@rebasepro/server 0.22.0 → 0.24.0

package/dist/boot/env.d.ts

@@ -9,9 +9,9 @@ import { type RebaseEnv } from "../env.js";
  * a set of environment variables, and everything either side needs to agree on
  * has to be part of the contract rather than a convention each project reinvents.
  */
-declare const bootEnvExtension: z.ZodObject<{
+export declare const bootEnvExtension: z.ZodObject<{
     SMTP_HOST: z.ZodOptional<z.ZodString>;
-    SMTP_PORT: z.ZodPipe<z.ZodDefault<z.ZodString>, z.ZodTransform<number, string>>;
+    SMTP_PORT: z.ZodPreprocess<z.ZodDefault<z.ZodCoercedNumber<unknown>>>;
     SMTP_SECURE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
         true: "true";
@@ -34,19 +34,24 @@ declare const bootEnvExtension: z.ZodObject<{
         none: "none";
         ensure: "ensure";
     }>>;
+    REBASE_HSTS_INCLUDE_SUBDOMAINS: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
     REBASE_METRICS: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
     REBASE_METRICS_TOKEN: z.ZodOptional<z.ZodString>;
-    LOG_LEVEL: z.ZodOptional<z.ZodEnum<{
+    LOG_LEVEL: z.ZodPreprocess<z.ZodOptional<z.ZodEnum<{
         "": "";
         debug: "debug";
         info: "info";
         warn: "warn";
         error: "error";
-    }>>;
+    }>>>;
     STORAGE_PUBLIC_READ: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
         true: "true";
@@ -62,6 +67,7 @@ declare const bootEnvExtension: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    STORAGE_DOWNLOAD_TOKEN_TTL: z.ZodPreprocess<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
     AUTH_REQUIRE: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
         true: "true";
@@ -82,6 +88,21 @@ declare const bootEnvExtension: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_REQUIRE_EMAIL_VERIFICATION: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_MAGIC_LINK_CREATES_USERS: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
+        "": "";
+        true: "true";
+        false: "false";
+    }>>, z.ZodTransform<boolean, "" | "true" | "false">>;
+    AUTH_REFRESH_TOKEN_REUSE: z.ZodPipe<z.ZodOptional<z.ZodEnum<{
+        "": "";
+        reject: "reject";
+        "revoke-session": "revoke-session";
+    }>>, z.ZodTransform<"reject" | "revoke-session" | undefined, "" | "reject" | "revoke-session" | undefined>>;
     CAPTCHA_PROVIDER: z.ZodOptional<z.ZodEnum<{
         "": "";
         turnstile: "turnstile";
@@ -131,7 +152,7 @@ declare const bootEnvExtension: z.ZodObject<{
         true: "true";
         false: "false";
     }>>, z.ZodTransform<boolean | undefined, "" | "true" | "false" | undefined>>;
-    REBASE_MAX_BODY_SIZE: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    REBASE_MAX_BODY_SIZE: z.ZodPreprocess<z.ZodOptional<z.ZodCoercedNumber<unknown>>>;
     REBASE_COMPRESSION: z.ZodPipe<z.ZodDefault<z.ZodEnum<{
         "": "";
         true: "true";
@@ -223,4 +244,28 @@ export type CorsOriginResolver = (origin: string) => string | null;
  * adds localhost to it rather than replacing it.
  */
 export declare function resolveCorsOrigin(env: RebaseBootEnv): CorsOriginResolver;
-export {};
+/**
+ * Response headers a browser app on another origin may read.
+ *
+ * Outside the CORS-safelisted few, a cross-origin `fetch` sees a header only
+ * when `Access-Control-Expose-Headers` names it — and the runtime named none.
+ * So in every cross-origin setup (every `rebase dev` project: a Vite frontend on
+ * its own port) the SDK read no `ETag`, `etagOf(row)` was always `undefined`,
+ * and an `ifMatch` update went out with no `If-Match` — a conditional write
+ * silently made unconditional. A 429's `Retry-After` and the `X-Request-ID` an
+ * error is reported by were lost the same way.
+ *
+ * These are the headers the SDK reads, plus the ones the API sends for a caller
+ * to act on (`X-RateLimit-*`, `Preference-Applied`). A backend that wires its
+ * own `cors()` wants the same list; `packages/server/test/cors-exposed-headers.test.ts`
+ * fails when the SDK reads a header this does not name.
+ */
+export declare const CORS_EXPOSED_HEADERS: readonly string[];
+/** What the runtime hands Hono's `cors()`. */
+export interface RebaseCorsOptions {
+    origin: CorsOriginResolver;
+    credentials: true;
+    exposeHeaders: string[];
+}
+/** The runtime's whole CORS config, so a test can drive the same one boot does. */
+export declare function resolveCorsOptions(env: RebaseBootEnv): RebaseCorsOptions;

package/dist/boot/fetch-bundle.d.ts

@@ -33,6 +33,19 @@ export declare const BUNDLE_FETCH_DIR_ENV = "REBASE_BUNDLE_FETCH_DIR";
  * whether to fetch at all — keep the two in step.
  */
 export declare const BUNDLE_SOURCE_FILENAME = ".rebase-bundle-source";
+/**
+ * Present in a bundle root while a dependency install there has not finished.
+ *
+ * Written before npm starts and removed once it returns, so it outlives exactly
+ * one thing: an install that was killed partway. A failed install deletes what
+ * it wrote, but a SIGKILL — an OOMKill, a startup probe restarting the
+ * container — runs no cleanup, and the partial `node_modules` it leaves on the
+ * pod's volume cannot be told from a finished one by looking at the directory.
+ *
+ * `infra/docker/entrypoint.mjs` reads this file by the same name — keep the two
+ * in step.
+ */
+export declare const INSTALL_PENDING_FILENAME = ".rebase-install-pending";
 /** What the tree in `destination` was fetched from, or null if unknown. */
 export declare function unpackedBundleSource(destination: string): string | null;
 /**
@@ -56,7 +69,11 @@ export interface FetchBundleOptions {
     fetchImpl?: typeof fetch;
     /** Injected for tests. */
     extract?: (tarball: string, destination: string) => Promise<void>;
-    /** How long a single download attempt may take before it is abandoned. */
+    /**
+     * How long a download attempt may go without progress — waiting for the
+     * response, or between two chunks of its body — before it is abandoned and
+     * retried.
+     */
     timeoutMs?: number;
     /**
      * How many times to try the download.

package/dist/boot/rls-audit-option.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The scheduled RLS audit, switched on from the environment.
+ *
+ * `REBASE_RLS_AUDIT=true` is how a bundle boot — the runtime image,
+ * `rebase start`, `rebase dev` — asks for the audit, because a bundle has no
+ * code path to `rlsAudit.enabled`. The variable also decides which process owns
+ * the scan (`boot/role.ts`); this is the other half, without which a process
+ * that owned the scan had none to run.
+ *
+ * The scanner is `@rebasepro/rls-check`, loaded from the bundle rather than
+ * imported: the runtime deliberately carries no Postgres driver of its own (see
+ * `rls-audit/index.ts`), so a project that wants the audit declares the package
+ * among its dependencies and the bundle brings it.
+ */
+import type { RebaseBootEnv } from "./env.js";
+import type { RlsAuditConfig } from "../rls-audit/index.js";
+export declare const RLS_CHECK_PACKAGE = "@rebasepro/rls-check";
+/**
+ * The `rlsAudit` option for a bundle boot: on, with the bundle's own scanner,
+ * when `REBASE_RLS_AUDIT` is true; otherwise undefined.
+ *
+ * Refuses rather than booting without it. The variable is an explicit request
+ * for a security audit, and a boot that quietly skipped it would report a
+ * database as unaudited only to whoever thought to open the admin route.
+ */
+export declare function resolveRlsAuditOptions(env: Pick<RebaseBootEnv, "REBASE_RLS_AUDIT">, resolveFrom: string[]): Promise<RlsAuditConfig | undefined>;

package/dist/boot/security-headers.d.ts

@@ -0,0 +1,26 @@
+import type { MiddlewareHandler } from "hono";
+/**
+ * The `Strict-Transport-Security` value this runtime sends.
+ *
+ * Without `includeSubDomains` unless the operator asks for it. The default
+ * `secureHeaders()` sends it, and on a self-hosted custom domain that tells
+ * every browser to refuse plain HTTP on every sibling subdomain for six months —
+ * a decision about hosts this process does not serve, and not one it can undo
+ * once a browser has cached it.
+ */
+export declare function strictTransportSecurity(includeSubDomains: boolean): string;
+/**
+ * The Content-Security-Policy every static app is served with.
+ *
+ * Conservative on purpose: it says who may frame the app (this origin only,
+ * like the `X-Frame-Options: SAMEORIGIN` already sent), forbids plugins, and
+ * pins `<base>` to this origin. It restricts no script, style, worker, font or
+ * connection source, because an app's own build decides those — the CMS admin
+ * runs inline scripts, module workers and third-party sign-in, and a policy
+ * that broke any of them would be one every project had to turn off.
+ */
+export declare const STATIC_APP_CSP = "frame-ancestors 'self'; object-src 'none'; base-uri 'self'";
+/** The security headers both boot paths — backend and static-only — install. */
+export declare function runtimeSecureHeaders(options: {
+    hstsIncludeSubDomains: boolean;
+}): MiddlewareHandler;

package/dist/boot/sources.d.ts

@@ -51,6 +51,7 @@ export declare function envSuffixForKey(key: string, defaultKey: string): string
  *
  * `media-cdn` and `media_cdn` are different source keys but the same suffix, and
  * without this check one of them would silently read the other's configuration.
+ * Every spelling a key is read under counts (see `envSuffixFormsForKey`).
  */
 export declare function assertDistinctSuffixes(definitions: {
     key: string;

package/dist/boot/static-routing.d.ts

@@ -0,0 +1,56 @@
+import { type StaticAppRequest } from "../serve-spa.js";
+import { type LoadedStaticApp } from "./bundle.js";
+/**
+ * A request's hostname in the form an app's `host` is written in: lowercase,
+ * with no port and no trailing dot.
+ *
+ * All three are ways of naming the same host that a browser, a proxy or a
+ * person with curl will send. `Admin.Example.com`, `admin.example.com:443` and
+ * the fully-qualified `admin.example.com.` are one site, and an app that
+ * answered only the first spelling would be down for whoever typed another.
+ *
+ * An IPv6 literal comes back as it arrived: its colons are not a port, and no
+ * app is ever given one, so all it has to do here is not be mangled into
+ * something that could match.
+ */
+export declare function normalizeRequestHost(host: string): string;
+/**
+ * Which static app answers a request: the one rule, written once.
+ *
+ * An app is a candidate when it names no hostname or names this one, and the
+ * path is under its own. Of the candidates, the longest path wins, and at an
+ * equal path the app with a hostname beats the one without — which is
+ * {@link compareStaticApps}, so the first candidate in that order is the winner.
+ * `undefined` when no app claims the request, and then no app answers it.
+ *
+ * The CLI and the control plane order apps by the same rule, so the app a
+ * deploy says is at an address is the app that answers there.
+ */
+export declare function createStaticAppResolver(apps: readonly LoadedStaticApp[]): (request: StaticAppRequest) => LoadedStaticApp | undefined;
+/** How one static app is mounted: what `serveSPA` needs beyond its own build. */
+export interface StaticAppMount {
+    app: LoadedStaticApp;
+    /** Sibling paths the app's SPA fallback must decline — the path-only rule. */
+    siblingPaths: string[];
+    /** Present when apps are told apart by hostname; see `ServeSPAConfig.owns`. */
+    owns?: (request: StaticAppRequest) => boolean;
+}
+/**
+ * Decide how each static app is mounted, in the order given.
+ *
+ * Two rules, chosen by whether any app names a hostname.
+ *
+ * **None does:** every app declines the paths of the apps nested beneath it
+ * (`nestedAppPaths`), exactly as a bundle has always been served. Not the
+ * resolver, even though it would agree on every ordinary request: in the
+ * corner it disagrees — a file in the root app's build under a sibling's
+ * prefix — those bundles are already deployed. A bundle that never mentions
+ * a hostname gets byte-for-byte what it got before hostnames existed.
+ *
+ * **Any does:** a path cannot say which app a request belongs to any more.
+ * Two apps can both sit at "/", and a host-less site must still answer
+ * `/cms` on its own domain while an admin on another hostname owns `/cms`
+ * there — excluding "/cms" by path would 404 the site's. So every mount asks
+ * the one resolver instead, and declines whatever another app wins.
+ */
+export declare function planStaticAppMounts(apps: readonly LoadedStaticApp[]): StaticAppMount[];