@rebasepro/cli 0.13.1-canary.g18cfeb7 → 0.13.1-canary.g249daa1

package/dist/commands/init.d.ts

@@ -68,6 +68,35 @@ export declare function formatCdTarget(cwd: string, targetDirectory: string): st
  * triggering the non-TTY error. */
 export declare function printInitHelp(): void;
 export declare function createRebaseApp(rawArgs: string[]): Promise<void>;
+/**
+ * Whether `port` is free — on the wildcard address *and* on both loopback addresses.
+ *
+ * All three, because on macOS/BSD a successful bind does not mean the port is
+ * unused. Sockets carry `SO_REUSEADDR` (Node sets it), under which a wildcard
+ * bind and a specific-address bind on the same port do not conflict — in either
+ * direction. So each probe alone has a blind spot, and they are different ones:
+ *
+ * - **Wildcard only** (what this used to do) misses a server bound to
+ *   `127.0.0.1` and `[::1]` — a Homebrew or Postgres.app install, i.e. most
+ *   developer machines. 5432 was reported free while it was already serving
+ *   another project's database. Docker then published `*:5432` for the same
+ *   reason and the container started cleanly, with no "port already allocated"
+ *   error anywhere to hint at the collision. `DATABASE_URL` pointed at
+ *   `localhost:5432`, `localhost` resolves to `::1` first, and every command
+ *   reported success while reading and writing the *pre-existing* database — a
+ *   `db push` would have created tables, roles and RLS policies inside it.
+ *
+ * - **Loopback only** misses the opposite case: Docker Desktop publishes a
+ *   container's port on `*`, and a specific-address bind succeeds right past it.
+ *   That port is free to probe and unusable to publish, so `docker compose up -d
+ *   db` fails on "Bind for 0.0.0.0:PORT failed: port is already allocated" —
+ *   loudly, but only after the project has been generated around the bad port.
+ *
+ * Requiring all three costs three sockets and leaves neither gap. The wildcard
+ * bind is the one the container itself has to make; the loopback binds are the
+ * addresses `DATABASE_URL` will actually name.
+ */
+export declare function isPortAvailable(port: number): Promise<boolean>;
 /**
  * The runtime image tag to pin, given the version of the CLI doing the scaffolding.
  *

package/dist/fold-static.d.ts

@@ -62,6 +62,53 @@ export declare function foldableApps(manifest: FoldableManifest): {
  * evidence of a misbuild.
  */
 export declare function assertBuiltForPath(indexHtml: string, basePath: string, appName: string): void;
+/**
+ * The environment every static app is built with, wherever that build is driven from.
+ *
+ * Shared because there are two drivers — `foldFrontendIntoBundle` here, and
+ * `buildAssetApp` in `build.ts` for a standalone `type: "static"` app — and they
+ * had already drifted: the path variables were duplicated into both, so a fix
+ * applied to one shipped a bundle built the old way from the other. One function
+ * makes that impossible rather than merely unlikely.
+ *
+ * ## REBASE_APP_*
+ *
+ * The declared path is a build-time input, not only a serving concern: Vite
+ * reads `base` from REBASE_APP_BASE, and the trailing slash is that field's
+ * convention. See `assertBuiltForPath`.
+ *
+ * ## NODE_ENV
+ *
+ * A built app is a production artifact by construction, so build it as one. Not
+ * a formality: the scaffold's `.env` carries `NODE_ENV=development` for the dev
+ * backend, and Vite's `loadEnv` promotes a `NODE_ENV` found in an env file into
+ * the build unless the environment already sets one. So `rebase build` and
+ * `rebase cloud deploy` shipped a *development* bundle — `import.meta.env.DEV
+ * === true`, development React, dev-only branches live — from commands whose
+ * whole purpose is to produce something deployable. Setting it here is what
+ * closes it: Vite consults the env file's NODE_ENV only when `process.env`
+ * has none.
+ *
+ * ## VITE_API_URL
+ *
+ * An app served by the backend it talks to has its API on its own origin by
+ * construction, so a baked-in absolute URL can only be wrong. It was: that same
+ * `.env` carries `VITE_API_URL=http://localhost:3001` and
+ * `frontend/vite.config.ts` reads the project root via `envDir: ".."`, so a
+ * stock deploy shipped a site whose every request went to whoever ran the build
+ * — passing every server-side health check on the way out. Blanking it here
+ * fixes the bundle even for a project whose `.env` predates the `init` fix, or
+ * was written by hand. Empty is the right value rather than a missing one: the
+ * client falls back to `window.location.origin`, which keeps working when a
+ * custom domain is added.
+ *
+ * Vite prioritises `process.env.VITE_*` over `.env` files, so an explicit
+ * `VITE_API_URL=https://api.example.com rebase cloud deploy` still wins — the
+ * cross-origin escape hatch stays open, it just has to be deliberate. Nothing on
+ * this path loads the project `.env` into `process.env`, so a value inherited
+ * here really was set by the caller.
+ */
+export declare function staticBuildEnv(appPath: string, appName: string): Record<string, string>;
 /**
  * Build the project's static apps and fold them into the backend bundle.
  *

package/dist/index.es.js

@@ -13,9 +13,9 @@ import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
 import dotenv from "dotenv";
-import { createRequire } from "module";
 import { BUNDLE_FORMAT_VERSION, DEFAULT_DATA_SOURCE_KEY, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, getDataSourceCapabilities, normalizeStorageSources, storageEnvSuffix } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
+import { createRequire } from "module";
 //#region src/utils/package-manager.ts
 /**
 * Package manager detection and command abstraction.
@@ -978,13 +978,35 @@ function sanitize(properties) {
 	}
 	return out;
 }
+/**
+* The CLI's own version, read by walking up to this package's manifest.
+*
+* The obvious `require("../../package.json")` was wrong everywhere, not only on
+* one install path: `vite build` bundles this module into `dist/index.es.js`, so
+* the specifier resolves relative to `<pkg>/dist/` and lands on
+* `<parent-of-pkg>/package.json` — a file that does not exist under npm, pnpm or
+* the monorepo. Every event ever sent carried `cliVersion: "unknown"`, which is
+* the one field that makes the rest of a payload interpretable.
+*
+* So walk up and check the manifest's `name` rather than counting directory
+* levels: the count differs between `src/telemetry/` and the bundled `dist/`,
+* and a wrong count fails silently by finding *some* package.json — the nearest
+* dependency's, under a hoisted layout. Matching the name cannot do that.
+*/
 function cliVersion() {
 	try {
-		const pkg = createRequire(import.meta.url)("../../package.json");
-		return typeof pkg?.version === "string" ? pkg.version : "unknown";
-	} catch {
-		return "unknown";
-	}
+		let dir = path.dirname(fileURLToPath(import.meta.url));
+		const root = path.parse(dir).root;
+		while (dir && dir !== root) {
+			const manifest = path.join(dir, "package.json");
+			if (fs.existsSync(manifest)) {
+				const pkg = JSON.parse(fs.readFileSync(manifest, "utf-8"));
+				if (pkg?.name === "@rebasepro/cli" && typeof pkg.version === "string" && pkg.version) return pkg.version;
+			}
+			dir = path.dirname(dir);
+		}
+	} catch {}
+	return "unknown";
 }
 function buildEvent(event, properties, identity) {
 	return {
@@ -1635,6 +1657,49 @@ async function linkScaffoldToCloud(options) {
 		console.warn(chalk.yellow(`  ${linkLater}`));
 	}
 }
+/**
+* Make the initial commit, after everything that writes into the project has run.
+*
+* It used to happen immediately after `git init`, which is before dependency
+* installation and before introspection — so `init --git --install` ended on a
+* dirty tree whose only untracked file was `pnpm-lock.yaml`. A lockfile is
+* precisely the thing that should be in a project's first commit, and a brand
+* new scaffold whose first `git status` is dirty invites the reader to conclude
+* the lockfile is deliberately ignored and never commit it at all.
+*
+* Introspection has the same shape: it generates `config/collections` and
+* `schema.generated.ts`, which belong in the commit describing the scaffold that
+* produced them.
+*
+* `git init` stays where it was. Creating the repository early costs nothing and
+* means a failed install still leaves the user a repository to commit into.
+*/
+async function commitScaffold(targetDirectory) {
+	try {
+		await execa("git", ["add", "-A"], { cwd: targetDirectory });
+		let identity = {};
+		try {
+			await execa("git", ["config", "user.email"], { cwd: targetDirectory });
+		} catch {
+			identity = {
+				GIT_AUTHOR_NAME: "Rebase",
+				GIT_AUTHOR_EMAIL: "noreply@rebase.pro",
+				GIT_COMMITTER_NAME: "Rebase",
+				GIT_COMMITTER_EMAIL: "noreply@rebase.pro"
+			};
+		}
+		await execa("git", [
+			"commit",
+			"-m",
+			"Initial commit from Rebase"
+		], {
+			cwd: targetDirectory,
+			env: identity
+		});
+	} catch {
+		console.warn(chalk.yellow("  Warning: Failed to create the initial commit"));
+	}
+}
 async function createProject$1(options) {
 	const startedAt = Date.now();
 	if (fs.existsSync(options.targetDirectory)) {
@@ -1674,6 +1739,7 @@ async function createProject$1(options) {
 	await applyHeadless(options.targetDirectory, options.headless);
 	await replacePlaceholders(options);
 	await configureEnvFile(options.targetDirectory, options.databaseUrl);
+	let gitInitialized = false;
 	if (options.git) {
 		console.log(chalk.gray("  Initializing git repository..."));
 		try {
@@ -1685,26 +1751,7 @@ async function createProject$1(options) {
 					"refs/heads/main"
 				], { cwd: options.targetDirectory });
 			} catch {}
-			await execa("git", ["add", "-A"], { cwd: options.targetDirectory });
-			let identity = {};
-			try {
-				await execa("git", ["config", "user.email"], { cwd: options.targetDirectory });
-			} catch {
-				identity = {
-					GIT_AUTHOR_NAME: "Rebase",
-					GIT_AUTHOR_EMAIL: "noreply@rebase.pro",
-					GIT_COMMITTER_NAME: "Rebase",
-					GIT_COMMITTER_EMAIL: "noreply@rebase.pro"
-				};
-			}
-			await execa("git", [
-				"commit",
-				"-m",
-				"Initial commit from Rebase"
-			], {
-				cwd: options.targetDirectory,
-				env: identity
-			});
+			gitInitialized = true;
 		} catch {
 			console.warn(chalk.yellow("  Warning: Failed to initialize git repository"));
 		}
@@ -1761,6 +1808,7 @@ async function createProject$1(options) {
 			console.warn(chalk.yellow(`  Run \`${installCmd.join(" ")}\` then \`${execCmd.join(" ")}\` manually.`));
 		}
 	}
+	if (gitInitialized) await commitScaffold(options.targetDirectory);
 	await linkScaffoldToCloud(options);
 	console.log("");
 	console.log(`${chalk.green.bold("✓")} Project ${chalk.bold(options.projectName)} created successfully!`);
@@ -2005,18 +2053,51 @@ project directory ${path.basename(options.targetDirectory)}/ was created and is
 		fs.writeFileSync(fullPath, content, "utf-8");
 	}
 }
-async function isPortAvailable(port) {
+/** `undefined` binds the wildcard address, which is a different question — see isPortAvailable. */
+function canBind(port, host) {
 	return new Promise((resolve) => {
 		const server = net.createServer();
-		server.once("error", () => {
-			resolve(false);
+		server.once("error", (err) => {
+			resolve(err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL");
 		});
 		server.once("listening", () => {
 			server.close(() => resolve(true));
 		});
-		server.listen(port);
+		if (host === void 0) server.listen(port);
+		else server.listen(port, host);
 	});
 }
+/**
+* Whether `port` is free — on the wildcard address *and* on both loopback addresses.
+*
+* All three, because on macOS/BSD a successful bind does not mean the port is
+* unused. Sockets carry `SO_REUSEADDR` (Node sets it), under which a wildcard
+* bind and a specific-address bind on the same port do not conflict — in either
+* direction. So each probe alone has a blind spot, and they are different ones:
+*
+* - **Wildcard only** (what this used to do) misses a server bound to
+*   `127.0.0.1` and `[::1]` — a Homebrew or Postgres.app install, i.e. most
+*   developer machines. 5432 was reported free while it was already serving
+*   another project's database. Docker then published `*:5432` for the same
+*   reason and the container started cleanly, with no "port already allocated"
+*   error anywhere to hint at the collision. `DATABASE_URL` pointed at
+*   `localhost:5432`, `localhost` resolves to `::1` first, and every command
+*   reported success while reading and writing the *pre-existing* database — a
+*   `db push` would have created tables, roles and RLS policies inside it.
+*
+* - **Loopback only** misses the opposite case: Docker Desktop publishes a
+*   container's port on `*`, and a specific-address bind succeeds right past it.
+*   That port is free to probe and unusable to publish, so `docker compose up -d
+*   db` fails on "Bind for 0.0.0.0:PORT failed: port is already allocated" —
+*   loudly, but only after the project has been generated around the bad port.
+*
+* Requiring all three costs three sockets and leaves neither gap. The wildcard
+* bind is the one the container itself has to make; the loopback binds are the
+* addresses `DATABASE_URL` will actually name.
+*/
+async function isPortAvailable(port) {
+	return await canBind(port) && await canBind(port, "127.0.0.1") && await canBind(port, "::1");
+}
 async function findAvailablePort(startPort) {
 	let port = startPort;
 	while (!await isPortAvailable(port)) port++;
@@ -2086,6 +2167,7 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
 		const composeApiPort = /^PORT=(\d+)/m.exec(envContent)?.[1] ?? "3001";
 		envContent = envContent.replace(/^#\s*CORS_ORIGINS=.*$/m, `CORS_ORIGINS=http://localhost:${composeApiPort}`);
+		envContent = envContent.replace(/^#?\s*VITE_API_URL=.*$/m, "VITE_API_URL=");
 		const { tag: runtimeVersion, note } = resolveRuntimeImageTag(readCliVersion());
 		const pinned = `${note ? `${note}\n` : ""}REBASE_VERSION=${runtimeVersion}`;
 		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, pinned) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\n${pinned}\n`;
@@ -2096,7 +2178,7 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
 		} else {
 			const dbPort = await findAvailablePort(5432);
-			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase_app:${dbPassword}@localhost:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, `DATABASE_URL=postgresql://rebase_app:${dbPassword}@127.0.0.1:${dbPort}/rebase?options=-c%20search_path=public&sslmode=disable\nDATABASE_PASSWORD=${dbPassword}`);
 			const dockerComposePath = path.join(targetDirectory, "docker-compose.yml");
 			if (fs.existsSync(dockerComposePath)) {
 				let dockerComposeContent = fs.readFileSync(dockerComposePath, "utf-8");
@@ -4846,6 +4928,61 @@ function assertBuiltForPath(indexHtml, basePath, appName) {
     build config — see docs/apps-and-runtimes.md §4.2.`);
 }
 /**
+* The environment every static app is built with, wherever that build is driven from.
+*
+* Shared because there are two drivers — `foldFrontendIntoBundle` here, and
+* `buildAssetApp` in `build.ts` for a standalone `type: "static"` app — and they
+* had already drifted: the path variables were duplicated into both, so a fix
+* applied to one shipped a bundle built the old way from the other. One function
+* makes that impossible rather than merely unlikely.
+*
+* ## REBASE_APP_*
+*
+* The declared path is a build-time input, not only a serving concern: Vite
+* reads `base` from REBASE_APP_BASE, and the trailing slash is that field's
+* convention. See `assertBuiltForPath`.
+*
+* ## NODE_ENV
+*
+* A built app is a production artifact by construction, so build it as one. Not
+* a formality: the scaffold's `.env` carries `NODE_ENV=development` for the dev
+* backend, and Vite's `loadEnv` promotes a `NODE_ENV` found in an env file into
+* the build unless the environment already sets one. So `rebase build` and
+* `rebase cloud deploy` shipped a *development* bundle — `import.meta.env.DEV
+* === true`, development React, dev-only branches live — from commands whose
+* whole purpose is to produce something deployable. Setting it here is what
+* closes it: Vite consults the env file's NODE_ENV only when `process.env`
+* has none.
+*
+* ## VITE_API_URL
+*
+* An app served by the backend it talks to has its API on its own origin by
+* construction, so a baked-in absolute URL can only be wrong. It was: that same
+* `.env` carries `VITE_API_URL=http://localhost:3001` and
+* `frontend/vite.config.ts` reads the project root via `envDir: ".."`, so a
+* stock deploy shipped a site whose every request went to whoever ran the build
+* — passing every server-side health check on the way out. Blanking it here
+* fixes the bundle even for a project whose `.env` predates the `init` fix, or
+* was written by hand. Empty is the right value rather than a missing one: the
+* client falls back to `window.location.origin`, which keeps working when a
+* custom domain is added.
+*
+* Vite prioritises `process.env.VITE_*` over `.env` files, so an explicit
+* `VITE_API_URL=https://api.example.com rebase cloud deploy` still wins — the
+* cross-origin escape hatch stays open, it just has to be deliberate. Nothing on
+* this path loads the project `.env` into `process.env`, so a value inherited
+* here really was set by the caller.
+*/
+function staticBuildEnv(appPath, appName) {
+	return {
+		REBASE_APP_PATH: appPath,
+		REBASE_APP_BASE: appPath === "/" ? "/" : `${appPath}/`,
+		REBASE_APP_NAME: appName,
+		NODE_ENV: "production",
+		VITE_API_URL: process.env.VITE_API_URL ?? ""
+	};
+}
+/**
 * Build the project's static apps and fold them into the backend bundle.
 *
 * Throws rather than exiting, so the caller decides whether a missing frontend
@@ -4864,11 +5001,7 @@ async function foldFrontendIntoBundle(options) {
 			cwd: projectRoot,
 			stdio: "inherit",
 			shell: true,
-			env: {
-				REBASE_APP_PATH: app.path,
-				REBASE_APP_BASE: app.path === "/" ? "/" : `${app.path}/`,
-				REBASE_APP_NAME: app.name
-			}
+			env: staticBuildEnv(app.path, app.name)
 		});
 		const assetsDir = path.join(projectRoot, app.output);
 		if (!fs.existsSync(assetsDir)) throw new Error(`"${app.name}" declared output "${app.output}" does not exist after building — the bundle would ship without a frontend.`);
@@ -5058,11 +5191,7 @@ async function buildAssetApp(projectRoot, name, app, runtimeRange, outOverride)
 			cwd: projectRoot,
 			stdio: "inherit",
 			shell: true,
-			env: {
-				REBASE_APP_PATH: basePath,
-				REBASE_APP_BASE: basePath === "/" ? "/" : `${basePath}/`,
-				REBASE_APP_NAME: name
-			}
+			env: staticBuildEnv(basePath, name)
 		});
 	} catch {
 		console.error(chalk.red(`  ✗ build command failed for "${name}"`));
@@ -11184,6 +11313,6 @@ function telemetryNotice() {
 	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, readEnvFile, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveRuntimeImageTag, resolveStartPort, resolveTsx, schemaCommand, selectUserForEmail, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, isPortAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, readEnvFile, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveRuntimeImageTag, resolveStartPort, resolveTsx, schemaCommand, selectUserForEmail, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map