@rebasepro/cli 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/telemetry/consent.d.ts

@@ -0,0 +1,38 @@
+import { TelemetryEventName } from "./payload";
+/**
+ * Asking, and what the question looks like.
+ *
+ * ## Why the prompt comes *after* the work
+ *
+ * The first `rebase init` on a machine is the event most worth having, and it
+ * is the one where no consent exists yet. Asking before scaffolding puts a
+ * privacy negotiation in front of someone who has not yet seen the tool do
+ * anything — the worst possible moment, and a reliable way to get a reflexive
+ * no.
+ *
+ * So the question is asked once the project exists and the user has seen it
+ * work. The event's data is still in memory at that point, so nothing is lost
+ * by waiting, and — this is the part that matters — **nothing has been
+ * transmitted or written**. Declining leaves no id, no file, no record.
+ *
+ * ## Why the payload is shown rather than described
+ *
+ * "Anonymous usage data" is a phrase that has been used to mean almost
+ * anything. Printing the exact JSON costs four lines of output and replaces a
+ * claim the user has to take on faith with something they can read. It is also
+ * the same builder the sender uses, so it cannot drift into a comfortable
+ * fiction.
+ */
+/** True when we may ask: no decision recorded, and nothing else forbids it. */
+export declare function shouldPrompt(env?: NodeJS.ProcessEnv): boolean;
+export declare function renderPreview(event: TelemetryEventName, properties: Record<string, unknown>): string;
+/**
+ * Ask, record the answer, and report it.
+ *
+ * Never throws and never blocks a non-interactive run: `rebase init --yes` in
+ * CI must behave exactly as it does today, which means not asking and not
+ * sending.
+ */
+export declare function promptForConsent(event: TelemetryEventName, properties: Record<string, unknown>): Promise<boolean>;
+/** Human-readable current state, for `rebase telemetry status`. */
+export declare function describeState(env?: NodeJS.ProcessEnv): string;

package/dist/telemetry/identity.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Who is reporting, and where that is remembered.
+ *
+ * Two identifiers, because they answer two different questions and conflating
+ * them would make the answers wrong:
+ *
+ *  - `machineId` — one developer's machine. Lives beside the cloud credentials
+ *    in `~/.rebase/`, so it survives across every project they scaffold.
+ *  - `projectId` — one *checkout*. Lives in the project's gitignored
+ *    `.rebase/`, next to `cloud.json` and `state.json`.
+ *
+ * Without the split, a developer trying five templates in an afternoon reads as
+ * five installations. With it, that is one machine and five projects, which is
+ * the shape the funnel actually needs.
+ *
+ * ## Why `projectId` is not committed
+ *
+ * `rebase.json` is checked in, and a stable identifier sitting in a public
+ * repository is a correlation handle for anyone who finds it — it ties a named
+ * organisation to whatever that id did. `.rebase/` is gitignored, so the id
+ * stays on the machine that generated it. It also makes the unit honest: what
+ * is being counted is a developer working on a project, not the project.
+ *
+ * ## Why both are random
+ *
+ * Neither is derived from a hostname, a database name, an email or a machine
+ * fingerprint. Hashing any of those only *looks* anonymous — the space of real
+ * hostnames is small enough to brute-force a salted hash back to the original
+ * in minutes. A random UUID carries no information at all and does the same job.
+ */
+/** Bumped when the stored shape changes in a way old CLIs cannot read. */
+export declare const TELEMETRY_CONFIG_VERSION = 1;
+export type TelemetryConfig = {
+    version: number;
+    /**
+     * `undefined` means never asked — which is *not* the same as declining, and
+     * is the only state in which anything may prompt.
+     */
+    enabled?: boolean;
+    machineId?: string;
+    /** When the choice was made, so a later release can tell stale consent from fresh. */
+    decidedAt?: string;
+};
+export declare function configPath(): string;
+export declare function readConfig(): TelemetryConfig;
+export declare function writeConfig(config: TelemetryConfig): void;
+/**
+ * The machine's id, generating and persisting one on first use.
+ *
+ * Only called once consent exists — an id written before the user agreed would
+ * be a record we had no right to create, even unsent.
+ */
+export declare function ensureMachineId(): string;
+/**
+ * The checkout's id, generating one if this project has none.
+ *
+ * The directory is created when it is missing, but **only** where a
+ * `rebase.json` proves this really is a project root. An earlier version
+ * required `.rebase/` to already exist, on the assumption that `rebase init`
+ * created it — it does not. It is written only when a scaffold is linked to
+ * Rebase Cloud, so every self-hosted project reported no `projectId` at all,
+ * for ever. That silently broke the funnel this id exists for, on exactly the
+ * population the telemetry is meant to learn about.
+ *
+ * The `rebase.json` check is what keeps the fix from being "scatter `.rebase/`
+ * wherever a command happens to run": no manifest, no project, no directory,
+ * and the event simply reports no project.
+ */
+export declare function ensureProjectId(projectRoot: string): string | undefined;

package/dist/telemetry/index.d.ts

@@ -0,0 +1,72 @@
+import { TelemetryEvent, TelemetryEventName } from "./payload";
+export { TELEMETRY_SCHEMA_VERSION, bucket, durationBucket, errorClass, buildEvent, sanitize } from "./payload";
+export type { TelemetryEvent, TelemetryEventName, TelemetryValue } from "./payload";
+export { configPath, readConfig, writeConfig } from "./identity";
+export type { TelemetryConfig } from "./identity";
+export { readProjectPolicy } from "./project";
+export type { ProjectTelemetryPolicy } from "./project";
+/**
+ * Where events go. Overridable so a fork can point at its own collector, and so
+ * the tests never touch the network.
+ */
+export declare const DEFAULT_TELEMETRY_ENDPOINT = "https://app.rebase.pro/api/functions/telemetry";
+export declare function endpoint(): string;
+/** Why nothing would be sent right now, or `null` when it would. */
+export type SuppressionReason = "not_asked" | "declined" | "do_not_track" | "rebase_telemetry_disabled" | "ci" | "project_opt_out";
+/**
+ * The one function that decides whether anything leaves the machine.
+ *
+ * Every path is a refusal except the last, which is the point: consent is
+ * opt-in, so the default answer at every branch — never asked, unreadable
+ * config, a set env var, a CI runner — is no.
+ *
+ * `DO_NOT_TRACK` is honoured because it is the cross-tool convention
+ * (consoledonottrack.com); a user who has set it globally has already answered
+ * this question and should not be asked again by us.
+ *
+ * `CI` is refused for a different reason: a build runner is not a person, and
+ * counting one is both useless and misleading. A single pipeline re-running on
+ * every push would otherwise outweigh every real developer in the data.
+ *
+ * A project's own `"telemetry": false` is checked *before* the machine setting,
+ * because it has to beat an individual opt-in to be worth anything — see
+ * project.ts on why the reverse is refused.
+ */
+export declare function suppressionReason(env?: NodeJS.ProcessEnv, cwd?: string): SuppressionReason | null;
+export declare function isEnabled(env?: NodeJS.ProcessEnv, cwd?: string): boolean;
+/**
+ * Record the user's answer. `false` is final — nothing prompts again.
+ *
+ * Returns whether the choice could actually be persisted. A read-only or full
+ * home directory makes `writeConfig` throw, and the direction of that failure
+ * matters enormously: someone turning sharing **off** who sees a stack trace,
+ * or worse sees nothing, is left sharing. The caller is expected to say so and
+ * point at `REBASE_TELEMETRY_DISABLED`, which needs no disk.
+ */
+export declare function setConsent(enabled: boolean): boolean;
+/**
+ * Build the event that *would* be sent, without sending it.
+ *
+ * This is what `rebase telemetry show` prints, and it is deliberately the same
+ * function the sender uses — a preview assembled by separate code is a promise
+ * that drifts. Returns `null` when nothing would be sent, so the command can
+ * say why instead of showing a payload that is never going anywhere.
+ */
+export declare function previewEvent(event: TelemetryEventName, properties?: Record<string, unknown>, projectRoot?: string): TelemetryEvent | null;
+/**
+ * Send one event, or quietly do nothing.
+ *
+ * Three properties this must hold, in order of importance:
+ *
+ *  1. **It never throws.** Telemetry failing is not a reason for `rebase dev`
+ *     to fail. Every error is swallowed.
+ *  2. **It never blocks meaningfully.** A two-second ceiling, after which the
+ *     command carries on regardless — a collector having a bad day must not
+ *     become the CLI hanging.
+ *  3. **It never sends without consent.** Enforced here rather than at the call
+ *     sites, so a new call site cannot get it wrong.
+ */
+export declare function recordEvent(event: TelemetryEventName, properties?: Record<string, unknown>, options?: {
+    projectRoot?: string;
+    timeoutMs?: number;
+}): Promise<void>;

package/dist/telemetry/payload.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Every field that may ever leave the machine, and nothing else.
+ *
+ * ## The rule this file exists to enforce
+ *
+ * **No value here may be free text.** Every property is either a number, a
+ * boolean, or a string drawn from a set enumerated in this file. That is not
+ * fussiness — free text is the mechanism by which telemetry leaks. An error
+ * message carries `/Users/francesco/rebase/...`, which is a real person's name.
+ * A collection name carries a customer's product vocabulary. A database URL
+ * carries a password. None of those are things anyone intends to send; they
+ * arrive by being interpolated into a string that a well-meaning field was
+ * happy to accept.
+ *
+ * So the payload is closed by construction. Adding a field means adding it
+ * here, where the review question — "can this ever contain something the user
+ * typed?" — is unavoidable.
+ *
+ * ## What is deliberately absent
+ *
+ * Project names, directory paths, collection or table names, hostnames,
+ * database URLs, error messages, stack traces, email addresses, exact row or
+ * user counts. Anything that would let a payload be traced to an organisation
+ * rather than to an anonymous id.
+ */
+/**
+ * Bumped whenever a field is added, removed or changes meaning.
+ *
+ * Sent with every event so the receiving end can reject or migrate old shapes,
+ * and so `rebase telemetry show` can state which contract the user agreed to.
+ */
+export declare const TELEMETRY_SCHEMA_VERSION = 1;
+/** The events the CLI reports. Closed set — a name not listed cannot be sent. */
+export type TelemetryEventName = "cli.init" | "cli.dev" | "cli.deploy" | "cli.schema_generate" | "cli.db_push" | "cli.error";
+/** A single non-free-text value. */
+export type TelemetryValue = string | number | boolean;
+export type TelemetryEvent = {
+    schema: number;
+    event: TelemetryEventName;
+    /** Random per machine — see identity.ts on why it is not derived. */
+    machineId: string;
+    /** Random per checkout. Absent when the command ran outside a project. */
+    projectId?: string;
+    /** The CLI's own version, so old releases can be told apart. */
+    cliVersion: string;
+    /** Coarse platform facts, for the support matrix. */
+    nodeMajor: number;
+    platform: NodeJS.Platform;
+    arch: string;
+    /** UTC, second precision. Not a device clock reading anyone can fingerprint. */
+    at: string;
+    properties: Record<string, TelemetryValue>;
+};
+/**
+ * Buckets rather than exact counts.
+ *
+ * An exact figure is a surprisingly good fingerprint — "this install has 37
+ * collections" narrows the field a great deal when combined with a version and
+ * a driver. A bucket answers "roughly how big" without doing that.
+ */
+export declare function bucket(value: number): string;
+/** Duration in coarse bands — enough to see "slow", not enough to fingerprint. */
+export declare function durationBucket(ms: number): string;
+/**
+ * An error reduced to something safe to transmit.
+ *
+ * The message and the stack are discarded, always. What survives is the
+ * constructor name and, for the errors that carry one, a `code` — both of which
+ * come from the program rather than from anything the user typed or named.
+ * `EACCES` is useful and safe; "cannot write /Users/francesco/clients/acme" is
+ * neither.
+ */
+export declare function errorClass(error: unknown): string;
+export declare function sanitize(properties: Record<string, unknown>): Record<string, TelemetryValue>;
+export declare function buildEvent(event: TelemetryEventName, properties: Record<string, unknown>, identity: {
+    machineId: string;
+    projectId?: string;
+}): TelemetryEvent;

package/dist/telemetry/project.d.ts

@@ -0,0 +1,34 @@
+/**
+ * A repository's own policy on usage sharing.
+ *
+ * ## Why this is deliberately one-directional
+ *
+ * `rebase.json` is committed, so whatever it says applies to everyone who
+ * clones the repository — including people who have never seen our prompt. That
+ * makes it the right place for exactly one of the two answers:
+ *
+ *  - **`false` is honoured**, and beats an individual's opt-in. An organisation
+ *    restricting its own repository is setting policy for work done on its
+ *    behalf, which is theirs to set. It is the same shape as a committed
+ *    `.npmrc`.
+ *  - **`true` is ignored**, and says so. It would be one developer answering a
+ *    privacy question for every colleague who later clones the repo — consent
+ *    by proxy, which is the precise thing opt-in exists to prevent.
+ *
+ * The asymmetry is the whole feature. A symmetric flag would be a worse version
+ * of the machine-level setting, and a quietly-obeyed `true` would be a way to
+ * enrol people without asking them.
+ *
+ * Read straight from the file rather than through `parseManifest`, for two
+ * reasons: the parser builds a typed object and drops keys it does not model,
+ * and a manifest too malformed to parse must still be able to switch telemetry
+ * off. A repository that says no should be obeyed even when it is broken.
+ */
+export type ProjectTelemetryPolicy = 
+/** `"telemetry": false` — suppress, regardless of the machine setting. */
+"opt_out"
+/** `"telemetry": true` — refused; the machine setting still decides. */
+ | "ignored_opt_in"
+/** No manifest, no key, or an unreadable one. */
+ | "unset";
+export declare function readProjectPolicy(startDir?: string): ProjectTelemetryPolicy;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/cli",
-  "version": "0.12.1-canary.gf5f1d39",
+  "version": "0.13.0",
   "description": "Developer tools for Rebase projects",
   "main": "./dist/index.es.js",
   "module": "./dist/index.es.js",
@@ -31,20 +31,20 @@
     "execa": "^9.6.1",
     "inquirer": "14.0.2",
     "jiti": "^2.7.0",
-    "@rebasepro/agent-skills": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/client": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/server": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/codegen": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/types": "0.12.1-canary.gf5f1d39",
-    "@rebasepro/server-postgres": "0.12.1-canary.gf5f1d39"
+    "@rebasepro/agent-skills": "0.13.0",
+    "@rebasepro/client": "0.13.0",
+    "@rebasepro/codegen": "0.13.0",
+    "@rebasepro/types": "0.13.0",
+    "@rebasepro/server": "0.13.0",
+    "@rebasepro/server-postgres": "0.13.0"
   },
   "devDependencies": {
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.2",
     "@types/pg": "^8.20.0",
-    "pg": "^8.21.0",
+    "pg": "^8.22.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16",
-    "vitest": "4.1.8"
+    "vite": "^8.1.5",
+    "vitest": "4.1.10"
   },
   "files": [
     "bin/",

package/templates/overlays/baas/backend/package.json

@@ -11,8 +11,8 @@
         "@rebasepro/server-postgres": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "drizzle-orm": "^0.45.2",
-        "hono": "^4.12.10",
-        "@hono/node-server": "^1.19.12",
+        "hono": "^4.12.27",
+        "@hono/node-server": "^2.0.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
         "dotenv": "^16.0.0",

package/templates/overlays/baas/package.json

@@ -17,12 +17,11 @@
         "generate:sdk": "rebase generate-sdk",
         "skills:install": "rebase skills install",
         "example": "tsx scripts/example.ts",
-        "deploy": "rebase build && rebase start"
+        "deploy": "rebase cloud deploy"
     },
     "devDependencies": {
         "@rebasepro/cli": "workspace:*",
         "@rebasepro/types": "workspace:*",
-        "concurrently": "^8.2.2",
         "tsx": "^4.20.6",
         "typescript": "^5.9.2"
     },

package/templates/template/backend/package.json

@@ -13,8 +13,8 @@
         "@rebasepro/server-postgres": "workspace:*",
         "@rebasepro/types": "workspace:*",
         "drizzle-orm": "^0.45.2",
-        "hono": "^4.12.25",
-        "@hono/node-server": "^1.19.12",
+        "hono": "^4.12.27",
+        "@hono/node-server": "^2.0.12",
         "pg": "^8.11.3",
         "ws": "^8.16.0",
         "dotenv": "^16.0.0",

package/templates/template/config/collections/index.ts

@@ -8,7 +8,15 @@ export const collections = [postsCollection, authorsCollection, tagsCollection,
 
 /**
  * Applied to any collection in this directory that declares no
- * `securityRules` of its own: anyone can read, only admins can write.
+ * `securityRules` of its own: every signed-in user reads every row, only
+ * admins write.
+ *
+ * `access: "public"` is about ROWS, not about who may call the API — it means
+ * "no row filter", not "no login". A request with no token is still answered
+ * 401 by the API before RLS is ever consulted. To serve readers who are not
+ * signed in (a public website reading this backend), set `AUTH_REQUIRE=false`
+ * in the backend's environment; access then rests entirely on these rules,
+ * which is what they are for.
  *
  * These live here, next to the collections, because `rebase db push`
  * generates the Postgres policies from these files — that is what actually

package/templates/template/frontend/package.json

@@ -15,10 +15,10 @@
         "{{PROJECT_NAME}}-config": "*",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
-        "react-router": "^7.0.0",
-        "react-router-dom": "^7.0.0",
+        "react-router": "^8.3.0",
         "react-compiler-runtime": "^1.0.0",
-        "@fontsource/rubik": "^5.2.5"
+        "@fontsource-variable/inter": "^5.3.0",
+        "@fontsource-variable/instrument-sans": "^5.3.0"
     },
     "scripts": {
         "dev": "vite --mode development",

package/templates/template/frontend/src/App.tsx

@@ -1,7 +1,8 @@
 import React from "react";
 
 import "@fontsource/jetbrains-mono";
-import "@fontsource/rubik";
+import "@fontsource-variable/inter";
+import "@fontsource-variable/instrument-sans";
 
 import { Rebase, RebaseAuth, useRebaseAuthController } from "@rebasepro/app";
 import { RebaseAdmin, RebaseShell } from "@rebasepro/admin";

package/templates/template/frontend/src/main.tsx

@@ -1,6 +1,7 @@
 import React from "react";
 import ReactDOM from "react-dom/client";
-import { createBrowserRouter, RouterProvider } from "react-router-dom";
+import { createBrowserRouter } from "react-router";
+import { RouterProvider } from "react-router/dom";
 import { App } from "./App";
 import "./index.css";
 

package/templates/template/frontend/vite.config.ts

@@ -22,7 +22,6 @@ export default defineConfig({
             "react",
             "react-dom",
             "react-router",
-            "react-router-dom",
             "@remix-run/router"
         ]
     },

package/templates/template/package.json

@@ -20,12 +20,11 @@
         "schema:generate": "rebase schema generate --collections ../config/collections",
         "generate:sdk": "rebase generate-sdk",
         "skills:install": "rebase skills install",
-        "deploy": "rebase build && rebase start"
+        "deploy": "rebase cloud deploy"
     },
     "devDependencies": {
         "@rebasepro/cli": "workspace:*",
         "@rebasepro/types": "workspace:*",
-        "concurrently": "^8.2.2",
         "typescript": "^5.9.2"
     },
     "engines": {