Platform model
OpenCloud separates product code from platform control.
App bundle
An application owns:
- static frontend output;
- ordered, append-only SQL migrations;
- optional Deno-compatible Functions;
- optional durable background queues;
- optional UTC cron schedules;
- generated, required-owner, and optional secret declarations; and
- a health path.
The manifest makes those inputs deterministic and reviewable.
Platform-owned boundaries
OpenCloud owns:
- canonical HTTPS routing and private-app admission;
- brokered Auth sessions and refresh;
- the per-app PostgreSQL schema and restrictive app boundary;
- opaque managed Files isolation and lifecycle;
- private Realtime topic construction;
- Function runtime credentials and secret injection;
- PostgreSQL-backed background-job delivery, retries, dead letters, and bounded history;
- durable deployment, cron, backup, log, and usage records.
Frontend code receives only same-origin runtime interfaces. It never receives service-role, database, object-store, or control-plane credentials.
Client versus operator APIs
The JavaScript SDK is for end-user browser code. Its authority is limited by the current user, RLS, managed Files access, Function manifest access, and the app host. It exposes high-level values rather than raw service clients.
The CLI is for builders and operators. App-scoped agent credentials can deploy, observe, verify, and operate only their assigned app and allowed scopes.
Never put an OPENCLOUD_TOKEN in browser code.