@rebasepro/types 0.16.0 → 0.16.1-canary.g041c925

package/dist/types/admin_block.d.ts

@@ -29,7 +29,7 @@
  *
  * @group Models
  */
-export declare const ADMIN_COLLECTION_KEYS: readonly ["Actions", "additionalFields", "alwaysApplyDefaultValues", "components", "customViews", "defaultEntityAction", "defaultFilter", "defaultSelectedView", "defaultSize", "defaultViewMode", "disableDefaultActions", "display", "enabledViews", "entityActions", "entityViews", "exportable", "filterPresets", "fixedFilter", "form", "formAutoSave", "formView", "group", "hideFromEntityViews", "hideFromNavigation", "hideIdFromCollection", "hideIdFromForm", "icon", "includeJsonView", "inlineEditing", "kanban", "listProperties", "localChangesBackup", "openEntityMode", "orderProperty", "pagination", "previewProperties", "propertiesOrder", "selectionController", "selectionEnabled", "sideDialogWidth", "sort", "titleProperty"];
+export declare const ADMIN_COLLECTION_KEYS: readonly ["Actions", "additionalFields", "alwaysApplyDefaultValues", "components", "customViews", "defaultEntityAction", "defaultFilter", "defaultSelectedView", "defaultSize", "defaultViewMode", "disableDefaultActions", "display", "enabledViews", "entityActions", "entityViews", "exportable", "filterPresets", "fixedFilter", "form", "formAutoSave", "formView", "group", "hideFromEntityViews", "hideFromNavigation", "hideIdFromCollection", "hideIdFromForm", "icon", "includeJsonView", "inlineEditing", "kanban", "listProperties", "localChangesBackup", "openEntityMode", "orderProperty", "pagination", "previewProperties", "propertiesOrder", "selectionController", "selectionEnabled", "sideDialogWidth", "sort"];
 /** A key of a collection's `admin` block. @group Models */
 export type AdminCollectionKey = typeof ADMIN_COLLECTION_KEYS[number];
 /**

package/dist/types/auth_adapter.d.ts

@@ -75,8 +75,16 @@ export interface AuthAdapterCapabilities {
     hasBuiltInAuthRoutes: boolean;
     /** Supports email/password login. */
     emailPasswordLogin: boolean;
-    /** Supports new user registration. */
-    registration: boolean;
+    /**
+     * Whether self-registration is open **right now**.
+     *
+     * A runtime answer, not a static feature list: the built-in adapter also
+     * reports `true` during the first-user bootstrap window (an empty user
+     * table) and `false` the moment `disableSelfRegistration` is set. Whatever
+     * this says, `POST /auth/register` does — both read the same predicate, so
+     * the UI can never be sent to a form that can only 403.
+     */
+    registrationEnabled: boolean;
     /**
      * Supports the end-user password reset flow (emailing a reset link).
      *
@@ -105,12 +113,15 @@ export interface AuthAdapterCapabilities {
     /** Supports passwordless magic link login. */
     magicLink: boolean;
     /**
-     * Whether `POST /auth/anonymous` will mint a credential-less session.
+     * Supports passwordless sign-in with a six-digit code sent by email.
      *
-     * Optional so an external adapter that predates the key keeps typechecking;
-     * absent means "this adapter does not offer anonymous sign-in".
+     * Optional so that an external adapter written before this existed still
+     * satisfies the interface; absent reads as "no", which is what an adapter
+     * that has never heard of the flow means.
      */
-    anonymousLogin?: boolean;
+    emailOtp?: boolean;
+    /** Whether `POST /auth/anonymous` will mint a credential-less session. */
+    anonymousLogin: boolean;
     /** List of enabled OAuth provider IDs (e.g. `["google", "github"]`). */
     enabledProviders: string[];
     /**
@@ -124,8 +135,6 @@ export interface AuthAdapterCapabilities {
      * Only applicable for built-in auth.
      */
     needsSetup?: boolean;
-    /** Whether new user registration is enabled (may differ from `registration` capability at runtime). */
-    registrationEnabled?: boolean;
 }
 /**
  * Options for paginated user listing.
@@ -284,7 +293,7 @@ export interface TransformAuthResponseContext {
     /** The authenticated user's ID. */
     uid: string;
     /** The auth method that triggered this response. */
-    method: "login" | "register" | "oauth" | "refresh" | "anonymous" | "magic-link" | "mfa";
+    method: "login" | "register" | "oauth" | "refresh" | "anonymous" | "magic-link" | "otp" | "mfa";
     /** The raw HTTP request (for reading headers, IP, etc.). */
     request: Request;
 }

package/dist/types/backend.d.ts

@@ -1,9 +1,10 @@
-import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections";
-import type { OrderByTuple } from "./filter-operators";
-import type { LogicalCondition } from "../controllers/data";
-import type { AuthAdapter } from "./auth_adapter";
-import type { HistoryConfig } from "../controllers/client";
-import type { ChannelBusSetting } from "./channel_bus";
+import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections.js";
+import type { OrderByTuple } from "./filter-operators.js";
+import type { LogicalCondition } from "../controllers/data.js";
+import type { AuthAdapter } from "./auth_adapter.js";
+import type { HistoryConfig } from "../controllers/client.js";
+import type { ChannelBusSetting } from "./channel_bus.js";
+import type { SchemaEditingAdmin } from "./schema_editing.js";
 /**
  * Abstract database connection interface.
  * Represents a connection to any database system.
@@ -433,7 +434,19 @@ export interface BranchAdmin {
  *
  * @group Admin
  */
-export type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin> & Partial<BranchAdmin>;
+export type DatabaseAdmin = Partial<SQLAdmin> & Partial<DocumentAdmin> & Partial<SchemaAdmin> & Partial<BranchAdmin> & Partial<SchemaEditingAdmin>;
+/**
+ * Type guard: can this admin plan a live schema change?
+ *
+ * Planning is engine-specific — it renders DDL, a Drizzle schema and the
+ * declarative SQL artifacts — so the implementation lives in the driver
+ * package. The server detects the capability structurally, exactly as it does
+ * for SQL, rather than importing an engine it is supposed to know nothing
+ * about.
+ *
+ * @group Admin
+ */
+export declare function isSchemaEditingAdmin(admin: DatabaseAdmin | undefined): admin is SchemaEditingAdmin;
 /**
  * Type guard: does this admin support SQL operations?
  * @group Admin
@@ -697,7 +710,7 @@ export interface BackendBootstrapper {
     /**
      * Initialize WebSocket server for realtime operations.
      */
-    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import("../controllers/data_driver").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;
+    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: import("../controllers/data_driver.js").DataDriver, config?: unknown, authAdapter?: AuthAdapter): Promise<void> | void;
 }
 /**
  * Result of `BackendBootstrapper.initializeDriver()`.
@@ -705,7 +718,7 @@ export interface BackendBootstrapper {
  */
 export interface InitializedDriver {
     /** The DataDriver instance, ready for use. */
-    driver: import("../controllers/data_driver").DataDriver;
+    driver: import("../controllers/data_driver.js").DataDriver;
     /** The realtime service, if the driver created one during init. */
     realtimeProvider?: RealtimeProvider;
     /** A collection registry to register schema / tables into. */
@@ -716,7 +729,7 @@ export interface InitializedDriver {
      * Set by drivers that introspect in `baas` mode; the server serves these
      * instead of collections loaded from config files.
      */
-    collections?: import("./collections").CollectionConfig[];
+    collections?: import("./collections.js").CollectionConfig[];
     /** The underlying database connection (for lifecycle management). */
     connection?: DatabaseConnection;
     /**

package/dist/types/collection_contract.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionConfig } from "./collections";
+import type { CollectionConfig } from "./collections.js";
 /**
  * Serializing collections so they survive a network hop.
  *

package/dist/types/collections.d.ts

@@ -1,9 +1,10 @@
-import type { CollectionCallbacks } from "./entity_callbacks";
-import type { Properties, PostgresProperties, FirebaseProperties, MongoProperties } from "./properties";
-import type { User } from "../users";
-import type { Relation } from "./relations";
-import type { SecurityRule } from "./security_rules";
-import type { SearchConfig } from "./search";
+import type { CollectionCallbacks } from "./entity_callbacks.js";
+import type { Properties, PostgresProperties, FirebaseProperties, MongoProperties } from "./properties.js";
+import type { User } from "../users/index.js";
+import type { EmailSendResult } from "../controllers/email.js";
+import type { Relation } from "./relations.js";
+import type { SecurityRule } from "./security_rules.js";
+import type { SearchConfig } from "./search.js";
 /**
  * Base interface containing all driver-agnostic collection properties.
  * Use {@link PostgresCollectionConfig} or {@link FirebaseCollectionConfig} for
@@ -475,7 +476,7 @@ export interface EntityChildView<M extends Record<string, unknown> = Record<stri
     collection: CollectionConfig<M>;
     source: ChildViewSource;
 }
-export type { WhereFilterOp, FilterValues, WireFilterValues, FilterPreset } from "./filter-operators";
+export type { WhereFilterOp, FilterValues, WireFilterValues, FilterPreset } from "./filter-operators.js";
 export type InferCollectionConfigType<S extends CollectionConfig> = S extends CollectionConfig<infer M> ? M : never;
 /**
  * Configuration for authentication collections.
@@ -557,13 +558,19 @@ export interface AuthCollectionConfig {
 export interface AuthCollectionContext {
     /** Hash a password using the configured algorithm (scrypt by default). */
     hashPassword: (password: string) => Promise<string>;
-    /** Send an email. Only available when email service is configured. */
+    /**
+     * Send an email. Only available when email service is configured.
+     *
+     * Resolves with what the provider reported — the assigned Message-ID, most
+     * usefully — so a hook that sends a message can store the id and later
+     * thread a reply back to it. Callers that do not care may ignore it.
+     */
     sendEmail?: (options: {
         to: string;
         subject: string;
         html: string;
         text?: string;
-    }) => Promise<void>;
+    }) => Promise<EmailSendResult>;
     /** Whether the email service is configured and available. */
     emailConfigured: boolean;
     /** The app name from email config (for templates). */

package/dist/types/component_ref.d.ts

@@ -2,8 +2,9 @@
  * How a collection points at a UI component without the backend learning about React.
  *
  * This file is the hinge the BaaS/admin split turns on. `ComponentRef` is named
- * by `properties.ts` (`ui.Field`, `ui.Preview`, `ui.Filter`), and `properties.ts`
- * must stay in the React-free core because every backend subsystem — validation,
+ * by a property's `admin` block (`admin.Field`, `admin.Preview`, `admin.Filter`)
+ * and imported by `properties.ts`, which must stay in the React-free core
+ * because every backend subsystem — validation,
  * the drizzle schema generator, the OpenAPI generator, the SDK codegen — reads
  * property definitions. If `ComponentRef` needed `React.ComponentType`, the whole
  * property model would have to move to the admin layer with it.

package/dist/types/cron.d.ts

@@ -1,5 +1,4 @@
-import type { RebaseServerClient } from "../controllers/client";
-import type { RebaseSdkData } from "../controllers/data";
+import type { RebaseServerClient } from "../controllers/client.js";
 /**
  * Cron Job type definitions for Rebase.
  *
@@ -107,29 +106,6 @@ export interface CronJobContext {
      * });
      */
     rebase: RebaseServerClient;
-    /**
-     * The same object as {@link rebase}, under the name this context used
-     * before.
-     *
-     * @deprecated Use `rebase` instead. Two things made the old name a problem,
-     * and neither was cosmetic. It contradicted every other server surface,
-     * where the singleton is `rebase` — the previous docstring had to end with
-     * *"it is only named `client` here"*. And typing it as `RebaseClient`
-     * re-exposed `client.data`, the alias that {@link RebaseServerClient}
-     * deliberately `Omit`s so the RLS-bypassing plane has exactly one name and
-     * the privilege is visible at the call site. A reader who learned
-     * `client.data` here carried it to a collection callback, where
-     * `context.data` is the *user-scoped* plane — same spelling, opposite
-     * privilege.
-     *
-     * Still the full server client at runtime, and `data` still resolves, so
-     * existing cron files keep working and keep compiling. It will be removed
-     * in the next major.
-     */
-    client: RebaseServerClient & {
-        /** @deprecated Use `rebase.dataAsAdmin` — the name states the privilege. */
-        data: RebaseSdkData;
-    };
 }
 export type CronJobRunState = "idle" | "running" | "success" | "error" | "disabled";
 /**

package/dist/types/data_source.d.ts

@@ -1,4 +1,4 @@
-import { WhereFilterOp } from "./filter-operators";
+import { WhereFilterOp } from "./filter-operators.js";
 /**
  * Describes the capabilities and features supported by a data source (driver).
  *

package/dist/types/database_adapter.d.ts

@@ -19,10 +19,10 @@
  *
  * @group Backend
  */
-import type { DataDriver } from "../controllers/data_driver";
-import type { CollectionConfig } from "./collections";
-import type { CollectionRegistryInterface, DatabaseAdmin, InitializedDriver, RealtimeProvider, BootstrappedAuth } from "./backend";
-import type { HistoryConfig } from "../controllers/client";
+import type { DataDriver } from "../controllers/data_driver.js";
+import type { CollectionConfig } from "./collections.js";
+import type { CollectionRegistryInterface, DatabaseAdmin, InitializedDriver, RealtimeProvider, BootstrappedAuth } from "./backend.js";
+import type { HistoryConfig } from "../controllers/client.js";
 /**
  * A `DatabaseAdapter` provides data persistence for Rebase.
  *
@@ -74,7 +74,7 @@ export interface DatabaseAdapter {
      * here — turning an adapter-authenticated server's socket into one that
      * accepted every client as already authenticated.
      */
-    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: DataDriver, config?: unknown, adapter?: import("./auth_adapter").AuthAdapter): Promise<void> | void;
+    initializeWebsockets?(server: unknown, realtimeService: RealtimeProvider, driver: DataDriver, config?: unknown, adapter?: import("./auth_adapter.js").AuthAdapter): Promise<void> | void;
     /**
      * Bring the database's collection tables up to date, additively — the boot
      * companion to `db push`. See `BackendBootstrapper.ensureCollectionSchema`

package/dist/types/entities.d.ts

@@ -1,4 +1,4 @@
-import type { SearchMatch } from "./search";
+import type { SearchMatch } from "./search.js";
 /**
  * New or existing status
  * @group Models

package/dist/types/entity_callbacks.d.ts

@@ -1,7 +1,7 @@
-import type { CollectionConfig } from "./collections";
-import type { EntityStatus, EntityValues } from "./entities";
-import type { User } from "../users";
-import type { RebaseCallContext } from "../call_context";
+import type { CollectionConfig } from "./collections.js";
+import type { EntityStatus, EntityValues } from "./entities.js";
+import type { User } from "../users/index.js";
+import type { RebaseCallContext } from "../call_context.js";
 /**
  * Lifecycle callbacks for entity CRUD operations.
  *

package/dist/types/index.d.ts

@@ -1,29 +1,32 @@
-export * from "./entities";
-export * from "./filter-operators";
-export * from "./chips";
-export * from "./properties";
-export * from "./admin_block";
-export * from "./collections";
-export * from "./search";
-export * from "./relations";
-export * from "./policy";
-export * from "./rls-functions";
-export * from "./security_rules";
-export * from "./entity_callbacks";
-export * from "./websockets";
-export * from "./backend";
-export * from "./channel_bus";
-export * from "./data_source";
-export * from "./storage_source";
-export * from "./cron";
-export * from "./backup";
-export * from "./component_ref";
-export * from "./auth_adapter";
-export * from "./database_adapter";
-export * from "./api_keys";
-export * from "./history";
-export * from "./postgres_introspection";
-export * from "./project_manifest";
-export * from "./collection_contract";
-export * from "./schema_version";
-export * from "./storage_authorize";
+export * from "./entities.js";
+export * from "./filter-operators.js";
+export * from "./chips.js";
+export * from "./properties.js";
+export * from "./admin_block.js";
+export * from "./collections.js";
+export * from "./search.js";
+export * from "./relations.js";
+export * from "./policy.js";
+export * from "./rls-functions.js";
+export * from "./security_rules.js";
+export * from "./entity_callbacks.js";
+export * from "./websockets.js";
+export * from "./backend.js";
+export * from "./schema_editing.js";
+export * from "./channel_bus.js";
+export * from "./data_source.js";
+export * from "./resources.js";
+export * from "./resource_kinds.js";
+export * from "./storage_source.js";
+export * from "./cron.js";
+export * from "./backup.js";
+export * from "./component_ref.js";
+export * from "./auth_adapter.js";
+export * from "./database_adapter.js";
+export * from "./api_keys.js";
+export * from "./history.js";
+export * from "./postgres_introspection.js";
+export * from "./project_manifest.js";
+export * from "./collection_contract.js";
+export * from "./schema_version.js";
+export * from "./storage_authorize.js";

package/dist/types/project_manifest.d.ts

@@ -24,7 +24,8 @@
  * work: two repositories never need to know about each other, only about the
  * project.
  */
-import type { StorageSourceDefinition } from "./storage_source";
+import type { StorageSourceDefinition } from "./storage_source.js";
+import type { ResourceGraph } from "./resources.js";
 /**
  * Which kind of thing an app is.
  *
@@ -58,7 +59,7 @@ export interface RebaseBackendAppConfig {
      *
      * Independent of *where* it runs. Both run on Rebase Cloud and both
      * self-host — the destination lives in `.rebase/cloud.json`, not here. See
-     * `docker/docker-compose.selfhost.yml`, which boots a managed bundle on a
+     * `infra/docker/docker-compose.selfhost.yml`, which boots a managed bundle on a
      * developer's own Docker host.
      *
      * This is authored rather than inferred on purpose. It is the single most
@@ -125,6 +126,31 @@ export interface RebaseStaticAppConfig {
     spa?: boolean;
 }
 export type RebaseAppConfig = RebaseBackendAppConfig | RebaseStaticAppConfig;
+/**
+ * Path prefixes the backend owns, which no static app may claim.
+ *
+ * One process — and, on the platform, one hostname — serves both the API and
+ * however many static apps a project has. Mounting is longest-path-first, so an
+ * app declaring `/api` would win against the API itself and every request to it
+ * would be answered with that app's `index.html`: a 200 carrying HTML where the
+ * caller expected JSON, from a project that looks deployed and healthy.
+ *
+ * Declared here rather than in either enforcer because both must agree. The CLI
+ * checks it so a developer finds out while editing `rebase.json`; the control
+ * plane checks it again at deploy intake, because the front door's correctness
+ * cannot rest on a check that ran in somebody else's CLI — and a repository can
+ * be deployed by a CLI older than this rule.
+ */
+export declare const RESERVED_BACKEND_PREFIXES: readonly ["/api", "/health", "/healthz", "/livez", "/readyz", "/metrics"];
+/**
+ * Whether `path` collides with a prefix the backend owns.
+ *
+ * Compares at segment boundaries, so `/api` and `/api/v2` collide while
+ * `/apidocs` does not — the same rule the router matches with, because a check
+ * that is stricter than the router rejects paths that would have worked, and one
+ * that is looser admits paths that will not.
+ */
+export declare function reservedPrefixFor(path: string): string | undefined;
 /**
  * One declared storage source, as authored in `rebase.json`.
  *
@@ -171,27 +197,20 @@ export interface RebaseProjectManifest {
      */
     apps: Record<string, RebaseAppConfig>;
     /**
-     * Storage sources this project uses, keyed by source key.
+     * Buckets are NOT declared here any more.
      *
-     * **Topology only — never credentials.** Which buckets exist is a property of
-     * the project and belongs in the repository; how to reach each one is a
-     * property of the deployment and lives in the environment, read per source
-     * from `<BASE>__<KEY>` (`S3_BUCKET__MEDIA` for a source keyed `media`). The
-     * default source takes no suffix, so a single-bucket project configured with
-     * plain `S3_BUCKET` keeps working having declared nothing at all.
+     * They were, and the runtime merged this block with the declarations in
+     * config code — a bucket named in both had one engine kept and the other
+     * silently discarded. Two homes for one concept, with a merge to decide
+     * between them, is the shape this whole model replaced.
      *
-     * Declared here rather than only in the config package because this file is
-     * the one artifact a host can read *before* running a build. That is what
-     * lets a console show "this project wants a `media` bucket, and it has none"
-     * on a project's first deploy, and it is why the managed and custom runtimes
-     * can present the same list — a custom build emits no bundle manifest, so a
-     * declaration that lived only in compiled config would leave every custom
-     * project invisible.
-     *
-     * Omitted entirely means one default source, which is the overwhelmingly
-     * common project and must not be required to say so.
+     * `bucket("media", { engine: "s3" })` in the project's config declares one
+     * now, and `rebase resources --write` generates `rebase.resources.json`,
+     * which is what a host reads before a build. A `storage` block left in this
+     * file is refused by the validator, by name, with the replacement in the
+     * message — not ignored, because a key that still parses and does nothing
+     * is the failure this removed.
      */
-    storage?: Record<string, RebaseStorageSourceConfig>;
     /**
      * Repository-wide opt-out from anonymous CLI usage sharing.
      *
@@ -263,6 +282,31 @@ export declare const BUNDLE_FORMAT_VERSION = 2;
  * any number of minors and patches while this stays put. It changes only when
  * the bundle/runtime contract breaks compatibility, and a project's
  * `manifest.runtime` range is matched against *this*.
+ *
+ * ## v2 — resources are declared, not configured
+ *
+ * `RebaseBackendConfig.dataSources` and `.storageSources` are gone. A project
+ * declares its databases and buckets with `database()` / `bucket()` in its
+ * config, and the runtime reads those declarations.
+ *
+ * This had to be a major, and the reason is the managed tier: it moves projects
+ * onto new images WITHOUT rebuilding them. A bundle built against v1 exports
+ * those keys, and a v2 runtime refuses them at boot — so without this bump, one
+ * image rollout would crash-loop every tenant that had ever declared a second
+ * database or bucket, in a wave, with the cause in a container log nobody is
+ * watching.
+ *
+ * With the bump, a v1 bundle on a v2 runtime is refused by
+ * `assertBundleCompatibility` with the remedy in the message, and the platform
+ * keeps it on a v1 image until it is rebuilt. That is the whole purpose of this
+ * number.
+ *
+ * **Release order matters and is not optional.** The control plane is the side
+ * that rejects, so it ships FIRST: raise `SUPPORTED_RUNTIME_CONTRACT` in the
+ * saas repo (it rejects only `contract >` its own, so it then accepts both),
+ * deploy that, and only then release a runtime implementing v2. Shipping the
+ * runtime first turns every deploy into a rejected intake blaming the tenant's
+ * bundle.
  */
 export declare const RUNTIME_CONTRACT_VERSION = 1;
 /** Where the runtime finds each part of the bundle. Paths are bundle-relative. */
@@ -313,6 +357,35 @@ export interface NativeDependency {
  * `manifest.json` — generated, and the document the runtime and control plane
  * both validate against.
  */
+/**
+ * One custom function, as recorded in a built bundle.
+ *
+ * @see RebaseBundleManifest.functions
+ */
+export interface RebaseBundleFunction {
+    /**
+     * The filename without its extension — which is also the URL segment it
+     * mounts at (`/api/functions/<name>`), the API-key permission that grants
+     * it, and the name `REBASE_FUNCTIONS_ONLY` selects by. One identity, used
+     * everywhere.
+     */
+    name: string;
+    /** Path inside the bundle, so a host can point at the file. */
+    file: string;
+    /**
+     * `false` when the function's own source imports a Node built-in or a
+     * package that needs one.
+     *
+     * Descriptive, never a gate: nothing refuses to build or deploy on this. It
+     * says where this function *could* run, not where it should.
+     */
+    portable: boolean;
+    /**
+     * Why it is not portable — one short phrase per reason, deduplicated.
+     * Absent when it is.
+     */
+    requires?: string[];
+}
 export interface RebaseBundleManifest {
     /** @see BUNDLE_FORMAT_VERSION */
     bundleFormat: number;
@@ -353,6 +426,28 @@ export interface RebaseBundleManifest {
     entry: RebaseBundleEntrypoints;
     /** Collection slugs contained in the bundle, for quick inspection. */
     collections?: string[];
+    /**
+     * Every custom function in the bundle, named and classified.
+     *
+     * Two things are recorded per function, and both are answers a host would
+     * otherwise have to get by importing user code:
+     *
+     * - **What it is called.** That name is the function's identity everywhere —
+     *   the URL segment it mounts at, the `functions/<name>` API-key
+     *   permission, the value `REBASE_FUNCTIONS_ONLY` selects by. A host that
+     *   wants to give one slow function its own replica count currently has to
+     *   boot the bundle to discover what is in it.
+     * - **Whether it needs Node.** Purely descriptive: a function that opens a
+     *   file or runs raw SQL is a fine function, and every deployment today is
+     *   a Node process. It is recorded because the question "which of these
+     *   could run somewhere else" has to be answerable from the artifact, and
+     *   because answering it per-file after the fact — across a codebase
+     *   already written — is the expensive version of the same question.
+     *
+     * Absent on a bundle built before this field existed, which is why every
+     * consumer must treat it as optional rather than as an empty list.
+     */
+    functions?: RebaseBundleFunction[];
     hooks: {
         /**
          * Whether the dependency closure contains native code.
@@ -381,17 +476,27 @@ export interface RebaseBundleManifest {
         /** Whether the config package exports a `storageAuthorize` hook. */
         authorize: boolean;
         /**
-         * Every storage source this bundle expects, resolved at build time from
-         * `rebase.json`'s `storage` block merged with any `storageSources` the
-         * config package exports.
+         * Buckets, on bundles built before {@link RebaseBundleManifest.resources}.
          *
-         * Recorded so the runtime does not have to import user code to learn its
-         * own topology, and so a host can tell — from the artifact alone, before
-         * starting anything — which buckets need configuring. Absent on bundles
-         * built before this field existed, which means one default source.
+         * No longer written. A host reads `resources`, which carries every kind
+         * in one list; this stays declared so a control plane can keep reading
+         * the bundles a project shipped before it was rebuilt.
          */
         sources?: StorageSourceDefinition[];
     };
+    /**
+     * Everything the project declares it needs — databases, buckets, topics,
+     * and whatever kind is registered next.
+     *
+     * Recorded so a host can tell, from the artifact alone and before starting
+     * anything, what a deploy will need provisioned. That question used to be
+     * answerable for buckets and for nothing else, because buckets were the
+     * only kind written into an artifact — which is how a project's databases
+     * became invisible to the platform that runs them.
+     *
+     * Absent on bundles built before this field existed.
+     */
+    resources?: ResourceGraph;
     deps: {
         /** Runtime dependencies of user code, as declared. */
         declared: Record<string, string>;