@rebasepro/server 0.17.3 → 0.18.0

package/LICENSE

@@ -19,4 +19,3 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-

package/README.md

@@ -8,6 +8,10 @@ Database-agnostic backend core for Rebase.
 pnpm add @rebasepro/server
 ```
 
+ESM-only: `"type": "module"` with no CommonJS build, so it is loaded with
+`import`. `require()` of it resolves only on Node 22.12+, which supports
+`require(esm)`.
+
 ## What This Package Does
 
 This is the central orchestrator for any Rebase backend. It provides the framework-level plumbing — HTTP routing (Hono), authentication middleware, storage, email, cron jobs, custom functions, and the REST API generator — without being coupled to any specific database. Database implementations are plugged in via driver packages like `@rebasepro/server-postgres` or `@rebasepro/server-mongo`.
@@ -24,7 +28,7 @@ This is the central orchestrator for any Rebase backend. It provides the framewo
 | `RebaseAuthConfig` | Auth config type (JWT, OAuth providers, hooks, service key). |
 | `RebaseBackendInstance` | Return type — includes `driver`, `healthCheck()`, `shutdown()`, `cronScheduler`, `storageController`, etc. |
 | `RebaseEnv` | Zod-inferred type of validated environment variables. |
-| `z` | Re-exported Zod instance for extending `loadEnv`. |
+| `z` | The runtime's own Zod instance. Build `loadEnv({ extend })` schemas with this one — a schema from a second copy of zod is silently ignored. |
 | `_setRebaseMock` / `_resetRebaseMock` | Test helpers to mock the `rebase` singleton (NODE_ENV=test only). |
 
 Also re-exports all abstract interfaces (`DatabaseAdapter`, `AuthAdapter`, `DataDriver`, etc.), API types (`HonoEnv`, `ApiConfig`), auth module, email module, storage module, history module, cron module, custom functions, logging utilities, and driver registry.

package/bin/rebase-server.js

@@ -27,12 +27,27 @@ Arguments:
   bundle-dir            Path to the bundle. Defaults to $REBASE_BUNDLE, then ./dist-bundle
 
 Key environment variables:
+  NODE_ENV              "production" for a deployment. It closes the first-admin
+                        window, requires CORS_ORIGINS, refuses local file
+                        storage and turns the OpenAPI docs off
   DATABASE_URL          Connection string for the default database (required)
   JWT_SECRET            Signing secret, >=32 chars (required in production)
+  REBASE_SERVICE_KEY    Server-to-server credential that bypasses row-level
+                        security. Treat it like a database superuser password
   PORT                  Port to bind (default 3001)
   CORS_ORIGINS          Comma-separated allowed origins (required in production)
+  REBASE_ADMIN_EMAIL    The first admin account, created once while the user
+  REBASE_ADMIN_PASSWORD table is empty (>=12 chars). In production the first
+                        account to register is NOT promoted, so without these
+                        a fresh deployment has no way in
+  DISABLE_SELF_REGISTRATION  "true" to refuse sign-ups outright
   REBASE_METRICS        "true" to expose Prometheus metrics at /metrics
-  REBASE_MIGRATE_ON_BOOT  none | ensure  (collection tables: run 'rebase db push')
+  REBASE_MIGRATE_ON_BOOT  none | ensure (default). "ensure" creates missing
+                        tables and columns at boot, INCLUDING your collections',
+                        additively, and applies their row-level security. It
+                        never alters, drops or narrows: those go through
+                        'rebase db push' from a checkout, along with
+                        junction-table RLS for many-to-many relations
 
 Additional databases and buckets are configured by suffixing the variable with
 the source key, e.g. DATABASE_URL__ANALYTICS or S3_BUCKET__MEDIA.

package/dist/{GCSStorageController-Bl7nmhdv.js → GCSStorageController-ZXPoNqW3.js}

@@ -3,6 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { o as folderKey, s as listingPrefix } from "./keys-g8lbVC_o.js";
 import "./types-BfKcm9do.js";
 //#region src/storage/GCSStorageController.ts
 /**
@@ -48,6 +49,13 @@ var GCSStorageController = class {
 	getType() {
 		return "gcs";
 	}
+	/**
+	* The configured bucket, and the logical `default` that maps to it.
+	* @see S3StorageController.knownBuckets
+	*/
+	knownBuckets() {
+		return ["default", this.config.bucket];
+	}
 	async putObject({ file, key, metadata, bucket }) {
 		this.validateFile(file);
 		const usedBucket = this.getBucket(bucket);
@@ -148,7 +156,7 @@ var GCSStorageController = class {
 	async listObjects(prefix, options) {
 		const resolvedBucket = this.getBucket(options?.bucket);
 		const [files, , filesApiResponse] = await (await this.getClient()).bucket(resolvedBucket).getFiles({
-			prefix: prefix || void 0,
+			prefix: listingPrefix(prefix),
 			delimiter: "/",
 			maxResults: options?.maxResults ?? 1e3,
 			pageToken: options?.pageToken,
@@ -163,14 +171,17 @@ var GCSStorageController = class {
 				root: null,
 				toString: () => `gs://${resolvedBucket}/${file.name}`
 			})),
-			prefixes: (filesApiResponse?.prefixes ?? []).map((p) => ({
-				bucket: resolvedBucket,
-				fullPath: p,
-				name: p.replace(/\/$/, "").split("/").pop() || "",
-				parent: null,
-				root: null,
-				toString: () => `gs://${resolvedBucket}/${p}`
-			})),
+			prefixes: (filesApiResponse?.prefixes ?? []).map((p) => {
+				const folder = folderKey(p);
+				return {
+					bucket: resolvedBucket,
+					fullPath: folder,
+					name: folder.split("/").pop() || "",
+					parent: null,
+					root: null,
+					toString: () => `gs://${resolvedBucket}/${folder}`
+				};
+			}),
 			nextPageToken: filesApiResponse?.nextPageToken
 		};
 	}
@@ -214,4 +225,4 @@ function isNotFoundError(error) {
 //#endregion
 export { GCSStorageController_exports as n, GCSStorageController as t };
 
-//# sourceMappingURL=GCSStorageController-Bl7nmhdv.js.map
+//# sourceMappingURL=GCSStorageController-ZXPoNqW3.js.map

package/dist/GCSStorageController-ZXPoNqW3.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"GCSStorageController-ZXPoNqW3.js","names":[],"sources":["../src/storage/GCSStorageController.ts"],"sourcesContent":["/**\n * Google Cloud Storage controller (works with GCS and Firebase Storage)\n *\n * The `@google-cloud/storage` package is loaded lazily so it remains an\n * optional peer dependency — users who don't need GCS never pay for the\n * import cost or need it installed.\n */\n\nimport {\n    StorageController,\n    GCSStorageConfig,\n    DEFAULT_MAX_FILE_SIZE\n} from \"./types\";\nimport { folderKey, listingPrefix } from \"./keys\";\nimport {\n    UploadFileProps,\n    UploadFileResult,\n    DownloadConfig,\n    DownloadMetadata,\n    StorageListResult,\n    StorageReference\n} from \"@rebasepro/types\";\n\n// ---------------------------------------------------------------------------\n// Lazy import of @google-cloud/storage\n// ---------------------------------------------------------------------------\n\nlet gcsModule: typeof import(\"@google-cloud/storage\") | null = null;\n\nasync function loadGCS(): Promise<typeof import(\"@google-cloud/storage\")> {\n    if (gcsModule) return gcsModule;\n    try {\n        gcsModule = await import(\"@google-cloud/storage\");\n        return gcsModule;\n    } catch {\n        throw new Error(\n            \"Google Cloud Storage is required for the GCS storage controller. \" +\n            \"Install it with: pnpm add @google-cloud/storage\"\n        );\n    }\n}\n\n// ---------------------------------------------------------------------------\n// GCSStorageController\n// ---------------------------------------------------------------------------\n\n/**\n * Google Cloud Storage implementation of `StorageController`.\n *\n * Works with standard GCS buckets **and** Firebase Storage buckets\n * (e.g. `\"my-project.appspot.com\"`).\n */\nexport class GCSStorageController implements StorageController {\n    private config: GCSStorageConfig;\n    private client: InstanceType<typeof import(\"@google-cloud/storage\").Storage> | null = null;\n\n    constructor(config: GCSStorageConfig) {\n        this.config = config;\n    }\n\n    // ------------------------------------------------------------------\n    // Lazy client initialisation\n    // ------------------------------------------------------------------\n\n    private async getClient(): Promise<InstanceType<typeof import(\"@google-cloud/storage\").Storage>> {\n        if (this.client) return this.client;\n        const { Storage } = await loadGCS();\n        this.client = new Storage({\n            projectId: this.config.projectId,\n            keyFilename: this.config.keyFilename,\n            credentials: this.config.credentials\n        });\n        return this.client;\n    }\n\n    // ------------------------------------------------------------------\n    // StorageController interface\n    // ------------------------------------------------------------------\n\n    getType(): \"gcs\" {\n        return \"gcs\";\n    }\n\n    /**\n     * The configured bucket, and the logical `default` that maps to it.\n     * @see S3StorageController.knownBuckets\n     */\n    knownBuckets(): string[] {\n        return [\"default\", this.config.bucket];\n    }\n\n    async putObject({\n        file,\n        key,\n        metadata,\n        bucket\n    }: UploadFileProps): Promise<UploadFileResult> {\n        this.validateFile(file);\n\n        const usedBucket = this.getBucket(bucket);\n        const client = await this.getClient();\n        const gcsFile = client.bucket(usedBucket).file(key);\n\n        // Convert File to Buffer\n        const arrayBuffer = await file.arrayBuffer();\n        const buffer = Buffer.from(arrayBuffer);\n\n        await gcsFile.save(buffer, {\n            contentType: file.type,\n            metadata: metadata ? { metadata: this.flattenMetadata(metadata) } : undefined\n        });\n\n        return {\n            key,\n            bucket: usedBucket,\n            storageUrl: `gs://${usedBucket}/${key}`\n        };\n    }\n\n    async getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig> {\n        // Handle gs:// and s3:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(gs|s3):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const client = await this.getClient();\n            const gcsFile = client.bucket(resolvedBucket).file(resolvedPath);\n\n            // Get metadata first to check existence and populate response\n            const [fileMetadata] = await gcsFile.getMetadata();\n\n            // Generate a signed URL\n            const expiresIn = this.config.signedUrlExpiration ?? 3600;\n            const [url] = await gcsFile.getSignedUrl({\n                action: \"read\",\n                expires: Date.now() + expiresIn * 1000\n            });\n\n            const metadata: DownloadMetadata = {\n                bucket: resolvedBucket,\n                fullPath: resolvedPath,\n                name: resolvedPath.split(\"/\").pop() || resolvedPath,\n                size: Number(fileMetadata.size) || 0,\n                contentType: fileMetadata.contentType || \"application/octet-stream\",\n                customMetadata: (fileMetadata.metadata as Record<string, string> | undefined) || {}\n            };\n\n            return {\n                url,\n                metadata\n            };\n        } catch (error: unknown) {\n            if (isNotFoundError(error)) {\n                return {\n                    url: null,\n                    fileNotFound: true\n                };\n            }\n            throw error;\n        }\n    }\n\n    async getObject(key: string, bucket?: string): Promise<File | null> {\n        // Handle gs:// and s3:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(gs|s3):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const client = await this.getClient();\n            const gcsFile = client.bucket(resolvedBucket).file(resolvedPath);\n\n            const [contents] = await gcsFile.download();\n\n            // Get content type from metadata\n            const [fileMetadata] = await gcsFile.getMetadata();\n            const contentType = fileMetadata.contentType || \"application/octet-stream\";\n            const fileName = resolvedPath.split(\"/\").pop() || resolvedPath;\n\n            const blob = new Blob([new Uint8Array(contents)], { type: contentType });\n            return new File([blob], fileName, { type: contentType });\n        } catch (error: unknown) {\n            if (isNotFoundError(error)) {\n                return null;\n            }\n            throw error;\n        }\n    }\n\n    async deleteObject(key: string, bucket?: string): Promise<void> {\n        // Handle gs:// and s3:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(gs|s3):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        const client = await this.getClient();\n        const gcsFile = client.bucket(resolvedBucket).file(resolvedPath);\n\n        await gcsFile.delete({ ignoreNotFound: true });\n    }\n\n    async listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult> {\n        const resolvedBucket = this.getBucket(options?.bucket);\n        const client = await this.getClient();\n        const gcsBucket = client.bucket(resolvedBucket);\n\n        // Fetch files (objects) matching the prefix\n        const [files, , filesApiResponse] = await gcsBucket.getFiles({\n            prefix: listingPrefix(prefix),\n            delimiter: \"/\",\n            maxResults: options?.maxResults ?? 1000,\n            pageToken: options?.pageToken,\n            autoPaginate: false\n        });\n\n        const items: StorageReference[] = files.map(file => ({\n            bucket: resolvedBucket,\n            fullPath: file.name,\n            name: file.name.split(\"/\").pop() || \"\",\n            parent: null as never,\n            root: null as never,\n            toString: () => `gs://${resolvedBucket}/${file.name}`\n        }));\n\n        // Common prefixes (folder-like entries) come from the API response\n        const apiPrefixes: string[] =\n            (filesApiResponse as Record<string, unknown> | undefined)?.prefixes as string[] ?? [];\n\n        const prefixes: StorageReference[] = apiPrefixes.map(p => {\n            // Without the trailing slash GCS puts on a common prefix, so a\n            // `fullPath` from a listing is a key any controller accepts.\n            const folder = folderKey(p);\n            return {\n                bucket: resolvedBucket,\n                fullPath: folder,\n                name: folder.split(\"/\").pop() || \"\",\n                parent: null as never,\n                root: null as never,\n                toString: () => `gs://${resolvedBucket}/${folder}`\n            };\n        });\n\n        // The next page token is returned on the query object (second element)\n        const nextPageToken =\n            (filesApiResponse as Record<string, unknown> | undefined)?.nextPageToken as string | undefined;\n\n        return {\n            items,\n            prefixes,\n            nextPageToken\n        };\n    }\n\n    // ------------------------------------------------------------------\n    // Private helpers\n    // ------------------------------------------------------------------\n\n    /**\n     * Validate file before upload\n     */\n    private validateFile(file: File): void {\n        const maxSize = this.config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n        if (file.size > maxSize) {\n            throw new Error(`File size ${file.size} exceeds maximum allowed size ${maxSize}`);\n        }\n\n        if (this.config.allowedMimeTypes && this.config.allowedMimeTypes.length > 0) {\n            if (!this.config.allowedMimeTypes.includes(file.type)) {\n                throw new Error(`File type ${file.type} is not allowed. Allowed types: ${this.config.allowedMimeTypes.join(\", \")}`);\n            }\n        }\n    }\n\n    /**\n     * Get the bucket name — either from parameter or config.\n     */\n    private getBucket(bucket?: string): string {\n        // \"default\" is a logical bucket name used by local storage;\n        // for GCS it should resolve to the configured bucket.\n        if (!bucket || bucket === \"default\") return this.config.bucket;\n        return bucket;\n    }\n\n    /**\n     * Flatten nested metadata to string values (GCS custom metadata requirement)\n     */\n    private flattenMetadata(metadata: Record<string, unknown>): Record<string, string> {\n        const flattened: Record<string, string> = {};\n        for (const [key, value] of Object.entries(metadata)) {\n            if (typeof value === \"string\") {\n                flattened[key] = value;\n            } else if (value !== undefined && value !== null) {\n                flattened[key] = JSON.stringify(value);\n            }\n        }\n        return flattened;\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Error helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Check whether an error represents a 404 / Not Found from the GCS client.\n */\nfunction isNotFoundError(error: unknown): boolean {\n    if (typeof error !== \"object\" || error === null) return false;\n    const err = error as Record<string, unknown>;\n    if (err[\"code\"] === 404) return true;\n    if (typeof err[\"message\"] === \"string\" && /not found/i.test(err[\"message\"])) return true;\n    return false;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AA2BA,IAAI,YAA2D;AAE/D,eAAe,UAA2D;CACtE,IAAI,WAAW,OAAO;CACtB,IAAI;EACA,YAAY,MAAM,OAAO;EACzB,OAAO;CACX,QAAQ;EACJ,MAAM,IAAI,MACN,kHAEJ;CACJ;AACJ;;;;;;;AAYA,IAAa,uBAAb,MAA+D;CAC3D;CACA,SAAsF;CAEtF,YAAY,QAA0B;EAClC,KAAK,SAAS;CAClB;CAMA,MAAc,YAAmF;EAC7F,IAAI,KAAK,QAAQ,OAAO,KAAK;EAC7B,MAAM,EAAE,YAAY,MAAM,QAAQ;EAClC,KAAK,SAAS,IAAI,QAAQ;GACtB,WAAW,KAAK,OAAO;GACvB,aAAa,KAAK,OAAO;GACzB,aAAa,KAAK,OAAO;EAC7B,CAAC;EACD,OAAO,KAAK;CAChB;CAMA,UAAiB;EACb,OAAO;CACX;;;;;CAMA,eAAyB;EACrB,OAAO,CAAC,WAAW,KAAK,OAAO,MAAM;CACzC;CAEA,MAAM,UAAU,EACZ,MACA,KACA,UACA,UAC2C;EAC3C,KAAK,aAAa,IAAI;EAEtB,MAAM,aAAa,KAAK,UAAU,MAAM;EAExC,MAAM,WAAU,MADK,KAAK,UAAU,EAAA,CACb,OAAO,UAAU,CAAC,CAAC,KAAK,GAAG;EAGlD,MAAM,cAAc,MAAM,KAAK,YAAY;EAC3C,MAAM,SAAS,OAAO,KAAK,WAAW;EAEtC,MAAM,QAAQ,KAAK,QAAQ;GACvB,aAAa,KAAK;GAClB,UAAU,WAAW,EAAE,UAAU,KAAK,gBAAgB,QAAQ,EAAE,IAAI,KAAA;EACxE,CAAC;EAED,OAAO;GACH;GACA,QAAQ;GACR,YAAY,QAAQ,WAAW,GAAG;EACtC;CACJ;CAEA,MAAM,aAAa,KAAa,QAA0C;EAEtE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GAEA,MAAM,WAAU,MADK,KAAK,UAAU,EAAA,CACb,OAAO,cAAc,CAAC,CAAC,KAAK,YAAY;GAG/D,MAAM,CAAC,gBAAgB,MAAM,QAAQ,YAAY;GAGjD,MAAM,YAAY,KAAK,OAAO,uBAAuB;GACrD,MAAM,CAAC,OAAO,MAAM,QAAQ,aAAa;IACrC,QAAQ;IACR,SAAS,KAAK,IAAI,IAAI,YAAY;GACtC,CAAC;GAWD,OAAO;IACH;IACA,UAAA;KAVA,QAAQ;KACR,UAAU;KACV,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACvC,MAAM,OAAO,aAAa,IAAI,KAAK;KACnC,aAAa,aAAa,eAAe;KACzC,gBAAiB,aAAa,YAAmD,CAAC;IAKlF;GACJ;EACJ,SAAS,OAAgB;GACrB,IAAI,gBAAgB,KAAK,GACrB,OAAO;IACH,KAAK;IACL,cAAc;GAClB;GAEJ,MAAM;EACV;CACJ;CAEA,MAAM,UAAU,KAAa,QAAuC;EAEhE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GAEA,MAAM,WAAU,MADK,KAAK,UAAU,EAAA,CACb,OAAO,cAAc,CAAC,CAAC,KAAK,YAAY;GAE/D,MAAM,CAAC,YAAY,MAAM,QAAQ,SAAS;GAG1C,MAAM,CAAC,gBAAgB,MAAM,QAAQ,YAAY;GACjD,MAAM,cAAc,aAAa,eAAe;GAChD,MAAM,WAAW,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAElD,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,WAAW,QAAQ,CAAC,GAAG,EAAE,MAAM,YAAY,CAAC;GACvE,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,MAAM,YAAY,CAAC;EAC3D,SAAS,OAAgB;GACrB,IAAI,gBAAgB,KAAK,GACrB,OAAO;GAEX,MAAM;EACV;CACJ;CAEA,MAAM,aAAa,KAAa,QAAgC;EAE5D,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAKA,OAFgB,MADK,KAAK,UAAU,EAAA,CACb,OAAO,cAAc,CAAC,CAAC,KAAK,YAE7C,CAAA,CAAQ,OAAO,EAAE,gBAAgB,KAAK,CAAC;CACjD;CAEA,MAAM,YAAY,QAAgB,SAIH;EAC3B,MAAM,iBAAiB,KAAK,UAAU,SAAS,MAAM;EAKrD,MAAM,CAAC,SAAS,oBAAoB,OAHlB,MADG,KAAK,UAAU,EAAA,CACX,OAAO,cAGU,CAAA,CAAU,SAAS;GACzD,QAAQ,cAAc,MAAM;GAC5B,WAAW;GACX,YAAY,SAAS,cAAc;GACnC,WAAW,SAAS;GACpB,cAAc;EAClB,CAAC;EAiCD,OAAO;GACH,OAhC8B,MAAM,KAAI,UAAS;IACjD,QAAQ;IACR,UAAU,KAAK;IACf,MAAM,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IACpC,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,KAAK;GACnD,EAyBI;GACA,WAtBC,kBAA0D,YAAwB,CAAC,EAAA,CAEvC,KAAI,MAAK;IAGtD,MAAM,SAAS,UAAU,CAAC;IAC1B,OAAO;KACH,QAAQ;KACR,UAAU;KACV,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACjC,QAAQ;KACR,MAAM;KACN,gBAAgB,QAAQ,eAAe,GAAG;IAC9C;GACJ,CAQI;GACA,eALC,kBAA0D;EAM/D;CACJ;;;;CASA,aAAqB,MAAkB;EACnC,MAAM,UAAU,KAAK,OAAO,eAAA;EAC5B,IAAI,KAAK,OAAO,SACZ,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,gCAAgC,SAAS;EAGpF,IAAI,KAAK,OAAO,oBAAoB,KAAK,OAAO,iBAAiB,SAAS;OAClE,CAAC,KAAK,OAAO,iBAAiB,SAAS,KAAK,IAAI,GAChD,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,kCAAkC,KAAK,OAAO,iBAAiB,KAAK,IAAI,GAAG;EAAA;CAG9H;;;;CAKA,UAAkB,QAAyB;EAGvC,IAAI,CAAC,UAAU,WAAW,WAAW,OAAO,KAAK,OAAO;EACxD,OAAO;CACX;;;;CAKA,gBAAwB,UAA2D;EAC/E,MAAM,YAAoC,CAAC;EAC3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAC9C,IAAI,OAAO,UAAU,UACjB,UAAU,OAAO;OACd,IAAI,UAAU,KAAA,KAAa,UAAU,MACxC,UAAU,OAAO,KAAK,UAAU,KAAK;EAG7C,OAAO;CACX;AACJ;;;;AASA,SAAS,gBAAgB,OAAyB;CAC9C,IAAI,OAAO,UAAU,YAAY,UAAU,MAAM,OAAO;CACxD,MAAM,MAAM;CACZ,IAAI,IAAI,YAAY,KAAK,OAAO;CAChC,IAAI,OAAO,IAAI,eAAe,YAAY,aAAa,KAAK,IAAI,UAAU,GAAG,OAAO;CACpF,OAAO;AACX"}

package/dist/{S3StorageController-CWvvrRpF.js → S3StorageController-5pAXyv31.js}

@@ -3,6 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
+import { o as folderKey, s as listingPrefix } from "./keys-g8lbVC_o.js";
 import "./types-BfKcm9do.js";
 //#region src/storage/S3StorageController.ts
 var S3StorageController_exports = /* @__PURE__ */ __exportAll({ S3StorageController: () => S3StorageController });
@@ -56,6 +57,16 @@ var S3StorageController = class {
 		return "s3";
 	}
 	/**
+	* The configured bucket, and the logical `default` that maps to it.
+	*
+	* Any other name went straight to S3 as a bucket name, so the request
+	* parameter was a way to address *any* bucket the deployment's credentials
+	* can reach — and a mistyped one came back as "file not found".
+	*/
+	knownBuckets() {
+		return ["default", this.config.bucket];
+	}
+	/**
 	* Validate file before upload
 	*/
 	validateFile(file) {
@@ -217,7 +228,7 @@ var S3StorageController = class {
 		const client = await this.getClient();
 		const command = new s3.ListObjectsV2Command({
 			Bucket: resolvedBucket,
-			Prefix: prefix || void 0,
+			Prefix: listingPrefix(prefix),
 			MaxKeys: options?.maxResults ?? 1e3,
 			ContinuationToken: options?.pageToken,
 			Delimiter: "/"
@@ -232,14 +243,17 @@ var S3StorageController = class {
 				root: null,
 				toString: () => `s3://${resolvedBucket}/${obj.Key}`
 			})),
-			prefixes: (response.CommonPrefixes || []).map((prefix) => ({
-				bucket: resolvedBucket,
-				fullPath: prefix.Prefix || "",
-				name: (prefix.Prefix || "").replace(/\/$/, "").split("/").pop() || "",
-				parent: null,
-				root: null,
-				toString: () => `s3://${resolvedBucket}/${prefix.Prefix}`
-			})),
+			prefixes: (response.CommonPrefixes || []).map((common) => {
+				const folder = folderKey(common.Prefix || "");
+				return {
+					bucket: resolvedBucket,
+					fullPath: folder,
+					name: folder.split("/").pop() || "",
+					parent: null,
+					root: null,
+					toString: () => `s3://${resolvedBucket}/${folder}`
+				};
+			}),
 			nextPageToken: response.NextContinuationToken
 		};
 	}
@@ -247,4 +261,4 @@ var S3StorageController = class {
 //#endregion
 export { S3StorageController_exports as n, S3StorageController as t };
 
-//# sourceMappingURL=S3StorageController-CWvvrRpF.js.map
+//# sourceMappingURL=S3StorageController-5pAXyv31.js.map

package/dist/S3StorageController-5pAXyv31.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"S3StorageController-5pAXyv31.js","names":[],"sources":["../src/storage/S3StorageController.ts"],"sourcesContent":["/**\n * S3-compatible storage controller (works with AWS S3 and MinIO)\n */\n\nimport type { S3Client as S3ClientType, } from \"@aws-sdk/client-s3\";\nimport { DEFAULT_MAX_FILE_SIZE, S3StorageConfig, StorageController } from \"./types\";\nimport { folderKey, listingPrefix } from \"./keys\";\nimport {\n    DownloadConfig,\n    DownloadMetadata,\n    StorageListResult,\n    StorageReference,\n    UploadFileProps,\n    UploadFileResult\n} from \"@rebasepro/types\";\n\nlet _s3Module: typeof import(\"@aws-sdk/client-s3\") | undefined;\nlet _presignerModule: typeof import(\"@aws-sdk/s3-request-presigner\") | undefined;\n\nasync function loadS3() {\n    if (!_s3Module) {\n        try {\n            _s3Module = await import(\"@aws-sdk/client-s3\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/client-s3 is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _s3Module;\n}\n\nasync function loadPresigner() {\n    if (!_presignerModule) {\n        try {\n            _presignerModule = await import(\"@aws-sdk/s3-request-presigner\");\n        } catch {\n            throw new Error(\n                \"@aws-sdk/s3-request-presigner is required for S3 storage. \" +\n                \"Install it: pnpm add @aws-sdk/client-s3 @aws-sdk/s3-request-presigner\"\n            );\n        }\n    }\n    return _presignerModule;\n}\n\n/**\n * S3-compatible storage implementation\n * Works with AWS S3 and MinIO (with forcePathStyle option)\n */\nexport class S3StorageController implements StorageController {\n    private config: S3StorageConfig;\n    private _client: S3ClientType | undefined;\n\n    constructor(config: S3StorageConfig) {\n        this.config = config;\n    }\n\n    /**\n     * Lazily create and cache the S3 client on first use\n     */\n    private async getClient(): Promise<S3ClientType> {\n        if (!this._client) {\n            const s3 = await loadS3();\n            this._client = new s3.S3Client({\n                region: this.config.region || \"us-east-1\",\n                endpoint: this.config.endpoint,\n                forcePathStyle: this.config.forcePathStyle ?? !!this.config.endpoint, // Auto-enable for custom endpoints (MinIO)\n                credentials: {\n                    accessKeyId: this.config.accessKeyId,\n                    secretAccessKey: this.config.secretAccessKey\n                }\n            });\n        }\n        return this._client;\n    }\n\n    getType(): \"s3\" {\n        return \"s3\";\n    }\n\n    /**\n     * The configured bucket, and the logical `default` that maps to it.\n     *\n     * Any other name went straight to S3 as a bucket name, so the request\n     * parameter was a way to address *any* bucket the deployment's credentials\n     * can reach — and a mistyped one came back as \"file not found\".\n     */\n    knownBuckets(): string[] {\n        return [\"default\", this.config.bucket];\n    }\n\n    /**\n     * Validate file before upload\n     */\n    private validateFile(file: File): void {\n        const maxSize = this.config.maxFileSize ?? DEFAULT_MAX_FILE_SIZE;\n        if (file.size > maxSize) {\n            throw new Error(`File size ${file.size} exceeds maximum allowed size ${maxSize}`);\n        }\n\n        if (this.config.allowedMimeTypes && this.config.allowedMimeTypes.length > 0) {\n            if (!this.config.allowedMimeTypes.includes(file.type)) {\n                throw new Error(`File type ${file.type} is not allowed. Allowed types: ${this.config.allowedMimeTypes.join(\", \")}`);\n            }\n        }\n    }\n\n    /**\n     * Get the bucket name - either from parameter or config\n     */\n    private getBucket(bucket?: string): string {\n        // \"default\" is a logical bucket name used by local storage;\n        // for S3 it should resolve to the configured bucket.\n        if (!bucket || bucket === \"default\") return this.config.bucket;\n        return bucket;\n    }\n\n    async putObject({\n        file,\n        key,\n        metadata,\n        bucket\n    }: UploadFileProps): Promise<UploadFileResult> {\n        this.validateFile(file);\n\n        const usedBucket = this.getBucket(bucket);\n\n        // Convert File to Buffer\n        const arrayBuffer = await file.arrayBuffer();\n        const buffer = Buffer.from(arrayBuffer);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.PutObjectCommand({\n            Bucket: usedBucket,\n            Key: key,\n            Body: buffer,\n            ContentType: file.type,\n            Metadata: metadata ? this.flattenMetadata(metadata) : undefined\n        });\n\n        await client.send(command);\n\n        return {\n            key,\n            bucket: usedBucket,\n            storageUrl: `s3://${usedBucket}/${key}`\n        };\n    }\n\n    /**\n     * Flatten nested metadata to string values (S3 requirement)\n     */\n    private flattenMetadata(metadata: Record<string, unknown>): Record<string, string> {\n        const flattened: Record<string, string> = {};\n        for (const [key, value] of Object.entries(metadata)) {\n            if (typeof value === \"string\") {\n                flattened[key] = value;\n            } else if (value !== undefined && value !== null) {\n                flattened[key] = JSON.stringify(value);\n            }\n        }\n        return flattened;\n    }\n\n    async getSignedUrl(key: string, bucket?: string): Promise<DownloadConfig> {\n        // Handle s3:// and gs:// URLs for backward compatibility\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const presigner = await loadPresigner();\n            const client = await this.getClient();\n\n            // First check if the object exists and get metadata\n            const headCommand = new s3.HeadObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const headResult = await client.send(headCommand);\n\n            // Generate a signed URL\n            const getCommand = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const expiresIn = this.config.signedUrlExpiration ?? 3600;\n            const url = await presigner.getSignedUrl(client, getCommand, { expiresIn });\n\n            const metadata: DownloadMetadata = {\n                bucket: resolvedBucket,\n                fullPath: resolvedPath,\n                name: resolvedPath.split(\"/\").pop() || resolvedPath,\n                size: headResult.ContentLength || 0,\n                contentType: headResult.ContentType || \"application/octet-stream\",\n                customMetadata: headResult.Metadata || {}\n            };\n\n            return {\n                url,\n                metadata\n            };\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NotFound\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return {\n                    url: null,\n                    fileNotFound: true\n                };\n            }\n            throw error;\n        }\n    }\n\n    async getObject(key: string, bucket?: string): Promise<File | null> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        try {\n            const s3 = await loadS3();\n            const client = await this.getClient();\n\n            const command = new s3.GetObjectCommand({\n                Bucket: resolvedBucket,\n                Key: resolvedPath\n            });\n\n            const response = await client.send(command);\n\n            if (!response.Body) {\n                return null;\n            }\n\n            // Convert stream to buffer\n            const chunks: Uint8Array[] = [];\n            for await (const chunk of response.Body as AsyncIterable<Uint8Array>) {\n                chunks.push(chunk);\n            }\n            const buffer = Buffer.concat(chunks);\n\n            const contentType = response.ContentType || \"application/octet-stream\";\n            const fileName = resolvedPath.split(\"/\").pop() || resolvedPath;\n\n            const blob = new Blob([buffer], { type: contentType });\n            return new File([blob], fileName, { type: contentType });\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NoSuchKey\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return null;\n            }\n            throw error;\n        }\n    }\n\n    async deleteObject(key: string, bucket?: string): Promise<void> {\n        // Handle s3:// and gs:// URLs\n        let resolvedPath = key;\n        let resolvedBucket = this.getBucket(bucket);\n\n        const match = key.match(/^(s3|gs):\\/\\//);\n        if (match) {\n            const protocolLength = match[0].length;\n            const withoutProtocol = key.substring(protocolLength);\n            const firstSlash = withoutProtocol.indexOf(\"/\");\n            if (firstSlash > 0) {\n                resolvedBucket = withoutProtocol.substring(0, firstSlash);\n                resolvedPath = withoutProtocol.substring(firstSlash + 1);\n            }\n        }\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.DeleteObjectCommand({\n            Bucket: resolvedBucket,\n            Key: resolvedPath\n        });\n\n        // Deleting something that is already gone is the outcome the caller\n        // wanted, so it is not an error. AWS itself answers DeleteObject with\n        // 204 for a key that never existed, but S3-compatible backends (MinIO,\n        // Ceph, R2 in some configurations) do raise NoSuchKey — and the local\n        // controller has always returned quietly in this case. Without this,\n        // which of those a deployment happens to run decides whether\n        // `DELETE /api/storage/:path` on a stale reference is a 200 or a 500.\n        try {\n            await client.send(command);\n        } catch (error: unknown) {\n            const s3Error = error as { name?: string; $metadata?: { httpStatusCode?: number } };\n            if (s3Error.name === \"NoSuchKey\" || s3Error.$metadata?.httpStatusCode === 404) {\n                return;\n            }\n            throw error;\n        }\n    }\n\n    async listObjects(prefix: string, options?: {\n        bucket?: string;\n        maxResults?: number;\n        pageToken?: string;\n    }): Promise<StorageListResult> {\n        const resolvedBucket = this.getBucket(options?.bucket);\n\n        const s3 = await loadS3();\n        const client = await this.getClient();\n\n        const command = new s3.ListObjectsV2Command({\n            Bucket: resolvedBucket,\n            Prefix: listingPrefix(prefix),\n            MaxKeys: options?.maxResults ?? 1000,\n            ContinuationToken: options?.pageToken,\n            Delimiter: \"/\" // This gives us folder-like behavior\n        });\n\n        const response = await client.send(command);\n\n        const items: StorageReference[] = (response.Contents || []).map(obj => ({\n            bucket: resolvedBucket,\n            fullPath: obj.Key || \"\",\n            name: (obj.Key || \"\").split(\"/\").pop() || \"\",\n            parent: null as never,\n            root: null as never,\n            toString: () => `s3://${resolvedBucket}/${obj.Key}`\n        }));\n\n        const prefixes: StorageReference[] = (response.CommonPrefixes || []).map(common => {\n            // Without the trailing slash S3 puts on a common prefix, so a\n            // `fullPath` from a listing is a key any controller accepts.\n            const folder = folderKey(common.Prefix || \"\");\n            return {\n                bucket: resolvedBucket,\n                fullPath: folder,\n                name: folder.split(\"/\").pop() || \"\",\n                parent: null as never,\n                root: null as never,\n                toString: () => `s3://${resolvedBucket}/${folder}`\n            };\n        });\n\n        return {\n            items,\n            prefixes,\n            nextPageToken: response.NextContinuationToken\n        };\n    }\n}\n"],"mappings":";;;;;;;;;AAgBA,IAAI;AACJ,IAAI;AAEJ,eAAe,SAAS;CACpB,IAAI,CAAC,WACD,IAAI;EACA,YAAY,MAAM,OAAO;CAC7B,QAAQ;EACJ,MAAM,IAAI,MACN,sHAEJ;CACJ;CAEJ,OAAO;AACX;AAEA,eAAe,gBAAgB;CAC3B,IAAI,CAAC,kBACD,IAAI;EACA,mBAAmB,MAAM,OAAO;CACpC,QAAQ;EACJ,MAAM,IAAI,MACN,iIAEJ;CACJ;CAEJ,OAAO;AACX;;;;;AAMA,IAAa,sBAAb,MAA8D;CAC1D;CACA;CAEA,YAAY,QAAyB;EACjC,KAAK,SAAS;CAClB;;;;CAKA,MAAc,YAAmC;EAC7C,IAAI,CAAC,KAAK,SAAS;GACf,MAAM,KAAK,MAAM,OAAO;GACxB,KAAK,UAAU,IAAI,GAAG,SAAS;IAC3B,QAAQ,KAAK,OAAO,UAAU;IAC9B,UAAU,KAAK,OAAO;IACtB,gBAAgB,KAAK,OAAO,kBAAkB,CAAC,CAAC,KAAK,OAAO;IAC5D,aAAa;KACT,aAAa,KAAK,OAAO;KACzB,iBAAiB,KAAK,OAAO;IACjC;GACJ,CAAC;EACL;EACA,OAAO,KAAK;CAChB;CAEA,UAAgB;EACZ,OAAO;CACX;;;;;;;;CASA,eAAyB;EACrB,OAAO,CAAC,WAAW,KAAK,OAAO,MAAM;CACzC;;;;CAKA,aAAqB,MAAkB;EACnC,MAAM,UAAU,KAAK,OAAO,eAAA;EAC5B,IAAI,KAAK,OAAO,SACZ,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,gCAAgC,SAAS;EAGpF,IAAI,KAAK,OAAO,oBAAoB,KAAK,OAAO,iBAAiB,SAAS;OAClE,CAAC,KAAK,OAAO,iBAAiB,SAAS,KAAK,IAAI,GAChD,MAAM,IAAI,MAAM,aAAa,KAAK,KAAK,kCAAkC,KAAK,OAAO,iBAAiB,KAAK,IAAI,GAAG;EAAA;CAG9H;;;;CAKA,UAAkB,QAAyB;EAGvC,IAAI,CAAC,UAAU,WAAW,WAAW,OAAO,KAAK,OAAO;EACxD,OAAO;CACX;CAEA,MAAM,UAAU,EACZ,MACA,KACA,UACA,UAC2C;EAC3C,KAAK,aAAa,IAAI;EAEtB,MAAM,aAAa,KAAK,UAAU,MAAM;EAGxC,MAAM,cAAc,MAAM,KAAK,YAAY;EAC3C,MAAM,SAAS,OAAO,KAAK,WAAW;EAEtC,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;GACpC,QAAQ;GACR,KAAK;GACL,MAAM;GACN,aAAa,KAAK;GAClB,UAAU,WAAW,KAAK,gBAAgB,QAAQ,IAAI,KAAA;EAC1D,CAAC;EAED,MAAM,OAAO,KAAK,OAAO;EAEzB,OAAO;GACH;GACA,QAAQ;GACR,YAAY,QAAQ,WAAW,GAAG;EACtC;CACJ;;;;CAKA,gBAAwB,UAA2D;EAC/E,MAAM,YAAoC,CAAC;EAC3C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,QAAQ,GAC9C,IAAI,OAAO,UAAU,UACjB,UAAU,OAAO;OACd,IAAI,UAAU,KAAA,KAAa,UAAU,MACxC,UAAU,OAAO,KAAK,UAAU,KAAK;EAG7C,OAAO;CACX;CAEA,MAAM,aAAa,KAAa,QAA0C;EAEtE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,YAAY,MAAM,cAAc;GACtC,MAAM,SAAS,MAAM,KAAK,UAAU;GAGpC,MAAM,cAAc,IAAI,GAAG,kBAAkB;IACzC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,aAAa,MAAM,OAAO,KAAK,WAAW;GAGhD,MAAM,aAAa,IAAI,GAAG,iBAAiB;IACvC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,YAAY,KAAK,OAAO,uBAAuB;GAYrD,OAAO;IACH,KAAA,MAZc,UAAU,aAAa,QAAQ,YAAY,EAAE,UAAU,CAAC;IAatE,UAAA;KAVA,QAAQ;KACR,UAAU;KACV,MAAM,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACvC,MAAM,WAAW,iBAAiB;KAClC,aAAa,WAAW,eAAe;KACvC,gBAAgB,WAAW,YAAY,CAAC;IAKxC;GACJ;EACJ,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,cAAc,QAAQ,WAAW,mBAAmB,KACrE,OAAO;IACH,KAAK;IACL,cAAc;GAClB;GAEJ,MAAM;EACV;CACJ;CAEA,MAAM,UAAU,KAAa,QAAuC;EAEhE,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,IAAI;GACA,MAAM,KAAK,MAAM,OAAO;GACxB,MAAM,SAAS,MAAM,KAAK,UAAU;GAEpC,MAAM,UAAU,IAAI,GAAG,iBAAiB;IACpC,QAAQ;IACR,KAAK;GACT,CAAC;GAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;GAE1C,IAAI,CAAC,SAAS,MACV,OAAO;GAIX,MAAM,SAAuB,CAAC;GAC9B,WAAW,MAAM,SAAS,SAAS,MAC/B,OAAO,KAAK,KAAK;GAErB,MAAM,SAAS,OAAO,OAAO,MAAM;GAEnC,MAAM,cAAc,SAAS,eAAe;GAC5C,MAAM,WAAW,aAAa,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAElD,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,MAAM,YAAY,CAAC;GACrD,OAAO,IAAI,KAAK,CAAC,IAAI,GAAG,UAAU,EAAE,MAAM,YAAY,CAAC;EAC3D,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,eAAe,QAAQ,WAAW,mBAAmB,KACtE,OAAO;GAEX,MAAM;EACV;CACJ;CAEA,MAAM,aAAa,KAAa,QAAgC;EAE5D,IAAI,eAAe;EACnB,IAAI,iBAAiB,KAAK,UAAU,MAAM;EAE1C,MAAM,QAAQ,IAAI,MAAM,eAAe;EACvC,IAAI,OAAO;GACP,MAAM,iBAAiB,MAAM,EAAE,CAAC;GAChC,MAAM,kBAAkB,IAAI,UAAU,cAAc;GACpD,MAAM,aAAa,gBAAgB,QAAQ,GAAG;GAC9C,IAAI,aAAa,GAAG;IAChB,iBAAiB,gBAAgB,UAAU,GAAG,UAAU;IACxD,eAAe,gBAAgB,UAAU,aAAa,CAAC;GAC3D;EACJ;EAEA,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,oBAAoB;GACvC,QAAQ;GACR,KAAK;EACT,CAAC;EASD,IAAI;GACA,MAAM,OAAO,KAAK,OAAO;EAC7B,SAAS,OAAgB;GACrB,MAAM,UAAU;GAChB,IAAI,QAAQ,SAAS,eAAe,QAAQ,WAAW,mBAAmB,KACtE;GAEJ,MAAM;EACV;CACJ;CAEA,MAAM,YAAY,QAAgB,SAIH;EAC3B,MAAM,iBAAiB,KAAK,UAAU,SAAS,MAAM;EAErD,MAAM,KAAK,MAAM,OAAO;EACxB,MAAM,SAAS,MAAM,KAAK,UAAU;EAEpC,MAAM,UAAU,IAAI,GAAG,qBAAqB;GACxC,QAAQ;GACR,QAAQ,cAAc,MAAM;GAC5B,SAAS,SAAS,cAAc;GAChC,mBAAmB,SAAS;GAC5B,WAAW;EACf,CAAC;EAED,MAAM,WAAW,MAAM,OAAO,KAAK,OAAO;EAyB1C,OAAO;GACH,QAxB+B,SAAS,YAAY,CAAC,EAAA,CAAG,KAAI,SAAQ;IACpE,QAAQ;IACR,UAAU,IAAI,OAAO;IACrB,OAAO,IAAI,OAAO,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;IAC1C,QAAQ;IACR,MAAM;IACN,gBAAgB,QAAQ,eAAe,GAAG,IAAI;GAClD,EAiBI;GACA,WAhBkC,SAAS,kBAAkB,CAAC,EAAA,CAAG,KAAI,WAAU;IAG/E,MAAM,SAAS,UAAU,OAAO,UAAU,EAAE;IAC5C,OAAO;KACH,QAAQ;KACR,UAAU;KACV,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;KACjC,QAAQ;KACR,MAAM;KACN,gBAAgB,QAAQ,eAAe,GAAG;IAC9C;GACJ,CAII;GACA,eAAe,SAAS;EAC5B;CACJ;AACJ"}

package/dist/admin-roles-vYdp_Pil.js

@@ -0,0 +1,36 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+//#region src/auth/admin-roles.ts
+/**
+* Which role names carry administrative privilege.
+*
+* One definition, because there used to be several and they disagreed.
+* `requireAdmin` accepted `admin` **or** `schema-admin`; the guard that refuses
+* a dangerous `defaultRole` compared against `admin` alone. So
+* `AUTH_DEFAULT_ROLE=schema-admin` passed the guard and made every public
+* registrant an administrator — and, since a `schema-admin` may edit users, one
+* of them could then grant themselves real `admin` and keep it.
+*
+* The guard and the check have to read the same list or the gap comes back, so
+* neither of them owns it.
+*
+* `schema-admin` is here deliberately: it can reach the schema editor and the
+* SQL surfaces, which is administrative by any definition that matters. If a
+* genuinely lesser role is added later, it does not belong in this list — it
+* belongs in a capability check of its own.
+*/
+var ADMINISTRATIVE_ROLES = ["admin", "schema-admin"];
+/** Does this single role name carry administrative privilege? */
+function isAdministrativeRole(role) {
+	return ADMINISTRATIVE_ROLES.includes(role);
+}
+/** Does any role in this list carry administrative privilege? */
+function hasAdministrativeRole(roles) {
+	return !!roles?.some(isAdministrativeRole);
+}
+//#endregion
+export { hasAdministrativeRole as n, isAdministrativeRole as r, ADMINISTRATIVE_ROLES as t };
+
+//# sourceMappingURL=admin-roles-vYdp_Pil.js.map

package/dist/admin-roles-vYdp_Pil.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-roles-vYdp_Pil.js","names":[],"sources":["../src/auth/admin-roles.ts"],"sourcesContent":["/**\n * Which role names carry administrative privilege.\n *\n * One definition, because there used to be several and they disagreed.\n * `requireAdmin` accepted `admin` **or** `schema-admin`; the guard that refuses\n * a dangerous `defaultRole` compared against `admin` alone. So\n * `AUTH_DEFAULT_ROLE=schema-admin` passed the guard and made every public\n * registrant an administrator — and, since a `schema-admin` may edit users, one\n * of them could then grant themselves real `admin` and keep it.\n *\n * The guard and the check have to read the same list or the gap comes back, so\n * neither of them owns it.\n *\n * `schema-admin` is here deliberately: it can reach the schema editor and the\n * SQL surfaces, which is administrative by any definition that matters. If a\n * genuinely lesser role is added later, it does not belong in this list — it\n * belongs in a capability check of its own.\n */\nexport const ADMINISTRATIVE_ROLES = [\"admin\", \"schema-admin\"] as const;\n\nexport type AdministrativeRole = (typeof ADMINISTRATIVE_ROLES)[number];\n\n/** Does this single role name carry administrative privilege? */\nexport function isAdministrativeRole(role: string): role is AdministrativeRole {\n    return (ADMINISTRATIVE_ROLES as readonly string[]).includes(role);\n}\n\n/** Does any role in this list carry administrative privilege? */\nexport function hasAdministrativeRole(roles: readonly string[] | null | undefined): boolean {\n    return !!roles?.some(isAdministrativeRole);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkBA,IAAa,uBAAuB,CAAC,SAAS,cAAc;;AAK5D,SAAgB,qBAAqB,MAA0C;CAC3E,OAAQ,qBAA2C,SAAS,IAAI;AACpE;;AAGA,SAAgB,sBAAsB,OAAsD;CACxF,OAAO,CAAC,CAAC,OAAO,KAAK,oBAAoB;AAC7C"}

package/dist/{admin_block-BX6YULvJ.js → admin_block-0Xu0r6eZ.js}

@@ -38,6 +38,7 @@ var ADMIN_COLLECTION_KEYS = [
 	"Actions",
 	"additionalFields",
 	"alwaysApplyDefaultValues",
+	"browserCallbacks",
 	"components",
 	"customViews",
 	"defaultEntityAction",
@@ -105,6 +106,7 @@ var ADMIN_PROPERTY_KEYS = [
 	"Filter",
 	"filterOperators",
 	"fixedFilter",
+	"format",
 	"hideFromCollection",
 	"includeEntityLink",
 	"includeId",
@@ -115,6 +117,7 @@ var ADMIN_PROPERTY_KEYS = [
 	"previewAsTag",
 	"previewProperties",
 	"readOnly",
+	"renderInForm",
 	"sortable",
 	"span",
 	"spreadChildren",
@@ -182,4 +185,4 @@ function nestAdminPropertyKeys(property) {
 //#endregion
 export { nestAdminPropertyKeys as i, ADMIN_PROPERTY_KEYS as n, nestAdminCollectionKeys as r, ADMIN_COLLECTION_KEYS as t };
 
-//# sourceMappingURL=admin_block-BX6YULvJ.js.map
+//# sourceMappingURL=admin_block-0Xu0r6eZ.js.map

package/dist/admin_block-0Xu0r6eZ.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin_block-0Xu0r6eZ.js","names":[],"sources":["../../types/src/types/admin_block.ts"],"sourcesContent":["/**\n * The keys of a collection's admin block, as data.\n *\n * There is no *type* for the block in this package any more, and that is the point:\n * `admin` is not declared on `BaseCollectionConfig` or on any property here, so a\n * BaaS install cannot even write one. `@rebasepro/cms-types` adds the field back by\n * declaration merging, which is why installing it is what makes the admin surface\n * appear.\n *\n * The *list* still has to live here, because three runtime consumers need it and two\n * of them are core — see below.\n */\n\n/**\n * Every key that belongs inside a collection's `admin` block, as data.\n *\n * The type that describes these fields is `AdminCollectionOptions` in\n * `@rebasepro/cms-types`, and it is erased at build time — but three runtime\n * consumers need the list, and two of them are core:\n *\n * - `serializeCollections`, to drop the block from the contract\n * - the ts-morph schema editor in `@rebasepro/server`, which rewrites collection\n *   files on disk from the admin panel and has to know where each key goes. A key\n *   missing from this list gets written to the *top level* of the file, where the\n *   backend ignores it and the panel never finds it again.\n * - the `collections-admin-block` codemod\n *\n * `@rebasepro/cms-types` re-exports this and asserts it names only real option\n * keys; the count is pinned by a test there.\n *\n * @group Models\n */\nexport const ADMIN_COLLECTION_KEYS = [\n    \"Actions\",\n    \"additionalFields\",\n    \"alwaysApplyDefaultValues\",\n    \"browserCallbacks\",\n    \"components\",\n    \"customViews\",\n    \"defaultEntityAction\",\n    \"defaultFilter\",\n    \"defaultSelectedView\",\n    \"defaultSize\",\n    \"defaultViewMode\",\n    \"disableDefaultActions\",\n    \"display\",\n    \"enabledViews\",\n    \"entityActions\",\n    \"entityViews\",\n    \"exportable\",\n    \"filterPresets\",\n    \"fixedFilter\",\n    \"form\",\n    \"formAutoSave\",\n    \"formView\",\n    \"group\",\n    \"hideFromEntityViews\",\n    \"hideFromNavigation\",\n    \"hideIdFromCollection\",\n    \"hideIdFromForm\",\n    \"icon\",\n    \"includeJsonView\",\n    \"inlineEditing\",\n    \"kanban\",\n    \"listProperties\",\n    \"localChangesBackup\",\n    \"openEntityMode\",\n    \"orderProperty\",\n    \"pagination\",\n    \"previewProperties\",\n    \"propertiesOrder\",\n    \"selectionController\",\n    \"selectionEnabled\",\n    \"sideDialogWidth\",\n    \"sort\"\n] as const;\n\n/** A key of a collection's `admin` block. @group Models */\nexport type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];\n\n/**\n * Every key that belongs inside a *property's* `admin` block, as data.\n *\n * The union of `AdminPropertyOptions` and its per-type extensions\n * (`AdminStringOptions`, `AdminArrayOptions`, …) in `@rebasepro/cms-types`.\n * It lives here for the same reason {@link ADMIN_COLLECTION_KEYS} does: the\n * runtime consumers are core packages that the BaaS guard forbids from\n * importing `@rebasepro/cms-types`. Here it is the boot-time collection\n * validator in `@rebasepro/server`, which has to tell \"you left `readOnly` at\n * the top of the property, where nothing reads it\" apart from \"you invented a\n * key we have never heard of\".\n *\n * `@rebasepro/cms-types` re-exports this and asserts it names only real\n * option keys.\n *\n * @group Models\n */\nexport const ADMIN_PROPERTY_KEYS = [\n    \"canAddElements\",\n    \"clearable\",\n    \"columnWidth\",\n    \"customProps\",\n    \"disabled\",\n    \"expanded\",\n    \"Field\",\n    \"Filter\",\n    \"filterOperators\",\n    \"fixedFilter\",\n    \"format\",\n    \"hideFromCollection\",\n    \"includeEntityLink\",\n    \"includeId\",\n    \"markdown\",\n    \"minimalistView\",\n    \"multiline\",\n    \"Preview\",\n    \"previewAsTag\",\n    \"previewProperties\",\n    \"readOnly\",\n    \"renderInForm\",\n    \"sortable\",\n    \"span\",\n    \"spreadChildren\",\n    \"urlPreview\",\n    \"widget\",\n] as const;\n\n/** A key of a property's `admin` block. @group Models */\nexport type AdminPropertyKey = typeof ADMIN_PROPERTY_KEYS[number];\n\n/**\n * Move flattened admin keys back down into the `admin` block.\n *\n * The admin panel works with a *flat* view model — the block merged onto the\n * collection — so what comes back from a form has `icon` and `defaultViewMode`\n * at the top level while `admin` still holds whatever the file was loaded with.\n * This is the way back.\n *\n * **The top-level value wins.** It is the one the form just wrote; the block is\n * the copy the collection was loaded with, and preferring it resolves every edit\n * in favour of the value the user changed away from.\n *\n * This lives here, next to the key lists, because it had two implementations —\n * `toAdminCollectionConfig` in `@rebasepro/cms-types` and `nestAdminKeys` in\n * `@rebasepro/server`'s schema editor — that agreed on everything except that\n * precedence, which is the only part that decides whether a save is visible.\n *\n * @group Models\n */\nexport function nestAdminKeysOf(\n    source: Record<string, unknown>,\n    adminKeys: readonly string[]\n): Record<string, unknown> {\n    const keys = new Set<string>(adminKeys);\n    const top: Record<string, unknown> = {};\n    const block: Record<string, unknown> = { ...((source.admin as Record<string, unknown> | undefined) ?? {}) };\n\n    for (const [key, value] of Object.entries(source)) {\n        if (key === \"admin\") continue;\n        if (keys.has(key)) block[key] = value;\n        else top[key] = value;\n    }\n\n    if (Object.keys(block).length > 0) top.admin = block;\n    return top;\n}\n\n/**\n * {@link nestAdminKeysOf} for a collection.\n *\n * @group Models\n */\nexport function nestAdminCollectionKeys(collection: Record<string, unknown>): Record<string, unknown> {\n    return nestAdminKeysOf(collection, ADMIN_COLLECTION_KEYS);\n}\n\n/**\n * {@link nestAdminKeysOf} for a property, applied to its children too.\n *\n * A map property carries `properties`, an array property carries `of`, and both\n * hold properties with `admin` blocks of their own. A flat `readOnly` left on a\n * child is as dead — and as fatal at the next boot — as one left on the parent,\n * so the walk goes all the way down.\n *\n * @group Models\n */\nexport function nestAdminPropertyKeys(property: Record<string, unknown>): Record<string, unknown> {\n    const nested = nestAdminKeysOf(property, ADMIN_PROPERTY_KEYS);\n\n    const children = nested.properties;\n    if (children && typeof children === \"object\" && !Array.isArray(children)) {\n        nested.properties = Object.fromEntries(\n            Object.entries(children as Record<string, unknown>).map(([key, child]) => [\n                key,\n                child && typeof child === \"object\" && !Array.isArray(child)\n                    ? nestAdminPropertyKeys(child as Record<string, unknown>)\n                    : child\n            ])\n        );\n    }\n\n    const of = nested.of;\n    if (Array.isArray(of)) {\n        nested.of = of.map(entry => entry && typeof entry === \"object\" && !Array.isArray(entry)\n            ? nestAdminPropertyKeys(entry as Record<string, unknown>)\n            : entry);\n    } else if (of && typeof of === \"object\") {\n        nested.of = nestAdminPropertyKeys(of as Record<string, unknown>);\n    }\n\n    return nested;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,IAAa,wBAAwB;CACjC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;AAsBA,IAAa,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACJ;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,gBACZ,QACA,WACuB;CACvB,MAAM,OAAO,IAAI,IAAY,SAAS;CACtC,MAAM,MAA+B,CAAC;CACtC,MAAM,QAAiC,EAAE,GAAK,OAAO,SAAiD,CAAC,EAAG;CAE1G,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,MAAM,GAAG;EAC/C,IAAI,QAAQ,SAAS;EACrB,IAAI,KAAK,IAAI,GAAG,GAAG,MAAM,OAAO;OAC3B,IAAI,OAAO;CACpB;CAEA,IAAI,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,GAAG,IAAI,QAAQ;CAC/C,OAAO;AACX;;;;;;AAOA,SAAgB,wBAAwB,YAA8D;CAClG,OAAO,gBAAgB,YAAY,qBAAqB;AAC5D;;;;;;;;;;;AAYA,SAAgB,sBAAsB,UAA4D;CAC9F,MAAM,SAAS,gBAAgB,UAAU,mBAAmB;CAE5D,MAAM,WAAW,OAAO;CACxB,IAAI,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,GACnE,OAAO,aAAa,OAAO,YACvB,OAAO,QAAQ,QAAmC,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CACtE,KACA,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACpD,sBAAsB,KAAgC,IACtD,KACV,CAAC,CACL;CAGJ,MAAM,KAAK,OAAO;CAClB,IAAI,MAAM,QAAQ,EAAE,GAChB,OAAO,KAAK,GAAG,KAAI,UAAS,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAChF,sBAAsB,KAAgC,IACtD,KAAK;MACR,IAAI,MAAM,OAAO,OAAO,UAC3B,OAAO,KAAK,sBAAsB,EAA6B;CAGnE,OAAO;AACX"}

package/dist/api/errors.d.ts

@@ -1,5 +1,28 @@
 import type { ErrorHandler } from "hono";
 import type { HonoEnv } from "./types.js";
+/**
+ * The schema-drift remedy, in the words that work on *this* database.
+ *
+ * The three copies of this message hard-coded `Run \`pnpm db:push\``, and on a
+ * stock scaffold — where the managed PGlite database is the default — that
+ * command answers `✗ rebase db push does not work on the managed development
+ * database.` and exits 1. So the one instruction the server gave when a
+ * developer's schema had drifted was a command their project refuses.
+ *
+ * Atlas plans a push by diffing against a second, empty database, and PGlite
+ * serves exactly one — which is why it cannot run there, and why the remedy
+ * has to know which database is under this run. There, boot applies additive
+ * changes, so restarting `rebase dev` *is* the fix.
+ *
+ * `REBASE_DEV_DATABASE_KIND` is set by the CLI from the database it resolved,
+ * the same variable `rebase schema generate`'s closing line already branches
+ * on. Absent — a deployed backend, a container, anything not started by
+ * `rebase dev` — the answer is the general one.
+ */
+export declare function schemaDriftRemedy(): {
+    short: string;
+    lines: string[];
+};
 /**
  * Standardized API error class.
  * Throw this from any route handler — the errorHandler middleware
@@ -56,6 +79,20 @@ export interface ErrorResponse {
         details?: unknown;
         /** Request correlation ID for tracing (echoes X-Request-ID). */
         requestId?: string;
+        /**
+         * Why this request was going to fail whatever it asked for.
+         *
+         * Only `SCHEMA_DRIFT` today: the caller's `x-rebase-schema` stamp is
+         * older than this backend's, so a 400 naming an unknown field is very
+         * likely a rename the client has not regenerated for. The error itself
+         * is unchanged — this explains it, it does not cause it.
+         */
+        cause?: {
+            code: string;
+            message: string;
+            clientSchema: string;
+            serverSchema: string;
+        };
     };
 }
 /**

package/dist/api/live-schema-routes.d.ts

@@ -60,6 +60,20 @@ export interface LiveSchemaRoutesConfig {
         path: string;
         contents: string;
     }[]>;
+    /**
+     * Why {@link writeSource} is absent, when the caller knows.
+     *
+     * `writeSource` being undefined has several causes — the editor turned off,
+     * `baas` mode, no `collectionsDir`, `NODE_ENV=production`, `ts-morph` not
+     * installed — and this route could see only that the field was unset, so it
+     * reported the last of them for all of them. The admin panel calls this
+     * *and* `/api/schema-editor/status` on every page load and got two
+     * different answers, one of which named a dependency that was installed.
+     */
+    sourceEditingOff?: {
+        code: string;
+        message: string;
+    };
     /**
      * Which paths {@link writeSource} will touch, without touching them.
      *

package/dist/api/logs-routes.d.ts

@@ -58,6 +58,14 @@ export interface LogMiddlewareOptions {
 }
 /** Hono middleware to log API requests */
 export declare function logMiddleware(options?: LogMiddlewareOptions): MiddlewareHandler<HonoEnv>;
+/**
+ * The `source` for a teed line, from whatever prefix it carries.
+ *
+ * Exported for its test: the mapping is a string match on wording somebody else
+ * writes, which is the shape of check that stops working without failing.
+ */
+export declare function sourceForMessage(message: string): LogEntry["source"];
+export declare function teeLoggerIntoLogBuffer(): () => void;
 /**
  * The stream's timings, injectable only so they can be tested.
  *

package/dist/api/rest/api-generator.d.ts

@@ -32,6 +32,39 @@ export declare class RestApiGenerator {
      * Generate REST routes using existing DataDriver
      */
     generateRoutes(): Hono<HonoEnv>;
+    /**
+     * A 404 that says which row was not found, and names the other reason.
+     *
+     * "Entity not found" was the entire message on five routes. It does not say
+     * which collection, which id, or — the part that costs the most time — that
+     * a row can be perfectly present and invisible: authenticated requests run
+     * as a restricted role, so a `SELECT` policy that excludes this caller
+     * produces exactly this 404. Somebody checking whether the row exists finds
+     * it in psql, concludes the API is broken, and goes looking in the wrong
+     * place.
+     *
+     * The collection and the id are both in the URL the caller just sent, so
+     * naming them back reveals nothing. `details` is withheld in production
+     * anyway, on the same principle as the database diagnostics one layer up:
+     * structured fields are for the people building against this, and a
+     * deployed API answers strangers.
+     */
+    private entityNotFound;
+    /**
+     * Record which collection a request is about, before anything can fail.
+     *
+     * One middleware rather than a `c.set` in each of the fifteen handlers,
+     * because the value has to be there for the ones that throw *before*
+     * reaching a handler body — an API-key permission check, a query parser
+     * refusing an operator — which is exactly the set of requests whose log
+     * line is worth reading.
+     *
+     * The slug is validated against the collections this backend serves, so the
+     * field is always a real collection and never whatever a caller typed. An
+     * unknown slug leaves it unset; the path is still logged, and the
+     * unmatched-route handler already says the collection does not exist.
+     */
+    private nameTheCollection;
     /**
      * Answer anything left under `/api/data` in the canonical error envelope.
      *

package/dist/api/root-error-handler.d.ts

@@ -0,0 +1,62 @@
+import { Hono } from "hono";
+import type { HonoEnv } from "./types.js";
+/**
+ * Give the root app the JSON error envelope, unless it already has one.
+ *
+ * `errorHandler` was installed on the data router and the functions router and
+ * nowhere else, so anything thrown outside those two — an app-level middleware,
+ * an auth route, a storage route, a custom route a project mounted itself — fell
+ * through to Hono's default: `500` with the body `Internal Server Error`, as
+ * `text/plain`. A client that parses `error.code` got a JSON parse failure
+ * instead of a code, which is the one shape no caller handles.
+ *
+ * The check is deliberate rather than an unconditional `onError`. An
+ * application that passes its own `config.app` may have installed a handler of
+ * its own, and overwriting it would silently replace the project's error
+ * contract with ours — a much worse failure than the one this fixes, because it
+ * would look like the framework working.
+ *
+ * Identity against a fresh `Hono` is what distinguishes the two: Hono's default
+ * handler is one module-level function shared by every instance, so an app that
+ * has never been given a handler compares equal to a brand-new one, and an app
+ * that has compares unequal. It reads a private field, which is why it is here,
+ * behind a name, with a test that fails if Hono ever stops working this way.
+ */
+export declare function installRootErrorHandler(app: Hono<HonoEnv>): boolean;
+/**
+ * And the same envelope for a path under `basePath` that matched nothing.
+ *
+ * `onError` was only ever half of it. A request that matches no route is not a
+ * thrown error — Hono answers it from its not-found handler, which `onError`
+ * never sees — so every unmatched path under `/api` came back as `404 Not
+ * Found`, `text/plain`. `backend/errors.md` opens by promising that *every*
+ * failure uses one envelope and carries a stable `code`, and
+ * `troubleshooting.md` says it again; a client parsing `error.code` got a JSON
+ * parse failure instead, which is the one shape no caller handles. Through the
+ * SDK it arrived as `RebaseApiError { code: undefined }`, so `e.code ===
+ * "NOT_FOUND"` never matched.
+ *
+ * Written as middleware that inspects the answer, rather than as `app.notFound`
+ * or as a catch-all route, because both of those are wrong here:
+ *
+ * - `app.notFound` would *replace* the handler of an application that passes its
+ *   own `config.app`. Hono keeps that handler in a `#private` field, so — unlike
+ *   the error handler, which is readable and therefore respected — there is no
+ *   way to tell an app that has one from an app that has the default.
+ * - A catch-all route depends on being registered after every real route, and
+ *   `boot.ts` registers `/api/health` *after* `initializeRebaseBackend` returns.
+ *   A catch-all would have swallowed the health probe.
+ *
+ * Post-processing has neither problem: it converts a 404 that came back as
+ * anything but JSON, and leaves the ones that are already an envelope — a
+ * storage miss, an unknown collection, an unknown function — exactly as their
+ * route wrote them. Scoped to `basePath`, so an app serving its own pages at `/`
+ * keeps answering its own way for the pages.
+ *
+ * `expected`, so it logs at debug. A 404 from a frontend holding a stale link is
+ * routine, and a `⚠️` per request would trade a missing envelope for noise
+ * nobody can act on.
+ */
+export declare function installUnmatchedApiEnvelope(app: Hono<HonoEnv>, basePath: string): void;
+/** Whether `onError` has been called on this app. */
+export declare function hasOwnErrorHandler(app: Hono<never> | Hono<HonoEnv>): boolean;

package/dist/api/schema-drift.d.ts

@@ -0,0 +1,39 @@
+import type { MiddlewareHandler } from "hono";
+import type { HonoEnv } from "./types.js";
+/**
+ * What a request said about the schema it was built against, and what this
+ * server's schema actually is.
+ *
+ * Both stamps, always — "your SDK is stale" is not actionable without the two
+ * numbers to compare and quote.
+ */
+export interface SchemaDrift {
+    /** The stamp the caller's generated SDK carries. */
+    client: string;
+    /** The stamp this backend's collections hash to. */
+    server: string;
+}
+/**
+ * Notice that a caller was generated against an older schema than this one.
+ *
+ * The header has been documented for a while — "echoed by a generated SDK in
+ * the `x-rebase-schema` header … so the platform can say 'this app was built
+ * against an older schema' instead of failing mysteriously at the first
+ * request" — and the sender became real when `generate-sdk` started emitting
+ * `schema.meta.ts`. Nothing read it. A renamed column therefore answered a
+ * generated client with a bare 400 naming a field the client's own types say
+ * exists, which is the exact confusion the header was introduced to prevent.
+ *
+ * This does not refuse anything. Drift is *not* an error: an SDK a schema older
+ * than the server's is usually still perfectly compatible — nothing it knows
+ * about was touched — and a middleware that rejected on a version mismatch
+ * would break every deploy where the backend ships before the frontend. So it
+ * only records the fact, and the error handler attaches it as the cause of a
+ * 400 or 404 that would have been returned anyway. A request that succeeds
+ * never learns it was stale.
+ *
+ * `resolveServerVersion` is a thunk, called at most once: computing a stamp
+ * walks and canonicalizes every collection, and a project whose bundle recorded
+ * one at build time (all of them but `baas`) answers without computing at all.
+ */
+export declare function createSchemaDriftDetector(resolveServerVersion: () => string | undefined): MiddlewareHandler<HonoEnv>;