@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/backup/backup-common.d.ts

@@ -1,5 +1,5 @@
 import type { BackupInfo } from "@rebasepro/types";
-import type { StorageController } from "../storage";
+import type { StorageController } from "../storage/index.js";
 export type BackupDestination = {
     kind: "local";
     path: string;

package/dist/backup/backup-routes.d.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
-import type { HonoEnv } from "../api/types";
-import type { StorageController } from "../storage";
-import { BackupDestination } from "./backup-common";
+import type { HonoEnv } from "../api/types.js";
+import type { StorageController } from "../storage/index.js";
+import { BackupDestination } from "./backup-common.js";
 export interface BackupRoutesConfig {
     /**
      * Resolve the current backup destination, or `null` when backups are not

package/dist/backup/index.d.ts

@@ -2,6 +2,6 @@
  * Storage-generic backup helpers and admin routes for the Backups panel.
  * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.
  */
-export * from "./backup-common";
-export { createBackupRoutes } from "./backup-routes";
-export type { BackupRoutesConfig } from "./backup-routes";
+export * from "./backup-common.js";
+export { createBackupRoutes } from "./backup-routes.js";
+export type { BackupRoutesConfig } from "./backup-routes.js";

package/dist/{backup-C6ljYVTp.js → backup-CRdZkA6c.js}

@@ -1,8 +1,9 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { n as errorHandler, t as ApiError } from "./errors-EBYiaJ2E.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
 import fs from "fs";
 import path from "path";
 import { Hono } from "hono";
@@ -160,4 +161,4 @@ var backup_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { parseBackupTimestamp as a, parseBackupDestination as i, createBackupRoutes as n, readBackupBytes as o, listBackupObjects as r, backup_exports as t };
 
-//# sourceMappingURL=backup-C6ljYVTp.js.map
+//# sourceMappingURL=backup-CRdZkA6c.js.map

package/dist/{backup-C6ljYVTp.js.map → backup-CRdZkA6c.js.map}

@@ -1 +1 @@
-{"version":3,"file":"backup-C6ljYVTp.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * Only `.dump` files are considered.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\"\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only .dump files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(\".dump\")) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!key.endsWith(\".dump\")) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;AAMA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;GACrB;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;EAC1B;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,SAAS,SAAS,OAAO,GAC1E,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,IAAI,SAAS,OAAO,GAAG,OAAO;CACnC,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;ACrGA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}
+{"version":3,"file":"backup-CRdZkA6c.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * Only `.dump` files are considered.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\"\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only .dump files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(\".dump\")) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!key.endsWith(\".dump\")) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;AAMA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;GACrB;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;EAC1B;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,SAAS,SAAS,OAAO,GAC1E,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,IAAI,SAAS,OAAO,GAAG,OAAO;CACnC,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;ACrGA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}

package/dist/boot/boot.d.ts

@@ -1,10 +1,10 @@
 import { type Server } from "http";
 import { Hono } from "hono";
-import { type RebaseBackendInstance } from "../init";
-import type { HonoEnv } from "../api/types";
-import { type RebaseBootEnv } from "./env";
-import { type LoadedBundle } from "./bundle";
-import { type InitializedDataSource } from "./driver";
+import { type RebaseBackendInstance } from "../init.js";
+import type { HonoEnv } from "../api/types.js";
+import { type RebaseBootEnv } from "./env.js";
+import { type LoadedBundle } from "./bundle.js";
+import { type InitializedDataSource } from "./driver.js";
 /** A running runtime, and the handle to stop it. */
 export interface BootedRuntime {
     app: Hono<HonoEnv>;

package/dist/boot/bundle.d.ts

@@ -1,5 +1,5 @@
 import { type CollectionConfig, type CollectionCallbacks, type DataSourceDefinition, type RebaseBundleManifest, type StorageSourceDefinition } from "@rebasepro/types";
-import type { StorageAuthorize } from "../storage/types";
+import type { StorageAuthorize } from "../storage/types.js";
 /** Thrown when a bundle cannot be read, or claims a contract this runtime cannot honour. */
 export declare class BundleError extends Error {
     readonly hint?: string | undefined;
@@ -31,6 +31,15 @@ export interface LoadedStaticApp {
     /** Serve `index.html` for unmatched paths under `path`. */
     spa: boolean;
 }
+/**
+ * The file that makes a directory a bundle.
+ *
+ * Exported because `fetch-bundle.ts` has to recognise the same thing after
+ * unpacking, and when it had its own idea of the name — `rebase-bundle.json`,
+ * which nothing has ever written — every download was rejected as "not a Rebase
+ * bundle". A marker with two spellings is a marker with none.
+ */
+export declare const MANIFEST_FILENAME = "manifest.json";
 /**
  * Read and validate a bundle's manifest.
  *

package/dist/boot/driver.d.ts

@@ -1,5 +1,5 @@
 import type { BackendBootstrapper, DatabaseAdapter } from "@rebasepro/types";
-import type { ResolvedDataSourceConfig } from "./sources";
+import type { ResolvedDataSourceConfig } from "./sources.js";
 /**
  * The connection handle a driver hands back at boot: the client object, the
  * pool to close on shutdown, and how to probe it.

package/dist/boot/env.d.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { type RebaseEnv } from "../env";
+import { type RebaseEnv } from "../env.js";
 /**
  * The environment a bundle-booted runtime understands.
  *
@@ -52,6 +52,11 @@ declare const bootEnvExtension: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    STORAGE_RENDITION_CACHE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
     STORAGE_ALLOW_ANY_AUTHENTICATED: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
         true: "true";
@@ -67,6 +72,23 @@ declare const bootEnvExtension: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_MAGIC_LINK: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_EMAIL_OTP: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    CAPTCHA_PROVIDER: z.ZodOptional<z.ZodEnum<{
+        "": "";
+        turnstile: "turnstile";
+        hcaptcha: "hcaptcha";
+    }>>;
+    CAPTCHA_SECRET: z.ZodOptional<z.ZodString>;
+    CAPTCHA_ROUTES: z.ZodOptional<z.ZodString>;
     AUTH_COOKIE_SAME_SITE: z.ZodOptional<z.ZodEnum<{
         "": "";
         Strict: "Strict";
@@ -113,6 +135,11 @@ declare const bootEnvExtension: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
+    REBASE_RLS_AUDIT: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
     REBASE_FUNCTIONS_ONLY: z.ZodOptional<z.ZodString>;
     REBASE_FUNCTIONS_EXCLUDE: z.ZodOptional<z.ZodString>;
     REBASE_FUNCTIONS_UPSTREAM: z.ZodOptional<z.ZodString>;

package/dist/boot/fetch-bundle.d.ts

@@ -2,6 +2,22 @@
 export declare const BUNDLE_URL_ENV = "REBASE_BUNDLE_URL";
 /** Bearer token for that fetch. Does not expire — see the module note. */
 export declare const BUNDLE_TOKEN_ENV = "REBASE_BUNDLE_TOKEN";
+/**
+ * Where a fetched bundle is unpacked. Defaults to a fresh temp directory.
+ *
+ * A platform sets this to a volume it sized on purpose, because the unpack and
+ * the dependency install are the two things in a pod's life that need real
+ * disk. Left unset the bundle lands under the OS temp directory, which on a
+ * container is the writable layer and on Cloud Run is a tmpfs — fine for a
+ * small bundle, and the thing to change first when one is not.
+ *
+ * It is deliberately a *fixed* directory when set, not a fresh one per boot: a
+ * container that restarts inside a live pod finds the tree it already unpacked
+ * and installed, so a restart costs a manifest check rather than a download and
+ * an `npm ci`. `REBASE_BUNDLE` is still the one that means "a bundle is already
+ * here, do not fetch at all" — this only says where to put one.
+ */
+export declare const BUNDLE_FETCH_DIR_ENV = "REBASE_BUNDLE_FETCH_DIR";
 export interface FetchBundleOptions {
     url: string;
     token?: string;
@@ -11,8 +27,29 @@ export interface FetchBundleOptions {
     fetchImpl?: typeof fetch;
     /** Injected for tests. */
     extract?: (tarball: string, destination: string) => Promise<void>;
-    /** How long the download may take before it is abandoned. */
+    /** How long a single download attempt may take before it is abandoned. */
     timeoutMs?: number;
+    /**
+     * How many times to try the download.
+     *
+     * A pod starting during a control-plane rollout, or racing its own DNS, gets
+     * one transient failure and would otherwise CrashLoop on it — and a
+     * CrashLoop re-runs the whole boot, so the retry is cheaper than the restart
+     * it replaces.
+     */
+    attempts?: number;
+    /** Delay between attempts. */
+    retryDelayMs?: number;
+    /**
+     * Install the bundle's declared dependencies after unpacking.
+     *
+     * On by default: a bundle that declares dependencies and has none installed
+     * cannot boot, and this is the only step between the two. Turned off for a
+     * bundle that was vendored at build time, and by tests.
+     */
+    installDependencies?: boolean;
+    /** Injected for tests. */
+    installImpl?: (bundleRoot: string) => Promise<void>;
 }
 /**
  * Whether this process should fetch its bundle rather than read one from disk.
@@ -31,6 +68,112 @@ export declare function shouldFetchBundle(env?: NodeJS.ProcessEnv): boolean;
  * refuse. Writing the whole tarball first means a truncated download is caught
  * by `tar` as a corrupt archive, which is an error.
  */
+/**
+ * Install the bundle's declared dependencies, in place.
+ *
+ * `npm ci` when a lockfile is present and `npm install` otherwise — a bundle
+ * that shipped a lockfile gets a reproducible install, one that did not still
+ * boots.
+ *
+ * `--ignore-scripts` is not optional. The runtime image's entrypoint refuses to
+ * run lifecycle scripts, and an install that ran them here would void that
+ * guarantee at every pod start, executing arbitrary code from the dependency
+ * tree before the process this is meant to be booting exists.
+ *
+ * The npm cache is dropped afterwards because it is, at that point, a
+ * byte-for-byte duplicate of the tree beside it and nothing reads it again —
+ * the runtime never installs twice in one process. Keeping it doubles the
+ * high-water mark on a disk that is usually the binding constraint.
+ */
+export declare function installBundleDependencies(bundleRoot: string, exec?: (cmd: string, args: string[], opts: object) => Promise<unknown>): Promise<void>;
+/**
+ * Packages the runtime image provides and a bundle must not carry its own copy of.
+ *
+ * Exactly one, deliberately. `@rebasepro/server` holds the framework singleton,
+ * and a second copy is not merely wasteful — it is a total, silent breakage of
+ * custom functions. Every function imports `defineFunction` from
+ * `@rebasepro/server`, so it resolves the BUNDLE's copy, which is a different
+ * module instance from the one `runFromBundle` booted. The singleton
+ * initialised by the boot is invisible to it, so `rebase.data`,
+ * `rebase.dataAsAdmin` and `rebase.storage` throw "server not initialized yet"
+ * on every request, in a process that is otherwise healthy and reports itself
+ * ready. Seen in production as every custom-function route 500ing while
+ * `/api/data/*` served fine.
+ *
+ * It arrives transitively: `@rebasepro/admin` and `@rebasepro/server-postgres`
+ * both depend on it, and nearly every project declares one of them.
+ *
+ * NOT every package the image ships. The image installs the narrow set of
+ * dependencies the runtime itself needs, while the bundle's install resolved
+ * each package's FULL tree — so redirecting a package at the image's copy can
+ * point it at a tree missing something. `@rebasepro/server-postgres` is the
+ * proof: the image's copy has no `chokidar`, and redirecting it took the
+ * database driver down and crash-looped the pod. `@rebasepro/server` is the one
+ * package where the redirect is both necessary (it holds the singleton) and
+ * provably safe (the process is already running from the image's copy).
+ */
+/**
+ * Where the runtime image keeps its own `node_modules`, when there is an image.
+ *
+ * An environment variable, set by the image, rather than something derived from
+ * this module's own location. Deriving it is the obvious approach and it does
+ * not survive the build: `__filename` is undefined in the ESM bundle vite emits,
+ * and `import.meta.url` is a syntax error under the CJS transform the jest
+ * suites use — so any version of this that reads its own path works in exactly
+ * one of the two places it has to.
+ *
+ * Found by booting the built image (`tooling/scripts/check-runtime-image-boots.mjs`),
+ * which is the only thing that runs the artifact this ships as. The unit tests
+ * were green.
+ *
+ * Absent outside a container, where there is no second copy to collapse and
+ * nothing to do.
+ */
+export declare const RUNTIME_MODULES_ENV = "REBASE_RUNTIME_MODULES";
+/**
+ * The packages the runtime image supplies to a fetched bundle.
+ *
+ * Must match `RUNTIME_PROVIDED` in `packages/cli/src/bundle.ts` and in
+ * `infra/docker/entrypoint.mjs`; `tooling/scripts/test/runtime-provided.test.mjs` fails if any
+ * of the three drift. The bundler STRIPS these from a bundle's declared
+ * dependencies on the promise that the image supplies them, so a shorter list
+ * here means the builder removed a dependency that nothing then provides, and
+ * every function and cron importing it fails to load with `Cannot find package`
+ * behind a container that reports itself healthy.
+ *
+ * This list carried only `@rebasepro/server` while the bundler stripped five —
+ * the same four-package gap that broke the non-fetch path, reproduced on the
+ * fetch path because this list was written before that fix and no gate watched
+ * this file.
+ */
+export declare const RUNTIME_PROVIDED_PACKAGES: readonly ["@rebasepro/server", "@rebasepro/types", "@rebasepro/client", "@rebasepro/common", "@rebasepro/utils"];
+/**
+ * Collapse a duplicate framework copy in the bundle onto the image's.
+ *
+ * Node resolves a module's identity by its real path, so replacing the
+ * duplicate with a symlink makes the two one instance again. It is also the
+ * honest version of what was already true: the image's copy is the one that
+ * booted and owns the process, so a bundle pinning a different version was
+ * never running that version — it just carried a second, dead one alongside it.
+ *
+ * Non-fatal by design. A project with no custom functions is unaffected by the
+ * duplicate, and refusing to boot over it would turn a degraded start into no
+ * start at all.
+ *
+ * @param imageModules the runtime image's own `node_modules`. Absent, there is
+ *   nothing to dedupe against and this is a no-op — which is the case in every
+ *   context except a container built from the runtime image.
+ */
+export declare function dedupeRuntimePackages(bundleRoot: string, imageModules: string | undefined): string[];
+/**
+ * Download, unpack and prepare a bundle, returning the directory it landed in.
+ *
+ * Downloads to a file rather than streaming into `tar`, deliberately. A stream
+ * that dies mid-transfer leaves `tar` having successfully extracted a prefix of
+ * the archive and exiting 0 — the half-unpacked bundle this module exists to
+ * refuse. Writing the whole tarball first means a truncated download is caught
+ * by `tar` as a corrupt archive, which is an error.
+ */
 export declare function fetchBundle(options: FetchBundleOptions): Promise<string>;
 /**
  * Find the bundle root inside an unpacked directory.

package/dist/boot/options.d.ts

@@ -1,14 +1,38 @@
 import type { CollectionConfig } from "@rebasepro/types";
-import type { RebaseAuthConfig } from "../init";
-import type { EmailConfig } from "../email";
-import type { RebaseBootEnv } from "./env";
+import type { RebaseAuthConfig } from "../init.js";
+import type { EmailConfig } from "../email/index.js";
+import type { CaptchaConfig } from "../auth/captcha.js";
+import type { RebaseBootEnv } from "./env.js";
 /**
- * Build the email configuration, or `undefined` when no SMTP host is set.
+ * Build the email configuration.
  *
- * Without it the auth adapter still works; password-reset and verification mail
- * simply has nowhere to go, which the auth routes report for themselves.
+ * With `SMTP_HOST`, that is a real SMTP transport. Without it, outside
+ * production, it is the development sink: mail is captured and its links are
+ * printed, so `POST /auth/magic-link` and `POST /auth/forgot-password` complete
+ * on a fresh project instead of answering `503 EMAIL_NOT_CONFIGURED`. The token
+ * was always minted and valid; only delivery was missing.
+ *
+ * Three conditions, all required, none configurable:
+ *
+ *  - no `SMTP_HOST` — a configured mail server always wins;
+ *  - `NODE_ENV` is not `production` — a captured reset mail carries a working
+ *    token, so this must not be reachable there (see `dev-sink.ts`);
+ *  - an absolute `FRONTEND_URL`, or the emailed link has no base and is dead on
+ *    arrival — which is the condition `assertEmailLinkBases` fails the boot on.
+ *
+ * When any of those does not hold this returns `undefined`, exactly as before,
+ * and the auth routes report the missing service for themselves.
  */
 export declare function resolveEmailOptions(env: RebaseBootEnv): EmailConfig | undefined;
+/**
+ * Bot protection from the environment, or `undefined` when it is not configured.
+ *
+ * Both halves are required together. A provider with no secret cannot verify
+ * anything, so it is left off here and `resolveCaptchaVerifier` refuses the boot
+ * if something else turns it on — the one failure this feature must not have is
+ * being silently absent while the config says otherwise.
+ */
+export declare function resolveCaptchaOptions(env: RebaseBootEnv): CaptchaConfig | undefined;
 /**
  * Build the auth configuration from the environment and the bundle's users
  * collection.

package/dist/boot/resource-adapters.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The graph, expressed as the shapes the existing subsystems already take.
+ *
+ * The data layer consumes `DataSourceDefinition[]` and the storage layer
+ * consumes `StorageSourceDefinition[]`, and both work. Nothing about the
+ * resource graph requires rewriting them: the graph is a better *declaration*,
+ * not a different runtime. So it is translated at the boundary, once, and
+ * everything downstream is untouched.
+ *
+ * Doing it the other way round — teaching each subsystem to read the graph —
+ * would have meant touching the pool manager, the storage registry and the
+ * collection resolver to land a config change, which is how a config change
+ * becomes a rewrite and then does not ship.
+ */
+import { type DataSourceDefinition, type ResourceGraph, type StorageSourceDefinition } from "@rebasepro/types";
+/** Databases in the graph, as the data layer's definitions. */
+export declare function graphToDataSources(graph: ResourceGraph): DataSourceDefinition[];
+/** Buckets in the graph, as the storage layer's definitions. */
+export declare function graphToStorageSources(graph: ResourceGraph): StorageSourceDefinition[];
+/** Topics in the graph, for the runtime to publish through and the worker to wire. */
+export declare function graphTopics(graph: ResourceGraph): ResourceGraph["resources"];
+/**
+ * Refuse a config still carrying a replaced key.
+ *
+ * Throws on the first one rather than collecting: unlike a manifest, where a
+ * reader wants every problem at once, this is a single edit per key and the
+ * message is long enough that three of them would bury each other.
+ */
+export declare function assertNoReplacedResourceConfig(config: Record<string, unknown>): void;
+/** The keys this refuses, for a doctor check and for the tests that pin them. */
+export declare function replacedResourceConfigKeys(): string[];

package/dist/boot/resource-loading.d.ts

@@ -0,0 +1,10 @@
+import { type ResourceGraph } from "@rebasepro/types";
+import { type LoadedBundle } from "./bundle.js";
+/**
+ * Evaluate a bundle's resource declarations and return the graph.
+ *
+ * A project with no `resources.ts` is normal and returns whatever the config
+ * index already registered — which for most projects is nothing, and a single
+ * default database is then synthesised downstream exactly as before.
+ */
+export declare function loadBundleResourceGraph(bundle: LoadedBundle): Promise<ResourceGraph>;

package/dist/boot/role.d.ts

@@ -13,8 +13,8 @@
  * a role that quietly runs no scheduler, or two roles that both provision the
  * schema, are failures nothing in a boot log makes obvious.
  */
-import type { RuntimeOwnershipOptions, RuntimeSurfaceOptions } from "../init/surfaces";
-import type { FunctionSelection } from "../functions/selection";
+import type { RuntimeOwnershipOptions, RuntimeSurfaceOptions } from "../init/surfaces.js";
+import type { FunctionSelection } from "../functions/selection.js";
 /** The four shapes a runtime process can boot in. */
 export type RebaseRuntimeRole = "all" | "api" | "functions" | "worker";
 /** Everything a role decides, resolved. */
@@ -34,6 +34,7 @@ export interface RoleEnv {
     REBASE_ROLE?: RebaseRuntimeRole;
     REBASE_CRON_SCHEDULER?: boolean;
     REBASE_JOB_WORKERS?: boolean;
+    REBASE_RLS_AUDIT?: boolean;
     REBASE_MIGRATE_ON_BOOT?: "none" | "ensure" | "push" | "";
     REBASE_FUNCTIONS_ONLY?: string;
     REBASE_FUNCTIONS_EXCLUDE?: string;

package/dist/boot/sources.d.ts

@@ -1,5 +1,5 @@
 import { type DataSourceDefinition, type StorageSourceDefinition } from "@rebasepro/types";
-import type { BackendStorageConfig } from "../storage/types";
+import type { BackendStorageConfig } from "../storage/types.js";
 /**
  * Resolving *named* data and storage sources from the environment.
  *
@@ -79,7 +79,13 @@ export declare function resolveDataSources(env: EnvBag, definitions: DataSourceD
  * once, in `initializeStorage`, which logs precisely why storage is disabled.
  * Duplicating it would mean two places to keep in agreement.
  */
-export declare function resolveStorageBackend(env: EnvBag, key: string, engineHint: string | undefined, defaultBasePath: string): BackendStorageConfig | undefined;
+export declare function resolveStorageBackend(env: EnvBag, key: string, engineHint: string | undefined, defaultBasePath: string, 
+/**
+ * The credential set this source shares, from its declaration. Only the
+ * account-scoped bindings — the ones describing the provider rather than the
+ * bucket — consult it. See `StorageSourceDefinition.account`.
+ */
+accountHint?: string): BackendStorageConfig | undefined;
 /**
  * Resolve every server-transport storage source into a controller config map.
  *

package/dist/boot/version-skew.d.ts

@@ -87,7 +87,7 @@ export declare function readPackageVersion(packageDir: string): string | undefin
  * The version of `@rebasepro/server` this deployment is actually running.
  *
  * Resolved from the same roots the drivers are, and that is the point rather
- * than a convenience. In a managed container `docker/entrypoint.mjs` replaces
+ * than a convenience. In a managed container `infra/docker/entrypoint.mjs` replaces
  * `/bundle/node_modules/@rebasepro/server` with a link to the image's copy, so
  * reading the manifest *through the bundle* reports the version that will
  * really execute — which is exactly the number the driver has to be compared

package/dist/collections/BackendCollectionRegistry.d.ts

@@ -1,5 +1,5 @@
 import { CollectionRegistry } from "@rebasepro/common";
-import { CollectionRegistryInterface } from "../db/interfaces";
+import { CollectionRegistryInterface } from "../db/interfaces.js";
 /**
  * Backend-agnostic collection registry.
  * Satisfies CollectionRegistryInterface through inheritance from CollectionRegistry.

package/dist/collections/loader.d.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, SecurityRule } from "@rebasepro/types";
-import { type ValidateCollectionConfigOptions } from "./validate-config";
+import { type ValidateCollectionConfigOptions } from "./validate-config.js";
 /**
  * The one definition of "the collections".
  *

package/dist/collections/validate-config.d.ts

@@ -33,6 +33,19 @@
 export type UnknownKeyPolicy = "warn" | "error" | "off";
 export interface ConfigProblem {
     severity: "error" | "warning";
+    /**
+     * What kind of wrong this is, because the two read very differently and the
+     * remedies differ.
+     *
+     * - `"key"` — a key this version does not read, whether renamed, removed or
+     *   simply unrecognised. The feature it configures is absent; the config is
+     *   otherwise coherent. `REBASE_STRICT_COLLECTION_CONFIG` governs how loud
+     *   the unrecognised half of this is.
+     * - `"incoherent"` — every key is recognised and the *combination* cannot do
+     *   what it says. That policy has no bearing on these, and saying it did
+     *   sent people to an environment variable that would not have helped.
+     */
+    kind: "key" | "incoherent";
     /** Dotted path into the config, e.g. `posts.properties.author`. */
     path: string;
     message: string;

package/dist/{contract-routes-DZ-LBpSL.js → contract-routes-D8TvxPLo.js}

@@ -1,9 +1,10 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import "./src-CrCxd8km.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import "./src-Cdsw7DqV.js";
+import { t as logger } from "./logger-DS03e908.js";
 import { Hono } from "hono";
 //#region ../types/src/types/project_manifest.ts
 /** Header carrying the schema version an SDK was generated from. */
@@ -261,4 +262,4 @@ function createContractRoutes(config) {
 //#endregion
 export { createContractRoutes as n, computeSchemaVersion as r, contract_routes_exports as t };
 
-//# sourceMappingURL=contract-routes-DZ-LBpSL.js.map
+//# sourceMappingURL=contract-routes-D8TvxPLo.js.map