@rebasepro/cli 0.13.1-canary.gcd6689e → 0.13.1-canary.gcef69d4

package/dist/commands/auth.d.ts

@@ -1 +1,32 @@
+/** A user as the admin API returns it, reduced to what this command needs. */
+export interface ResolvedUser {
+    id: string;
+    email: string;
+}
+/**
+ * Pick the user with exactly this email out of a search response.
+ *
+ * `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display
+ * name**, ordered by role count descending. This used to take row `[0]` and
+ * reset it, then print the email it had been *given* as confirmation — so two
+ * ordinary situations ended in a successful-looking reset of somebody else's
+ * account:
+ *
+ *   - a substring collision: `bob@example.com` also matches
+ *     `robert.bob@example.com`;
+ *   - a display name, which is user-controlled and accepted up to 255
+ *     characters with no constraint on its content, containing an address
+ *     belonging to someone else.
+ *
+ * The ordering makes it worse rather than better — `array_length(roles) DESC
+ * NULLS LAST` puts the most privileged match first, so the account most likely
+ * to be reset by mistake is an admin's.
+ *
+ * Returns `undefined` when nothing matched exactly, which the caller reports
+ * rather than falling through to a guess. The direct-database fallback below
+ * has always matched with `eq(usersTable.email, email)`; this is the same
+ * definition, so the command no longer resets different accounts depending on
+ * whether the backend happened to be running.
+ */
+export declare function selectUserForEmail(payload: unknown, email: string): ResolvedUser | undefined;
 export declare function authCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/init.d.ts

@@ -68,4 +68,26 @@ export declare function formatCdTarget(cwd: string, targetDirectory: string): st
  * triggering the non-TTY error. */
 export declare function printInitHelp(): void;
 export declare function createRebaseApp(rawArgs: string[]): Promise<void>;
+/**
+ * The runtime image tag to pin, given the version of the CLI doing the scaffolding.
+ *
+ * Only a stable release publishes `rebasepro/server` — a multi-arch build on
+ * every push to main would cost minutes per commit for an image nobody pulls.
+ * So pinning a prerelease CLI's own version writes a tag that cannot exist, and
+ * `docker compose up` fails on `manifest unknown`, which is the same dead end
+ * as the missing-repository bug this pinning was added to prevent.
+ *
+ * A prerelease therefore falls back to `latest`, which is correct rather than
+ * merely available: a bundle's manifest declares the runtime range it needs
+ * (`^1`), the image supplies only `@rebasepro/server`, and the framework a
+ * bundle runs is installed from its own `deps.declared` at boot. The current
+ * stable runtime boots a canary bundle by design.
+ *
+ * A floating tag is a real cost — it is what pinning exists to avoid — so say
+ * so in the file rather than leaving a reader to discover it.
+ */
+export declare function resolveRuntimeImageTag(cliVersion: string): {
+    tag: string;
+    note?: string;
+};
 export declare function configureEnvFile(targetDirectory: string, databaseUrl?: string): Promise<void>;

package/dist/index.es.js

@@ -12,6 +12,7 @@ import crypto from "crypto";
 import { execSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
+import dotenv from "dotenv";
 import { createRequire } from "module";
 import { BUNDLE_FORMAT_VERSION, RUNTIME_CONTRACT_VERSION, computeSchemaVersion, deserializeCollections, findStorageSuffixCollision, normalizeStorageSources, storageEnvSuffix } from "@rebasepro/types";
 import { generateSDK } from "@rebasepro/codegen";
@@ -289,6 +290,34 @@ function findEnvFile(projectRoot) {
 	return null;
 }
 /**
+* Read the project's `.env` into a plain object.
+*
+* One reader, because there were four: `dotenv` in `start`, a hand-rolled
+* `indexOf("=")` loop in `api-keys`, a single-key regex in `auth`, and its own
+* splitting in `cloud env`. `dotenv` is a declared dependency of this package,
+* so the other three existed for no reason and disagreed with the correct one
+* on the two things people actually write in a `.env`:
+*
+*   - `export KEY=value`, which the hand-rolled parser keyed as
+*     `export KEY` — so the command reported the key as unset while it was
+*     right there in the file;
+*   - `KEY=value # comment`, whose comment travelled into the value and then
+*     into an `Authorization` header, coming back as a 401 with nothing
+*     pointing at the cause.
+*
+* Returns `{}` when the project has no `.env`, so callers can treat "absent"
+* and "empty" alike.
+*/
+function readEnvFile(projectRoot) {
+	const envFile = findEnvFile(projectRoot);
+	if (!envFile || !fs.existsSync(envFile)) return {};
+	try {
+		return dotenv.parse(fs.readFileSync(envFile, "utf-8"));
+	} catch {
+		return {};
+	}
+}
+/**
 * Resolve a binary from the project's node_modules/.bin.
 * Checks backend, root, parent monorepo root, then falls back to PATH.
 */
@@ -2013,6 +2042,32 @@ function readCliVersion() {
 	} catch {}
 	return "latest";
 }
+/**
+* The runtime image tag to pin, given the version of the CLI doing the scaffolding.
+*
+* Only a stable release publishes `rebasepro/server` — a multi-arch build on
+* every push to main would cost minutes per commit for an image nobody pulls.
+* So pinning a prerelease CLI's own version writes a tag that cannot exist, and
+* `docker compose up` fails on `manifest unknown`, which is the same dead end
+* as the missing-repository bug this pinning was added to prevent.
+*
+* A prerelease therefore falls back to `latest`, which is correct rather than
+* merely available: a bundle's manifest declares the runtime range it needs
+* (`^1`), the image supplies only `@rebasepro/server`, and the framework a
+* bundle runs is installed from its own `deps.declared` at boot. The current
+* stable runtime boots a canary bundle by design.
+*
+* A floating tag is a real cost — it is what pinning exists to avoid — so say
+* so in the file rather than leaving a reader to discover it.
+*/
+function resolveRuntimeImageTag(cliVersion) {
+	if (/^\d+\.\d+\.\d+-/.test(cliVersion)) return {
+		tag: "latest",
+		note: `# Scaffolded by a prerelease CLI (${cliVersion}), which publishes no runtime image,\n# so this floats to the newest stable runtime. Pin an exact version once you
+# deploy: a moving tag changes what you are running with no version changing.`
+	};
+	return { tag: cliVersion };
+}
 async function configureEnvFile(targetDirectory, databaseUrl) {
 	const envExamplePath = path.join(targetDirectory, ".env.example");
 	const envPath = path.join(targetDirectory, ".env");
@@ -2031,8 +2086,9 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
 		const composeApiPort = /^PORT=(\d+)/m.exec(envContent)?.[1] ?? "3001";
 		envContent = envContent.replace(/^#\s*CORS_ORIGINS=.*$/m, `CORS_ORIGINS=http://localhost:${composeApiPort}`);
-		const runtimeVersion = readCliVersion();
-		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, `REBASE_VERSION=${runtimeVersion}`) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\nREBASE_VERSION=${runtimeVersion}\n`;
+		const { tag: runtimeVersion, note } = resolveRuntimeImageTag(readCliVersion());
+		const pinned = `${note ? `${note}\n` : ""}REBASE_VERSION=${runtimeVersion}`;
+		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, pinned) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\n${pinned}\n`;
 		if (databaseUrl) {
 			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
 			const { pinSearchPath } = await import("@rebasepro/server-postgres");
@@ -2367,7 +2423,7 @@ async function schemaCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
-	recordEvent("cli.schema_generate", { subcommand: subcommand ?? "none" }, { projectRoot });
+	recordEvent("cli.schema", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -2436,7 +2492,7 @@ async function dbCommand(subcommand, rawArgs) {
 		return;
 	}
 	const projectRoot = requireProjectRoot();
-	recordEvent("cli.db_push", { subcommand: subcommand ?? "none" }, { projectRoot });
+	recordEvent("cli.db", { subcommand: subcommand ?? "none" }, { projectRoot });
 	const backendDir = requireBackendDir(projectRoot);
 	const activePlugin = getActiveBackendPlugin(backendDir);
 	if (!activePlugin) {
@@ -5300,6 +5356,48 @@ async function startWorkspaceBackend(projectRoot, env) {
 * Subcommands:
 *   reset-password — Reset a user's password
 */
+/**
+* Pick the user with exactly this email out of a search response.
+*
+* `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display
+* name**, ordered by role count descending. This used to take row `[0]` and
+* reset it, then print the email it had been *given* as confirmation — so two
+* ordinary situations ended in a successful-looking reset of somebody else's
+* account:
+*
+*   - a substring collision: `bob@example.com` also matches
+*     `robert.bob@example.com`;
+*   - a display name, which is user-controlled and accepted up to 255
+*     characters with no constraint on its content, containing an address
+*     belonging to someone else.
+*
+* The ordering makes it worse rather than better — `array_length(roles) DESC
+* NULLS LAST` puts the most privileged match first, so the account most likely
+* to be reset by mistake is an admin's.
+*
+* Returns `undefined` when nothing matched exactly, which the caller reports
+* rather than falling through to a guess. The direct-database fallback below
+* has always matched with `eq(usersTable.email, email)`; this is the same
+* definition, so the command no longer resets different accounts depending on
+* whether the backend happened to be running.
+*/
+function selectUserForEmail(payload, email) {
+	const wanted = email.trim().toLowerCase();
+	if (!wanted) return void 0;
+	const rows = Array.isArray(payload) ? payload : payload && typeof payload === "object" && Array.isArray(payload.users) ? payload.users : [];
+	for (const row of rows) {
+		if (!row || typeof row !== "object") continue;
+		const record = row;
+		const rowEmail = typeof record.email === "string" ? record.email.trim().toLowerCase() : void 0;
+		if (!rowEmail || rowEmail !== wanted) continue;
+		const id = typeof record.id === "string" ? record.id : typeof record.uid === "string" ? record.uid : void 0;
+		if (!id) continue;
+		return {
+			id,
+			email: record.email
+		};
+	}
+}
 async function authCommand(subcommand, rawArgs) {
 	if (!subcommand || subcommand === "--help") {
 		printAuthHelp();
@@ -5336,12 +5434,8 @@ async function resetPassword(rawArgs) {
 		process.exit(1);
 	}
 	const projectRoot = requireProjectRoot();
-	let envServiceKey;
 	const envFile = findEnvFile(projectRoot);
-	if (envFile && fs.existsSync(envFile)) try {
-		const match = fs.readFileSync(envFile, "utf8").match(/^\s*REBASE_SERVICE_KEY\s*=\s*['"]?(.*?)['"]?\s*$/m);
-		if (match && match[1]) envServiceKey = match[1];
-	} catch {}
+	const envServiceKey = readEnvFile(projectRoot).REBASE_SERVICE_KEY;
 	let baseUrl = process.env.REBASE_BASE_URL;
 	let serviceKey = process.env.REBASE_SERVICE_KEY || envServiceKey;
 	const statePath = path.join(projectRoot, ".rebase", "state.json");
@@ -5361,7 +5455,7 @@ async function resetPassword(rawArgs) {
 		try {
 			const finalPass = newPassword || "NewPassword123!";
 			const cleanBaseUrl = baseUrl.replace(/\/+$/, "");
-			const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=1`;
+			const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=50`;
 			const searchRes = await fetch(searchUrl, { headers: {
 				"Authorization": `Bearer ${serviceKey}`,
 				"Accept": "application/json"
@@ -5369,18 +5463,9 @@ async function resetPassword(rawArgs) {
 			if (!searchRes.ok) throw new Error(`Failed to list users: ${searchRes.statusText}`);
 			const searchData = await searchRes.json();
 			if (!searchData || typeof searchData !== "object") throw new Error("Invalid response format from user search API.");
-			let userId;
-			if (Array.isArray(searchData)) {
-				const firstUser = searchData[0];
-				if (firstUser && typeof firstUser === "object" && "id" in firstUser && typeof firstUser.id === "string") userId = firstUser.id;
-				else if (firstUser && typeof firstUser === "object" && "uid" in firstUser && typeof firstUser.uid === "string") userId = firstUser.uid;
-			} else if ("users" in searchData && Array.isArray(searchData.users)) {
-				const firstUser = searchData.users[0];
-				if (firstUser && typeof firstUser === "object" && "id" in firstUser && typeof firstUser.id === "string") userId = firstUser.id;
-				else if (firstUser && typeof firstUser === "object" && "uid" in firstUser && typeof firstUser.uid === "string") userId = firstUser.uid;
-			}
-			if (!userId) throw new Error(`User not found with email: ${email}`);
-			const resetUrl = `${cleanBaseUrl}/api/admin/users/${userId}/reset-password`;
+			const matched = selectUserForEmail(searchData, email);
+			if (!matched) throw new Error(`No user has the email ${email}.`);
+			const resetUrl = `${cleanBaseUrl}/api/admin/users/${matched.id}/reset-password`;
 			const resetRes = await fetch(resetUrl, {
 				method: "POST",
 				headers: {
@@ -5397,7 +5482,7 @@ async function resetPassword(rawArgs) {
 			console.log("API reset successful.");
 			console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (via API)"));
 			console.log("");
-			console.log(`  ${chalk.gray("Email:")} ${email}`);
+			console.log(`  ${chalk.gray("Email:")} ${matched.email}`);
 			console.log(`  ${chalk.gray("Password:")} ${finalPass}`);
 			console.log("");
 			return;
@@ -5465,10 +5550,12 @@ async function resetPassword() {
     if (result.length > 0) {
         console.log("✅ Password reset for: " + result[0].email);
         ${!newPassword ? "console.log(\"   New password: \" + newPassword);" : ""}
-    } else {
-        console.log("✗ User not found: " + email);
+        process.exit(0);
     }
-    process.exit(0);
+    // Nothing was updated, so nothing was reset. Exiting 0 here reported
+    // success for a no-op, which is what a script would have believed.
+    console.error("✗ User not found: " + email);
+    process.exit(1);
 }
 
 resetPassword().catch(console.error);
@@ -5486,11 +5573,20 @@ resetPassword().catch(console.error);
 			stdio: "inherit",
 			env
 		});
+		const cleanup = () => {
+			try {
+				fs.unlinkSync(tmpScriptPath);
+			} catch {}
+		};
 		return new Promise((resolve) => {
+			child.on("error", (err) => {
+				cleanup();
+				console.error(chalk.red("✗ Could not run the reset script."));
+				console.error(chalk.gray(`  ${err.message}`));
+				process.exit(1);
+			});
 			child.on("close", (code) => {
-				try {
-					fs.unlinkSync(tmpScriptPath);
-				} catch {}
+				cleanup();
 				if (code !== 0) process.exit(code ?? 1);
 				resolve();
 			});
@@ -5786,25 +5882,13 @@ ${chalk.green.bold("Examples")}
 *   create  — Create a new API key
 *   revoke  — Revoke an existing API key
 */
-function loadEnv(projectRoot) {
-	const envFile = findEnvFile(projectRoot);
-	const env = {};
-	if (envFile && fs.existsSync(envFile)) {
-		const content = fs.readFileSync(envFile, "utf-8");
-		for (const line of content.split("\n")) {
-			const trimmed = line.trim();
-			if (!trimmed || trimmed.startsWith("#")) continue;
-			const idx = trimmed.indexOf("=");
-			if (idx > 0) {
-				const key = trimmed.slice(0, idx).trim();
-				let value = trimmed.slice(idx + 1).trim();
-				if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
-				env[key] = value;
-			}
-		}
-	}
-	return env;
-}
+/**
+* Was a hand-rolled `indexOf("=")` loop. It keyed `export KEY=value` as
+* `export KEY` and carried a trailing `# comment` into the value — so a key
+* that was present read as absent, or reached an `Authorization` header with a
+* comment attached and came back 401. See `readEnvFile`.
+*/
+var loadEnv = readEnvFile;
 function resolveBaseUrl(env, projectRoot) {
 	if (env.REBASE_BASE_URL) return env.REBASE_BASE_URL;
 	if (projectRoot) try {
@@ -10913,6 +10997,6 @@ function telemetryNotice() {
 	return chalk.gray(`Usage sharing: ${sharing ? "on" : "off"} — ${chalk.cyan("rebase telemetry")} to inspect or change\n`);
 }
 //#endregion
-export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveStartPort, resolveTsx, schemaCommand, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
+export { CURRENT_RUNTIME_RANGE, DEFAULT_BUNDLE_DIR, DEFAULT_CONFIG_DIR, DEFAULT_CRONS_DIR, DEFAULT_FUNCTIONS_DIR, DEFAULT_SCHEMA_FILE, DEV_PORT_FILENAME, MANIFEST_FILENAME, ManifestError, TEMPLATE_PLACEHOLDER_FILES, appsCommand, assessManagedCompatibility, authCommand, buildBundle, buildCommand, buildInitQuestions, buildStaticBundle, buildableApps, cloudCommand, collectDeclaredDependencies, configureEnvFile, createRebaseApp, dbCommand, detectFrameworkDepDrift, detectNativeDependencies, detectPackageManager, detectStorageAuthorize, devCommand, doctorCommand, ejectCommand, entry, findBackendApp, findBackendDir, findEnvFile, findFrontendDir, findProjectRoot, findUnusedServerEntry, foldStaticIntoBundle, formatCdTarget, generateSdkCommand, getActiveBackendPlugin, getPMCommands, getProjectPort, isIdentifierLike, isPnpmAvailable, loadManifest, manifestExists, manifestPath, normalizeEsmSpecifiers, pnpmAvailabilityFromProbe, positionals, printInitHelp, readEnvFile, requireBackendDir, requireProjectRoot, resetPnpmAvailabilityCache, resolveBackendPaths, resolveCliVersion, resolveExampleBaseUrl, resolveLocalBin, resolvePluginCliScript, resolveRuntimeImageTag, resolveStartPort, resolveTsx, schemaCommand, selectUserForEmail, startCommand, synthesizeManifest, validateManifest, validateProjectName, validateTsxInstallation, writeManifest };
 
 //# sourceMappingURL=index.es.js.map