@rebasepro/cli 0.12.1-canary.gdd7172e → 0.12.1-canary.ge191fb7

package/dist/index.es.js

@@ -904,10 +904,26 @@ function durationBucket(ms) {
 * turning into an incident. Strings are capped at 64 characters because no
 * legitimate enumerated value is longer, and a path or a message always is.
 */
+/**
+* Key names that shadow an `Object.prototype` member.
+*
+* `__proto__` is already excluded by the pattern (it starts with an
+* underscore), and assigning any of these to an object literal shadows rather
+* than pollutes — so nothing is exploitable here. They are refused because a
+* stored property called `constructor` is a trap for every consumer downstream
+* that reaches for `properties.constructor` and gets a string.
+*/
+var RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"constructor",
+	"prototype",
+	"hasownproperty",
+	"tostring",
+	"valueof"
+]);
 function sanitize(properties) {
 	const out = {};
 	for (const [key, value] of Object.entries(properties)) {
-		if (!/^[a-z][a-z0-9_]{0,31}$/.test(key)) continue;
+		if (!/^[a-z][a-z0-9_]{0,31}$/.test(key) || RESERVED_KEYS.has(key.toLowerCase())) continue;
 		if (typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) out[key] = value;
 		else if (typeof value === "string" && value.length > 0 && value.length <= 64) {
 			if (!/[/\\@:\s]/.test(value)) out[key] = value;
@@ -982,16 +998,29 @@ function ensureMachineId() {
 /**
 * The checkout's id, generating one if this project has none.
 *
-* Returns `undefined` when there is nowhere to put it — `.rebase/` is created
-* by `rebase init`, so a command run outside a project simply reports no
-* project, rather than scattering directories across the filesystem.
+* The directory is created when it is missing, but **only** where a
+* `rebase.json` proves this really is a project root. An earlier version
+* required `.rebase/` to already exist, on the assumption that `rebase init`
+* created it — it does not. It is written only when a scaffold is linked to
+* Rebase Cloud, so every self-hosted project reported no `projectId` at all,
+* for ever. That silently broke the funnel this id exists for, on exactly the
+* population the telemetry is meant to learn about.
+*
+* The `rebase.json` check is what keeps the fix from being "scatter `.rebase/`
+* wherever a command happens to run": no manifest, no project, no directory,
+* and the event simply reports no project.
 */
 function ensureProjectId(projectRoot) {
+	if (!fs.existsSync(path.join(projectRoot, "rebase.json"))) return void 0;
 	const dir = path.join(projectRoot, ".rebase");
-	if (!fs.existsSync(dir)) return void 0;
+	try {
+		fs.mkdirSync(dir, { recursive: true });
+	} catch {
+		return;
+	}
 	const file = path.join(dir, "state.json");
 	let state = {};
-	try {
+	if (fs.existsSync(file)) try {
 		const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
 		if (raw && typeof raw === "object") state = raw;
 	} catch {
@@ -1009,6 +1038,22 @@ function ensureProjectId(projectRoot) {
 	}
 	return projectId;
 }
+//#endregion
+//#region src/telemetry/project.ts
+function readProjectPolicy(startDir = process.cwd()) {
+	try {
+		const root = findProjectRoot(startDir);
+		if (!root) return "unset";
+		const file = path.join(root, MANIFEST_FILENAME);
+		if (!fs.existsSync(file)) return "unset";
+		const raw = fs.readFileSync(file, "utf-8");
+		const match = /"telemetry"\s*:\s*(true|false)/.exec(raw);
+		if (!match) return "unset";
+		return match[1] === "false" ? "opt_out" : "ignored_opt_in";
+	} catch {
+		return "unset";
+	}
+}
 function endpoint() {
 	return process.env.REBASE_TELEMETRY_ENDPOINT?.trim() || "https://app.rebase.pro/api/functions/telemetry";
 }
@@ -1026,29 +1071,47 @@ function endpoint() {
 * `CI` is refused for a different reason: a build runner is not a person, and
 * counting one is both useless and misleading. A single pipeline re-running on
 * every push would otherwise outweigh every real developer in the data.
+*
+* A project's own `"telemetry": false` is checked *before* the machine setting,
+* because it has to beat an individual opt-in to be worth anything — see
+* project.ts on why the reverse is refused.
 */
-function suppressionReason(env = process.env) {
+function suppressionReason(env = process.env, cwd = process.cwd()) {
 	if (env.DO_NOT_TRACK && env.DO_NOT_TRACK !== "0") return "do_not_track";
 	if (env.REBASE_TELEMETRY_DISABLED && env.REBASE_TELEMETRY_DISABLED !== "0") return "rebase_telemetry_disabled";
 	if (env.CI && env.CI !== "false") return "ci";
+	if (readProjectPolicy(cwd) === "opt_out") return "project_opt_out";
 	const config = readConfig();
 	if (config.enabled === void 0) return "not_asked";
 	if (!config.enabled) return "declined";
 	return null;
 }
-function isEnabled(env = process.env) {
-	return suppressionReason(env) === null;
+function isEnabled(env = process.env, cwd = process.cwd()) {
+	return suppressionReason(env, cwd) === null;
 }
-/** Record the user's answer. `false` is final — nothing prompts again. */
+/**
+* Record the user's answer. `false` is final — nothing prompts again.
+*
+* Returns whether the choice could actually be persisted. A read-only or full
+* home directory makes `writeConfig` throw, and the direction of that failure
+* matters enormously: someone turning sharing **off** who sees a stack trace,
+* or worse sees nothing, is left sharing. The caller is expected to say so and
+* point at `REBASE_TELEMETRY_DISABLED`, which needs no disk.
+*/
 function setConsent(enabled) {
 	const config = readConfig();
-	writeConfig({
-		...config,
-		enabled,
-		decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		machineId: enabled ? config.machineId ?? void 0 : void 0
-	});
-	if (enabled) ensureMachineId();
+	try {
+		writeConfig({
+			...config,
+			enabled,
+			decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			machineId: enabled ? config.machineId ?? void 0 : void 0
+		});
+		if (enabled) ensureMachineId();
+		return true;
+	} catch {
+		return false;
+	}
 }
 /**
 * Build the event that *would* be sent, without sending it.
@@ -1081,7 +1144,7 @@ function previewEvent(event, properties = {}, projectRoot) {
 */
 async function recordEvent(event, properties = {}, options = {}) {
 	try {
-		if (!isEnabled()) return;
+		if (!isEnabled(process.env, options.projectRoot ?? process.cwd())) return;
 		const payload = buildEvent(event, properties, {
 			machineId: ensureMachineId(),
 			projectId: options.projectRoot ? ensureProjectId(options.projectRoot) : void 0
@@ -1185,6 +1248,7 @@ function describeState(env = process.env) {
 		case "do_not_track": return `${chalk.gray("disabled")} — the ${chalk.cyan("DO_NOT_TRACK")} environment variable is set`;
 		case "rebase_telemetry_disabled": return `${chalk.gray("disabled")} — the ${chalk.cyan("REBASE_TELEMETRY_DISABLED")} environment variable is set`;
 		case "ci": return `${chalk.gray("disabled")} — this looks like CI (${chalk.cyan("CI")} is set), which is never counted`;
+		case "project_opt_out": return `${chalk.gray("disabled")} — this project's ${chalk.cyan("rebase.json")} sets ${chalk.cyan("\"telemetry\": false")}`;
 	}
 }
 //#endregion
@@ -1877,7 +1941,11 @@ async function replacePlaceholders(options) {
 	const prereleasePins = [...unreleased].filter(([, version]) => version === "latest" || version.includes("-"));
 	if (cliIsStable && prereleasePins.length > 0) {
 		const lines = prereleasePins.map(([name, version]) => `    ${name} → ${version}`).join("\n");
-		throw new Error(`Rebase ${cliVersion} is not fully published to npm.\n\nThese packages have no ${cliVersion} release, so the newest thing on the\nregistry is a prerelease:\n\n${lines}\n\nScaffolding would pin those alongside the ${cliVersion} packages and produce\nan app that cannot install or run. That is a release gap in Rebase itself —\nnot a problem with your machine, your network, or your package manager.\n\nStopped before writing dependency versions or installing anything. The\nproject directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this with the list above.`);
+		throw new Error(`Rebase ${cliVersion} is not fully published to npm.\n\nThese packages have no ${cliVersion} release, so the newest thing on the\nregistry is a prerelease:\n\n${lines}\n\nScaffolding would pin those alongside the ${cliVersion} packages and produce\nan app that cannot install or run. That is a release gap in Rebase itself —
+not a problem with your machine, your network, or your package manager.
+
+Stopped before writing dependency versions or installing anything. The
+project directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this with the list above.`);
 	}
 	for (const [fullPath, originalContent] of fileContents.entries()) {
 		let content = originalContent.replace(/\{\{PROJECT_NAME\}\}/g, options.projectName);
@@ -2281,6 +2349,7 @@ async function schemaCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.schema_generate", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -2349,6 +2418,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.db_push", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -4194,7 +4264,7 @@ async function buildBundle(options) {
 		console.log(chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
 		console.log(chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
 		console.log(chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
-		console.log(chalk.dim(`      or run \`rebase eject\` to make this file the entrypoint and own the image.`));
+		console.log(chalk.dim("      or run `rebase eject` to make this file the entrypoint and own the image."));
 	}
 	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
 	cleanOutDir(projectRoot, outDir);
@@ -5976,12 +6046,21 @@ async function telemetryCommand(rawArgs) {
 			printPayload();
 			return;
 		case "enable":
-			setConsent(true);
+			if (!setConsent(true)) {
+				console.error(chalk.red(`Could not write ${configPath()} — sharing was not enabled.`));
+				process.exitCode = 1;
+				return;
+			}
 			console.log(chalk.green("Anonymous usage sharing enabled."));
 			console.log(chalk.gray(`Inspect what gets sent with ${chalk.cyan("rebase telemetry show")}.`));
 			return;
 		case "disable":
-			setConsent(false);
+			if (!setConsent(false)) {
+				console.error(chalk.red(`Could not write ${configPath()} — sharing is still ON.`));
+				console.error(chalk.yellow(`Set ${chalk.cyan("REBASE_TELEMETRY_DISABLED=1")} in your environment instead; it needs no file.`));
+				process.exitCode = 1;
+				return;
+			}
 			console.log(chalk.gray("Anonymous usage sharing disabled. Nothing further will be sent."));
 			return;
 		default:
@@ -5992,6 +6071,12 @@ async function telemetryCommand(rawArgs) {
 function printStatus() {
 	console.log("");
 	console.log(`  Status:   ${describeState()}`);
+	if (readProjectPolicy() === "ignored_opt_in") {
+		console.log("");
+		console.log(chalk.yellow("  Note: this project's rebase.json sets \"telemetry\": true, which is ignored."));
+		console.log(chalk.gray("        A committed file cannot consent on behalf of everyone who clones it."));
+		console.log(chalk.gray(`        Only "telemetry": false is honoured there. Use ${chalk.cyan("rebase telemetry enable")}.`));
+	}
 	console.log(`  Endpoint: ${chalk.gray(endpoint())}`);
 	console.log(`  Config:   ${chalk.gray(configPath())}`);
 	console.log("");
@@ -6028,6 +6113,11 @@ ${chalk.bold("Commands")}
   ${chalk.blue("enable")}     Start sharing
   ${chalk.blue("disable")}    Stop sharing, permanently
 
+${chalk.bold("Project policy")}
+  ${chalk.blue("\"telemetry\": false")} in ${chalk.blue("rebase.json")} disables sharing for everyone who
+  clones the repository, overriding each developer's own choice.
+  ${chalk.gray("\"telemetry\": true is ignored — a committed file cannot consent for others.")}
+
 ${chalk.bold("Environment")}
   ${chalk.blue("DO_NOT_TRACK")}                 Set to disable, across every tool that honours it
   ${chalk.blue("REBASE_TELEMETRY_DISABLED")}    Set to disable Rebase specifically
@@ -10717,7 +10807,23 @@ ${chalk.green.bold("Options")}
   ${chalk.blue("--help, -h")}      Show this help message
 
 ${chalk.gray("Documentation: https://rebase.pro/docs")}
-`);
+${telemetryNotice()}`);
+}
+/**
+* One line about usage sharing, in the global help.
+*
+* Every other tool that collects anything prints a first-run notice. Ours asks
+* at the end of `rebase init` — but someone who installs the CLI and never runs
+* `init`, or who joins a project someone else scaffolded, would otherwise never
+* learn the subsystem exists. This is the cheapest place to close that: the
+* help is what an unfamiliar user reads first.
+*
+* It states the current setting rather than a generic sentence, so it is also
+* the fastest answer to "is this thing on?".
+*/
+function telemetryNotice() {
+	const sharing = isEnabled();
+	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
 export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveStartPort, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };