@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/storage/policies.d.ts

@@ -0,0 +1,88 @@
+/**
+ * Declarative access control for storage.
+ *
+ * Storage is not under row-level security, so `storageAuthorize` — a hook, a
+ * piece of imperative code — was the whole access-control model. That is the one
+ * place the claim "security lives in the database" does not hold, and it shows
+ * in the shape of the alternative: without a hook, **any authenticated caller
+ * may read, overwrite, delete or list any key they can name**, because storage
+ * keys share one flat namespace.
+ *
+ * A policy list says the same things declaratively, and can be read without
+ * running it:
+ *
+ * ```ts
+ * storagePolicies: [
+ *     { path: "public/**", operations: ["read"], allow: "public" },
+ *     { path: "users/:uid/**", allow: ({ params, user }) => user?.uid === params.uid }
+ * ]
+ * ```
+ *
+ * ## Deny by default, and why that is the whole design
+ *
+ * A key matched by no policy is refused. That makes every widening an explicit,
+ * reviewable line, and it makes a mistake in this module fail *closed* — a
+ * pattern that fails to match denies access rather than granting it. Authz code
+ * that fails open is worth more to an attacker than the feature is to anyone
+ * else, so the bias is deliberate and absolute.
+ *
+ * ## The hook remains, as an escape hatch and not as a fallback
+ *
+ * Ownership frequently lives in a row rather than in a key, which no pattern can
+ * express. So when policies match nothing, an explicit `storageAuthorize` is
+ * consulted before the request is refused. Present, it can widen; absent, the
+ * answer is no. Policies never *narrow* what the hook allowed and the hook never
+ * overrides a policy denial — each can only say yes, which keeps "who allowed
+ * this?" answerable by reading either one alone.
+ */
+import type { StorageAuthorize, StorageAuthorizeContext, StorageOperation } from "@rebasepro/types";
+/** Everything a predicate is told, plus whatever the path captured. */
+export interface StoragePolicyContext extends StorageAuthorizeContext {
+    /** Segments captured by `:name` placeholders in the matched path. */
+    params: Record<string, string>;
+}
+export type StoragePolicyPredicate = (ctx: StoragePolicyContext) => boolean | Promise<boolean>;
+export interface StoragePolicy {
+    /**
+     * A key pattern, matched segment by segment against the sanitized key.
+     *
+     * - a literal segment matches itself
+     * - `*` matches exactly one segment
+     * - `:name` matches one segment and captures it
+     * - `**` matches the rest of the key, including nothing, and is only
+     *   allowed as the final segment
+     */
+    path: string;
+    /** Which operations this grants. Defaults to every one of them. */
+    operations?: StorageOperation[];
+    /**
+     * Who it grants to.
+     *
+     * - `"public"` — anyone, signed in or not
+     * - `"authenticated"` — any caller with a uid
+     * - a predicate — anything else, given the captured params and the user
+     */
+    allow: "public" | "authenticated" | StoragePolicyPredicate;
+}
+export declare class StoragePolicyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Compile a policy list into a {@link StorageAuthorize}.
+ *
+ * Compiled once, at boot, so a malformed pattern fails the start rather than the
+ * first upload. `fallback` is an explicit `storageAuthorize`, consulted only
+ * when no policy matched.
+ */
+export declare function compileStoragePolicies(policies: StoragePolicy[], fallback?: StorageAuthorize): StorageAuthorize;
+/**
+ * The access-control function for a configuration, or `undefined` when it
+ * declares none.
+ *
+ * Kept separate from {@link compileStoragePolicies} so `init` has one call to
+ * make and one thing to reason about: policies, a hook, both, or neither.
+ */
+export declare function resolveStorageAccessControl(config: {
+    storagePolicies?: StoragePolicy[];
+    storageAuthorize?: StorageAuthorize;
+}): StorageAuthorize | undefined;

package/dist/storage/range.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Byte-range requests for served objects.
+ *
+ * Without `Accept-Ranges`, a browser will not offer to seek in an audio or
+ * video element served from here: it has no way to ask for the middle of a file,
+ * so scrubbing means fetching the whole thing from the start, and on a long
+ * recording it means fetching it again for every seek. Safari goes further and
+ * refuses to play a `<video>` at all unless the first response is a `206`.
+ *
+ * So this is not a performance nicety. For media it is the difference between a
+ * player that works and one that does not.
+ *
+ * ## What is implemented, and what is refused
+ *
+ * A single range — `bytes=0-499`, `bytes=500-`, `bytes=-500`. That is what every
+ * browser sends for media playback.
+ *
+ * Multiple ranges in one request (`bytes=0-99,200-299`) are **not** served.
+ * Answering them means composing a `multipart/byteranges` body, and nothing that
+ * matters sends them; a server may always answer a range request with the whole
+ * `200` instead, which is what happens here. Refusing to guess is better than a
+ * half-implemented multipart encoder.
+ *
+ * An unsatisfiable range — one starting past the end of the object — is a `416`
+ * with a `Content-Range: bytes /<size>`, as RFC 9110 requires. Answering `200`
+ * there would hand a player the whole file when it asked for a byte that does
+ * not exist, and it would never notice.
+ */
+/** A resolved, inclusive byte range within an object of known size. */
+export interface ByteRange {
+    start: number;
+    /** Inclusive, as the header is. */
+    end: number;
+    /** `end - start + 1`. */
+    length: number;
+}
+export type RangeParse = 
+/** No `Range` header, or one this server declines to honour. Serve `200`. */
+{
+    kind: "none";
+}
+/** Serve `206` with this range. */
+ | {
+    kind: "range";
+    range: ByteRange;
+}
+/** Serve `416`. The range cannot be satisfied for an object of this size. */
+ | {
+    kind: "unsatisfiable";
+};
+/**
+ * Parse a `Range` header against an object of `size` bytes.
+ *
+ * Deliberately conservative: anything malformed, multi-range, or in a unit other
+ * than bytes resolves to `none`, which serves the whole object. A range request
+ * answered with `200` is always legal; a range answered wrongly is a corrupted
+ * download.
+ */
+export declare function parseRange(header: string | undefined, size: number): RangeParse;
+/** The `Content-Range` for a served range. */
+export declare function contentRange(range: ByteRange, size: number): string;
+/** The `Content-Range` for a `416`, which names the size and no range. */
+export declare function unsatisfiableContentRange(size: number): string;

package/dist/storage/rendition-cache.d.ts

@@ -0,0 +1,45 @@
+import type { StorageController } from "./types.js";
+/**
+ * Where renditions live inside the source bucket.
+ *
+ * Fixed rather than configurable: it is the target of a lifecycle rule and of
+ * the route-layer refusal below, and both of those are worth being able to
+ * write down once, in the documentation, for every deployment.
+ */
+export declare const RENDITION_PREFIX = "_rebase/renditions/";
+/** True for a key that names the reserved rendition space. */
+export declare function isRenditionKey(key: string): boolean;
+export interface RenditionCacheConfig {
+    /** Off unless set. See the module comment for why. */
+    enabled?: boolean;
+}
+export interface DurableRendition {
+    data: Buffer;
+    contentType: string;
+}
+export interface DurableRenditionCache {
+    /** The stored rendition for this cache key, or null. Never throws. */
+    get(controller: StorageController, cacheKey: string, bucket: string | undefined): Promise<DurableRendition | null>;
+    /** Store a rendition. Never throws: a failed write is a slower cache. */
+    put(controller: StorageController, cacheKey: string, bucket: string | undefined, rendition: DurableRendition): Promise<void>;
+}
+/**
+ * The object key for a rendition.
+ *
+ * Hashed rather than derived from the source path: the source key can be up to
+ * 1024 characters and the transform options are a JSON object, so a readable
+ * composition would exceed key limits on exactly the paths people use — deep
+ * per-user prefixes. The source key is kept in the object's metadata, where it
+ * is available to anyone auditing the prefix and to nothing on the hot path.
+ */
+export declare function renditionKey(cacheKey: string, contentType: string): string;
+/**
+ * A rendition's key when reading, where the content type is not yet known.
+ *
+ * Reads try the known extensions rather than storing an index: four `getObject`
+ * calls at worst is still one round trip in the common case — the first
+ * candidate is the format the request asked for — and an index is a second
+ * thing to keep consistent with the objects it describes.
+ */
+export declare function renditionKeyCandidates(cacheKey: string, preferred?: string): string[];
+export declare function createDurableRenditionCache(): DurableRenditionCache;

package/dist/storage/routes.d.ts

@@ -7,10 +7,12 @@
  * is used.
  */
 import { Hono } from "hono";
-import { StorageController, type StorageAuthorize, type StorageAuthorizeData } from "./types";
-import { type StorageRegistry } from "./storage-registry";
+import { StorageController, type StorageAuthorize, type StorageAuthorizeData } from "./types.js";
+import { type StorageRegistry } from "./storage-registry.js";
 import { type StorageSourceDefinition, type AuthAdapter } from "@rebasepro/types";
-import { HonoEnv } from "../api/types";
+import { HonoEnv } from "../api/types.js";
+import { type StorageTrigger } from "./triggers.js";
+import { type RenditionCacheConfig } from "./rendition-cache.js";
 /**
  * Decide what to actually serve for a stored content type.
  *
@@ -24,8 +26,8 @@ export declare function resolveServedContentType(storedContentType: string): {
 };
 export interface StorageRoutesConfig {
     /**
-     * Single storage controller (backward-compatible).
-     * Used as fallback when no `registry` is provided.
+     * A single storage controller, for a backend with one storage source.
+     * Used when no `registry` is provided.
      */
     controller?: StorageController;
     /**
@@ -71,6 +73,16 @@ export interface StorageRoutesConfig {
      * resolved.
      */
     authorizeData?: () => StorageAuthorizeData | undefined;
+    /**
+     * Keep derived image renditions in the storage source instead of only in
+     * this process's memory. Off unless enabled — see `rendition-cache.ts` for
+     * why a read that writes to somebody's bucket is not a default.
+     */
+    renditionCache?: RenditionCacheConfig;
+    /**
+     * Run something when an object lands, or when one goes. See `triggers.ts`.
+     */
+    triggers?: StorageTrigger[];
 }
 /**
  * Extract the wildcard portion of a route path from the full request path.

package/dist/storage/storage-registry.d.ts

@@ -10,7 +10,7 @@
  * - String properties use `storageId` in their config to specify which storage to use
  * - Properties without `storageId` fallback to "(default)"
  */
-import { StorageController } from "./types";
+import { StorageController } from "./types.js";
 /**
  * The default storage identifier used when:
  * - A single storage controller is provided (not a map)

package/dist/storage/triggers.d.ts

@@ -0,0 +1,66 @@
+/** What happened to the object. */
+export type StorageTriggerEvent = "finalize" | "delete";
+export interface StorageEventContext {
+    /** Which event this is. */
+    event: StorageTriggerEvent;
+    /** The canonical storage key, as written. */
+    key: string;
+    /** The bucket, when the request named one. */
+    bucket?: string;
+    /** The storage source the object lives in. */
+    storageId: string;
+    /** Size in bytes. Present on `finalize`, absent on `delete`. */
+    size?: number;
+    /** The uploader's declared content type, when there was one. */
+    contentType?: string;
+    /** Segments captured by `:name` placeholders in the matched path. */
+    params: Record<string, string>;
+    /** Who made the request, when it was authenticated. */
+    user?: {
+        uid: string;
+        email?: string;
+        roles?: string[];
+    } | null;
+    /** When the event was raised, ISO 8601. */
+    at: string;
+}
+export type StorageTriggerHandler = (ctx: StorageEventContext) => void | Promise<void>;
+export interface StorageTrigger {
+    /**
+     * A key pattern, matched segment by segment against the canonical key.
+     *
+     * - a literal segment matches itself
+     * - `*` matches exactly one segment
+     * - `:name` matches one segment and captures it
+     * - `**` matches the rest of the key, including nothing, and is only
+     *   allowed as the final segment
+     */
+    path: string;
+    /** Which events fire it. Defaults to `["finalize"]`. */
+    events?: StorageTriggerEvent[];
+    /** A name for the logs. Defaults to the pattern. */
+    name?: string;
+    handler: StorageTriggerHandler;
+}
+/**
+ * A request's principal, in the shape a trigger is documented to receive.
+ *
+ * Hono's `user` variable is typed `AuthResult`, which admits `true` — some
+ * middleware sets a bare boolean to mean "authenticated, with no identity
+ * attached". A trigger asking "who did this?" is better told `null` than
+ * `true`, and better told `null` than a `{}` with no `uid`.
+ */
+export declare function triggerUser(raw: unknown): StorageEventContext["user"];
+export declare class StorageTriggerError extends Error {
+    constructor(message: string);
+}
+/** Fires the triggers a key and event match. Never throws. */
+export type StorageTriggerDispatcher = (ctx: Omit<StorageEventContext, "params">) => Promise<void>;
+/**
+ * Compile a trigger list into a dispatcher, or throw
+ * {@link StorageTriggerError}.
+ *
+ * Compiled at boot so a malformed pattern fails the start rather than the first
+ * upload — and, worse, rather than failing *silently* by matching nothing.
+ */
+export declare function compileStorageTriggers(triggers: StorageTrigger[]): StorageTriggerDispatcher;

package/dist/storage/tus-handler.d.ts

@@ -8,8 +8,8 @@
  * @see https://tus.io/protocols/resumable-upload
  */
 import type { Context } from "hono";
-import type { StorageController } from "./types";
-import { type StorageRegistry } from "./storage-registry";
+import type { StorageController } from "./types.js";
+import { type StorageRegistry } from "./storage-registry.js";
 /**
  * TUS resumable upload handler.
  *
@@ -33,6 +33,16 @@ export declare class TusHandler {
      * can only answer for the destination it is told about.
      */
     private authorizeUpload?;
+    /**
+     * Called once the bytes are stored, so storage triggers fire for the
+     * resumable path too. A trigger wired only to `POST /upload` would miss
+     * exactly the uploads big enough to be worth reacting to.
+     *
+     * Never throws: the dispatcher swallows handler errors, because the
+     * object is already written and failing here would tell the client to
+     * repeat a write that succeeded.
+     */
+    private onFinalized?;
     private uploads;
     private tusDir;
     private cleanupTimer?;
@@ -49,7 +59,28 @@ export declare class TusHandler {
      * Every routing value the write will use is passed in, because the hook
      * can only answer for the destination it is told about.
      */
-    authorizeUpload?: ((c: Context, key: string, bucket: string, storageId?: string) => Promise<void>) | undefined);
+    authorizeUpload?: ((c: Context, key: string, bucket: string, storageId?: string) => Promise<void>) | undefined, 
+    /**
+     * Called once the bytes are stored, so storage triggers fire for the
+     * resumable path too. A trigger wired only to `POST /upload` would miss
+     * exactly the uploads big enough to be worth reacting to.
+     *
+     * Never throws: the dispatcher swallows handler errors, because the
+     * object is already written and failing here would tell the client to
+     * repeat a write that succeeded.
+     */
+    onFinalized?: ((event: {
+        key: string;
+        bucket?: string;
+        storageId?: string;
+        size: number;
+        contentType?: string;
+        user?: {
+            uid: string;
+            email?: string;
+            roles?: string[];
+        } | null;
+    }) => Promise<void>) | undefined);
     /** Ensure the temp directory exists. */
     private ensureDir;
     /** Start periodic cleanup of stale uploads. */

package/dist/topics/runtime.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Topics, on the durable job queue.
+ *
+ * ## Why fan out at publish time
+ *
+ * Publishing writes **one job row per subscription**, not one row for the
+ * event. That is the shape SNS→SQS has and the reason is the same: each
+ * subscriber then retries on its own schedule, and a subscription that is
+ * broken or slow neither blocks the others nor causes them to run again. A
+ * single row per event forces one retry policy across every consumer, so the
+ * fourth attempt of a failing audit log re-delivers a welcome email that
+ * already went out.
+ *
+ * It also makes "did this subscriber get it" a row somebody can look at, which
+ * is the property the job queue was built for: work that gives up is *kept*,
+ * because a queue that silently drops what it could not deliver is
+ * indistinguishable from one with nothing to do.
+ *
+ * ## What at-least-once means here
+ *
+ * A handler can see the same event twice — a worker that dies holding a job
+ * releases it after the visibility timeout, and the next worker starts the
+ * handler again from the top. Handlers must tolerate that. It is the honest
+ * name for what a retrying queue does, which is why `at-most-once` is refused
+ * at declaration rather than quietly given the other guarantee.
+ *
+ * ## Transactional publish
+ *
+ * `enqueue` is a row insert, so a publish inside a transaction that rolls back
+ * was never published — the difference between "email sent for an order that
+ * does not exist" and nothing having happened at all.
+ */
+import { type ResourceDeclaration, type TopicRuntime } from "@rebasepro/types";
+import type { JobHandler, JobQueueClient } from "./../jobs/types.js";
+/** The job task name a subscription's deliveries are recorded under. */
+export declare function topicTaskName(topic: string, subscription: string): string;
+/** Attempts a subscription gets before its delivery is left failed. */
+export declare const DEFAULT_TOPIC_ATTEMPTS = 5;
+/**
+ * Build the job handlers every declared subscription needs.
+ *
+ * Returned rather than registered, because the queue takes its whole task map
+ * at construction — and a task map assembled in one place is one somebody can
+ * print.
+ */
+export declare function topicJobHandlers(): Record<string, JobHandler<never>>;
+export interface TopicRuntimeOptions {
+    queue: JobQueueClient;
+    /** Declared topics, so publishing to an undeclared one can be refused. */
+    topics: ResourceDeclaration[];
+}
+/**
+ * Build the runtime topics publish through.
+ *
+ * Publishing to a topic nothing declared throws. The handle API makes it hard
+ * to reach, but a string name from an ejected project or a dynamic caller can —
+ * and enqueueing under a task no worker handles would write rows nobody ever
+ * runs.
+ */
+export declare function createTopicRuntime(options: TopicRuntimeOptions): TopicRuntime;
+/**
+ * Install the runtime, and hand back a teardown.
+ *
+ * Publishing without one throws rather than resolving — an event that
+ * disappears into a resolved promise is the failure a queue exists to
+ * prevent — so it is installed for exactly as long as a backend is up.
+ */
+export declare function installTopicRuntime(options: TopicRuntimeOptions): () => void;

package/dist/{types-DSnOC4mF.js → types-BfKcm9do.js}

@@ -1,6 +1,7 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
 //#region src/storage/types.ts
 /**
 * Default maximum file size (50MB)
@@ -35,4 +36,4 @@ var DOCUMENT_MIME_TYPES = [
 //#endregion
 export { DOCUMENT_MIME_TYPES as n, IMAGE_MIME_TYPES as r, DEFAULT_MAX_FILE_SIZE as t };
 
-//# sourceMappingURL=types-DSnOC4mF.js.map
+//# sourceMappingURL=types-BfKcm9do.js.map

package/dist/{types-DSnOC4mF.js.map → types-BfKcm9do.js.map}

@@ -1 +1 @@
-{"version":3,"file":"types-DSnOC4mF.js","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage configuration and types for Rebase backend\n */\n\nimport { StorageSource, UploadFileProps, UploadFileResult, DownloadConfig, StorageListResult, StorageReference } from \"@rebasepro/types\";\n\n/**\n * Local filesystem storage configuration\n */\nexport interface LocalStorageConfig {\n    type: \"local\";\n    /** Base directory for file storage (e.g., './uploads') */\n    basePath: string;\n    /** Maximum file size in bytes (default: 50MB) */\n    maxFileSize?: number;\n    /** Allowed MIME types (if not set, all types allowed) */\n    allowedMimeTypes?: string[];\n    /** Base URL for generating download URLs (default: auto-detected from request) */\n    baseUrl?: string;\n}\n\n/**\n * S3-compatible storage configuration (works with AWS S3 and MinIO)\n */\nexport interface S3StorageConfig {\n    type: \"s3\";\n    /** S3 bucket name */\n    bucket: string;\n    /** AWS region (e.g., 'us-east-1') */\n    region?: string;\n    /** Custom endpoint URL (required for MinIO, Cloudflare R2, Hetzner Object Storage) */\n    endpoint?: string;\n    /** AWS access key ID */\n    accessKeyId: string;\n    /** AWS secret access key */\n    secretAccessKey: string;\n    /** Use path-style URLs (required for MinIO) */\n    forcePathStyle?: boolean;\n    /** Maximum file size in bytes (default: 50MB) */\n    maxFileSize?: number;\n    /** Allowed MIME types (if not set, all types allowed) */\n    allowedMimeTypes?: string[];\n    /** URL expiration time in seconds for signed URLs (default: 3600) */\n    signedUrlExpiration?: number;\n}\n\n/**\n * Google Cloud Storage configuration (works with GCS and Firebase Storage)\n */\nexport interface GCSStorageConfig {\n    type: \"gcs\";\n    /** GCS bucket name (e.g. \"my-project.appspot.com\" for Firebase Storage) */\n    bucket: string;\n    /** GCP project ID (optional, auto-detected from credentials) */\n    projectId?: string;\n    /** Path to service account JSON key file */\n    keyFilename?: string;\n    /** Service account credentials object (alternative to keyFilename) */\n    credentials?: { client_email: string; private_key: string; project_id?: string };\n    /** Maximum file size in bytes (default: 50MB) */\n    maxFileSize?: number;\n    /** Allowed MIME types */\n    allowedMimeTypes?: string[];\n    /** Signed URL expiration in seconds (default: 3600) */\n    signedUrlExpiration?: number;\n}\n\n/**\n * Storage configuration — local filesystem, S3-compatible, or Google Cloud Storage.\n *\n * **Built-in providers:**\n * - `local` — Zero-config filesystem storage. Great for dev and single-server deployments (Hetzner, bare metal).\n * - `s3` — Any S3-compatible provider. AWS S3, Cloudflare R2, MinIO, Hetzner Object Storage,\n *           Backblaze B2, DigitalOcean Spaces, and even GCS (via its S3-compatible interoperability API).\n * - `gcs` — Native Google Cloud Storage / Firebase Storage via `@google-cloud/storage`.\n *\n * **Custom providers:**\n * For other cloud storage (Azure Blob, etc.), implement the `StorageController`\n * interface and pass the instance directly to the `storage` config.\n */\nexport type BackendStorageConfig = LocalStorageConfig | S3StorageConfig | GCSStorageConfig;\n\n/** What a storage request is trying to do to an object. */\nexport type {\n    StorageOperation,\n    StorageAuthorizeUser,\n    StorageAuthorizeContext,\n    StorageAuthorizeData,\n    StorageAuthorize\n} from \"@rebasepro/types\";\n\n/**\n * Storage controller interface for backend implementations\n */\nexport interface StorageController {\n    /**\n     * Upload an object\n     */\n    putObject(props: UploadFileProps): Promise<UploadFileResult>;\n\n    /**\n     * Get a download URL (signed URL equivalent) for an object\n     */\n    getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig>;\n\n    /**\n     * Get object as a File\n     */\n    getObject(key: string, bucket?: string): Promise<File | null>;\n\n    /**\n     * Delete an object\n     */\n    deleteObject(key: string, bucket?: string): Promise<void>;\n\n    /**\n     * List objects in a prefix\n     */\n    listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult>;\n\n    /**\n     * Get the storage provider identifier.\n     *\n     * Built-in values are `'local'` and `'s3'`. Custom implementations\n     * should return their own identifier (e.g. `'gcs'`, `'azure'`).\n     */\n    getType(): string;\n}\n\n/**\n * Default maximum file size (50MB)\n */\nexport const DEFAULT_MAX_FILE_SIZE = 50 * 1024 * 1024;\n\n/**\n * Common image MIME types\n */\nexport const IMAGE_MIME_TYPES = [\n    \"image/jpeg\",\n    \"image/png\",\n    \"image/gif\",\n    \"image/webp\",\n    \"image/svg+xml\",\n    \"image/bmp\",\n    \"image/tiff\"\n];\n\n/**\n * Common document MIME types\n */\nexport const DOCUMENT_MIME_TYPES = [\n    \"application/pdf\",\n    \"application/msword\",\n    \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n    \"application/vnd.ms-excel\",\n    \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n    \"application/vnd.ms-powerpoint\",\n    \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\n    \"text/plain\",\n    \"text/csv\"\n];\n"],"mappings":";;;;;;;AAwIA,IAAa,wBAAwB,KAAK,OAAO;;;;AAKjD,IAAa,mBAAmB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;AAKA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ"}
+{"version":3,"file":"types-BfKcm9do.js","names":[],"sources":["../src/storage/types.ts"],"sourcesContent":["/**\n * Storage configuration and types for Rebase backend\n */\n\nimport { StorageSource, UploadFileProps, UploadFileResult, DownloadConfig, StorageListResult, StorageReference } from \"@rebasepro/types\";\n\n/**\n * Local filesystem storage configuration\n */\nexport interface LocalStorageConfig {\n    type: \"local\";\n    /** Base directory for file storage (e.g., './uploads') */\n    basePath: string;\n    /** Maximum file size in bytes (default: 50MB) */\n    maxFileSize?: number;\n    /** Allowed MIME types (if not set, all types allowed) */\n    allowedMimeTypes?: string[];\n    /** Base URL for generating download URLs (default: auto-detected from request) */\n    baseUrl?: string;\n}\n\n/**\n * S3-compatible storage configuration (works with AWS S3 and MinIO)\n */\nexport interface S3StorageConfig {\n    type: \"s3\";\n    /** S3 bucket name */\n    bucket: string;\n    /** AWS region (e.g., 'us-east-1') */\n    region?: string;\n    /** Custom endpoint URL (required for MinIO, Cloudflare R2, Hetzner Object Storage) */\n    endpoint?: string;\n    /** AWS access key ID */\n    accessKeyId: string;\n    /** AWS secret access key */\n    secretAccessKey: string;\n    /** Use path-style URLs (required for MinIO) */\n    forcePathStyle?: boolean;\n    /** Maximum file size in bytes (default: 50MB) */\n    maxFileSize?: number;\n    /** Allowed MIME types (if not set, all types allowed) */\n    allowedMimeTypes?: string[];\n    /** URL expiration time in seconds for signed URLs (default: 3600) */\n    signedUrlExpiration?: number;\n}\n\n/**\n * Google Cloud Storage configuration (works with GCS and Firebase Storage)\n */\nexport interface GCSStorageConfig {\n    type: \"gcs\";\n    /** GCS bucket name (e.g. \"my-project.appspot.com\" for Firebase Storage) */\n    bucket: string;\n    /** GCP project ID (optional, auto-detected from credentials) */\n    projectId?: string;\n    /** Path to service account JSON key file */\n    keyFilename?: string;\n    /** Service account credentials object (alternative to keyFilename) */\n    credentials?: { client_email: string; private_key: string; project_id?: string };\n    /** Maximum file size in bytes (default: 50MB) */\n    maxFileSize?: number;\n    /** Allowed MIME types */\n    allowedMimeTypes?: string[];\n    /** Signed URL expiration in seconds (default: 3600) */\n    signedUrlExpiration?: number;\n}\n\n/**\n * Storage configuration — local filesystem, S3-compatible, or Google Cloud Storage.\n *\n * **Built-in providers:**\n * - `local` — Zero-config filesystem storage. Great for dev and single-server deployments (Hetzner, bare metal).\n * - `s3` — Any S3-compatible provider. AWS S3, Cloudflare R2, MinIO, Hetzner Object Storage,\n *           Backblaze B2, DigitalOcean Spaces, and even GCS (via its S3-compatible interoperability API).\n * - `gcs` — Native Google Cloud Storage / Firebase Storage via `@google-cloud/storage`.\n *\n * **Custom providers:**\n * For other cloud storage (Azure Blob, etc.), implement the `StorageController`\n * interface and pass the instance directly to the `storage` config.\n */\nexport type BackendStorageConfig = LocalStorageConfig | S3StorageConfig | GCSStorageConfig;\n\n/** What a storage request is trying to do to an object. */\nexport type {\n    StorageOperation,\n    StorageAuthorizeUser,\n    StorageAuthorizeContext,\n    StorageAuthorizeData,\n    StorageAuthorize\n} from \"@rebasepro/types\";\n\n/**\n * Storage controller interface for backend implementations\n */\nexport interface StorageController {\n    /**\n     * Upload an object\n     */\n    putObject(props: UploadFileProps): Promise<UploadFileResult>;\n\n    /**\n     * Get a download URL (signed URL equivalent) for an object\n     */\n    getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig>;\n\n    /**\n     * Get object as a File\n     */\n    getObject(key: string, bucket?: string): Promise<File | null>;\n\n    /**\n     * Delete an object\n     */\n    deleteObject(key: string, bucket?: string): Promise<void>;\n\n    /**\n     * List objects in a prefix\n     */\n    listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult>;\n\n    /**\n     * Get the storage provider identifier.\n     *\n     * Built-in values are `'local'` and `'s3'`. Custom implementations\n     * should return their own identifier (e.g. `'gcs'`, `'azure'`).\n     */\n    getType(): string;\n}\n\n/**\n * Default maximum file size (50MB)\n */\nexport const DEFAULT_MAX_FILE_SIZE = 50 * 1024 * 1024;\n\n/**\n * Common image MIME types\n */\nexport const IMAGE_MIME_TYPES = [\n    \"image/jpeg\",\n    \"image/png\",\n    \"image/gif\",\n    \"image/webp\",\n    \"image/svg+xml\",\n    \"image/bmp\",\n    \"image/tiff\"\n];\n\n/**\n * Common document MIME types\n */\nexport const DOCUMENT_MIME_TYPES = [\n    \"application/pdf\",\n    \"application/msword\",\n    \"application/vnd.openxmlformats-officedocument.wordprocessingml.document\",\n    \"application/vnd.ms-excel\",\n    \"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet\",\n    \"application/vnd.ms-powerpoint\",\n    \"application/vnd.openxmlformats-officedocument.presentationml.presentation\",\n    \"text/plain\",\n    \"text/csv\"\n];\n"],"mappings":";;;;;;;;AAwIA,IAAa,wBAAwB,KAAK,OAAO;;;;AAKjD,IAAa,mBAAmB;CAC5B;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;AAKA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ"}

package/dist/utils/host.d.ts

@@ -0,0 +1,58 @@
+/**
+ * The host globals this package reads, behind functions that do not assume Node.
+ *
+ * `process` is not defined on workerd, on Deno Deploy without the compat flag,
+ * or in a browser. That matters here for one specific reason: the portable
+ * authoring surface (`@rebasepro/server/functions`) reaches the logger and the
+ * error handler, and a bare `process.env.NODE_ENV` inside either of them turns
+ * the first log line of a request into a `ReferenceError` on a runtime that has
+ * no `process` — a failure that reads as "the framework crashed" rather than
+ * "this runtime has no process object".
+ *
+ * Nothing here throws and nothing here is async. A runtime that cannot answer
+ * gets the empty answer, because every caller in this file's blast radius is
+ * choosing a log level or a format, and the safe default for both is the
+ * development one.
+ *
+ * @module
+ */
+/**
+ * The process environment, or the closest thing this runtime has to one.
+ *
+ * Order: a bag published by {@link setHostEnv} first, because an adapter that
+ * set one knows more than the ambient globals do; then `process.env`; then
+ * nothing.
+ */
+export declare function hostEnv(): Record<string, string | undefined>;
+/**
+ * Read one environment variable without touching `process` directly.
+ *
+ * Trimmed, and blank is treated as absent — a variable declared with no value
+ * is the ordinary way to write a compose file or a `.env` line, and every
+ * caller in this package means "unset" by it. See `resolveFunctionsTimeoutMs`,
+ * which learned that the hard way.
+ */
+export declare function hostEnvVar(name: string): string | undefined;
+/**
+ * Publish an environment bag for contextless readers.
+ *
+ * Called by an adapter for a runtime whose environment is not ambient. Merges
+ * rather than replaces, so two adapters (or an adapter plus a test) do not
+ * silently erase each other's variables.
+ */
+export declare function setHostEnv(env: Record<string, string | undefined>): void;
+/** @internal Test seam — drops anything {@link setHostEnv} published. */
+export declare function _clearHostEnv(): void;
+/**
+ * Write one already-formatted line to the process's output.
+ *
+ * `process.stdout.write` is preferred where it exists because it is the only
+ * one of the two that does not append its own formatting to a line that is
+ * already a complete JSON document — `console.log` on Node is
+ * `process.stdout.write` plus `util.format`, and `util.format` will happily
+ * reinterpret a `%s` that appeared inside a user's log message.
+ *
+ * Where it does not exist, `console` is the runtime's log sink and is what its
+ * platform collects.
+ */
+export declare function writeLine(stream: "out" | "err", line: string): void;

package/dist/utils/logger.d.ts

@@ -1,18 +1,3 @@
-/**
- * Structured Logger for Rebase Backend
- *
- * Outputs JSON lines when `NODE_ENV=production`, human-readable prefixed
- * lines otherwise.  Designed to work with Google Cloud Logging severity levels.
- *
- * Every line — message and data, at any depth — passes through the redaction
- * below, which strips Drizzle's `Failed query: … / params: …` wrapper and the
- * values of secret-looking keys. See the block above `serialiseError`.
- *
- * Usage:
- *   import { logger } from "./utils/logger";
- *   logger.info("Server started", { port: 3001 });
- *   logger.error("Request failed", { path: "/api/test", error: err });
- */
 export type LogLevel = "debug" | "info" | "warn" | "error";
 export interface LogEntry {
     severity: string;

package/dist/utils/request-id.d.ts

@@ -1,4 +1,4 @@
 import type { MiddlewareHandler } from "hono";
-import type { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types.js";
 export declare const REQUEST_ID_HEADER = "X-Request-ID";
 export declare function requestId(): MiddlewareHandler<HonoEnv>;

package/functions/package.json

@@ -0,0 +1,24 @@
+{
+    "//": [
+        "Not a package. A resolution redirect, so that `@rebasepro/server/functions`",
+        "works under TypeScript's legacy `moduleResolution: \"node\"` as well as under",
+        "`bundler` / `node16` / `nodenext`.",
+        "",
+        "The `exports` map in ../package.json is the real declaration, and it is what",
+        "Node uses at runtime — once a package has `exports`, Node ignores directory",
+        "redirects like this one entirely. TypeScript's node10 mode does the opposite:",
+        "it ignores `exports` and resolves subpaths as directories. A project scaffolded",
+        "by `rebase init` compiles with `moduleResolution: \"node\"`, so without this file",
+        "the very import the template ships — `@rebasepro/server/functions` — fails its",
+        "own `tsc` with TS2307, while running perfectly.",
+        "",
+        "Deleting this file breaks type-checking for every such project and nothing",
+        "else, which is the hardest kind of breakage to attribute. `files` in",
+        "../package.json ships it; assert-build-output.mjs verifies the targets exist."
+    ],
+    "type": "module",
+    "main": "../dist/functions/index.js",
+    "module": "../dist/functions/index.js",
+    "types": "../dist/functions/index.d.ts",
+    "sideEffects": false
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server",
   "type": "module",
-  "version": "0.16.0",
+  "version": "0.16.1-canary.g0d7af95",
   "description": "Database-Agnostic Backend Core for Rebase",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -36,6 +36,11 @@
       "development": "./dist/index.es.js",
       "import": "./dist/index.es.js"
     },
+    "./functions": {
+      "types": "./dist/functions/index.d.ts",
+      "development": "./dist/functions/index.js",
+      "import": "./dist/functions/index.js"
+    },
     "./package.json": "./package.json"
   },
   "dependencies": {
@@ -44,10 +49,10 @@
     "jsonwebtoken": "^9.0.3",
     "ws": "^8.21.1",
     "zod": "^4.4.3",
-    "@rebasepro/client": "0.16.0",
-    "@rebasepro/types": "0.16.0",
-    "@rebasepro/common": "0.16.0",
-    "@rebasepro/utils": "0.16.0"
+    "@rebasepro/client": "0.16.1-canary.g0d7af95",
+    "@rebasepro/common": "0.16.1-canary.g0d7af95",
+    "@rebasepro/types": "0.16.1-canary.g0d7af95",
+    "@rebasepro/utils": "0.16.1-canary.g0d7af95"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
@@ -103,14 +108,15 @@
   },
   "files": [
     "bin",
-    "dist"
+    "dist",
+    "functions"
   ],
   "bin": {
     "rebase-server": "bin/rebase-server.js"
   },
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && vite build --config vite.config.functions.ts && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && node ../../tooling/scripts/assert-build-output.mjs && node --experimental-vm-modules --no-warnings ../../tooling/scripts/assert-portable-entry.mjs dist/functions/index.js",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "cross-env NODE_OPTIONS=\"--experimental-vm-modules\" jest --passWithNoTests --forceExit",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f"