@rebasepro/server 0.17.3 → 0.18.1

package/dist/{backup-CRdZkA6c.js → backup-C8P6Cl3G.js}

@@ -3,7 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
-import { n as errorHandler, t as ApiError } from "./errors-DBwpj9N8.js";
+import { n as errorHandler, t as ApiError } from "./errors-HjfaPlvY.js";
 import fs from "fs";
 import path from "path";
 import { Hono } from "hono";
@@ -161,4 +161,4 @@ var backup_exports = /* @__PURE__ */ __exportAll({
 //#endregion
 export { parseBackupTimestamp as a, parseBackupDestination as i, createBackupRoutes as n, readBackupBytes as o, listBackupObjects as r, backup_exports as t };
 
-//# sourceMappingURL=backup-CRdZkA6c.js.map
+//# sourceMappingURL=backup-C8P6Cl3G.js.map

package/dist/{backup-CRdZkA6c.js.map → backup-C8P6Cl3G.js.map}

@@ -1 +1 @@
-{"version":3,"file":"backup-CRdZkA6c.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * Only `.dump` files are considered.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\"\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only .dump files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(\".dump\")) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!key.endsWith(\".dump\")) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;AAMA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;GACrB;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;EAC1B;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,SAAS,SAAS,OAAO,GAC1E,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,IAAI,SAAS,OAAO,GAAG,OAAO;CACnC,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;ACrGA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}
+{"version":3,"file":"backup-C8P6Cl3G.js","names":[],"sources":["../src/backup/backup-common.ts","../src/backup/backup-routes.ts","../src/backup/index.ts"],"sourcesContent":["/**\n * Storage-generic backup helpers used by the admin backup routes.\n *\n * These live in server (which owns {@link StorageController}) so the\n * admin API can list backups without depending on the Postgres driver —\n * `server` must not import from `server-postgres`. The `pg_dump`-side\n * copies of the tiny pure parsers live in `@rebasepro/server-postgres`;\n * keep the two in sync if the naming scheme ever changes.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport type { BackupInfo, BackupDestinationKind } from \"@rebasepro/types\";\nimport type { StorageController } from \"../storage\";\n\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/** Parse a destination string (`s3://…`, `gs://…`, or a local path). */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) return { kind: \"s3\", bucket: s3[1], prefix: s3[2].replace(/\\/+$/, \"\") };\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) return { kind: \"gcs\", bucket: gcs[1], prefix: gcs[2].replace(/\\/+$/, \"\") };\n    return { kind: \"local\", path: out };\n}\n\n/**\n * Recover the UTC creation time encoded in a `rebase-<db>-<ts>.dump` name.\n * Returns `null` for names that don't match, so foreign objects are ignored.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * List the backups at a destination as {@link BackupInfo}, newest first.\n * Only `.dump` files are considered.\n */\nexport async function listBackupObjects(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupInfo[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        if (!fs.existsSync(dir)) return [];\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f): BackupInfo => {\n                const full = path.join(dir, f);\n                const st = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? st.mtime;\n                return {\n                    key: full,\n                    name: f,\n                    sizeBytes: st.size,\n                    createdAt: createdAt.toISOString(),\n                    destinationKind: \"local\"\n                };\n            })\n            .sort(byNewest);\n    }\n\n    if (!storage) return [];\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key): BackupInfo => {\n            const createdAt = parseBackupTimestamp(key);\n            return {\n                key,\n                name: key.split(\"/\").pop() || key,\n                createdAt: createdAt ? createdAt.toISOString() : undefined,\n                destinationKind: dest.kind as BackupDestinationKind\n            };\n        })\n        .sort(byNewest);\n}\n\nfunction byNewest(a: BackupInfo, b: BackupInfo): number {\n    const ta = a.createdAt ? Date.parse(a.createdAt) : 0;\n    const tb = b.createdAt ? Date.parse(b.createdAt) : 0;\n    return tb - ta;\n}\n\n/** Read a single backup's bytes. Guards against path traversal for local. */\nexport async function readBackupBytes(\n    dest: BackupDestination,\n    key: string,\n    storage?: StorageController\n): Promise<{ bytes: Uint8Array<ArrayBuffer>; name: string } | null> {\n    if (dest.kind === \"local\") {\n        const stat = fs.existsSync(dest.path) ? fs.statSync(dest.path) : null;\n        const dir = stat?.isDirectory() ? dest.path : path.dirname(dest.path);\n        const resolvedDir = path.resolve(dir);\n        const resolved = path.resolve(key);\n        // Only allow reads inside the backup directory, and only .dump files.\n        if (!resolved.startsWith(resolvedDir + path.sep) || !resolved.endsWith(\".dump\")) {\n            return null;\n        }\n        if (!fs.existsSync(resolved)) return null;\n        return { bytes: new Uint8Array(fs.readFileSync(resolved)), name: path.basename(resolved) };\n    }\n\n    if (!storage) return null;\n    if (!key.endsWith(\".dump\")) return null;\n    const file = await storage.getObject(key, dest.bucket);\n    if (!file) return null;\n    return { bytes: new Uint8Array(await file.arrayBuffer()), name: key.split(\"/\").pop() || key };\n}\n","import { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { ApiError, errorHandler } from \"../api/errors\";\nimport type { StorageController } from \"../storage\";\nimport { BackupDestination, listBackupObjects, readBackupBytes } from \"./backup-common\";\n\nexport interface BackupRoutesConfig {\n    /**\n     * Resolve the current backup destination, or `null` when backups are not\n     * configured (`BACKUP_DESTINATION` unset). Read lazily so a restart isn't\n     * required to pick up config.\n     */\n    getDestination: () => BackupDestination | null;\n    /** Storage controller for object-storage destinations. */\n    storage?: StorageController;\n}\n\n/**\n * Admin REST routes for the Backups panel.\n *\n * Routes (mounted under `/admin/backups`, admin-guarded by the caller):\n *   GET /            → list available backups\n *   GET /download    → download a backup's bytes (?key=…)\n */\nexport function createBackupRoutes(config: BackupRoutesConfig): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    router.onError(errorHandler);\n\n    router.get(\"/\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            return c.json({ backups: [], destinationKind: \"local\" as const, configured: false });\n        }\n        const backups = await listBackupObjects(dest, config.storage);\n        return c.json({ backups, destinationKind: dest.kind, configured: true });\n    });\n\n    router.get(\"/download\", async (c) => {\n        const dest = config.getDestination();\n        if (!dest) {\n            throw ApiError.badRequest(\"Backups are not configured (set BACKUP_DESTINATION).\");\n        }\n        const key = c.req.query(\"key\");\n        if (!key) {\n            throw ApiError.badRequest(\"Missing 'key' query parameter.\");\n        }\n        const result = await readBackupBytes(dest, key, config.storage);\n        if (!result) {\n            throw ApiError.notFound(`Backup not found: ${key}`);\n        }\n        c.header(\"Content-Type\", \"application/octet-stream\");\n        c.header(\"Content-Disposition\", `attachment; filename=\"${result.name}\"`);\n        return c.body(result.bytes);\n    });\n\n    return router;\n}\n","/**\n * Storage-generic backup helpers and admin routes for the Backups panel.\n * The `pg_dump`/`pg_restore` machinery lives in `@rebasepro/server-postgres`.\n */\nexport * from \"./backup-common\";\nexport { createBackupRoutes } from \"./backup-routes\";\nexport type { BackupRoutesConfig } from \"./backup-routes\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IAAI,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,GAAG,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAC9E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KAAK,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,IAAI,EAAE,CAAC,QAAQ,QAAQ,EAAE;CAAE;CAClF,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;;;;;AAMA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;AAMA,eAAsB,kBAClB,MACA,SACqB;CACrB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,OAAO,CAAC;EACjC,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAkB;GACpB,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,KAAK,GAAG,SAAS,IAAI;GAC3B,MAAM,YAAY,qBAAqB,CAAC,KAAK,GAAG;GAChD,OAAO;IACH,KAAK;IACL,MAAM;IACN,WAAW,GAAG;IACd,WAAW,UAAU,YAAY;IACjC,iBAAiB;GACrB;EACJ,CAAC,CAAC,CACD,KAAK,QAAQ;CACtB;CAEA,IAAI,CAAC,SAAS,OAAO,CAAC;CAKtB,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,QAAoB;EACtB,MAAM,YAAY,qBAAqB,GAAG;EAC1C,OAAO;GACH;GACA,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;GAC9B,WAAW,YAAY,UAAU,YAAY,IAAI,KAAA;GACjD,iBAAiB,KAAK;EAC1B;CACJ,CAAC,CAAC,CACD,KAAK,QAAQ;AACtB;AAEA,SAAS,SAAS,GAAe,GAAuB;CACpD,MAAM,KAAK,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI;CAEnD,QADW,EAAE,YAAY,KAAK,MAAM,EAAE,SAAS,IAAI,KACvC;AAChB;;AAGA,eAAsB,gBAClB,MACA,KACA,SACgE;CAChE,IAAI,KAAK,SAAS,SAAS;EAEvB,MAAM,OADO,GAAG,WAAW,KAAK,IAAI,IAAI,GAAG,SAAS,KAAK,IAAI,IAAI,KAAA,EAC/C,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACpE,MAAM,cAAc,KAAK,QAAQ,GAAG;EACpC,MAAM,WAAW,KAAK,QAAQ,GAAG;EAEjC,IAAI,CAAC,SAAS,WAAW,cAAc,KAAK,GAAG,KAAK,CAAC,SAAS,SAAS,OAAO,GAC1E,OAAO;EAEX,IAAI,CAAC,GAAG,WAAW,QAAQ,GAAG,OAAO;EACrC,OAAO;GAAE,OAAO,IAAI,WAAW,GAAG,aAAa,QAAQ,CAAC;GAAG,MAAM,KAAK,SAAS,QAAQ;EAAE;CAC7F;CAEA,IAAI,CAAC,SAAS,OAAO;CACrB,IAAI,CAAC,IAAI,SAAS,OAAO,GAAG,OAAO;CACnC,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,KAAK,MAAM;CACrD,IAAI,CAAC,MAAM,OAAO;CAClB,OAAO;EAAE,OAAO,IAAI,WAAW,MAAM,KAAK,YAAY,CAAC;EAAG,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK;CAAI;AAChG;;;;;;;;;;ACrGA,SAAgB,mBAAmB,QAA2C;CAC1E,MAAM,SAAS,IAAI,KAAc;CACjC,OAAO,QAAQ,YAAY;CAE3B,OAAO,IAAI,KAAK,OAAO,MAAM;EACzB,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,OAAO,EAAE,KAAK;GAAE,SAAS,CAAC;GAAG,iBAAiB;GAAkB,YAAY;EAAM,CAAC;EAEvF,MAAM,UAAU,MAAM,kBAAkB,MAAM,OAAO,OAAO;EAC5D,OAAO,EAAE,KAAK;GAAE;GAAS,iBAAiB,KAAK;GAAM,YAAY;EAAK,CAAC;CAC3E,CAAC;CAED,OAAO,IAAI,aAAa,OAAO,MAAM;EACjC,MAAM,OAAO,OAAO,eAAe;EACnC,IAAI,CAAC,MACD,MAAM,SAAS,WAAW,sDAAsD;EAEpF,MAAM,MAAM,EAAE,IAAI,MAAM,KAAK;EAC7B,IAAI,CAAC,KACD,MAAM,SAAS,WAAW,gCAAgC;EAE9D,MAAM,SAAS,MAAM,gBAAgB,MAAM,KAAK,OAAO,OAAO;EAC9D,IAAI,CAAC,QACD,MAAM,SAAS,SAAS,qBAAqB,KAAK;EAEtD,EAAE,OAAO,gBAAgB,0BAA0B;EACnD,EAAE,OAAO,uBAAuB,yBAAyB,OAAO,KAAK,EAAE;EACvE,OAAO,EAAE,KAAK,OAAO,KAAK;CAC9B,CAAC;CAED,OAAO;AACX"}

package/dist/boot/boot.d.ts

@@ -2,6 +2,7 @@ import { type Server } from "http";
 import { Hono } from "hono";
 import { type RebaseBackendInstance } from "../init.js";
 import type { HonoEnv } from "../api/types.js";
+import { type Logger } from "../utils/logger.js";
 import { type RebaseBootEnv } from "./env.js";
 import { type LoadedBundle } from "./bundle.js";
 import { type InitializedDataSource } from "./driver.js";
@@ -111,6 +112,23 @@ export declare function bootFromBundle(options?: BootOptions): Promise<BootedRun
  */
 export declare function resolveProvisionOnly(env?: NodeJS.ProcessEnv): boolean;
 export declare function runFromBundle(options?: BootOptions): Promise<BootedRuntime>;
+/** The two logger methods {@link reportBootFailure} writes through. */
+export type BootFailureLog = Pick<Logger, "error" | "debug">;
+/**
+ * Say why the boot failed, in the form the reader can act on.
+ *
+ * Extracted from `runFromBundle` so it can be tested: the catch it came from
+ * ends in `process.exit(1)`, and what a dying process printed on its way out is
+ * exactly the thing nobody had a test for. `CollectionConfigError` spent a
+ * release on the wrong side of this branch, so a multi-line validator message —
+ * composed over several lines, naming both offending files — reached the author
+ * as `{"error":{"name":"Error","message":"1 problem(s) …\n\n…","stack":"… at
+ * assertCollectionConfigs (…/dist/index.es.js:727:8) …"}}`: the answer,
+ * `\n`-escaped, inside 3 KB of framework frames.
+ */
+export declare function reportBootFailure(err: unknown, log?: BootFailureLog, env?: {
+    NODE_ENV?: string;
+}): void;
 /**
  * Say so, once per boot, when a data source's driver is older than this runtime.
  *

package/dist/boot/bundle.d.ts

@@ -3,7 +3,7 @@ import type { StorageAuthorize } from "../storage/types.js";
 /** Thrown when a bundle cannot be read, or claims a contract this runtime cannot honour. */
 export declare class BundleError extends Error {
     readonly hint?: string | undefined;
-    constructor(message: string, hint?: string | undefined);
+    constructor(message: string, hint?: string | undefined, options?: ErrorOptions);
 }
 /** A bundle that has been located and whose manifest has been validated. */
 export interface LoadedBundle {
@@ -21,6 +21,17 @@ export interface LoadedBundle {
      * warning, so a partially-built bundle still boots its API.
      */
     staticApps: LoadedStaticApp[];
+    /**
+     * True when this "bundle" is a view over the project's own source tree —
+     * what `rebase dev` boots — rather than a built one.
+     *
+     * The difference matters to anything that would write a file back: the
+     * schema editor rewrites collection *source*, which exists on one of these
+     * paths and not the other. Read it from here rather than from
+     * `manifest.runtime.builtAgainst === "source"`: the manifest is what a
+     * build wrote down, and a bundle can carry any string a builder put there.
+     */
+    isSource: boolean;
 }
 /** One built static app inside a loaded bundle, with an absolute directory. */
 export interface LoadedStaticApp {
@@ -117,7 +128,14 @@ export declare function createSourceBundle(options: {
  * is known from the bundle, without reading anyone's secrets.
  */
 export interface BundleConfigExports {
+    /**
+     * Read only so that `assertNoReplacedResourceConfig` can refuse a bundle
+     * still carrying them. Databases and buckets are declared with `database()`
+     * and `bucket()` in `config/resources.ts`; nothing downstream consumes these
+     * two fields.
+     */
     dataSources?: DataSourceDefinition[];
+    /** See `dataSources` — present only so boot can refuse it by name. */
     storageSources?: StorageSourceDefinition[];
     /**
      * Per-object storage access control.
@@ -137,11 +155,16 @@ export interface BundleConfigExports {
 /**
  * Read the config package's `index` for declarations.
  *
- * Absent, empty or unreadable all mean the same thing: a single default database
- * and a single default bucket. That is the overwhelmingly common project, and it
- * must not be required to say so. A malformed export is reported and ignored
- * rather than fatal — a typo in an optional declaration should not take down a
- * server whose collections are fine.
+ * Absent or empty mean the same thing: a single default database and a single
+ * default bucket. That is the overwhelmingly common project, and it must not be
+ * required to say so. A malformed export — `dataSources` that is not an array —
+ * is reported and ignored rather than fatal: a typo in one optional declaration
+ * should not take down a server whose collections are fine.
+ *
+ * A file that is THERE and cannot be imported is a different thing, and it is
+ * fatal. Every declaration in it is gone, so the process comes up bound to a
+ * different set of databases and buckets than the project declares, announcing
+ * success. That is not a degraded start, it is a different deployment.
  */
 export declare function loadBundleConfigExports(bundle: LoadedBundle): Promise<BundleConfigExports>;
 /**

package/dist/boot/ddl-bootstrap.d.ts

@@ -59,6 +59,8 @@ export declare function isConcurrentDdlRace(err: unknown): boolean;
  * what a lost `CREATE TYPE`/`CREATE TABLE` race raises (`pg_type_typname_nsp_index`
  * is the one seen in practice); a unique violation on user data names the user's
  * own constraint and is left to the caller.
+ *
+ * With one exception, in {@link NOT_A_RACE_PG_INDEXES}.
  */
 export declare function isDuplicateObjectRace(err: unknown): boolean;
 export interface DdlBootstrapper {

package/dist/boot/env.d.ts

@@ -95,11 +95,36 @@ declare const bootEnvExtension: z.ZodObject<{
         Lax: "Lax";
         None: "None";
     }>>;
+    AUTH_COOKIE_SECURE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
     AUTH_DEFAULT_ROLE: z.ZodOptional<z.ZodString>;
     GITHUB_CLIENT_ID: z.ZodOptional<z.ZodString>;
     GITHUB_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
     MICROSOFT_CLIENT_ID: z.ZodOptional<z.ZodString>;
     MICROSOFT_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    LINKEDIN_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    LINKEDIN_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    FACEBOOK_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    FACEBOOK_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    TWITTER_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    TWITTER_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    DISCORD_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    DISCORD_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    GITLAB_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    GITLAB_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    BITBUCKET_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    BITBUCKET_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    SLACK_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    SLACK_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    SPOTIFY_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    SPOTIFY_CLIENT_SECRET: z.ZodOptional<z.ZodString>;
+    APPLE_CLIENT_ID: z.ZodOptional<z.ZodString>;
+    APPLE_TEAM_ID: z.ZodOptional<z.ZodString>;
+    APPLE_KEY_ID: z.ZodOptional<z.ZodString>;
+    APPLE_PRIVATE_KEY: z.ZodOptional<z.ZodString>;
     REBASE_BASE_PATH: z.ZodDefault<z.ZodString>;
     REBASE_ENABLE_SWAGGER: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
         "": "";
@@ -162,7 +187,6 @@ export declare function loadBootEnv(): RebaseBootEnv;
  * server with the developer's session and read the responses.
  */
 export declare function isLocalhostOrigin(origin: string): boolean;
-/** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
 /**
  * Whether this process serves the OpenAPI docs.
  *
@@ -177,6 +201,7 @@ export declare function isLocalhostOrigin(origin: string): boolean;
  * that can disagree about the same route is the bug this replaces.
  */
 export declare function resolveEnableSwagger(env: RebaseBootEnv): boolean | undefined;
+/** A CORS origin resolver of the shape Hono's `cors()` middleware expects. */
 export type CorsOriginResolver = (origin: string) => string | null;
 /**
  * Build the CORS origin policy.
@@ -186,6 +211,10 @@ export type CorsOriginResolver = (origin: string) => string | null;
  * `FRONTEND_URL`, so an empty list here can only mean the values were blank
  * strings — still worth failing on, because the alternative is an API that
  * quietly rejects its own frontend.
+ *
+ * Development reflects localhost *and* whatever that same allow-list names. The
+ * list is the same one in both environments; the difference is that development
+ * adds localhost to it rather than replacing it.
  */
 export declare function resolveCorsOrigin(env: RebaseBootEnv): CorsOriginResolver;
 export {};

package/dist/boot/fetch-bundle.d.ts

@@ -159,6 +159,7 @@ export declare function installBundleDependencies(bundleRoot: string, exec?: (cm
  * nothing to do.
  */
 export declare const RUNTIME_MODULES_ENV = "REBASE_RUNTIME_MODULES";
+export declare function imageModulesDir(): string | undefined;
 /**
  * The packages the runtime image supplies to a fetched bundle.
  *
@@ -174,8 +175,17 @@ export declare const RUNTIME_MODULES_ENV = "REBASE_RUNTIME_MODULES";
  * the same four-package gap that broke the non-fetch path, reproduced on the
  * fetch path because this list was written before that fix and no gate watched
  * this file.
+ *
+ * `zod` is not a @rebasepro package and belongs here anyway. The runtime
+ * exports `loadEnv`, whose `extend` option takes a zod schema and calls
+ * `.parse()` on it. When the bundle carries its own zod that schema is built
+ * from a DIFFERENT zod than the one doing the parsing, and every field carrying
+ * a `.default()` is rejected — so a managed deploy came up, reported success,
+ * and ran zero crons. The image installs zod (see
+ * infra/docker/server.Dockerfile); naming it here is what makes the bundle's
+ * copy collapse onto it.
  */
-export declare const RUNTIME_PROVIDED_PACKAGES: readonly ["@rebasepro/server", "@rebasepro/types", "@rebasepro/client", "@rebasepro/common", "@rebasepro/utils"];
+export declare const RUNTIME_PROVIDED_PACKAGES: readonly ["@rebasepro/server", "@rebasepro/types", "@rebasepro/client", "@rebasepro/common", "@rebasepro/utils", "zod"];
 /**
  * Collapse a duplicate framework copy in the bundle onto the image's.
  *
@@ -189,6 +199,19 @@ export declare const RUNTIME_PROVIDED_PACKAGES: readonly ["@rebasepro/server", "
  * duplicate, and refusing to boot over it would turn a degraded start into no
  * start at all.
  *
+ * Called from `bootFromBundle` on EVERY boot, against whatever directory boot
+ * settled on — not from the install. Hanging it off the install made it
+ * unreachable for three of the four ways a bundle arrives: one that vendored
+ * `node_modules` at build time, a pod restarting onto a tree it installed
+ * earlier, and the fallback that serves an on-disk bundle after a failed fetch
+ * all skip the install and took the dedupe with them. Prospector hit the first:
+ * two copies of `@rebasepro/types` in one process, whose `registerResourceKind`
+ * calls for kind `database` disagreed, so importing the driver threw at boot and
+ * the pod crash-looped reporting a driver that was installed all along.
+ *
+ * Safe to repeat: an entry that is already a symlink is left alone, so the
+ * container entrypoint having done this first costs one `lstat` per package.
+ *
  * @param imageModules the runtime image's own `node_modules`. Absent, there is
  *   nothing to dedupe against and this is a no-op — which is the case in every
  *   context except a container built from the runtime image.

package/dist/boot/options.d.ts

@@ -33,12 +33,4 @@ export declare function resolveEmailOptions(env: RebaseBootEnv): EmailConfig | u
  * being silently absent while the config says otherwise.
  */
 export declare function resolveCaptchaOptions(env: RebaseBootEnv): CaptchaConfig | undefined;
-/**
- * Build the auth configuration from the environment and the bundle's users
- * collection.
- *
- * OAuth providers are included only when both halves of a credential pair are
- * present. Google is the exception the template already made: a client id alone
- * is enough, because the ID-token flow needs no secret.
- */
 export declare function resolveAuthOptions(env: RebaseBootEnv, usersCollection: CollectionConfig | undefined): RebaseAuthConfig;

package/dist/boot/provision.d.ts

@@ -57,7 +57,11 @@ export interface ProvisionTarget {
     engine: string;
     driverVersion?: string;
     runtimeVersion?: string;
-    bootstrapper: Pick<BackendBootstrapper, "ensureCollectionSchema" | "ensureCollectionPolicies" | "readCollectionsSchemaVersion" | "stampCollectionsSchemaVersion">;
+    bootstrapper: Pick<BackendBootstrapper, "verifyConnection" | "ensureCollectionSchema" | "ensureCollectionPolicies" | "ensureRlsRuntime" | "readCollectionsSchemaVersion" | "stampCollectionsSchemaVersion">;
+    /** The data-source key this target provisions for. `(default)` for the primary. */
+    key?: string;
+    /** Whether this is the default source — the one auth lives on. */
+    isDefault?: boolean;
     /**
      * The handle the hooks read (`internals.db`), or `undefined` to let the
      * adapter fall back to the connection it was constructed with.
@@ -89,6 +93,22 @@ export interface ProvisionRunOptions {
 export declare function provisioningDisabled(env?: {
     REBASE_MIGRATE_ON_BOOT?: string;
 }): boolean;
+/**
+ * Ask the database whether it is there, before boot's first real query.
+ *
+ * Ordering is the whole point. Provisioning is the first thing in boot that
+ * talks to the database — earlier than `initializeDriver`, which is where the
+ * Postgres adapter's connection diagnosis lives — so a developer whose database
+ * was not running got Drizzle's wrapper and nothing else: `Failed query:
+ * [redacted]`, a stack through drizzle internals, no host, no port, no
+ * `ECONNREFUSED`, and no suggestion to start the database. The diagnosis existed
+ * the whole time; nothing reached it.
+ *
+ * A driver that cannot probe (no `verifyConnection`) is not an error: this is a
+ * better first message, not a new requirement. And a probe that throws is fatal
+ * for the same reason provisioning is — every path after this needs the database.
+ */
+export declare function verifyProvisioningConnection(target: ProvisionTarget): Promise<void>;
 /**
  * Create any collection tables the database is missing, before serving.
  *
@@ -130,36 +150,46 @@ export declare function provisionCollectionTables(collections: CollectionConfig[
  */
 export declare function provisionCollectionPolicies(collections: CollectionConfig[], target: ProvisionTarget, options?: ProvisionRunOptions): Promise<ProvisionOutcome>;
 /**
- * The collections a data source's engine is the store for.
+ * The collections one data source is the store for.
  *
  * A project's collections directory holds *every* collection it declares,
- * whatever engine serves it — that is the point of `dataSource` routing. What it
- * is not is a list of tables to create: handing the whole directory to the
- * primary source's bootstrapper made a Firestore collection declared alongside
- * the Postgres ones arrive as an empty Postgres table, with RLS policies, while
- * the app went on reading its documents from Firestore.
- *
- * Excluding is deliberately conservative. A collection that names neither an
- * `engine` nor a `dataSource` belongs to whichever source is primary — the
- * "postgres" that `resolveDataSource` falls back to there is a default, not a
- * declaration, and must not exclude anything on its own. Only a collection that
- * explicitly routes to a *different* engine is dropped, so a project running two
- * sources on the same engine is unaffected.
+ * whatever source serves it — that is the point of `dataSource` routing. What
+ * it is not is a list of tables for the primary to create. This used to
+ * filter by *engine*, so a collection routed to a second Postgres database
+ * was handed to the default one: its table was created where nothing would
+ * ever read it, and the database it was routed to never got one. Every query
+ * against `database("analytics")` then failed on a missing relation behind a
+ * boot that had reported the schema up to date.
+ *
+ * So: a collection belongs to the source its `dataSource` names, or to the
+ * default when it names none. The engine check stays as a guard — a
+ * collection that declares an `engine` other than this source's is never its
+ * table, whatever key it names — and a source of a different engine still
+ * gets nothing that is not explicitly its own.
  *
  * Takes the shapes it actually reads rather than an `InitializedDataSource`, so
  * the path that has data sources and the path that has only an adapter can share
  * one implementation instead of growing a second one that drifts.
  */
-export declare function collectionsStoredBy(collections: CollectionConfig[], primary: {
+export declare function collectionsStoredBy(collections: CollectionConfig[], source: {
+    key: string;
     engine: string;
 }, dataSources: Array<{
     key: string;
     engine: string;
 }>): CollectionConfig[];
-/** Say what was routed elsewhere, so a missing table is never a silent one. */
-export declare function logForeignCollections(all: CollectionConfig[], stored: CollectionConfig[], primary: {
+/**
+ * Say what no source provisions, so a missing table is never a silent one.
+ *
+ * Every collection should be stored by exactly one of the sources handed in.
+ * One that none claims — routed to a key no source has, or declaring an
+ * engine none of them runs — is logged here by name rather than left to fail
+ * on its first request.
+ */
+export declare function logUnprovisionedCollections(all: CollectionConfig[], storedBySome: Set<CollectionConfig>, sources: Array<{
+    key: string;
     engine: string;
-}): void;
+}>): void;
 /**
  * Which bootstrapper provisions, and what to call it in a message.
  *
@@ -178,5 +208,15 @@ export declare function logForeignCollections(all: CollectionConfig[], stored: C
 export declare function provisionTargetFor(bootstrappers: BackendBootstrapper[], adapter?: {
     type: string;
 }, driverResult?: InitializedDriver): ProvisionTarget;
+/**
+ * One provisioning target per data source, the default first.
+ *
+ * The default keeps the pre-init handle the bundle path supplies; every other
+ * source is provisioned through its own adapter's connection, which is the
+ * contract `ensureCollectionSchema` already honours when handed no result.
+ */
+export declare function provisionTargetsFor(bootstrappers: BackendBootstrapper[], adapter?: {
+    type: string;
+}, driverResult?: InitializedDriver): ProvisionTarget[];
 /** Load collections for provisioning when only a directory is known. */
 export declare function collectionsForProvisioning(declared: CollectionConfig[], collectionsDir: string | undefined): Promise<CollectionConfig[]>;

package/dist/boot/resource-adapters.d.ts

@@ -13,12 +13,22 @@
  * becomes a rewrite and then does not ship.
  */
 import { type DataSourceDefinition, type ResourceGraph, type StorageSourceDefinition } from "@rebasepro/types";
-/** Databases in the graph, as the data layer's definitions. */
+/**
+ * Databases in the graph, as the data layer's definitions.
+ *
+ * The per-field mapping lives in `@rebasepro/types` next to the constructors,
+ * so this and `declaredDataSources()` cannot answer differently. They used to:
+ * this side carried a bucket's `account` and the types side dropped it, which
+ * meant shared credentials resolved on the managed runtime and resolved nothing
+ * in an ejected backend.
+ */
 export declare function graphToDataSources(graph: ResourceGraph): DataSourceDefinition[];
 /** Buckets in the graph, as the storage layer's definitions. */
 export declare function graphToStorageSources(graph: ResourceGraph): StorageSourceDefinition[];
 /** Topics in the graph, for the runtime to publish through and the worker to wire. */
 export declare function graphTopics(graph: ResourceGraph): ResourceGraph["resources"];
+/** Queues in the graph, for the runtime to enqueue on and the worker to wire. */
+export declare function graphQueues(graph: ResourceGraph): ResourceGraph["resources"];
 /**
  * Refuse a config still carrying a replaced key.
  *

package/dist/boot/resource-resolvers.d.ts

@@ -0,0 +1,96 @@
+/**
+ * How each resource kind is bound, registered per kind.
+ *
+ * `@rebasepro/types` registers what a kind *is* — its engines, its options,
+ * the variable bases it binds from. This is the other half: what the runtime
+ * does with those variables. Keeping it a registry rather than a switch is
+ * what makes the next kind an afternoon: a `cache` arrives as a spec in
+ * `@rebasepro/types`, a resolver here, and a driver — and nothing else in the
+ * boot path, `rebase status` or the gate that holds the two halves together
+ * has to learn its name.
+ *
+ * Two readers, one answer. Boot calls a resolver to bind; `rebase status`
+ * calls the same resolver to say whether a binding would succeed. The first
+ * time those two disagreed, status would be reassuring somebody about a
+ * deployment that was about to refuse to start — which is why status has no
+ * resolver of its own.
+ *
+ * ## Every declared kind must be bindable
+ *
+ * A graph entry whose kind has no resolver used to be dropped: the adapters
+ * filtered by the kinds they knew and the rest went nowhere, so a bundle from
+ * a newer CLI declaring a kind this runtime had never heard of booted with the
+ * declaration ignored. {@link assertEveryKindBindable} refuses that at boot,
+ * by name, which is the same rule the CLI applies to an unknown engine.
+ */
+import { type ResourceDeclaration, type ResourceGraph } from "@rebasepro/types";
+import { type EnvBag } from "./sources.js";
+/** What a resolver knows about the process it resolves for. */
+export interface ResolveContext {
+    /** Whether this is a production process. Decides whether a local stand-in is allowed. */
+    production: boolean;
+    /** Where a local storage source lives when nothing names a path. */
+    defaultBasePath: string;
+}
+/**
+ * One resource's binding verdict.
+ *
+ * - `ready`: bound, or standing in — `standsIn` names the engine a local
+ *   directory is standing in for in development.
+ * - `unbound`: declared and not configured. Not fatal: the resource is
+ *   skipped, and whatever uses it answers 501.
+ * - `blocked`: boot refuses. The detail is the resolver's own message.
+ * - `code`: binds from nothing. A cron, a function, a topic: the declaration
+ *   is the whole configuration.
+ */
+export type ResourceResolution = {
+    state: "ready";
+    detail?: string;
+    standsIn?: string;
+} | {
+    state: "unbound";
+    detail: string;
+} | {
+    state: "blocked";
+    detail: string;
+} | {
+    state: "code";
+    detail?: string;
+};
+export interface ResourceResolver {
+    kind: string;
+    /**
+     * The variable bases this resolver reads, exactly. Held to the kind's
+     * `envBases` by `resource-env-bases.test.ts`, so a base one side names and
+     * the other never consults — a variable somebody sets and nothing reads —
+     * fails a build instead of reaching a developer.
+     */
+    reads: readonly string[];
+    /** The subset of `reads` that falls back to `<BASE>__<ACCOUNT>`. */
+    accountScoped?: readonly string[];
+    resolve(declaration: ResourceDeclaration, env: EnvBag, context: ResolveContext): ResourceResolution;
+}
+/** Register a kind's resolver. Idempotent for the same object; a second, different one throws. */
+export declare function registerResourceResolver(resolver: ResourceResolver): void;
+/** The resolver for a kind, or undefined when this runtime cannot bind it. */
+export declare function resourceResolver(kind: string): ResourceResolver | undefined;
+/** Every registered resolver, for the gate and for `rebase doctor`. */
+export declare function resourceResolvers(): ResourceResolver[];
+/**
+ * Refuse a graph that declares a kind this runtime has no resolver for.
+ *
+ * Throws with every offending kind at once, because they arrive together — a
+ * newer CLI that added two kinds is the usual cause — and a message naming one
+ * of two sends somebody back through the same failure twice.
+ */
+export declare function assertEveryKindBindable(graph: ResourceGraph): void;
+/**
+ * Every kind `@rebasepro/types` registers that this runtime cannot bind.
+ *
+ * Empty in a consistent build. Non-empty means the two packages disagree —
+ * a kind was added to one and not the other — which the gate reports and
+ * `rebase doctor` can show.
+ */
+export declare function unbindableKinds(): string[];
+/** The default-keyed declaration of a kind, synthesised for kinds that have one implicitly. */
+export declare function implicitDeclaration(kind: string): ResourceDeclaration | undefined;

package/dist/boot/sources.d.ts

@@ -25,6 +25,16 @@ import type { BackendStorageConfig } from "../storage/types.js";
  */
 /** Environment lookup, injectable so tests need not mutate `process.env`. */
 export type EnvBag = Record<string, string | undefined>;
+/** What the resolver needs to know about the process it resolves for. */
+export interface ResolveStorageOptions {
+    /**
+     * Whether this is a production process. `false` lets a declared object
+     * store nothing bound stand in as a local directory; `true` or unknown
+     * leaves it unbound. Unknown is treated as production on purpose — a
+     * process that has not said it is development must not be handed a disk.
+     */
+    production?: boolean;
+}
 /**
  * Convert a source key into the suffix used in environment variable names.
  *
@@ -70,6 +80,21 @@ export interface ResolvedDataSourceConfig {
  * the wrong place with a healthy-looking server in front of it.
  */
 export declare function resolveDataSources(env: EnvBag, definitions: DataSourceDefinition[] | undefined): ResolvedDataSourceConfig[];
+/**
+ * The storage bindings that describe the PROVIDER rather than the bucket.
+ *
+ * These are the ones a source's `account` lets it share: naming an account
+ * makes them fall back to `<BASE>__<ACCOUNT>` when no per-key value is set.
+ * `S3_BUCKET` and `GCS_BUCKET` are deliberately absent — the bucket name is
+ * what distinguishes one source from another and must never fall back — and so
+ * are `STORAGE_TYPE` and `STORAGE_PATH`, which describe this source alone.
+ *
+ * Exported because `rebase status` has to tell a developer *which* variable a
+ * bucket is actually waiting on, and deriving that list a second time is how it
+ * would come to disagree with the resolver below. `resource-env-bases.test.ts`
+ * holds it to the reader each base is passed to.
+ */
+export declare const ACCOUNT_SCOPED_STORAGE_BASES: readonly ["S3_ACCESS_KEY_ID", "S3_SECRET_ACCESS_KEY", "S3_REGION", "S3_ENDPOINT", "S3_FORCE_PATH_STYLE", "GCS_PROJECT_ID", "GCS_KEY_FILENAME"];
 /**
  * Build one storage configuration from the variables for a single source.
  *
@@ -85,7 +110,7 @@ export declare function resolveStorageBackend(env: EnvBag, key: string, engineHi
  * account-scoped bindings — the ones describing the provider rather than the
  * bucket — consult it. See `StorageSourceDefinition.account`.
  */
-accountHint?: string): BackendStorageConfig | undefined;
+accountHint?: string, options?: ResolveStorageOptions): BackendStorageConfig | undefined;
 /**
  * Resolve every server-transport storage source into a controller config map.
  *
@@ -93,22 +118,4 @@ accountHint?: string): BackendStorageConfig | undefined;
  * so multiple buckets need nothing new downstream — they were always supported,
  * they just had no way to be configured from the environment.
  */
-export declare function resolveStorageSources(env: EnvBag, definitions: StorageSourceDefinition[] | undefined, defaultBasePath: string): Record<string, BackendStorageConfig> | undefined;
-/**
- * Read a project's declared storage sources from its `rebase.json`.
- *
- * A managed bundle carries its topology in `manifest.json`, resolved at build
- * time. A **custom** runtime has no manifest — it builds its own image and its
- * own entrypoint — so without this it would have to re-declare in code what
- * `rebase.json` already says, and the two would drift. Since a custom image
- * contains the repository anyway, reading the file it already ships is what
- * keeps one declaration authoritative for both runtimes.
- *
- * Walks up from `startDir` because an entrypoint lives at `backend/src` in the
- * scaffolded layout and somewhere else in a hand-rolled one. A missing,
- * unreadable or malformed file means "declared nothing" — one default source —
- * which is the correct reading of every project that predates this and must
- * never be an error: a storage declaration is optional, and failing to boot a
- * whole backend over an absent optional file would be the worse bug.
- */
-export declare function loadDeclaredStorageSources(startDir: string, levels?: number): StorageSourceDefinition[];
+export declare function resolveStorageSources(env: EnvBag, definitions: StorageSourceDefinition[] | undefined, defaultBasePath: string, options?: ResolveStorageOptions): Record<string, BackendStorageConfig> | undefined;