@abloatai/ablo 0.29.1 → 0.29.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.29.3
+
+### Patch Changes
+
+- **`ablo connect` validates from Ablo's network when your machine can't reach the database.** Replication runs from Ablo's infrastructure, not from your laptop, so a database that is IPv6-only (Supabase direct hosts), IP-allowlisted, or behind a VPN can be perfectly replicable even when every local dial fails. When `--check` can't connect at all, it now asks the engine to run the same readiness checklist from its own network instead of reporting a false failure; `--register` no longer blocks on local unreachability and lets the registration preflight decide. A host that _was_ reached and rejected the connection — bad credentials, a TLS error, a Postgres error — still fails locally, because the engine would see exactly the same thing.
+
+## 0.29.2
+
+### Patch Changes
+
+- **Switching to a project you never minted a key for no longer locks you out.** Project-management commands — `ablo projects list`, `create`, `rename`, and `use` — are organization-level operations, so they now accept any of the organization's stored keys (the active project's key first, then the `default` profile, then any profile still holding an unexpired key) instead of strictly the active project's key. Selecting a keyless project could previously leave `ablo projects use default` unauthorized — the one command that would undo the switch. Data commands keep the strict resolver, so this permissive fallback never routes a read or write through an unintended project.
+
 ## 0.29.1
 
 ### Patch Changes

package/dist/cli.cjs

@@ -280036,13 +280036,10 @@ function clearCredential() {
   return removed;
 }
 function resolveApiKey(modeOverride) {
-  if (process.env.ABLO_API_KEY) return process.env.ABLO_API_KEY;
-  const cfg = readConfig();
-  if (!cfg) return void 0;
-  const entry = cfg.profiles[activeProfileName(cfg)]?.[modeOverride ?? cfg.mode];
-  if (!entry) return void 0;
-  if (entry.expiresAt && Date.parse(entry.expiresAt) <= Date.now()) return void 0;
-  return entry.apiKey;
+  return resolveKey({ purpose: "data", mode: modeOverride }).key;
+}
+function resolveOrgKey(modeOverride) {
+  return resolveKey({ purpose: "org-read", mode: modeOverride }).key;
 }
 function guardActiveProjectKey() {
   if (process.env.ABLO_API_KEY) {
@@ -280054,11 +280051,31 @@ function guardActiveProjectKey() {
   const available = Object.entries(profiles).filter(([, keys]) => hasKey(keys)).map(([name]) => name);
   return { ok: hasKey(profiles[activeProfile]), activeProfile, available };
 }
+function resolveKey(policy) {
+  if (policy.scanEnvFiles) {
+    const fromProject = readProjectApiKey(policy.cwd);
+    if (fromProject) return { key: fromProject.key, source: fromProject.source };
+  } else if (process.env.ABLO_API_KEY) {
+    return { key: process.env.ABLO_API_KEY, source: "env" };
+  }
+  const cfg = readConfig();
+  if (!cfg) return { key: void 0, source: null };
+  const mode2 = policy.mode ?? cfg.mode;
+  const profiles = policy.purpose === "org-read" ? (
+    // Active first (a scoped key is preferred when present), then the
+    // org-default, then any remaining profile — deduplicated, order-preserving.
+    [.../* @__PURE__ */ new Set([activeProfileName(cfg), DEFAULT_PROFILE, ...Object.keys(cfg.profiles)])]
+  ) : [activeProfileName(cfg)];
+  for (const name of profiles) {
+    const entry = cfg.profiles[name]?.[mode2];
+    if (!entry) continue;
+    if (entry.expiresAt && Date.parse(entry.expiresAt) <= Date.now()) continue;
+    return { key: entry.apiKey, source: "stored" };
+  }
+  return { key: void 0, source: null };
+}
 function resolveEffectiveApiKey(modeOverride, cwd) {
-  const fromProject = readProjectApiKey(cwd);
-  if (fromProject) return { key: fromProject.key, source: fromProject.source };
-  const key = resolveApiKey(modeOverride);
-  return key ? { key, source: "stored" } : { key: void 0, source: null };
+  return resolveKey({ purpose: "data", mode: modeOverride, scanEnvFiles: true, cwd });
 }
 function resolvePushPlan() {
   const { key, source } = resolveEffectiveApiKey();
@@ -280254,7 +280271,7 @@ function apiUrl() {
   return (process.env.ABLO_API_URL ?? ABLO_DEFAULT_BASE_URL).replace(/\/+$/, "");
 }
 function requireKey() {
-  const apiKey = resolveApiKey();
+  const apiKey = resolveOrgKey();
   if (!apiKey) {
     console.error(
       import_picocolors3.default.red("  No API key.") + import_picocolors3.default.dim(
@@ -280460,7 +280477,7 @@ async function resolveTarget(opts) {
     keyEnv,
     confirmed,
     localProject,
-    mismatches: reconcile({ confirmed, keyEnv, localProject })
+    mismatches: reconcile({ confirmed, keyEnv, localProject, cliMode: getMode() })
   };
 }
 async function confirmFromServer(opts) {
@@ -280505,10 +280522,9 @@ function confirmedProjectSlug(project) {
   return project.isDefault ? DEFAULT_PROJECT_SLUG : project.slug;
 }
 function reconcile(input) {
-  const { confirmed, keyEnv, localProject } = input;
+  const { confirmed, keyEnv, localProject, cliMode } = input;
   const mismatches = [];
   const realEnv = confirmed?.environment ?? keyEnv;
-  const cliMode = getMode();
   if (realEnv && realEnv !== cliMode) {
     mismatches.push({ kind: "environment", keyEnv: realEnv, cliMode });
   }
@@ -281132,6 +281148,106 @@ async function migrate(argv) {
 // src/cli/connect.ts
 init_cjs_shims();
 var import_picocolors6 = __toESM(require_picocolors(), 1);
+
+// src/cli/remoteValidation.ts
+init_cjs_shims();
+var DIAL_FAILURE_CODES = /* @__PURE__ */ new Set([
+  "ENOTFOUND",
+  "EAI_AGAIN",
+  "ECONNREFUSED",
+  "ECONNRESET",
+  "ETIMEDOUT",
+  "ENETUNREACH",
+  "EHOSTUNREACH",
+  "CONNECT_TIMEOUT"
+]);
+function dialFailureReason(err) {
+  if (err === null || typeof err !== "object") return null;
+  const coded = err;
+  const code = typeof coded.code === "string" ? coded.code : null;
+  if (code && DIAL_FAILURE_CODES.has(code)) {
+    return typeof coded.message === "string" && coded.message.length > 0 ? coded.message : code;
+  }
+  if (Array.isArray(coded.errors)) {
+    for (const member of coded.errors) {
+      const reason = dialFailureReason(member);
+      if (reason) return reason;
+    }
+  }
+  return null;
+}
+function validateEndpoint(baseUrl2) {
+  return `${baseUrl2.replace(/\/+$/, "")}/api/v1/datasources/validate`;
+}
+function describeRemoteFailure(failure) {
+  switch (failure.item) {
+    case "wal_level":
+      return {
+        label: failure.actual ? `wal_level is ${failure.actual} (need logical)` : `wal_level must be logical`,
+        fix: failure.fix
+      };
+    case "publication":
+      return { label: "the Ablo publication does not exist", fix: failure.fix };
+    case "replication_role":
+      return { label: "the DATABASE_URL role lacks the REPLICATION attribute", fix: failure.fix };
+    case "replica_identity":
+      return {
+        label: `published tables cannot replicate UPDATE/DELETE${failure.actual ? ` (${failure.actual})` : ""}`,
+        fix: failure.fix
+      };
+    default:
+      return { label: failure.item, fix: failure.fix };
+  }
+}
+function parseWireFailures(value) {
+  if (!Array.isArray(value)) return [];
+  const failures = [];
+  for (const entry of value) {
+    if (entry === null || typeof entry !== "object") continue;
+    const { item, actual, fix } = entry;
+    if (typeof item !== "string" || typeof fix !== "string") continue;
+    failures.push({ item, fix, ...typeof actual === "string" ? { actual } : {} });
+  }
+  return failures;
+}
+async function requestRemoteValidation(input) {
+  const doFetch = input.fetchImpl ?? fetch;
+  let res;
+  try {
+    res = await doFetch(validateEndpoint(input.apiUrl), {
+      method: "POST",
+      headers: { "content-type": "application/json", authorization: `Bearer ${input.apiKey}` },
+      body: JSON.stringify({ connectionString: input.connectionString })
+    });
+  } catch (err) {
+    return {
+      ok: false,
+      status: 0,
+      message: `couldn't reach ${input.apiUrl}: ${err instanceof Error ? err.message : String(err)}`
+    };
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok) {
+    const code = typeof body.code === "string" ? body.code : body.error?.code;
+    const message = typeof body.message === "string" ? body.message : typeof body.error?.message === "string" ? body.error.message : `HTTP ${res.status}`;
+    return {
+      ok: false,
+      status: res.status,
+      message,
+      ...typeof code === "string" ? { code } : {}
+    };
+  }
+  const reachable = body.reachable === true;
+  return {
+    ok: true,
+    reachable,
+    ready: body.ready === true,
+    ...typeof body.reason === "string" ? { reason: body.reason } : {},
+    failures: parseWireFailures(body.failures)
+  };
+}
+
+// src/cli/connect.ts
 var ABLO_PUBLICATION = "ablo_publication";
 var ABLO_REPLICATION_ROLE = "ablo_replicator";
 function parseConnectArgs(argv) {
@@ -281361,27 +281477,94 @@ function requireDatabaseUrl(verb) {
   return dbUrl;
 }
 async function probeAndReport(dbUrl) {
-  const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
+  const sql = src_default(dbUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
   } });
   let items;
   try {
     items = await probeReadiness(sql);
   } catch (err) {
+    await sql.end({ timeout: 2 }).catch(() => void 0);
+    const dial = dialFailureReason(err);
+    if (dial) return { kind: "no-dial", reason: dial };
     const pg = err ?? {};
     console.error(import_picocolors6.default.red(`  Couldn't read the database: ${pg.message ?? String(err)}`));
-    await sql.end({ timeout: 2 });
     process.exit(1);
   }
   await sql.end({ timeout: 2 });
   for (const item of items) printCheckItem(item);
-  return items.filter((i) => !i.ok).length;
+  return { kind: "probed", failures: items.filter((i) => !i.ok).length };
+}
+async function runRemoteCheck(dbUrl, localReason) {
+  console.log(
+    `  This machine can't reach the database (${import_picocolors6.default.dim(localReason)}).
+  That is not the verdict: replication runs from Ablo's infrastructure, not from here.
+  Asking Ablo to check the database from its side\u2026
+`
+  );
+  const apiKey = resolveApiKey();
+  if (!apiKey) {
+    console.error(
+      import_picocolors6.default.red(`  The engine-side check needs an API key, and none was found.`) + import_picocolors6.default.dim(
+        ` Run ${import_picocolors6.default.bold("ablo login")} (or set ${import_picocolors6.default.bold("ABLO_API_KEY")}), then re-run ${import_picocolors6.default.bold("ablo connect --check")}.`
+      )
+    );
+    process.exit(1);
+  }
+  const apiUrl2 = (process.env.ABLO_API_URL ?? DEFAULT_URL).replace(/\/+$/, "");
+  const result = await requestRemoteValidation({ apiUrl: apiUrl2, apiKey, connectionString: dbUrl });
+  if (!result.ok) {
+    console.error(import_picocolors6.default.red(`  The engine-side check failed: ${result.message}`));
+    if (result.code === "forbidden") {
+      console.error(
+        import_picocolors6.default.dim(`  Checking a database from Ablo's side needs a ${import_picocolors6.default.bold("secret")} key (sk_\u2026). Run ${import_picocolors6.default.bold("ablo login")} for one.`)
+      );
+    }
+    console.error();
+    process.exit(1);
+  }
+  if (!result.reachable) {
+    console.error(
+      `  ${import_picocolors6.default.red("\u2717")} Ablo's infrastructure can't reach it either${result.reason ? ` ${import_picocolors6.default.dim(`(${result.reason})`)}` : ""}.`
+    );
+    console.error(
+      import_picocolors6.default.dim(
+        `  Replication needs a host Ablo's servers can dial \u2014 a localhost or private-network
+  Postgres can't be replicated by the hosted service. Use a reachable host (or a tunnel),
+  or the signed ${import_picocolors6.default.bold("dataSource()")} endpoint fallback.
+`
+      )
+    );
+    process.exit(1);
+  }
+  for (const failure of result.failures) {
+    const { label, fix } = describeRemoteFailure(failure);
+    printCheckItem({ ok: false, label, fix });
+  }
+  console.log();
+  if (result.ready) {
+    console.log(
+      `  ${import_picocolors6.default.green("\u2713")} Ready \u2014 checked from Ablo's infrastructure. Ablo can connect and tail this database's WAL.
+`
+    );
+    process.exit(0);
+  }
+  const count = result.failures.length;
+  console.log(
+    `  ${import_picocolors6.default.red(`${count} item${count === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim(`\u2014 found by Ablo's infrastructure. Apply the fixes above, then re-run ${import_picocolors6.default.bold("ablo connect --check")}.`)}
+`
+  );
+  process.exit(1);
 }
 async function runCheck() {
   const dbUrl = requireDatabaseUrl("--check");
   console.log(`
   ${brand("ablo")} ${import_picocolors6.default.dim("connect --check")}  ${import_picocolors6.default.dim("logical-replication readiness")}
 `);
-  const failures = await probeAndReport(dbUrl);
+  const outcome = await probeAndReport(dbUrl);
+  if (outcome.kind === "no-dial") {
+    return runRemoteCheck(dbUrl, outcome.reason);
+  }
+  const failures = outcome.failures;
   console.log();
   if (failures === 0) {
     console.log(`  ${import_picocolors6.default.green("\u2713")} Ready \u2014 Ablo can connect and tail this database's WAL.
@@ -281409,11 +281592,18 @@ async function runRegister() {
   console.log(`
   ${brand("ablo")} ${import_picocolors6.default.dim("connect --register")}  ${import_picocolors6.default.dim("register this database for replication")}
 `);
-  const failures = await probeAndReport(dbUrl);
-  if (failures > 0) {
+  const outcome = await probeAndReport(dbUrl);
+  if (outcome.kind === "no-dial") {
+    console.log(
+      `  This machine can't reach the database (${import_picocolors6.default.dim(outcome.reason)}) \u2014 continuing anyway.
+  Replication runs from Ablo's infrastructure, which validates the database during
+  registration and refuses with the full checklist if it isn't ready.
+`
+    );
+  } else if (outcome.failures > 0) {
     console.log(
       `
-  ${import_picocolors6.default.red(`${failures} item${failures === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim("\u2014 a database that isn\u2019t replication-ready can\u2019t stream. Fix the above, then re-run.")}
+  ${import_picocolors6.default.red(`${outcome.failures} item${outcome.failures === 1 ? "" : "s"} to fix`)} ${import_picocolors6.default.dim("\u2014 a database that isn\u2019t replication-ready can\u2019t stream. Fix the above, then re-run.")}
 `
     );
     process.exit(1);
@@ -281536,7 +281726,8 @@ var CONNECT_USAGE = `  ablo connect \u2014 connect your database for the read pa
     npx ablo connect                      Print the exact setup SQL for your Postgres
     npx ablo connect --tables a,b,c       Publish only these tables (default: all tables)
     npx ablo connect --role <name>        Name the replication role (default: ablo_replicator)
-    npx ablo connect --check              Validate DATABASE_URL is replication-ready
+    npx ablo connect --check              Validate DATABASE_URL is replication-ready (runs from Ablo's
+                                          infrastructure when this machine can't reach the host)
     npx ablo connect --register           Register DATABASE_URL so Ablo replicates it (one self-service step)
     npx ablo connect --audit-infra        Read-only Stage 5 audit for deprecated Ablo sync tables/types`;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/ablo",
-  "version": "0.29.1",
+  "version": "0.29.3",
   "description": "The Collaboration Layer For AI Agents",
   "license": "Apache-2.0",
   "type": "module",