokenAuth, extractUserFromToken, hashPassword, verifyPassword, validatePasswordStrength, generateSecurePassword, resolveAuthHooks, createBuiltinAuthAdapter, createCustomAuthAdapter, createGoogleProvider, createLinkedinProvider, createGitHubProvider, createMicrosoftProvider, createAppleProvider, createFacebookProvider, createTwitterProvider, createDiscordProvider, createGitLabProvider, createBitbucketProvider, createSlackProvider, createSpotifyProvider, oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail, verifyOidcIdToken, tryVerifyOidcIdToken, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed, safeCompare } from "./auth";
 export type { AccessTokenPayload, PasswordValidationResult, AuthHooks, AuthMethod, ResolvedAuthHooks, BuiltinAuthAdapterConfig, GoogleProviderConfig, AuthMiddlewareOptions, AuthResult, ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./auth";
 export * from "./api/types";
 export * from "./api/errors";
@@ -23,7 +23,7 @@ export * from "./storage";
 export { createHistoryRoutes } from "./history";
 export { loadFunctionsFromDirectory, createFunctionRoutes, defineFunction } from "./functions";
 export type { LoadedFunction, RebaseFunctionContext } from "./functions";
-export { loadCronJobsFromDirectory, CronScheduler, validateCronExpression, createCronRoutes, createCronStore, defineCron } from "./cron";
+export { loadCronJobsFromDirectory, loadCronJobsWithDiagnostics, CronScheduler, validateCronExpression, createCronRoutes, createCronStore, defineCron } from "./cron";
 export type { LoadedCronJob, CronStore } from "./cron";
 export { createBackupRoutes, parseBackupDestination, parseBackupTimestamp, listBackupObjects, readBackupBytes } from "./backup";
 export type { BackupRoutesConfig, BackupDestination } from "./backup";
@@ -35,6 +35,7 @@ export type { RebaseEnv } from "./env";
 export * from "./types";
 export * from "./services/driver-registry";
 export * from "./services/webhook-service";
+export * from "./services/outbound-url-guard";
 export { cleanupDevPortFile, listenWithPortRetry } from "./utils/dev-port";
 export { serveSPA } from "./serve-spa";
 export { installShutdownHandlers } from "./init/shutdown";