@rebasepro/cli 0.12.1-canary.gf4240e3 → 0.13.0

package/dist/commands/cloud/context.d.ts

@@ -24,7 +24,32 @@ export declare function requireClient(rawArgs: string[]): Promise<{
     client: CloudClient;
     url: string;
 }>;
+/** One place a deploy can actually land, as the control plane describes it. */
+export interface DeployTarget {
+    clusterId?: string | null;
+    provider: string;
+    region?: string;
+    label?: string;
+    baseDomain?: string;
+}
+export interface PlatformConfig {
+    tenantBaseDomain?: string;
+    deployTargets?: DeployTarget[];
+}
+export declare function fetchPlatformConfig(client: CloudClient, url: string): Promise<PlatformConfig | undefined>;
+/**
+ * The base domain tenant projects are served at, derived from the same
+ * TENANT_BASE_DOMAIN the ingress and the console read (see
+ * saas/backend/src/utils/tenant-domain.ts).
+ */
 export declare function fetchTenantBaseDomain(client: CloudClient, url: string): Promise<string | undefined>;
+/**
+ * The infrastructure a deploy for this control plane would ACTUALLY use, in the
+ * resolver's own preference order (saas/backend/src/k8s/resolve.ts).
+ *
+ * @returns the targets, or `undefined` when the control plane cannot say.
+ */
+export declare function fetchDeployTargets(client: CloudClient, url: string): Promise<DeployTarget[] | undefined>;
 /**
  * Public host for a project — `<subdomain>.<base>`, or the bare subdomain when
  * the base domain is unknown.

package/dist/commands/cloud/projects.d.ts

@@ -1,5 +1,36 @@
-import { type CloudClient } from "./context";
+import { type DeployTarget, type CloudClient } from "./context";
 export declare function listProjects(rawArgs: string[]): Promise<void>;
+/**
+ * Where this project says it runs.
+ *
+ * `provider`/`region` are a *request*: no code downstream reads them to pick a
+ * deploy target — that comes from the project's cluster record or the ambient
+ * in-cluster context (saas/backend/src/k8s/resolve.ts). So a wrong value here is
+ * never contradicted by a failure; it just sits in the record. The CLI used to
+ * default to `hetzner`/`nbg1` unconditionally, which is how projects running on
+ * our GKE cluster came to describe themselves as Hetzner in the console — and
+ * `provider` is half the Stripe compute lookup key (`compute_<provider>_<vmSize>`),
+ * so that is a mispricing, not a cosmetic slip.
+ *
+ * The control plane already publishes the infrastructure that actually exists,
+ * and the console's create wizard reads it. Ask the same question here.
+ *
+ * Exported for tests: the decision is pure, so it can be pinned without a
+ * control plane. The fetching and the exit live in `resolveRequestedTarget`.
+ *
+ * @param requested `--provider`, if the caller named one. An explicit flag wins:
+ *   it is the caller stating intent, and `deploy` corrects the record anyway.
+ * @param targets What the control plane says exists, or `undefined` when it
+ *   cannot say — an older deployment with no `platform-config`, or a failed
+ *   request. That is different from an empty list, which is a control plane
+ *   stating it has no infrastructure at all.
+ * @returns the target to record, or `null` when the control plane answered that
+ *   there is none.
+ */
+export declare function chooseRequestedTarget(requested: string | undefined, targets: DeployTarget[] | undefined): {
+    provider: string;
+    region?: string;
+} | null;
 export declare function createProject(rawArgs: string[]): Promise<void>;
 export declare function projectInfo(rawArgs: string[], projectRef: string): Promise<void>;
 export declare function deleteProject(rawArgs: string[], projectRef: string): Promise<void>;

package/dist/index.es.js

@@ -528,33 +528,51 @@ async function requireClient(rawArgs) {
 	};
 }
 /**
-* The base domain tenant projects are served at, as reported by the control
-* plane (`platform-config`, which derives it from the same TENANT_BASE_DOMAIN
-* the ingress and the console read — see saas/backend/src/utils/tenant-domain.ts).
+* The control plane's public, non-secret self-description (`platform-config`).
 *
-* The CLI cannot know this value: it is per-deployment configuration (production
-* serves tenants at `rebase.website`, a dev control plane at `localhost`). It
-* used to be hardcoded to `rebase.pro`, so `cloud projects create` congratulated
-* the user with a URL that resolves nowhere near their app.
+* None of it is knowable from the CLI side: it is per-deployment configuration —
+* production serves tenants at `rebase.website` on GKE, a dev control plane at
+* `localhost` on Docker. Guessing produced two separate lies: a congratulation
+* URL that resolved nowhere near the app, and a `provider` the project does not
+* run on (see `createProject`).
 *
 * Cached per host for the process: it is fixed for a control plane's lifetime,
 * and `projects list` formats one host per row off a single fetch.
 *
-* @returns the base domain, or `undefined` if the control plane doesn't serve
+* @returns the config, or `undefined` if the control plane doesn't serve
 *   `platform-config` (an older deployment) or the request failed. A failure is
-*   cached too — the caller renders a subdomain either way, and a short-lived
-*   CLI should not retry once per row.
-*/
-var tenantBaseDomainCache = /* @__PURE__ */ new Map();
-function fetchTenantBaseDomain(client, url) {
-	let pending = tenantBaseDomainCache.get(url);
+*   cached too — a short-lived CLI should not retry once per row. Note the
+*   distinction callers rely on: `undefined` means "this control plane cannot
+*   tell us", whereas `deployTargets: []` is a control plane stating that it has
+*   no infrastructure configured.
+*/
+var platformConfigCache = /* @__PURE__ */ new Map();
+function fetchPlatformConfig(client, url) {
+	let pending = platformConfigCache.get(url);
 	if (!pending) {
-		pending = client.functions.invoke("platform-config", void 0, { method: "GET" }).then((cfg) => cfg?.tenantBaseDomain?.trim() || void 0).catch(() => void 0);
-		tenantBaseDomainCache.set(url, pending);
+		pending = client.functions.invoke("platform-config", void 0, { method: "GET" }).then((cfg) => cfg ?? void 0).catch(() => void 0);
+		platformConfigCache.set(url, pending);
 	}
 	return pending;
 }
 /**
+* The base domain tenant projects are served at, derived from the same
+* TENANT_BASE_DOMAIN the ingress and the console read (see
+* saas/backend/src/utils/tenant-domain.ts).
+*/
+function fetchTenantBaseDomain(client, url) {
+	return fetchPlatformConfig(client, url).then((cfg) => cfg?.tenantBaseDomain?.trim() || void 0);
+}
+/**
+* The infrastructure a deploy for this control plane would ACTUALLY use, in the
+* resolver's own preference order (saas/backend/src/k8s/resolve.ts).
+*
+* @returns the targets, or `undefined` when the control plane cannot say.
+*/
+function fetchDeployTargets(client, url) {
+	return fetchPlatformConfig(client, url).then((cfg) => Array.isArray(cfg?.deployTargets) ? cfg.deployTargets : void 0);
+}
+/**
 * Public host for a project — `<subdomain>.<base>`, or the bare subdomain when
 * the base domain is unknown.
 *
@@ -904,10 +922,26 @@ function durationBucket(ms) {
 * turning into an incident. Strings are capped at 64 characters because no
 * legitimate enumerated value is longer, and a path or a message always is.
 */
+/**
+* Key names that shadow an `Object.prototype` member.
+*
+* `__proto__` is already excluded by the pattern (it starts with an
+* underscore), and assigning any of these to an object literal shadows rather
+* than pollutes — so nothing is exploitable here. They are refused because a
+* stored property called `constructor` is a trap for every consumer downstream
+* that reaches for `properties.constructor` and gets a string.
+*/
+var RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"constructor",
+	"prototype",
+	"hasownproperty",
+	"tostring",
+	"valueof"
+]);
 function sanitize(properties) {
 	const out = {};
 	for (const [key, value] of Object.entries(properties)) {
-		if (!/^[a-z][a-z0-9_]{0,31}$/.test(key)) continue;
+		if (!/^[a-z][a-z0-9_]{0,31}$/.test(key) || RESERVED_KEYS.has(key.toLowerCase())) continue;
 		if (typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) out[key] = value;
 		else if (typeof value === "string" && value.length > 0 && value.length <= 64) {
 			if (!/[/\\@:\s]/.test(value)) out[key] = value;
@@ -982,16 +1016,29 @@ function ensureMachineId() {
 /**
 * The checkout's id, generating one if this project has none.
 *
-* Returns `undefined` when there is nowhere to put it — `.rebase/` is created
-* by `rebase init`, so a command run outside a project simply reports no
-* project, rather than scattering directories across the filesystem.
+* The directory is created when it is missing, but **only** where a
+* `rebase.json` proves this really is a project root. An earlier version
+* required `.rebase/` to already exist, on the assumption that `rebase init`
+* created it — it does not. It is written only when a scaffold is linked to
+* Rebase Cloud, so every self-hosted project reported no `projectId` at all,
+* for ever. That silently broke the funnel this id exists for, on exactly the
+* population the telemetry is meant to learn about.
+*
+* The `rebase.json` check is what keeps the fix from being "scatter `.rebase/`
+* wherever a command happens to run": no manifest, no project, no directory,
+* and the event simply reports no project.
 */
 function ensureProjectId(projectRoot) {
+	if (!fs.existsSync(path.join(projectRoot, "rebase.json"))) return void 0;
 	const dir = path.join(projectRoot, ".rebase");
-	if (!fs.existsSync(dir)) return void 0;
+	try {
+		fs.mkdirSync(dir, { recursive: true });
+	} catch {
+		return;
+	}
 	const file = path.join(dir, "state.json");
 	let state = {};
-	try {
+	if (fs.existsSync(file)) try {
 		const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
 		if (raw && typeof raw === "object") state = raw;
 	} catch {
@@ -1060,16 +1107,29 @@ function suppressionReason(env = process.env, cwd = process.cwd()) {
 function isEnabled(env = process.env, cwd = process.cwd()) {
 	return suppressionReason(env, cwd) === null;
 }
-/** Record the user's answer. `false` is final — nothing prompts again. */
+/**
+* Record the user's answer. `false` is final — nothing prompts again.
+*
+* Returns whether the choice could actually be persisted. A read-only or full
+* home directory makes `writeConfig` throw, and the direction of that failure
+* matters enormously: someone turning sharing **off** who sees a stack trace,
+* or worse sees nothing, is left sharing. The caller is expected to say so and
+* point at `REBASE_TELEMETRY_DISABLED`, which needs no disk.
+*/
 function setConsent(enabled) {
 	const config = readConfig();
-	writeConfig({
-		...config,
-		enabled,
-		decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
-		machineId: enabled ? config.machineId ?? void 0 : void 0
-	});
-	if (enabled) ensureMachineId();
+	try {
+		writeConfig({
+			...config,
+			enabled,
+			decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			machineId: enabled ? config.machineId ?? void 0 : void 0
+		});
+		if (enabled) ensureMachineId();
+		return true;
+	} catch {
+		return false;
+	}
 }
 /**
 * Build the event that *would* be sent, without sending it.
@@ -1899,7 +1959,11 @@ async function replacePlaceholders(options) {
 	const prereleasePins = [...unreleased].filter(([, version]) => version === "latest" || version.includes("-"));
 	if (cliIsStable && prereleasePins.length > 0) {
 		const lines = prereleasePins.map(([name, version]) => `    ${name} → ${version}`).join("\n");
-		throw new Error(`Rebase ${cliVersion} is not fully published to npm.\n\nThese packages have no ${cliVersion} release, so the newest thing on the\nregistry is a prerelease:\n\n${lines}\n\nScaffolding would pin those alongside the ${cliVersion} packages and produce\nan app that cannot install or run. That is a release gap in Rebase itself —\nnot a problem with your machine, your network, or your package manager.\n\nStopped before writing dependency versions or installing anything. The\nproject directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this with the list above.`);
+		throw new Error(`Rebase ${cliVersion} is not fully published to npm.\n\nThese packages have no ${cliVersion} release, so the newest thing on the\nregistry is a prerelease:\n\n${lines}\n\nScaffolding would pin those alongside the ${cliVersion} packages and produce\nan app that cannot install or run. That is a release gap in Rebase itself —
+not a problem with your machine, your network, or your package manager.
+
+Stopped before writing dependency versions or installing anything. The
+project directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this with the list above.`);
 	}
 	for (const [fullPath, originalContent] of fileContents.entries()) {
 		let content = originalContent.replace(/\{\{PROJECT_NAME\}\}/g, options.projectName);
@@ -2303,6 +2367,7 @@ async function schemaCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.schema_generate", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -2371,6 +2436,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
+	recordEvent("cli.db_push", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -4216,7 +4282,7 @@ async function buildBundle(options) {
 		console.log(chalk.yellow(`  ⚠ ${unusedEntry} is not the bundle's entry point — it is not compiled or shipped.`));
 		console.log(chalk.dim(`      The runtime boots the bundle itself and mounts ${compiled}.`));
 		console.log(chalk.dim(`      Routes defined there will not exist once deployed: move them to ${paths.functions}/,`));
-		console.log(chalk.dim(`      or run \`rebase eject\` to make this file the entrypoint and own the image.`));
+		console.log(chalk.dim("      or run `rebase eject` to make this file the entrypoint and own the image."));
 	}
 	log(options, chalk.dim(`  compiling ${includes.length} source group(s) → ${path.relative(projectRoot, outDir)}/`));
 	cleanOutDir(projectRoot, outDir);
@@ -5998,12 +6064,21 @@ async function telemetryCommand(rawArgs) {
 			printPayload();
 			return;
 		case "enable":
-			setConsent(true);
+			if (!setConsent(true)) {
+				console.error(chalk.red(`Could not write ${configPath()} — sharing was not enabled.`));
+				process.exitCode = 1;
+				return;
+			}
 			console.log(chalk.green("Anonymous usage sharing enabled."));
 			console.log(chalk.gray(`Inspect what gets sent with ${chalk.cyan("rebase telemetry show")}.`));
 			return;
 		case "disable":
-			setConsent(false);
+			if (!setConsent(false)) {
+				console.error(chalk.red(`Could not write ${configPath()} — sharing is still ON.`));
+				console.error(chalk.yellow(`Set ${chalk.cyan("REBASE_TELEMETRY_DISABLED=1")} in your environment instead; it needs no file.`));
+				process.exitCode = 1;
+				return;
+			}
 			console.log(chalk.gray("Anonymous usage sharing disabled. Nothing further will be sent."));
 			return;
 		default:
@@ -6363,6 +6438,54 @@ function providerDefaults(provider) {
 		};
 	}
 }
+/**
+* Where this project says it runs.
+*
+* `provider`/`region` are a *request*: no code downstream reads them to pick a
+* deploy target — that comes from the project's cluster record or the ambient
+* in-cluster context (saas/backend/src/k8s/resolve.ts). So a wrong value here is
+* never contradicted by a failure; it just sits in the record. The CLI used to
+* default to `hetzner`/`nbg1` unconditionally, which is how projects running on
+* our GKE cluster came to describe themselves as Hetzner in the console — and
+* `provider` is half the Stripe compute lookup key (`compute_<provider>_<vmSize>`),
+* so that is a mispricing, not a cosmetic slip.
+*
+* The control plane already publishes the infrastructure that actually exists,
+* and the console's create wizard reads it. Ask the same question here.
+*
+* Exported for tests: the decision is pure, so it can be pinned without a
+* control plane. The fetching and the exit live in `resolveRequestedTarget`.
+*
+* @param requested `--provider`, if the caller named one. An explicit flag wins:
+*   it is the caller stating intent, and `deploy` corrects the record anyway.
+* @param targets What the control plane says exists, or `undefined` when it
+*   cannot say — an older deployment with no `platform-config`, or a failed
+*   request. That is different from an empty list, which is a control plane
+*   stating it has no infrastructure at all.
+* @returns the target to record, or `null` when the control plane answered that
+*   there is none.
+*/
+function chooseRequestedTarget(requested, targets) {
+	if (requested) return {
+		provider: requested,
+		region: void 0
+	};
+	if (!targets) return {
+		provider: "hetzner",
+		region: void 0
+	};
+	if (targets.length === 0) return null;
+	const [target] = targets;
+	return {
+		provider: target.provider,
+		region: target.region?.trim() || void 0
+	};
+}
+async function resolveRequestedTarget(client, url, requested) {
+	const chosen = chooseRequestedTarget(requested, await fetchDeployTargets(client, url));
+	if (!chosen) fail("This control plane has no deploy targets configured.", `Register a cluster, or pass ${chalk.bold("--provider")} and ${chalk.bold("--region")} to record one anyway.`);
+	return chosen;
+}
 async function createProject(rawArgs) {
 	const args = arg({
 		"--name": String,
@@ -6398,9 +6521,10 @@ async function createProject(rawArgs) {
 	const subdomain = (args["--subdomain"] || a.subdomain || "").trim().toLowerCase();
 	const gitRepoUrl = (args["--repo"] || a.repo || "").trim();
 	const gitBranch = (args["--branch"] || a.branch || "main").trim();
-	const provider = (args["--provider"] || a.provider || "hetzner").trim();
+	const target = await resolveRequestedTarget(client, url, (args["--provider"] || a.provider)?.trim() || void 0);
+	const provider = target.provider;
 	const defaults = providerDefaults(provider);
-	const region = (args["--region"] || defaults.region).trim();
+	const region = (args["--region"] || target.region || defaults.region).trim();
 	const vmSize = (args["--vm-size"] || defaults.vmSize).trim();
 	if (!name || !subdomain) fail("Name and subdomain are required.");
 	try {
@@ -10750,7 +10874,23 @@ ${chalk.green.bold("Options")}
   ${chalk.blue("--help, -h")}      Show this help message
 
 ${chalk.gray("Documentation: https://rebase.pro/docs")}
-`);
+${telemetryNotice()}`);
+}
+/**
+* One line about usage sharing, in the global help.
+*
+* Every other tool that collects anything prints a first-run notice. Ours asks
+* at the end of `rebase init` — but someone who installs the CLI and never runs
+* `init`, or who joins a project someone else scaffolded, would otherwise never
+* learn the subsystem exists. This is the cheapest place to close that: the
+* help is what an unfamiliar user reads first.
+*
+* It states the current setting rather than a generic sentence, so it is also
+* the fastest answer to "is this thing on?".
+*/
+function telemetryNotice() {
+	const sharing = isEnabled();
+	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
 export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveStartPort, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };