resources is provisioned once per app, not once per service. Two services
declaring uses: ["database"] share one database.
A database Bay owns
"managed"
default:"managed"
Bay creates it, owns it, and injects the credentials.
"postgres"
required
string
pg
or psycopg or Prisma, and detection provisions Postgres because the dependency
is the declaration.
Each app connects as its own role — app_<slug> — and no other app can reach it.
A database that already exists
The mode that matters if you are already on Supabase, Neon or RDS:string
required
The secret name holding the connection URL — never the URL itself.Bay does not need to know your connection string, only that a value exists
under that name and reached the revision. So the credential travels the same
path as every other secret and is never committed to a file.
provider: "external" means Bay provisions nothing and touches nothing. It was
inexpressible before, and its absence excluded every app that already had
infrastructure of its own.A bucket
boolean
Object storage behind a CDN. Credentials are injected into every service that
lists
"bucket" in uses.