@rebasepro/cli 0.15.0 → 0.16.0

package/dist/bundle.d.ts

@@ -15,6 +15,15 @@ export interface BuildBundleOptions {
      * once, by the command that owns it.
      */
     storage?: DeclaredStorageSources;
+    /**
+     * Install the declared dependencies into the bundle at build time.
+     *
+     * Omitted means "when it is safe to" — which is every bundle whose closure
+     * has no native code. `false` is the escape hatch for a build that must not
+     * shell out to npm at all (an air-gapped CI, a offline reproducibility
+     * check); the bundle still works, it simply installs at boot as before.
+     */
+    vendor?: boolean;
     /** Skip type checking. Faster, and strictly worse — for iteration only. */
     skipTypeCheck?: boolean;
     /** Skip regenerating the Drizzle schema from the collections. */
@@ -26,6 +35,13 @@ export interface BuildBundleResult {
     outDir: string;
     manifest: RebaseBundleManifest;
     collectionCount: number;
+    /**
+     * Whether the dependency tree was installed into the bundle, and why not
+     * when it was not. Reported rather than silent: "your pods will take a
+     * minute to start" is a consequence a developer should hear at build time,
+     * not discover during an incident.
+     */
+    vendor: VendorResult;
 }
 /**
  * Whether the compiled config package exports a `storageAuthorize` hook.
@@ -147,6 +163,85 @@ export declare function findUnusedServerEntry(projectRoot: string, functionsDir:
  * Compile and assemble a bundle.
  */
 export declare function buildBundle(options: BuildBundleOptions): Promise<BuildBundleResult>;
+/** Default install target: what the published runtime image runs. */
+export declare const VENDOR_TARGET_OS = "linux";
+export declare const VENDOR_TARGET_CPU = "x64";
+export interface VendorResult {
+    vendored: boolean;
+    target?: {
+        os: string;
+        cpu: string;
+        node: string;
+    };
+    /** Why nothing was installed. Present exactly when `vendored` is false. */
+    skipped?: string;
+    /** Size of the installed tree on disk, when one was installed. */
+    bytes?: number;
+}
+/**
+ * Where a vendored bundle starts being too big to upload.
+ *
+ * The control plane refuses a bundle over 100 MB, and that ceiling is not
+ * arbitrary or easily raised: its pod has a 512Mi memory limit and the upload
+ * route holds the body while it writes it, so the cap protects the process that
+ * also serves the console, deploys and billing. Vendoring is the one change that
+ * can push a bundle near it.
+ *
+ * So the warning is here, at build time, where the remedy is one flag away —
+ * rather than at deploy time as a 413 nobody can act on without rebuilding. The
+ * threshold sits below the real cap because this measures the tree on disk and
+ * the upload is compressed: crossing it means "getting close", not "will fail".
+ */
+export declare const VENDOR_SIZE_WARN_BYTES: number;
+/**
+ * Install the bundle's declared dependencies into the bundle itself.
+ *
+ * ## What this buys
+ *
+ * A managed pod's bundle lives on an `emptyDir`, so it is re-fetched and
+ * re-installed on **every** start — an eviction, a node failure, an OOM, a
+ * runtime rollout. The install is 35–55 seconds of a 40–60 second cold start,
+ * which makes it the price of every unplanned restart a tenant suffers. Doing it
+ * once at build time instead of every time at boot takes that to roughly the
+ * cost of untarring.
+ *
+ * The pod side needs no change to benefit: the init container already skips
+ * installing when `node_modules` is present, a guard that existed for
+ * pre-baked images and turns out to be exactly the hook this needs.
+ *
+ * ## Why it refuses to vendor native code
+ *
+ * A compiled binary is valid only for the platform it was built for, and a
+ * developer's machine is rarely the deployment's. The managed runtime already
+ * refuses bundles containing native modules for the same reason, so this refusal
+ * costs nothing there — but a self-hosted project may legitimately use them, and
+ * for those the honest answer is to install in the container, where the platform
+ * is known.
+ *
+ * ## Why `--os` and `--cpu` are not optional
+ *
+ * The dangerous case is not native code, which is detectable. It is a pure-JS
+ * package whose real work lives in a **platform-specific optional dependency** —
+ * `esbuild` being the one everybody meets. Installing on an Apple Silicon Mac
+ * resolves `@esbuild/darwin-arm64`, produces a tree that looks complete, and
+ * fails at import inside a linux/amd64 pod. npm resolves optional dependencies
+ * for the declared target rather than the host when told to, so it is told to.
+ */
+export declare function vendorDependencies(options: {
+    outDir: string;
+    declared: Record<string, string>;
+    nativeModules: NativeDependency[];
+    /**
+     * Packages the runtime resolves *from the bundle* and cannot boot without —
+     * in practice the database driver, which the image deliberately does not
+     * supply. A vendored tree missing one of these is refused; see below.
+     */
+    required?: string[];
+    /** `false` disables; `undefined` means "when it is safe to". */
+    requested?: boolean;
+    /** Injected in tests. */
+    run?: (cmd: string, args: string[], cwd: string) => void;
+}): VendorResult;
 /**
  * Package a built static app (a `static` or bundled-`admin` app) into a bundle.
  *

package/dist/commands/cloud/resources.d.ts

@@ -73,6 +73,41 @@ export declare function resolveWebhookIdArg(rawArgs: string[]): string | undefin
 export declare function webhooksCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
 export declare function storageCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
 export declare function printStorageHelp(): void;
-export declare function clustersCommand(rawArgs: string[]): Promise<void>;
+/**
+ * `rebase cloud clusters` — list, register and verify the clusters tenants run on.
+ *
+ * Registration is deliberately an operator action: the `clusters` collection is
+ * admin-only, and a cluster record carries a credential with enough power to
+ * create namespaces and read every secret in them. A self-serve "bring your own
+ * cluster" flow is a different feature with a different threat model.
+ */
+export declare function clustersCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
 export declare function billingCommand(rawArgs: string[]): Promise<void>;
+/**
+ * `rebase cloud resources` — show what a project is given, and change it.
+ *
+ * ## Why nothing is validated here
+ *
+ * The rules are the *target cluster's*, not the CLI's: GKE Autopilot bills a
+ * 250m/512Mi floor and rewrites anything outside a 1:1–6.5:1 memory:CPU band,
+ * while a Hetzner or EKS node has neither constraint. A CLI that carried those
+ * numbers would be wrong for two of the three providers the moment it shipped,
+ * and would drift from the control plane the first time either changed.
+ *
+ * So the control plane validates and this reports what it said. The same
+ * boundary refuses a raw PATCH and a console save, which is the property worth
+ * having — a check in a client only covers the clients that run it.
+ */
+export declare function resourcesCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * Turn `--cpu 500m --db-instances 2` into the patch to send.
+ *
+ * Pure, and exported, so the flag handling is testable without a control plane —
+ * the same shape `buildSettingsPatch` uses. Returns an error string rather than
+ * throwing, because the caller owns how a refusal is printed in JSON mode.
+ */
+export declare function buildDialPatch(rawArgs: string[]): {
+    patch: Record<string, unknown>;
+    error?: string;
+};
 export {};

package/dist/commands/db.d.ts

@@ -1 +1,16 @@
+/**
+ * Rewrite local path arguments so they mean what the user typed.
+ *
+ * The plugin CLI is spawned with `cwd: backendDir` — it has to be, because that
+ * is where the plugin and its dependencies resolve from. But the developer runs
+ * `rebase db` from the project root, so a relative `--out ./backups` was being
+ * resolved against `backend/` and landed in `backend/backups`, while the
+ * success line echoed the path as typed. The file was real and the reported
+ * location was wrong, which is the worst way for a backup command to behave.
+ * `rebase db --help` documents exactly this invocation.
+ *
+ * Absolutising here rather than inside the plugin keeps the fix where the cwd
+ * is actually changed, and leaves the plugin usable on its own terms.
+ */
+export declare function absolutizeLocalPathArgs(args: string[], cwd: string): string[];
 export declare function dbCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/doctor.d.ts

@@ -1 +1,9 @@
+import { type LibpqUrlFinding } from "../utils/libpq-url";
+/**
+ * Find connection strings libpq cannot parse, anywhere in the project.
+ *
+ * Exported for the tests; `envFile` is passed separately because a project may
+ * keep its `.env` outside the root (see `findEnvFile`).
+ */
+export declare function findLibpqUrlProblems(projectRoot: string, envFile?: string | null): LibpqUrlFinding[];
 export declare function doctorCommand(rawArgs: string[]): Promise<void>;