@rebasepro/server 0.24.0 → 0.24.1-canary.g56af4a4

package/dist/policy-PdzX-Opd.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-PdzX-Opd.js","names":[],"sources":["../../types/src/types/policy.ts"],"sourcesContent":["/**\n * Structured, engine-agnostic policy expressions.\n *\n * A {@link PolicyExpression} is the single source of truth for a row-level\n * security condition. It is compiled to Postgres `USING`/`WITH CHECK` SQL\n * (authoritative enforcement) and independently evaluated in JavaScript (to\n * drive the admin UI, and — in future — to enforce on engines without native\n * RLS such as MongoDB). Because both the SQL and the JS decision derive from\n * the *same* expression, the UI matches database enforcement by construction —\n * no drift between two hand-written implementations.\n *\n * The only escape hatch that cannot be evaluated client-side is the\n * {@link RawPolicyExpression} node (`{ kind: \"raw\" }`): it preserves full\n * PostgreSQL power but, being arbitrary SQL, is treated as *unknown* by the\n * JavaScript evaluator (never silently allowed) and reflected exactly in the UI\n * via server-computed capability flags.\n *\n * @group Models\n */\nexport type PolicyExpression =\n    | TruePolicyExpression\n    | FalsePolicyExpression\n    | AndPolicyExpression\n    | OrPolicyExpression\n    | NotPolicyExpression\n    | ComparePolicyExpression\n    | RolesOverlapPolicyExpression\n    | RolesContainPolicyExpression\n    | AuthenticatedPolicyExpression\n    | RegisteredPolicyExpression\n    | ServerContextPolicyExpression\n    | ExistsInPolicyExpression\n    | RawPolicyExpression;\n\n/**\n * The id a request without a logged-in user reports as `rebase.uid()`.\n *\n * A user-context request always sets `app.uid`: blank would read back as\n * `NULL`, and `NULL` is how the trusted server context is recognised, so an\n * anonymous visitor would be promoted to server privileges. The driver\n * therefore substitutes this sentinel at the single chokepoint where the GUC\n * is set.\n *\n * The consequence for policy authors is that **`rebase.uid() IS NOT NULL` is a\n * tautology on the user path** — it is true for anonymous visitors too. Use\n * {@link policy.authenticated} to mean \"signed in\", and\n * {@link policy.serverContext} to mean \"the trusted server context\". Do not\n * hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one\n * literal is not enough.\n *\n * @group Models\n */\nexport const ANONYMOUS_USER_ID = \"anonymous\";\n\n/**\n * Every uid that has ever meant \"nobody is signed in\" — newest first.\n *\n * There are two because there were two. The types, the policy compiler, the\n * JavaScript evaluator and the linter were all built on\n * {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated\n * callers as `'anon'` — so `policy.authenticated()`, which compiled to\n * `rebase.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The\n * sanctioned way to write \"signed in\" granted to everyone, and the linter\n * flagged the spelling that actually worked as a foreign convention.\n *\n * The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here\n * because policies outlive the server that generated them: a database still\n * holding policies from before the fix, or a project whose server has not been\n * upgraded yet, must not become a grant in either direction. Compile against\n * this list, not against a single literal.\n *\n * No real user id is ever one of these, so a match is always \"not signed in\".\n *\n * @group Models\n */\nexport const ANONYMOUS_USER_IDS: readonly string[] = [ANONYMOUS_USER_ID, \"anon\"];\n\n/**\n * Whether a uid stands for \"no one is signed in\", in any spelling rebase has\n * used. `null`/`undefined` is the trusted server context, not an anonymous\n * caller, and is therefore **not** anonymous — see {@link ANONYMOUS_USER_ID}.\n *\n * @group Models\n */\nexport function isAnonymousUid(uid: string | null | undefined): boolean {\n    return typeof uid === \"string\" && ANONYMOUS_USER_IDS.includes(uid);\n}\n\n/** Always allows. Compiles to `true`. @group Models */\nexport interface TruePolicyExpression {\n    kind: \"true\";\n}\n\n/** Always denies. Compiles to `false`. @group Models */\nexport interface FalsePolicyExpression {\n    kind: \"false\";\n}\n\n/** Logical AND — every operand must pass. @group Models */\nexport interface AndPolicyExpression {\n    kind: \"and\";\n    operands: readonly PolicyExpression[];\n}\n\n/** Logical OR — at least one operand must pass. @group Models */\nexport interface OrPolicyExpression {\n    kind: \"or\";\n    operands: readonly PolicyExpression[];\n}\n\n/** Logical negation. @group Models */\nexport interface NotPolicyExpression {\n    kind: \"not\";\n    operand: PolicyExpression;\n}\n\n/** Comparison operators available to {@link ComparePolicyExpression}. @group Models */\nexport type PolicyCompareOperator = \"eq\" | \"neq\" | \"lt\" | \"lte\" | \"gt\" | \"gte\";\n\n/**\n * Compares two operands, e.g. `owner_id = rebase.uid()`.\n * @group Models\n */\nexport interface ComparePolicyExpression {\n    kind: \"compare\";\n    op: PolicyCompareOperator;\n    left: PolicyOperand;\n    right: PolicyOperand;\n}\n\n/**\n * True when the user holds *at least one* of the given application roles.\n * Compiles to `string_to_array(rebase.roles(), ',') && ARRAY[...]`.\n * @group Models\n */\nexport interface RolesOverlapPolicyExpression {\n    kind: \"rolesOverlap\";\n    roles: readonly string[];\n}\n\n/**\n * True when the user holds *all* of the given application roles.\n * Compiles to `string_to_array(rebase.roles(), ',') @> ARRAY[...]`.\n * @group Models\n */\nexport interface RolesContainPolicyExpression {\n    kind: \"rolesContain\";\n    roles: readonly string[];\n}\n\n/**\n * True when a signed-in user is making the request. Compiles to\n * `rebase.uid() IS NOT NULL AND rebase.uid() <> 'anonymous'`.\n *\n * Both halves are load-bearing. `IS NOT NULL` excludes the server context;\n * the {@link ANONYMOUS_USER_ID} comparison excludes anonymous visitors, who\n * *do* carry a non-null `rebase.uid()`. Checking only `IS NOT NULL` grants to\n * everyone — see {@link ANONYMOUS_USER_ID}.\n *\n * `policy.not(policy.authenticated())` therefore means \"anonymous visitor or\n * the server context\". To single out the server context, use\n * {@link ServerContextPolicyExpression}.\n * @group Models\n */\nexport interface AuthenticatedPolicyExpression {\n    kind: \"authenticated\";\n}\n\n/**\n * True for a signed-in caller who has an ACCOUNT — not a guest.\n *\n * The distinction {@link AuthenticatedPolicyExpression} cannot make. Anonymous\n * SIGN-IN (`POST /auth/anonymous`) mints a real user row with a real uid and a\n * real session, so such a caller is \"authenticated\" by every test that looks at\n * `rebase.uid()`: same shape, same default role, indistinguishable inside a\n * policy. On a deployment with anonymous sign-in enabled, every rule meaning\n * \"a signed-in person\" therefore also meant \"anybody at all\", since pressing\n * Continue as guest needs no email, no password and no agreement to anything.\n *\n * Note the two senses of \"anonymous\", which is the reason this was easy to\n * miss. {@link ANONYMOUS_USER_ID} is the sentinel for a request carrying NO\n * session, and `authenticated()` already excludes it. A guest is the other\n * thing: a session with nobody behind it. This node excludes both.\n *\n * Compiles to `authenticated() AND NOT rebase.is_anonymous()`.\n *\n * Use it wherever a rule is about a person who could be held responsible for\n * something — writing a review, joining an organization, spending money. Use\n * `authenticated()` where a guest is genuinely welcome, which is what\n * anonymous sign-in is for: a cart before checkout, a draft before signup.\n * @group Models\n */\nexport interface RegisteredPolicyExpression {\n    kind: \"registered\";\n}\n\n/**\n * True only in the trusted **server context** — the built-in flows that run\n * without a user (signup, migrations, `dataAsAdmin`) set no user GUC, so\n * `rebase.uid()` is `NULL` for them and only for them. Compiles to\n * `rebase.uid() IS NULL`.\n *\n * This is what lets the owner connection satisfy a policy even under FORCE RLS.\n * It is deliberately a primitive rather than `not(authenticated())`: the two\n * meant the same thing while `authenticated` ignored {@link ANONYMOUS_USER_ID},\n * and conflating them is what turns a server-only grant into an anonymous one.\n *\n * The JavaScript evaluator always returns `false` for this node — a client is\n * never the server context.\n * @group Models\n */\nexport interface ServerContextPolicyExpression {\n    kind: \"serverContext\";\n}\n\n/**\n * Membership / relational access: true when at least one row exists in another\n * collection (a join/membership table) matching `where`. This is what lets you\n * scope reads to \"rows whose team the caller belongs to\" without an N+1\n * per-row lookup — it compiles to a single correlated `EXISTS` subquery.\n *\n * Inside `where`, {@link FieldPolicyOperand} (`policy.field`) references a column\n * of the joined collection, while {@link OuterFieldPolicyOperand}\n * (`policy.outerField`) references a column of the row being checked (the outer\n * table under RLS). Combine with {@link AuthUidPolicyOperand} to correlate to\n * the caller.\n *\n * @example\n * ```ts\n * // documents visible only to members of the document's team:\n * policy.existsIn({\n *   collection: \"team_members\",\n *   where: policy.and(\n *     policy.compare(policy.field(\"team_id\"), \"eq\", policy.outerField(\"team_id\")),\n *     policy.compare(policy.field(\"user_id\"), \"eq\", policy.authUid()),\n *   ),\n * })\n * // → EXISTS (SELECT 1 FROM team_members _ex0\n * //           WHERE _ex0.team_id = documents.team_id AND _ex0.user_id = rebase.uid())\n * ```\n *\n * Postgres-authoritative: like {@link RawPolicyExpression}, the JavaScript\n * evaluator treats it as *unknown* (it cannot run a subquery client-side), so\n * enforcement is always the database's.\n * @group Models\n */\nexport interface ExistsInPolicyExpression {\n    kind: \"existsIn\";\n    /** Slug of the collection to search (the join / membership table). */\n    collection: string;\n    /** Condition evaluated against the joined collection's rows. */\n    where: PolicyExpression;\n}\n\n/**\n * A raw PostgreSQL boolean expression — the full-power escape hatch.\n *\n * Columns can be referenced as `{column_name}`. This is Postgres-only and\n * **server-authoritative**: the JavaScript evaluator cannot evaluate arbitrary\n * SQL, so it treats this node as *unknown* rather than guessing.\n * @group Models\n */\nexport interface RawPolicyExpression {\n    kind: \"raw\";\n    sql: string;\n}\n\n/**\n * An operand referenced by a {@link ComparePolicyExpression}.\n * @group Models\n */\nexport type PolicyOperand =\n    | FieldPolicyOperand\n    | OuterFieldPolicyOperand\n    | LiteralPolicyOperand\n    | AuthUidPolicyOperand\n    | AuthRolesPolicyOperand\n    | AuthClaimPolicyOperand;\n\n/** A column value on the row being evaluated. @group Models */\nexport interface FieldPolicyOperand {\n    kind: \"field\";\n    /** The property/column name (resolved to its DB column when compiled). */\n    name: string;\n}\n\n/**\n * A column value on the *outer* row when used inside {@link ExistsInPolicyExpression}\n * — i.e. the row the RLS policy is being evaluated for, referenced from within the\n * subquery. Outside an `existsIn` it is equivalent to {@link FieldPolicyOperand}.\n * @group Models\n */\nexport interface OuterFieldPolicyOperand {\n    kind: \"outerField\";\n    /** The property/column name on the outer collection. */\n    name: string;\n}\n\n/** A constant value. @group Models */\nexport interface LiteralPolicyOperand {\n    kind: \"literal\";\n    value: string | number | boolean | null;\n}\n\n/** The current user's id — compiles to `rebase.uid()`. @group Models */\nexport interface AuthUidPolicyOperand {\n    kind: \"authUid\";\n}\n\n/**\n * The current user's roles as an array — compiles to\n * `string_to_array(rebase.roles(), ',')`.\n * @group Models\n */\nexport interface AuthRolesPolicyOperand {\n    kind: \"authRoles\";\n}\n\n/**\n * A named claim on the caller's session token — compiles to\n * `NULLIF(rebase.jwt() ->> '<name>', '')`.\n *\n * The operand multi-tenancy is built on, and the reason it is an operand rather\n * than a {@link RawPolicyExpression}: a claim arrives as **text**, and the\n * column it is compared against usually is not. `org_id = rebase.jwt() ->>\n * 'org_id'` on a `uuid` column is not a policy that denies — it is\n * `CREATE POLICY` failing with \"operator does not exist: uuid = text\", and a\n * table left with RLS enabled and no policy denies every row. Casting the\n * *column* to text instead compiles, but takes the index off the one predicate\n * that is ANDed into every read of the table.\n *\n * As an operand the compiler can see both sides: it casts the claim to the\n * column's type, guarded so a malformed claim denies rather than raising\n * `invalid input syntax` on every query, and the column keeps its index.\n *\n * An absent claim, and a claim set to the empty string, are both NULL — and a\n * comparison against NULL is never true, so a caller carrying no claim sees no\n * rows rather than all of them.\n *\n * Only *custom* claims are reachable. `uid`, `roles`, `aal` and `isAnonymous`\n * are identity claims written after the custom ones when a token is minted,\n * precisely so a claims hook cannot assert them; they have their own operands\n * ({@link AuthUidPolicyOperand}, {@link AuthRolesPolicyOperand}) and naming one\n * here is refused.\n *\n * Postgres-authoritative: the JavaScript evaluator reports *unknown* rather\n * than reproducing Postgres's cast semantics (uuid case folding, numeric\n * widening) a second time and getting them subtly wrong.\n * @group Models\n */\nexport interface AuthClaimPolicyOperand {\n    kind: \"authClaim\";\n    /** The claim's name on the token, e.g. `\"org_id\"`. */\n    name: string;\n}\n\n// ── Constructor helpers ──────────────────────────────────────────────\n// Small, dependency-free builders so callers (and the desugaring in\n// `@rebasepro/common`) can assemble expressions without object-literal noise.\n\n/** @group Models */\nexport const policy = {\n    true: (): TruePolicyExpression => ({ kind: \"true\" }),\n    false: (): FalsePolicyExpression => ({ kind: \"false\" }),\n    and: (...operands: readonly PolicyExpression[]): AndPolicyExpression => ({ kind: \"and\",\noperands: operands as PolicyExpression[] }),\n    or: (...operands: readonly PolicyExpression[]): OrPolicyExpression => ({ kind: \"or\",\noperands: operands as PolicyExpression[] }),\n    not: (operand: PolicyExpression): NotPolicyExpression => ({ kind: \"not\",\noperand }),\n    compare: (left: PolicyOperand, op: PolicyCompareOperator, right: PolicyOperand): ComparePolicyExpression =>\n        ({ kind: \"compare\",\nop,\nleft,\nright }),\n    rolesOverlap: (roles: readonly string[]): RolesOverlapPolicyExpression => ({ kind: \"rolesOverlap\",\nroles: roles as string[] }),\n    rolesContain: (roles: readonly string[]): RolesContainPolicyExpression => ({ kind: \"rolesContain\",\nroles: roles as string[] }),\n    authenticated: (): AuthenticatedPolicyExpression => ({ kind: \"authenticated\" }),\n    registered: (): RegisteredPolicyExpression => ({ kind: \"registered\" }),\n    serverContext: (): ServerContextPolicyExpression => ({ kind: \"serverContext\" }),\n    existsIn: (args: { collection: string; where: PolicyExpression }): ExistsInPolicyExpression =>\n        ({ kind: \"existsIn\",\ncollection: args.collection,\nwhere: args.where }),\n    raw: (sql: string): RawPolicyExpression => ({ kind: \"raw\",\nsql }),\n    field: (name: string): FieldPolicyOperand => ({ kind: \"field\",\nname }),\n    outerField: (name: string): OuterFieldPolicyOperand => ({ kind: \"outerField\",\nname }),\n    literal: (value: string | number | boolean | null): LiteralPolicyOperand => ({ kind: \"literal\",\nvalue }),\n    authUid: (): AuthUidPolicyOperand => ({ kind: \"authUid\" }),\n    authRoles: (): AuthRolesPolicyOperand => ({ kind: \"authRoles\" }),\n    authClaim: (name: string): AuthClaimPolicyOperand => ({ kind: \"authClaim\",\nname })\n};\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAoDA,IAAa,oBAAoB;;;;;;;;;;;;;;;;;;;;;;AAuBjC,IAAa,qBAAwC,CAAC,mBAAmB,MAAM;;;;;;;;AAS/E,SAAgB,eAAe,KAAyC;CACpE,OAAO,OAAO,QAAQ,YAAY,mBAAmB,SAAS,GAAG;AACrE;;AAmRA,IAAa,SAAS;CAClB,aAAmC,EAAE,MAAM,OAAO;CAClD,cAAqC,EAAE,MAAM,QAAQ;CACrD,MAAM,GAAG,cAAgE;EAAE,MAAM;EAC3E;CAA+B;CACrC,KAAK,GAAG,cAA+D;EAAE,MAAM;EACzE;CAA+B;CACrC,MAAM,aAAoD;EAAE,MAAM;EACtE;CAAQ;CACJ,UAAU,MAAqB,IAA2B,WACrD;EAAE,MAAM;EACjB;EACA;EACA;CAAM;CACF,eAAe,WAA4D;EAAE,MAAM;EAChF;CAAkB;CACrB,eAAe,WAA4D;EAAE,MAAM;EAChF;CAAkB;CACrB,sBAAqD,EAAE,MAAM,gBAAgB;CAC7E,mBAA+C,EAAE,MAAM,aAAa;CACpE,sBAAqD,EAAE,MAAM,gBAAgB;CAC7E,WAAW,UACN;EAAE,MAAM;EACjB,YAAY,KAAK;EACjB,OAAO,KAAK;CAAM;CACd,MAAM,SAAsC;EAAE,MAAM;EACxD;CAAI;CACA,QAAQ,UAAsC;EAAE,MAAM;EAC1D;CAAK;CACD,aAAa,UAA2C;EAAE,MAAM;EACpE;CAAK;CACD,UAAU,WAAmE;EAAE,MAAM;EACzF;CAAM;CACF,gBAAsC,EAAE,MAAM,UAAU;CACxD,kBAA0C,EAAE,MAAM,YAAY;CAC9D,YAAY,UAA0C;EAAE,MAAM;EAClE;CAAK;AACL"}

package/dist/project_manifest-R6y_KHms.js

@@ -0,0 +1,59 @@
+import { createRequire as __rebaseCreateRequire } from "module";
+import __rebaseProcess from "process";
+globalThis.process ??= __rebaseProcess;
+__rebaseCreateRequire(import.meta.url);
+//#region ../types/src/types/project_manifest.ts
+/**
+* Path prefixes the backend owns, which no static app may claim.
+*
+* One process — and, on the platform, one hostname — serves both the API and
+* however many static apps a project has. Mounting is longest-path-first, so an
+* app declaring `/api` would win against the API itself and every request to it
+* would be answered with that app's `index.html`: a 200 carrying HTML where the
+* caller expected JSON, from a project that looks deployed and healthy.
+*
+* Declared here rather than in either enforcer because both must agree. The CLI
+* checks it so a developer finds out while editing `rebase.json`; the control
+* plane checks it again at deploy intake, because the front door's correctness
+* cannot rest on a check that ran in somebody else's CLI — and a repository can
+* be deployed by a CLI older than this rule.
+*/
+var RESERVED_BACKEND_PREFIXES = [
+	"/api",
+	"/health",
+	"/healthz",
+	"/livez",
+	"/readyz",
+	"/metrics"
+];
+/**
+* Whether `path` collides with a prefix the backend owns.
+*
+* Compares at segment boundaries, so `/api` and `/api/v2` collide while
+* `/apidocs` does not — the same rule the router matches with, because a check
+* that is stricter than the router rejects paths that would have worked, and one
+* that is looser admits paths that will not.
+*/
+function reservedPrefixFor(path) {
+	const normalized = path.endsWith("/") && path !== "/" ? path.slice(0, -1) : path;
+	return RESERVED_BACKEND_PREFIXES.find((reserved) => normalized === reserved || normalized.startsWith(`${reserved}/`));
+}
+/**
+* Whether `host` is a public DNS name an app can be given: lowercase labels of
+* letters, digits and hyphens, at least two of them, not an IP address and not
+* `localhost`. Internationalised names arrive here already in punycode.
+*/
+function isValidAppHost(host) {
+	if (host.length === 0 || host.length > 253 || host !== host.toLowerCase()) return false;
+	const labels = host.split(".");
+	if (labels.length < 2) return false;
+	const label = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+	if (!labels.every((part) => label.test(part))) return false;
+	return !/^[0-9]+$/.test(labels[labels.length - 1]);
+}
+/** Header carrying the schema version an SDK was generated from. */
+var SCHEMA_VERSION_HEADER = "x-rebase-schema";
+//#endregion
+export { isValidAppHost as n, reservedPrefixFor as r, SCHEMA_VERSION_HEADER as t };
+
+//# sourceMappingURL=project_manifest-R6y_KHms.js.map

package/dist/project_manifest-R6y_KHms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project_manifest-R6y_KHms.js","names":[],"sources":["../../types/src/types/project_manifest.ts"],"sourcesContent":["/**\n * The project manifest (`rebase.json`) and the build artifacts derived from it.\n *\n * Three separate documents live in this file, and keeping them distinct matters:\n *\n * 1. {@link RebaseProjectManifest} — `rebase.json`. **Authored** by the developer,\n *    committed to the repository. Declares topology only: which runtime major the\n *    project targets, and which apps *this repository* contributes to the project.\n *    Schema, security rules, hooks and functions stay in TypeScript under the\n *    config package — nothing that needs a type system belongs here.\n *\n * 2. {@link RebaseProjectLink} — the per-checkout link (`.rebase/cloud.json`).\n *    **Not committed**, because it is per-developer like a git remote. Says which\n *    deployed project this working copy points at, whether that is a Rebase Cloud\n *    project or the base URL of a self-hosted backend.\n *\n * 3. {@link RebaseBundleManifest} — `manifest.json` inside a built bundle.\n *    **Generated**, never hand-edited. It is the lockfile analogue: the exact\n *    contract a built artifact claims to satisfy, which the runtime validates\n *    before it boots and a control plane validates before it deploys.\n *\n * A repository declares only the apps it contains. The set of apps belonging to a\n * project is held by the project itself, which is what makes multi-repo projects\n * work: two repositories never need to know about each other, only about the\n * project.\n */\n\nimport type { StorageSourceDefinition } from \"./storage_source\";\nimport type { ResourceGraph } from \"./resources\";\n\n/**\n * Which kind of thing an app is.\n *\n * - `backend` — the collections/hooks/functions that define the project's API.\n *   Exactly one per *project* (not per repository); the registry enforces it.\n * - `static`  — a pre-built client bundle (SPA, static site), served from the\n *   backend process at its declared `path` or from a CDN. The admin panel is\n *   one of these: it is an app in the user's repository like any other.\n *\n * That is the whole list. Ownership of the server process is a property of the\n * backend app ({@link RebaseBackendAppConfig.runtime}), not an app type.\n */\nexport type RebaseAppType = \"backend\" | \"static\";\n\n/**\n * The backend app: the project's API surface.\n *\n * Paths are relative to the directory holding `rebase.json`. The defaults match\n * the layout `rebase init` scaffolds, so a stock project may declare simply\n * `{ \"type\": \"backend\", \"runtime\": \"managed\" }`.\n */\nexport interface RebaseBackendAppConfig {\n    type: \"backend\";\n    /**\n     * Who owns the process this backend runs in.\n     *\n     * - `managed` — the platform's runtime image boots this project's bundle.\n     *   You supply collections, functions, crons and schema; Rebase supplies the\n     *   server.\n     * - `custom` — this repository builds its own image and entrypoint. The\n     *   escape hatch: full control, no managed-runtime guarantees.\n     *\n     * Independent of *where* it runs. Both run on Rebase Cloud and both\n     * self-host — the destination lives in `.rebase/cloud.json`, not here. See\n     * `infra/docker/docker-compose.selfhost.yml`, which boots a managed bundle on a\n     * developer's own Docker host.\n     *\n     * This is authored rather than inferred on purpose. It is the single most\n     * consequential fact about a deployment, and inferring it is what used to\n     * land projects on the custom runtime without anyone choosing it.\n     */\n    runtime: \"managed\" | \"custom\";\n    /** Directory of the config package (collections + index). Default `config`. */\n    config?: string;\n    /** Directory of server functions. Default `backend/functions`. */\n    functions?: string;\n    /** Directory of cron job definitions. Default `backend/crons` when present. */\n    crons?: string;\n    /**\n     * Path to the generated Drizzle schema module (tables/enums/relations).\n     * Default `backend/src/schema.generated.ts`.\n     */\n    schema?: string;\n    /**\n     * Module path (relative to `config`) exporting the auth users collection as\n     * its default export. Default `collections/users`.\n     */\n    usersCollection?: string;\n    /**\n     * Type server-side data from the generated `Database`. When `true`, every\n     * `rebase generate-sdk` — `rebase dev`'s included, and the first one on a\n     * fresh clone — writes the types and the `Register` declaration to\n     * `<config>/generated/`. `rebase generate-sdk --register` sets it.\n     * Default `false`.\n     */\n    registerDatabase?: boolean;\n\n    /**\n     * `runtime: \"custom\"` only. Dockerfile path relative to the repository root.\n     * Default `Dockerfile`.\n     */\n    dockerfile?: string;\n    /**\n     * `runtime: \"custom\"` only. Directory handed to `docker build` as the build\n     * context, relative to the directory holding `rebase.json`. Default `.`.\n     *\n     * The one path in this file allowed to point **above** the project. Every\n     * other one names something Rebase reads, and those must be inside the\n     * project or a bundle cannot carry them; this names something Rebase never\n     * opens. In a workspace repository it normally has to be the workspace root\n     * (`\"..\"`), because the lockfile and sibling packages a Dockerfile copies do\n     * not live beside `rebase.json`.\n     *\n     * {@link RebaseBackendAppConfig.dockerfile} stays relative to `rebase.json`\n     * whatever this is — it names a file in this repository, and moving the\n     * context should not rewrite it. `rebase build` re-expresses it against the\n     * context when it prints the command, because `docker build -f` resolves\n     * against the working directory rather than the context.\n     */\n    context?: string;\n    /** `runtime: \"custom\"` only. Port the container listens on. Default 8080. */\n    port?: number;\n}\n\n/**\n * A static client bundle — SPA or static site — built here and served at `path`.\n */\nexport interface RebaseStaticAppConfig {\n    type: \"static\";\n    /** Package directory containing the client sources. */\n    root: string;\n    /** Command that produces `output`. Run from the repository root. */\n    build?: string;\n    /** Directory of built assets, relative to the repository root. */\n    output: string;\n    /**\n     * Public base path this app is served under. Default `/`.\n     *\n     * Several static apps run in one process, each at its own path — the API at\n     * `/api`, a site at `/`, the admin at `/admin` — which is what keeps a\n     * self-hosted deployment a single container.\n     *\n     * **This is a build-time input, not only a serving concern.** An app mounted\n     * at `/admin` must be *built* for `/admin` (Vite's `base`), or `index.html`\n     * loads and every asset 404s: a blank page with no server error. `rebase\n     * build` passes it as `REBASE_APP_BASE` and asserts the emitted HTML honours\n     * it. Changing this value requires rebuilding the app.\n     *\n     * **Or a full URL, to give the app a hostname of its own:**\n     * `\"https://admin.example.com\"`, or `\"https://admin.example.com/cms\"` for a\n     * path under it. The app then answers only on that hostname, and every app\n     * without one keeps answering on all the others. The URL form is split by\n     * {@link parseAppAddress}: the hostname travels as the bundle's\n     * {@link RebaseBundleStatic.host}, and the path part is what the rules above\n     * (and `REBASE_APP_BASE`) apply to. HTTPS only, with no port, query or\n     * fragment — a hostname is served over TLS by the platform, not chosen per\n     * request.\n     *\n     * On Rebase Cloud the deploy registers the hostname on the project. It is\n     * live once its DNS records verify, which the deploy prints when they don't\n     * yet.\n     */\n    path?: string;\n    /**\n     * Serve `index.html` for unmatched paths under `path` (client-side routing).\n     * Default `true` — the overwhelmingly common case for a client app, and a\n     * static *site* generator emits real files for its routes anyway.\n     */\n    spa?: boolean;\n    /**\n     * Where this app mounts the Rebase CMS, as a URL path — the address you\n     * would type to reach it, not a path relative to `path`.\n     *\n     * The CMS is an ordinary React component in the developer's own app\n     * (`<RebaseCMS basePath=\"/admin\">`), so its address is a *client-side\n     * route*: nothing on the server, in the bundle, or in the control plane can\n     * observe it. A project whose CMS sits at `/admin` inside a frontend that\n     * also serves a product at `/` is indistinguishable, from the outside, from\n     * one that has no CMS at all — which is exactly how a Rebase Cloud project\n     * came to have no discoverable admin URL anywhere in its console.\n     *\n     * Declaring it is the only way that fact travels. It is carried into the\n     * bundle manifest, recorded on the project's app row at deploy, and is what\n     * lets the console (and `rebase apps list`) offer a link straight to it.\n     *\n     * Must be `path` itself or something beneath it, since the app serving that\n     * URL is the one that has to answer for it. Absent means this app does not\n     * mount the CMS — the common case for a marketing site or a product app.\n     *\n     * @example \"/\" — the whole app is the CMS, as `rebase init` scaffolds it\n     * @example \"/admin\" — the CMS is one route of a larger app\n     */\n    cms?: string;\n}\n\nexport type RebaseAppConfig = RebaseBackendAppConfig | RebaseStaticAppConfig;\n\n/**\n * Path prefixes the backend owns, which no static app may claim.\n *\n * One process — and, on the platform, one hostname — serves both the API and\n * however many static apps a project has. Mounting is longest-path-first, so an\n * app declaring `/api` would win against the API itself and every request to it\n * would be answered with that app's `index.html`: a 200 carrying HTML where the\n * caller expected JSON, from a project that looks deployed and healthy.\n *\n * Declared here rather than in either enforcer because both must agree. The CLI\n * checks it so a developer finds out while editing `rebase.json`; the control\n * plane checks it again at deploy intake, because the front door's correctness\n * cannot rest on a check that ran in somebody else's CLI — and a repository can\n * be deployed by a CLI older than this rule.\n */\nexport const RESERVED_BACKEND_PREFIXES = [\"/api\", \"/health\", \"/healthz\", \"/livez\", \"/readyz\", \"/metrics\"] as const;\n\n/**\n * Whether `path` collides with a prefix the backend owns.\n *\n * Compares at segment boundaries, so `/api` and `/api/v2` collide while\n * `/apidocs` does not — the same rule the router matches with, because a check\n * that is stricter than the router rejects paths that would have worked, and one\n * that is looser admits paths that will not.\n */\nexport function reservedPrefixFor(path: string): string | undefined {\n    const normalized = path.endsWith(\"/\") && path !== \"/\" ? path.slice(0, -1) : path;\n    return RESERVED_BACKEND_PREFIXES.find(\n        reserved => normalized === reserved || normalized.startsWith(`${reserved}/`)\n    );\n}\n\n/**\n * Where a static app answers: on one hostname or all of them, at a path.\n *\n * `host` absent is every hostname the project is served on.\n */\nexport interface AppAddress {\n    host?: string;\n    path: string;\n}\n\nexport type AppAddressResult =\n    | { ok: true; address: AppAddress }\n    | { ok: false; reason: string };\n\n/**\n * Split a static app's declared `path` into the hostname it claims and the path\n * under it.\n *\n * `\"/admin\"` is `{ path: \"/admin\" }`, returned as written: the path rules\n * (leading slash, no `..`, reserved prefixes) belong to the caller, which\n * applies them to the path part of either form. `\"https://admin.example.com/cms\"`\n * is `{ host: \"admin.example.com\", path: \"/cms\" }`.\n *\n * Shared because three parties must read the same value the same way: the CLI\n * while `rebase.json` is edited, the control plane at deploy intake (a bundle can\n * come from any CLI, or none), and the runtime choosing which app answers.\n */\nexport function parseAppAddress(value: string): AppAddressResult {\n    if (!/^[a-z][a-z0-9+.-]*:\\/\\//i.test(value)) {\n        // A bare hostname is the likeliest mistake, and \"must start with /\" would\n        // not say what was meant.\n        if (!value.startsWith(\"/\") && isValidAppHost(value.toLowerCase().replace(/\\/.*$/, \"\"))) {\n            return { ok: false, reason: `looks like a hostname — write it as a URL: \"https://${value}\"` };\n        }\n        return { ok: true, address: { path: value } };\n    }\n\n    // `new URL` forgives what a manifest should not: it strips tabs and newlines,\n    // reads \"\\\" as \"/\", and drops a default \":443\". Each would make the address\n    // mean something other than what was written, so these are judged on the\n    // text, before the parser can tidy them away.\n    // eslint-disable-next-line no-control-regex\n    if (/[\\s\\\\\\u0000-\\u001f\\u007f]/.test(value)) {\n        return { ok: false, reason: \"must not contain spaces, control characters or backslashes\" };\n    }\n    const authority = value.slice(value.indexOf(\"//\") + 2).split(/[/?#]/)[0];\n    if (/:[^@]*$/.test(authority) && !authority.startsWith(\"[\")) {\n        return { ok: false, reason: \"must not name a port — a hostname is served on 443\" };\n    }\n\n    let url: URL;\n    try {\n        url = new URL(value);\n    } catch {\n        return { ok: false, reason: \"is not a valid URL\" };\n    }\n    if (url.protocol !== \"https:\") {\n        return { ok: false, reason: `must use https — the platform serves every hostname over TLS: \"https://${url.host}${url.pathname === \"/\" ? \"\" : url.pathname}\"` };\n    }\n    if (url.username || url.password) return { ok: false, reason: \"must not contain credentials\" };\n    if (url.port) return { ok: false, reason: \"must not name a port — a hostname is served on 443\" };\n    // `new URL` drops an empty \"?\" or \"#\", so test the text as well.\n    if (url.search || url.hash || /[?#]/.test(value)) {\n        return { ok: false, reason: \"must not have a query or fragment\" };\n    }\n    if (!isValidAppHost(url.hostname)) {\n        return { ok: false, reason: `names \"${url.hostname}\", which is not a public hostname` };\n    }\n    // The rules a path is held to are the caller's, so hand back what was\n    // written after the host, not what `URL` normalised it to — a `..` resolved\n    // away here would slip past the check that exists to refuse it.\n    const authorityAndPath = value.slice(value.indexOf(\"//\") + 2);\n    const slash = authorityAndPath.indexOf(\"/\");\n    return { ok: true, address: { host: url.hostname, path: slash === -1 ? \"/\" : authorityAndPath.slice(slash) } };\n}\n\n/**\n * Whether `host` is a public DNS name an app can be given: lowercase labels of\n * letters, digits and hyphens, at least two of them, not an IP address and not\n * `localhost`. Internationalised names arrive here already in punycode.\n */\nexport function isValidAppHost(host: string): boolean {\n    if (host.length === 0 || host.length > 253 || host !== host.toLowerCase()) return false;\n    const labels = host.split(\".\");\n    if (labels.length < 2) return false;\n    const label = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;\n    if (!labels.every(part => label.test(part))) return false;\n    // An all-numeric last label is an IPv4 address, never a TLD.\n    return !/^[0-9]+$/.test(labels[labels.length - 1]);\n}\n\n/**\n * One declared storage source, as authored in `rebase.json`.\n *\n * The key comes from the enclosing record, so this is\n * {@link StorageSourceDefinition} minus its `key` — the same document the\n * runtime registry and the frontend router consume, expressed the way a JSON\n * object naturally expresses \"a set of named things\".\n */\nexport interface RebaseStorageSourceConfig {\n    /** Engine backing this source: `local`, `s3`, `gcs`, or a custom id. */\n    engine: string;\n    /**\n     * How the frontend reaches it. Default `server` (proxied through\n     * `/api/storage`). `direct` means a provider SDK talks to the bucket and the\n     * backend is not in the upload path.\n     */\n    transport?: \"server\" | \"direct\";\n    /** Human-readable label for the console and the admin UI. */\n    label?: string;\n}\n\n/**\n * `rebase.json` — the authored project manifest.\n */\nexport interface RebaseProjectManifest {\n    /** JSON Schema URL, for editor completion. Ignored by the tooling. */\n    $schema?: string;\n    /**\n     * The runtime contract **major** this project targets, as a semver range\n     * (e.g. `^1`, `~1.4`, or an exact `1.4.2` to pin).\n     *\n     * The platform upgrades patches and minors underneath a project without\n     * asking; it never crosses a major. See {@link RUNTIME_CONTRACT_VERSION}.\n     *\n     * Named `rebase` rather than `runtime` so that `runtime` means exactly one\n     * thing — {@link RebaseBackendAppConfig.runtime}, who owns the process. It\n     * reads like `engines` in a `package.json`, which is what it is.\n     */\n    rebase: string;\n    /**\n     * Apps this repository contributes, keyed by app name. The key is the app's\n     * identity within the project: it is what `rebase deploy <app>` names, what\n     * client credentials are issued against, and what a second repository must\n     * not collide with.\n     */\n    apps: Record<string, RebaseAppConfig>;\n    /**\n     * Buckets are NOT declared here any more.\n     *\n     * They were, and the runtime merged this block with the declarations in\n     * config code — a bucket named in both had one engine kept and the other\n     * silently discarded. Two homes for one concept, with a merge to decide\n     * between them, is the shape this whole model replaced.\n     *\n     * `bucket(\"media\", { engine: \"s3\" })` in the project's config declares one\n     * now, and `rebase resources --write` generates `rebase.resources.json`,\n     * which is what a host reads before a build. A `storage` block left in this\n     * file is refused by the validator, by name, with the replacement in the\n     * message — not ignored, because a key that still parses and does nothing\n     * is the failure this removed.\n     */\n    /**\n     * Repository-wide opt-out from anonymous CLI usage sharing.\n     *\n     * **Only `false` does anything.** It suppresses sharing for everyone who\n     * clones this repository, overriding each developer's own answer — an\n     * organisation setting policy for work done on its behalf, the same shape\n     * as a committed `.npmrc`.\n     *\n     * `true` is deliberately ignored, and the CLI says so rather than obeying\n     * quietly. This file is committed, so a `true` here would be one developer\n     * answering a privacy question for every colleague who later clones the\n     * repo — consent by proxy, which is the exact thing opt-in exists to\n     * prevent. Individuals answer at `rebase init`, or with `rebase telemetry enable` / `disable`.\n     */\n    telemetry?: boolean;\n}\n\n/**\n * The per-checkout project link.\n *\n * Deliberately separate from `rebase.json`: the manifest is committed and shared,\n * while the link is per-developer. Keeping them in one file would mean either\n * committing someone's project id or gitignoring the topology.\n */\nexport interface RebaseProjectLink {\n    /**\n     * A Rebase Cloud project id, or the base URL of any running Rebase backend\n     * (`https://api.example.com`). Both are first-class: every command that\n     * accepts a project reference accepts either, so a self-hosted project has\n     * the same tooling as a cloud one.\n     */\n    project: string;\n    /** Organization slug. Cloud projects only. */\n    org?: string;\n    /** Explicit API base URL, when it differs from the project's default. */\n    apiUrl?: string;\n}\n\n/**\n * Whether a project can run on the managed runtime, and if not, precisely why.\n *\n * The reasons are returned rather than summarised so tooling can print something\n * a developer can act on. \"Not eligible\" is never a dead end — it selects the\n * custom-runtime path, which still deploys.\n */\nexport interface ManagedCompatibility {\n    eligible: boolean;\n    reasons: string[];\n}\n\n// ─────────────────────────────────────────────────────────────────────────────\n// Bundle\n// ─────────────────────────────────────────────────────────────────────────────\n\n/**\n * Version of the bundle *format* itself.\n *\n * Bumped only when the on-disk layout changes in a way an older runtime could\n * not read. A runtime accepts any bundle whose `bundleFormat` is less than or\n * equal to its own — old bundles keep booting on new runtimes, which is the\n * whole point of separating the artifact from the engine.\n *\n * - **1** — `mode: \"cms\" | \"baas\" | \"static\"`, `entry.static` a single directory\n *   string, `entry.admin` for a bundled admin panel.\n * - **2** — `kind: \"backend\" | \"static\"`, `entry.static` a list of\n *   {@link RebaseBundleStatic}, `entry.admin` removed. A format-1 runtime reading\n *   one of these would find no `mode` and an array where it expects a string, so\n *   the bump is what turns that into a refusal to boot instead of a bundle that\n *   starts and serves nothing.\n */\nexport const BUNDLE_FORMAT_VERSION = 2;\n\n/**\n * The runtime contract major.\n *\n * Distinct from the `@rebasepro/server` package version: the package may release\n * any number of minors and patches while this stays put. It changes only when\n * the bundle/runtime contract breaks compatibility, and a project's\n * `manifest.runtime` range is matched against *this*.\n *\n * ## v2 — resources are declared, not configured\n *\n * `RebaseBackendConfig.dataSources` and `.storageSources` are gone. A project\n * declares its databases and buckets with `database()` / `bucket()` in its\n * config, and the runtime reads those declarations.\n *\n * This had to be a major, and the reason is the managed tier: it moves projects\n * onto new images WITHOUT rebuilding them. A bundle built against v1 exports\n * those keys, and a v2 runtime refuses them at boot — so without this bump, one\n * image rollout would crash-loop every tenant that had ever declared a second\n * database or bucket, in a wave, with the cause in a container log nobody is\n * watching.\n *\n * With the bump, a v1 bundle on a v2 runtime is refused by\n * `assertBundleCompatibility` with the remedy in the message, and the platform\n * keeps it on a v1 image until it is rebuilt. That is the whole purpose of this\n * number.\n *\n * **Release order matters and is not optional.** The control plane is the side\n * that rejects, so it ships FIRST: raise `SUPPORTED_RUNTIME_CONTRACT` in the\n * saas repo (it rejects only `contract >` its own, so it then accepts both),\n * deploy that, and only then release a runtime implementing v2. Shipping the\n * runtime first turns every deploy into a rejected intake blaming the tenant's\n * bundle.\n */\nexport const RUNTIME_CONTRACT_VERSION = 1;\n\n/** Where the runtime finds each part of the bundle. Paths are bundle-relative. */\nexport interface RebaseBundleEntrypoints {\n    /** Compiled config package directory (collections live under it). */\n    config?: string;\n    /** Compiled collections directory, when it differs from `<config>/collections`. */\n    collections?: string;\n    /** Compiled functions directory. */\n    functions?: string;\n    /** Compiled crons directory. */\n    crons?: string;\n    /** Compiled Drizzle schema module. */\n    schema?: string;\n    /** Module exporting the auth users collection (default export). */\n    usersCollection?: string;\n    /**\n     * Built static apps to serve from this process, in declaration order.\n     *\n     * A list rather than a single directory because one process serves several\n     * apps at different paths — a site at `/` and the admin at `/admin`. The\n     * runtime mounts them longest-path-first so the `/`-rooted app's catch-all\n     * does not claim its siblings' URLs.\n     */\n    static?: RebaseBundleStatic[];\n}\n\n/** One built static app inside a bundle. */\nexport interface RebaseBundleStatic {\n    /** Public base path, e.g. `/` or `/admin`. Always a path, never a URL. */\n    path: string;\n    /**\n     * The one hostname this app answers on, lowercase, e.g. `admin.example.com`.\n     *\n     * Absent means every hostname the project is served on, which is what every\n     * app was before this field existed. Present, the app answers only for\n     * requests whose `Host` is exactly this — the path part of its address is\n     * still `path`. At an equal `path`, an app naming the request's hostname\n     * wins over one that does not.\n     *\n     * A runtime that predates this field ignores it and would mount two apps at\n     * the same `path`, so a bundle carrying it must only ever reach a runtime\n     * that reads it. The control plane enforces that at intake.\n     */\n    host?: string;\n    /** Bundle-relative directory holding the built assets. */\n    dir: string;\n    /** Serve `index.html` for unmatched paths under `path`. */\n    spa: boolean;\n    /**\n     * The app's name in `rebase.json`.\n     *\n     * `dir` is `static/<name>` and has been since folding was written, so this\n     * is recoverable by string surgery — which is precisely why it is stated\n     * instead. A control plane reconciling app rows against this list has to\n     * match them by name, and a consumer that has to re-derive an identifier\n     * from a path is one refactor away from matching nothing and registering a\n     * duplicate app on every deploy.\n     *\n     * Optional because bundles built before this field exists do not carry it;\n     * a reader that needs a name falls back to the last segment of `dir`.\n     */\n    name?: string;\n    /**\n     * Where this app mounts the Rebase CMS, as a URL path.\n     *\n     * Copied from the app's declaration — see {@link RebaseStaticAppConfig.cms}\n     * for why a client-side route has to be declared to be knowable at all.\n     */\n    cms?: string;\n}\n\n/**\n * A native module found in the dependency closure.\n *\n * Recorded rather than merely counted so a rejection can name the offending\n * package instead of saying \"something here is native\".\n */\nexport interface NativeDependency {\n    name: string;\n    /** Why it was flagged — a `.node` binary, a gyp build, or an install script. */\n    reason: string;\n}\n\n/**\n * `manifest.json` — generated, and the document the runtime and control plane\n * both validate against.\n */\n/**\n * One custom function, as recorded in a built bundle.\n *\n * @see RebaseBundleManifest.functions\n */\nexport interface RebaseBundleFunction {\n    /**\n     * The filename without its extension — which is also the URL segment it\n     * mounts at (`/api/functions/<name>`), the API-key permission that grants\n     * it, and the name `REBASE_FUNCTIONS_ONLY` selects by. One identity, used\n     * everywhere.\n     */\n    name: string;\n    /** Path inside the bundle, so a host can point at the file. */\n    file: string;\n    /**\n     * `false` when the function's own source imports a Node built-in or a\n     * package that needs one.\n     *\n     * Descriptive, never a gate: nothing refuses to build or deploy on this. It\n     * says where this function *could* run, not where it should.\n     */\n    portable: boolean;\n    /**\n     * Why it is not portable — one short phrase per reason, deduplicated.\n     * Absent when it is.\n     */\n    requires?: string[];\n}\n\nexport interface RebaseBundleManifest {\n    /** @see BUNDLE_FORMAT_VERSION */\n    bundleFormat: number;\n    runtime: {\n        /** The `runtime` range copied from `rebase.json`. */\n        range: string;\n        /** Exact `@rebasepro/server` version this bundle was built against. */\n        builtAgainst: string;\n        /** Runtime contract major this bundle requires. */\n        contract: number;\n    };\n    /**\n     * Hash of the compiled collection definitions.\n     *\n     * This is the contract stamp. A generated SDK records the value it was built\n     * from, a client sends it back, and a mismatch is what lets the platform say\n     * \"this app was built against an older schema\" instead of failing mysteriously\n     * at the first request. It covers collections only — a hook edit does not\n     * change a client's contract, so it must not invalidate every SDK.\n     */\n    schemaVersion: string;\n    /** Which app in `rebase.json` this bundle was built from. */\n    app: string;\n    /**\n     * What the runtime does with this bundle.\n     *\n     * - `backend` — boot the full server: database, auth and the data API, plus\n     *   any static apps in `entry.static`.\n     * - `static` — no backend at all: serve `entry.static` and nothing else. No\n     *   database, no auth, no data sources. This is how a static app runs on the\n     *   same image as the backend.\n     *\n     * Replaces an earlier `mode: \"cms\" | \"baas\" | \"static\"`. The cms/baas\n     * distinction was never a third kind of thing — it is simply whether\n     * `entry.config` is present, so it is derived rather than declared.\n     */\n    kind: \"backend\" | \"static\";\n    entry: RebaseBundleEntrypoints;\n    /** Collection slugs contained in the bundle, for quick inspection. */\n    collections?: string[];\n    /**\n     * Every custom function in the bundle, named and classified.\n     *\n     * Two things are recorded per function, and both are answers a host would\n     * otherwise have to get by importing user code:\n     *\n     * - **What it is called.** That name is the function's identity everywhere —\n     *   the URL segment it mounts at, the `functions/<name>` API-key\n     *   permission, the value `REBASE_FUNCTIONS_ONLY` selects by. A host that\n     *   wants to give one slow function its own replica count currently has to\n     *   boot the bundle to discover what is in it.\n     * - **Whether it needs Node.** Purely descriptive: a function that opens a\n     *   file or runs raw SQL is a fine function, and every deployment today is\n     *   a Node process. It is recorded because the question \"which of these\n     *   could run somewhere else\" has to be answerable from the artifact, and\n     *   because answering it per-file after the fact — across a codebase\n     *   already written — is the expensive version of the same question.\n     *\n     * Absent on a bundle built before this field existed, which is why every\n     * consumer must treat it as optional rather than as an empty list.\n     */\n    functions?: RebaseBundleFunction[];\n    hooks: {\n        /**\n         * Whether the dependency closure contains native code.\n         *\n         * The managed runtime refuses these: a prebuilt binary cannot be run on\n         * an image the platform did not build it for, and the honest failure is\n         * at deploy time rather than at 3am in a crash loop.\n         */\n        native: boolean;\n        nativeModules?: NativeDependency[];\n    };\n    /**\n     * What the bundle's config says about storage access control.\n     *\n     * Storage is not under RLS and its keys share one flat namespace, so a\n     * deployment with file storage enabled and no access model serves every\n     * user's files to every signed-in user. The runtime refuses to boot in that\n     * state — which, on a hosted platform that enables storage from the *console*\n     * rather than from the bundle, surfaces as a crash loop the developer cannot\n     * read.\n     *\n     * Recording it here lets a host reject the deploy with the reason instead.\n     * Absent on bundles built before this field existed.\n     */\n    storage?: {\n        /** Whether the config package exports a `storageAuthorize` hook. */\n        authorize: boolean;\n        /**\n         * Buckets, on bundles built before {@link RebaseBundleManifest.resources}.\n         *\n         * No longer written. A host reads `resources`, which carries every kind\n         * in one list; this stays declared so a control plane can keep reading\n         * the bundles a project shipped before it was rebuilt.\n         */\n        sources?: StorageSourceDefinition[];\n    };\n    /**\n     * Everything the project declares it needs — databases, buckets, topics,\n     * and whatever kind is registered next.\n     *\n     * Recorded so a host can tell, from the artifact alone and before starting\n     * anything, what a deploy will need provisioned. That question used to be\n     * answerable for buckets and for nothing else, because buckets were the\n     * only kind written into an artifact — which is how a project's databases\n     * became invisible to the platform that runs them.\n     *\n     * Absent on bundles built before this field existed.\n     */\n    resources?: ResourceGraph;\n    deps: {\n        /** Runtime dependencies of user code, as declared. */\n        declared: Record<string, string>;\n        /**\n         * The dependency tree ships *inside* the bundle, already installed.\n         *\n         * Absent or false means the tree is declared but not present, and\n         * whoever boots the bundle has to install it. On the managed runtime that\n         * install runs in an init container on **every** pod start — the bundle\n         * lives on a volume that is wiped each time — and it is the single\n         * largest cost in a managed pod's life: 35–55 seconds of a 40–60 second\n         * cold start. Since a pod restarts on every eviction, node failure, OOM\n         * and runtime rollout, that number is not a startup detail. It is what an\n         * outage costs.\n         *\n         * Vendoring moves the install to build time, where it happens once. It is\n         * skipped when the closure contains native code, because a prebuilt\n         * binary is only valid for the platform it was built for — see\n         * {@link vendorTarget} for what \"the platform\" means here.\n         */\n        vendored?: boolean;\n        /**\n         * What {@link vendored} was resolved for, recorded so a mismatch can be\n         * refused rather than discovered at import time.\n         *\n         * Cross-platform vendoring is safe for pure JavaScript and unsafe for\n         * anything compiled, and the boundary between them is not always visible\n         * in a dependency list: `esbuild` is pure-JS with a *platform-specific\n         * optional dependency* holding the actual binary, so an install run on a\n         * developer's Mac silently produces a tree that cannot run on the Linux\n         * image. The install therefore resolves optional dependencies for the\n         * target explicitly rather than for the machine it runs on, and records\n         * the answer here.\n         */\n        vendorTarget?: {\n            /** npm `--os`, e.g. `linux`. */\n            os: string;\n            /** npm `--cpu`, e.g. `x64`. */\n            cpu: string;\n            /** Node major the tree was resolved for. */\n            node: string;\n        };\n    };\n    build: {\n        /** `@rebasepro/cli` version that produced this bundle. */\n        cli: string;\n        /** Node major the bundle was compiled on. */\n        node: string;\n        /** ISO-8601. */\n        createdAt: string;\n    };\n}\n\n/** The contract a running backend serves at `GET /api/meta/contract`. */\nexport interface RebaseProjectContract {\n    /** Matches {@link RebaseBundleManifest.schemaVersion}. */\n    schemaVersion: string;\n    runtime: {\n        /** `@rebasepro/server` version currently running. */\n        version: string;\n        contract: number;\n    };\n    /** Full collection definitions, serialized — the input to SDK generation. */\n    collections: unknown[];\n    /** Collection slugs, for cheap inspection without parsing the definitions. */\n    collectionSlugs: string[];\n    generatedAt: string;\n}\n\n/** Header carrying the schema version an SDK was generated from. */\nexport const SCHEMA_VERSION_HEADER = \"x-rebase-schema\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoNA,IAAa,4BAA4B;CAAC;CAAQ;CAAW;CAAY;CAAU;CAAW;AAAU;;;;;;;;;AAUxG,SAAgB,kBAAkB,MAAkC;CAChE,MAAM,aAAa,KAAK,SAAS,GAAG,KAAK,SAAS,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI;CAC5E,OAAO,0BAA0B,MAC7B,aAAY,eAAe,YAAY,WAAW,WAAW,GAAG,SAAS,EAAE,CAC/E;AACJ;;;;;;AAmFA,SAAgB,eAAe,MAAuB;CAClD,IAAI,KAAK,WAAW,KAAK,KAAK,SAAS,OAAO,SAAS,KAAK,YAAY,GAAG,OAAO;CAClF,MAAM,SAAS,KAAK,MAAM,GAAG;CAC7B,IAAI,OAAO,SAAS,GAAG,OAAO;CAC9B,MAAM,QAAQ;CACd,IAAI,CAAC,OAAO,OAAM,SAAQ,MAAM,KAAK,IAAI,CAAC,GAAG,OAAO;CAEpD,OAAO,CAAC,WAAW,KAAK,OAAO,OAAO,SAAS,EAAE;AACrD;;AAmdA,IAAa,wBAAwB"}