@rebasepro/server 0.16.1-canary.gef08a6e → 0.17.0

package/dist/boot/fetch-bundle.d.ts

@@ -18,6 +18,23 @@ export declare const BUNDLE_TOKEN_ENV = "REBASE_BUNDLE_TOKEN";
  * here, do not fetch at all" — this only says where to put one.
  */
 export declare const BUNDLE_FETCH_DIR_ENV = "REBASE_BUNDLE_FETCH_DIR";
+/**
+ * Records which URL produced the tree sitting in the fetch directory.
+ *
+ * Reusing an already-unpacked bundle is what makes a restart cheap, but "there
+ * is a bundle here" is not the same question as "is it the bundle we were told
+ * to run". Anything that fills the directory behind the runtime's back — an
+ * orphaned `fetch-bundle` init container left on a Deployment, a stale volume —
+ * used to win over the URL, and the pod then served whatever it found while
+ * every deploy reported success. The URL is the instruction; this is how a
+ * restart tells whether the disk already satisfies it.
+ *
+ * `infra/docker/entrypoint.mjs` reads this file by the same name to decide
+ * whether to fetch at all — keep the two in step.
+ */
+export declare const BUNDLE_SOURCE_FILENAME = ".rebase-bundle-source";
+/** What the tree in `destination` was fetched from, or null if unknown. */
+export declare function unpackedBundleSource(destination: string): string | null;
 export interface FetchBundleOptions {
     url: string;
     token?: string;
@@ -100,7 +117,7 @@ export declare function installBundleDependencies(bundleRoot: string, exec?: (cm
  * ready. Seen in production as every custom-function route 500ing while
  * `/api/data/*` served fine.
  *
- * It arrives transitively: `@rebasepro/admin` and `@rebasepro/server-postgres`
+ * It arrives transitively: `@rebasepro/cms` and `@rebasepro/server-postgres`
  * both depend on it, and nearly every project declares one of them.
  *
  * NOT every package the image ships. The image installs the narrow set of

package/dist/collections/validate-config.d.ts

@@ -22,7 +22,7 @@
  * Everything is reported in one pass. Someone migrating a project wants the
  * whole list once, not fifty-five sequential boots.
  *
- * This is not `validateCollectionJson` in `@rebasepro/admin`. That one parses a
+ * This is not `validateCollectionJson` in `@rebasepro/cms`. That one parses a
  * JSON string pasted into the panel's import dialog and checks value *shapes*
  * against the flat `AdminCollection` view model. This one checks key *identity*
  * against the authoring contract, on live objects, in a package that may not
@@ -33,6 +33,19 @@
 export type UnknownKeyPolicy = "warn" | "error" | "off";
 export interface ConfigProblem {
     severity: "error" | "warning";
+    /**
+     * What kind of wrong this is, because the two read very differently and the
+     * remedies differ.
+     *
+     * - `"key"` — a key this version does not read, whether renamed, removed or
+     *   simply unrecognised. The feature it configures is absent; the config is
+     *   otherwise coherent. `REBASE_STRICT_COLLECTION_CONFIG` governs how loud
+     *   the unrecognised half of this is.
+     * - `"incoherent"` — every key is recognised and the *combination* cannot do
+     *   what it says. That policy has no bearing on these, and saying it did
+     *   sent people to an environment variable that would not have helped.
+     */
+    kind: "key" | "incoherent";
     /** Dotted path into the config, e.g. `posts.properties.author`. */
     path: string;
     message: string;

package/dist/index.d.ts

@@ -14,7 +14,7 @@ export { loadCollectionsFromDirectory, applyCollectionDefaults, type CollectionD
 export { assertCollectionConfigs, findCollectionConfigProblems, unknownKeyPolicyFromEnv, type ConfigProblem, type UnknownKeyPolicy, type ValidateCollectionConfigOptions } from "./collections/validate-config.js";
 export * from "./db/interfaces.js";
 export * from "./auth/interfaces.js";
-export { requireAuth, requireAdmin, optionalAuth, queryTokenAuth, fileTokenAuth, extractUserFromToken, hashPassword, verifyPassword, validatePasswordStrength, generateSecurePassword, resolveAuthHooks, createBuiltinAuthAdapter, createCustomAuthAdapter, createGoogleProvider, createLinkedinProvider, createGitHubProvider, createMicrosoftProvider, createAppleProvider, createFacebookProvider, createTwitterProvider, createDiscordProvider, createGitLabProvider, createBitbucketProvider, createSlackProvider, createSpotifyProvider, oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail, verifyOidcIdToken, tryVerifyOidcIdToken, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed, safeCompare, getJwks, hasAsymmetricSigningKey, createJwksRoutes } from "./auth/index.js";
+export { requireAuth, requireAdmin, optionalAuth, queryTokenAuth, fileTokenAuth, extractUserFromToken, hashPassword, verifyPassword, validatePasswordStrength, generateSecurePassword, resolveAuthHooks, createBuiltinAuthAdapter, createCustomAuthAdapter, createGoogleProvider, createLinkedinProvider, createGitHubProvider, createMicrosoftProvider, createAppleProvider, createFacebookProvider, createTwitterProvider, createDiscordProvider, createGitLabProvider, createBitbucketProvider, createSlackProvider, createSpotifyProvider, oauthCodeFlowSchema, pkceTokenParams, providerVerifiedEmail, verifyOidcIdToken, tryVerifyOidcIdToken, isApiKeyToken, validateApiKey, httpMethodToOperation, isOperationAllowed, safeCompare, getJwks, hasAsymmetricSigningKey, createJwksRoutes, configureJwt } from "./auth/index.js";
 export type { JwtSigningKeyConfig, JwtSigningAlgorithm, PublicJwk, AccessTokenPayload, PasswordValidationResult, AuthHooks, AuthMethod, ResolvedAuthHooks, BuiltinAuthAdapterConfig, GoogleProviderConfig, AuthMiddlewareOptions, AuthResult, ApiKey, ApiKeyMasked, ApiKeyPermission, ApiKeyWithSecret, CreateApiKeyRequest, UpdateApiKeyRequest, ApiKeyStore, ApiKeyOperation } from "./auth/index.js";
 export * from "./api/types.js";
 export * from "./api/errors.js";