@rebasepro/cli 0.21.0 → 0.21.1-canary.g8c5a265

package/README.md

@@ -9,8 +9,8 @@ pnpm add -g @rebasepro/cli
 ```
 
 ESM-only: `"type": "module"` with no CommonJS build, so it is loaded with
-`import`. `require()` of it resolves only on Node 22.12+, which supports
-`require(esm)`.
+`import`. It needs Node `>=22.22.0` (its `engines` floor), where `require()`
+of it resolves too: Node has supported `require(esm)` since 22.12.
 
 The CLI is also bundled with every Rebase project as a local dependency.
 
@@ -20,19 +20,29 @@ The CLI is also bundled with every Rebase project as a local dependency.
 |---------|-------------|
 | `rebase init` | Scaffold a new Rebase project |
 | `rebase dev` | Start the development server (backend + frontend) |
-| `rebase build` | Build all workspace packages |
+| `rebase build` | Build the apps declared in `rebase.json` into a bundle |
+| `rebase normalize-imports` | Complete compiled output's relative imports for Node ESM |
 | `rebase start` | Start the backend server (production) |
+| `rebase apps list` | Show the apps this repository declares |
 | `rebase schema generate` | Generate Drizzle schema from collection definitions |
 | `rebase schema introspect` | Introspect an existing database → Rebase collections |
+| `rebase schema stale` | Report generated schema files the collections have moved past |
 | `rebase db push` | Apply schema directly to database (dev). Previews the plan and refuses destructive changes (e.g. dropped columns) unless confirmed interactively or run with `--allow-destructive`. |
 | `rebase db generate` | Generate SQL migration files |
 | `rebase db migrate` | Run pending migrations |
+| `rebase db pull` | Copy another database into local development |
+| `rebase db branch` | Create, list, switch and delete database branches |
+| `rebase db stop` | Stop the managed development database (data is kept) |
+| `rebase db reset` | Delete the managed development database and start over |
 | `rebase generate-sdk` | Generate a typed TypeScript SDK from collections |
 | `rebase auth reset-password` | Reset a user's password |
+| `rebase api-keys list \| create \| revoke` | Manage scoped service API keys |
 | `rebase doctor` | Detect schema drift between collections, Drizzle schema, and database |
 | `rebase status` | Show every resource this project declares and whether its variables are set |
 | `rebase resources` | List the databases, buckets and topics this project declares |
+| `rebase eject` | Own the server process and the image (one-way) |
 | `rebase skills install` | Install Rebase agent skills for your AI coding assistant |
+| `rebase telemetry` | Anonymous usage sharing (opt-in, off by default) |
 | `rebase cloud <command>` | Manage your apps on Rebase Cloud (auth, deploy, databases, …) |
 
 Run `rebase --help` or `rebase <command> --help` for detailed usage.

package/bin/rebase.js

@@ -188,7 +188,10 @@ const { entry } = await import("../dist/index.es.js");
  * `utils/args.ts` marks those with `isUsageError` rather than a class, because
  * this file imports the bundle and `instanceof` cannot reach across it.
  */
-const wantsStack = process.argv.includes("--debug") || process.env.REBASE_DEBUG === "1";
+// After the bundle, which already imports this package, and spelled as the
+// commands spell it: `wantsRawError` in `commands/cloud/errors.ts`.
+const { parseEnvBoolean } = await import("@rebasepro/types");
+const wantsStack = process.argv.includes("--debug") || parseEnvBoolean(process.env.REBASE_DEBUG) === true;
 
 entry(process.argv).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);

package/dist/commands/cloud/errors.d.ts

@@ -76,5 +76,10 @@ export declare function summarizeError(error: unknown, context: string): ErrorSu
  * `--debug` is already what `bin/rebase.js` prints after every failure as the
  * thing to add, so the raw payload hangs off the flag people are told to reach
  * for rather than off one invented here.
+ *
+ * The one reader of `REBASE_DEBUG` in the commands, spelled as the bin spells
+ * it. It used to be `=== "1"` here while the quote fallbacks in `resources.ts`
+ * tested the raw string for truthiness, so `=true` hid the body and `=0`
+ * printed the fallback.
  */
 export declare function wantsRawError(argv?: readonly string[]): boolean;

package/dist/index.es.js

@@ -22,7 +22,7 @@ import { execFileSync, spawn, spawnSync } from "child_process";
 import os from "os";
 import { createRebaseClient } from "@rebasepro/client";
 import dotenv from "dotenv";
-import { BUNDLE_FORMAT_VERSION, DEFAULT_DATA_SOURCE_KEY, DEFAULT_RESOURCE_KEY, DEFAULT_STORAGE_SOURCE_KEY, RUNTIME_CONTRACT_VERSION, buildResourceGraph, computeSchemaVersion, declareFunction, declaredQueueConsumers, declaredResources, declaredSubscriptions, deserializeCollections, envBasesForResource, findEnvSuffixCollision, findStorageSuffixCollision, getDataSourceCapabilities, isResourceHandle, reservedPrefixFor, resetDeclaredQueueConsumers, resetDeclaredResources, resetDeclaredSubscriptions, resolveResourceRefs, resourceEnvSuffix, resourceId, resourceKeyOf, resourceToDataSource } from "@rebasepro/types";
+import { BUNDLE_FORMAT_VERSION, DEFAULT_DATA_SOURCE_KEY, DEFAULT_RESOURCE_KEY, DEFAULT_STORAGE_SOURCE_KEY, RUNTIME_CONTRACT_VERSION, buildResourceGraph, computeSchemaVersion, declareFunction, declaredQueueConsumers, declaredResources, declaredSubscriptions, deserializeCollections, envBasesForResource, findEnvSuffixCollision, findStorageSuffixCollision, getDataSourceCapabilities, isResourceHandle, parseEnvBoolean, reservedPrefixFor, resetDeclaredQueueConsumers, resetDeclaredResources, resetDeclaredSubscriptions, resolveResourceRefs, resourceEnvSuffix, resourceId, resourceKeyOf, resourceToDataSource } from "@rebasepro/types";
 import { CodegenError, generateSDK, toSafeIdentifier } from "@rebasepro/codegen";
 import { createRequire } from "module";
 import { randomBytes as randomBytes$1 } from "node:crypto";
@@ -186,6 +186,29 @@ function parseCommandArgs({ spec, rawArgs, commandWords, command, maxPositionals
 //#endregion
 //#region src/commands/cloud/errors.ts
 /**
+* Turning a control-plane failure into something the caller can act on.
+*
+* The control plane talks to Kubernetes, and when Kubernetes refuses it, the
+* refusal travels back verbatim: a whole `Status` object, the request headers,
+* an `audit-id`, an `x-kubernetes-pf-flowschema-uid`. That reached the user's
+* terminal unedited. Two things are wrong with it beyond the noise.
+*
+* The first is that the one sentence that matters is buried in the middle of a
+* JSON blob, so the remedy — if there is one — is the hardest part to find.
+*
+* The second is worse, and is the reason this file exists rather than a
+* `slice(0, 200)`. A `403` naming a `system:serviceaccount:` is a statement
+* about the PLATFORM's own credentials: some role the control plane runs as is
+* missing a grant. Nothing in the user's project can change that — not the
+* collections, not `rebase.json`, not the deploy flags — and the error, printed
+* raw in the middle of `rebase cloud deploy`, reads exactly like a project
+* fault. Someone acting on that reading deletes working code looking for the
+* cause. (That is not hypothetical: three cron jobs were removed from a project
+* to test whether they caused a `cronjobs.batch` 403. They did not.)
+*
+* So this classifies before it summarises, and says whose problem it is.
+*/
+/**
 * The service accounts a Kubernetes 403 can name, and what each means.
 *
 * `system:serviceaccount:` is the platform's own identity — the control plane's
@@ -308,9 +331,14 @@ function truncate(text) {
 * `--debug` is already what `bin/rebase.js` prints after every failure as the
 * thing to add, so the raw payload hangs off the flag people are told to reach
 * for rather than off one invented here.
+*
+* The one reader of `REBASE_DEBUG` in the commands, spelled as the bin spells
+* it. It used to be `=== "1"` here while the quote fallbacks in `resources.ts`
+* tested the raw string for truthiness, so `=true` hid the body and `=0`
+* printed the fallback.
 */
 function wantsRawError(argv = process.argv) {
-	return argv.includes("--debug") || process.env.REBASE_DEBUG === "1";
+	return argv.includes("--debug") || parseEnvBoolean(process.env.REBASE_DEBUG) === true;
 }
 //#endregion
 //#region src/commands/cloud/context.ts
@@ -714,8 +742,7 @@ function initOutputMode(rawArgs) {
 		argv: rawArgs.slice(2),
 		permissive: true
 	})["--json"]) JSON_MODE = true;
-	else if (process.env.REBASE_JSON === "0") JSON_MODE = false;
-	else JSON_MODE = process.env.REBASE_JSON === "1" || process.stdout.isTTY !== true;
+	else JSON_MODE = parseEnvBoolean(process.env.REBASE_JSON) ?? process.stdout.isTTY !== true;
 	return JSON_MODE;
 }
 /** Whether the current invocation is emitting machine-readable JSON. */
@@ -1446,6 +1473,18 @@ function endpoint() {
 	return process.env.REBASE_TELEMETRY_ENDPOINT?.trim() || "https://app.rebase.pro/api/functions/telemetry";
 }
 /**
+* Set to anything but a spelled no.
+*
+* The conventions behind these variables make presence the signal —
+* `CI=woodpecker` is a CI run, `DO_NOT_TRACK=please` is an answer — so a value
+* the parser does not recognise still counts, and the refusal holds. Only the
+* platform's spellings of no turn one off. It was `!== "0"` for two of them and
+* `!== "false"` for `CI`, so `CI=0` read as a runner.
+*/
+function setAndNotNo(value) {
+	return value !== void 0 && value.trim() !== "" && parseEnvBoolean(value) !== false;
+}
+/**
 * The one function that decides whether anything leaves the machine.
 *
 * Every path is a refusal except the last, which is the point: consent is
@@ -1465,9 +1504,9 @@ function endpoint() {
 * project.ts on why the reverse is refused.
 */
 function suppressionReason(env = process.env, cwd = process.cwd()) {
-	if (env.DO_NOT_TRACK && env.DO_NOT_TRACK !== "0") return "do_not_track";
-	if (env.REBASE_TELEMETRY_DISABLED && env.REBASE_TELEMETRY_DISABLED !== "0") return "rebase_telemetry_disabled";
-	if (env.CI && env.CI !== "false") return "ci";
+	if (setAndNotNo(env.DO_NOT_TRACK)) return "do_not_track";
+	if (setAndNotNo(env.REBASE_TELEMETRY_DISABLED)) return "rebase_telemetry_disabled";
+	if (setAndNotNo(env.CI)) return "ci";
 	if (readProjectPolicy(cwd) === "opt_out") return "project_opt_out";
 	const config = readConfig();
 	if (config.enabled === void 0) return "not_asked";
@@ -2343,7 +2382,7 @@ async function replacePlaceholders(options) {
 		const matches = [...content.matchAll(/"(@rebasepro\/[^"]+)":\s*"workspace:\*"/g)];
 		for (const match of matches) allPackages.add(match[1]);
 	}
-	const probe = process.env.REBASE_E2E === "true" || version === "unknown" ? { kind: "published" } : await probeRelease(version);
+	const probe = parseEnvBoolean(process.env.REBASE_E2E) === true || version === "unknown" ? { kind: "published" } : await probeRelease(version);
 	if (probe.kind === "gap") throw new Error(`Rebase ${version} is not fully published to npm.\n\n${RELEASE_PROBE_PACKAGE} has no ${version} release — the registry has ${probe.found}.\nEvery @rebasepro package ships at one version, so scaffolding would pin ${allPackages.size}\ndependencies at a version that is not there, and the install would fail.\n\nThat is a release gap in Rebase itself — not a problem with your machine,
 your network, or your package manager.
 
@@ -4856,7 +4895,7 @@ function refuseStorageBlock(raw, issues) {
 * else. It used to be inferred from the presence of `backend/src/index.ts`,
 * which every scaffolded project had whether or not it wanted its own server, so
 * projects predating the manifest silently landed on the custom runtime and paid
-* for it (see `docs/plans/cloud-deploy-workspace-vendoring.md`).
+* for it.
 */
 function synthesizeManifest(projectRoot) {
 	const exists = (relative) => fs.existsSync(path.join(projectRoot, relative));
@@ -5774,8 +5813,8 @@ async function devCommand(rawArgs) {
 	* gating only the preflight left the managed PGlite starting anyway, which
 	* is the one database a scaffolded project would otherwise get.
 	*/
-	const noDb = Boolean(args["--no-db"]) || process.env.REBASE_DEV_NO_DB === "1";
-	const shouldGenerate = args["--generate"] || process.env.REBASE_AUTO_GENERATE === "true" || process.env.REBASE_GENERATE === "true";
+	const noDb = Boolean(args["--no-db"]) || parseEnvBoolean(process.env.REBASE_DEV_NO_DB) === true;
+	const shouldGenerate = args["--generate"] || parseEnvBoolean(process.env.REBASE_AUTO_GENERATE) === true || parseEnvBoolean(process.env.REBASE_GENERATE) === true;
 	const { port: startPort, source: startPortSource } = resolveStartPort(projectRoot, args["--port"]);
 	const portIsPinned = args["--port"] !== void 0;
 	const pinnedFrontendPort = process.env.REBASE_FRONTEND_PORT;
@@ -7184,7 +7223,7 @@ function collectDeclaredDependencies(projectRoot) {
 			if (typeof version === "string" && version.startsWith("workspace:")) continue;
 			if (resolvesToWorkspacePackage(projectRoot, name)) continue;
 			const protocol = typeof version === "string" ? nonRegistrySpecifier(version) : null;
-			if (protocol && process.env.REBASE_E2E === "true" && protocol === "file:") {
+			if (protocol && parseEnvBoolean(process.env.REBASE_E2E) === true && protocol === "file:") {
 				declared[name] = version;
 				continue;
 			}
@@ -13351,7 +13390,7 @@ async function billingCommand(rawArgs) {
 				if (hasCluster) monthly = `${monthly} — platform fee, your own cluster`;
 			}
 		} catch (err) {
-			if (process.env.REBASE_DEBUG) console.error(`  (no price: ${err instanceof Error ? err.message : String(err)})`);
+			if (wantsRawError()) console.error(`  (no price: ${err instanceof Error ? err.message : String(err)})`);
 		}
 		emit(() => {
 			console.log("");
@@ -13470,7 +13509,7 @@ async function computeCommand(action, rawArgs) {
 				path: "quote"
 			});
 		} catch (err) {
-			if (process.env.REBASE_DEBUG) console.error(`  (no price: ${err instanceof Error ? err.message : String(err)})`);
+			if (wantsRawError()) console.error(`  (no price: ${err instanceof Error ? err.message : String(err)})`);
 		}
 		emit(() => {
 			console.log("");