@abloatai/cli 0.56.0 → 0.57.0

package/dist/cli.cjs

@@ -3970,7 +3970,7 @@ var init_observeCliError = __esm({
     import_errorObservation = require("@abloatai/transaction/errorObservation");
     import_errors5 = require("@abloatai/transaction/errors");
     dsn = process.env.ABLO_CLI_SENTRY_DSN ?? "https://1ac154bff10b06836e1ea9de9e0d92f0@o4510928209772544.ingest.de.sentry.io/4511660691423312" ?? "";
-    release = process.env.ABLO_CLI_RELEASE ?? "@abloatai/cli@0.56.0";
+    release = process.env.ABLO_CLI_RELEASE ?? "@abloatai/cli@0.57.0";
     initialized = false;
     nativeProcessExit = process.exit.bind(process);
     exitBoundaryInstalled = false;
@@ -4297,7 +4297,7 @@ var init_src2 = __esm({
 
 // src/cliEnvironment.ts
 function cliVersion() {
-  return "0.56.0";
+  return "0.57.0";
 }
 function cliOs() {
   const value = (0, import_node_os.platform)();
@@ -4372,7 +4372,9 @@ function trackCliSchemaPushAttempted() {
 }
 function flushProductAnalytics(options = {}) {
   if (flushInFlight) return flushInFlight;
-  flushInFlight = flushOnce(options).catch(() => void 0).finally(() => {
+  flushInFlight = flushOnce(options).catch((error) => {
+    void error;
+  }).finally(() => {
     flushInFlight = null;
   });
   return flushInFlight;
@@ -4395,8 +4397,8 @@ function queueEvent(eventName, properties) {
     state.queue = [...state.queue, parsed].slice(-MAX_QUEUED_EVENTS);
     writeState(state);
     if (disclose) {
-      console.error(
-        "Ablo collects limited usage analytics. Run `ablo telemetry disable` to opt out or `ablo telemetry status` for details."
+      process.stderr.write(
+        "Ablo collects limited usage analytics. Run `ablo telemetry disable` to opt out or `ablo telemetry status` for details.\n"
       );
     }
   } catch {
@@ -4473,8 +4475,9 @@ function writeState(state) {
 function environmentBlocker() {
   if (process.env.ABLO_TELEMETRY_DISABLED === "1") return "ABLO_TELEMETRY_DISABLED";
   if (process.env.DO_NOT_TRACK === "1") return "DO_NOT_TRACK";
-  const ciVariables = ["CI", "GITHUB_ACTIONS", "GITLAB_CI", "BUILDKITE", "CIRCLECI", "TF_BUILD"];
-  return ciVariables.find((name) => truthyEnvironmentValue(process.env[name])) ?? null;
+  return TELEMETRY_BLOCKING_ENV.slice(2).find(
+    (name) => truthyEnvironmentValue(process.env[name])
+  ) ?? null;
 }
 function truthyEnvironmentValue(value) {
   return value !== void 0 && value !== "" && value !== "0" && value.toLowerCase() !== "false";
@@ -4502,7 +4505,7 @@ function runTelemetryCommand(argv) {
   if (status2.blockedBy) console.log(`Environment override: ${status2.blockedBy}`);
   console.log(`Queued events: ${status2.queuedEvents}`);
 }
-var import_node_crypto2, import_node_fs, import_node_path, TELEMETRY_FILE_VERSION, MAX_QUEUED_EVENTS, MAX_FLUSH_EVENTS, DEFAULT_FLUSH_TIMEOUT_MS, flushInFlight;
+var import_node_crypto2, import_node_fs, import_node_path, TELEMETRY_FILE_VERSION, MAX_QUEUED_EVENTS, MAX_FLUSH_EVENTS, DEFAULT_FLUSH_TIMEOUT_MS, flushInFlight, TELEMETRY_BLOCKING_ENV;
 var init_telemetry = __esm({
   "src/telemetry.ts"() {
     "use strict";
@@ -4519,6 +4522,16 @@ var init_telemetry = __esm({
     MAX_FLUSH_EVENTS = 20;
     DEFAULT_FLUSH_TIMEOUT_MS = 800;
     flushInFlight = null;
+    TELEMETRY_BLOCKING_ENV = [
+      "ABLO_TELEMETRY_DISABLED",
+      "DO_NOT_TRACK",
+      "CI",
+      "GITHUB_ACTIONS",
+      "GITLAB_CI",
+      "BUILDKITE",
+      "CIRCLECI",
+      "TF_BUILD"
+    ];
   }
 });
 
@@ -288767,6 +288780,9 @@ async function check(argv) {
   }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const schemaJson = JSON.parse((0, import_schema9.serializeSchema)(schema));
+  const accessFindings = new Map(
+    (0, import_schema9.auditSchemaAccessPolicies)(schemaJson).map((finding) => [finding.model, finding])
+  );
   console.log(`
   ${brand("ablo")} ${import_picocolors25.default.dim("check")}  ${import_picocolors25.default.dim(`schema "${args.appSchema}"`)}
 `);
@@ -288807,6 +288823,12 @@ async function check(argv) {
     }
     const problems = [];
     const warns = [];
+    const accessFinding = accessFindings.get(key);
+    if (accessFinding) {
+      problems.push(
+        `[${accessFinding.code}] ${accessFinding.message} Fix: ${accessFinding.fix}`
+      );
+    }
     if (!present.has("id")) problems.push('missing primary key "id"');
     const orgCol = (0, import_schema9.tenancyColumn)((0, import_schema9.resolveTenancy)(model));
     if (orgCol && !present.has(orgCol)) {
@@ -289751,8 +289773,21 @@ export async function POST(request: Request): Promise<Response> {
     );
   }
 
+  const authorizedScope = await authorizeActiveWorkspace(user.id);
+  if (!authorizedScope) {
+    return Response.json(
+      credentialEndpointErrorSchema.parse({
+        error: { code: 'policy_denied', message: 'Workspace membership is stale or revoked' },
+      }),
+      { status: 403, headers: noStore },
+    );
+  }
+
   const { token, expiresAt } = await sync.sessions.create({
     user: { id: user.id },
+    // These ids came from the server-side membership lookup below. Never take
+    // organization, workspace, team, or group ids from the request body.
+    syncGroups: authorizedScope.syncGroups,
     can: { records: ['read', 'create', 'update'] },
   });
   return Response.json(
@@ -289776,6 +289811,27 @@ async function getCurrentUser(): Promise<{ id: string } | null> {
   const session = await auth.api.getSession({ headers: await headers() });
   return session?.user ? { id: session.user.id } : null;
 }
+
+type AuthorizedWorkspace = {
+  workspaceId: string;
+  syncGroups: readonly [\`workspace:\${string}\`, ...\`\${string}:\${string}\`[]];
+};
+
+async function authorizeActiveWorkspace(userId: string): Promise<AuthorizedWorkspace | null> {
+  void userId;
+  // REQUIRED: query your membership table here, immediately before minting.
+  // Read the active workspace from the server-side session, verify this user has
+  // an active membership, and derive every team/group id on the server. Return
+  // null for a stale or revoked membership. This refusal keeps a newly generated
+  // route from turning "signed in" into workspace authorization by accident.
+  //
+  // Example after your membership query:
+  // return {
+  //   workspaceId: membership.workspaceId,
+  //   syncGroups: [\`workspace:\${membership.workspaceId}\`],
+  // };
+  return null;
+}
 `;
 }
 
@@ -289808,7 +289864,7 @@ export const schema = defineSchema({
 });
 `;
 }
-function generateSyncConfig(auth) {
+function generateSyncConfig(auth, options = {}) {
   const authLine = auth === "apikey" ? "" : auth === "firebase" ? `
   auth: async () => {
     const { getAuth } = await import('firebase/auth');
@@ -289820,7 +289876,7 @@ function generateSyncConfig(auth) {
   // auth: async () => { const { data } = await supabase.auth.getSession(); return data.session?.access_token ?? ''; },` : auth === "betterauth" ? `
   // auth: async () => { const session = await authClient.getSession(); return session?.token ?? ''; },` : `
   // auth: () => 'your-jwt-token', // replace with your auth provider`;
-  return `import Ablo from '@abloatai/ablo';
+  return `${options.serverOnly ? "import 'server-only';\n\n" : ""}import Ablo from '@abloatai/ablo';
 import { schema } from './schema';
 
 // SERVER-ONLY client \u2014 it holds your \`sk_\` key. Use it from server code: the
@@ -289982,7 +290038,10 @@ export async function POST(req: Request): Promise<Response> {
     const model: unknown = Reflect.get(prisma, event.model); // prisma.record, prisma.task, \u2026
     if (!isModelDelegate(model)) continue; // a model you don't mirror locally \u2014 skip it
     if (event.data === null) {
-      await model.delete({ where: { id: event.objectId } }).catch(() => {}); // already gone
+      await model.delete({ where: { id: event.objectId } }).catch((error) => {
+        // Idempotent replay: a missing local row is already the desired state.
+        void error;
+      });
     } else {
       await model.upsert({ where: { id: event.objectId }, create: event.data, update: event.data });
     }
@@ -290062,7 +290121,7 @@ async function main() {
 main().catch((err) => {
   // Ablo errors stringify to one clean line (code + message + docs link),
   // never a stack/object dump \u2014 see AbloError.toString().
-  console.error(String(err));
+  process.stderr.write(String(err) + '\\n');
   process.exit(1);
 });
 `;
@@ -290413,7 +290472,10 @@ async function runInit(args = []) {
     }
   }
   files.push({ path: (0, import_node_path5.join)(abloDir, "schema.ts"), content: schemaSource, note: schemaNote });
-  files.push({ path: (0, import_node_path5.join)(abloDir, "index.ts"), content: generateSyncConfig(auth) });
+  files.push({
+    path: (0, import_node_path5.join)(abloDir, "index.ts"),
+    content: generateSyncConfig(auth, { serverOnly: framework === "nextjs" })
+  });
   files.push({ path: (0, import_node_path5.join)(abloDir, "register.ts"), content: generateRegister() });
   const orm = detectOrm(opts.orm);
   if (storage === "endpoint") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/cli",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "The ablo command line: set up Ablo, connect your database, and push your schema from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -35,10 +35,10 @@
   },
   "dependencies": {
     "@sentry/node": "^10.18.0",
-    "@abloatai/transaction": "^0.56.0",
+    "@abloatai/transaction": "^0.57.0",
     "jiti": "^2.7.0",
     "zod": "^4.4.3",
-    "@abloatai/humans": "^0.56.0"
+    "@abloatai/humans": "^0.57.0"
   },
   "devDependencies": {
     "@ablo/product-analytics": "file:../product-analytics",