@rebasepro/cli 0.20.0 → 0.21.0

package/dist/bundle.d.ts

@@ -398,6 +398,8 @@ export declare function foldStaticIntoBundle(options: {
     path: string;
     /** Serve `index.html` for unmatched paths under `path`. */
     spa: boolean;
+    /** Where this app mounts the Rebase CMS, if it does. */
+    cms?: string;
 }): {
     fileCount: number;
     dir: string;
@@ -412,6 +414,8 @@ export declare function buildStaticBundle(options: {
     path?: string;
     /** Serve `index.html` for unmatched paths. Default `true`. */
     spa?: boolean;
+    /** Where this app mounts the Rebase CMS, if it does. */
+    cms?: string;
 }): {
     outDir: string;
     manifest: RebaseBundleManifest;

package/dist/commands/build.d.ts

@@ -1,4 +1,30 @@
 import type { RebaseAppConfig } from "@rebasepro/types";
+/**
+ * The two commands that turn a custom-runtime app into an image.
+ *
+ * Exported for the test, because the failure this replaced was in the printed
+ * text and nowhere else. It said:
+ *
+ *     docker build -f backend/Dockerfile .
+ *
+ * for every custom backend, and the `.` was a guess — `context` was validated,
+ * stored on the config, and read by nothing. For the reference project that
+ * guess is wrong: `app/backend/Dockerfile` opens by copying `pnpm-lock.yaml`
+ * and `pnpm-workspace.yaml`, which live at the monorepo root, so the command
+ * `rebase build` handed you died on its first instruction. The deploy that
+ * actually works, `infra/cloudbuild.yaml`, has always said
+ * `-f app/backend/Dockerfile .` from the root.
+ *
+ * `dockerfile` is relative to `rebase.json`; `context` is too, and may point
+ * above it. Docker resolves `-f` against the working directory, not the
+ * context, so the path has to be re-expressed against wherever the command
+ * runs — which is what the old line never did and is the whole reason it
+ * could not be right for both.
+ */
+export declare function dockerBuildHint(projectRoot: string, name: string, app: {
+    dockerfile?: string;
+    context?: string;
+}): string[];
 export declare function buildCommand(rawArgs?: string[]): Promise<void>;
 /**
  * Build a static app and package it into a static bundle.

package/dist/commands/cloud/bundle-deploy.d.ts

@@ -17,6 +17,35 @@ export declare function packBundle(bundleDir: string, outPath: string): Promise<
  * without unpacking the uploaded archive first — a rejection (native deps, no
  * matching runtime) is then a fast, cheap answer.
  */
+/** The commit a bundle was built from, as far as the working directory knows. */
+export interface BundleCommit {
+    hash: string;
+    message: string;
+}
+/**
+ * The commit HEAD is on, read here because here is the only place it exists.
+ *
+ * A bundle deploy has no repository anywhere near the control plane: the CLI
+ * builds a tarball and uploads it, so the three paths `deploy.ts` documents for
+ * learning a commit — clone, `ls-remote`, or "there is no repo at all" — all
+ * resolve to the third. Every bundle deployment therefore recorded an empty
+ * hash, which is 291 of the 305 rows in production: a Deployments list where
+ * almost nothing says what it shipped.
+ *
+ * But the CLI is standing IN the repository. `git -C <dir> log -1` answers
+ * exactly, message included — the one thing even the git-build path cannot get
+ * from `ls-remote`.
+ *
+ * Returns null rather than guessing, for every reason it can fail: no git, not a
+ * repository, no commits yet. The server records what it is given and nothing
+ * more, so null here stays `UNKNOWN_COMMIT_HASH` there.
+ *
+ * A dirty tree is NOT reported as a different commit. The bundle may contain
+ * uncommitted work, and the honest statement about that is "built from a tree at
+ * <hash>", not a fabricated identifier — the same rule the rest of this file
+ * follows about inventing values.
+ */
+export declare function bundleCommit(cwd: string, run?: (args: string[]) => string): BundleCommit | null;
 export declare function bundleDeployBody(input: {
     projectId: string;
     bundleId: string;
@@ -28,6 +57,14 @@ export declare function bundleDeployBody(input: {
      * register the whole set rather than only the one being deployed.
      */
     declaredApps?: DeclaredApp[];
+    /**
+     * What HEAD said when this bundle was built, or null outside a repository.
+     *
+     * Omitted from the body entirely when null — an absent field and an empty
+     * one are the same to the server, and sending `""` would make "we did not
+     * look" indistinguishable from "we looked and there was nothing".
+     */
+    commit?: BundleCommit | null;
 }): Record<string, unknown>;
 /** An app as `rebase.json` declares it, reduced to what the registry stores. */
 export interface DeclaredApp {

package/dist/commands/cloud/context.d.ts

@@ -1,6 +1,17 @@
 import arg from "arg";
 import { createRebaseClient } from "@rebasepro/client";
 /** Project-local link file: <project>/.rebase/cloud.json */
+/**
+ * The billing account an organization row points at, whichever key it arrived under.
+ *
+ * REST serves every column under its own property name, so the relation comes
+ * back as `billingAccountId`. Both readers in this CLI checked
+ * `billing_account_id` and `billingAccount` — neither is what arrives — so
+ * `rebase cloud billing` answered "no billing account" for every organization,
+ * and the deploy pre-check never saw an internal plan. The other two spellings
+ * are still accepted: older servers and fixtures send them.
+ */
+export declare function billingAccountIdOf(org: unknown): string | number | undefined;
 export declare function projectLinkPath(cwd?: string): string;
 /** Persist the active organization id for a host. */
 export declare function setContextOrg(url: string, org: string | undefined): void;
@@ -514,3 +525,46 @@ export declare function reportError(e: unknown, context: string): never;
  * rather than from a line that happens to end in a URL.
  */
 export declare function openUrl(target: string, label?: string): void;
+/**
+ * The one thing every control-plane row is required to have.
+ *
+ * The subcommands each declare their own row shape — `OrgRow`, `ProjectRow`,
+ * `DatabaseRow`, `DeploymentRow` — and every one of them is an `id` plus
+ * fields that are all optional, because a control plane older than a given
+ * column simply does not send it. The reads are written that way too
+ * (`o.name ?? "(unnamed)"`, `row.slug ? … : ""`).
+ */
+export interface CloudRow {
+    id: string | number;
+}
+/**
+ * Read the control plane's rows as a subcommand's row shape.
+ *
+ * `client.data.collection(...)` is typed against the *generated* schema of the
+ * project the SDK is pointed at, and the control-plane collections this CLI
+ * reads are not in one — so every row arrives as an open
+ * `Record<string, unknown>`. A declared `interface` gets no implicit index
+ * signature, so it does not overlap that, and a direct `as` is refused: which
+ * is how ten call sites came to write `as unknown as XRow[]`, an assertion
+ * about a wire payload with nothing checking it in either direction.
+ *
+ * There is exactly one invariant to check and this checks it. Everything else
+ * the shapes declare is optional and already read as such, so there is nothing
+ * further to verify — but a row with no usable `id` is not a row any of these
+ * commands can act on, and passing it through was how a listing came to print
+ * `[undefined]` and a lookup came to compare against the string `"undefined"`.
+ */
+export declare function cloudRows<T extends CloudRow>(rows: readonly Record<string, unknown>[] | undefined): T[];
+/** {@link cloudRows} for an endpoint that returns a single row. */
+export declare function cloudRow<T extends CloudRow>(row: Record<string, unknown> | undefined): T | undefined;
+/**
+ * {@link cloudRows} for a write that must have produced a row.
+ *
+ * `create()` returning something with no usable `id` means the control plane
+ * accepted the write and then described it in a way this CLI cannot act on.
+ * The callers all go straight on to use that id — `setContextOrg(url,
+ * String(created.id))` — so asserting the shape, which is what stood here,
+ * turned a control-plane fault into an organization whose active id is the
+ * seven-letter string `"undefined"`, stored in the user's config file.
+ */
+export declare function requireCloudRow<T extends CloudRow>(row: Record<string, unknown> | undefined, what: string): T;

package/dist/commands/cloud/databases.d.ts

@@ -3,6 +3,8 @@
  *
  *   db list                List databases attached to the project
  *   db create              Attach a managed or bring-your-own database
+ *   db info                Where the database is, and what it is called
+ *   db connect             A local port that IS the project's database
  *   db test                Test connectivity to the project's database
  *   db backup list|create|restore
  */

package/dist/commands/cloud/db-connect.d.ts

@@ -0,0 +1,70 @@
+/**
+ * `rebase cloud db connect` — a local port that is your cloud database.
+ *
+ * ## What this replaces
+ *
+ * A managed database lives in a namespace of the platform's cluster, and its
+ * address (`postgres-rw.rebase-tenant-….svc.cluster.local`) resolves to nothing
+ * on a developer's machine. The console used to bridge that gap by printing
+ *
+ *     kubectl port-forward svc/postgres-rw -n rebase-tenant-… 5432:5432
+ *
+ * which nobody outside the platform can run: a tenant of Rebase Cloud has no
+ * kubeconfig for our cluster, and there is no product that sells one. So the
+ * platform reaches into the cluster instead, and this command is the local end
+ * of that reach.
+ *
+ * ## How it works
+ *
+ * A listener on 127.0.0.1. Every TCP connection it accepts opens its own
+ * WebSocket to the control plane, authenticates in-band with the console session
+ * this CLI already holds, and from `ready` onwards the two are a byte pipe. The
+ * database still asks for a password — the tunnel is a network path, not a
+ * credential — so `psql` behaves exactly as it would against a local Postgres.
+ *
+ * One WebSocket per connection rather than one multiplexed socket: `psql` is one
+ * connection and a pool is a handful, and per-connection sockets keep the
+ * framing at "these bytes are those bytes" with no stream ids to get wrong.
+ *
+ * Node's global `WebSocket` is used rather than `ws`, which is why the token
+ * goes in the first frame instead of an `Authorization` header — the WHATWG
+ * client cannot set request headers, and a header-only endpoint would be
+ * unreachable from a browser too.
+ */
+import net from "node:net";
+/** Documented in `action-help.ts`, and paired with it by `action-help.test.ts`. */
+export declare const DB_CONNECT_FLAGS: {
+    readonly "--port": NumberConstructor;
+    readonly "--reveal": BooleanConstructor;
+};
+/** `https://app.rebase.pro` → `wss://app.rebase.pro/api/db-tunnel/p1`. */
+export declare function tunnelUrl(cloudUrl: string, projectId: string): string;
+/**
+ * A local DSN for the tunnel, with the password only if the caller asked.
+ *
+ * Built here and nowhere else. The server reports the *cluster's* URI, which is
+ * the one thing that must not be printed as the way to connect — it is exactly
+ * the address that does not work from here.
+ */
+export declare function localDsn(opts: {
+    port: number;
+    username: string | null;
+    database: string | null;
+    password?: string;
+}): string;
+export declare function dbConnect(rawArgs: string[]): Promise<void>;
+/**
+ * One accepted connection, carried over one WebSocket.
+ *
+ * The local socket is paused until the tunnel says `ready`, so a client that
+ * sends its startup packet the instant it connects — which every Postgres
+ * client does — cannot have those bytes arrive before there is a database to
+ * send them to.
+ *
+ * Exported for `db-connect.pipe.test.ts`, which drives it with a real socket
+ * against a real WebSocket: this is the half a developer's client actually
+ * talks to, and a pipe is the one component whose bugs are silent — a dropped
+ * or reordered chunk does not throw, it corrupts a Postgres message and
+ * surfaces as a protocol error nowhere near here.
+ */
+export declare function pipeThroughTunnel(socket: net.Socket, endpoint: string, token: string): void;

package/dist/commands/cloud/projects.d.ts

@@ -53,8 +53,8 @@ export declare const CREATE_PROJECT_FLAGS: {
      * means the two-command sequence that every project needs is one command,
      * and `--db none` is there for the case that genuinely wants to decide later.
      *
-     * Distinct from `--db-mode`/`--db-cpu` next to it, which are resource dials
-     * on a database that exists. This is whether there is one.
+     * Distinct from `--db-cpu`/`--db-instances` next to it, which are resource
+     * dials on a database that exists. This is whether there is one.
      */
     readonly "--db": StringConstructor;
     /** For `--db byodb`. Same spelling as `rebase cloud db create` uses. */
@@ -65,7 +65,6 @@ export declare const CREATE_PROJECT_FLAGS: {
     readonly "--replicas": StringConstructor;
     readonly "--spot": StringConstructor;
     readonly "--scale-to-zero": StringConstructor;
-    readonly "--db-mode": StringConstructor;
     readonly "--db-instances": StringConstructor;
     readonly "--db-cpu": StringConstructor;
     readonly "--db-memory": StringConstructor;

package/dist/commands/init.d.ts

@@ -56,7 +56,42 @@ export interface BuildQuestionsParams {
  * Exported for testability — all prompt `type` values must match
  * types registered by the installed version of inquirer.
  */
-export declare function buildInitQuestions(params: BuildQuestionsParams): Record<string, unknown>[];
+/**
+ * The questions this command asks, as inquirer types them.
+ *
+ * Declared, rather than left as `Record<string, unknown>` and asserted into
+ * `Parameters<typeof inquirer.prompt>[0]` at the call. Inquirer infers the
+ * answer shape from the array it is handed, so an array of open records matches
+ * none of its overloads — which is the refusal that assertion was there to get
+ * past, at the cost of every question in this file being unchecked: a
+ * misspelled `mesage`, a `choices` on a `confirm`, a `default` of the wrong
+ * type for its question kind all compiled.
+ */
+export type InitQuestion = {
+    type: "input";
+    name: string;
+    message: string;
+    default: string;
+    validate?: (input: string) => string | true;
+} | {
+    type: "confirm";
+    name: string;
+    message: string;
+    default: boolean;
+    when?: (answers: Record<string, unknown>) => boolean;
+} | {
+    type: "select";
+    name: string;
+    message: string;
+    choices: ReadonlyArray<{
+        name: string;
+        value: unknown;
+        short: string;
+    }>;
+    default: unknown;
+    when?: (answers: Record<string, unknown>) => boolean;
+};
+export declare function buildInitQuestions(params: BuildQuestionsParams): InitQuestion[];
 /**
  * The `cd` a user must type to enter the new project.
  *

package/dist/fold-static.d.ts

@@ -6,6 +6,7 @@ export interface FoldableManifest {
         output?: string;
         path?: string;
         spa?: boolean;
+        cms?: string;
     }>;
 }
 export interface FoldOptions {
@@ -32,6 +33,8 @@ export interface FoldableApp {
     path: string;
     /** SPA fallback, defaulted to `true`. */
     spa: boolean;
+    /** Where this app mounts the Rebase CMS, if it does. */
+    cms?: string;
 }
 /**
  * Every static app in the manifest, in mount order.