@rebasepro/cli 0.12.0 → 0.12.1-canary.g06f263c

package/bin/rebase.js

@@ -88,4 +88,30 @@ if (!existsSync(distEntry)) {
 
 const { entry } = await import("../dist/index.es.js");
 
-entry(process.argv);
+/**
+ * The CLI's last line of defence.
+ *
+ * `entry()` returns a promise and nothing was awaiting it, so anything a
+ * command threw surfaced as an unhandled rejection: Node's own stack trace,
+ * rooted in `dist/index.es.js`, with the CLI's bundled line numbers and no
+ * exit code of its own. "Collections directory not found" is a sentence a
+ * developer can act on; the same sentence under ten frames of bundle internals
+ * reads as a crash in Rebase.
+ *
+ * The message is the error's own — commands that already print something
+ * friendly and exit never reach here. The stack is available behind
+ * `--debug`/`REBASE_DEBUG`, because when the message is *not* enough that is
+ * the only thing that helps.
+ */
+const wantsStack = process.argv.includes("--debug") || process.env.REBASE_DEBUG === "1";
+
+entry(process.argv).catch((error) => {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stderr.write(`\x1b[31m✗ ${message}\x1b[0m\n`);
+    if (wantsStack && error instanceof Error && error.stack) {
+        process.stderr.write(`\n${error.stack}\n`);
+    } else {
+        process.stderr.write("\x1b[90m  Re-run with --debug for the stack trace.\x1b[0m\n");
+    }
+    process.exit(1);
+});

package/dist/bundle.d.ts

@@ -68,6 +68,41 @@ export declare function detectNativeDependencies(projectRoot: string, declared:
  * own config package already travels inside the bundle.
  */
 export declare function collectDeclaredDependencies(projectRoot: string): Record<string, string>;
+/** One `@rebasepro/*` dependency as some package.json in the project declares it. */
+export interface DeclaredFrameworkDep {
+    name: string;
+    range: string;
+    /** Project-relative package.json it was declared in. */
+    file: string;
+}
+export interface FrameworkDepDrift {
+    /** Declared at a version that can never reach the CLI's own. */
+    behind: DeclaredFrameworkDep[];
+    /**
+     * The distinct lower bounds found across all declared `@rebasepro/*`, when
+     * there is more than one — the project is pinning mixed-era framework
+     * packages against each other.
+     */
+    disagreeing: string[];
+}
+/**
+ * Find `@rebasepro/*` dependencies pinned to a version older than this CLI.
+ *
+ * This is the only place a developer can be told. In development, every
+ * `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the
+ * checkout, so the version STRINGS in package.json are never exercised — the
+ * project runs fine locally on whatever is on disk, and the declared numbers are
+ * first honoured when the runtime npm-installs them from a bundle in the cloud.
+ * A project scaffolded at 0.10.0 therefore keeps working on a developer's
+ * machine indefinitely while being, in the cloud, a 0.10.0 driver.
+ *
+ * That matters because the image supplies only `@rebasepro/server`; the database
+ * driver comes from these declarations and a newer runtime never updates it.
+ * Every package.json is scanned, `dependencies` and `devDependencies` both,
+ * because they have to be bumped together and the one that gets forgotten is the
+ * one nobody looks at.
+ */
+export declare function detectFrameworkDepDrift(projectRoot: string, cliVersion: string): FrameworkDepDrift;
 /**
  * Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
  *
@@ -182,3 +217,4 @@ export declare function buildStaticBundle(options: {
     manifest: RebaseBundleManifest;
     fileCount: number;
 };
+export declare function resolveCliVersion(): string;

package/dist/index.es.js

@@ -355,8 +355,9 @@ function requireProjectRoot() {
 	const root = findProjectRoot();
 	if (!root) {
 		console.error(chalk.red("✗ Could not find a Rebase project root."));
-		console.error(chalk.gray("  Make sure you are inside a Rebase project directory"));
-		console.error(chalk.gray("  (one with backend/, frontend/, and config/ directories)."));
+		console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));
+		console.error(chalk.gray("  a package.json with a \"backend\" workspace, or a backend/ next to a config/."));
+		console.error(chalk.gray("  Run this from inside a project, or create one with `rebase init`."));
 		process.exit(1);
 	}
 	return root;
@@ -532,7 +533,7 @@ async function requireClient(rawArgs) {
 * the ingress and the console read — see saas/backend/src/utils/tenant-domain.ts).
 *
 * The CLI cannot know this value: it is per-deployment configuration (production
-* serves tenants at `apps.rebase.pro`, a dev control plane at `localhost`). It
+* serves tenants at `rebase.website`, a dev control plane at `localhost`). It
 * used to be hardcoded to `rebase.pro`, so `cloud projects create` congratulated
 * the user with a URL that resolves nowhere near their app.
 *
@@ -1461,9 +1462,10 @@ async function replacePlaceholders(options) {
 			versionToUse = stdout.trim();
 		} catch {
 			try {
+				const tag = cliVersion.includes("canary") ? "canary" : "latest";
 				const { stdout } = await execa(viewBin, [
 					"view",
-					`${pkgName}@${cliVersion.includes("canary") ? "canary" : "latest"}`,
+					`${pkgName}@${tag}`,
 					"version"
 				]);
 				if (!stdout.trim()) throw new Error("Not found");
@@ -1560,13 +1562,20 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		const dbPassword = crypto.randomBytes(16).toString("hex");
 		const serviceKey = crypto.randomBytes(48).toString("base64");
 		let envContent = fs.readFileSync(envPath, "utf-8");
+		envContent = envContent.replace(/^(# ║ {2})(Copy this file to \.env and fill in the values)( +║)$/m, (_match, open, old, close) => {
+			const replacement = "Generated by `rebase init` — the secrets below are already set";
+			const width = old.length + close.length - 1;
+			return open + replacement.slice(0, width).padEnd(width, " ") + "║";
+		});
 		envContent = envContent.replace(/^JWT_SECRET=.*$/m, `JWT_SECRET=${jwtSecret}`);
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
 		const runtimeVersion = readCliVersion();
 		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, `REBASE_VERSION=${runtimeVersion}`) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\nREBASE_VERSION=${runtimeVersion}\n`;
 		if (databaseUrl) {
 			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${databaseUrl}\nDATABASE_PASSWORD=${dbPassword}`);
+			const { pinSearchPath } = await import("@rebasepro/server-postgres");
+			const pinnedUrl = pinSearchPath(databaseUrl);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase:${dbPassword}@localhost:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
@@ -2084,7 +2093,7 @@ var REMOVED_APP_TYPES = {
 	mobile: "mobile apps are no longer declared in the manifest — nothing consumed this type. Remove the entry"
 };
 /** Reserved because they name things in URLs and CLI output. */
-var RESERVED_APP_NAMES = new Set([
+var RESERVED_APP_NAMES = /* @__PURE__ */ new Set([
 	"api",
 	"health",
 	"metrics",
@@ -3081,7 +3090,7 @@ ${chalk.green.bold("Description")}
 */
 var DEFAULT_BUNDLE_DIR = "dist-bundle";
 /** Packages whose presence means the bundle cannot run on a stock runtime image. */
-var KNOWN_NATIVE_PACKAGES = new Set([
+var KNOWN_NATIVE_PACKAGES = /* @__PURE__ */ new Set([
 	"sharp",
 	"canvas",
 	"bcrypt",
@@ -3097,7 +3106,7 @@ var KNOWN_NATIVE_PACKAGES = new Set([
 	"pg-native"
 ]);
 /** Dependencies supplied by the runtime image itself, not by the bundle. */
-var RUNTIME_PROVIDED = new Set([
+var RUNTIME_PROVIDED = /* @__PURE__ */ new Set([
 	"@rebasepro/server",
 	"@rebasepro/types",
 	"@rebasepro/client",
@@ -3506,6 +3515,139 @@ function collectDeclaredDependencies(projectRoot) {
 	return declared;
 }
 /**
+* Lowest version a range could resolve to, or null if it is not a range.
+*
+* Kept deliberately tiny and local. The published range grammar here is a caret,
+* a tilde, an exact version or a `>=` floor, and the alternative — a semver
+* dependency in the CLI — buys breadth this does not need.
+*/
+function lowerBoundOf(range) {
+	const raw = range.trim().replace(/^[\^~]/, "").replace(/^>=\s*/, "").replace(/^v/, "");
+	if (!/^\d+(\.\d+){0,2}$/.test(raw)) return null;
+	const [major, minor = 0, patch = 0] = raw.split(".").map(Number);
+	return [
+		major,
+		minor,
+		patch
+	];
+}
+/** Highest version a range could resolve to (exclusive), or null. */
+function upperBoundOf(range) {
+	const trimmed = range.trim();
+	const min = lowerBoundOf(trimmed);
+	if (!min) return null;
+	if (trimmed.startsWith(">=")) return null;
+	const [major, minor, patch] = min;
+	if (trimmed.startsWith("^")) {
+		if (major > 0) return [
+			major + 1,
+			0,
+			0
+		];
+		if (minor > 0) return [
+			0,
+			minor + 1,
+			0
+		];
+		return [
+			0,
+			0,
+			patch + 1
+		];
+	}
+	if (trimmed.startsWith("~")) return trimmed.replace(/^~v?/, "").split(".").length >= 2 ? [
+		major,
+		minor + 1,
+		0
+	] : [
+		major + 1,
+		0,
+		0
+	];
+	const parts = trimmed.replace(/^v/, "").split(".").length;
+	if (parts === 1) return [
+		major + 1,
+		0,
+		0
+	];
+	if (parts === 2) return [
+		major,
+		minor + 1,
+		0
+	];
+	return [
+		major,
+		minor,
+		patch + 1
+	];
+}
+function compareTriples(a, b) {
+	for (let i = 0; i < 3; i++) if (a[i] !== b[i]) return a[i] < b[i] ? -1 : 1;
+	return 0;
+}
+/**
+* Whether a declared range could EVER resolve at or above `target`.
+*
+* The same question the control plane asks at intake, asked here first. Only a
+* range whose entire span sits below the target is reported — `^0.10.0` can
+* never cross to 0.12 whatever npm publishes — because a false alarm on a build
+* that would have worked trains people to ignore the warning that matters.
+*/
+function canReach(range, target) {
+	const ceiling = upperBoundOf(range);
+	const floor = lowerBoundOf(target);
+	if (!floor || !lowerBoundOf(range)) return null;
+	if (!ceiling) return true;
+	return compareTriples(ceiling, floor) > 0;
+}
+/**
+* Find `@rebasepro/*` dependencies pinned to a version older than this CLI.
+*
+* This is the only place a developer can be told. In development, every
+* `@rebasepro/*` resolves through pnpm's `link:`/`workspace:` overrides to the
+* checkout, so the version STRINGS in package.json are never exercised — the
+* project runs fine locally on whatever is on disk, and the declared numbers are
+* first honoured when the runtime npm-installs them from a bundle in the cloud.
+* A project scaffolded at 0.10.0 therefore keeps working on a developer's
+* machine indefinitely while being, in the cloud, a 0.10.0 driver.
+*
+* That matters because the image supplies only `@rebasepro/server`; the database
+* driver comes from these declarations and a newer runtime never updates it.
+* Every package.json is scanned, `dependencies` and `devDependencies` both,
+* because they have to be bumped together and the one that gets forgotten is the
+* one nobody looks at.
+*/
+function detectFrameworkDepDrift(projectRoot, cliVersion) {
+	const found = [];
+	for (const relative of [
+		"package.json",
+		"backend/package.json",
+		"config/package.json",
+		"frontend/package.json"
+	]) {
+		const file = path.join(projectRoot, relative);
+		if (!fs.existsSync(file)) continue;
+		try {
+			const pkg = JSON.parse(fs.readFileSync(file, "utf8"));
+			for (const block of [pkg.dependencies, pkg.devDependencies]) for (const [name, range] of Object.entries(block ?? {})) {
+				if (!name.startsWith("@rebasepro/")) continue;
+				if (typeof range !== "string") continue;
+				found.push({
+					name,
+					range,
+					file: relative
+				});
+			}
+		} catch {}
+	}
+	const behind = found.filter((d) => canReach(d.range, cliVersion) === false);
+	const bounds = new Set(found.map((d) => lowerBoundOf(d.range)).filter((b) => b != null).map((b) => b.join(".")));
+	return {
+		behind,
+		disagreeing: bounds.size > 1 ? [...bounds].sort() : []
+	};
+}
+/**
 * Rewrite relative import specifiers in emitted JavaScript so Node can resolve them.
 *
 * TypeScript deliberately does not touch specifiers: `moduleResolution: "bundler"`
@@ -4203,6 +4345,16 @@ async function buildCommand(rawArgs = []) {
 				console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));
 				console.log(chalk.dim("      These cannot run on the managed runtime. See `rebase doctor`."));
 			}
+			const drift = detectFrameworkDepDrift(projectRoot, resolveCliVersion());
+			if (drift.behind.length > 0) {
+				console.log(chalk.yellow(`    ⚠ framework dependencies older than this CLI (${resolveCliVersion()}):`));
+				for (const dep of drift.behind) console.log(chalk.dim(`      ${dep.name}@${dep.range}  (${dep.file})`));
+				console.log(chalk.dim("      The image supplies the server, but your bundle supplies the database"));
+				console.log(chalk.dim("      driver — a newer runtime does not update it. Bump these and rebuild."));
+			} else if (drift.disagreeing.length > 0) {
+				console.log(chalk.yellow(`    ⚠ mixed @rebasepro versions declared: ${drift.disagreeing.join(", ")}`));
+				console.log(chalk.dim("      These are published together and expect to run together; pin them alike."));
+			}
 			if (!args["--no-static"]) {
 				const folded = await foldFrontendIntoBundle({
 					projectRoot,
@@ -5061,7 +5213,7 @@ function parseAgentFlags(rawArgs) {
 	return requested;
 }
 async function skillsInstall(rawArgs = []) {
-	const projectDir = process.cwd();
+	const projectDir = findProjectRoot() ?? process.cwd();
 	let skillsDir;
 	try {
 		skillsDir = getSkillsSourceDir();
@@ -5105,7 +5257,8 @@ async function skillsInstall(rawArgs = []) {
 	for (const agentKey of agents) {
 		const agent = AGENTS[agentKey];
 		const count = installForAgent(agentKey, skills, projectDir);
-		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(agent.targetDir)}`);
+		const shown = path.relative(process.cwd(), path.join(projectDir, agent.targetDir)) || agent.targetDir;
+		console.log(`  ${chalk.green("✓")} ${chalk.bold(agent.label)} — ${count} skills installed to ${chalk.gray(shown)}`);
 	}
 	console.log("");
 	console.log(chalk.gray("  Skills are project-local. Commit them to share with your team."));
@@ -9876,9 +10029,10 @@ async function entry(args) {
 				argv: args.slice(3),
 				permissive: true
 			});
+			const sdkRoot = sdkArgs["--help"] ? process.cwd() : requireProjectRoot();
 			await generateSdkCommand({
-				collectionsDir: sdkArgs["--collections-dir"] || "./config/collections",
-				output: sdkArgs["--output"] || "./generated/sdk",
+				collectionsDir: sdkArgs["--collections-dir"] || path.join(sdkRoot, "config/collections"),
+				output: sdkArgs["--output"] || path.join(sdkRoot, "generated/sdk"),
 				from: sdkArgs["--from"],
 				token: sdkArgs["--token"],
 				help: sdkArgs["--help"],
@@ -9988,6 +10142,6 @@ ${chalk.gray("Documentation: https://rebase.pro/docs")}
 `);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map