@rebasepro/types 0.10.0 → 0.10.1-canary.14e53ae

package/src/types/index.ts

@@ -16,6 +16,7 @@ export * from "./modify_collections";
 export * from "./formex";
 export * from "./websockets";
 export * from "./backend";
+export * from "./channel_bus";
 export * from "./translations";
 export * from "./plugins";
 export * from "./builders";
@@ -33,4 +34,8 @@ export * from "./database_adapter";
 export * from "./breadcrumbs";
 export * from "./component_overrides";
 export * from "./api_keys";
+export * from "./project_manifest";
+export * from "./collection_contract";
+export * from "./schema_version";
+export * from "./storage_authorize";
 

package/src/types/policy.ts

@@ -258,21 +258,35 @@ export interface AuthRolesPolicyOperand {
 export const policy = {
     true: (): TruePolicyExpression => ({ kind: "true" }),
     false: (): FalsePolicyExpression => ({ kind: "false" }),
-    and: (...operands: readonly PolicyExpression[]): AndPolicyExpression => ({ kind: "and", operands: operands as PolicyExpression[] }),
-    or: (...operands: readonly PolicyExpression[]): OrPolicyExpression => ({ kind: "or", operands: operands as PolicyExpression[] }),
-    not: (operand: PolicyExpression): NotPolicyExpression => ({ kind: "not", operand }),
+    and: (...operands: readonly PolicyExpression[]): AndPolicyExpression => ({ kind: "and",
+operands: operands as PolicyExpression[] }),
+    or: (...operands: readonly PolicyExpression[]): OrPolicyExpression => ({ kind: "or",
+operands: operands as PolicyExpression[] }),
+    not: (operand: PolicyExpression): NotPolicyExpression => ({ kind: "not",
+operand }),
     compare: (left: PolicyOperand, op: PolicyCompareOperator, right: PolicyOperand): ComparePolicyExpression =>
-        ({ kind: "compare", op, left, right }),
-    rolesOverlap: (roles: readonly string[]): RolesOverlapPolicyExpression => ({ kind: "rolesOverlap", roles: roles as string[] }),
-    rolesContain: (roles: readonly string[]): RolesContainPolicyExpression => ({ kind: "rolesContain", roles: roles as string[] }),
+        ({ kind: "compare",
+op,
+left,
+right }),
+    rolesOverlap: (roles: readonly string[]): RolesOverlapPolicyExpression => ({ kind: "rolesOverlap",
+roles: roles as string[] }),
+    rolesContain: (roles: readonly string[]): RolesContainPolicyExpression => ({ kind: "rolesContain",
+roles: roles as string[] }),
     authenticated: (): AuthenticatedPolicyExpression => ({ kind: "authenticated" }),
     serverContext: (): ServerContextPolicyExpression => ({ kind: "serverContext" }),
     existsIn: (args: { collection: string; where: PolicyExpression }): ExistsInPolicyExpression =>
-        ({ kind: "existsIn", collection: args.collection, where: args.where }),
-    raw: (sql: string): RawPolicyExpression => ({ kind: "raw", sql }),
-    field: (name: string): FieldPolicyOperand => ({ kind: "field", name }),
-    outerField: (name: string): OuterFieldPolicyOperand => ({ kind: "outerField", name }),
-    literal: (value: string | number | boolean | null): LiteralPolicyOperand => ({ kind: "literal", value }),
+        ({ kind: "existsIn",
+collection: args.collection,
+where: args.where }),
+    raw: (sql: string): RawPolicyExpression => ({ kind: "raw",
+sql }),
+    field: (name: string): FieldPolicyOperand => ({ kind: "field",
+name }),
+    outerField: (name: string): OuterFieldPolicyOperand => ({ kind: "outerField",
+name }),
+    literal: (value: string | number | boolean | null): LiteralPolicyOperand => ({ kind: "literal",
+value }),
     authUid: (): AuthUidPolicyOperand => ({ kind: "authUid" }),
     authRoles: (): AuthRolesPolicyOperand => ({ kind: "authRoles" })
 };

package/src/types/project_manifest.ts

@@ -0,0 +1,362 @@
+/**
+ * The project manifest (`rebase.json`) and the build artifacts derived from it.
+ *
+ * Three separate documents live in this file, and keeping them distinct matters:
+ *
+ * 1. {@link RebaseProjectManifest} — `rebase.json`. **Authored** by the developer,
+ *    committed to the repository. Declares topology only: which runtime major the
+ *    project targets, and which apps *this repository* contributes to the project.
+ *    Schema, security rules, hooks and functions stay in TypeScript under the
+ *    config package — nothing that needs a type system belongs here.
+ *
+ * 2. {@link RebaseProjectLink} — the per-checkout link (`.rebase/cloud.json`).
+ *    **Not committed**, because it is per-developer like a git remote. Says which
+ *    deployed project this working copy points at, whether that is a Rebase Cloud
+ *    project or the base URL of a self-hosted backend.
+ *
+ * 3. {@link RebaseBundleManifest} — `manifest.json` inside a built bundle.
+ *    **Generated**, never hand-edited. It is the lockfile analogue: the exact
+ *    contract a built artifact claims to satisfy, which the runtime validates
+ *    before it boots and a control plane validates before it deploys.
+ *
+ * A repository declares only the apps it contains. The set of apps belonging to a
+ * project is held by the project itself, which is what makes multi-repo projects
+ * work: two repositories never need to know about each other, only about the
+ * project.
+ */
+
+/**
+ * Which kind of thing an app is.
+ *
+ * - `backend` — the collections/hooks/functions that define the project's API.
+ *   Exactly one per *project* (not per repository); the registry enforces it.
+ * - `static`  — a pre-built client bundle (SPA, static site) served over CDN.
+ * - `admin`   — the Rebase admin panel, either hosted by the platform or built
+ *   into this repository.
+ * - `mobile`  — a native app. Registration only: it gets client credentials and
+ *   configuration, and is never built or hosted here.
+ * - `custom`  — an arbitrary container image built from a Dockerfile. The eject
+ *   hatch: full control, no managed-runtime guarantees.
+ */
+export type RebaseAppType = "backend" | "static" | "admin" | "mobile" | "custom";
+
+/**
+ * The backend app: the project's API surface.
+ *
+ * Paths are relative to the directory holding `rebase.json`. The defaults match
+ * the layout `rebase init` scaffolds, so a stock project may declare simply
+ * `{ "type": "backend" }`.
+ */
+export interface RebaseBackendAppConfig {
+    type: "backend";
+    /** Directory of the config package (collections + index). Default `config`. */
+    config?: string;
+    /** Directory of server functions. Default `backend/functions`. */
+    functions?: string;
+    /** Directory of cron job definitions. Default `backend/crons` when present. */
+    crons?: string;
+    /**
+     * Path to the generated Drizzle schema module (tables/enums/relations).
+     * Default `backend/src/schema.generated.ts`.
+     */
+    schema?: string;
+    /**
+     * Which collections source the runtime uses.
+     *
+     * - `cms` (default) — collections come from the config package.
+     * - `baas` — collections are introspected from the live database at boot and
+     *   the config package is not required.
+     */
+    mode?: "cms" | "baas";
+    /**
+     * Module path (relative to `config`) exporting the auth users collection as
+     * its default export. Default `collections/users`.
+     */
+    usersCollection?: string;
+}
+
+/**
+ * A static client bundle — SPA or static site — built here and served from CDN.
+ */
+export interface RebaseStaticAppConfig {
+    type: "static";
+    /** Package directory containing the client sources. */
+    root: string;
+    /** Command that produces `output`. Run from the repository root. */
+    build?: string;
+    /** Directory of built assets, relative to the repository root. */
+    output: string;
+    /**
+     * Serve `index.html` for unmatched paths (client-side routing).
+     * Default `true` — the overwhelmingly common case for a client app, and a
+     * static *site* generator emits real files for its routes anyway.
+     */
+    spa?: boolean;
+}
+
+/**
+ * The admin panel.
+ *
+ * `hosted` is the default and means the platform serves it — nothing is built
+ * into this repository and nothing ships in the bundle. `bundled` builds it here,
+ * which is what a self-hosted or air-gapped deployment wants.
+ */
+export interface RebaseAdminAppConfig {
+    type: "admin";
+    mode?: "hosted" | "bundled";
+    /** Only for `bundled`: package directory containing the admin sources. */
+    root?: string;
+    /** Only for `bundled`: build command. */
+    build?: string;
+    /** Only for `bundled`: directory of built assets. */
+    output?: string;
+}
+
+/**
+ * A native app. Registered for credentials and configuration; never built here.
+ */
+export interface RebaseMobileAppConfig {
+    type: "mobile";
+    platform: "ios" | "android" | "other";
+}
+
+/**
+ * An app built from a Dockerfile into an arbitrary image.
+ *
+ * This is the deliberate escape hatch. A project containing one is not eligible
+ * for the managed runtime — the platform cannot make guarantees about an image
+ * it did not build — but it still deploys, and nothing else about the project
+ * changes.
+ */
+export interface RebaseCustomAppConfig {
+    type: "custom";
+    /** Dockerfile path relative to the repository root. */
+    dockerfile?: string;
+    /** Build context relative to the repository root. Default `.`. */
+    context?: string;
+    /** Port the container listens on. Default 8080. */
+    port?: number;
+}
+
+export type RebaseAppConfig =
+    | RebaseBackendAppConfig
+    | RebaseStaticAppConfig
+    | RebaseAdminAppConfig
+    | RebaseMobileAppConfig
+    | RebaseCustomAppConfig;
+
+/**
+ * `rebase.json` — the authored project manifest.
+ */
+export interface RebaseProjectManifest {
+    /** JSON Schema URL, for editor completion. Ignored by the tooling. */
+    $schema?: string;
+    /**
+     * The runtime **major** this project targets, as a semver range
+     * (e.g. `^1`, `~1.4`, or an exact `1.4.2` to pin).
+     *
+     * The platform upgrades patches and minors underneath a project without
+     * asking; it never crosses a major. See {@link RUNTIME_CONTRACT_VERSION}.
+     */
+    runtime: string;
+    /**
+     * Apps this repository contributes, keyed by app name. The key is the app's
+     * identity within the project: it is what `rebase deploy <app>` names, what
+     * client credentials are issued against, and what a second repository must
+     * not collide with.
+     */
+    apps: Record<string, RebaseAppConfig>;
+}
+
+/**
+ * The per-checkout project link.
+ *
+ * Deliberately separate from `rebase.json`: the manifest is committed and shared,
+ * while the link is per-developer. Keeping them in one file would mean either
+ * committing someone's project id or gitignoring the topology.
+ */
+export interface RebaseProjectLink {
+    /**
+     * A Rebase Cloud project id, or the base URL of any running Rebase backend
+     * (`https://api.example.com`). Both are first-class: every command that
+     * accepts a project reference accepts either, so a self-hosted project has
+     * the same tooling as a cloud one.
+     */
+    project: string;
+    /** Organization slug. Cloud projects only. */
+    org?: string;
+    /** Explicit API base URL, when it differs from the project's default. */
+    apiUrl?: string;
+}
+
+/**
+ * Whether a project can run on the managed runtime, and if not, precisely why.
+ *
+ * The reasons are returned rather than summarised so tooling can print something
+ * a developer can act on. "Not eligible" is never a dead end — it selects the
+ * custom-runtime path, which still deploys.
+ */
+export interface ManagedCompatibility {
+    eligible: boolean;
+    reasons: string[];
+}
+
+// ─────────────────────────────────────────────────────────────────────────────
+// Bundle
+// ─────────────────────────────────────────────────────────────────────────────
+
+/**
+ * Version of the bundle *format* itself.
+ *
+ * Bumped only when the on-disk layout changes in a way an older runtime could
+ * not read. A runtime accepts any bundle whose `bundleFormat` is less than or
+ * equal to its own — old bundles keep booting on new runtimes, which is the
+ * whole point of separating the artifact from the engine.
+ */
+export const BUNDLE_FORMAT_VERSION = 1;
+
+/**
+ * The runtime contract major.
+ *
+ * Distinct from the `@rebasepro/server` package version: the package may release
+ * any number of minors and patches while this stays put. It changes only when
+ * the bundle/runtime contract breaks compatibility, and a project's
+ * `manifest.runtime` range is matched against *this*.
+ */
+export const RUNTIME_CONTRACT_VERSION = 1;
+
+/** Where the runtime finds each part of the bundle. Paths are bundle-relative. */
+export interface RebaseBundleEntrypoints {
+    /** Compiled config package directory (collections live under it). */
+    config?: string;
+    /** Compiled collections directory, when it differs from `<config>/collections`. */
+    collections?: string;
+    /** Compiled functions directory. */
+    functions?: string;
+    /** Compiled crons directory. */
+    crons?: string;
+    /** Compiled Drizzle schema module. */
+    schema?: string;
+    /** Module exporting the auth users collection (default export). */
+    usersCollection?: string;
+    /** Built admin assets, when the admin panel is bundled rather than hosted. */
+    admin?: string;
+    /** Built static assets to serve from the runtime, when not on a CDN. */
+    static?: string;
+}
+
+/**
+ * A native module found in the dependency closure.
+ *
+ * Recorded rather than merely counted so a rejection can name the offending
+ * package instead of saying "something here is native".
+ */
+export interface NativeDependency {
+    name: string;
+    /** Why it was flagged — a `.node` binary, a gyp build, or an install script. */
+    reason: string;
+}
+
+/**
+ * `manifest.json` — generated, and the document the runtime and control plane
+ * both validate against.
+ */
+export interface RebaseBundleManifest {
+    /** @see BUNDLE_FORMAT_VERSION */
+    bundleFormat: number;
+    runtime: {
+        /** The `runtime` range copied from `rebase.json`. */
+        range: string;
+        /** Exact `@rebasepro/server` version this bundle was built against. */
+        builtAgainst: string;
+        /** Runtime contract major this bundle requires. */
+        contract: number;
+    };
+    /**
+     * Hash of the compiled collection definitions.
+     *
+     * This is the contract stamp. A generated SDK records the value it was built
+     * from, a client sends it back, and a mismatch is what lets the platform say
+     * "this app was built against an older schema" instead of failing mysteriously
+     * at the first request. It covers collections only — a hook edit does not
+     * change a client's contract, so it must not invalidate every SDK.
+     */
+    schemaVersion: string;
+    /** Which app in `rebase.json` this bundle was built from. */
+    app: string;
+    /**
+     * What the runtime does with this bundle.
+     *
+     * - `cms` — a backend with declared collections; the runtime provisions their
+     *   tables and serves the data API.
+     * - `baas` — a backend that introspects an existing database rather than
+     *   declaring collections.
+     * - `static` — no backend at all: the bundle is a built SPA (`entry.static`),
+     *   and the runtime only serves those assets. No database, no data sources —
+     *   this is how a `static`/`admin` app runs on the same image as the backend.
+     */
+    mode: "cms" | "baas" | "static";
+    entry: RebaseBundleEntrypoints;
+    /** Collection slugs contained in the bundle, for quick inspection. */
+    collections?: string[];
+    hooks: {
+        /**
+         * Whether the dependency closure contains native code.
+         *
+         * The managed runtime refuses these: a prebuilt binary cannot be run on
+         * an image the platform did not build it for, and the honest failure is
+         * at deploy time rather than at 3am in a crash loop.
+         */
+        native: boolean;
+        nativeModules?: NativeDependency[];
+    };
+    /**
+     * What the bundle's config says about storage access control.
+     *
+     * Storage is not under RLS and its keys share one flat namespace, so a
+     * deployment with file storage enabled and no access model serves every
+     * user's files to every signed-in user. The runtime refuses to boot in that
+     * state — which, on a hosted platform that enables storage from the *console*
+     * rather than from the bundle, surfaces as a crash loop the developer cannot
+     * read.
+     *
+     * Recording it here lets a host reject the deploy with the reason instead.
+     * Absent on bundles built before this field existed.
+     */
+    storage?: {
+        /** Whether the config package exports a `storageAuthorize` hook. */
+        authorize: boolean;
+    };
+    deps: {
+        /** Runtime dependencies of user code, as declared. */
+        declared: Record<string, string>;
+    };
+    build: {
+        /** `@rebasepro/cli` version that produced this bundle. */
+        cli: string;
+        /** Node major the bundle was compiled on. */
+        node: string;
+        /** ISO-8601. */
+        createdAt: string;
+    };
+}
+
+/** The contract a running backend serves at `GET /api/meta/contract`. */
+export interface RebaseProjectContract {
+    /** Matches {@link RebaseBundleManifest.schemaVersion}. */
+    schemaVersion: string;
+    runtime: {
+        /** `@rebasepro/server` version currently running. */
+        version: string;
+        contract: number;
+    };
+    mode: "cms" | "baas";
+    /** Full collection definitions, serialized — the input to SDK generation. */
+    collections: unknown[];
+    /** Collection slugs, for cheap inspection without parsing the definitions. */
+    collectionSlugs: string[];
+    generatedAt: string;
+}
+
+/** Header carrying the schema version an SDK was generated from. */
+export const SCHEMA_VERSION_HEADER = "x-rebase-schema";

package/src/types/schema_version.ts

@@ -0,0 +1,112 @@
+import type { CollectionConfig } from "./collections";
+import { serializeCollections } from "./collection_contract";
+
+/**
+ * The schema version stamp.
+ *
+ * One function, used in three places that must agree or the whole drift-detection
+ * story is noise: `rebase build` writes it into a bundle manifest, the runtime
+ * serves it from the contract endpoint, and a generated SDK records the value it
+ * was built from. If any two of those computed it differently, every client would
+ * look permanently out of date.
+ *
+ * It covers **collections only** — the client's contract is the shape of the
+ * data, so editing a hook or a server function must not invalidate every SDK in
+ * every repository. That is a deliberate narrowing, not an oversight.
+ */
+
+/** Stable stringify: object keys sorted at every level, so key order cannot alter the hash. */
+function canonicalize(value: unknown): string {
+    if (value === null || typeof value !== "object") {
+        return JSON.stringify(value) ?? "null";
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map(canonicalize).join(",")}]`;
+    }
+    const entries = Object.entries(value as Record<string, unknown>)
+        .filter(([, v]) => v !== undefined)
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+    return `{${entries.map(([k, v]) => `${JSON.stringify(k)}:${canonicalize(v)}`).join(",")}}`;
+}
+
+/**
+ * Reduce a collection to the parts a generated client is actually built from.
+ *
+ * The version answers one question — "is this SDK stale?" — so it must change
+ * exactly when the generated types could change, and never otherwise. Hashing a
+ * whole collection fails both halves of that:
+ *
+ * - Security rules, callbacks, icons, groups and UI settings do not appear in a
+ *   generated client, so including them reports perfectly current SDKs as stale.
+ * - Worse, they are not stable *inputs*. The runtime applies default security
+ *   rules when it loads collections, so the same source hashed before and after
+ *   loading produced two different answers — a build-time stamp that could never
+ *   match the server that served it.
+ *
+ * Codegen reads the slug (for the `Database` key and type names), the properties,
+ * and the relations. That is the projection.
+ */
+function projectForCodegen(collection: CollectionConfig): Record<string, unknown> {
+    const source = collection as CollectionConfig & {
+        relations?: unknown;
+        subcollections?: CollectionConfig[];
+        path?: string;
+        engine?: unknown;
+        dataSource?: unknown;
+    };
+
+    return {
+        slug: collection.slug ?? source.path,
+        properties: collection.properties,
+        relations: source.relations,
+        // The engine decides whether relations are resolved at all: codegen asks
+        // `getDataSourceCapabilities(collection.engine).supportsRelations`, and an
+        // engine that answers no drops every foreign-key column from the
+        // generated Row/Insert/Update types. Moving a collection to such an
+        // engine is a real change to the generated types, so it has to move the
+        // version. `dataSource` is what resolves to `engine`, so it counts too.
+        engine: source.engine,
+        dataSource: source.dataSource,
+        subcollections: source.subcollections?.map(projectForCodegen)
+    };
+}
+
+/**
+ * Compute the canonical string a schema version hashes.
+ *
+ * Exposed separately so the hashing itself can differ by environment: Node has
+ * `crypto`, and callers without it can still compare canonical forms directly.
+ */
+export function canonicalSchemaPayload(collections: CollectionConfig[]): string {
+    const projected = serializeCollections(collections)
+        .map(collection => projectForCodegen(collection as CollectionConfig));
+    return canonicalize(projected);
+}
+
+/**
+ * A short, non-cryptographic digest of the canonical payload.
+ *
+ * FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a
+ * security boundary: nothing trusts a schema version to prove anything, it only
+ * answers "is this the same schema as before". A hand-rolled hash keeps this
+ * module free of `node:crypto`, so the identical function runs in the browser,
+ * in the CLI, and in the runtime — which is the property that actually matters.
+ */
+export function computeSchemaVersion(collections: CollectionConfig[]): string {
+    const payload = canonicalSchemaPayload(collections);
+
+    let h1 = 0x811c9dc5;
+    let h2 = 0x01000193;
+
+    for (let i = 0; i < payload.length; i++) {
+        const code = payload.charCodeAt(i);
+        h1 ^= code;
+        // Multiply by the FNV prime using shifts to stay in 32-bit integer math.
+        h1 = (h1 + ((h1 << 1) + (h1 << 4) + (h1 << 7) + (h1 << 8) + (h1 << 24))) >>> 0;
+        h2 ^= code + i;
+        h2 = (h2 + ((h2 << 1) + (h2 << 5) + (h2 << 9) + (h2 << 15) + (h2 << 24))) >>> 0;
+    }
+
+    const hex = (n: number): string => n.toString(16).padStart(8, "0");
+    return `v1:${hex(h1)}${hex(h2)}`;
+}

package/src/types/storage_authorize.ts

@@ -0,0 +1,77 @@
+/**
+ * The storage access-control contract.
+ *
+ * Lives here rather than in `@rebasepro/server` because a project declares its
+ * `storageAuthorize` hook from its **config package**, and a config package
+ * depends on `@rebasepro/types` alone. A type the contract requires but the
+ * contract's author cannot import is not much of a contract.
+ *
+ * `@rebasepro/server` re-exports all of this, so existing imports keep working.
+ */
+
+export type StorageOperation = "read" | "write" | "delete" | "list";
+
+/** The caller, as resolved by whichever auth middleware ran. */
+export interface StorageAuthorizeUser {
+    uid: string;
+    email?: string;
+    roles?: string[];
+}
+
+export interface StorageAuthorizeContext {
+    /** Object key, bucket prefix stripped and traversal already sanitized. */
+    key: string;
+    bucket: string;
+    operation: StorageOperation;
+    /** Null when the route allows unauthenticated access. */
+    user: StorageAuthorizeUser | null;
+    /** Named backend the request targeted, when one was given. */
+    storageId?: string;
+    /**
+     * Trusted, RLS-bypassing data access, so the hook can answer the question it
+     * actually has to answer: *who owns this object?*
+     *
+     * Without it the hook can only do prefix arithmetic on the key, which
+     * expresses no real multi-tenant rule — ownership lives in a row, not in a
+     * string. And it cannot simply import the server to get one: a project
+     * declares this hook from its **config** package, which depends on
+     * `@rebasepro/types` alone and cannot resolve `@rebasepro/server` at
+     * runtime. So the accessor is handed in.
+     *
+     * It bypasses row-level security on purpose. The hook IS the authorization
+     * decision; asking it to make that decision through a reader that has
+     * already been narrowed by the caller's own permissions is circular.
+     */
+    data?: StorageAuthorizeData;
+}
+
+/**
+ * The slice of the data API a storage hook needs: read a collection, in the
+ * trusted server context.
+ *
+ * Deliberately read-only and deliberately tiny. A hook that can write is a hook
+ * that can be tricked into writing, and an authorization check has no business
+ * mutating anything.
+ */
+export interface StorageAuthorizeData {
+    collection(slug: string): {
+        find(query?: Record<string, unknown>): Promise<{ data: Record<string, unknown>[] }>;
+        findById(id: string): Promise<Record<string, unknown> | null>;
+    };
+}
+
+/**
+ * Per-object access control for storage, the analogue of an RLS policy on a
+ * collection.
+ *
+ * Without it, storage routes authenticate but do not authorize: `requireAuth`
+ * and `publicRead` are global switches, so any signed-in user could read any
+ * key they could name. That is fine for a single-tenant app and useless for a
+ * multi-tenant one, where the only thing separating two tenants' files would be
+ * key unguessability — not an access-control model. Multi-tenant apps were
+ * left to route every byte through a custom function to get an ownership check
+ * in, and each of them had to invent it.
+ *
+ * Return false (or throw) to deny. Denials surface as 403.
+ */
+export type StorageAuthorize = (ctx: StorageAuthorizeContext) => boolean | Promise<boolean>;