@rebasepro/server 0.23.0 → 0.24.0

package/dist/{src-vkcwKXbT.js → src-CatHFUym.js}

@@ -268,12 +268,29 @@ var DEFAULT_CAPABILITIES = {
 	supportsDocumentAdmin: true,
 	supportsSchemaAdmin: true
 };
-var CAPABILITIES_REGISTRY = {
-	postgres: POSTGRES_CAPABILITIES,
-	firestore: FIREBASE_CAPABILITIES,
-	mongodb: MONGODB_CAPABILITIES,
-	"(default)": DEFAULT_CAPABILITIES
-};
+var BUILT_IN_CAPABILITIES = /* @__PURE__ */ new Map([
+	["postgres", POSTGRES_CAPABILITIES],
+	["firestore", FIREBASE_CAPABILITIES],
+	["mongodb", MONGODB_CAPABILITIES],
+	["(default)", DEFAULT_CAPABILITIES]
+]);
+/**
+* Capabilities registered at runtime, on `globalThis` rather than in a module
+* local: a third-party driver inlines its own copy of this package and
+* registers through it, while the app and the server read through theirs. A
+* module local made the registration land in a copy nobody else reads.
+* See `module-state-across-copies.test.ts`.
+*/
+var REGISTERED_CAPABILITIES_KEY = Symbol.for("@rebasepro/types.dataSourceCapabilities.v1");
+function registeredCapabilities() {
+	const g = globalThis;
+	let registered = g[REGISTERED_CAPABILITIES_KEY];
+	if (!registered) {
+		registered = /* @__PURE__ */ new Map();
+		g[REGISTERED_CAPABILITIES_KEY] = registered;
+	}
+	return registered;
+}
 /**
 * Look up capabilities for a given engine key.
 * If `engine` is undefined or not found, returns `DEFAULT_CAPABILITIES`.
@@ -281,7 +298,7 @@ var CAPABILITIES_REGISTRY = {
 */
 function getDataSourceCapabilities(engine) {
 	if (!engine) return POSTGRES_CAPABILITIES;
-	return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
+	return registeredCapabilities().get(engine) ?? BUILT_IN_CAPABILITIES.get(engine) ?? DEFAULT_CAPABILITIES;
 }
 //#endregion
 //#region ../types/src/types/collections.ts
@@ -860,10 +877,15 @@ amendResourceKind("bucket", {
 		"S3_FORCE_PATH_STYLE",
 		"GCS_BUCKET",
 		"GCS_PROJECT_ID",
-		"GCS_KEY_FILENAME"
+		"GCS_KEY_FILENAME",
+		"STORAGE_MAX_FILE_SIZE"
 	],
 	envBasesByEngine: {
-		local: ["STORAGE_TYPE", "STORAGE_PATH"],
+		local: [
+			"STORAGE_TYPE",
+			"STORAGE_PATH",
+			"STORAGE_MAX_FILE_SIZE"
+		],
 		s3: [
 			"STORAGE_TYPE",
 			"S3_BUCKET",
@@ -871,13 +893,15 @@ amendResourceKind("bucket", {
 			"S3_ACCESS_KEY_ID",
 			"S3_SECRET_ACCESS_KEY",
 			"S3_ENDPOINT",
-			"S3_FORCE_PATH_STYLE"
+			"S3_FORCE_PATH_STYLE",
+			"STORAGE_MAX_FILE_SIZE"
 		],
 		gcs: [
 			"STORAGE_TYPE",
 			"GCS_BUCKET",
 			"GCS_PROJECT_ID",
-			"GCS_KEY_FILENAME"
+			"GCS_KEY_FILENAME",
+			"STORAGE_MAX_FILE_SIZE"
 		],
 		azure: [],
 		firebase: []
@@ -892,14 +916,48 @@ registerResourceKind({
 	implicitDefault: false
 });
 amendResourceKind("topic", { envBases: [] });
-var runtimeHolder = { current: null };
+/**
+* Declared handlers and installed runtimes, for topics and queues — on
+* `globalThis` under a shared symbol, never in module locals.
+*
+* A module local is one per COPY of this package, and two copies in one
+* process is the normal layout rather than an accident: `@rebasepro/server`
+* inlines this package into its own dist, while `config/resources.ts` imports
+* it from `node_modules`. With locals, a project's `.handler()` and
+* `.subscription()` went into the project's copy and the worker read the
+* server's empty one (`Job queue started {"tasks":0}`), and the runtime the
+* server installed was invisible to the project's `enqueue`/`publish` — so
+* every queue and topic threw "no runtime is installed" inside a running
+* backend. The CLI deriving the graph had the same split. Same mechanism and
+* reasoning as `registry()` in resources.ts; `module-state-across-copies.test.ts`
+* loads two copies to hold it, and scans for any other module-level state that
+* would split the same way.
+*
+* The version is in the symbol: a change to this object's SHAPE takes a new
+* suffix, so no copy ever reads a shape it does not know.
+*/
+var WORK_KEY = Symbol.for("@rebasepro/types.workRegistry.v1");
+function work() {
+	const g = globalThis;
+	let shared = g[WORK_KEY];
+	if (!shared) {
+		shared = {
+			topicRuntime: null,
+			subscriptions: [],
+			queueRuntime: null,
+			queueConsumers: /* @__PURE__ */ new Map()
+		};
+		g[WORK_KEY] = shared;
+	}
+	return shared;
+}
 /** Install the transport topics publish through. Called by the server at boot. */
 function setTopicRuntime(runtime) {
-	runtimeHolder.current = runtime;
+	work().topicRuntime = runtime;
 }
-var subscriptions = [];
 /** Every declared subscription, for the worker to wire and the graph to record. */
 function declaredSubscriptions(topic) {
+	const { subscriptions } = work();
 	return topic ? subscriptions.filter((s) => s.topic === topic) : subscriptions.slice();
 }
 registerResourceKind({
@@ -950,15 +1008,13 @@ registerResourceKind({
 	optionKeys: ["maxAttempts"],
 	implicitDefault: false
 });
-var queueRuntimeHolder = { current: null };
 /** Install the transport queues enqueue through. Called by the server at boot. */
 function setQueueRuntime(runtime) {
-	queueRuntimeHolder.current = runtime;
+	work().queueRuntime = runtime;
 }
-var queueConsumers = /* @__PURE__ */ new Map();
 /** Every declared queue handler, for the worker to wire. */
 function declaredQueueConsumers() {
-	return [...queueConsumers.values()];
+	return [...work().queueConsumers.values()];
 }
 /**
 * One declaration, as the data layer's definition.
@@ -996,6 +1052,369 @@ function resourceToStorageSource(declaration) {
 	};
 }
 //#endregion
-export { NULL_OPS as A, isPostgresCollectionConfig as C, ALL_WHERE_FILTER_OPS as D, getDataSourceCapabilities as E, toCanonicalOp as F, isRelationAggregateSort as M, parseRelationAggregateSort as N, CANONICAL_TO_REST as O, sortKeyToString as P, getDeclaredSubcollections as S, DEFAULT_DATA_SOURCE_KEY as T, RLS_JWT_SQL as _, resourceToStorageSource as a, rewriteLegacyRlsFunctions as b, DEFAULT_STORAGE_SOURCE_KEY as c, buildResourceGraph as d, resolveResourceRefs as f, resourceKinds as g, resourceKind as h, resourceToDataSource as i, REST_TO_CANONICAL as j, LIST_OPS as k, storageEnvSuffix as l, resourceKeyOf as m, declaredQueueConsumers as n, setQueueRuntime as o, resourceEnvSuffix as p, declaredSubscriptions as r, setTopicRuntime as s, declareCron as t, DEFAULT_RESOURCE_KEY as u, RLS_ROLES_SQL as v, isRelationalCollectionConfig as w, getCollectionDataPath as x, RLS_UID_SQL as y };
+//#region ../types/src/types/scopes.ts
+/**
+* Scopes — what a credential may do, named `resource:action`.
+*
+* One vocabulary for every way of reaching a Rebase backend: a person's
+* session, a service key, a personal key and an OAuth token for `/mcp` all
+* answer "may this caller do X?" with the same strings, so a grant reads the
+* same on a key, on a role and on a consent screen.
+*
+* A scope may carry a target — `data:read:posts` is `data:read` on the `posts`
+* collection only. The unqualified scope covers every target. Only the data
+* plane and app scopes take targets; see {@link SCOPE_TARGETS}.
+*
+* Two planes, held differently:
+*
+* - **The data plane** (`data:*`, `storage:*`, `functions:invoke`). Every
+*   signed-in person holds all of it, because what a person may do with data
+*   is decided row by row by the collection's `securityRules` and by storage
+*   policies, never by a scope. On a key or a token these scopes narrow: a key
+*   holding `data:read:posts` reaches nothing else, whatever RLS would allow.
+* - **The admin plane** (everything else). Nobody holds it implicitly. The
+*   `admin` role holds all of it; any other role holds what the app declares
+*   for it under `auth.roles` on the users collection.
+*
+* Apps declare their own scopes too (`auth.scopes`), named the same way —
+* `project:deploy`. Every signed-in person holds every app scope: like the data
+* plane, the function behind it decides whether the person may act, and the
+* scope exists so a key can be narrowed to that one action.
+*
+* @module
+*/
+/** @group Auth */
+var DATA_PLANE_SCOPES = [
+	"data:read",
+	"data:write",
+	"data:delete",
+	"storage:read",
+	"storage:write",
+	"storage:delete",
+	"functions:invoke"
+];
+/** @group Auth */
+var ADMIN_SCOPES = [
+	"users:read",
+	"users:write",
+	"schema:read",
+	"schema:write",
+	"database:read",
+	"database:write",
+	"backups:read",
+	"cron:read",
+	"cron:write",
+	"logs:read",
+	"keys:read",
+	"keys:write"
+];
+/** Every scope Rebase itself defines, in display order. @group Auth */
+var BUILT_IN_SCOPES = [...DATA_PLANE_SCOPES, ...ADMIN_SCOPES];
+/**
+* Scopes no key may hold.
+*
+* A key that could manage keys could mint its own successor, widen itself, or
+* revoke the keys other integrations run on — and revoking it would undo none
+* of that. Managing keys is for a person (or the service key).
+*
+* @group Auth
+*/
+var KEY_MANAGEMENT_SCOPES = ["keys:read", "keys:write"];
+/** The one built-in role. It holds every scope and is the RLS `admin` role. @group Auth */
+var ADMIN_ROLE = "admin";
+/**
+* The built-in scopes that accept a target, and what the target names.
+*
+* - `data:*` — a collection slug
+* - `storage:*` — a storage source id (`(default)` for the default source)
+* - `functions:invoke` — a custom function's name
+*
+* @group Auth
+*/
+var SCOPE_TARGETS = {
+	"data:read": "collection",
+	"data:write": "collection",
+	"data:delete": "collection",
+	"storage:read": "bucket",
+	"storage:write": "bucket",
+	"storage:delete": "bucket",
+	"functions:invoke": "function"
+};
+/** @group Auth */
+var BUILT_IN_SCOPE_DESCRIPTIONS = {
+	"data:read": {
+		label: "Read data",
+		description: "Read rows from collections, through the caller's row-level security."
+	},
+	"data:write": {
+		label: "Create and update data",
+		description: "Create and update rows in collections, through the caller's row-level security."
+	},
+	"data:delete": {
+		label: "Delete data",
+		description: "Delete rows from collections, through the caller's row-level security."
+	},
+	"storage:read": {
+		label: "Read files",
+		description: "List and download stored files."
+	},
+	"storage:write": {
+		label: "Upload files",
+		description: "Upload files and create folders."
+	},
+	"storage:delete": {
+		label: "Delete files",
+		description: "Delete stored files."
+	},
+	"functions:invoke": {
+		label: "Call functions",
+		description: "Call the backend's custom functions. A function can do anything its code does."
+	},
+	"users:read": {
+		label: "See users",
+		description: "List user accounts and their roles."
+	},
+	"users:write": {
+		label: "Manage users",
+		description: "Create, edit and delete accounts, reset passwords and second factors, and assign roles up to the holder's own."
+	},
+	"schema:read": {
+		label: "See the schema",
+		description: "Read the collection schema, plan schema changes and run the RLS audit."
+	},
+	"schema:write": {
+		label: "Change the schema",
+		description: "Apply schema changes: edits collection files and alters the database."
+	},
+	"database:read": {
+		label: "Inspect the database",
+		description: "List databases, tables, Postgres roles and branches."
+	},
+	"database:write": {
+		label: "Run SQL",
+		description: "Run SQL as the database owner, outside row-level security, and create or delete branches."
+	},
+	"backups:read": {
+		label: "Download backups",
+		description: "List and download database backups — every row, outside row-level security."
+	},
+	"cron:read": {
+		label: "See cron jobs",
+		description: "List cron jobs and read their run history."
+	},
+	"cron:write": {
+		label: "Run cron jobs",
+		description: "Trigger cron jobs and switch them on or off."
+	},
+	"logs:read": {
+		label: "Read server logs",
+		description: "Read the server's request and application logs."
+	},
+	"keys:read": {
+		label: "See service keys",
+		description: "List the project's service keys. Never grantable to a key."
+	},
+	"keys:write": {
+		label: "Manage service keys",
+		description: "Create, change and revoke the project's service keys. Never grantable to a key."
+	}
+};
+/** The access model of an app that declares nothing: built-ins only. @group Auth */
+var EMPTY_ACCESS_MODEL = {
+	roles: {},
+	scopes: {}
+};
+var SCOPE_PART = /^[a-z][a-z0-9-]*$/;
+/**
+* Split `resource:action[:target]`. Returns null for anything else.
+*
+* The target is everything after the second colon, so a target may itself
+* contain colons. Resource and action are lower-case words.
+*
+* @group Auth
+*/
+function parseScope(value) {
+	if (typeof value !== "string") return null;
+	const first = value.indexOf(":");
+	if (first < 0) return null;
+	const second = value.indexOf(":", first + 1);
+	const resource = value.slice(0, first);
+	const action = second < 0 ? value.slice(first + 1) : value.slice(first + 1, second);
+	if (!SCOPE_PART.test(resource) || !SCOPE_PART.test(action)) return null;
+	if (second < 0) return { scope: `${resource}:${action}` };
+	const target = value.slice(second + 1);
+	if (target.length === 0 || /\s/.test(target)) return null;
+	return {
+		scope: `${resource}:${action}`,
+		target
+	};
+}
+/** @group Auth */
+function isBuiltInScope(scope) {
+	return BUILT_IN_SCOPES.includes(scope);
+}
+/** @group Auth */
+function isDataPlaneScope(scope) {
+	return DATA_PLANE_SCOPES.includes(scope);
+}
+/** @group Auth */
+function isAdminScope(scope) {
+	return ADMIN_SCOPES.includes(scope);
+}
+/** Does this list of roles include the built-in `admin` role? @group Auth */
+function hasAdminRole(roles) {
+	return !!roles?.includes(ADMIN_ROLE);
+}
+/**
+* Does a set of held scopes grant `scope`, optionally on one `target`?
+*
+* The unqualified grant covers every target. A qualified grant covers its own
+* target only, and never answers an unqualified question: a key holding
+* `data:read:posts` is not asked "may you read data?" and told yes.
+*
+* @group Auth
+*/
+function scopeGrants(held, scope, target) {
+	for (const entry of held) {
+		if (entry === scope) return true;
+		if (target !== void 0 && entry === `${scope}:${target}`) return true;
+	}
+	return false;
+}
+/**
+* Does a set of held scopes grant `scope` on at least one target?
+*
+* For a surface that lists what is reachable — the collections an MCP client
+* may query — and filters per item afterwards.
+*
+* @group Auth
+*/
+function scopeGrantsAny(held, scope) {
+	const prefix = `${scope}:`;
+	return held.some((entry) => entry === scope || entry.startsWith(prefix));
+}
+/**
+* Every scope a person holding `roles` has.
+*
+* The data plane and every app scope always; the whole admin plane with the
+* `admin` role; otherwise each declared role's scopes. A role nobody declared
+* adds nothing — it may still mean something to an RLS policy.
+*
+* @group Auth
+*/
+function scopesForRoles(roles, model = EMPTY_ACCESS_MODEL) {
+	const held = /* @__PURE__ */ new Set([...DATA_PLANE_SCOPES, ...Object.keys(model.scopes)]);
+	if (hasAdminRole(roles)) {
+		for (const scope of ADMIN_SCOPES) held.add(scope);
+		return [...held];
+	}
+	for (const role of roles ?? []) {
+		const definition = Object.prototype.hasOwnProperty.call(model.roles, role) ? model.roles[role] : void 0;
+		for (const scope of definition?.scopes ?? []) held.add(scope);
+	}
+	return [...held];
+}
+/**
+* Every scope this access model knows, unqualified: the built-ins, then the
+* app's own.
+*
+* @group Auth
+*/
+function knownScopes(model = EMPTY_ACCESS_MODEL) {
+	return [...BUILT_IN_SCOPES, ...Object.keys(model.scopes)];
+}
+/** Does this scope accept a target? @group Auth */
+function scopeAcceptsTarget(scope, model = EMPTY_ACCESS_MODEL) {
+	if (isBuiltInScope(scope)) return SCOPE_TARGETS[scope] !== void 0;
+	return (Object.prototype.hasOwnProperty.call(model.scopes, scope) ? model.scopes[scope] : void 0)?.target !== void 0;
+}
+/**
+* Check a list of scope strings against an access model. Returns the
+* problems, empty when every entry is a known scope with an acceptable target.
+*
+* @group Auth
+*/
+function validateScopes(values, model = EMPTY_ACCESS_MODEL) {
+	const known = new Set(knownScopes(model));
+	const problems = [];
+	for (const value of values) {
+		const text = typeof value === "string" ? value : String(value);
+		const parsed = typeof value === "string" ? parseScope(value) : null;
+		if (!parsed) problems.push({
+			scope: text,
+			reason: "malformed"
+		});
+		else if (!known.has(parsed.scope)) problems.push({
+			scope: text,
+			reason: "unknown"
+		});
+		else if (parsed.target !== void 0 && !scopeAcceptsTarget(parsed.scope, model)) problems.push({
+			scope: text,
+			reason: "target-not-accepted"
+		});
+	}
+	return problems;
+}
+/**
+* The entries of `requested` that `held` does not cover — what a credential
+* would hold beyond its minter. Empty means the request is within reach.
+*
+* `data:read:posts` is covered by `data:read`; `data:read` is not covered by
+* `data:read:posts`.
+*
+* @group Auth
+*/
+function scopesBeyond(requested, held) {
+	return requested.filter((entry) => {
+		const parsed = parseScope(entry);
+		if (!parsed) return true;
+		return !scopeGrants(held, parsed.scope, parsed.target);
+	});
+}
+/**
+* Narrow `requested` to what `held` covers, entry by entry. What a personal
+* key holds today when its owner has lost a role since it was minted.
+*
+* @group Auth
+*/
+function intersectScopes(requested, held) {
+	const beyond = new Set(scopesBeyond(requested, held));
+	return requested.filter((entry) => !beyond.has(entry));
+}
+/** The roles of an access model, `admin` first. @group Auth */
+function summarizeRoles(model = EMPTY_ACCESS_MODEL) {
+	return [{
+		id: ADMIN_ROLE,
+		name: "Admin",
+		description: "Holds every scope. Row-level security does not limit it: it reads, changes and deletes every row.",
+		scopes: [...ADMIN_SCOPES],
+		builtIn: true
+	}, ...Object.entries(model.roles).map(([id, definition]) => ({
+		id,
+		name: definition.name ?? id,
+		...definition.description ? { description: definition.description } : {},
+		scopes: [...definition.scopes],
+		builtIn: false
+	}))];
+}
+/** Every scope of an access model, described, in display order. @group Auth */
+function summarizeScopes(model = EMPTY_ACCESS_MODEL) {
+	const builtIn = BUILT_IN_SCOPES.map((scope) => ({
+		scope,
+		...BUILT_IN_SCOPE_DESCRIPTIONS[scope],
+		...SCOPE_TARGETS[scope] ? { target: SCOPE_TARGETS[scope] } : {},
+		plane: isDataPlaneScope(scope) ? "data" : "admin"
+	}));
+	const app = Object.entries(model.scopes).map(([scope, definition]) => ({
+		scope,
+		label: definition.label,
+		description: definition.description ?? "",
+		...definition.target ? { target: definition.target } : {},
+		plane: "app"
+	}));
+	return [...builtIn, ...app];
+}
+//#endregion
+export { parseRelationAggregateSort as $, DEFAULT_RESOURCE_KEY as A, rewriteLegacyRlsFunctions as B, declaredSubscriptions as C, setTopicRuntime as D, setQueueRuntime as E, resourceKind as F, DEFAULT_DATA_SOURCE_KEY as G, getDeclaredSubcollections as H, resourceKinds as I, CANONICAL_TO_REST as J, getDataSourceCapabilities as K, RLS_JWT_SQL as L, resolveResourceRefs as M, resourceEnvSuffix as N, DEFAULT_STORAGE_SOURCE_KEY as O, resourceKeyOf as P, isRelationAggregateSort as Q, RLS_ROLES_SQL as R, declaredQueueConsumers as S, resourceToStorageSource as T, isPostgresCollectionConfig as U, getCollectionDataPath as V, isRelationalCollectionConfig as W, NULL_OPS as X, LIST_OPS as Y, REST_TO_CANONICAL as Z, scopesForRoles as _, KEY_MANAGEMENT_SCOPES as a, validateScopes as b, intersectScopes as c, isDataPlaneScope as d, sortKeyToString as et, knownScopes as f, scopesBeyond as g, scopeGrantsAny as h, EMPTY_ACCESS_MODEL as i, buildResourceGraph as j, storageEnvSuffix as k, isAdminScope as l, scopeGrants as m, ADMIN_SCOPES as n, SCOPE_TARGETS as o, parseScope as p, ALL_WHERE_FILTER_OPS as q, BUILT_IN_SCOPES as r, hasAdminRole as s, ADMIN_ROLE as t, toCanonicalOp as tt, isBuiltInScope as u, summarizeRoles as v, resourceToDataSource as w, declareCron as x, summarizeScopes as y, RLS_UID_SQL as z };
 
-//# sourceMappingURL=src-vkcwKXbT.js.map
+//# sourceMappingURL=src-CatHFUym.js.map