@rebasepro/server 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/{function-loader-D7o5Epjj.js → function-loader-iKhOZatS.js}

@@ -4,16 +4,48 @@ globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { n as __exportAll } from "./rolldown-runtime-dW7B1o5h.js";
 import { r as logger } from "./logger-D-S-hO5e.js";
-import { t as nativeDynamicImport } from "./dynamic-import-X40pTZUQ.js";
+import { i as warnDeprecated, n as describeLoadFailure, r as nativeDynamicImport, t as SYNTAX_ERROR_ADVICE } from "./load-failure-L5hvfDoG.js";
 import * as fs$1 from "fs";
 import * as path$1 from "path";
 import { pathToFileURL } from "url";
 //#region src/functions/function-loader.ts
 var function_loader_exports = /* @__PURE__ */ __exportAll({
+	functionList: () => functionList,
+	loadFunctions: () => loadFunctions,
 	loadFunctionsFromDirectory: () => loadFunctionsFromDirectory,
-	loadFunctionsWithDiagnostics: () => loadFunctionsWithDiagnostics
+	loadFunctionsWithDiagnostics: () => loadFunctionsWithDiagnostics,
+	readFunctionsDirectory: () => readFunctionsDirectory
 });
 /**
+* Load the custom functions in a directory, as values.
+*
+* Each file default-exports a Hono app — `defineFunction(...)` — or a factory
+* returning one. The filename without its extension is the record key, which
+* is the URL segment it is served at: `functions/send-invoice.ts` →
+* `{ "send-invoice": app }`. Only the top level is read.
+*
+* Never throws for a bad file: it is skipped, logged, and passed to
+* `options.onSkip`.
+*
+* @example
+* ```ts
+* const functions = await loadFunctions(path.resolve("functions"));
+* const backend = await createRebaseBackend({ database, functions, provision: true });
+* ```
+*/
+async function loadFunctions(directory, options = {}) {
+	const { functions, problems } = await readFunctionsDirectory(directory, options.importModule);
+	if (options.onSkip) for (const problem of problems) options.onSkip(problem);
+	return functions;
+}
+/** A record of functions as the list {@link createFunctionRoutes} mounts, in record order. */
+function functionList(functions) {
+	return Object.entries(functions).map(([name, app]) => ({
+		name,
+		app
+	}));
+}
+/**
 * Extensions the bundler compiles (or a developer might reasonably write) that
 * this loader cannot import. `rebase build` globs `functions/**\/*.ts`, so the
 * build's idea of "a function file" is strictly wider than the runtime's — the
@@ -30,29 +62,35 @@ var UNSUPPORTED_CODE_EXTENSIONS = [
 	".cjs"
 ];
 /**
-* Auto-discover Hono route files from a directory.
-*
-* Each file should default-export a Hono app (or router).
-* The filename (without extension) becomes the mount path:
-*   `functions/send-invoice.ts` → mounted at `/send-invoice`
-*
-* This mirrors how `loadCollectionsFromDirectory` works for collections.
-*
-* Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the
-* caller also needs to report what did not.
+* @deprecated Use `loadFunctions` instead, which returns the functions as a
+* record keyed by name. Will be removed in a future release.
 */
 async function loadFunctionsFromDirectory(directory, importModule = nativeDynamicImport) {
-	return (await loadFunctionsWithDiagnostics(directory, importModule)).functions;
+	warnDeprecated("server.loadFunctionsFromDirectory", "`loadFunctionsFromDirectory` is deprecated; use `loadFunctions(dir)`, which returns `{ [name]: app }`.");
+	return functionList((await readFunctionsDirectory(directory, importModule)).functions);
 }
 /**
-* {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.
+* @deprecated Use `loadFunctions` instead, with `onSkip` to collect the files
+* it skipped. Will be removed in a future release.
+*/
+async function loadFunctionsWithDiagnostics(directory, importModule = nativeDynamicImport) {
+	warnDeprecated("server.loadFunctionsWithDiagnostics", "`loadFunctionsWithDiagnostics` is deprecated; use `loadFunctions(dir, { onSkip })`, which returns `{ [name]: app }`.");
+	const { functions, problems } = await readFunctionsDirectory(directory, importModule);
+	return {
+		functions: functionList(functions),
+		problems
+	};
+}
+/**
+* Read a directory of function files: what loaded, keyed by name, and one
+* `<file> (<reason>)` per file that did not.
 *
 * Never throws: a single malformed function must not crash server boot. The
-* caller decides what to do with `problems` — `init.ts` mounts the router
-* regardless and surfaces the count on the listing endpoint.
+* backend mounts the router regardless and surfaces the count of skipped files
+* on the listing endpoint.
 */
-async function loadFunctionsWithDiagnostics(directory, importModule = nativeDynamicImport) {
-	const functions = [];
+async function readFunctionsDirectory(directory, importModule = nativeDynamicImport) {
+	const functions = {};
 	const problems = [];
 	if (!fs$1.existsSync(directory)) return {
 		functions,
@@ -83,26 +121,17 @@ async function loadFunctionsWithDiagnostics(directory, importModule = nativeDyna
 					problems.push(`${file} (no default export)`);
 					continue;
 				}
-				if (isHonoLike(exported)) {
+				const app = isHonoLike(exported) ? exported : typeof exported === "function" ? exported() : void 0;
+				if (isHonoLike(app)) {
 					const name = path$1.basename(file, path$1.extname(file));
-					functions.push({
-						name,
-						app: exported
-					});
-					logger.debug(`⚡ Loaded function route: ${name}`);
-					continue;
-				}
-				if (typeof exported === "function") {
-					const result = exported();
-					if (isHonoLike(result)) {
-						const name = path$1.basename(file, path$1.extname(file));
-						functions.push({
-							name,
-							app: result
-						});
-						logger.debug(`⚡ Loaded function route: ${name}`);
+					if (Object.hasOwn(functions, name)) {
+						logger.warn(`[functions] ${file}: another file is already served as '${name}'. Skipping.`);
+						problems.push(`${file} (another file is already served as '${name}')`);
 						continue;
 					}
+					functions[name] = app;
+					logger.debug(`⚡ Loaded function route: ${name}`);
+					continue;
 				}
 				const exportType = typeof exported;
 				const keys = exported && typeof exported === "object" ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(", ") : "N/A";
@@ -113,12 +142,13 @@ async function loadFunctionsWithDiagnostics(directory, importModule = nativeDyna
 			} catch (err) {
 				const message = err instanceof Error ? err.message : String(err);
 				logger.error(`[functions] Failed to load ${file}: ${message}`);
-				problems.push(`${file} (threw: ${message})`);
+				problems.push(describeLoadFailure(file, err));
 			}
 		}
 	}
 	if (problems.length > 0) {
 		const advice = [];
+		if (problems.some((p) => p.includes("(syntax error"))) advice.push(SYNTAX_ERROR_ADVICE);
 		if (problems.some((p) => p.includes("(threw:"))) advice.push("  A file that threw ran at import time. Read configuration *inside* a handler (`requireEnv(c, \"STRIPE_KEY\")`, or a lazily-built client) rather than at module scope, where one undefined variable takes the whole file down before any route exists.");
 		if (problems.some((p) => p.includes("(no default export)"))) advice.push("  A file with no default export exports nothing the loader can mount. `export default defineFunction((app) => { … })`.");
 		if (problems.some((p) => p.includes("(not a Hono app or factory)"))) advice.push("  A default export the loader did not recognise is usually two copies of hono. Author with `defineFunction(...)` from @rebasepro/server/functions, which uses the server's own copy.");
@@ -141,6 +171,6 @@ function isHonoLike(obj) {
 	return typeof record.fetch === "function" && Array.isArray(record.routes);
 }
 //#endregion
-export { loadFunctionsFromDirectory as n, loadFunctionsWithDiagnostics as r, function_loader_exports as t };
+export { loadFunctionsWithDiagnostics as i, loadFunctions as n, loadFunctionsFromDirectory as r, function_loader_exports as t };
 
-//# sourceMappingURL=function-loader-D7o5Epjj.js.map
+//# sourceMappingURL=function-loader-iKhOZatS.js.map

package/dist/function-loader-iKhOZatS.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-loader-iKhOZatS.js","names":[],"sources":["../src/functions/function-loader.ts"],"sourcesContent":["import * as fs from \"fs\";\nimport * as path from \"path\";\nimport { pathToFileURL } from \"url\";\nimport { Hono } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { logger } from \"../utils/logger.js\";\nimport { nativeDynamicImport, type ModuleImporter } from \"../utils/dynamic-import.js\";\nimport { describeLoadFailure, SYNTAX_ERROR_ADVICE } from \"../utils/load-failure.js\";\nimport { warnDeprecated } from \"@rebasepro/common\";\n\n/**\n * One custom function: a Hono app, served at `<functions mount>/<name>`.\n *\n * What `defineFunction(...)` returns, and what a function file default-exports:\n * a Hono app over {@link HonoEnv}, the environment a function runs in — build\n * one by hand as `new Hono<HonoEnv>()`. Any Hono-compatible app works at\n * runtime — the loader checks for `.fetch()` and `.routes` rather than an\n * `instanceof`, because a project and the server can hold two copies of hono.\n */\nexport type FunctionApp = Hono<HonoEnv>;\n\n/**\n * Functions as values: the URL segment each one answers at, to its app.\n *\n * `functions: { \"send-invoice\": sendInvoice }` serves `sendInvoice` at\n * `/api/functions/send-invoice` — the same thing a file named\n * `functions/send-invoice.ts` does. {@link loadFunctions} returns exactly this\n * shape, so `functions: await loadFunctions(dir)` and `functionsDir: dir` serve\n * the same routes.\n */\nexport type FunctionsRecord = Record<string, FunctionApp>;\n\n/** How a directory of modules is read. Shared by the function and cron loaders. */\nexport interface LoadDirectoryOptions {\n    /**\n     * How a module file is imported. Defaults to the runtime's own `import()`;\n     * a caller with its own loader hooks (tsx, a test runner's sandbox) passes\n     * `url => import(url)` so they apply.\n     */\n    importModule?: ModuleImporter;\n    /**\n     * Called once for every file the loader saw and did **not** load, as\n     * `<file> (<reason>)`. The files are skipped either way — one malformed\n     * file must not take the others with it — and logged; this is how a caller\n     * reports them anywhere else.\n     */\n    onSkip?: (problem: string) => void;\n}\n\n/**\n * Load the custom functions in a directory, as values.\n *\n * Each file default-exports a Hono app — `defineFunction(...)` — or a factory\n * returning one. The filename without its extension is the record key, which\n * is the URL segment it is served at: `functions/send-invoice.ts` →\n * `{ \"send-invoice\": app }`. Only the top level is read.\n *\n * Never throws for a bad file: it is skipped, logged, and passed to\n * `options.onSkip`.\n *\n * @example\n * ```ts\n * const functions = await loadFunctions(path.resolve(\"functions\"));\n * const backend = await createRebaseBackend({ database, functions, provision: true });\n * ```\n */\nexport async function loadFunctions(directory: string, options: LoadDirectoryOptions = {}): Promise<FunctionsRecord> {\n    const { functions, problems } = await readFunctionsDirectory(directory, options.importModule);\n    if (options.onSkip) for (const problem of problems) options.onSkip(problem);\n    return functions;\n}\n\n/** A loaded function, by name. The shape {@link createFunctionRoutes} mounts. */\nexport interface LoadedFunction {\n    /** Endpoint name derived from filename (e.g., \"send-invoice\") */\n    name: string;\n    /** The Hono sub-app to mount */\n    app: FunctionApp;\n}\n\n/** What a directory of function files produced: what mounted, and what did not. */\nexport interface LoadedFunctions {\n    /** The functions that will be served. */\n    functions: LoadedFunction[];\n    /**\n     * One entry per file the loader saw and did **not** mount, each already\n     * phrased as `<name> (<reason>)`.\n     */\n    problems: string[];\n}\n\n/** A record of functions as the list {@link createFunctionRoutes} mounts, in record order. */\nexport function functionList(functions: FunctionsRecord): LoadedFunction[] {\n    return Object.entries(functions).map(([name, app]) => ({ name, app }));\n}\n\n/**\n * Extensions the bundler compiles (or a developer might reasonably write) that\n * this loader cannot import. `rebase build` globs `functions/**\\/*.ts`, so the\n * build's idea of \"a function file\" is strictly wider than the runtime's — the\n * worst direction for a mismatch to go. Anything listed here is reported as a\n * problem instead of vanishing; non-code files (`.md`, `.json`, `.txt`) stay\n * silent, because a README next to your functions is not a mistake.\n */\nconst UNSUPPORTED_CODE_EXTENSIONS = [\".mts\", \".cts\", \".tsx\", \".jsx\", \".mjs\", \".cjs\"];\n\n/**\n * @deprecated Use `loadFunctions` instead, which returns the functions as a\n * record keyed by name. Will be removed in a future release.\n */\nexport async function loadFunctionsFromDirectory(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunction[]> {\n    warnDeprecated(\n        \"server.loadFunctionsFromDirectory\",\n        \"`loadFunctionsFromDirectory` is deprecated; use `loadFunctions(dir)`, which returns `{ [name]: app }`.\"\n    );\n    return functionList((await readFunctionsDirectory(directory, importModule)).functions);\n}\n\n/**\n * @deprecated Use `loadFunctions` instead, with `onSkip` to collect the files\n * it skipped. Will be removed in a future release.\n */\nexport async function loadFunctionsWithDiagnostics(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<LoadedFunctions> {\n    warnDeprecated(\n        \"server.loadFunctionsWithDiagnostics\",\n        \"`loadFunctionsWithDiagnostics` is deprecated; use `loadFunctions(dir, { onSkip })`, which returns `{ [name]: app }`.\"\n    );\n    const { functions, problems } = await readFunctionsDirectory(directory, importModule);\n    return { functions: functionList(functions), problems };\n}\n\n/**\n * Read a directory of function files: what loaded, keyed by name, and one\n * `<file> (<reason>)` per file that did not.\n *\n * Never throws: a single malformed function must not crash server boot. The\n * backend mounts the router regardless and surfaces the count of skipped files\n * on the listing endpoint.\n */\nexport async function readFunctionsDirectory(\n    directory: string,\n    importModule: ModuleImporter = nativeDynamicImport\n): Promise<{ functions: FunctionsRecord; problems: string[] }> {\n    const functions: FunctionsRecord = {};\n    // Aggregate problem files so a broken function surfaces as one loud\n    // summary line, not just a warning buried per-file. We still don't throw:\n    // a single malformed function must not crash server boot.\n    const problems: string[] = [];\n\n    if (!fs.existsSync(directory)) {\n        return { functions, problems };\n    }\n\n    // `withFileTypes` so a directory entry is a *reported* skip rather than a\n    // filter miss. `readdirSync(dir)` returned bare names, and a subdirectory\n    // simply failed the `.ts`/`.js` test — so `functions/admin/users.ts` was\n    // compiled by `rebase build`, shipped in the bundle, and then dropped at\n    // boot without a single log line.\n    const entries = fs.readdirSync(directory, { withFileTypes: true });\n    for (const entry of entries) {\n        const file = entry.name;\n\n        if (entry.isDirectory()) {\n            // Dot-directories are tooling (`.git`, `.turbo`), not intent.\n            if (file.startsWith(\".\") || file === \"node_modules\") continue;\n            logger.warn(\n                `[functions] ${file}/: subdirectory ignored. Functions are loaded from the top level of ` +\n                `${directory} only, so nothing under ${file}/ is served. Move the file up (or flatten the ` +\n                \"name: `admin/users.ts` → `admin-users.ts`).\"\n            );\n            problems.push(`${file}/ (subdirectory — functions are not loaded recursively)`);\n            continue;\n        }\n\n        const extension = path.extname(file);\n        if (\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            UNSUPPORTED_CODE_EXTENSIONS.includes(extension)\n        ) {\n            logger.warn(\n                `[functions] ${file}: ${extension} files are not loaded. Rename it to .ts (or .js) to serve it.`\n            );\n            problems.push(`${file} (unsupported extension ${extension})`);\n            continue;\n        }\n\n        if (\n            (file.endsWith(\".ts\") || file.endsWith(\".js\")) &&\n            // Dotfiles: notably macOS bsdtar AppleDouble sidecars (`._foo.ts`),\n            // binary blobs that cannot be imported.\n            !file.startsWith(\".\") &&\n            !file.includes(\".test.\") &&\n            !file.endsWith(\".d.ts\") &&\n            file !== \"index.ts\" &&\n            file !== \"index.js\"\n        ) {\n            const filePath = path.join(directory, file);\n            try {\n                const fileUrl = pathToFileURL(filePath).href;\n\n                const mod = await importModule(fileUrl);\n\n                const exported = mod.default;\n\n                if (!exported) {\n                    logger.warn(`[functions] ${file}: no default export. Skipping.`);\n                    problems.push(`${file} (no default export)`);\n                    continue;\n                }\n\n                // Accept a Hono instance — use duck-typing to handle different\n                // Hono versions which may not share the same prototype.\n                const app = isHonoLike(exported)\n                    ? exported as FunctionApp\n                    // Also accept a factory function that returns a Hono instance\n                    : typeof exported === \"function\" ? exported() : undefined;\n                if (isHonoLike(app)) {\n                    const name = path.basename(file, path.extname(file));\n                    // `send.ts` and `send.js` side by side name one URL. A\n                    // record holds one app per name, so the second is reported\n                    // rather than silently replacing the first.\n                    if (Object.hasOwn(functions, name)) {\n                        logger.warn(`[functions] ${file}: another file is already served as '${name}'. Skipping.`);\n                        problems.push(`${file} (another file is already served as '${name}')`);\n                        continue;\n                    }\n                    functions[name] = app as FunctionApp;\n                    logger.debug(`⚡ Loaded function route: ${name}`);\n                    continue;\n                }\n\n                // Provide actionable diagnostics\n                const exportType = typeof exported;\n                const keys = exported && typeof exported === \"object\"\n                    ? Object.getOwnPropertyNames(Object.getPrototypeOf(exported)).slice(0, 10).join(\", \")\n                    : \"N/A\";\n                logger.warn(\n                    `[functions] ${file}: default export is not a Hono app or factory. Skipping.\\n` +\n                    `  export type: ${exportType}${exported?.constructor?.name ? ` (${exported.constructor.name})` : \"\"}\\n` +\n                    `  prototype methods: ${keys}\\n` +\n                    \"  Hint: ensure the function exports a Hono app created with the same hono version as the server.\\n\" +\n                    \"  Author with `defineFunction(...)` from @rebasepro/server for a typed, checked contract.\\n\" +\n                    \"  The loader checks for .fetch() and .routes — any Hono-compatible app will work.\"\n                );\n                problems.push(`${file} (not a Hono app or factory)`);\n            } catch (err: unknown) {\n                const message =\n                    err instanceof Error ? err.message : String(err);\n                logger.error(`[functions] Failed to load ${file}: ${message}`);\n                problems.push(describeLoadFailure(file, err));\n            }\n        }\n    }\n\n    if (problems.length > 0) {\n        // Advice keyed to what actually went wrong. The old line said\n        // \"author them with `defineFunction(...)`\" for every failure — which is\n        // the fix for a wrong export shape and no help at all for the commonest\n        // one: a file that threw while being imported, usually a module-scope\n        // `process.env.X` read that came back undefined. Told to reach for\n        // `defineFunction`, an author rewrites a file whose export was already\n        // correct and gets the same failure.\n        const advice: string[] = [];\n        if (problems.some(p => p.includes(\"(syntax error\"))) {\n            advice.push(SYNTAX_ERROR_ADVICE);\n        }\n        if (problems.some(p => p.includes(\"(threw:\"))) {\n            advice.push(\n                \"  A file that threw ran at import time. Read configuration *inside* a handler \" +\n                \"(`requireEnv(c, \\\"STRIPE_KEY\\\")`, or a lazily-built client) rather than at module \" +\n                \"scope, where one undefined variable takes the whole file down before any route exists.\"\n            );\n        }\n        if (problems.some(p => p.includes(\"(no default export)\"))) {\n            advice.push(\n                \"  A file with no default export exports nothing the loader can mount. \" +\n                \"`export default defineFunction((app) => { … })`.\"\n            );\n        }\n        if (problems.some(p => p.includes(\"(not a Hono app or factory)\"))) {\n            advice.push(\n                \"  A default export the loader did not recognise is usually two copies of hono. \" +\n                \"Author with `defineFunction(...)` from @rebasepro/server/functions, which uses the \" +\n                \"server's own copy.\"\n            );\n        }\n        logger.warn(\n            `[functions] ${problems.length} function file(s) were skipped and will NOT be served:\\n` +\n            problems.map((p) => `  - ${p}`).join(\"\\n\") + \"\\n\" +\n            advice.join(\"\\n\")\n        );\n    }\n\n    return { functions, problems };\n}\n\n/**\n * Duck-type check for Hono apps.\n * We avoid `instanceof Hono` because different Hono versions\n * installed in the user's project vs. our dependencies will\n * not share the same prototype, causing false negatives.\n */\nfunction isHonoLike(obj: unknown): boolean {\n    if (!obj || typeof obj !== \"object\") return false;\n    // Hono instances always have .fetch() and .routes\n    const record = obj as Record<string, unknown>;\n    return (\n        typeof record.fetch === \"function\" &&\n        Array.isArray(record.routes)\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkEA,eAAsB,cAAc,WAAmB,UAAgC,CAAC,GAA6B;CACjH,MAAM,EAAE,WAAW,aAAa,MAAM,uBAAuB,WAAW,QAAQ,YAAY;CAC5F,IAAI,QAAQ,QAAQ,KAAK,MAAM,WAAW,UAAU,QAAQ,OAAO,OAAO;CAC1E,OAAO;AACX;;AAsBA,SAAgB,aAAa,WAA8C;CACvE,OAAO,OAAO,QAAQ,SAAS,CAAC,CAAC,KAAK,CAAC,MAAM,UAAU;EAAE;EAAM;CAAI,EAAE;AACzE;;;;;;;;;AAUA,IAAM,8BAA8B;CAAC;CAAQ;CAAQ;CAAQ;CAAQ;CAAQ;AAAM;;;;;AAMnF,eAAsB,2BAClB,WACA,eAA+B,qBACN;CACzB,eACI,qCACA,wGACJ;CACA,OAAO,cAAc,MAAM,uBAAuB,WAAW,YAAY,EAAA,CAAG,SAAS;AACzF;;;;;AAMA,eAAsB,6BAClB,WACA,eAA+B,qBACP;CACxB,eACI,uCACA,sHACJ;CACA,MAAM,EAAE,WAAW,aAAa,MAAM,uBAAuB,WAAW,YAAY;CACpF,OAAO;EAAE,WAAW,aAAa,SAAS;EAAG;CAAS;AAC1D;;;;;;;;;AAUA,eAAsB,uBAClB,WACA,eAA+B,qBAC4B;CAC3D,MAAM,YAA6B,CAAC;CAIpC,MAAM,WAAqB,CAAC;CAE5B,IAAI,CAAC,KAAG,WAAW,SAAS,GACxB,OAAO;EAAE;EAAW;CAAS;CAQjC,MAAM,UAAU,KAAG,YAAY,WAAW,EAAE,eAAe,KAAK,CAAC;CACjE,KAAK,MAAM,SAAS,SAAS;EACzB,MAAM,OAAO,MAAM;EAEnB,IAAI,MAAM,YAAY,GAAG;GAErB,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,gBAAgB;GACrD,OAAO,KACH,eAAe,KAAK,sEACjB,UAAU,0BAA0B,KAAK,8FAEhD;GACA,SAAS,KAAK,GAAG,KAAK,wDAAwD;GAC9E;EACJ;EAEA,MAAM,YAAY,OAAK,QAAQ,IAAI;EACnC,IACI,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,4BAA4B,SAAS,SAAS,GAChD;GACE,OAAO,KACH,eAAe,KAAK,IAAI,UAAU,8DACtC;GACA,SAAS,KAAK,GAAG,KAAK,0BAA0B,UAAU,EAAE;GAC5D;EACJ;EAEA,KACK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS,KAAK,MAG5C,CAAC,KAAK,WAAW,GAAG,KACpB,CAAC,KAAK,SAAS,QAAQ,KACvB,CAAC,KAAK,SAAS,OAAO,KACtB,SAAS,cACT,SAAS,YACX;GACE,MAAM,WAAW,OAAK,KAAK,WAAW,IAAI;GAC1C,IAAI;IACA,MAAM,UAAU,cAAc,QAAQ,CAAC,CAAC;IAIxC,MAAM,YAAW,MAFC,aAAa,OAAO,EAAA,CAEjB;IAErB,IAAI,CAAC,UAAU;KACX,OAAO,KAAK,eAAe,KAAK,+BAA+B;KAC/D,SAAS,KAAK,GAAG,KAAK,qBAAqB;KAC3C;IACJ;IAIA,MAAM,MAAM,WAAW,QAAQ,IACzB,WAEA,OAAO,aAAa,aAAa,SAAS,IAAI,KAAA;IACpD,IAAI,WAAW,GAAG,GAAG;KACjB,MAAM,OAAO,OAAK,SAAS,MAAM,OAAK,QAAQ,IAAI,CAAC;KAInD,IAAI,OAAO,OAAO,WAAW,IAAI,GAAG;MAChC,OAAO,KAAK,eAAe,KAAK,uCAAuC,KAAK,aAAa;MACzF,SAAS,KAAK,GAAG,KAAK,uCAAuC,KAAK,GAAG;MACrE;KACJ;KACA,UAAU,QAAQ;KAClB,OAAO,MAAM,4BAA4B,MAAM;KAC/C;IACJ;IAGA,MAAM,aAAa,OAAO;IAC1B,MAAM,OAAO,YAAY,OAAO,aAAa,WACvC,OAAO,oBAAoB,OAAO,eAAe,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,IAClF;IACN,OAAO,KACH,eAAe,KAAK,2EACF,aAAa,UAAU,aAAa,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,GAAG,yBAC5E,KAAK;;kFAIjC;IACA,SAAS,KAAK,GAAG,KAAK,6BAA6B;GACvD,SAAS,KAAc;IACnB,MAAM,UACF,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;IACnD,OAAO,MAAM,8BAA8B,KAAK,IAAI,SAAS;IAC7D,SAAS,KAAK,oBAAoB,MAAM,GAAG,CAAC;GAChD;EACJ;CACJ;CAEA,IAAI,SAAS,SAAS,GAAG;EAQrB,MAAM,SAAmB,CAAC;EAC1B,IAAI,SAAS,MAAK,MAAK,EAAE,SAAS,eAAe,CAAC,GAC9C,OAAO,KAAK,mBAAmB;EAEnC,IAAI,SAAS,MAAK,MAAK,EAAE,SAAS,SAAS,CAAC,GACxC,OAAO,KACH,wPAGJ;EAEJ,IAAI,SAAS,MAAK,MAAK,EAAE,SAAS,qBAAqB,CAAC,GACpD,OAAO,KACH,wHAEJ;EAEJ,IAAI,SAAS,MAAK,MAAK,EAAE,SAAS,6BAA6B,CAAC,GAC5D,OAAO,KACH,sLAGJ;EAEJ,OAAO,KACH,eAAe,SAAS,OAAO,4DAC/B,SAAS,KAAK,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,IAAI,OAC7C,OAAO,KAAK,IAAI,CACpB;CACJ;CAEA,OAAO;EAAE;EAAW;CAAS;AACjC;;;;;;;AAQA,SAAS,WAAW,KAAuB;CACvC,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAE5C,MAAM,SAAS;CACf,OACI,OAAO,OAAO,UAAU,cACxB,MAAM,QAAQ,OAAO,MAAM;AAEnC"}

package/dist/{function-routes-CaNG4waN.js → function-routes-j9TwpvQe.js}

@@ -243,10 +243,11 @@ function createFunctionRoutes(functions, problems = [], mountPath = "/functions"
 	const router = new Hono();
 	const skipped = problems.length;
 	router.get("/", requireAuth, (c) => {
+		const at = c.get("mountPath") ?? mountPath;
 		return c.json({
 			functions: functions.map((fn) => ({
 				name: fn.name,
-				endpoint: `${mountPath}/${fn.name}`
+				endpoint: `${at}/${fn.name}`
 			})),
 			...skipped > 0 && {
 				skipped,
@@ -265,10 +266,10 @@ function createFunctionRoutes(functions, problems = [], mountPath = "/functions"
 		const refuse = (message) => {
 			throw new ApiError(404, "FUNCTION_NOT_FOUND", message, { function: name }, true);
 		};
-		if (!name) refuse(`No function in the request path. Expected ${mountPath}/<function>.`);
+		if (!name) refuse(`No function in the request path. Expected ${c.get("mountPath") ?? mountPath}/<function>.`);
 		if (mounted.has(name)) refuse(`The function '${name}' is served, and has no ${c.req.method} route at '/${rest}'. The path after the function name is routed by the function's own Hono app.`);
 		const file = failedToLoad.get(name);
-		if (file) refuse(`The function '${name}' is not served: '${file}' failed to load. The server log records why, at boot.`);
+		if (file && identified) refuse(`The function '${name}' is not served: '${file}' failed to load. The server log records why, at boot.`);
 		return refuse(`No function named '${name}' on this backend.` + (identified ? mounted.size > 0 ? ` This backend serves: ${[...mounted].sort().join(", ")}.` : " This backend serves no functions." : "") + (skipped > 0 && identified ? ` ${skipped} function file(s) failed to load and are not served — see the server log.` : ""));
 	});
 	return router;
@@ -276,4 +277,4 @@ function createFunctionRoutes(functions, problems = [], mountPath = "/functions"
 //#endregion
 export { getDriver as a, getUser as c, identityResolved as d, isAdmin as f, getApiKey as i, getUserId as l, requireDriver as m, function_routes_exports as n, getRequestId as o, isAuthenticated as p, requireRole as r, getRoles as s, createFunctionRoutes as t, hasRole as u };
 
-//# sourceMappingURL=function-routes-CaNG4waN.js.map
+//# sourceMappingURL=function-routes-j9TwpvQe.js.map

package/dist/function-routes-j9TwpvQe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"function-routes-j9TwpvQe.js","names":[],"sources":["../src/auth/admin-roles.ts","../src/functions/context.ts","../src/functions/guards.ts","../src/functions/function-routes.ts"],"sourcesContent":["/**\n * The admin role and scope matching, for code that may not import\n * `@rebasepro/types`.\n *\n * The custom-functions surface (`@rebasepro/server/functions`) must bundle for\n * a runtime with no Node built-ins and imports nothing but `hono`, so its\n * guards cannot reach the canonical definitions in `@rebasepro/types`\n * (`ADMIN_ROLE`, `hasAdminRole`, `scopeGrants`). These are the same rules,\n * restated, and `test/admin-roles.test.ts` holds them equal.\n *\n * Everything else imports the `@rebasepro/types` versions.\n */\n\n/** The one built-in role. It holds every scope. */\nexport const ADMIN_ROLE_NAME = \"admin\";\n\n/** Does this list of roles include the admin role? */\nexport function holdsAdminRole(roles: readonly string[] | null | undefined): boolean {\n    return !!roles?.includes(ADMIN_ROLE_NAME);\n}\n\n/**\n * Does a set of held scopes grant `scope`, optionally on one `target`? The\n * unqualified grant covers every target; `scope:target` covers its own.\n */\nexport function heldScopesGrant(held: readonly string[], scope: string, target?: string): boolean {\n    for (const entry of held) {\n        if (entry === scope) return true;\n        if (target !== undefined && entry === `${scope}:${target}`) return true;\n    }\n    return false;\n}\n","/**\n * Reading the request context from inside a custom function.\n *\n * The functions router resolves the caller's identity before any handler runs\n * and leaves the result on the Hono context. Getting it back out used to be the\n * user's problem, and the shape made that worse than it sounds: `HonoEnv`\n * types `user` as `AuthResult`, a union that includes `boolean`, `null` and an\n * index signature, because the same slot is filled by four different middlewares\n * — JWT, service key, API key, and a user-supplied validator that may return\n * `true`. Every example in the documentation therefore opened with\n *\n *     const user = c.get(\"user\") as { uid: string; roles?: string[] } | undefined;\n *\n * and an assertion in a security-relevant position is exactly the kind of line\n * that gets copied once and then never re-examined. It is also wrong in one\n * case that occurs in practice: a custom validator returning `true` stores\n * `{ uid: \"default\", roles: [] }`, which the assertion above types as having a\n * `uid` — true here, but nothing checks it.\n *\n * These accessors do the narrowing once, in the framework, where it can be\n * tested. They are also **runtime-neutral by construction** — no crypto, no\n * token parsing, no I/O, nothing but property reads on an object another\n * middleware already populated. That is what lets them live in\n * `@rebasepro/server/functions` and run unchanged on a host that has no Node\n * built-ins.\n *\n * @module\n */\nimport type { Context } from \"hono\";\nimport type { DataDriver } from \"@rebasepro/types\";\nimport type { HonoEnv } from \"../api/types\";\nimport type { ApiKeyMasked } from \"../auth/api-keys/api-key-types\";\nimport { heldScopesGrant, holdsAdminRole } from \"../auth/admin-roles\";\n\n/**\n * The caller, as a custom function sees them.\n *\n * A narrowed view of whatever the auth middleware resolved: `uid` and `roles`\n * are guaranteed, and the index signature keeps any extra claims the token or\n * the adapter carried (`email`, `org_id`, anything a custom validator added)\n * reachable without a cast.\n */\nexport interface FunctionUser {\n    /** Stable id of the caller. `\"service\"` for service-key and API-key callers. */\n    uid: string;\n    /** Roles as resolved for this request. Never `undefined` — an empty array instead. */\n    roles: string[];\n    /** Present when the identity carried one. Not every auth method does. */\n    email?: string;\n    /** Any further claim the token, adapter or validator supplied. */\n    [claim: string]: unknown;\n}\n\n/** Anything with a Hono-style `.get`, so these work on any `Context` shape. */\ntype CtxLike = Context<HonoEnv> | Context;\n\nfunction read<K extends keyof HonoEnv[\"Variables\"]>(\n    c: CtxLike,\n    key: K\n): HonoEnv[\"Variables\"][K] | undefined {\n    // `c.get` is typed against the app's own Env, which a handler mounted\n    // through `app.route()` may have declared more loosely. The cast is\n    // confined to this one function rather than repeated at every call site.\n    return (c as Context<HonoEnv>).get(key);\n}\n\n/**\n * The authenticated caller, or `undefined` for an anonymous request.\n *\n * **`undefined` is not a permission decision.** The functions router mounts its\n * auth middleware with `requireAuth: false` on purpose — a webhook receiver has\n * no token to send — so an anonymous caller reaches the handler and reads\n * `undefined` here while the handler runs on regardless. Use {@link requireAuth}\n * (or a `!user` branch that returns 401) to make it a decision.\n *\n * A caller who presented a *bad* token never gets this far: both auth\n * middlewares reject an unverifiable token with 401 before the router is\n * reached, precisely so an expired session cannot be silently downgraded to an\n * anonymous one.\n */\nexport function getUser(c: CtxLike): FunctionUser | undefined {\n    const raw = read(c, \"user\");\n    if (!raw || typeof raw !== \"object\") return undefined;\n\n    const record = raw as Record<string, unknown>;\n    const uid = typeof record.uid === \"string\" ? record.uid : undefined;\n    if (uid === undefined) return undefined;\n\n    const roles = Array.isArray(record.roles)\n        ? record.roles.filter((role): role is string => typeof role === \"string\")\n        : [];\n\n    return { ...record,\n        uid,\n        roles } as FunctionUser;\n}\n\n/** The caller's id, or `undefined` when nobody is signed in. */\nexport function getUserId(c: CtxLike): string | undefined {\n    return getUser(c)?.uid;\n}\n\n/** The caller's roles. Empty for an anonymous request — never `undefined`. */\nexport function getRoles(c: CtxLike): string[] {\n    return getUser(c)?.roles ?? [];\n}\n\n/**\n * Whether the caller holds **any** of the named roles.\n *\n * Any rather than all, because that is what a route guard means by a list of\n * roles; require several by calling this more than once.\n */\nexport function hasRole(c: CtxLike, ...roles: string[]): boolean {\n    if (roles.length === 0) return false;\n    const held = new Set(getRoles(c));\n    return roles.some(role => held.has(role));\n}\n\n/** Whether the caller holds the `admin` role, which holds every scope. */\nexport function isAdmin(c: CtxLike): boolean {\n    return holdsAdminRole(getRoles(c));\n}\n\n/**\n * Everything the caller may do, as `resource:action[:target]` scope strings —\n * the data plane, the app's own `auth.scopes`, and whatever their roles (or\n * their API key) hold. Empty for an anonymous request.\n *\n * Resolved by the framework before the handler runs; `undefined` only when no\n * Rebase auth middleware ran (see {@link identityResolved}).\n */\nexport function getScopes(c: CtxLike): string[] | undefined {\n    return read(c, \"scopes\");\n}\n\n/**\n * Whether the caller holds `scope`, on `target` when one is given.\n *\n * For an app scope declared under `auth.scopes` — `project:deploy` — a\n * signed-in person always holds it, so this narrows only API keys and tokens.\n * Whether the *person* may deploy *this* project is still the handler's to\n * decide.\n */\nexport function hasScope(c: CtxLike, scope: string, target?: string): boolean {\n    return heldScopesGrant(getScopes(c) ?? [], scope, target);\n}\n\n/** Whether the request carries an identity at all. */\nexport function isAuthenticated(c: CtxLike): boolean {\n    return getUser(c) !== undefined;\n}\n\n/**\n * The request-scoped data driver: reads and writes run as **the caller**, with\n * your row-level security policies evaluated against their identity.\n *\n * This is the accessor to reach for when a function serves user-facing data.\n * `rebase.dataAsAdmin` is the other one, and it is not the same thing — it runs\n * as `{ uid: \"service\", roles: [\"admin\"] }` for every caller alike, which is\n * correct for trusted background work and wrong for a request.\n *\n * `undefined` only when no Rebase auth middleware ran (see\n * {@link identityResolved}); inside a function mounted by the framework it is\n * always present, anonymous requests included — they get an anon-scoped driver\n * so policies still have an identity to evaluate.\n */\nexport function getDriver(c: CtxLike): DataDriver | undefined {\n    return read(c, \"driver\");\n}\n\n/**\n * {@link getDriver}, but throws instead of handing back `undefined`.\n *\n * For the common case where a handler cannot proceed without it and would\n * otherwise write `c.get(\"driver\")!` — an assertion that turns a wiring problem\n * into `Cannot read properties of undefined (reading 'fetchCollection')` twenty\n * lines away from the cause.\n */\nexport function requireDriver(c: CtxLike): DataDriver {\n    const driver = getDriver(c);\n    if (!driver) {\n        throw new Error(\n            \"No request-scoped driver on this context. A Rebase auth middleware \" +\n            \"populates it before any custom function runs, so this means the handler \" +\n            \"was mounted outside the functions router — e.g. added to your own Hono \" +\n            \"app directly. Mount it from the functions directory, or use \" +\n            \"`rebase.dataAsAdmin` if the work is genuinely service-scoped.\"\n        );\n    }\n    return driver;\n}\n\n/**\n * The API key this request authenticated with, masked, or `undefined` when it\n * did not use one.\n *\n * Useful for attribution and for per-key behaviour. The permission check itself\n * has already happened — reaching a handler means the key was allowed to.\n */\nexport function getApiKey(c: CtxLike): ApiKeyMasked | undefined {\n    return read(c, \"apiKey\");\n}\n\n/**\n * The correlation id for this request — generated, or taken from an inbound\n * `X-Request-ID`.\n *\n * Log it. It is the only thing that ties a line written inside a function to\n * the framework's own lines for the same request.\n */\nexport function getRequestId(c: CtxLike): string | undefined {\n    return read(c, \"requestId\");\n}\n\n/**\n * The signal aborted when this request outlasts the functions timeout and is\n * answered `504 FUNCTION_TIMEOUT`. Pass it to `fetch` and anything else that\n * takes one, so the work stops with the request instead of running on after\n * the caller was told it failed.\n *\n * Never aborts when the timeout is off, or outside the functions router.\n */\nexport function getSignal(c: CtxLike): AbortSignal {\n    return read(c, \"functionSignal\") ?? new AbortController().signal;\n}\n\n/**\n * Whether a Rebase auth middleware has run on this request.\n *\n * Both middlewares populate `driver` for *every* outcome, anonymous included,\n * and populate `user` whenever there is one. So \"neither is set\" does not mean\n * \"anonymous\" — it means nothing resolved the identity, and treating that as\n * anonymous is the dangerous reading. The guards use this to tell a genuinely\n * anonymous caller (401) from a misconfigured mount (500), because answering\n * 401 to the second sends whoever is debugging it to look at the token.\n */\nexport function identityResolved(c: CtxLike): boolean {\n    return read(c, \"user\") !== undefined || read(c, \"driver\") !== undefined;\n}\n","/**\n * Route guards for custom functions.\n *\n * These decide access from the identity the platform already resolved. They do\n * **not** verify tokens, and that division is the point rather than a\n * limitation:\n *\n * - Verifying a token needs a signing key, constant-time comparison and a\n *   revocation lookup. That is host work, it belongs to the process that holds\n *   the secret, and it is the part of the stack that cannot be made\n *   runtime-neutral without rewriting it against WebCrypto.\n * - Deciding whether *this* caller may call *this* route is application work.\n *   It needs nothing but the resolved identity, so it costs nothing to make it\n *   portable — and it is the half that lives in user code.\n *\n * Splitting there is what lets a function file compile and run unchanged on a\n * host with no Node built-ins, and it is why these live in\n * `@rebasepro/server/functions` while `verifyAccessToken` does not.\n *\n * **Inside the functions router these are equivalent to the guards exported\n * from the package root.** Both auth middlewares resolve the identity before\n * any handler runs: a valid credential populates `user`, an invalid one is\n * rejected with 401 by the middleware itself, and a missing one leaves `user`\n * unset. So the root `requireAuth`'s token-parsing branch is unreachable from a\n * function, and removing it changes no outcome. The one difference is a handler\n * mounted **outside** the framework's router, where no middleware ran: the root\n * guard would parse the `Authorization` header itself, and these refuse the\n * request with a 500 that names the wiring problem. Fail-closed, and legible.\n *\n * @module\n */\nimport type { Context, MiddlewareHandler } from \"hono\";\nimport type { HonoEnv } from \"../api/types\";\nimport { getUser, isAdmin, getRoles, identityResolved, hasScope } from \"./context\";\n\n/**\n * The answer to \"a guard ran, but no middleware had resolved anything\".\n *\n * Deliberately a 500 and not a 401. A 401 tells the caller their credential is\n * the problem, and here the caller's credential was never looked at — sending\n * them to check their token is sending them to the one place the answer is not.\n */\nfunction unresolvedIdentity(): { error: { message: string; code: string } } {\n    return {\n        error: {\n            message:\n                \"This route's identity was never resolved: no Rebase auth middleware ran \" +\n                \"before the guard. A function loaded from the functions directory always \" +\n                \"has one. This usually means the Hono app was mounted onto your own \" +\n                \"server directly, bypassing the functions router.\",\n            code: \"AUTH_MIDDLEWARE_MISSING\"\n        }\n    };\n}\n\n/**\n * Reject anonymous callers with 401.\n *\n * Put it in the route's own middleware slot rather than `app.use(\"/*\", …)`:\n * `use()` covers only the routes declared *below* it, so a route appended later\n * — by you, months from now, at the bottom of the file — is silently\n * unprotected. The per-route form cannot drift that way.\n *\n * @example\n * ```ts\n * app.post(\"/\", requireAuth, async (c) => {\n *     const user = getUser(c)!;  // guaranteed by the guard\n *     return c.json({ uid: user.uid });\n * });\n * ```\n */\nexport const requireAuth: MiddlewareHandler<HonoEnv> = async (c, next) => {\n    if (getUser(c)) return next();\n    if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n\n    return c.json({\n        error: {\n            message: \"Authentication required\",\n            code: \"UNAUTHORIZED\"\n        }\n    }, 401);\n};\n\n/**\n * Reject callers without the `admin` role with 403.\n *\n * Must come **after** {@link requireAuth}: on its own it answers 401 for an\n * anonymous caller, which is right, but pairing them keeps the two failures\n * distinguishable — 401 \"who are you\", 403 \"not you\".\n *\n * Prefer {@link requireScope} for anything an app declares a scope for: a\n * scope can be granted to a narrower role and to a key, and `admin` cannot.\n */\nexport const requireAdmin: MiddlewareHandler<HonoEnv> = async (c, next) => {\n    const user = getUser(c);\n    if (!user) {\n        if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n        return c.json({\n            error: {\n                message: \"Authentication required\",\n                code: \"UNAUTHORIZED\"\n            }\n        }, 401);\n    }\n\n    if (!isAdmin(c)) {\n        return c.json({\n            error: {\n                message: \"Admin privileges required for this operation\",\n                code: \"FORBIDDEN\"\n            }\n        }, 403);\n    }\n\n    return next();\n};\n\n/**\n * Reject callers holding none of the named roles with 403.\n *\n * Any of them, not all — require several by chaining the guard twice. Naming no\n * role at all is a programming error and throws at module load rather than at\n * request time, because `requireRole()` with an empty list would otherwise read\n * as a guard while admitting everyone.\n *\n * @example\n * ```ts\n * app.post(\"/publish\", requireAuth, requireRole(\"editor\", \"admin\"), handler);\n * ```\n */\nexport function requireRole(...roles: string[]): MiddlewareHandler<HonoEnv> {\n    if (roles.length === 0) {\n        throw new Error(\n            \"requireRole() needs at least one role. An empty list would admit every \" +\n            \"signed-in caller while reading as a restriction.\"\n        );\n    }\n\n    const allowed = new Set(roles);\n    return async (c, next) => {\n        const user = getUser(c);\n        if (!user) {\n            if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n            return c.json({\n                error: {\n                    message: \"Authentication required\",\n                    code: \"UNAUTHORIZED\"\n                }\n            }, 401);\n        }\n\n        if (!getRoles(c).some(role => allowed.has(role))) {\n            return c.json({\n                error: {\n                    message: `This operation requires one of these roles: ${roles.join(\", \")}`,\n                    code: \"FORBIDDEN\"\n                }\n            }, 403);\n        }\n\n        return next();\n    };\n}\n\n/**\n * Reject callers who do not hold `scope` with 403.\n *\n * `scope` is a built-in scope or one the app declares under `auth.scopes` on\n * the users collection. `target` narrows it to one resource — a key holding\n * `project:deploy:p1` passes `requireScope(\"project:deploy\", c => c.req.param(\"project\"))`\n * for `p1` only — and may be read from the request.\n *\n * A signed-in person holds every app scope, so for a person this is no\n * authorization at all: it narrows API keys and tokens. Decide whether the\n * person may act in the handler, as you would without it.\n *\n * @example\n * ```ts\n * app.post(\"/deploy/:project\", requireAuth, requireScope(\"project:deploy\", c => c.req.param(\"project\")), handler);\n * ```\n */\nexport function requireScope(\n    scope: string,\n    target?: string | ((c: Context<HonoEnv>) => string | undefined)\n): MiddlewareHandler<HonoEnv> {\n    return async (c, next) => {\n        if (!getUser(c)) {\n            if (!identityResolved(c)) return c.json(unresolvedIdentity(), 500);\n            return c.json({\n                error: {\n                    message: \"Authentication required\",\n                    code: \"UNAUTHORIZED\"\n                }\n            }, 401);\n        }\n        const resolvedTarget = typeof target === \"function\" ? target(c) : target;\n        if (!hasScope(c, scope, resolvedTarget)) {\n            const wanted = resolvedTarget !== undefined ? `${scope}:${resolvedTarget}` : scope;\n            return c.json({\n                error: {\n                    message: `This credential does not hold the \"${wanted}\" scope.`,\n                    code: \"SCOPE_MISSING\",\n                    details: { requiredScope: wanted }\n                }\n            }, 403);\n        }\n        return next();\n    };\n}\n","import { Hono } from \"hono\";\nimport { HonoEnv } from \"../api/types\";\nimport { ApiError } from \"../api/errors\";\nimport { LoadedFunction } from \"./function-loader\";\nimport { requireAuth } from \"./guards\";\n\n/** The file a loader problem names, without its extension: `broken.ts (threw: …)` → `broken`. */\nfunction problemName(problem: string): string {\n    return problem.split(\" \")[0].replace(/\\/$/, \"\").replace(/\\.[cm]?[jt]s$/, \"\");\n}\n\n/**\n * Mount all loaded function routes under a single Hono router.\n *\n * Each function is mounted at `/<function-name>`, preserving\n * whatever HTTP methods and middleware the Hono sub-app defines.\n *\n * @param functions What loaded. May be empty — the router still mounts, so\n *   \"no functions are served\" answers 200 with an empty list instead of 404.\n * @param problems The files the loader saw and could not serve, as\n *   `\"<file> (<reason>)\"`. The listing reports a count and a pointer to the log,\n *   not the reasons: those carry import errors, and the listing is one guard\n *   away from anyone. The unmatched-route handler uses the *names* to answer the\n *   one question a 404 on a function nobody can find should answer — \"there is a\n *   file for this and it did not load\" — which is the difference between a typo\n *   and a broken deploy, and the loader was the only thing that knew.\n */\nexport function createFunctionRoutes(\n    functions: LoadedFunction[],\n    problems: string[] = [],\n    /**\n     * Where this router is mounted, so the listing can report a path a caller\n     * can actually request. It used to hardcode `/functions/<name>`, which is\n     * wrong under every `basePath` including the default `/api`. The\n     * `mountPath` a functions group records for the request wins over it.\n     */\n    mountPath = \"/functions\"\n): Hono<HonoEnv> {\n    const router = new Hono<HonoEnv>();\n    const skipped = problems.length;\n\n    // Listing endpoint: GET / → list available functions.\n    //\n    // Functions themselves stay anonymous-callable by default — a webhook\n    // receiver has to be — but the index of them does not: it is an inventory\n    // of every custom endpoint, for whoever asks. `requireAuth` admits any\n    // resolved identity (a signed-in user, an API key, the service key), so\n    // `rebase doctor` and `rebase cloud debug` keep their answer; the latter\n    // already reads a 401 here as \"mounted\".\n    router.get(\"/\", requireAuth, (c) => {\n        const at = c.get(\"mountPath\") ?? mountPath;\n        return c.json({\n            functions: functions.map((fn) => ({\n                name: fn.name,\n                endpoint: `${at}/${fn.name}`\n            })),\n            ...(skipped > 0 && {\n                skipped,\n                note: `${skipped} function file(s) failed to load and are NOT served — see the server log for the reason.`\n            })\n        });\n    });\n\n    for (const fn of functions) {\n        router.route(`/${fn.name}`, fn.app);\n    }\n\n    // A name that matches nothing, answered in the envelope.\n    //\n    // Registered last so every real route wins it. Without it, a typo'd\n    // function name — the single most likely 404 a developer meets on this\n    // surface — fell through to Hono's default `404 Not Found` as `text/plain`,\n    // and through the SDK arrived as `RebaseApiError { code: undefined }`, so\n    // the documented `e.code === \"FUNCTION_NOT_FOUND\"` branch never ran.\n    //\n    // What the message may say depends on who is asking. The mounted names are\n    // an inventory of every custom endpoint, which is exactly what the listing\n    // above requires an identity to see — so an anonymous caller is told their\n    // name is unknown and nothing more, and a resolved caller gets the list\n    // that turns the 404 into a fix.\n    const mounted = new Set(functions.map(fn => fn.name));\n    const failedToLoad = new Map(problems.map(p => [problemName(p), p.split(\" \")[0]]));\n\n    router.all(\"/:name{.*}\", (c): never => {\n        const requested = (c.req.param(\"name\") ?? \"\").split(\"/\").filter(Boolean);\n        const name = requested[0] ?? \"\";\n        const rest = requested.slice(1).join(\"/\");\n        const identified = Boolean(c.get(\"user\"));\n\n        const refuse = (message: string): never => {\n            throw new ApiError(404, \"FUNCTION_NOT_FOUND\", message, { function: name }, true);\n        };\n\n        if (!name) {\n            refuse(`No function in the request path. Expected ${c.get(\"mountPath\") ?? mountPath}/<function>.`);\n        }\n        if (mounted.has(name)) {\n            refuse(\n                `The function '${name}' is served, and has no ${c.req.method} route at '/${rest}'. ` +\n                \"The path after the function name is routed by the function's own Hono app.\"\n            );\n        }\n        // The file name is the same inventory, a file at a time — and it\n        // names a source file besides — so it is told to an identified caller\n        // only. An anonymous one gets exactly the answer a name that matches\n        // nothing gets.\n        const file = failedToLoad.get(name);\n        if (file && identified) {\n            refuse(\n                `The function '${name}' is not served: '${file}' failed to load. ` +\n                \"The server log records why, at boot.\"\n            );\n        }\n        return refuse(\n            `No function named '${name}' on this backend.` +\n            (identified\n                ? (mounted.size > 0\n                    ? ` This backend serves: ${[...mounted].sort().join(\", \")}.`\n                    : \" This backend serves no functions.\")\n                : \"\") +\n            (skipped > 0 && identified\n                ? ` ${skipped} function file(s) failed to load and are not served — see the server log.`\n                : \"\")\n        );\n    });\n\n    return router;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAcA,IAAa,kBAAkB;;AAG/B,SAAgB,eAAe,OAAsD;CACjF,OAAO,CAAC,CAAC,OAAO,SAAS,eAAe;AAC5C;;;ACqCA,SAAS,KACL,GACA,KACmC;CAInC,OAAQ,EAAuB,IAAI,GAAG;AAC1C;;;;;;;;;;;;;;;AAgBA,SAAgB,QAAQ,GAAsC;CAC1D,MAAM,MAAM,KAAK,GAAG,MAAM;CAC1B,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO,KAAA;CAE5C,MAAM,SAAS;CACf,MAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,KAAA;CAC1D,IAAI,QAAQ,KAAA,GAAW,OAAO,KAAA;CAE9B,MAAM,QAAQ,MAAM,QAAQ,OAAO,KAAK,IAClC,OAAO,MAAM,QAAQ,SAAyB,OAAO,SAAS,QAAQ,IACtE,CAAC;CAEP,OAAO;EAAE,GAAG;EACR;EACA;CAAM;AACd;;AAGA,SAAgB,UAAU,GAAgC;CACtD,OAAO,QAAQ,CAAC,CAAC,EAAE;AACvB;;AAGA,SAAgB,SAAS,GAAsB;CAC3C,OAAO,QAAQ,CAAC,CAAC,EAAE,SAAS,CAAC;AACjC;;;;;;;AAQA,SAAgB,QAAQ,GAAY,GAAG,OAA0B;CAC7D,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,MAAM,OAAO,IAAI,IAAI,SAAS,CAAC,CAAC;CAChC,OAAO,MAAM,MAAK,SAAQ,KAAK,IAAI,IAAI,CAAC;AAC5C;;AAGA,SAAgB,QAAQ,GAAqB;CACzC,OAAO,eAAe,SAAS,CAAC,CAAC;AACrC;;AA2BA,SAAgB,gBAAgB,GAAqB;CACjD,OAAO,QAAQ,CAAC,MAAM,KAAA;AAC1B;;;;;;;;;;;;;;;AAgBA,SAAgB,UAAU,GAAoC;CAC1D,OAAO,KAAK,GAAG,QAAQ;AAC3B;;;;;;;;;AAUA,SAAgB,cAAc,GAAwB;CAClD,MAAM,SAAS,UAAU,CAAC;CAC1B,IAAI,CAAC,QACD,MAAM,IAAI,MACN,6UAKJ;CAEJ,OAAO;AACX;;;;;;;;AASA,SAAgB,UAAU,GAAsC;CAC5D,OAAO,KAAK,GAAG,QAAQ;AAC3B;;;;;;;;AASA,SAAgB,aAAa,GAAgC;CACzD,OAAO,KAAK,GAAG,WAAW;AAC9B;;;;;;;;;;;AAwBA,SAAgB,iBAAiB,GAAqB;CAClD,OAAO,KAAK,GAAG,MAAM,MAAM,KAAA,KAAa,KAAK,GAAG,QAAQ,MAAM,KAAA;AAClE;;;;;;;;;;ACrMA,SAAS,qBAAmE;CACxE,OAAO,EACH,OAAO;EACH,SACI;EAIJ,MAAM;CACV,EACJ;AACJ;;;;;;;;;;;;;;;;;AAkBA,IAAa,cAA0C,OAAO,GAAG,SAAS;CACtE,IAAI,QAAQ,CAAC,GAAG,OAAO,KAAK;CAC5B,IAAI,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAAE,KAAK,mBAAmB,GAAG,GAAG;CAEjE,OAAO,EAAE,KAAK,EACV,OAAO;EACH,SAAS;EACT,MAAM;CACV,EACJ,GAAG,GAAG;AACV;;;;;;;;;;;;;;AAiDA,SAAgB,YAAY,GAAG,OAA6C;CACxE,IAAI,MAAM,WAAW,GACjB,MAAM,IAAI,MACN,yHAEJ;CAGJ,MAAM,UAAU,IAAI,IAAI,KAAK;CAC7B,OAAO,OAAO,GAAG,SAAS;EAEtB,IAAI,CADS,QAAQ,CAChB,GAAM;GACP,IAAI,CAAC,iBAAiB,CAAC,GAAG,OAAO,EAAE,KAAK,mBAAmB,GAAG,GAAG;GACjE,OAAO,EAAE,KAAK,EACV,OAAO;IACH,SAAS;IACT,MAAM;GACV,EACJ,GAAG,GAAG;EACV;EAEA,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,MAAK,SAAQ,QAAQ,IAAI,IAAI,CAAC,GAC3C,OAAO,EAAE,KAAK,EACV,OAAO;GACH,SAAS,+CAA+C,MAAM,KAAK,IAAI;GACvE,MAAM;EACV,EACJ,GAAG,GAAG;EAGV,OAAO,KAAK;CAChB;AACJ;;;;;AC3JA,SAAS,YAAY,SAAyB;CAC1C,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,QAAQ,iBAAiB,EAAE;AAC/E;;;;;;;;;;;;;;;;;AAkBA,SAAgB,qBACZ,WACA,WAAqB,CAAC,GAOtB,YAAY,cACC;CACb,MAAM,SAAS,IAAI,KAAc;CACjC,MAAM,UAAU,SAAS;CAUzB,OAAO,IAAI,KAAK,cAAc,MAAM;EAChC,MAAM,KAAK,EAAE,IAAI,WAAW,KAAK;EACjC,OAAO,EAAE,KAAK;GACV,WAAW,UAAU,KAAK,QAAQ;IAC9B,MAAM,GAAG;IACT,UAAU,GAAG,GAAG,GAAG,GAAG;GAC1B,EAAE;GACF,GAAI,UAAU,KAAK;IACf;IACA,MAAM,GAAG,QAAQ;GACrB;EACJ,CAAC;CACL,CAAC;CAED,KAAK,MAAM,MAAM,WACb,OAAO,MAAM,IAAI,GAAG,QAAQ,GAAG,GAAG;CAgBtC,MAAM,UAAU,IAAI,IAAI,UAAU,KAAI,OAAM,GAAG,IAAI,CAAC;CACpD,MAAM,eAAe,IAAI,IAAI,SAAS,KAAI,MAAK,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;CAEjF,OAAO,IAAI,eAAe,MAAa;EACnC,MAAM,aAAa,EAAE,IAAI,MAAM,MAAM,KAAK,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EACvE,MAAM,OAAO,UAAU,MAAM;EAC7B,MAAM,OAAO,UAAU,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;EACxC,MAAM,aAAa,QAAQ,EAAE,IAAI,MAAM,CAAC;EAExC,MAAM,UAAU,YAA2B;GACvC,MAAM,IAAI,SAAS,KAAK,sBAAsB,SAAS,EAAE,UAAU,KAAK,GAAG,IAAI;EACnF;EAEA,IAAI,CAAC,MACD,OAAO,6CAA6C,EAAE,IAAI,WAAW,KAAK,UAAU,aAAa;EAErG,IAAI,QAAQ,IAAI,IAAI,GAChB,OACI,iBAAiB,KAAK,0BAA0B,EAAE,IAAI,OAAO,cAAc,KAAK,8EAEpF;EAMJ,MAAM,OAAO,aAAa,IAAI,IAAI;EAClC,IAAI,QAAQ,YACR,OACI,iBAAiB,KAAK,oBAAoB,KAAK,uDAEnD;EAEJ,OAAO,OACH,sBAAsB,KAAK,uBAC1B,aACM,QAAQ,OAAO,IACZ,yBAAyB,CAAC,GAAG,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,KACxD,uCACJ,OACL,UAAU,KAAK,aACV,IAAI,QAAQ,6EACZ,GACV;CACJ,CAAC;CAED,OAAO;AACX"}

package/dist/functions/context.d.ts

@@ -138,6 +138,15 @@ export declare function getApiKey(c: CtxLike): ApiKeyMasked | undefined;
  * the framework's own lines for the same request.
  */
 export declare function getRequestId(c: CtxLike): string | undefined;
+/**
+ * The signal aborted when this request outlasts the functions timeout and is
+ * answered `504 FUNCTION_TIMEOUT`. Pass it to `fetch` and anything else that
+ * takes one, so the work stops with the request instead of running on after
+ * the caller was told it failed.
+ *
+ * Never aborts when the timeout is off, or outside the functions router.
+ */
+export declare function getSignal(c: CtxLike): AbortSignal;
 /**
  * Whether a Rebase auth middleware has run on this request.
  *

package/dist/functions/define-function.d.ts

@@ -1,5 +1,5 @@
 import { Hono } from "hono";
-import type { RebaseServerClient } from "@rebasepro/types";
+import type { RebaseServerClient, RegisteredDatabase } from "@rebasepro/types";
 import type { HonoEnv } from "../api/types.js";
 /**
  * Typed context injected into a function authored with {@link defineFunction}.
@@ -10,10 +10,11 @@ import type { HonoEnv } from "../api/types.js";
  * on the Hono context via {@link HonoEnv} — read them with `c.get("user")`
  * / `c.var.driver` inside a handler.
  */
-export interface RebaseFunctionContext {
+export interface RebaseFunctionContext<DB = RegisteredDatabase> {
     /**
-     * The server-side Rebase singleton (`dataAsAdmin`, `auth`, `storage`,
-     * `email`, `sql`).
+     * The server-side Rebase client (`dataAsAdmin`, `auth`, `storage`,
+     * `email`, `sql`) of the backend serving the request — the same object
+     * the imported `rebase` is there.
      *
      * `rebase.dataAsAdmin` runs as the service identity
      * `{ uid: "service", roles: ["admin"] }` — **admin-scoped, not an RLS
@@ -36,8 +37,11 @@ export interface RebaseFunctionContext {
      * (`c.var.driver`), which carries the caller's identity. (`rebase.data` no
      * longer exists on this type — `dataAsAdmin` is the only name for the
      * admin-scoped accessor.)
+     *
+     * Typed from the `Database` the project registered on `Register`, or from
+     * the type argument of `defineFunction<Database>(…)`; untyped otherwise.
      */
-    rebase: RebaseServerClient;
+    rebase: RebaseServerClient<DB>;
 }
 /**
  * Typed authoring contract for a custom backend function.
@@ -74,4 +78,4 @@ export interface RebaseFunctionContext {
  *   own `Hono<HonoEnv>` app to use instead.
  * @returns The Hono app to default-export from the function file.
  */
-export declare function defineFunction(definition: (app: Hono<HonoEnv>, ctx: RebaseFunctionContext) => void | Hono<HonoEnv>): Hono<HonoEnv>;
+export declare function defineFunction<DB = RegisteredDatabase>(definition: (app: Hono<HonoEnv>, ctx: RebaseFunctionContext<DB>) => void | Hono<HonoEnv>): Hono<HonoEnv>;

package/dist/functions/function-loader.d.ts

@@ -1,10 +1,66 @@
 import { Hono } from "hono";
+import type { HonoEnv } from "../api/types.js";
 import { type ModuleImporter } from "../utils/dynamic-import.js";
+/**
+ * One custom function: a Hono app, served at `<functions mount>/<name>`.
+ *
+ * What `defineFunction(...)` returns, and what a function file default-exports:
+ * a Hono app over {@link HonoEnv}, the environment a function runs in — build
+ * one by hand as `new Hono<HonoEnv>()`. Any Hono-compatible app works at
+ * runtime — the loader checks for `.fetch()` and `.routes` rather than an
+ * `instanceof`, because a project and the server can hold two copies of hono.
+ */
+export type FunctionApp = Hono<HonoEnv>;
+/**
+ * Functions as values: the URL segment each one answers at, to its app.
+ *
+ * `functions: { "send-invoice": sendInvoice }` serves `sendInvoice` at
+ * `/api/functions/send-invoice` — the same thing a file named
+ * `functions/send-invoice.ts` does. {@link loadFunctions} returns exactly this
+ * shape, so `functions: await loadFunctions(dir)` and `functionsDir: dir` serve
+ * the same routes.
+ */
+export type FunctionsRecord = Record<string, FunctionApp>;
+/** How a directory of modules is read. Shared by the function and cron loaders. */
+export interface LoadDirectoryOptions {
+    /**
+     * How a module file is imported. Defaults to the runtime's own `import()`;
+     * a caller with its own loader hooks (tsx, a test runner's sandbox) passes
+     * `url => import(url)` so they apply.
+     */
+    importModule?: ModuleImporter;
+    /**
+     * Called once for every file the loader saw and did **not** load, as
+     * `<file> (<reason>)`. The files are skipped either way — one malformed
+     * file must not take the others with it — and logged; this is how a caller
+     * reports them anywhere else.
+     */
+    onSkip?: (problem: string) => void;
+}
+/**
+ * Load the custom functions in a directory, as values.
+ *
+ * Each file default-exports a Hono app — `defineFunction(...)` — or a factory
+ * returning one. The filename without its extension is the record key, which
+ * is the URL segment it is served at: `functions/send-invoice.ts` →
+ * `{ "send-invoice": app }`. Only the top level is read.
+ *
+ * Never throws for a bad file: it is skipped, logged, and passed to
+ * `options.onSkip`.
+ *
+ * @example
+ * ```ts
+ * const functions = await loadFunctions(path.resolve("functions"));
+ * const backend = await createRebaseBackend({ database, functions, provision: true });
+ * ```
+ */
+export declare function loadFunctions(directory: string, options?: LoadDirectoryOptions): Promise<FunctionsRecord>;
+/** A loaded function, by name. The shape {@link createFunctionRoutes} mounts. */
 export interface LoadedFunction {
     /** Endpoint name derived from filename (e.g., "send-invoice") */
     name: string;
     /** The Hono sub-app to mount */
-    app: Hono<import("hono").Env>;
+    app: FunctionApp;
 }
 /** What a directory of function files produced: what mounted, and what did not. */
 export interface LoadedFunctions {
@@ -12,30 +68,31 @@ export interface LoadedFunctions {
     functions: LoadedFunction[];
     /**
      * One entry per file the loader saw and did **not** mount, each already
-     * phrased as `<name> (<reason>)`. Returned rather than only logged so the
-     * running server can say what is missing — a boot log line is not reachable
-     * from `GET /api/functions`.
+     * phrased as `<name> (<reason>)`.
      */
     problems: string[];
 }
+/** A record of functions as the list {@link createFunctionRoutes} mounts, in record order. */
+export declare function functionList(functions: FunctionsRecord): LoadedFunction[];
 /**
- * Auto-discover Hono route files from a directory.
- *
- * Each file should default-export a Hono app (or router).
- * The filename (without extension) becomes the mount path:
- *   `functions/send-invoice.ts` → mounted at `/send-invoice`
- *
- * This mirrors how `loadCollectionsFromDirectory` works for collections.
- *
- * Returns only what loaded. Use {@link loadFunctionsWithDiagnostics} when the
- * caller also needs to report what did not.
+ * @deprecated Use `loadFunctions` instead, which returns the functions as a
+ * record keyed by name. Will be removed in a future release.
  */
 export declare function loadFunctionsFromDirectory(directory: string, importModule?: ModuleImporter): Promise<LoadedFunction[]>;
 /**
- * {@link loadFunctionsFromDirectory}, plus the list of files that were skipped.
+ * @deprecated Use `loadFunctions` instead, with `onSkip` to collect the files
+ * it skipped. Will be removed in a future release.
+ */
+export declare function loadFunctionsWithDiagnostics(directory: string, importModule?: ModuleImporter): Promise<LoadedFunctions>;
+/**
+ * Read a directory of function files: what loaded, keyed by name, and one
+ * `<file> (<reason>)` per file that did not.
  *
  * Never throws: a single malformed function must not crash server boot. The
- * caller decides what to do with `problems` — `init.ts` mounts the router
- * regardless and surfaces the count on the listing endpoint.
+ * backend mounts the router regardless and surfaces the count of skipped files
+ * on the listing endpoint.
  */
-export declare function loadFunctionsWithDiagnostics(directory: string, importModule?: ModuleImporter): Promise<LoadedFunctions>;
+export declare function readFunctionsDirectory(directory: string, importModule?: ModuleImporter): Promise<{
+    functions: FunctionsRecord;
+    problems: string[];
+}>;

package/dist/functions/function-routes.d.ts

@@ -21,6 +21,7 @@ export declare function createFunctionRoutes(functions: LoadedFunction[], proble
 /**
  * Where this router is mounted, so the listing can report a path a caller
  * can actually request. It used to hardcode `/functions/<name>`, which is
- * wrong under every `basePath` including the default `/api`.
+ * wrong under every `basePath` including the default `/api`. The
+ * `mountPath` a functions group records for the request wins over it.
  */
 mountPath?: string): Hono<HonoEnv>;

package/dist/functions/index.d.ts

@@ -67,12 +67,13 @@ export type { RebaseFunctionContext } from "./define-function.js";
  *
  * It is safe to hold at module scope, unlike a configuration value, because it
  * is a lazy Proxy: nothing is resolved until a property is read, which happens
- * inside a request. That indirection is also the whole of what a future
- * isolate-based host has to hook — see `_setRebaseResolver` in
- * `../singleton.ts`.
+ * inside a request — and it resolves to the backend serving that request, so
+ * with two backends in one process each one's functions see their own. That
+ * indirection is the whole of what a host hooks — the Node server per request,
+ * an isolate host per isolate — see `_setRebaseResolver` in `../singleton.ts`.
  */
 export { rebase } from "../singleton.js";
-export { getUser, getUserId, getRoles, hasRole, isAdmin, getScopes, hasScope, isAuthenticated, getDriver, requireDriver, getApiKey, getRequestId, identityResolved } from "./context.js";
+export { getUser, getUserId, getRoles, hasRole, isAdmin, getScopes, hasScope, isAuthenticated, getDriver, requireDriver, getApiKey, getRequestId, getSignal, identityResolved } from "./context.js";
 export type { FunctionUser } from "./context.js";
 export { requireAuth, requireAdmin, requireRole, requireScope } from "./guards.js";
 export { getEnv, env, requireEnv, runtimeKey, isNodeRuntime, lazyResource } from "./runtime-env.js";

package/dist/functions/index.js

@@ -96,13 +96,15 @@ var INSTANCE_SLOT = Symbol.for("@rebasepro/server:singleton-instance");
 * A *function* that answers "which client is this call for", for hosts where
 * one answer per process is the wrong shape.
 *
-* A Node server boots once and serves every request from the same client, so
-* {@link INSTANCE_SLOT} is the whole story. An isolate-based host is different
-* in a way that matters: the environment arrives attached to the **request**,
-* not to the module, so there is nothing to publish at import time, and an
-* isolate can be reused across requests that must not share state. Such a host
-* registers a resolver — typically reading an `AsyncLocalStorage` populated per
-* request — and it is consulted first.
+* {@link INSTANCE_SLOT} is one answer per process: the default backend's. A
+* Node process can hold several backends, and the code each one runs — a
+* function, a cron job, a hook — must see that one, so the server registers a
+* resolver reading the backend scope it enters per request (an
+* `AsyncLocalStorage`, host-side, in `backend/scope.ts`). An isolate-based
+* host is different in the same way: the environment arrives attached to the
+* **request**, not to the module, so there is nothing to publish at import
+* time, and an isolate can be reused across requests that must not share
+* state. The resolver is consulted first.
 *
 * This exists now, before there is a host that needs it, because of what it
 * protects: `rebase` is a lazy Proxy, so every property access already goes
@@ -123,10 +125,13 @@ function getInstance() {
 	return global[INSTANCE_SLOT] ?? null;
 }
 /**
-* The server-side Rebase singleton.
+* The server-side Rebase client, as a module-level handle.
 *
-* Initialized automatically during server startup. Provides access to all
-* app-scoped services: **data**, **auth**, **storage**, and **email**.
+* Inside a request, cron run or job a backend serves, it is that backend's
+* client (`backend.rebase`) — so with two backends in one process, each one's
+* functions see their own. Anywhere else it is the process default's, which
+* `initializeRebaseBackend` (or `setDefaultBackend`) installs. Provides access
+* to all app-scoped services: **data**, **auth**, **storage**, and **email**.
 *
 * **Admin data plane** (`rebase.dataAsAdmin`):
 * Backed by the native DataDriver — calls go directly to the database without
@@ -185,12 +190,25 @@ var rebase = new Proxy({}, {
 		return instance[prop];
 	},
 	set(_, prop) {
-		throw new Error(`Cannot set rebase.${String(prop)} directly. The singleton is read-only. Use _initRebase() during server startup.`);
+		throw new Error(`Cannot set rebase.${String(prop)} directly. The singleton is read-only. Install a backend with setDefaultBackend(backend), or use backend.rebase.`);
 	}
 });
 //#endregion
 //#region src/functions/define-function.ts
 /**
+* The `rebase` handle, seen through the `Database` a function names.
+*
+* One object serves every function; `DB` only describes it. It resolves, per
+* call, to the backend serving the request — the same answer the imported
+* `rebase` gives. Each collection accessor on `dataAsAdmin` is resolved by
+* name at call time, so a generated `Database` adds compile-time checks and
+* changes nothing the object does — the same reason the browser client's
+* `createRebaseClient<Database>()` is one implementation for every `Database`.
+*/
+function typedSingleton() {
+	return rebase;
+}
+/**
 * Typed authoring contract for a custom backend function.
 *
 * A custom function is a file in the `functionsDir` that default-exports a
@@ -227,7 +245,7 @@ var rebase = new Proxy({}, {
 */
 function defineFunction(definition) {
 	const app = new Hono();
-	const returned = definition(app, { rebase });
+	const returned = definition(app, { rebase: typedSingleton() });
 	return returned instanceof Hono ? returned : app;
 }
 //#endregion
@@ -393,6 +411,17 @@ function getRequestId(c) {
 	return read(c, "requestId");
 }
 /**
+* The signal aborted when this request outlasts the functions timeout and is
+* answered `504 FUNCTION_TIMEOUT`. Pass it to `fetch` and anything else that
+* takes one, so the work stops with the request instead of running on after
+* the caller was told it failed.
+*
+* Never aborts when the timeout is off, or outside the functions router.
+*/
+function getSignal(c) {
+	return read(c, "functionSignal") ?? new AbortController().signal;
+}
+/**
 * Whether a Rebase auth middleware has run on this request.
 *
 * Both middlewares populate `driver` for *every* outcome, anonymous included,
@@ -1078,6 +1107,6 @@ var ApiError = class ApiError extends Error {
 	}
 };
 //#endregion
-export { ApiError, defineFunction, env, getApiKey, getDriver, getEnv, getRequestId, getRoles, getScopes, getUser, getUserId, hasRole, hasScope, identityResolved, isAdmin, isAuthenticated, isNodeRuntime, lazyResource, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, requireScope, runtimeKey, waitUntil };
+export { ApiError, defineFunction, env, getApiKey, getDriver, getEnv, getRequestId, getRoles, getScopes, getSignal, getUser, getUserId, hasRole, hasScope, identityResolved, isAdmin, isAuthenticated, isNodeRuntime, lazyResource, rebase, requireAdmin, requireAuth, requireDriver, requireEnv, requireRole, requireScope, runtimeKey, waitUntil };
 
 //# sourceMappingURL=index.js.map