@rebasepro/server 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/email/types.d.ts

@@ -2,12 +2,12 @@
  * Email service types and interfaces.
  *
  * The canonical `EmailService` and `EmailSendOptions` live in `@rebasepro/types`
- * so they can be used on the `RebaseClient` interface without pulling in nodemailer.
- * This file re-exports them for backward compatibility and adds server-specific
- * config types (SMTP, template functions, etc.).
+ * so they can be used on the `RebaseClient` interface without pulling in
+ * nodemailer. This module re-exports them beside the server-only config types
+ * (SMTP, template functions, …), so a backend imports one module, not two.
  */
-import type { EmailService, EmailSendOptions } from "@rebasepro/types";
-export type { EmailService, EmailSendOptions };
+import type { EmailService, EmailSendOptions, EmailSendResult } from "@rebasepro/types";
+export type { EmailService, EmailSendOptions, EmailSendResult };
 /**
  * SMTP server configuration
  */
@@ -76,6 +76,17 @@ export type MagicLinkTemplateFunction = (magicLinkUrl: string, user: {
     html: string;
     text?: string;
 };
+/**
+ * Template function for one-time sign-in code emails
+ */
+export type EmailOtpTemplateFunction = (code: string, user: {
+    email: string;
+    displayName?: string | null;
+}) => {
+    subject: string;
+    html: string;
+    text?: string;
+};
 /**
  * Complete email configuration
  */
@@ -92,7 +103,7 @@ export interface EmailConfig {
      * Alternative: custom function to send emails
      * Use this for custom email providers (AWS SES SDK, Resend, etc.)
      */
-    sendEmail?: (options: EmailSendOptions) => Promise<void>;
+    sendEmail?: (options: EmailSendOptions) => Promise<EmailSendResult | void>;
     /**
      * Base URL for password reset links (e.g., "https://myapp.com")
      * The reset link will be: {baseUrl}/reset-password?token={token}
@@ -146,5 +157,6 @@ export interface EmailConfig {
         userInvitation?: UserInvitationTemplateFunction;
         welcomeEmail?: WelcomeEmailTemplateFunction;
         magicLink?: MagicLinkTemplateFunction;
+        emailOtp?: EmailOtpTemplateFunction;
     };
 }

package/dist/env.d.ts

@@ -5,8 +5,8 @@ import { z } from "zod";
 declare const rebaseEnvSchema: z.ZodObject<{
     NODE_ENV: z.ZodDefault<z.ZodEnum<{
         production: "production";
-        development: "development";
         test: "test";
+        development: "development";
     }>>;
     PORT: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
     DATABASE_URL: z.ZodString;

package/dist/{errors-EBYiaJ2E.js → errors-DBwpj9N8.js}

@@ -1,7 +1,8 @@
-import { createRequire as __createRequire } from "module";
-import process from "process";
-__createRequire(import.meta.url);
-import { t as logger } from "./logger-DfvF_8r-.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { r as hostEnv, t as logger } from "./logger-DS03e908.js";
 //#region src/api/errors.ts
 /** Tracks whether we've already shown the doctor hint (once per process). */
 var _schemaDriftHinted = false;
@@ -156,7 +157,7 @@ var errorHandler = (err, c) => {
 	const isDbSchemaMismatch = code === "SCHEMA_DRIFT";
 	if (isDbSchemaMismatch) {
 		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
-		if (!_schemaDriftHinted && process.env.NODE_ENV !== "production") {
+		if (!_schemaDriftHinted && hostEnv().NODE_ENV !== "production") {
 			_schemaDriftHinted = true;
 			logger.warn([
 				"",
@@ -187,7 +188,7 @@ var errorHandler = (err, c) => {
 	else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
 	const dbDetails = dbError ? {
 		dbCode: dbError.code,
-		...process.env.NODE_ENV !== "production" && {
+		...hostEnv().NODE_ENV !== "production" && {
 			dbMessage: dbError.message,
 			...dbError.detail && { detail: dbError.detail },
 			...dbError.hint && { hint: dbError.hint }
@@ -227,4 +228,4 @@ function codeToStatus(code) {
 //#endregion
 export { errorHandler as n, ApiError as t };
 
-//# sourceMappingURL=errors-EBYiaJ2E.js.map
+//# sourceMappingURL=errors-DBwpj9N8.js.map

package/dist/errors-DBwpj9N8.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors-DBwpj9N8.js","names":[],"sources":["../src/api/errors.ts"],"sourcesContent":["import type { ErrorHandler } from \"hono\";\nimport type { ContentfulStatusCode } from \"hono/utils/http-status\";\nimport type { HonoEnv } from \"./types\";\nimport { logger } from \"../utils/logger\";\nimport { hostEnv } from \"../utils/host\";\n\n/** Tracks whether we've already shown the doctor hint (once per process). */\nlet _schemaDriftHinted = false;\n\n/** Shape of Postgres / network errors with diagnostic codes */\ninterface PgLikeError {\n    code?: string;\n    address?: string;\n    port?: number;\n    message?: string;\n    table?: string;\n    column?: string;\n    schema?: string;\n    detail?: string;\n    hint?: string;\n    constraint?: string;\n}\n\n/** 5-character SQLSTATE, e.g. `42501`, `23505`. */\nconst SQLSTATE_RE = /^[0-9A-Z]{5}$/;\n\n/**\n * Walk the cause chain for the underlying database error, identified by a\n * 5-char SQLSTATE `code`. Drizzle wraps the pg error in `.cause`, and route\n * code sometimes wraps drizzle again, so the real error may sit several\n * levels down.\n */\nfunction extractDbError(error: unknown, depth = 0): PgLikeError | null {\n    if (!error || typeof error !== \"object\" || depth > 8) return null;\n    const e = error as PgLikeError & { cause?: unknown };\n    if (typeof e.code === \"string\" && SQLSTATE_RE.test(e.code)) return e;\n    if (e.cause && typeof e.cause === \"object\") return extractDbError(e.cause, depth + 1);\n    return null;\n}\n\n/**\n * Extract the missing table or column name from a PG error.\n * PG 42P01 messages look like: 'relation \"my_table\" does not exist'\n * PG 42703 messages look like: 'column \"my_col\" does not exist' or 'column my_table.my_col does not exist'\n */\nfunction extractMissingIdentifier(pgMessage?: string): string | null {\n    if (!pgMessage) return null;\n    // Match quoted identifier: relation \"xxx\" / column \"xxx\"\n    const quoted = pgMessage.match(/(?:relation|column|table)\\s+\"([^\"]+)\"/i);\n    if (quoted) return quoted[1];\n    // Match unquoted: column table.col does not exist\n    const unquoted = pgMessage.match(/(?:relation|column|table)\\s+([\\w.]+)\\s+does not exist/i);\n    if (unquoted) return unquoted[1];\n    return null;\n}\n\n/**\n * Standardized API error class.\n * Throw this from any route handler — the errorHandler middleware\n * will format it into `{ error: { message, code, details? } }`.\n */\nexport class ApiError extends Error {\n    public readonly statusCode: number;\n    public readonly code: string;\n    public readonly details?: unknown;\n    /**\n     * Whether this outcome is a routine part of normal operation rather than\n     * something an operator should look at. Expected errors log at debug; every\n     * other operational error logs at warn.\n     *\n     * The motivating case is `POST /auth/refresh` with no session: clients\n     * refresh on page load before they know whether one exists, so every\n     * anonymous page view is a 401 — correct, and not worth a warning line.\n     *\n     * The other class is a caller-caused 4xx that never reached the database: a\n     * mistyped filter operator, sort direction or limit, a request for a\n     * collection that does not exist. Nothing on this server is wrong, and the\n     * response body has already told the caller what to fix — while one client\n     * holding a stale name would otherwise write a warning per request, forever,\n     * until the level means nothing. See `api/rest/query-parser.ts`.\n     *\n     * What stays at warn is anything that says something about the *server*:\n     * a schema that has drifted from the code, a permission the database\n     * refused, a dependency that failed. Those are 4xx too, and they are still\n     * incidents.\n     */\n    public readonly expected: boolean;\n\n    constructor(statusCode: number, code: string, message: string, details?: unknown, expected = false) {\n        super(message);\n        this.name = \"ApiError\";\n        this.statusCode = statusCode;\n        this.code = code;\n        this.details = details;\n        this.expected = expected;\n    }\n\n    // ── Factory methods ──────────────────────────────────────────────\n\n    static badRequest(message: string, code = \"BAD_REQUEST\", details?: unknown): ApiError {\n        return new ApiError(400, code, message, details);\n    }\n\n    static unauthorized(message: string, code = \"UNAUTHORIZED\"): ApiError {\n        return new ApiError(401, code, message);\n    }\n\n    /**\n     * A 401 that is a normal outcome, not an incident — logged at debug.\n     * See {@link ApiError.expected}.\n     */\n    static unauthenticated(message: string, code = \"UNAUTHORIZED\"): ApiError {\n        return new ApiError(401, code, message, undefined, true);\n    }\n\n    static forbidden(message: string, code = \"FORBIDDEN\"): ApiError {\n        return new ApiError(403, code, message);\n    }\n\n    static notFound(message: string, code = \"NOT_FOUND\"): ApiError {\n        return new ApiError(404, code, message);\n    }\n\n    static conflict(message: string, code = \"CONFLICT\"): ApiError {\n        return new ApiError(409, code, message);\n    }\n\n    static internal(message: string, code = \"INTERNAL_ERROR\"): ApiError {\n        return new ApiError(500, code, message);\n    }\n\n    static serviceUnavailable(message: string, code = \"SERVICE_UNAVAILABLE\"): ApiError {\n        return new ApiError(503, code, message);\n    }\n}\n\n/**\n * Canonical error response shape:\n * `{ error: { message: string, code: string, details?: unknown } }`\n */\nexport interface ErrorResponse {\n    error: {\n        message: string;\n        code: string;\n        details?: unknown;\n        /** Request correlation ID for tracing (echoes X-Request-ID). */\n        requestId?: string;\n    };\n}\n\n/**\n * General shape of errors that flow through the API error handler.\n * Extends Error with optional HTTP status, error code, and details.\n */\nexport interface RebaseApiError extends Error {\n    statusCode?: number;\n    code?: string;\n    details?: unknown;\n}\n\n// `isRebaseApiError` was here. It read `return error instanceof Error`, so it\n// answered yes to every error while being named and used as though it\n// discriminated — the create and update handlers guarded a \"classify this as\n// BAD_REQUEST\" branch on it, and an unreachable database was therefore reported\n// to callers as a bad request. Deleted rather than repaired: the shape it\n// claimed to test is not decidable from an `Error`, and the layer that does\n// know — the driver, which holds the SQLSTATE — raises a real `ApiError`.\n\n/**\n * Hono error-handling middleware (`app.onError`).\n * Converts any error into the canonical `{ error: { message, code } }` shape.\n */\nexport const errorHandler: ErrorHandler<HonoEnv> = (err, c) => {\n    // Typecast custom error properties\n    const error: RebaseApiError = err;\n    const reqId = typeof c.get === \"function\" ? c.get(\"requestId\") : undefined;\n\n    if (error instanceof ApiError || error.name === \"ApiError\") {\n        // Operational errors — log at warn, unless the error declares itself a\n        // routine outcome (see ApiError.expected), which would otherwise put a\n        // warning in the log for every anonymous page view.\n        const expected = error instanceof ApiError && error.expected;\n        const line = `[API] ${c.req.method} ${c.req.path} → ${error.statusCode} ${error.code}: ${error.message}` +\n            (reqId ? ` [${reqId}]` : \"\");\n        if (expected) {\n            logger.debug(line);\n        } else {\n            logger.warn(`⚠️ ${line}`);\n        }\n        return c.json({\n            error: {\n                message: error.message,\n                code: error.code || \"INTERNAL_ERROR\",\n                ...(error.details !== undefined && { details: error.details }),\n                ...(reqId && { requestId: reqId })\n            }\n        } satisfies ErrorResponse, (error.statusCode || 500) as ContentfulStatusCode);\n    }\n\n    const statusCode = error.statusCode || codeToStatus(error.code) || 500;\n    let code = error.code || \"INTERNAL_ERROR\";\n\n    // Handle DB connection and specific system errors for better logging\n    let logMessage = error.message;\n\n    // Resolve the actual cause — Node's net module wraps dual-stack failures\n    // in an AggregateError whose inner errors carry the real address/port.\n    let resolvedCause: PgLikeError | undefined;\n    if (error.cause && typeof error.cause === \"object\" && error.cause !== null && \"code\" in error.cause) {\n        const cause = error.cause as PgLikeError & { errors?: PgLikeError[] };\n        if (cause.code === \"ECONNREFUSED\" && !cause.address && Array.isArray(cause.errors)) {\n            // AggregateError — pick the first inner error that has address info\n            resolvedCause = cause.errors.find(e => e.address) || cause;\n        } else {\n            resolvedCause = cause;\n        }\n    }\n\n    // The real database error may sit several levels down the cause chain.\n    // Losing it turns a precise failure (e.g. an RLS denial) into an opaque\n    // \"Failed query: …\" 500 that is undiagnosable without direct DB access.\n    const dbError = extractDbError(error);\n\n    if (resolvedCause && (resolvedCause.code === \"ENETUNREACH\" || resolvedCause.code === \"ECONNREFUSED\")) {\n        const cause = resolvedCause;\n        if (cause.code === \"ENETUNREACH\") {\n            logMessage = `Network unreachable. Cannot connect to database at ${cause.address}:${cause.port}.`;\n        } else {\n            logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;\n        }\n    } else if (\"code\" in error && error.code === \"ENETUNREACH\") {\n         const netErr = error as PgLikeError;\n         logMessage = `Network unreachable. Cannot connect to service at ${netErr.address}:${netErr.port}.`;\n    } else if (dbError && (dbError.code === \"42703\" || dbError.code === \"42P01\")) {\n        code = \"SCHEMA_DRIFT\";\n        const issue = dbError.code === \"42703\" ? \"column\" : \"table\";\n        const identifier = dbError.table || dbError.column || extractMissingIdentifier(dbError.message) || \"unknown\";\n        logMessage = `Schema drift: ${issue} \"${identifier}\" does not exist in the database. Run \\`pnpm db:push\\` to sync your schema, or \\`pnpm db:migrate\\` to apply pending migrations.`;\n    } else if (dbError) {\n        const parts = [`[PG ${dbError.code}] ${dbError.message}`];\n        if (dbError.detail) parts.push(`Detail: ${dbError.detail}`);\n        if (dbError.hint) parts.push(`Hint: ${dbError.hint}`);\n        if (dbError.table) parts.push(`Table: ${dbError.table}`);\n        if (dbError.column) parts.push(`Column: ${dbError.column}`);\n        if (dbError.constraint) parts.push(`Constraint: ${dbError.constraint}`);\n        if (dbError.code === \"42501\") {\n            code = \"DB_PERMISSION_DENIED\";\n            parts.push(\n                \"The database rejected the statement for lack of privilege — usually a row-level \" +\n                `security policy${dbError.table ? ` on \"${dbError.table}\"` : \"\"} denying this role, ` +\n                \"or a stale FORCE ROW LEVEL SECURITY flag binding the owner connection.\"\n            );\n        }\n        logMessage = parts.join(\". \");\n    }\n\n    const isDbSchemaMismatch = code === \"SCHEMA_DRIFT\";\n\n    if (isDbSchemaMismatch) {\n        // Database schema mismatch is logged as a warning instead of a fatal error\n        logger.warn(\n            `⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` +\n            (reqId ? ` [${reqId}]` : \"\")\n        );\n        // In dev mode, show a one-time hint to run `rebase doctor`\n        if (!_schemaDriftHinted && hostEnv().NODE_ENV !== \"production\") {\n            _schemaDriftHinted = true;\n            logger.warn([\n                \"\",\n                \"┌──────────────────────────────────────────────────────────────┐\",\n                \"│  💡 TIP: Run `rebase doctor` for full schema diagnostics    │\",\n                \"│                                                             │\",\n                \"│  Quick fixes (local dev, against DATABASE_URL):             │\",\n                \"│    pnpm db:push      sync schema to database (dev)          │\",\n                \"│    pnpm db:migrate   generate + apply migration (prod)      │\",\n                \"│    rebase doctor     full 3-way drift report                │\",\n                \"│                                                             │\",\n                \"│  Managed cloud: the runtime applies schema + RLS at boot    │\",\n                \"│  (REBASE_MIGRATE_ON_BOOT); redeploy rather than db:push,    │\",\n                \"│  which cannot reach the tenant database.                    │\",\n                \"└──────────────────────────────────────────────────────────────┘\",\n                \"\"\n            ].join(\"\\n\"));\n        }\n    } else {\n        // Unexpected errors — log at error level\n        logger.error(\n            `❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` +\n            (reqId ? ` [${reqId}]` : \"\")\n        );\n    }\n\n    // Suppress the huge stack trace for known DB errors: it is noisy, and the\n    // extracted [PG …] line above carries the signal. The SQL and the bound\n    // params it used to leak are no longer this branch's problem — `logger`\n    // strips Drizzle's `Failed query: … / params: …` wrapper out of every\n    // message and stack it emits, so the fallbacks below (a connection dropped\n    // mid-statement carries no SQLSTATE, so `dbError` is null and the stack is\n    // logged) are covered too.\n    const suppressStack = isDbSchemaMismatch || dbError !== null || (statusCode < 500 && code === \"BAD_REQUEST\");\n    if (!suppressStack) {\n        logger.error(String(error.stack || error));\n    }\n\n    // Sanitize the message for the client to prevent leaking sensitive details\n    // like SQL queries or internal IP addresses.\n    let clientMessage = \"An unexpected error occurred\";\n    if (statusCode < 500 && error.message) {\n        // If it's a 4xx error (e.g. from validation), it's generally safe to send the message\n        clientMessage = error.message;\n    } else if (error instanceof ApiError || error.name === \"ApiError\") {\n        // We already handled ApiError above, but just in case\n        clientMessage = error.message;\n    } else if (code === \"SCHEMA_DRIFT\") {\n        const pgErr = dbError || (error as PgLikeError);\n        const issue = pgErr.code === \"42703\" ? \"column\" : \"table\";\n        const identifier = pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || \"unknown\";\n        clientMessage = `Schema drift: ${issue} \"${identifier}\" does not exist. Run \\`pnpm db:push\\` to sync your schema.`;\n    } else if (code === \"DB_PERMISSION_DENIED\") {\n        clientMessage = `Permission denied by the database${dbError?.table ? ` on \"${dbError.table}\"` : \"\"} (row-level security). Check the RLS policies for this table.`;\n    } else if (code === \"INTERNAL_ERROR\") {\n        clientMessage = \"Internal Server Error\";\n    }\n\n    // Database diagnostics for the envelope: the SQLSTATE is always safe to\n    // return; message/detail/hint can reference schema internals, so only\n    // outside production.\n    const dbDetails = dbError ? {\n        dbCode: dbError.code,\n        ...(hostEnv().NODE_ENV !== \"production\" && {\n            dbMessage: dbError.message,\n            ...(dbError.detail && { detail: dbError.detail }),\n            ...(dbError.hint && { hint: dbError.hint })\n        })\n    } : undefined;\n\n    return c.json({\n        error: {\n            message: clientMessage,\n            code,\n            ...(error.details !== undefined\n                ? { details: error.details }\n                : dbDetails !== undefined ? { details: dbDetails } : {}),\n            ...(reqId && { requestId: reqId })\n        }\n    } satisfies ErrorResponse, statusCode as ContentfulStatusCode);\n};\n\n/**\n * Map known error codes to HTTP status codes.\n */\nfunction codeToStatus(code?: string): number | undefined {\n    if (!code) return undefined;\n    const map: Record<string, number> = {\n        BAD_REQUEST: 400,\n        INVALID_INPUT: 400,\n        WEAK_PASSWORD: 400,\n        UNAUTHORIZED: 401,\n        INVALID_CREDENTIALS: 401,\n        INVALID_TOKEN: 401,\n        FORBIDDEN: 403,\n        NOT_FOUND: 404,\n        CONFLICT: 409,\n        EMAIL_EXISTS: 409,\n        ROLE_EXISTS: 409,\n        SCHEMA_DRIFT: 500,\n        DB_PERMISSION_DENIED: 500,\n        INTERNAL_ERROR: 500,\n        NOT_CONFIGURED: 503,\n        SERVICE_UNAVAILABLE: 503\n    };\n    return map[code];\n}\n\n\n"],"mappings":";;;;;;;AAOA,IAAI,qBAAqB;;AAiBzB,IAAM,cAAc;;;;;;;AAQpB,SAAS,eAAe,OAAgB,QAAQ,GAAuB;CACnE,IAAI,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,GAAG,OAAO;CAC7D,MAAM,IAAI;CACV,IAAI,OAAO,EAAE,SAAS,YAAY,YAAY,KAAK,EAAE,IAAI,GAAG,OAAO;CACnE,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAAU,OAAO,eAAe,EAAE,OAAO,QAAQ,CAAC;CACpF,OAAO;AACX;;;;;;AAOA,SAAS,yBAAyB,WAAmC;CACjE,IAAI,CAAC,WAAW,OAAO;CAEvB,MAAM,SAAS,UAAU,MAAM,wCAAwC;CACvE,IAAI,QAAQ,OAAO,OAAO;CAE1B,MAAM,WAAW,UAAU,MAAM,wDAAwD;CACzF,IAAI,UAAU,OAAO,SAAS;CAC9B,OAAO;AACX;;;;;;AAOA,IAAa,WAAb,MAAa,iBAAiB,MAAM;CAChC;CACA;CACA;;;;;;;;;;;;;;;;;;;;;;CAsBA;CAEA,YAAY,YAAoB,MAAc,SAAiB,SAAmB,WAAW,OAAO;EAChG,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,aAAa;EAClB,KAAK,OAAO;EACZ,KAAK,UAAU;EACf,KAAK,WAAW;CACpB;CAIA,OAAO,WAAW,SAAiB,OAAO,eAAe,SAA6B;EAClF,OAAO,IAAI,SAAS,KAAK,MAAM,SAAS,OAAO;CACnD;CAEA,OAAO,aAAa,SAAiB,OAAO,gBAA0B;EAClE,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;;;;;CAMA,OAAO,gBAAgB,SAAiB,OAAO,gBAA0B;EACrE,OAAO,IAAI,SAAS,KAAK,MAAM,SAAS,KAAA,GAAW,IAAI;CAC3D;CAEA,OAAO,UAAU,SAAiB,OAAO,aAAuB;EAC5D,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,SAAS,SAAiB,OAAO,aAAuB;EAC3D,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,SAAS,SAAiB,OAAO,YAAsB;EAC1D,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,SAAS,SAAiB,OAAO,kBAA4B;EAChE,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;CAEA,OAAO,mBAAmB,SAAiB,OAAO,uBAAiC;EAC/E,OAAO,IAAI,SAAS,KAAK,MAAM,OAAO;CAC1C;AACJ;;;;;AAsCA,IAAa,gBAAuC,KAAK,MAAM;CAE3D,MAAM,QAAwB;CAC9B,MAAM,QAAQ,OAAO,EAAE,QAAQ,aAAa,EAAE,IAAI,WAAW,IAAI,KAAA;CAEjE,IAAI,iBAAiB,YAAY,MAAM,SAAS,YAAY;EAIxD,MAAM,WAAW,iBAAiB,YAAY,MAAM;EACpD,MAAM,OAAO,SAAS,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,MAAM,WAAW,GAAG,MAAM,KAAK,IAAI,MAAM,aAC1F,QAAQ,KAAK,MAAM,KAAK;EAC7B,IAAI,UACA,OAAO,MAAM,IAAI;OAEjB,OAAO,KAAK,MAAM,MAAM;EAE5B,OAAO,EAAE,KAAK,EACV,OAAO;GACH,SAAS,MAAM;GACf,MAAM,MAAM,QAAQ;GACpB,GAAI,MAAM,YAAY,KAAA,KAAa,EAAE,SAAS,MAAM,QAAQ;GAC5D,GAAI,SAAS,EAAE,WAAW,MAAM;EACpC,EACJ,GAA4B,MAAM,cAAc,GAA4B;CAChF;CAEA,MAAM,aAAa,MAAM,cAAc,aAAa,MAAM,IAAI,KAAK;CACnE,IAAI,OAAO,MAAM,QAAQ;CAGzB,IAAI,aAAa,MAAM;CAIvB,IAAI;CACJ,IAAI,MAAM,SAAS,OAAO,MAAM,UAAU,YAAY,MAAM,UAAU,QAAQ,UAAU,MAAM,OAAO;EACjG,MAAM,QAAQ,MAAM;EACpB,IAAI,MAAM,SAAS,kBAAkB,CAAC,MAAM,WAAW,MAAM,QAAQ,MAAM,MAAM,GAE7E,gBAAgB,MAAM,OAAO,MAAK,MAAK,EAAE,OAAO,KAAK;OAErD,gBAAgB;CAExB;CAKA,MAAM,UAAU,eAAe,KAAK;CAEpC,IAAI,kBAAkB,cAAc,SAAS,iBAAiB,cAAc,SAAS,iBAAiB;EAClG,MAAM,QAAQ;EACd,IAAI,MAAM,SAAS,eACf,aAAa,sDAAsD,MAAM,QAAQ,GAAG,MAAM,KAAK;OAE/F,aAAa,qCAAqC,MAAM,QAAQ,GAAG,MAAM,KAAK;CAEtF,OAAO,IAAI,UAAU,SAAS,MAAM,SAAS,eAAe;EACvD,MAAM,SAAS;EACf,aAAa,qDAAqD,OAAO,QAAQ,GAAG,OAAO,KAAK;CACrG,OAAO,IAAI,YAAY,QAAQ,SAAS,WAAW,QAAQ,SAAS,UAAU;EAC1E,OAAO;EAGP,aAAa,iBAFC,QAAQ,SAAS,UAAU,WAAW,QAEhB,IADjB,QAAQ,SAAS,QAAQ,UAAU,yBAAyB,QAAQ,OAAO,KAAK,UAChD;CACvD,OAAO,IAAI,SAAS;EAChB,MAAM,QAAQ,CAAC,OAAO,QAAQ,KAAK,IAAI,QAAQ,SAAS;EACxD,IAAI,QAAQ,QAAQ,MAAM,KAAK,WAAW,QAAQ,QAAQ;EAC1D,IAAI,QAAQ,MAAM,MAAM,KAAK,SAAS,QAAQ,MAAM;EACpD,IAAI,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,OAAO;EACvD,IAAI,QAAQ,QAAQ,MAAM,KAAK,WAAW,QAAQ,QAAQ;EAC1D,IAAI,QAAQ,YAAY,MAAM,KAAK,eAAe,QAAQ,YAAY;EACtE,IAAI,QAAQ,SAAS,SAAS;GAC1B,OAAO;GACP,MAAM,KACF,kGACkB,QAAQ,QAAQ,QAAQ,QAAQ,MAAM,KAAK,GAAG,2FAEpE;EACJ;EACA,aAAa,MAAM,KAAK,IAAI;CAChC;CAEA,MAAM,qBAAqB,SAAS;CAEpC,IAAI,oBAAoB;EAEpB,OAAO,KACH,YAAY,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,WAAW,GAAG,KAAK,IAAI,gBAClE,QAAQ,KAAK,MAAM,KAAK,GAC7B;EAEA,IAAI,CAAC,sBAAsB,QAAQ,CAAC,CAAC,aAAa,cAAc;GAC5D,qBAAqB;GACrB,OAAO,KAAK;IACR;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;IACA;GACJ,CAAC,CAAC,KAAK,IAAI,CAAC;EAChB;CACJ,OAEI,OAAO,MACH,WAAW,EAAE,IAAI,OAAO,GAAG,EAAE,IAAI,KAAK,KAAK,WAAW,GAAG,KAAK,IAAI,gBACjE,QAAQ,KAAK,MAAM,KAAK,GAC7B;CAWJ,IAAI,EADkB,sBAAsB,YAAY,QAAS,aAAa,OAAO,SAAS,gBAE1F,OAAO,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC;CAK7C,IAAI,gBAAgB;CACpB,IAAI,aAAa,OAAO,MAAM,SAE1B,gBAAgB,MAAM;MACnB,IAAI,iBAAiB,YAAY,MAAM,SAAS,YAEnD,gBAAgB,MAAM;MACnB,IAAI,SAAS,gBAAgB;EAChC,MAAM,QAAQ,WAAY;EAG1B,gBAAgB,iBAFF,MAAM,SAAS,UAAU,WAAW,QAEX,IADpB,MAAM,SAAS,MAAM,UAAU,yBAAyB,MAAM,WAAW,MAAM,OAAO,KAAK,UACxD;CAC1D,OAAO,IAAI,SAAS,wBAChB,gBAAgB,oCAAoC,SAAS,QAAQ,QAAQ,QAAQ,MAAM,KAAK,GAAG;MAChG,IAAI,SAAS,kBAChB,gBAAgB;CAMpB,MAAM,YAAY,UAAU;EACxB,QAAQ,QAAQ;EAChB,GAAI,QAAQ,CAAC,CAAC,aAAa,gBAAgB;GACvC,WAAW,QAAQ;GACnB,GAAI,QAAQ,UAAU,EAAE,QAAQ,QAAQ,OAAO;GAC/C,GAAI,QAAQ,QAAQ,EAAE,MAAM,QAAQ,KAAK;EAC7C;CACJ,IAAI,KAAA;CAEJ,OAAO,EAAE,KAAK,EACV,OAAO;EACH,SAAS;EACT;EACA,GAAI,MAAM,YAAY,KAAA,IAChB,EAAE,SAAS,MAAM,QAAQ,IACzB,cAAc,KAAA,IAAY,EAAE,SAAS,UAAU,IAAI,CAAC;EAC1D,GAAI,SAAS,EAAE,WAAW,MAAM;CACpC,EACJ,GAA2B,UAAkC;AACjE;;;;AAKA,SAAS,aAAa,MAAmC;CACrD,IAAI,CAAC,MAAM,OAAO,KAAA;CAmBlB,OAAO;EAjBH,aAAa;EACb,eAAe;EACf,eAAe;EACf,cAAc;EACd,qBAAqB;EACrB,eAAe;EACf,WAAW;EACX,WAAW;EACX,UAAU;EACV,cAAc;EACd,aAAa;EACb,cAAc;EACd,sBAAsB;EACtB,gBAAgB;EAChB,gBAAgB;EAChB,qBAAqB;CAElB,EAAI;AACf"}

package/dist/{function-loader-DDS1v7YX.js → function-loader-LLdmBFoL.js}

@@ -1,9 +1,10 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
-import { t as logger } from "./logger-DfvF_8r-.js";
-import { t as nativeDynamicImport } from "./dynamic-import-Dvh-K5fl.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { t as logger } from "./logger-DS03e908.js";
+import { t as nativeDynamicImport } from "./dynamic-import-X40pTZUQ.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 import { pathToFileURL } from "url";
@@ -134,6 +135,6 @@ function isHonoLike(obj) {
 	return typeof record.fetch === "function" && Array.isArray(record.routes);
 }
 //#endregion
-export { loadFunctionsFromDirectory as n, function_loader_exports as t };
+export { loadFunctionsFromDirectory as n, loadFunctionsWithDiagnostics as r, function_loader_exports as t };
 
-//# sourceMappingURL=function-loader-DDS1v7YX.js.map
+//# sourceMappingURL=function-loader-LLdmBFoL.js.map

package/dist/{function-loader-DDS1v7YX.js.map → function-loader-LLdmBFoL.js.map}

@@ -1 +1 @@
-{"version":3,"file":"function-loader-DDS1v7YX.js","names":[],"sources":["../src/functions/function-loader.ts"],"sourcesContent":["import * as fs from \"fs\";\nimport * as path from \"path\";\nimport { pathToFileURL } from \"url\";\nimport { Hono } from \"hono\";\nimport { logger } from \"../utils/logger.js\";\nimport { nativeDynamicImport, type ModuleImporter } from \"../utils/dynamic-import.js\";\n\nexport interface LoadedFunction {\n    /** Endpoint name derived from filename (e.g., \"send-invoice\") */\n    name: string;\n    /** The Hono sub-app to mount */\n    app: Hono<import(\"hono\").Env>;\n}\n\n/** What a directory of function files produced: what mounted, and what did not. */\nexport interface LoadedFunctions {\n    /** The functions that will be served. */\n    functions: LoadedFunction[];\n    /**\n     * One entry per file the loader saw and did **not** mount, each already\n     * phrased as `<name> (<reason>)`. Returned rather than only logged so the\n     * running server can say what is missing — a boot log line is not reachable\n     * from `GET /api/functions`.\n     */\n    problems: string[];\n}\n\n/**\n * Extensions the bundler compiles (or a developer might reasonably write) that\n * this loader cannot import. `rebase build` globs `functions/**\\/*.ts`, so the\n * build's idea of \"a function file\" is strictly wider than the runtime's — the\n * worst direction for a mismatch to go. Anything listed here is reported as a\n * problem instead of vanishing; non-code files (`.md`, `.json`, `.txt`) stay\n * silent, because a README next to your functions is not a mistake.\n */\nconst UNSUPPORTED_CODE_EXTENSIONS = [\".mts\", \".cts\", \".tsx\", \".jsx\", \".mjs\", \".cjs\"];\n\n/**\n * Auto-discover Hono route files from a directory.\n *\n * Each file should default-export a Hono app (or router).\n * The filename (without extension) becomes the mount path:\n *   `functions/send-invoice.ts` → mounted at `/send-invoice`\n *\n * This mirrors how `loadCollectionsFromDirectory` works for collections.\n *\n * Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the\n * caller also needs to report what did not.\n */\nexport async function loadFunctionsFromDirectory(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunction[]> {\n    return (await loadFunctionsWithDiagnostics(directory, importModule)).functions;\n}\n\n/**\n * {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.\n *\n * Never throws: a single malformed function must not crash server boot. The\n * caller decides what to do with `problems` — `init.ts` mounts the router\n * regardless and surfaces the count on the listing endpoint.\n */\nexport async function loadFunctionsWithDiagnostics(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunctions> {\n    const functions: LoadedFunction[] = [];\n    // Aggregate problem files so a broken function surfaces as one loud\n    // summary line, not just a warning buried per-file. We still don't throw:\n    // a single malformed function must not crash server boot.\n    const problems: string[] = [];\n\n    if (!fs.existsSync(directory)) {\n        return { functions, problems };\n    }\n\n    // `withFileTypes` so a directory entry is a *reported* skip rather than a\n    // filter miss. `readdirSync(dir)` returned bare names, and a subdirectory\n    // simply failed the `.ts`/`.js` test — so `functions/admin/users.ts` was\n    // compiled by `rebase build`, shipped in the bundle, and then dropped at\n    // boot without a single log line.\n    const entries = fs.readdirSync(directory, { withFileTypes: true });\n    for (const entry of entries) {\n        const file = entry.name;\n\n        if (entry.isDirectory()) {\n            // Dot-directories are tooling (`.git`, `.turbo`), not intent.\n            if (file.startsWith(\".\") || file === \"node_modules\") continue;\n            logger.warn(\n                `[functions] ${file}/: subdirectory ignored. Functions are loaded from the top level of ` +\n                `${directory} only, so nothing under ${file}/ is served. Move the file up (or flatten the ` +\n                \"name: `admin/users.ts` → `admin-users.ts`).\"\n            );\n            problems.push(`${file}/ (subdirectory — functions are not loaded recursively)`);\n            continue;\n        }\n\n        const extension = path.extname(file);\n        if (\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            UNSUPPORTED_CODE_EXTENSIONS.includes(extension)\n        ) {\n            logger.warn(\n                `[functions] ${file}: ${extension} files are not loaded. Rename it to .ts (or .js) to serve it.`\n            );\n            problems.push(`${file} (unsupported extension ${extension})`);\n            continue;\n        }\n\n        if (\n            (file.endsWith(\".ts\") || file.endsWith(\".js\")) &&\n            // Dotfiles: notably macOS bsdtar AppleDouble sidecars (`._foo.ts`),\n            // binary blobs that cannot be imported.\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            !file.endsWith(\".d.ts\") &&\n            file !== \"index.ts\" &&\n            file !== \"index.js\"\n        ) {\n            const filePath = path.join(directory, file);\n            try {\n                const fileUrl = pathToFileURL(filePath).href;\n\n                const mod = await importModule(fileUrl);\n\n                const exported = mod.default;\n\n                if (!exported) {\n                    logger.warn(`[functions] ${file}: no default export. Skipping.`);\n                    problems.push(`${file} (no default export)`);\n                    continue;\n                }\n\n                // Accept a Hono instance — use duck-typing to handle different\n                // Hono versions which may not share the same prototype.\n                if (isHonoLike(exported)) {\n                    const name = path.basename(file, path.extname(file));\n                    functions.push({ name,\napp: exported as Hono });\n                    logger.debug(`⚡ Loaded function route: ${name}`);\n                    continue;\n                }\n\n                // Also accept a factory function that returns a Hono instance\n                if (typeof exported === \"function\") {\n                    const result = exported();\n                    if (isHonoLike(result)) {\n                        const name = path.basename(file, path.extname(file));\n                        functions.push({ name,\napp: result as Hono });\n                        logger.debug(`⚡ Loaded function route: ${name}`);\n                        continue;\n                    }\n                }\n\n                // Provide actionable diagnostics\n                const exportType = typeof exported;\n                const keys = exported && typeof exported === \"object\"\n                    ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(\", \")\n                    : \"N/A\";\n                logger.warn(\n                    `[functions] ${file}: default export is not a Hono app or factory. Skipping.\\n` +\n                    `  export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : \"\"}\\n` +\n                    `  prototype methods: ${keys}\\n` +\n                    \"  Hint: ensure the function exports a Hono app created with the same hono version as the server.\\n\" +\n                    \"  Author with `defineFunction(...)` from @rebasepro/server for a typed, checked contract.\\n\" +\n                    \"  The loader checks for .fetch() and .routes — any Hono-compatible app will work.\"\n                );\n                problems.push(`${file} (not a Hono app or factory)`);\n            } catch (err: unknown) {\n                const message =\n                    err instanceof Error ? err.message : String(err);\n                logger.error(`[functions] Failed to load ${file}: ${message}`);\n                problems.push(`${file} (threw: ${message})`);\n            }\n        }\n    }\n\n    if (problems.length > 0) {\n        logger.warn(\n            `[functions] ${problems.length} function file(s) were skipped and will NOT be served:\\n` +\n            problems.map((p) => `  - ${p}`).join(\"\\n\") + \"\\n\" +\n            \"  Fix these or author them with `defineFunction(...)` for a typed, compile-checked contract.\"\n        );\n    }\n\n    return { functions, problems };\n}\n\n/**\n * Duck-type check for Hono apps.\n * We avoid `instanceof Hono` because different Hono versions\n * installed in the user's project vs. our dependencies will\n * not share the same prototype, causing false negatives.\n */\nfunction isHonoLike(obj: unknown): boolean {\n    if (!obj || typeof obj !== \"object\") return false;\n    // Hono instances always have .fetch() and .routes\n    const record = obj as Record<string, unknown>;\n    return (\n        typeof record.fetch === \"function\" &&\n        Array.isArray(record.routes)\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAM,8BAA8B;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AAAM;;;;;;;;;;;;;AAcnF,eAAsB,2BAClB,WACA,eAA+B,qBACN;CACzB,QAAQ,MAAM,6BAA6B,WAAW,YAAY,EAAA,CAAG;AACzE;;;;;;;;AASA,eAAsB,6BAClB,WACA,eAA+B,qBACP;CACxB,MAAM,YAA8B,CAAC;CAIrC,MAAM,WAAqB,CAAC;CAE5B,IAAI,CAAC,KAAG,WAAW,SAAS,GACxB,OAAO;EAAE;EAAW;CAAS;CAQjC,MAAM,UAAU,KAAG,YAAY,WAAW,EAAE,eAAe,KAAK,CAAC;CACjE,KAAK,MAAM,SAAS,SAAS;EACzB,MAAM,OAAO,MAAM;EAEnB,IAAI,MAAM,YAAY,GAAG;GAErB,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,gBAAgB;GACrD,OAAO,KACH,eAAe,KAAK,sEACjB,UAAU,0BAA0B,KAAK,8FAEhD;GACA,SAAS,KAAK,GAAG,KAAK,wDAAwD;GAC9E;EACJ;EAEA,MAAM,YAAY,OAAK,QAAQ,IAAI;EACnC,IACI,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,4BAA4B,SAAS,SAAS,GAChD;GACE,OAAO,KACH,eAAe,KAAK,IAAI,UAAU,8DACtC;GACA,SAAS,KAAK,GAAG,KAAK,0BAA0B,UAAU,EAAE;GAC5D;EACJ;EAEA,KACK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK,MAG5C,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,CAAC,KAAK,SAAS,OAAO,KACtB,SAAS,cACT,SAAS,YACX;GACE,MAAM,WAAW,OAAK,KAAK,WAAW,IAAI;GAC1C,IAAI;IACA,MAAM,UAAU,cAAc,QAAQ,CAAC,CAAC;IAIxC,MAAM,YAAW,MAFC,aAAa,OAAO,EAAA,CAEjB;IAErB,IAAI,CAAC,UAAU;KACX,OAAO,KAAK,eAAe,KAAK,+BAA+B;KAC/D,SAAS,KAAK,GAAG,KAAK,qBAAqB;KAC3C;IACJ;IAIA,IAAI,WAAW,QAAQ,GAAG;KACtB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;KACnD,UAAU,KAAK;MAAE;MACrC,KAAK;KAAiB,CAAC;KACH,OAAO,MAAM,4BAA4B,MAAM;KAC/C;IACJ;IAGA,IAAI,OAAO,aAAa,YAAY;KAChC,MAAM,SAAS,SAAS;KACxB,IAAI,WAAW,MAAM,GAAG;MACpB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;MACnD,UAAU,KAAK;OAAE;OACzC,KAAK;MAAe,CAAC;MACG,OAAO,MAAM,4BAA4B,MAAM;MAC/C;KACJ;IACJ;IAGA,MAAM,aAAa,OAAO;IAC1B,MAAM,OAAO,YAAY,OAAO,aAAa,WACvC,OAAO,oBAAoB,OAAO,eAAe,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,IAClF;IACN,OAAO,KACH,eAAe,KAAK,2EACF,aAAa,UAAU,aAAa,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,GAAG,yBAC5E,KAAK;;kFAIjC;IACA,SAAS,KAAK,GAAG,KAAK,6BAA6B;GACvD,SAAS,KAAc;IACnB,MAAM,UACF,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IACnD,OAAO,MAAM,8BAA8B,KAAK,IAAI,SAAS;IAC7D,SAAS,KAAK,GAAG,KAAK,WAAW,QAAQ,EAAE;GAC/C;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAClB,OAAO,KACH,eAAe,SAAS,OAAO,4DAC/B,SAAS,KAAK,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,gGAEjD;CAGJ,OAAO;EAAE;EAAW;CAAS;AACjC;;;;;;;AAQA,SAAS,WAAW,KAAuB;CACvC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAE5C,MAAM,SAAS;CACf,OACI,OAAO,OAAO,UAAU,cACxB,MAAM,QAAQ,OAAO,MAAM;AAEnC"}
+{"version":3,"file":"function-loader-LLdmBFoL.js","names":[],"sources":["../src/functions/function-loader.ts"],"sourcesContent":["import * as fs from \"fs\";\nimport * as path from \"path\";\nimport { pathToFileURL } from \"url\";\nimport { Hono } from \"hono\";\nimport { logger } from \"../utils/logger.js\";\nimport { nativeDynamicImport, type ModuleImporter } from \"../utils/dynamic-import.js\";\n\nexport interface LoadedFunction {\n    /** Endpoint name derived from filename (e.g., \"send-invoice\") */\n    name: string;\n    /** The Hono sub-app to mount */\n    app: Hono<import(\"hono\").Env>;\n}\n\n/** What a directory of function files produced: what mounted, and what did not. */\nexport interface LoadedFunctions {\n    /** The functions that will be served. */\n    functions: LoadedFunction[];\n    /**\n     * One entry per file the loader saw and did **not** mount, each already\n     * phrased as `<name> (<reason>)`. Returned rather than only logged so the\n     * running server can say what is missing — a boot log line is not reachable\n     * from `GET /api/functions`.\n     */\n    problems: string[];\n}\n\n/**\n * Extensions the bundler compiles (or a developer might reasonably write) that\n * this loader cannot import. `rebase build` globs `functions/**\\/*.ts`, so the\n * build's idea of \"a function file\" is strictly wider than the runtime's — the\n * worst direction for a mismatch to go. Anything listed here is reported as a\n * problem instead of vanishing; non-code files (`.md`, `.json`, `.txt`) stay\n * silent, because a README next to your functions is not a mistake.\n */\nconst UNSUPPORTED_CODE_EXTENSIONS = [\".mts\", \".cts\", \".tsx\", \".jsx\", \".mjs\", \".cjs\"];\n\n/**\n * Auto-discover Hono route files from a directory.\n *\n * Each file should default-export a Hono app (or router).\n * The filename (without extension) becomes the mount path:\n *   `functions/send-invoice.ts` → mounted at `/send-invoice`\n *\n * This mirrors how `loadCollectionsFromDirectory` works for collections.\n *\n * Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the\n * caller also needs to report what did not.\n */\nexport async function loadFunctionsFromDirectory(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunction[]> {\n    return (await loadFunctionsWithDiagnostics(directory, importModule)).functions;\n}\n\n/**\n * {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.\n *\n * Never throws: a single malformed function must not crash server boot. The\n * caller decides what to do with `problems` — `init.ts` mounts the router\n * regardless and surfaces the count on the listing endpoint.\n */\nexport async function loadFunctionsWithDiagnostics(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunctions> {\n    const functions: LoadedFunction[] = [];\n    // Aggregate problem files so a broken function surfaces as one loud\n    // summary line, not just a warning buried per-file. We still don't throw:\n    // a single malformed function must not crash server boot.\n    const problems: string[] = [];\n\n    if (!fs.existsSync(directory)) {\n        return { functions, problems };\n    }\n\n    // `withFileTypes` so a directory entry is a *reported* skip rather than a\n    // filter miss. `readdirSync(dir)` returned bare names, and a subdirectory\n    // simply failed the `.ts`/`.js` test — so `functions/admin/users.ts` was\n    // compiled by `rebase build`, shipped in the bundle, and then dropped at\n    // boot without a single log line.\n    const entries = fs.readdirSync(directory, { withFileTypes: true });\n    for (const entry of entries) {\n        const file = entry.name;\n\n        if (entry.isDirectory()) {\n            // Dot-directories are tooling (`.git`, `.turbo`), not intent.\n            if (file.startsWith(\".\") || file === \"node_modules\") continue;\n            logger.warn(\n                `[functions] ${file}/: subdirectory ignored. Functions are loaded from the top level of ` +\n                `${directory} only, so nothing under ${file}/ is served. Move the file up (or flatten the ` +\n                \"name: `admin/users.ts` → `admin-users.ts`).\"\n            );\n            problems.push(`${file}/ (subdirectory — functions are not loaded recursively)`);\n            continue;\n        }\n\n        const extension = path.extname(file);\n        if (\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            UNSUPPORTED_CODE_EXTENSIONS.includes(extension)\n        ) {\n            logger.warn(\n                `[functions] ${file}: ${extension} files are not loaded. Rename it to .ts (or .js) to serve it.`\n            );\n            problems.push(`${file} (unsupported extension ${extension})`);\n            continue;\n        }\n\n        if (\n            (file.endsWith(\".ts\") || file.endsWith(\".js\")) &&\n            // Dotfiles: notably macOS bsdtar AppleDouble sidecars (`._foo.ts`),\n            // binary blobs that cannot be imported.\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            !file.endsWith(\".d.ts\") &&\n            file !== \"index.ts\" &&\n            file !== \"index.js\"\n        ) {\n            const filePath = path.join(directory, file);\n            try {\n                const fileUrl = pathToFileURL(filePath).href;\n\n                const mod = await importModule(fileUrl);\n\n                const exported = mod.default;\n\n                if (!exported) {\n                    logger.warn(`[functions] ${file}: no default export. Skipping.`);\n                    problems.push(`${file} (no default export)`);\n                    continue;\n                }\n\n                // Accept a Hono instance — use duck-typing to handle different\n                // Hono versions which may not share the same prototype.\n                if (isHonoLike(exported)) {\n                    const name = path.basename(file, path.extname(file));\n                    functions.push({ name,\napp: exported as Hono });\n                    logger.debug(`⚡ Loaded function route: ${name}`);\n                    continue;\n                }\n\n                // Also accept a factory function that returns a Hono instance\n                if (typeof exported === \"function\") {\n                    const result = exported();\n                    if (isHonoLike(result)) {\n                        const name = path.basename(file, path.extname(file));\n                        functions.push({ name,\napp: result as Hono });\n                        logger.debug(`⚡ Loaded function route: ${name}`);\n                        continue;\n                    }\n                }\n\n                // Provide actionable diagnostics\n                const exportType = typeof exported;\n                const keys = exported && typeof exported === \"object\"\n                    ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(\", \")\n                    : \"N/A\";\n                logger.warn(\n                    `[functions] ${file}: default export is not a Hono app or factory. Skipping.\\n` +\n                    `  export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : \"\"}\\n` +\n                    `  prototype methods: ${keys}\\n` +\n                    \"  Hint: ensure the function exports a Hono app created with the same hono version as the server.\\n\" +\n                    \"  Author with `defineFunction(...)` from @rebasepro/server for a typed, checked contract.\\n\" +\n                    \"  The loader checks for .fetch() and .routes — any Hono-compatible app will work.\"\n                );\n                problems.push(`${file} (not a Hono app or factory)`);\n            } catch (err: unknown) {\n                const message =\n                    err instanceof Error ? err.message : String(err);\n                logger.error(`[functions] Failed to load ${file}: ${message}`);\n                problems.push(`${file} (threw: ${message})`);\n            }\n        }\n    }\n\n    if (problems.length > 0) {\n        logger.warn(\n            `[functions] ${problems.length} function file(s) were skipped and will NOT be served:\\n` +\n            problems.map((p) => `  - ${p}`).join(\"\\n\") + \"\\n\" +\n            \"  Fix these or author them with `defineFunction(...)` for a typed, compile-checked contract.\"\n        );\n    }\n\n    return { functions, problems };\n}\n\n/**\n * Duck-type check for Hono apps.\n * We avoid `instanceof Hono` because different Hono versions\n * installed in the user's project vs. our dependencies will\n * not share the same prototype, causing false negatives.\n */\nfunction isHonoLike(obj: unknown): boolean {\n    if (!obj || typeof obj !== \"object\") return false;\n    // Hono instances always have .fetch() and .routes\n    const record = obj as Record<string, unknown>;\n    return (\n        typeof record.fetch === \"function\" &&\n        Array.isArray(record.routes)\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAM,8BAA8B;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AAAM;;;;;;;;;;;;;AAcnF,eAAsB,2BAClB,WACA,eAA+B,qBACN;CACzB,QAAQ,MAAM,6BAA6B,WAAW,YAAY,EAAA,CAAG;AACzE;;;;;;;;AASA,eAAsB,6BAClB,WACA,eAA+B,qBACP;CACxB,MAAM,YAA8B,CAAC;CAIrC,MAAM,WAAqB,CAAC;CAE5B,IAAI,CAAC,KAAG,WAAW,SAAS,GACxB,OAAO;EAAE;EAAW;CAAS;CAQjC,MAAM,UAAU,KAAG,YAAY,WAAW,EAAE,eAAe,KAAK,CAAC;CACjE,KAAK,MAAM,SAAS,SAAS;EACzB,MAAM,OAAO,MAAM;EAEnB,IAAI,MAAM,YAAY,GAAG;GAErB,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,gBAAgB;GACrD,OAAO,KACH,eAAe,KAAK,sEACjB,UAAU,0BAA0B,KAAK,8FAEhD;GACA,SAAS,KAAK,GAAG,KAAK,wDAAwD;GAC9E;EACJ;EAEA,MAAM,YAAY,OAAK,QAAQ,IAAI;EACnC,IACI,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,4BAA4B,SAAS,SAAS,GAChD;GACE,OAAO,KACH,eAAe,KAAK,IAAI,UAAU,8DACtC;GACA,SAAS,KAAK,GAAG,KAAK,0BAA0B,UAAU,EAAE;GAC5D;EACJ;EAEA,KACK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK,MAG5C,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,CAAC,KAAK,SAAS,OAAO,KACtB,SAAS,cACT,SAAS,YACX;GACE,MAAM,WAAW,OAAK,KAAK,WAAW,IAAI;GAC1C,IAAI;IACA,MAAM,UAAU,cAAc,QAAQ,CAAC,CAAC;IAIxC,MAAM,YAAW,MAFC,aAAa,OAAO,EAAA,CAEjB;IAErB,IAAI,CAAC,UAAU;KACX,OAAO,KAAK,eAAe,KAAK,+BAA+B;KAC/D,SAAS,KAAK,GAAG,KAAK,qBAAqB;KAC3C;IACJ;IAIA,IAAI,WAAW,QAAQ,GAAG;KACtB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;KACnD,UAAU,KAAK;MAAE;MACrC,KAAK;KAAiB,CAAC;KACH,OAAO,MAAM,4BAA4B,MAAM;KAC/C;IACJ;IAGA,IAAI,OAAO,aAAa,YAAY;KAChC,MAAM,SAAS,SAAS;KACxB,IAAI,WAAW,MAAM,GAAG;MACpB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;MACnD,UAAU,KAAK;OAAE;OACzC,KAAK;MAAe,CAAC;MACG,OAAO,MAAM,4BAA4B,MAAM;MAC/C;KACJ;IACJ;IAGA,MAAM,aAAa,OAAO;IAC1B,MAAM,OAAO,YAAY,OAAO,aAAa,WACvC,OAAO,oBAAoB,OAAO,eAAe,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,IAClF;IACN,OAAO,KACH,eAAe,KAAK,2EACF,aAAa,UAAU,aAAa,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,GAAG,yBAC5E,KAAK;;kFAIjC;IACA,SAAS,KAAK,GAAG,KAAK,6BAA6B;GACvD,SAAS,KAAc;IACnB,MAAM,UACF,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IACnD,OAAO,MAAM,8BAA8B,KAAK,IAAI,SAAS;IAC7D,SAAS,KAAK,GAAG,KAAK,WAAW,QAAQ,EAAE;GAC/C;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAClB,OAAO,KACH,eAAe,SAAS,OAAO,4DAC/B,SAAS,KAAK,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,gGAEjD;CAGJ,OAAO;EAAE;EAAW;CAAS;AACjC;;;;;;;AAQA,SAAS,WAAW,KAAuB;CACvC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAE5C,MAAM,SAAS;CACf,OACI,OAAO,OAAO,UAAU,cACxB,MAAM,QAAQ,OAAO,MAAM;AAEnC"}

package/dist/{function-routes-Btcez1T-.js → function-routes-ClT6UQpD.js}

@@ -1,7 +1,8 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-__createRequire(import.meta.url);
-import { n as __exportAll } from "./rolldown-runtime-DSJWtz9O.js";
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
 import { Hono } from "hono";
 //#region src/functions/function-routes.ts
 var function_routes_exports = /* @__PURE__ */ __exportAll({ createFunctionRoutes: () => createFunctionRoutes });
@@ -17,13 +18,13 @@ var function_routes_exports = /* @__PURE__ */ __exportAll({ createFunctionRoutes
 *   as a count and a pointer to the log, not as filenames: the listing is
 *   reachable anonymously, and the per-file reasons carry import errors.
 */
-function createFunctionRoutes(functions, skipped = 0) {
+function createFunctionRoutes(functions, skipped = 0, mountPath = "/functions") {
 	const router = new Hono();
 	router.get("/", (c) => {
 		return c.json({
 			functions: functions.map((fn) => ({
 				name: fn.name,
-				endpoint: `/functions/${fn.name}`
+				endpoint: `${mountPath}/${fn.name}`
 			})),
 			...skipped > 0 && {
 				skipped,
@@ -37,4 +38,4 @@ function createFunctionRoutes(functions, skipped = 0) {
 //#endregion
 export { function_routes_exports as n, createFunctionRoutes as t };
 
-//# sourceMappingURL=function-routes-Btcez1T-.js.map
+//# sourceMappingURL=function-routes-ClT6UQpD.js.map

package/dist/function-routes-ClT6UQpD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-routes-ClT6UQpD.js","names":[],"sources":["../src/functions/function-routes.ts"],"sourcesContent":["import { Hono } from \"hono\";\nimport { HonoEnv } from \"../api/types\";\nimport { LoadedFunction } from \"./function-loader\";\n\n/**\n * Mount all loaded function routes under a single Hono router.\n *\n * Each function is mounted at `/<function-name>`, preserving\n * whatever HTTP methods and middleware the Hono sub-app defines.\n *\n * @param functions What loaded. May be empty — the router still mounts, so\n *   \"no functions are served\" answers 200 with an empty list instead of 404.\n * @param skipped How many files the loader saw and could not serve. Reported\n *   as a count and a pointer to the log, not as filenames: the listing is\n *   reachable anonymously, and the per-file reasons carry import errors.\n */\nexport function createFunctionRoutes(\n    functions: LoadedFunction[],\n    skipped = 0,\n    /**\n     * Where this router is mounted, so the listing can report a path a caller\n     * can actually request. It used to hardcode `/functions/<name>`, which is\n     * wrong under every `basePath` including the default `/api`.\n     */\n    mountPath = \"/functions\"\n): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n\n    // Listing endpoint: GET / → list available functions\n    router.get(\"/\", (c) => {\n        return c.json({\n            functions: functions.map((fn) => ({\n                name: fn.name,\n                endpoint: `${mountPath}/${fn.name}`\n            })),\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} function file(s) failed to load and are NOT served — see the server log for the reason.`\n            })\n        });\n    });\n\n    for (const fn of functions) {\n        router.route(`/${fn.name}`, fn.app);\n    }\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAgBA,SAAgB,qBACZ,WACA,UAAU,GAMV,YAAY,cACC;CACb,MAAM,SAAS,IAAI,KAAc;CAGjC,OAAO,IAAI,MAAM,MAAM;EACnB,OAAO,EAAE,KAAK;GACV,WAAW,UAAU,KAAK,QAAQ;IAC9B,MAAM,GAAG;IACT,UAAU,GAAG,UAAU,GAAG,GAAG;GACjC,EAAE;GACF,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAED,KAAK,MAAM,MAAM,WACb,OAAO,MAAM,IAAI,GAAG,QAAQ,GAAG,GAAG;CAGtC,OAAO;AACX"}

package/dist/functions/context.d.ts

@@ -0,0 +1,141 @@
+/**
+ * Reading the request context from inside a custom function.
+ *
+ * The functions router resolves the caller's identity before any handler runs
+ * and leaves the result on the Hono context. Getting it back out used to be the
+ * user's problem, and the shape made that worse than it sounds: `HonoEnv`
+ * types `user` as `AuthResult`, a union that includes `boolean`, `null` and an
+ * index signature, because the same slot is filled by four different middlewares
+ * — JWT, service key, API key, and a user-supplied validator that may return
+ * `true`. Every example in the documentation therefore opened with
+ *
+ *     const user = c.get("user") as { uid: string; roles?: string[] } | undefined;
+ *
+ * and an assertion in a security-relevant position is exactly the kind of line
+ * that gets copied once and then never re-examined. It is also wrong in one
+ * case that occurs in practice: a custom validator returning `true` stores
+ * `{ uid: "default", roles: [] }`, which the assertion above types as having a
+ * `uid` — true here, but nothing checks it.
+ *
+ * These accessors do the narrowing once, in the framework, where it can be
+ * tested. They are also **runtime-neutral by construction** — no crypto, no
+ * token parsing, no I/O, nothing but property reads on an object another
+ * middleware already populated. That is what lets them live in
+ * `@rebasepro/server/functions` and run unchanged on a host that has no Node
+ * built-ins.
+ *
+ * @module
+ */
+import type { Context } from "hono";
+import type { DataDriver } from "@rebasepro/types";
+import type { HonoEnv } from "../api/types.js";
+import type { ApiKeyMasked } from "../auth/api-keys/api-key-types.js";
+/**
+ * The caller, as a custom function sees them.
+ *
+ * A narrowed view of whatever the auth middleware resolved: `uid` and `roles`
+ * are guaranteed, and the index signature keeps any extra claims the token or
+ * the adapter carried (`email`, `org_id`, anything a custom validator added)
+ * reachable without a cast.
+ */
+export interface FunctionUser {
+    /** Stable id of the caller. `"service"` for service-key and API-key callers. */
+    uid: string;
+    /** Roles as resolved for this request. Never `undefined` — an empty array instead. */
+    roles: string[];
+    /** Present when the identity carried one. Not every auth method does. */
+    email?: string;
+    /** Any further claim the token, adapter or validator supplied. */
+    [claim: string]: unknown;
+}
+/** Anything with a Hono-style `.get`, so these work on any `Context` shape. */
+type CtxLike = Context<HonoEnv> | Context;
+/**
+ * The authenticated caller, or `undefined` for an anonymous request.
+ *
+ * **`undefined` is not a permission decision.** The functions router mounts its
+ * auth middleware with `requireAuth: false` on purpose — a webhook receiver has
+ * no token to send — so an anonymous caller reaches the handler and reads
+ * `undefined` here while the handler runs on regardless. Use {@link requireAuth}
+ * (or a `!user` branch that returns 401) to make it a decision.
+ *
+ * A caller who presented a *bad* token never gets this far: both auth
+ * middlewares reject an unverifiable token with 401 before the router is
+ * reached, precisely so an expired session cannot be silently downgraded to an
+ * anonymous one.
+ */
+export declare function getUser(c: CtxLike): FunctionUser | undefined;
+/** The caller's id, or `undefined` when nobody is signed in. */
+export declare function getUserId(c: CtxLike): string | undefined;
+/** The caller's roles. Empty for an anonymous request — never `undefined`. */
+export declare function getRoles(c: CtxLike): string[];
+/**
+ * Whether the caller holds **any** of the named roles.
+ *
+ * Any rather than all, because that is what a route guard means by a list of
+ * roles; require several by calling this more than once.
+ */
+export declare function hasRole(c: CtxLike, ...roles: string[]): boolean;
+/**
+ * Whether the caller holds an administrative role.
+ *
+ * Delegates to the single definition in `auth/admin-roles.ts` — which is
+ * `admin` **or** `schema-admin` — rather than comparing against `"admin"`.
+ * Those two lists disagreed once, and the gap made every public registrant an
+ * administrator; see that file.
+ */
+export declare function isAdmin(c: CtxLike): boolean;
+/** Whether the request carries an identity at all. */
+export declare function isAuthenticated(c: CtxLike): boolean;
+/**
+ * The request-scoped data driver: reads and writes run as **the caller**, with
+ * your row-level security policies evaluated against their identity.
+ *
+ * This is the accessor to reach for when a function serves user-facing data.
+ * `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs
+ * as `{ uid: "service", roles: ["admin"] }` for every caller alike, which is
+ * correct for trusted background work and wrong for a request.
+ *
+ * `undefined` only when no Rebase auth middleware ran (see
+ * {@link identityResolved}); inside a function mounted by the framework it is
+ * always present, anonymous requests included — they get an anon-scoped driver
+ * so policies still have an identity to evaluate.
+ */
+export declare function getDriver(c: CtxLike): DataDriver | undefined;
+/**
+ * {@link getDriver}, but throws instead of handing back `undefined`.
+ *
+ * For the common case where a handler cannot proceed without it and would
+ * otherwise write `c.get("driver")!` — an assertion that turns a wiring problem
+ * into `Cannot read properties of undefined (reading 'fetchCollection')` twenty
+ * lines away from the cause.
+ */
+export declare function requireDriver(c: CtxLike): DataDriver;
+/**
+ * The API key this request authenticated with, masked, or `undefined` when it
+ * did not use one.
+ *
+ * Useful for attribution and for per-key behaviour. The permission check itself
+ * has already happened — reaching a handler means the key was allowed to.
+ */
+export declare function getApiKey(c: CtxLike): ApiKeyMasked | undefined;
+/**
+ * The correlation id for this request — generated, or taken from an inbound
+ * `X-Request-ID`.
+ *
+ * Log it. It is the only thing that ties a line written inside a function to
+ * the framework's own lines for the same request.
+ */
+export declare function getRequestId(c: CtxLike): string | undefined;
+/**
+ * Whether a Rebase auth middleware has run on this request.
+ *
+ * Both middlewares populate `driver` for *every* outcome, anonymous included,
+ * and populate `user` whenever there is one. So "neither is set" does not mean
+ * "anonymous" — it means nothing resolved the identity, and treating that as
+ * anonymous is the dangerous reading. The guards use this to tell a genuinely
+ * anonymous caller (401) from a misconfigured mount (500), because answering
+ * 401 to the second sends whoever is debugging it to look at the token.
+ */
+export declare function identityResolved(c: CtxLike): boolean;
+export {};

package/dist/functions/define-function.d.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
 import type { RebaseServerClient } from "@rebasepro/types";
-import type { HonoEnv } from "../api/types";
+import type { HonoEnv } from "../api/types.js";
 /**
  * Typed context injected into a function authored with {@link defineFunction}.
  *

package/dist/functions/function-routes.d.ts

@@ -1,6 +1,6 @@
 import { Hono } from "hono";
-import { HonoEnv } from "../api/types";
-import { LoadedFunction } from "./function-loader";
+import { HonoEnv } from "../api/types.js";
+import { LoadedFunction } from "./function-loader.js";
 /**
  * Mount all loaded function routes under a single Hono router.
  *
@@ -13,4 +13,10 @@ import { LoadedFunction } from "./function-loader";
  *   as a count and a pointer to the log, not as filenames: the listing is
  *   reachable anonymously, and the per-file reasons carry import errors.
  */
-export declare function createFunctionRoutes(functions: LoadedFunction[], skipped?: number): Hono<HonoEnv>;
+export declare function createFunctionRoutes(functions: LoadedFunction[], skipped?: number, 
+/**
+ * Where this router is mounted, so the listing can report a path a caller
+ * can actually request. It used to hardcode `/functions/<name>`, which is
+ * wrong under every `basePath` including the default `/api`.
+ */
+mountPath?: string): Hono<HonoEnv>;

package/dist/functions/guards.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Route guards for custom functions.
+ *
+ * These decide access from the identity the platform already resolved. They do
+ * **not** verify tokens, and that division is the point rather than a
+ * limitation:
+ *
+ * - Verifying a token needs a signing key, constant-time comparison and a
+ *   revocation lookup. That is host work, it belongs to the process that holds
+ *   the secret, and it is the part of the stack that cannot be made
+ *   runtime-neutral without rewriting it against WebCrypto.
+ * - Deciding whether *this* caller may call *this* route is application work.
+ *   It needs nothing but the resolved identity, so it costs nothing to make it
+ *   portable — and it is the half that lives in user code.
+ *
+ * Splitting there is what lets a function file compile and run unchanged on a
+ * host with no Node built-ins, and it is why these live in
+ * `@rebasepro/server/functions` while `verifyAccessToken` does not.
+ *
+ * **Inside the functions router these are equivalent to the guards exported
+ * from the package root.** Both auth middlewares resolve the identity before
+ * any handler runs: a valid credential populates `user`, an invalid one is
+ * rejected with 401 by the middleware itself, and a missing one leaves `user`
+ * unset. So the root `requireAuth`'s token-parsing branch is unreachable from a
+ * function, and removing it changes no outcome. The one difference is a handler
+ * mounted **outside** the framework's router, where no middleware ran: the root
+ * guard would parse the `Authorization` header itself, and these refuse the
+ * request with a 500 that names the wiring problem. Fail-closed, and legible.
+ *
+ * @module
+ */
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "../api/types.js";
+/**
+ * Reject anonymous callers with 401.
+ *
+ * Put it in the route's own middleware slot rather than `app.use("/*", …)`:
+ * `use()` covers only the routes declared *below* it, so a route appended later
+ * — by you, months from now, at the bottom of the file — is silently
+ * unprotected. The per-route form cannot drift that way.
+ *
+ * @example
+ * ```ts
+ * app.post("/", requireAuth, async (c) => {
+ *     const user = getUser(c)!;  // guaranteed by the guard
+ *     return c.json({ uid: user.uid });
+ * });
+ * ```
+ */
+export declare const requireAuth: MiddlewareHandler<HonoEnv>;
+/**
+ * Reject callers without an administrative role with 403.
+ *
+ * Must come **after** {@link requireAuth}: on its own it answers 401 for an
+ * anonymous caller, which is right, but pairing them keeps the two failures
+ * distinguishable — 401 "who are you", 403 "not you".
+ *
+ * Administrative means `admin` or `schema-admin`, from the single list in
+ * `auth/admin-roles.ts`. Do not compare against `"admin"` by hand; that is the
+ * divergence that list exists to prevent.
+ */
+export declare const requireAdmin: MiddlewareHandler<HonoEnv>;
+/**
+ * Reject callers holding none of the named roles with 403.
+ *
+ * Any of them, not all — require several by chaining the guard twice. Naming no
+ * role at all is a programming error and throws at module load rather than at
+ * request time, because `requireRole()` with an empty list would otherwise read
+ * as a guard while admitting everyone.
+ *
+ * @example
+ * ```ts
+ * app.post("/publish", requireAuth, requireRole("editor", "admin"), handler);
+ * ```
+ */
+export declare function requireRole(...roles: string[]): MiddlewareHandler<HonoEnv>;

package/dist/functions/index.d.ts

@@ -1,5 +1,96 @@
-export { loadFunctionsFromDirectory } from "./function-loader";
-export type { LoadedFunction } from "./function-loader";
-export { createFunctionRoutes } from "./function-routes";
-export { defineFunction } from "./define-function";
-export type { RebaseFunctionContext } from "./define-function";
+/**
+ * `@rebasepro/server/functions` — the portable authoring surface.
+ *
+ * Everything a custom function needs, and nothing that ties it to one runtime.
+ * Import from here rather than from `@rebasepro/server`:
+ *
+ * ```ts
+ * import { defineFunction, requireAuth, getUser, rebase } from "@rebasepro/server/functions";
+ * ```
+ *
+ * ## Why this entry point exists
+ *
+ * `@rebasepro/server` is a single barrel over the whole framework: the boot
+ * sequence, the collection loader, the backup routes, the SPA server, the
+ * WebSocket layer. Importing one name from it pulls `@hono/node-server`, `ws`,
+ * `jsonwebtoken`, Drizzle and a dozen modules that open files. On Node that
+ * costs a little start-up time and nothing else, which is why it stood for as
+ * long as it did. On a host without Node built-ins it does not resolve at all —
+ * so with only that entry point, *no* custom function could ever run anywhere
+ * but Node, no matter how portable the function's own code was.
+ *
+ * That is not a limitation you can lift later. `import { defineFunction } from
+ * "@rebasepro/server"` is the line in every function file, every template and
+ * every documentation page; changing it afterwards is a breaking change for
+ * everyone who has written one. The entry point has to exist before the code
+ * that would depend on it does.
+ *
+ * ## What "portable" means here, precisely
+ *
+ * Every module reachable from this file:
+ *
+ * - imports no Node built-in, directly or transitively;
+ * - imports no package that needs one (`@hono/node-server`, `ws`,
+ *   `jsonwebtoken`, `drizzle-orm`, `pg`, …);
+ * - touches no host global — `process`, `Buffer`, `__dirname` — at module
+ *   scope, so the module *evaluates* on a runtime that has none.
+ *
+ * `portability.test.ts` walks this graph on every run and fails naming the
+ * import chain that broke it. The rule is not a convention; it is a test.
+ *
+ * ## What is deliberately not here
+ *
+ * - **`rebase.sql()`** — reachable through `rebase`, and Node-only in practice:
+ *   it runs on the database owner connection over a TCP socket. It is left on
+ *   the object rather than hidden because there is nothing wrong with using it
+ *   on a Node deployment; see its docblock, and `runtimeKey()` if a function
+ *   needs to degrade rather than fail.
+ * - **Token verification.** Deciding whether a caller is who they say needs the
+ *   signing key and belongs to the host; deciding whether *this* caller may
+ *   call *this* route needs only the resolved identity and belongs here. That
+ *   is why `requireAuth` below carries no crypto — see `./guards.ts`.
+ * - **The loader, the router, the proxy, the timeout middleware.** Host
+ *   machinery. It lives in `./internal.ts`.
+ *
+ * @module
+ */
+export { defineFunction } from "./define-function.js";
+export type { RebaseFunctionContext } from "./define-function.js";
+/**
+ * The app-scoped Rebase client: `dataAsAdmin`, `auth`, `storage`, `email`,
+ * `sql`.
+ *
+ * Re-exported here — the same object the package root exports, not a copy —
+ * because it is the one piece of the framework a function reaches for at
+ * runtime, and requiring a second import from the Node-only barrel to get it
+ * would defeat the entry point.
+ *
+ * It is safe to hold at module scope, unlike a configuration value, because it
+ * is a lazy Proxy: nothing is resolved until a property is read, which happens
+ * inside a request. That indirection is also the whole of what a future
+ * isolate-based host has to hook — see `_setRebaseResolver` in
+ * `../singleton.ts`.
+ */
+export { rebase } from "../singleton.js";
+export { getUser, getUserId, getRoles, hasRole, isAdmin, isAuthenticated, getDriver, requireDriver, getApiKey, getRequestId, identityResolved } from "./context.js";
+export type { FunctionUser } from "./context.js";
+export { requireAuth, requireAdmin, requireRole } from "./guards.js";
+export { getEnv, env, requireEnv, runtimeKey, isNodeRuntime, lazyResource } from "./runtime-env.js";
+export { waitUntil } from "./wait-until.js";
+/**
+ * The Hono environment a Rebase function runs in: `c.get("user")`,
+ * `c.get("driver")`, `c.get("apiKey")` and `c.get("requestId")` are typed
+ * through it.
+ *
+ * `defineFunction` applies it for you. Declare it explicitly only when building
+ * the Hono app by hand: `new Hono<HonoEnv>()`.
+ */
+export type { HonoEnv, ApiResponse } from "../api/types.js";
+/**
+ * Throw this to answer with a specific status.
+ *
+ * The functions router installs the framework's error handler, so an `ApiError`
+ * thrown anywhere inside a handler becomes the status and body it names,
+ * whereas any other throw becomes a 500 with its detail withheld.
+ */
+export { ApiError } from "../api/errors.js";