@abloatai/cli 0.55.0 → 0.57.0

package/dist/cli.cjs

@@ -3970,7 +3970,7 @@ var init_observeCliError = __esm({
     import_errorObservation = require("@abloatai/transaction/errorObservation");
     import_errors5 = require("@abloatai/transaction/errors");
     dsn = process.env.ABLO_CLI_SENTRY_DSN ?? "https://1ac154bff10b06836e1ea9de9e0d92f0@o4510928209772544.ingest.de.sentry.io/4511660691423312" ?? "";
-    release = process.env.ABLO_CLI_RELEASE ?? "@abloatai/cli@0.55.0";
+    release = process.env.ABLO_CLI_RELEASE ?? "@abloatai/cli@0.57.0";
     initialized = false;
     nativeProcessExit = process.exit.bind(process);
     exitBoundaryInstalled = false;
@@ -4297,7 +4297,7 @@ var init_src2 = __esm({
 
 // src/cliEnvironment.ts
 function cliVersion() {
-  return "0.55.0";
+  return "0.57.0";
 }
 function cliOs() {
   const value = (0, import_node_os.platform)();
@@ -4372,7 +4372,9 @@ function trackCliSchemaPushAttempted() {
 }
 function flushProductAnalytics(options = {}) {
   if (flushInFlight) return flushInFlight;
-  flushInFlight = flushOnce(options).catch(() => void 0).finally(() => {
+  flushInFlight = flushOnce(options).catch((error) => {
+    void error;
+  }).finally(() => {
     flushInFlight = null;
   });
   return flushInFlight;
@@ -4395,8 +4397,8 @@ function queueEvent(eventName, properties) {
     state.queue = [...state.queue, parsed].slice(-MAX_QUEUED_EVENTS);
     writeState(state);
     if (disclose) {
-      console.error(
-        "Ablo collects limited usage analytics. Run `ablo telemetry disable` to opt out or `ablo telemetry status` for details."
+      process.stderr.write(
+        "Ablo collects limited usage analytics. Run `ablo telemetry disable` to opt out or `ablo telemetry status` for details.\n"
       );
     }
   } catch {
@@ -4473,8 +4475,9 @@ function writeState(state) {
 function environmentBlocker() {
   if (process.env.ABLO_TELEMETRY_DISABLED === "1") return "ABLO_TELEMETRY_DISABLED";
   if (process.env.DO_NOT_TRACK === "1") return "DO_NOT_TRACK";
-  const ciVariables = ["CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "CIRCLECI", "TF_BUILD"];
-  return ciVariables.find((name) => truthyEnvironmentValue(process.env[name])) ?? null;
+  return TELEMETRY_BLOCKING_ENV.slice(2).find(
+    (name) => truthyEnvironmentValue(process.env[name])
+  ) ?? null;
 }
 function truthyEnvironmentValue(value) {
   return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
@@ -4502,7 +4505,7 @@ function runTelemetryCommand(argv) {
   if (status2.blockedBy) console.log(`Environment override: ${status2.blockedBy}`);
   console.log(`Queued events: ${status2.queuedEvents}`);
 }
-var import_node_crypto2, import_node_fs, import_node_path, TELEMETRY_FILE_VERSION, MAX_QUEUED_EVENTS, MAX_FLUSH_EVENTS, DEFAULT_FLUSH_TIMEOUT_MS, flushInFlight;
+var import_node_crypto2, import_node_fs, import_node_path, TELEMETRY_FILE_VERSION, MAX_QUEUED_EVENTS, MAX_FLUSH_EVENTS, DEFAULT_FLUSH_TIMEOUT_MS, flushInFlight, TELEMETRY_BLOCKING_ENV;
 var init_telemetry = __esm({
   "src/telemetry.ts"() {
     "use strict";
@@ -4519,6 +4522,16 @@ var init_telemetry = __esm({
     MAX_FLUSH_EVENTS = 20;
     DEFAULT_FLUSH_TIMEOUT_MS = 800;
     flushInFlight = null;
+    TELEMETRY_BLOCKING_ENV = [
+      "ABLO_TELEMETRY_DISABLED",
+      "DO_NOT_TRACK",
+      "CI",
+      "GITHUB_ACTIONS",
+      "GITLAB_CI",
+      "BUILDKITE",
+      "CIRCLECI",
+      "TF_BUILD"
+    ];
   }
 });
 
@@ -284792,21 +284805,14 @@ function classifyKey(apiKey) {
     reason: `${import_picocolors16.default.bold("ABLO_API_KEY")} is not a secret Ablo key. Expected a branch-bound ${import_picocolors16.default.bold("sk_\u2026")} credential. Run ${import_picocolors16.default.bold("npx ablo dev")} to prepare a development branch.`
   };
 }
-function wireEnvLocal(apiKey, cwd = process.cwd(), projectId, branchId) {
+function wireEnvLocal(apiKey, cwd = process.cwd()) {
   const envPath = (0, import_path5.resolve)(cwd, ".env.local");
   const line = `ABLO_API_KEY=${apiKey}`;
-  const projectLine = projectId ? `ABLO_PROJECT_ID=${projectId}` : null;
-  const branchLine = branchId ? `ABLO_BRANCH_ID=${branchId}` : null;
   let action;
+  let removedPins = [];
   if (!(0, import_fs7.existsSync)(envPath)) {
-    (0, import_fs7.writeFileSync)(
-      envPath,
-      `${line}
-${projectLine ? `${projectLine}
-` : ""}${branchLine ? `${branchLine}
-` : ""}`,
-      { mode: 384 }
-    );
+    (0, import_fs7.writeFileSync)(envPath, `${line}
+`, { mode: 384 });
     action = `Created ${import_picocolors16.default.bold(".env.local")} with ${import_picocolors16.default.bold("ABLO_API_KEY")}`;
   } else {
     const content = (0, import_fs7.readFileSync)(envPath, "utf8");
@@ -284822,25 +284828,16 @@ ${projectLine ? `${projectLine}
       (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
       action = `Updated ${import_picocolors16.default.bold("ABLO_API_KEY")} in ${import_picocolors16.default.bold(".env.local")} ${import_picocolors16.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
     }
-    if (projectLine) {
-      const next = (0, import_fs7.readFileSync)(envPath, "utf8");
-      if (/^ABLO_PROJECT_ID=.*$/m.test(next)) {
-        (0, import_fs7.writeFileSync)(envPath, next.replace(/^ABLO_PROJECT_ID=.*$/m, projectLine));
-      } else {
-        (0, import_fs7.appendFileSync)(envPath, `${next.endsWith("\n") || next.length === 0 ? "" : "\n"}${projectLine}
-`);
-      }
-    }
-    if (branchLine) {
-      const next = (0, import_fs7.readFileSync)(envPath, "utf8");
-      if (/^ABLO_BRANCH_ID=.*$/m.test(next)) {
-        (0, import_fs7.writeFileSync)(envPath, next.replace(/^ABLO_BRANCH_ID=.*$/m, branchLine));
-      } else {
-        (0, import_fs7.appendFileSync)(envPath, `${next.endsWith("\n") || next.length === 0 ? "" : "\n"}${branchLine}
-`);
-      }
+    const before = (0, import_fs7.readFileSync)(envPath, "utf8");
+    const after = before.replace(/^ABLO_(?:PROJECT|BRANCH)_ID=.*\n?/gm, "");
+    if (after !== before) {
+      removedPins = ["ABLO_PROJECT_ID", "ABLO_BRANCH_ID"].filter(
+        (key) => new RegExp(`^${key}=`, "m").test(before)
+      );
+      (0, import_fs7.writeFileSync)(envPath, after);
     }
   }
+  const pinNote = removedPins.length ? ` Removed ${removedPins.map((key) => import_picocolors16.default.bold(key)).join(" and ")}; the key names its own project and branch.` : "";
   const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
   const gitignore = (0, import_fs7.existsSync)(gitignorePath) ? (0, import_fs7.readFileSync)(gitignorePath, "utf8") : "";
   const ignored = /^(\.env\.local|\.env\*|\.env\.\*|\.env.*)$/m.test(gitignore);
@@ -284854,7 +284851,7 @@ ${projectLine ? `${projectLine}
     );
     gitignoreNote = ` Added ${import_picocolors16.default.bold(".env.local")} to ${import_picocolors16.default.bold(".gitignore")} so the key can't be committed.`;
   }
-  return `${action}.${gitignoreNote}`;
+  return `${action}.${pinNote}${gitignoreNote}`;
 }
 async function runPush(schema, args) {
   const { ok, status: status2, body, bodyText } = await pushSchema(schema, {
@@ -285015,7 +285012,7 @@ async function dev(argv, runtime = {}) {
   if (runtime.branch) {
     console.log(
       `
-  ${import_picocolors16.default.green("\u2713")} ${wireEnvLocal(args.apiKey, process.cwd(), runtime.branch.projectId, runtime.branch.id)}`
+  ${import_picocolors16.default.green("\u2713")} ${wireEnvLocal(args.apiKey, process.cwd())}`
     );
     console.log(
       `  ${import_picocolors16.default.dim(`Temporary branch credential expires ${runtime.branch.expiresAt}; rerun ablo dev to rotate it.`)}`
@@ -285446,6 +285443,10 @@ init_controlPlane();
 init_config();
 init_target();
 init_readiness();
+function doctorVerdict(counts) {
+  if (counts.blockers > 0 || counts.failed > 0) return "blocked";
+  return counts.skipped > 0 ? "unverified" : "ready";
+}
 function render(check2) {
   const mark = check2.state === "ok" ? import_picocolors18.default.green("\u2713") : check2.state === "fail" ? import_picocolors18.default.red("\u2717") : import_picocolors18.default.dim("\u2013");
   console.log(
@@ -285607,7 +285608,15 @@ async function inspectDoctor(options = {}) {
   if (delivery.kind === "known") {
     const when = windowWords(delivery.window_seconds);
     checks.push(
-      delivery.unroutable > 0 ? {
+      delivery.unroutable > 0 ? delivery.unroutable === delivery.recorded ? {
+        // Nothing at all was routable. One bad row does not look like
+        // this, so the cause is the plane rather than the rows: reporting
+        // it as "N of N" would send the reader hunting for the N.
+        label: "delivery",
+        state: "fail",
+        detail: `no change reached anyone (${delivery.recorded} in ${when})`,
+        fix: "run `ablo check`. When nothing routes, the tenancy value is usually missing for the whole plane rather than for particular rows."
+      } : {
         label: "delivery",
         state: "fail",
         detail: `${delivery.unroutable} of ${delivery.recorded} change${delivery.recorded === 1 ? "" : "s"} in ${when} reached nobody` + (delivery.sample ? ` (e.g. ${delivery.sample.model}/${delivery.sample.id})` : ""),
@@ -285642,7 +285651,8 @@ async function inspectDoctor(options = {}) {
     dataSource,
     pushedSchema: pushed,
     schemaDrift: drift,
-    delivery
+    delivery,
+    verdict: doctorVerdict({ blockers: blocking.length, failed, skipped })
   };
 }
 function renderDoctorReport(report) {
@@ -285660,7 +285670,7 @@ function renderDoctorReport(report) {
     );
   } else if (report.skipped > 0) {
     console.log(
-      `  ${import_picocolors18.default.yellow("?")} ${import_picocolors18.default.dim(`nothing is blocking a write, but ${report.skipped} check${report.skipped === 1 ? "" : "s"} could not be run`)}`
+      `  ${import_picocolors18.default.yellow("?")} ${import_picocolors18.default.dim(`nothing found a problem, but ${report.skipped} check${report.skipped === 1 ? "" : "s"} could not be run. This is not a clean bill of health.`)}`
     );
   } else {
     console.log(
@@ -285669,10 +285679,26 @@ function renderDoctorReport(report) {
   }
   console.log();
 }
-async function doctor() {
+function doctorReportAsJson(report) {
+  return JSON.stringify(
+    {
+      object: "doctor_report",
+      verdict: report.verdict,
+      checks: report.checks,
+      blockers: report.blockers
+    },
+    null,
+    2
+  );
+}
+async function doctor(argv = []) {
   const report = await inspectDoctor();
-  renderDoctorReport(report);
-  if (!report.ready) process.exitCode = 1;
+  if (argv.includes("--json") || process.env.ABLO_JSON === "1") {
+    console.log(doctorReportAsJson(report));
+  } else {
+    renderDoctorReport(report);
+  }
+  if (report.verdict !== "ready") process.exitCode = 1;
 }
 
 // src/setup/contracts.ts
@@ -287508,7 +287534,10 @@ var COMMANDS = [
     core: { group: "Every day", does: "Check the whole setup at once and list everything that would block a write" },
     full: {
       group: "See what's happening",
-      rows: [{ run: "doctor", does: "Every setup check at once \u2014 exits non-zero when a write would fail" }]
+      rows: [
+        { run: "doctor", does: "Every setup check at once. Exits non-zero when a write would fail, or when a check could not be run" },
+        { run: "doctor --json", does: "The same verdict as data, for a script or an agent" }
+      ]
     }
   },
   {
@@ -288751,6 +288780,9 @@ async function check(argv) {
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const schemaJson = JSON.parse((0, import_schema9.serializeSchema)(schema));
+  const accessFindings = new Map(
+    (0, import_schema9.auditSchemaAccessPolicies)(schemaJson).map((finding) => [finding.model, finding])
+  );
   console.log(`
   ${brand("ablo")} ${import_picocolors25.default.dim("check")}  ${import_picocolors25.default.dim(`schema "${args.appSchema}"`)}
 `);
@@ -288791,6 +288823,12 @@ async function check(argv) {
     }
     const problems = [];
     const warns = [];
+    const accessFinding = accessFindings.get(key);
+    if (accessFinding) {
+      problems.push(
+        `[${accessFinding.code}] ${accessFinding.message} Fix: ${accessFinding.fix}`
+      );
+    }
     if (!present.has("id")) problems.push('missing primary key "id"');
     const orgCol = (0, import_schema9.tenancyColumn)((0, import_schema9.resolveTenancy)(model));
     if (orgCol && !present.has(orgCol)) {
@@ -289735,8 +289773,21 @@ export async function POST(request: Request): Promise<Response> {
     );
   }
 
+  const authorizedScope = await authorizeActiveWorkspace(user.id);
+  if (!authorizedScope) {
+    return Response.json(
+      credentialEndpointErrorSchema.parse({
+        error: { code: 'policy_denied', message: 'Workspace membership is stale or revoked' },
+      }),
+      { status: 403, headers: noStore },
+    );
+  }
+
   const { token, expiresAt } = await sync.sessions.create({
     user: { id: user.id },
+    // These ids came from the server-side membership lookup below. Never take
+    // organization, workspace, team, or group ids from the request body.
+    syncGroups: authorizedScope.syncGroups,
     can: { records: ['read', 'create', 'update'] },
   });
   return Response.json(
@@ -289760,6 +289811,27 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
   const session = await auth.api.getSession({ headers: await headers() });
   return session?.user ? { id: session.user.id } : null;
 }
+
+type AuthorizedWorkspace = {
+  workspaceId: string;
+  syncGroups: readonly [\`workspace:\${string}\`, ...\`\${string}:\${string}\`[]];
+};
+
+async function authorizeActiveWorkspace(userId: string): Promise<AuthorizedWorkspace | null> {
+  void userId;
+  // REQUIRED: query your membership table here, immediately before minting.
+  // Read the active workspace from the server-side session, verify this user has
+  // an active membership, and derive every team/group id on the server. Return
+  // null for a stale or revoked membership. This refusal keeps a newly generated
+  // route from turning "signed in" into workspace authorization by accident.
+  //
+  // Example after your membership query:
+  // return {
+  //   workspaceId: membership.workspaceId,
+  //   syncGroups: [\`workspace:\${membership.workspaceId}\`],
+  // };
+  return null;
+}
 `;
 }
 
@@ -289792,7 +289864,7 @@ export const schema = defineSchema({
 });
 `;
 }
-function generateSyncConfig(auth) {
+function generateSyncConfig(auth, options = {}) {
   const authLine = auth === "apikey" ? "" : auth === "firebase" ? `
   auth: async () => {
     const { getAuth } = await import('firebase/auth');
@@ -289804,7 +289876,7 @@ function generateSyncConfig(auth) {
   // auth: async () => { const { data } = await supabase.auth.getSession(); return data.session?.access_token ?? ''; },` : auth === "betterauth" ? `
   // auth: async () => { const session = await authClient.getSession(); return session?.token ?? ''; },` : `
   // auth: () => 'your-jwt-token', // replace with your auth provider`;
-  return `import Ablo from '@abloatai/ablo';
+  return `${options.serverOnly ? "import 'server-only';\n\n" : ""}import Ablo from '@abloatai/ablo';
 import { schema } from './schema';
 
 // SERVER-ONLY client \u2014 it holds your \`sk_\` key. Use it from server code: the
@@ -289813,8 +289885,6 @@ import { schema } from './schema';
 // via the session route and never touches the key.
 export const sync = Ablo({
   apiKey: process.env.ABLO_API_KEY,${authLine}
-  workspaceId: process.env.ABLO_PROJECT_ID,
-  branchId: process.env.ABLO_BRANCH_ID,
   schema,
 });
 
@@ -289840,7 +289910,7 @@ function generateEnv(storage, opts = {}) {
   const { includeApiKey = true } = opts;
   const databaseBlock = storage === "replication" ? "# Used by `npx ablo connect` to set up + register logical replication \u2014 the\n# DIRECT (un-pooled) endpoint. Ablo TAILS your WAL from here; it never writes.\n# The client never sees it; the browser never sees it. Your DB stays yours.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
   const webhookBlock = storage === "endpoint" ? "# Signing secret for the webhook receiver (app/api/ablo/webhooks/route.ts).\n# Ablo mints this when you register the endpoint's URL (POST /v1/webhook_endpoints\n# or the dashboard) and returns it once \u2014 paste it here.\nABLO_WEBHOOK_SECRET=whsec_your_endpoint_secret_here\n" : "";
-  const apiKeyBlock = includeApiKey ? "# Ablo: a branch-bound sk_ key (`npx ablo dev` wires both values for you).\n# Project + branch are assertions: the SDK rejects a key for another app or environment.\nABLO_API_KEY=sk_your_key_here\nABLO_PROJECT_ID=proj_your_project_id\nABLO_BRANCH_ID=br_your_branch_id\n" : "";
+  const apiKeyBlock = includeApiKey ? "# Ablo: a branch-bound sk_ key (`npx ablo dev` writes it for you).\n# The key names its own project and branch, so nothing else is needed here.\nABLO_API_KEY=sk_your_key_here\n" : "";
   return `${apiKeyBlock}${webhookBlock}${databaseBlock}`;
 }
 function generateDataSource(orm) {
@@ -289968,7 +290038,10 @@ export async function POST(req: Request): Promise<Response> {
     const model: unknown = Reflect.get(prisma, event.model); // prisma.record, prisma.task, \u2026
     if (!isModelDelegate(model)) continue; // a model you don't mirror locally \u2014 skip it
     if (event.data === null) {
-      await model.delete({ where: { id: event.objectId } }).catch(() => {}); // already gone
+      await model.delete({ where: { id: event.objectId } }).catch((error) => {
+        // Idempotent replay: a missing local row is already the desired state.
+        void error;
+      });
     } else {
       await model.upsert({ where: { id: event.objectId }, create: event.data, update: event.data });
     }
@@ -290048,7 +290121,7 @@ async function main() {
 main().catch((err) => {
   // Ablo errors stringify to one clean line (code + message + docs link),
   // never a stack/object dump \u2014 see AbloError.toString().
-  console.error(String(err));
+  process.stderr.write(String(err) + '\\n');
   process.exit(1);
 });
 `;
@@ -290399,7 +290472,10 @@ async function runInit(args = []) {
     }
   }
   files.push({ path: (0, import_node_path5.join)(abloDir, "schema.ts"), content: schemaSource, note: schemaNote });
-  files.push({ path: (0, import_node_path5.join)(abloDir, "index.ts"), content: generateSyncConfig(auth) });
+  files.push({
+    path: (0, import_node_path5.join)(abloDir, "index.ts"),
+    content: generateSyncConfig(auth, { serverOnly: framework === "nextjs" })
+  });
   files.push({ path: (0, import_node_path5.join)(abloDir, "register.ts"), content: generateRegister() });
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {
@@ -290531,7 +290607,7 @@ var HANDLERS = {
   branch: (argv) => branches([...argv]),
   status: (argv) => status([...argv]),
   whoami: (argv) => whoami([...argv]),
-  doctor: () => doctor(),
+  doctor: (argv) => doctor([...argv]),
   logs: (argv) => logs([...argv]),
   webhooks: (argv) => webhooks([...argv]),
   check: (argv) => check([...argv]),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/cli",
-  "version": "0.55.0",
+  "version": "0.57.0",
   "description": "The ablo command line: set up Ablo, connect your database, and push your schema from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -35,10 +35,10 @@
   },
   "dependencies": {
     "@sentry/node": "^10.18.0",
-    "@abloatai/transaction": "^0.55.0",
+    "@abloatai/transaction": "^0.57.0",
     "jiti": "^2.7.0",
     "zod": "^4.4.3",
-    "@abloatai/humans": "^0.55.0"
+    "@abloatai/humans": "^0.57.0"
   },
   "devDependencies": {
     "@ablo/product-analytics": "file:../product-analytics",