Platform model

OpenCloud separates product code from platform control.

App bundle

An application owns:

• static frontend output;
• ordered, append-only SQL migrations;
• optional Deno-compatible Functions;
• optional UTC cron schedules;
• required secret names; and
• a health path.

The manifest makes those inputs deterministic and reviewable.

Platform-owned boundaries

OpenCloud owns:

• canonical HTTPS routing and private-app admission;
• brokered Auth sessions and refresh;
• the per-app PostgreSQL schema and restrictive app boundary;
• Storage bucket isolation;
• private Realtime topic construction;
• Function runtime credentials and secret injection;
• durable deployment, cron, backup, log, and usage records.

Frontend code receives only same-origin runtime interfaces. It never receives service-role, database, object-store, or control-plane credentials.

Client versus operator APIs

The JavaScript SDK is for end-user browser code. Its authority is limited by the current user, RLS, Storage policies, Function JWT mode, and the app host.

The CLI is for builders and operators. App-scoped agent credentials can deploy, observe, verify, and operate only their assigned app and allowed scopes.

Never put an OPENCLOUD_TOKEN in browser code.