@rebasepro/server 0.22.0 → 0.24.0

package/dist/{src-Br6ARbs6.js → src-CatHFUym.js}

@@ -268,12 +268,29 @@ var DEFAULT_CAPABILITIES = {
 	supportsDocumentAdmin: true,
 	supportsSchemaAdmin: true
 };
-var CAPABILITIES_REGISTRY = {
-	postgres: POSTGRES_CAPABILITIES,
-	firestore: FIREBASE_CAPABILITIES,
-	mongodb: MONGODB_CAPABILITIES,
-	"(default)": DEFAULT_CAPABILITIES
-};
+var BUILT_IN_CAPABILITIES = /* @__PURE__ */ new Map([
+	["postgres", POSTGRES_CAPABILITIES],
+	["firestore", FIREBASE_CAPABILITIES],
+	["mongodb", MONGODB_CAPABILITIES],
+	["(default)", DEFAULT_CAPABILITIES]
+]);
+/**
+* Capabilities registered at runtime, on `globalThis` rather than in a module
+* local: a third-party driver inlines its own copy of this package and
+* registers through it, while the app and the server read through theirs. A
+* module local made the registration land in a copy nobody else reads.
+* See `module-state-across-copies.test.ts`.
+*/
+var REGISTERED_CAPABILITIES_KEY = Symbol.for("@rebasepro/types.dataSourceCapabilities.v1");
+function registeredCapabilities() {
+	const g = globalThis;
+	let registered = g[REGISTERED_CAPABILITIES_KEY];
+	if (!registered) {
+		registered = /* @__PURE__ */ new Map();
+		g[REGISTERED_CAPABILITIES_KEY] = registered;
+	}
+	return registered;
+}
 /**
 * Look up capabilities for a given engine key.
 * If `engine` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
@@ -281,7 +298,7 @@ var CAPABILITIES_REGISTRY = {
 */
 function getDataSourceCapabilities(engine) {
 	if (!engine) return POSTGRES_CAPABILITIES;
-	return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
+	return registeredCapabilities().get(engine) ?? BUILT_IN_CAPABILITIES.get(engine) ?? DEFAULT_CAPABILITIES;
 }
 //#endregion
 //#region ../types/src/types/collections.ts
@@ -761,31 +778,6 @@ function storageEnvSuffix(key, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
 	if (!normalized) throw new Error(`Source key "${key}" cannot be turned into an environment variable name. Use a key containing at least one letter or digit.`);
 	return `__${normalized}`;
 }
-/**
-* Two distinct keys that collapse onto the same variable name, or `null`.
-*
-* `media-cdn` and `media_cdn` are different source keys but the same suffix, so
-* without this one of them silently reads the other's configuration. Returns the
-* offending pair rather than throwing, so each caller can raise it in its own
-* idiom — a `BundleError` at boot, a build failure in the CLI, a rejected deploy
-* in a control plane.
-*
-* @group Models
-*/
-function findStorageSuffixCollision(keys, defaultKey = DEFAULT_STORAGE_SOURCE_KEY) {
-	const seen = /* @__PURE__ */ new Map();
-	for (const key of keys) {
-		const suffix = storageEnvSuffix(key, defaultKey);
-		const existing = seen.get(suffix);
-		if (existing !== void 0 && existing !== key) return {
-			a: existing,
-			b: key,
-			suffix
-		};
-		seen.set(suffix, key);
-	}
-	return null;
-}
 //#endregion
 //#region ../types/src/types/resource_kinds.ts
 /**
@@ -885,10 +877,15 @@ amendResourceKind("bucket", {
 		"S3_FORCE_PATH_STYLE",
 		"GCS_BUCKET",
 		"GCS_PROJECT_ID",
-		"GCS_KEY_FILENAME"
+		"GCS_KEY_FILENAME",
+		"STORAGE_MAX_FILE_SIZE"
 	],
 	envBasesByEngine: {
-		local: ["STORAGE_TYPE", "STORAGE_PATH"],
+		local: [
+			"STORAGE_TYPE",
+			"STORAGE_PATH",
+			"STORAGE_MAX_FILE_SIZE"
+		],
 		s3: [
 			"STORAGE_TYPE",
 			"S3_BUCKET",
@@ -896,13 +893,15 @@ amendResourceKind("bucket", {
 			"S3_ACCESS_KEY_ID",
 			"S3_SECRET_ACCESS_KEY",
 			"S3_ENDPOINT",
-			"S3_FORCE_PATH_STYLE"
+			"S3_FORCE_PATH_STYLE",
+			"STORAGE_MAX_FILE_SIZE"
 		],
 		gcs: [
 			"STORAGE_TYPE",
 			"GCS_BUCKET",
 			"GCS_PROJECT_ID",
-			"GCS_KEY_FILENAME"
+			"GCS_KEY_FILENAME",
+			"STORAGE_MAX_FILE_SIZE"
 		],
 		azure: [],
 		firebase: []
@@ -917,14 +916,48 @@ registerResourceKind({
 	implicitDefault: false
 });
 amendResourceKind("topic", { envBases: [] });
-var runtimeHolder = { current: null };
+/**
+* Declared handlers and installed runtimes, for topics and queues — on
+* `globalThis` under a shared symbol, never in module locals.
+*
+* A module local is one per COPY of this package, and two copies in one
+* process is the normal layout rather than an accident: `@rebasepro/server`
+* inlines this package into its own dist, while `config/resources.ts` imports
+* it from `node_modules`. With locals, a project's `.handler()` and
+* `.subscription()` went into the project's copy and the worker read the
+* server's empty one (`Job queue started {"tasks":0}`), and the runtime the
+* server installed was invisible to the project's `enqueue`/`publish` — so
+* every queue and topic threw "no runtime is installed" inside a running
+* backend. The CLI deriving the graph had the same split. Same mechanism and
+* reasoning as `registry()` in resources.ts; `module-state-across-copies.test.ts`
+* loads two copies to hold it, and scans for any other module-level state that
+* would split the same way.
+*
+* The version is in the symbol: a change to this object's SHAPE takes a new
+* suffix, so no copy ever reads a shape it does not know.
+*/
+var WORK_KEY = Symbol.for("@rebasepro/types.workRegistry.v1");
+function work() {
+	const g = globalThis;
+	let shared = g[WORK_KEY];
+	if (!shared) {
+		shared = {
+			topicRuntime: null,
+			subscriptions: [],
+			queueRuntime: null,
+			queueConsumers: /* @__PURE__ */ new Map()
+		};
+		g[WORK_KEY] = shared;
+	}
+	return shared;
+}
 /** Install the transport topics publish through. Called by the server at boot. */
 function setTopicRuntime(runtime) {
-	runtimeHolder.current = runtime;
+	work().topicRuntime = runtime;
 }
-var subscriptions = [];
 /** Every declared subscription, for the worker to wire and the graph to record. */
 function declaredSubscriptions(topic) {
+	const { subscriptions } = work();
 	return topic ? subscriptions.filter((s) => s.topic === topic) : subscriptions.slice();
 }
 registerResourceKind({
@@ -975,15 +1008,13 @@ registerResourceKind({
 	optionKeys: ["maxAttempts"],
 	implicitDefault: false
 });
-var queueRuntimeHolder = { current: null };
 /** Install the transport queues enqueue through. Called by the server at boot. */
 function setQueueRuntime(runtime) {
-	queueRuntimeHolder.current = runtime;
+	work().queueRuntime = runtime;
 }
-var queueConsumers = /* @__PURE__ */ new Map();
 /** Every declared queue handler, for the worker to wire. */
 function declaredQueueConsumers() {
-	return [...queueConsumers.values()];
+	return [...work().queueConsumers.values()];
 }
 /**
 * One declaration, as the data layer's definition.
@@ -1021,6 +1052,369 @@ function resourceToStorageSource(declaration) {
 	};
 }
 //#endregion
-export { LIST_OPS as A, getDeclaredSubcollections as C, getDataSourceCapabilities as D, DEFAULT_DATA_SOURCE_KEY as E, sortKeyToString as F, toCanonicalOp as I, REST_TO_CANONICAL as M, isRelationAggregateSort as N, ALL_WHERE_FILTER_OPS as O, parseRelationAggregateSort as P, getCollectionDataPath as S, isRelationalCollectionConfig as T, resourceKinds as _, resourceToStorageSource as a, RLS_UID_SQL as b, DEFAULT_STORAGE_SOURCE_KEY as c, DEFAULT_RESOURCE_KEY as d, buildResourceGraph as f, resourceKind as g, resourceKeyOf as h, resourceToDataSource as i, NULL_OPS as j, CANONICAL_TO_REST as k, findStorageSuffixCollision as l, resourceEnvSuffix as m, declaredQueueConsumers as n, setQueueRuntime as o, resolveResourceRefs as p, declaredSubscriptions as r, setTopicRuntime as s, declareCron as t, storageEnvSuffix as u, RLS_JWT_SQL as v, isPostgresCollectionConfig as w, rewriteLegacyRlsFunctions as x, RLS_ROLES_SQL as y };
+//#region ../types/src/types/scopes.ts
+/**
+* Scopes — what a credential may do, named `resource:action`.
+*
+* One vocabulary for every way of reaching a Rebase backend: a person's
+* session, a service key, a personal key and an OAuth token for `/mcp` all
+* answer "may this caller do X?" with the same strings, so a grant reads the
+* same on a key, on a role and on a consent screen.
+*
+* A scope may carry a target — `data:read:posts` is `data:read` on the `posts`
+* collection only. The unqualified scope covers every target. Only the data
+* plane and app scopes take targets; see {@link SCOPE_TARGETS}.
+*
+* Two planes, held differently:
+*
+* - **The data plane** (`data:*`, `storage:*`, `functions:invoke`). Every
+*   signed-in person holds all of it, because what a person may do with data
+*   is decided row by row by the collection's `securityRules` and by storage
+*   policies, never by a scope. On a key or a token these scopes narrow: a key
+*   holding `data:read:posts` reaches nothing else, whatever RLS would allow.
+* - **The admin plane** (everything else). Nobody holds it implicitly. The
+*   `admin` role holds all of it; any other role holds what the app declares
+*   for it under `auth.roles` on the users collection.
+*
+* Apps declare their own scopes too (`auth.scopes`), named the same way —
+* `project:deploy`. Every signed-in person holds every app scope: like the data
+* plane, the function behind it decides whether the person may act, and the
+* scope exists so a key can be narrowed to that one action.
+*
+* @module
+*/
+/** @group Auth */
+var DATA_PLANE_SCOPES = [
+	"data:read",
+	"data:write",
+	"data:delete",
+	"storage:read",
+	"storage:write",
+	"storage:delete",
+	"functions:invoke"
+];
+/** @group Auth */
+var ADMIN_SCOPES = [
+	"users:read",
+	"users:write",
+	"schema:read",
+	"schema:write",
+	"database:read",
+	"database:write",
+	"backups:read",
+	"cron:read",
+	"cron:write",
+	"logs:read",
+	"keys:read",
+	"keys:write"
+];
+/** Every scope Rebase itself defines, in display order. @group Auth */
+var BUILT_IN_SCOPES = [...DATA_PLANE_SCOPES, ...ADMIN_SCOPES];
+/**
+* Scopes no key may hold.
+*
+* A key that could manage keys could mint its own successor, widen itself, or
+* revoke the keys other integrations run on — and revoking it would undo none
+* of that. Managing keys is for a person (or the service key).
+*
+* @group Auth
+*/
+var KEY_MANAGEMENT_SCOPES = ["keys:read", "keys:write"];
+/** The one built-in role. It holds every scope and is the RLS `admin` role. @group Auth */
+var ADMIN_ROLE = "admin";
+/**
+* The built-in scopes that accept a target, and what the target names.
+*
+* - `data:*` — a collection slug
+* - `storage:*` — a storage source id (`(default)` for the default source)
+* - `functions:invoke` — a custom function's name
+*
+* @group Auth
+*/
+var SCOPE_TARGETS = {
+	"data:read": "collection",
+	"data:write": "collection",
+	"data:delete": "collection",
+	"storage:read": "bucket",
+	"storage:write": "bucket",
+	"storage:delete": "bucket",
+	"functions:invoke": "function"
+};
+/** @group Auth */
+var BUILT_IN_SCOPE_DESCRIPTIONS = {
+	"data:read": {
+		label: "Read data",
+		description: "Read rows from collections, through the caller's row-level security."
+	},
+	"data:write": {
+		label: "Create and update data",
+		description: "Create and update rows in collections, through the caller's row-level security."
+	},
+	"data:delete": {
+		label: "Delete data",
+		description: "Delete rows from collections, through the caller's row-level security."
+	},
+	"storage:read": {
+		label: "Read files",
+		description: "List and download stored files."
+	},
+	"storage:write": {
+		label: "Upload files",
+		description: "Upload files and create folders."
+	},
+	"storage:delete": {
+		label: "Delete files",
+		description: "Delete stored files."
+	},
+	"functions:invoke": {
+		label: "Call functions",
+		description: "Call the backend's custom functions. A function can do anything its code does."
+	},
+	"users:read": {
+		label: "See users",
+		description: "List user accounts and their roles."
+	},
+	"users:write": {
+		label: "Manage users",
+		description: "Create, edit and delete accounts, reset passwords and second factors, and assign roles up to the holder's own."
+	},
+	"schema:read": {
+		label: "See the schema",
+		description: "Read the collection schema, plan schema changes and run the RLS audit."
+	},
+	"schema:write": {
+		label: "Change the schema",
+		description: "Apply schema changes: edits collection files and alters the database."
+	},
+	"database:read": {
+		label: "Inspect the database",
+		description: "List databases, tables, Postgres roles and branches."
+	},
+	"database:write": {
+		label: "Run SQL",
+		description: "Run SQL as the database owner, outside row-level security, and create or delete branches."
+	},
+	"backups:read": {
+		label: "Download backups",
+		description: "List and download database backups — every row, outside row-level security."
+	},
+	"cron:read": {
+		label: "See cron jobs",
+		description: "List cron jobs and read their run history."
+	},
+	"cron:write": {
+		label: "Run cron jobs",
+		description: "Trigger cron jobs and switch them on or off."
+	},
+	"logs:read": {
+		label: "Read server logs",
+		description: "Read the server's request and application logs."
+	},
+	"keys:read": {
+		label: "See service keys",
+		description: "List the project's service keys. Never grantable to a key."
+	},
+	"keys:write": {
+		label: "Manage service keys",
+		description: "Create, change and revoke the project's service keys. Never grantable to a key."
+	}
+};
+/** The access model of an app that declares nothing: built-ins only. @group Auth */
+var EMPTY_ACCESS_MODEL = {
+	roles: {},
+	scopes: {}
+};
+var SCOPE_PART = /^[a-z][a-z0-9-]*$/;
+/**
+* Split `resource:action[:target]`. Returns null for anything else.
+*
+* The target is everything after the second colon, so a target may itself
+* contain colons. Resource and action are lower-case words.
+*
+* @group Auth
+*/
+function parseScope(value) {
+	if (typeof value !== "string") return null;
+	const first = value.indexOf(":");
+	if (first < 0) return null;
+	const second = value.indexOf(":", first + 1);
+	const resource = value.slice(0, first);
+	const action = second < 0 ? value.slice(first + 1) : value.slice(first + 1, second);
+	if (!SCOPE_PART.test(resource) || !SCOPE_PART.test(action)) return null;
+	if (second < 0) return { scope: `${resource}:${action}` };
+	const target = value.slice(second + 1);
+	if (target.length === 0 || /\s/.test(target)) return null;
+	return {
+		scope: `${resource}:${action}`,
+		target
+	};
+}
+/** @group Auth */
+function isBuiltInScope(scope) {
+	return BUILT_IN_SCOPES.includes(scope);
+}
+/** @group Auth */
+function isDataPlaneScope(scope) {
+	return DATA_PLANE_SCOPES.includes(scope);
+}
+/** @group Auth */
+function isAdminScope(scope) {
+	return ADMIN_SCOPES.includes(scope);
+}
+/** Does this list of roles include the built-in `admin` role? @group Auth */
+function hasAdminRole(roles) {
+	return !!roles?.includes(ADMIN_ROLE);
+}
+/**
+* Does a set of held scopes grant `scope`, optionally on one `target`?
+*
+* The unqualified grant covers every target. A qualified grant covers its own
+* target only, and never answers an unqualified question: a key holding
+* `data:read:posts` is not asked "may you read data?" and told yes.
+*
+* @group Auth
+*/
+function scopeGrants(held, scope, target) {
+	for (const entry of held) {
+		if (entry === scope) return true;
+		if (target !== void 0 && entry === `${scope}:${target}`) return true;
+	}
+	return false;
+}
+/**
+* Does a set of held scopes grant `scope` on at least one target?
+*
+* For a surface that lists what is reachable — the collections an MCP client
+* may query — and filters per item afterwards.
+*
+* @group Auth
+*/
+function scopeGrantsAny(held, scope) {
+	const prefix = `${scope}:`;
+	return held.some((entry) => entry === scope || entry.startsWith(prefix));
+}
+/**
+* Every scope a person holding `roles` has.
+*
+* The data plane and every app scope always; the whole admin plane with the
+* `admin` role; otherwise each declared role's scopes. A role nobody declared
+* adds nothing — it may still mean something to an RLS policy.
+*
+* @group Auth
+*/
+function scopesForRoles(roles, model = EMPTY_ACCESS_MODEL) {
+	const held = /* @__PURE__ */ new Set([...DATA_PLANE_SCOPES, ...Object.keys(model.scopes)]);
+	if (hasAdminRole(roles)) {
+		for (const scope of ADMIN_SCOPES) held.add(scope);
+		return [...held];
+	}
+	for (const role of roles ?? []) {
+		const definition = Object.prototype.hasOwnProperty.call(model.roles, role) ? model.roles[role] : void 0;
+		for (const scope of definition?.scopes ?? []) held.add(scope);
+	}
+	return [...held];
+}
+/**
+* Every scope this access model knows, unqualified: the built-ins, then the
+* app's own.
+*
+* @group Auth
+*/
+function knownScopes(model = EMPTY_ACCESS_MODEL) {
+	return [...BUILT_IN_SCOPES, ...Object.keys(model.scopes)];
+}
+/** Does this scope accept a target? @group Auth */
+function scopeAcceptsTarget(scope, model = EMPTY_ACCESS_MODEL) {
+	if (isBuiltInScope(scope)) return SCOPE_TARGETS[scope] !== void 0;
+	return (Object.prototype.hasOwnProperty.call(model.scopes, scope) ? model.scopes[scope] : void 0)?.target !== void 0;
+}
+/**
+* Check a list of scope strings against an access model. Returns the
+* problems, empty when every entry is a known scope with an acceptable target.
+*
+* @group Auth
+*/
+function validateScopes(values, model = EMPTY_ACCESS_MODEL) {
+	const known = new Set(knownScopes(model));
+	const problems = [];
+	for (const value of values) {
+		const text = typeof value === "string" ? value : String(value);
+		const parsed = typeof value === "string" ? parseScope(value) : null;
+		if (!parsed) problems.push({
+			scope: text,
+			reason: "malformed"
+		});
+		else if (!known.has(parsed.scope)) problems.push({
+			scope: text,
+			reason: "unknown"
+		});
+		else if (parsed.target !== void 0 && !scopeAcceptsTarget(parsed.scope, model)) problems.push({
+			scope: text,
+			reason: "target-not-accepted"
+		});
+	}
+	return problems;
+}
+/**
+* The entries of `requested` that `held` does not cover — what a credential
+* would hold beyond its minter. Empty means the request is within reach.
+*
+* `data:read:posts` is covered by `data:read`; `data:read` is not covered by
+* `data:read:posts`.
+*
+* @group Auth
+*/
+function scopesBeyond(requested, held) {
+	return requested.filter((entry) => {
+		const parsed = parseScope(entry);
+		if (!parsed) return true;
+		return !scopeGrants(held, parsed.scope, parsed.target);
+	});
+}
+/**
+* Narrow `requested` to what `held` covers, entry by entry. What a personal
+* key holds today when its owner has lost a role since it was minted.
+*
+* @group Auth
+*/
+function intersectScopes(requested, held) {
+	const beyond = new Set(scopesBeyond(requested, held));
+	return requested.filter((entry) => !beyond.has(entry));
+}
+/** The roles of an access model, `admin` first. @group Auth */
+function summarizeRoles(model = EMPTY_ACCESS_MODEL) {
+	return [{
+		id: ADMIN_ROLE,
+		name: "Admin",
+		description: "Holds every scope. Row-level security does not limit it: it reads, changes and deletes every row.",
+		scopes: [...ADMIN_SCOPES],
+		builtIn: true
+	}, ...Object.entries(model.roles).map(([id, definition]) => ({
+		id,
+		name: definition.name ?? id,
+		...definition.description ? { description: definition.description } : {},
+		scopes: [...definition.scopes],
+		builtIn: false
+	}))];
+}
+/** Every scope of an access model, described, in display order. @group Auth */
+function summarizeScopes(model = EMPTY_ACCESS_MODEL) {
+	const builtIn = BUILT_IN_SCOPES.map((scope) => ({
+		scope,
+		...BUILT_IN_SCOPE_DESCRIPTIONS[scope],
+		...SCOPE_TARGETS[scope] ? { target: SCOPE_TARGETS[scope] } : {},
+		plane: isDataPlaneScope(scope) ? "data" : "admin"
+	}));
+	const app = Object.entries(model.scopes).map(([scope, definition]) => ({
+		scope,
+		label: definition.label,
+		description: definition.description ?? "",
+		...definition.target ? { target: definition.target } : {},
+		plane: "app"
+	}));
+	return [...builtIn, ...app];
+}
+//#endregion
+export { parseRelationAggregateSort as $, DEFAULT_RESOURCE_KEY as A, rewriteLegacyRlsFunctions as B, declaredSubscriptions as C, setTopicRuntime as D, setQueueRuntime as E, resourceKind as F, DEFAULT_DATA_SOURCE_KEY as G, getDeclaredSubcollections as H, resourceKinds as I, CANONICAL_TO_REST as J, getDataSourceCapabilities as K, RLS_JWT_SQL as L, resolveResourceRefs as M, resourceEnvSuffix as N, DEFAULT_STORAGE_SOURCE_KEY as O, resourceKeyOf as P, isRelationAggregateSort as Q, RLS_ROLES_SQL as R, declaredQueueConsumers as S, resourceToStorageSource as T, isPostgresCollectionConfig as U, getCollectionDataPath as V, isRelationalCollectionConfig as W, NULL_OPS as X, LIST_OPS as Y, REST_TO_CANONICAL as Z, scopesForRoles as _, KEY_MANAGEMENT_SCOPES as a, validateScopes as b, intersectScopes as c, isDataPlaneScope as d, sortKeyToString as et, knownScopes as f, scopesBeyond as g, scopeGrantsAny as h, EMPTY_ACCESS_MODEL as i, buildResourceGraph as j, storageEnvSuffix as k, isAdminScope as l, scopeGrants as m, ADMIN_SCOPES as n, SCOPE_TARGETS as o, parseScope as p, ALL_WHERE_FILTER_OPS as q, BUILT_IN_SCOPES as r, hasAdminRole as s, ADMIN_ROLE as t, toCanonicalOp as tt, isBuiltInScope as u, summarizeRoles as v, resourceToDataSource as w, declareCron as x, summarizeScopes as y, RLS_UID_SQL as z };
 
-//# sourceMappingURL=src-Br6ARbs6.js.map
+//# sourceMappingURL=src-CatHFUym.js.map