@apso/cli 0.27.0 → 0.29.0

package/README.md

@@ -314,7 +314,7 @@ apso config reset                  # Reset to defaults
 | `webUrl` | string | Platform web URL |
 | `verbose` | boolean | Enable verbose output |
 | `noColor` | boolean | Disable colored output |
-| `telemetryDisabled` | boolean | Opt out of anonymous telemetry |
+| `telemetryDisabled` | boolean | Opt out of anonymous telemetry (or `apso config set telemetry off`) |
 | `defaultWorkspace` | string | Default workspace slug |
 
 Boolean values accept `true`/`false` or `1`/`0`.
@@ -327,6 +327,7 @@ Environment variables override config file values:
 | `APSO_WEB_URL` | `webUrl` |
 | `APSO_DEBUG=true` | `verbose` |
 | `NO_COLOR` or `APSO_NO_COLOR=true` | `noColor` |
+| `APSO_TELEMETRY=0` / `DO_NOT_TRACK=1` | `telemetryDisabled` |
 
 ### `apso schema`
 
@@ -348,6 +349,32 @@ apso [command] --help       # Show command help
 apso [command] --version    # Show CLI version
 ```
 
+## Telemetry & privacy
+
+The CLI sends anonymous usage data so we can see which commands are used and
+prioritize accordingly. It is opt-out and carries no personal data.
+
+**What is collected:** command name (`generate`, `init`, `deploy`, …), CLI
+version, OS and architecture, Node version, command duration and success, and
+an anonymous install id (a random UUID stored in your CLI config — not derived
+from any machine identifier). If you are logged in, events attribute to your
+Apso account, the same as the web app.
+
+**What is never collected:** your source code, your `.apsorc` or schema
+contents, file paths, environment variable values, or any other file contents.
+
+**Opt out** any of these ways:
+
+```bash
+apso config set telemetry off     # persisted in your CLI config
+export APSO_TELEMETRY=0            # per-shell
+export DO_NOT_TRACK=1             # honors the consoledonottrack.com standard
+```
+
+On first run the CLI prints a one-time notice pointing at these opt-outs.
+See [`docs/telemetry.md`](docs/telemetry.md) for full detail. Aggregate
+public download stats (npm/PyPI) are available via `node scripts/usage-stats.mjs`.
+
 ## Supported languages
 
 | Language | Framework | ORM | Status |

package/dist/commands/config.js

@@ -26,6 +26,19 @@ function parseBoolean(value) {
         return false;
     return null;
 }
+/**
+ * Parse the friendly `telemetry on|off` value into the underlying
+ * `telemetryDisabled` boolean. `off` (opt out) => disabled = true.
+ * Accepts on/off, enabled/disabled, and true/false/1/0.
+ */
+function parseTelemetryToggle(value) {
+    const lower = value.toLowerCase();
+    if (["off", "false", "0", "disabled", "no"].includes(lower))
+        return true;
+    if (["on", "true", "1", "enabled", "yes"].includes(lower))
+        return false;
+    return null;
+}
 class Config extends base_command_1.default {
     async run() {
         const { args, argv } = await this.parse(Config);
@@ -46,6 +59,11 @@ class Config extends base_command_1.default {
             if (!key) {
                 this.error("Usage: apso config get <key>");
             }
+            // Friendly read-alias: `telemetry` reports on/off from telemetryDisabled.
+            if (key === "telemetry") {
+                this.log(config_1.globalConfig.read().telemetryDisabled ? "off" : "on");
+                return;
+            }
             if (!VALID_KEYS.includes(key)) {
                 this.error(`Unknown key: ${key}\nValid keys: ${VALID_KEYS.join(", ")}`);
             }
@@ -59,6 +77,16 @@ class Config extends base_command_1.default {
             if (!key || value === undefined) {
                 this.error("Usage: apso config set <key> <value>");
             }
+            // Friendly write-alias: `telemetry on|off` maps to telemetryDisabled.
+            if (key === "telemetry") {
+                const disabled = parseTelemetryToggle(value);
+                if (disabled === null) {
+                    this.error(`Invalid telemetry value: ${value}. Use on or off.`);
+                }
+                config_1.globalConfig.set("telemetryDisabled", disabled);
+                this.log(`telemetry = ${disabled ? "off" : "on"}`);
+                return;
+            }
             if (!VALID_KEYS.includes(key)) {
                 this.error(`Unknown key: ${key}\nValid keys: ${VALID_KEYS.join(", ")}`);
             }
@@ -94,6 +122,7 @@ Config.examples = [
     `$ apso config`,
     `$ apso config get apiUrl`,
     `$ apso config set verbose true`,
+    `$ apso config set telemetry off`,
     `$ apso config reset`,
 ];
 Config.strict = false;

package/dist/commands/deploy.d.ts

@@ -9,6 +9,7 @@ export default class Deploy extends BaseCommand {
         "skip-push": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         repo: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
         branch: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        "local-git": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;
     /**

package/dist/commands/deploy.js

@@ -11,6 +11,7 @@ const apsorc_parser_1 = require("../lib/apsorc-parser");
 const sandbox_1 = require("../lib/migrate/sandbox");
 const spinner_1 = require("../lib/utils/spinner");
 const interactive_1 = require("../lib/utils/interactive");
+const server_push_1 = require("../lib/deploy/server-push");
 class Deploy extends base_command_1.default {
     async run() {
         const { flags } = await this.parse(Deploy);
@@ -68,7 +69,7 @@ class Deploy extends base_command_1.default {
         // Sync local code to the connected GitHub repo (the deploy builds from it).
         // Skip for redeploys of already-synced code.
         if (!flags["skip-push"]) {
-            await this.syncCodeToGithub(service, flags.repo, flags.branch);
+            await this.syncCodeToGithub(service, flags.repo, flags.branch, flags["local-git"]);
         }
         // Determine source
         if (service.githubRepo || flags.repo) {
@@ -132,12 +133,16 @@ class Deploy extends base_command_1.default {
      * can clone it at deploy time. No code passes through Apso — we read the local
      * git and push straight to GitHub.
      */
-    async syncCodeToGithub(service, repoFlag, branch) {
+    async syncCodeToGithub(service, repoFlag, branch, useLocalGit) {
         const cwd = process.cwd();
-        if (!git.gitAvailable()) {
-            this.error("git is required to deploy. Install git and try again.");
+        // --local-git needs git + a local repo. The default server-side push reads
+        // the files directly and pushes through the platform, so neither is needed.
+        if (useLocalGit) {
+            if (!git.gitAvailable()) {
+                this.error("git is required for --local-git. Install git, or drop --local-git.");
+            }
+            git.initRepo(cwd);
         }
-        git.initRepo(cwd);
         // Pick the repo: prefer what the local project is already wired to, then the
         // service's connected repo, then --repo, then ask.
         let conn = await services_1.githubApi.getConnection();
@@ -166,7 +171,10 @@ class Deploy extends base_command_1.default {
                 this.error("GitHub still isn't connected. Complete 'apso github connect' and re-run deploy.");
             }
         }
-        let repoFullName = git.localRepoFullName(cwd) || service.githubRepo || repoFlag;
+        // Only read the local git remote when git is present (a bare machine using
+        // the server-side push may not have git at all).
+        const localRepo = git.gitAvailable() ? git.localRepoFullName(cwd) : "";
+        let repoFullName = localRepo || service.githubRepo || repoFlag;
         if (!repoFullName) {
             repoFullName = await this.resolveRepo(conn.connectionId, service);
         }
@@ -176,18 +184,39 @@ class Deploy extends base_command_1.default {
             this.log(`Connecting repository ${repoFullName}...`);
             await services_1.githubApi.connectRepo(service.id, conn.connectionId, repoFullName);
         }
-        // Point the local repo at it and push with the user's git credentials.
-        git.setOrigin(cwd, git.httpsUrlFor(repoFullName));
-        const committed = git.commitAll(cwd, "Deploy via Apso CLI");
-        this.log(committed
-            ? `Committed local changes; pushing to ${repoFullName}#${branch}...`
-            : `Pushing to ${repoFullName}#${branch}...`);
-        try {
-            git.pushHead(cwd, branch);
+        if (useLocalGit) {
+            // Push with the user's local git credentials.
+            git.setOrigin(cwd, git.httpsUrlFor(repoFullName));
+            const committed = git.commitAll(cwd, "Deploy via Apso CLI");
+            this.log(committed
+                ? `Committed local changes; pushing to ${repoFullName}#${branch}...`
+                : `Pushing to ${repoFullName}#${branch}...`);
+            try {
+                git.pushHead(cwd, branch);
+            }
+            catch (error) {
+                const msg = error instanceof Error ? error.message : String(error);
+                this.error(`git push to ${repoFullName} failed. Ensure you have push access and your git credentials are set up.\n${msg}`);
+            }
         }
-        catch (error) {
-            const msg = error instanceof Error ? error.message : String(error);
-            this.error(`git push to ${repoFullName} failed. Ensure you have push access and your git credentials are set up.\n${msg}`);
+        else {
+            // Default: upload the project and push through the Apso GitHub connection.
+            // No local git or gh required.
+            this.log(`Uploading code and pushing to ${repoFullName}#${branch} via your Apso GitHub connection...`);
+            try {
+                await (0, server_push_1.serverSidePush)({
+                    cwd,
+                    serviceId: service.id,
+                    connectionId: conn.connectionId,
+                    branch,
+                    message: "Deploy via Apso CLI",
+                });
+                this.log(`Pushed to ${repoFullName}#${branch}.`);
+            }
+            catch (error) {
+                const msg = error instanceof Error ? error.message : String(error);
+                this.error(`Push failed: ${msg}\nRetry, or use --local-git to push with your local git instead.`);
+            }
         }
     }
     /**
@@ -268,5 +297,9 @@ Deploy.flags = {
         description: "Branch to push to",
         default: "main",
     }),
+    "local-git": core_1.Flags.boolean({
+        description: "Push using your local git instead of the platform (needs local GitHub auth)",
+        default: false,
+    }),
 };
 exports.default = Deploy;

package/dist/commands/dev.d.ts

@@ -13,8 +13,17 @@ export default class Dev extends BaseCommand {
     /**
      * TypeScript: run `npm run dev` which reads DATABASE_TYPE from .env.
      * PGlite is handled natively by the NestJS app -- no sidecar needed.
+     *
+     * Prefer the `dev` script, but fall back to `start:dev` for templates that
+     * only define the latter (e.g. the v1 service template). See apsoai/cli#102.
      */
     private runTypeScript;
+    /**
+     * Return the first script from `candidates` that exists in the local
+     * package.json. If package.json is missing or unparseable, fall back to the
+     * first candidate so behavior is unchanged when we cannot inspect it.
+     */
+    private resolveNpmScript;
     /**
      * Python: if pglite, start the pglite-server sidecar first, then uvicorn.
      */

package/dist/commands/dev.js

@@ -52,10 +52,37 @@ class Dev extends base_command_1.default {
     /**
      * TypeScript: run `npm run dev` which reads DATABASE_TYPE from .env.
      * PGlite is handled natively by the NestJS app -- no sidecar needed.
+     *
+     * Prefer the `dev` script, but fall back to `start:dev` for templates that
+     * only define the latter (e.g. the v1 service template). See apsoai/cli#102.
      */
     async runTypeScript() {
-        this.log("Starting TypeScript dev server...");
-        await this.spawnAndWait("npm", ["run", "dev"]);
+        const script = this.resolveNpmScript(["dev", "start:dev"]);
+        if (!script) {
+            this.error('No "dev" or "start:dev" script found in package.json.\n' +
+                "Make sure you are in an Apso TypeScript project root.");
+        }
+        this.log(`Starting TypeScript dev server (npm run ${script})...`);
+        await this.spawnAndWait("npm", ["run", script]);
+    }
+    /**
+     * Return the first script from `candidates` that exists in the local
+     * package.json. If package.json is missing or unparseable, fall back to the
+     * first candidate so behavior is unchanged when we cannot inspect it.
+     */
+    resolveNpmScript(candidates) {
+        const pkgPath = path.resolve("package.json");
+        if (!fs.existsSync(pkgPath))
+            return candidates[0];
+        try {
+            // eslint-disable-next-line unicorn/prefer-json-parse-buffer -- JSON.parse's TS type requires a string, not a Buffer
+            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
+            const scripts = (pkg.scripts || {});
+            return candidates.find((c) => typeof scripts[c] === "string");
+        }
+        catch {
+            return candidates[0];
+        }
     }
     /**
      * Python: if pglite, start the pglite-server sidecar first, then uvicorn.

package/dist/commands/generate.js

@@ -96,19 +96,31 @@ class Generate extends base_command_1.default {
             console.log(`[apso] Building... ${entity.name}`);
             const entityBuildStart = perf_hooks_1.performance.now();
             const entityRelationships = relationshipMap[entity.name] || [];
-            // Effective HTTP-controller flag (TypeScript REST only for now): entity
-            // overrides the top-level default, which defaults to true. When false, the
-            // controller is neither generated nor wired into the module (a hand-written
-            // controller owns the route). GraphQL uses resolvers, so the flag doesn't
-            // apply there. Python (FastAPI) and Go (Gin) wire routers differently and
-            // don't yet honor this flag — keep it a no-op for them (controllers always
-            // generated) so we never emit broken wiring (a skipped router still
-            // referenced by the index module). Tracked separately for Python/Go.
-            const includeController = language === "typescript" && lowerCaseApiType === "rest"
-                ? ((_b = (_a = entity.http) !== null && _a !== void 0 ? _a : http) !== null && _b !== void 0 ? _b : true)
-                : true;
-            if (!includeController) {
-                console.log(`[apso]   ${entity.name}: http=false — skipping generated controller`);
+            // Effective HTTP flag: entity overrides the top-level default, which
+            // defaults to true. GraphQL uses resolvers, so the flag doesn't apply
+            // there. The flag only does real suppression where a generated route
+            // can't be cleanly overridden without removing it (see apsoai/cli#95):
+            //   - TypeScript (NestJS): suppress the controller + its module wiring.
+            //   - Go (Gin): suppress the handler + its route registration (Gin
+            //     panics on a duplicate method+path, so overriding needs removal).
+            //   - Python (FastAPI): NO-OP. FastAPI matches in registration order, so
+            //     a hand-written APIRouter included before autogen_router in main.py
+            //     shadows the generated route without removing it. We only emit an
+            //     informational notice pointing at that pattern.
+            const effectiveHttp = (_b = (_a = entity.http) !== null && _a !== void 0 ? _a : http) !== null && _b !== void 0 ? _b : true;
+            const httpSuppressible = (language === "typescript" || language === "go") &&
+                lowerCaseApiType === "rest";
+            const includeController = httpSuppressible ? effectiveHttp : true;
+            if (httpSuppressible && !includeController) {
+                const artifact = language === "go" ? "handler + routes" : "controller";
+                console.log(`[apso]   ${entity.name}: http=false — skipping generated ${artifact}`);
+            }
+            else if (language === "python" &&
+                lowerCaseApiType === "rest" &&
+                effectiveHttp === false) {
+                console.log(`[apso]   ${entity.name}: http=false is a no-op for FastAPI — to replace a ` +
+                    `generated route, include your own APIRouter before autogen_router in main.py ` +
+                    `(first match wins). See the custom-endpoints skill.`);
             }
             const generationTasks = [
                 generator.generateEntity({
@@ -177,7 +189,7 @@ class Generate extends base_command_1.default {
             await (0, file_system_1.createFile)(fullPath, file.content);
         }
         // Generate index module
-        const indexFiles = await generator.generateIndexModule(entities, lowerCaseApiType, { emitEvents });
+        const indexFiles = await generator.generateIndexModule(entities, lowerCaseApiType, { emitEvents, http });
         for (const file of indexFiles) {
             const fullPath = path.join(autogenPath, file.path);
             // eslint-disable-next-line no-await-in-loop

package/dist/commands/github/connect.js

@@ -20,7 +20,9 @@ function openBrowser(url) {
         (0, child_process_1.exec)(command, () => resolve());
     });
 }
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+const sleep = (ms) => new Promise((r) => {
+    setTimeout(r, ms);
+});
 /**
  * `apso github connect` — walk the user through connecting their GitHub
  * account so the CLI can push generated code to a real repository.

package/dist/commands/link.js

@@ -81,6 +81,7 @@ class Link extends base_command_1.default {
         else if (flags.create) {
             this.log(`Creating service "${flags.create}"...`);
             service = await (0, upgrade_1.withUpgradeRetry)(() => services_1.servicesApi.create(workspace.id, { name: flags.create }));
+            // eslint-disable-next-line no-negated-condition -- clearer as a non-interactive guard in this else-if chain
         }
         else if (!(0, interactive_1.isInteractive)()) {
             this.error((0, interactive_1.missingFlag)("Pass --service <slug> to link an existing service, or --create <name> to make a new one."));

package/dist/commands/mcp/serve.d.ts

@@ -6,6 +6,8 @@ export default class McpServe extends BaseCommand {
         help: import("@oclif/core/lib/interfaces").BooleanFlag<void>;
     };
     run(): Promise<void>;
+    /** Wrap every registered tool handler with usage telemetry. */
+    private instrumentTools;
     private registerTools;
     private registerResources;
 }

package/dist/commands/mcp/serve.js

@@ -10,6 +10,7 @@ const mcp_js_1 = require("@modelcontextprotocol/sdk/server/mcp.js");
 const stdio_js_1 = require("@modelcontextprotocol/sdk/server/stdio.js");
 const zod_1 = require("zod");
 const base_command_1 = tslib_1.__importDefault(require("../../lib/base-command"));
+const telemetry_1 = require("../../lib/telemetry/telemetry");
 const apsorc_parser_1 = require("../../lib/apsorc-parser");
 const lib_1 = require("../../lib");
 const runner_1 = require("../../lib/doctor/runner");
@@ -23,11 +24,50 @@ class McpServe extends base_command_1.default {
             name: "apso",
             version: "0.10.2",
         });
+        // Emit a PostHog event per MCP tool call so agent usage of the server shows
+        // up in the same analytics as the CLI. Wrapping server.tool once covers all
+        // tools without touching each handler.
+        this.instrumentTools(server);
         this.registerTools(server);
         this.registerResources(server);
         const transport = new stdio_js_1.StdioServerTransport();
         await server.connect(transport);
     }
+    /** Wrap every registered tool handler with usage telemetry. */
+    instrumentTools(server) {
+        const original = server.tool.bind(server);
+        server.tool = (...args) => {
+            const name = String(args[0]);
+            const lastIndex = args.length - 1;
+            const handler = args[lastIndex];
+            if (typeof handler === "function") {
+                const orig = handler;
+                args[lastIndex] = async (...hArgs) => {
+                    const start = Date.now();
+                    try {
+                        const result = await orig(...hArgs);
+                        (0, telemetry_1.track)("mcp_tool_called", {
+                            tool: name,
+                            success: true,
+                            duration_ms: Date.now() - start,
+                        });
+                        return result;
+                    }
+                    catch (error) {
+                        (0, telemetry_1.track)("mcp_tool_called", {
+                            tool: name,
+                            success: false,
+                            duration_ms: Date.now() - start,
+                            error: error instanceof Error ? error.message : String(error),
+                        });
+                        (0, telemetry_1.captureException)(error, { mcp_tool: name });
+                        throw error;
+                    }
+                };
+            }
+            return original(...args);
+        };
+    }
     registerTools(server) {
         // ── design_schema ──────────────────────────────────────────────
         server.tool("design_schema", "Design a database schema from application requirements. Takes a description of entities, relationships, and business rules. Returns a validated .apsorc schema definition ready for code generation.", {

package/dist/commands/update.js

@@ -40,7 +40,7 @@ class Update extends base_command_1.default {
         }
         // Pick the upgrade command based on how the CLI was installed.
         const installRoot = `${this.config.root || ""} ${process.execPath}`;
-        const isBrew = /(?:Cellar|homebrew|\/opt\/homebrew)/i.test(installRoot);
+        const isBrew = /cellar|homebrew|\/opt\/homebrew/i.test(installRoot);
         const cmd = isBrew
             ? "brew upgrade apsoai/tap/apso"
             : "npm install -g @apso/cli@latest";

package/dist/commands/use.js

@@ -55,7 +55,8 @@ class Use extends base_command_1.default {
         this.log(`  Now using workspace: ${ws.name} (${ws.slug})`);
         // Show what's in the workspace so the next step is obvious.
         try {
-            const services = (await services_1.servicesApi.list(ws.id)).data;
+            const listed = await services_1.servicesApi.list(ws.id);
+            const services = listed.data;
             this.log("");
             if (services.length > 0) {
                 this.log("  Services:");

package/dist/hooks/init/telemetry.js

@@ -7,6 +7,12 @@ const telemetry_1 = require("../../lib/telemetry/telemetry");
  */
 const hook = async function (opts) {
     (0, telemetry_1.initTelemetry)();
+    // First-run transparency notice (issue #96). Printed to stderr so it never
+    // pollutes stdout / piped output, shown once per install.
+    if ((0, telemetry_1.shouldShowFirstRunNotice)()) {
+        process.stderr.write(`\n${telemetry_1.FIRST_RUN_NOTICE}\n\n`);
+        (0, telemetry_1.markFirstRunNoticeShown)();
+    }
     if (opts.id) {
         (0, telemetry_1.track)("cli_command_started", { command: opts.id });
     }

package/dist/lib/api/services.d.ts

@@ -127,4 +127,16 @@ export declare const githubApi: {
         message?: string;
     }): Promise<Raw>;
 };
+/**
+ * Service code API — used for the server-side deploy (upload the project zip to
+ * S3; the backend then pushes it to the repo, so no local git is required).
+ */
+export declare const codeApi: {
+    /** Presigned S3 PUT URL to upload the service's code zip. */
+    getUploadUrl(serviceId: string): Promise<{
+        url: string;
+        bucket?: string;
+        key?: string;
+    }>;
+};
 export {};

package/dist/lib/api/services.js

@@ -12,7 +12,7 @@
  * below.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.githubApi = exports.buildApi = exports.schemaApi = exports.servicesApi = exports.workspacesApi = exports.authApi = void 0;
+exports.codeApi = exports.githubApi = exports.buildApi = exports.schemaApi = exports.servicesApi = exports.workspacesApi = exports.authApi = void 0;
 const client_1 = require("./client");
 function adaptWorkspace(raw) {
     var _a, _b, _c, _d;
@@ -72,9 +72,9 @@ function adaptPaginated(raw, mapItem) {
     const items = Array.isArray(raw) ? raw : (_a = raw === null || raw === void 0 ? void 0 : raw.data) !== null && _a !== void 0 ? _a : [];
     const total = (_b = raw === null || raw === void 0 ? void 0 : raw.total) !== null && _b !== void 0 ? _b : items.length;
     const page = (_c = raw === null || raw === void 0 ? void 0 : raw.page) !== null && _c !== void 0 ? _c : 1;
-    const pageSize = items.length || 1;
+    const pageSize = items.length > 0 ? items.length : 1;
     return {
-        data: items.map(mapItem),
+        data: items.map((item) => mapItem(item)),
         meta: {
             total,
             page,
@@ -98,7 +98,7 @@ exports.authApi = {
      * clears stored credentials). Best-effort, never throws.
      */
     async logout() {
-        return;
+        // no-op: logout clears local credentials elsewhere; best-effort, never throws.
     },
 };
 /**
@@ -109,7 +109,7 @@ exports.workspacesApi = {
         var _a;
         const raw = await client_1.api.get("/api/workspaces");
         const items = Array.isArray(raw) ? raw : (_a = raw === null || raw === void 0 ? void 0 : raw.data) !== null && _a !== void 0 ? _a : [];
-        return items.map(adaptWorkspace);
+        return items.map((workspace) => adaptWorkspace(workspace));
     },
     async getById(id) {
         const raw = await client_1.api.get(`/api/workspaces/${id}`);
@@ -261,7 +261,9 @@ exports.buildApi = {
                 options.onProgress(status);
             if (status.status === "success" || status.status === "failed")
                 return status;
-            await new Promise((resolve) => setTimeout(resolve, pollInterval));
+            await new Promise((resolve) => {
+                setTimeout(resolve, pollInterval);
+            });
         }
         /* eslint-enable no-await-in-loop */
         throw new Error("Build timed out");
@@ -366,3 +368,13 @@ exports.githubApi = {
         });
     },
 };
+/**
+ * Service code API — used for the server-side deploy (upload the project zip to
+ * S3; the backend then pushes it to the repo, so no local git is required).
+ */
+exports.codeApi = {
+    /** Presigned S3 PUT URL to upload the service's code zip. */
+    async getUploadUrl(serviceId) {
+        return client_1.api.get(`/api/services/${serviceId}/code/upload-url`);
+    },
+};

package/dist/lib/config/types.d.ts

@@ -123,6 +123,16 @@ export interface GlobalConfigFile {
      * Disable telemetry
      */
     telemetryDisabled: boolean;
+    /**
+     * Anonymous install id (random UUID) for opt-out CLI telemetry. Generated
+     * once on first run and persisted here. Not derived from any machine
+     * identifier; carries no PII.
+     */
+    installId?: string;
+    /**
+     * Whether the first-run telemetry transparency notice has been shown.
+     */
+    telemetryNoticeShown: boolean;
 }
 /**
  * Project link stored in .apso/link.json

package/dist/lib/config/types.js

@@ -19,6 +19,7 @@ exports.DEFAULT_GLOBAL_CONFIG = {
     verbose: false,
     noColor: false,
     telemetryDisabled: false,
+    telemetryNoticeShown: false,
 };
 /**
  * Environment variables that can override configuration

package/dist/lib/deploy/server-push.d.ts

@@ -0,0 +1,15 @@
+/// <reference types="node" />
+/** Zip the project source into a buffer, skipping build/vcs/dependency dirs. */
+export declare function zipProject(cwd: string): Buffer;
+/**
+ * Server-side push: upload the project zip to S3 and have the platform push it
+ * to the connected repo through the user's GitHub connection. No local git or
+ * `gh` required — works on a bare machine that has only `apso login`.
+ */
+export declare function serverSidePush(opts: {
+    cwd: string;
+    serviceId: string;
+    connectionId: string;
+    branch: string;
+    message: string;
+}): Promise<void>;

package/dist/lib/deploy/server-push.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serverSidePush = exports.zipProject = void 0;
+const tslib_1 = require("tslib");
+const adm_zip_1 = tslib_1.__importDefault(require("adm-zip"));
+const path = tslib_1.__importStar(require("path"));
+const services_1 = require("../api/services");
+// Never ship these into the code zip — the backend reconstitutes the runnable
+// base template and only needs the source + schema + user edits.
+const EXCLUDE_DIRS = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    ".next",
+    ".apso",
+    "coverage",
+]);
+/** Zip the project source into a buffer, skipping build/vcs/dependency dirs. */
+function zipProject(cwd) {
+    const zip = new adm_zip_1.default();
+    zip.addLocalFolder(cwd, "", (filename) => {
+        const parts = filename.split(path.sep);
+        return !parts.some((p) => EXCLUDE_DIRS.has(p));
+    });
+    return zip.toBuffer();
+}
+exports.zipProject = zipProject;
+/**
+ * Server-side push: upload the project zip to S3 and have the platform push it
+ * to the connected repo through the user's GitHub connection. No local git or
+ * `gh` required — works on a bare machine that has only `apso login`.
+ */
+async function serverSidePush(opts) {
+    const buffer = zipProject(opts.cwd);
+    const { url } = await services_1.codeApi.getUploadUrl(opts.serviceId);
+    const res = await fetch(url, {
+        method: "PUT",
+        headers: { "Content-Type": "application/zip" },
+        body: buffer,
+    });
+    if (!res.ok) {
+        throw new Error(`Code upload failed (${res.status}). ${await res.text().catch(() => "")}`);
+    }
+    await services_1.githubApi.push(opts.serviceId, opts.connectionId, {
+        branch: opts.branch,
+        message: opts.message,
+    });
+}
+exports.serverSidePush = serverSidePush;