@rebasepro/cli 0.24.0 → 0.24.1-canary.g19596ef

package/dist/telemetry-EMFRVRQi.js

@@ -0,0 +1,351 @@
+import { c as findProjectRoot, t as MANIFEST_FILENAME } from "./project-Wp2zoyeN.js";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import crypto from "crypto";
+import { fileURLToPath } from "url";
+import { parseEnvBoolean } from "@rebasepro/types";
+function configPath() {
+	return path.join(os.homedir(), ".rebase", "telemetry.json");
+}
+function readConfig() {
+	try {
+		const raw = JSON.parse(fs.readFileSync(configPath(), "utf-8"));
+		if (raw && typeof raw === "object") return {
+			version: typeof raw.version === "number" ? raw.version : 1,
+			enabled: typeof raw.enabled === "boolean" ? raw.enabled : void 0,
+			machineId: typeof raw.machineId === "string" ? raw.machineId : void 0,
+			decidedAt: typeof raw.decidedAt === "string" ? raw.decidedAt : void 0
+		};
+	} catch {}
+	return { version: 1 };
+}
+function writeConfig(config) {
+	const file = configPath();
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, JSON.stringify({
+		...config,
+		version: 1
+	}, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+}
+/**
+* The machine's id, generating and persisting one on first use.
+*
+* Only called once consent exists — an id written before the user agreed would
+* be a record we had no right to create, even unsent.
+*/
+function ensureMachineId() {
+	const config = readConfig();
+	if (config.machineId) return config.machineId;
+	const machineId = crypto.randomUUID();
+	writeConfig({
+		...config,
+		machineId
+	});
+	return machineId;
+}
+/** Where a checkout keeps its id, under the project's gitignored `.rebase/`. */
+var PROJECT_ID_FILE = "telemetry-project.json";
+/**
+* The checkout's id, generating one if this project has none.
+*
+* The directory is created when it is missing, but **only** where a
+* `rebase.json` proves this really is a project root. An earlier version
+* required `.rebase/` to already exist, on the assumption that `rebase init`
+* created it — it does not. It is written only when a scaffold is linked to
+* Rebase Cloud, so every self-hosted project reported no `projectId` at all,
+* for ever. That silently broke the funnel this id exists for, on exactly the
+* population the telemetry is meant to learn about.
+*
+* The `rebase.json` check is what keeps the fix from being "scatter `.rebase/`
+* wherever a command happens to run": no manifest, no project, no directory,
+* and the event simply reports no project.
+*
+* A file of its own, written by nothing else. The id used to be a key in
+* `.rebase/state.json`, which is the dev server's runtime file: rewritten
+* from scratch on every start and deleted on every shutdown. So every
+* restart of `rebase dev` minted a new id, and one checkout read as a new
+* project each time — the error this split exists to prevent, by another way.
+*/
+function ensureProjectId(projectRoot) {
+	if (!fs.existsSync(path.join(projectRoot, "rebase.json"))) return void 0;
+	const dir = path.join(projectRoot, ".rebase");
+	try {
+		fs.mkdirSync(dir, { recursive: true });
+	} catch {
+		return;
+	}
+	const file = path.join(dir, PROJECT_ID_FILE);
+	if (fs.existsSync(file)) return readProjectId(file);
+	const projectId = crypto.randomUUID();
+	try {
+		fs.writeFileSync(file, `${JSON.stringify({ projectId }, null, 2)}\n`, {
+			encoding: "utf-8",
+			flag: "wx",
+			mode: 384
+		});
+	} catch {
+		return fs.existsSync(file) ? readProjectId(file) : void 0;
+	}
+	return projectId;
+}
+/**
+* The id a checkout's file holds. A file that does not parse is not ours to
+* repair — overwriting it would quietly start a second id for the same
+* checkout — so the event reports no project instead.
+*/
+function readProjectId(file) {
+	try {
+		const raw = JSON.parse(fs.readFileSync(file, "utf-8"));
+		if (raw && typeof raw === "object" && typeof raw.projectId === "string") return raw.projectId;
+	} catch {}
+}
+/** Duration in coarse bands — enough to see "slow", not enough to fingerprint. */
+function durationBucket(ms) {
+	if (!Number.isFinite(ms) || ms < 0) return "unknown";
+	if (ms < 5e3) return "<5s";
+	if (ms < 3e4) return "5-30s";
+	if (ms < 12e4) return "30-120s";
+	return "120s+";
+}
+/**
+* An error reduced to something safe to transmit.
+*
+* The message and the stack are discarded, always. What survives is the
+* constructor name and, for the errors that carry one, a `code` — both of which
+* come from the program rather than from anything the user typed or named.
+* `EACCES` is useful and safe; "cannot write /Users/francesco/clients/acme" is
+* neither.
+*/
+function errorClass(error) {
+	if (error && typeof error === "object") {
+		const code = error.code;
+		if (typeof code === "string" && /^[A-Z][A-Z0-9_]{1,31}$/.test(code)) return code;
+		const name = error.name;
+		if (typeof name === "string" && /^[A-Za-z][A-Za-z0-9]{0,31}$/.test(name)) return name;
+	}
+	return "Unknown";
+}
+/**
+* Drop anything that is not a permitted value type, and clamp strings.
+*
+* The last line of defence rather than the first. Every call site is supposed
+* to pass enumerated values; this is what stops a future one that forgets from
+* turning into an incident. Strings are capped at 64 characters because no
+* legitimate enumerated value is longer, and a path or a message always is.
+*/
+/**
+* Key names that shadow an `Object.prototype` member.
+*
+* `__proto__` is already excluded by the pattern (it starts with an
+* underscore), and assigning any of these to an object literal shadows rather
+* than pollutes — so nothing is exploitable here. They are refused because a
+* stored property called `constructor` is a trap for every consumer downstream
+* that reaches for `properties.constructor` and gets a string.
+*/
+var RESERVED_KEYS = /* @__PURE__ */ new Set([
+	"constructor",
+	"prototype",
+	"hasownproperty",
+	"tostring",
+	"valueof"
+]);
+function sanitize(properties) {
+	const out = {};
+	for (const [key, value] of Object.entries(properties)) {
+		if (!/^[a-z][a-z0-9_]{0,31}$/.test(key) || RESERVED_KEYS.has(key.toLowerCase())) continue;
+		if (typeof value === "boolean" || typeof value === "number" && Number.isFinite(value)) out[key] = value;
+		else if (typeof value === "string" && value.length > 0 && value.length <= 64) {
+			if (!/[/\\@:\s]/.test(value)) out[key] = value;
+		}
+	}
+	return out;
+}
+/**
+* The CLI's own version, read by walking up to this package's manifest.
+*
+* The obvious `require("../../package.json")` was wrong everywhere, not only on
+* one install path: `vite build` bundles this module into `dist/index.es.js`, so
+* the specifier resolves relative to `<pkg>/dist/` and lands on
+* `<parent-of-pkg>/package.json` — a file that does not exist under npm, pnpm or
+* the monorepo. Every event ever sent carried `cliVersion: "unknown"`, which is
+* the one field that makes the rest of a payload interpretable.
+*
+* So walk up and check the manifest's `name` rather than counting directory
+* levels: the count differs between `src/telemetry/` and the bundled `dist/`,
+* and a wrong count fails silently by finding *some* package.json — the nearest
+* dependency's, under a hoisted layout. Matching the name cannot do that.
+*/
+function cliVersion() {
+	try {
+		let dir = path.dirname(fileURLToPath(import.meta.url));
+		const root = path.parse(dir).root;
+		while (dir && dir !== root) {
+			const manifest = path.join(dir, "package.json");
+			if (fs.existsSync(manifest)) {
+				const pkg = JSON.parse(fs.readFileSync(manifest, "utf-8"));
+				if (pkg?.name === "@rebasepro/cli" && typeof pkg.version === "string" && pkg.version) return pkg.version;
+			}
+			dir = path.dirname(dir);
+		}
+	} catch {}
+	return "unknown";
+}
+function buildEvent(event, properties, identity) {
+	return {
+		schema: 1,
+		event,
+		machineId: identity.machineId,
+		projectId: identity.projectId,
+		cliVersion: cliVersion(),
+		nodeMajor: Number(process.versions.node.split(".")[0]) || 0,
+		platform: os.platform(),
+		arch: os.arch(),
+		at: (/* @__PURE__ */ new Date()).toISOString().replace(/\.\d{3}Z$/, "Z"),
+		properties: sanitize(properties)
+	};
+}
+//#endregion
+//#region src/telemetry/project.ts
+function readProjectPolicy(startDir = process.cwd()) {
+	try {
+		const root = findProjectRoot(startDir);
+		if (!root) return "unset";
+		const file = path.join(root, MANIFEST_FILENAME);
+		if (!fs.existsSync(file)) return "unset";
+		const raw = fs.readFileSync(file, "utf-8");
+		const match = /"telemetry"\s*:\s*(true|false)/.exec(raw);
+		if (!match) return "unset";
+		return match[1] === "false" ? "opt_out" : "ignored_opt_in";
+	} catch {
+		return "unset";
+	}
+}
+function endpoint() {
+	return process.env.REBASE_TELEMETRY_ENDPOINT?.trim() || "https://app.rebase.pro/api/functions/telemetry";
+}
+/**
+* Set to anything but a spelled no.
+*
+* The conventions behind these variables make presence the signal —
+* `CI=woodpecker` is a CI run, `DO_NOT_TRACK=please` is an answer — so a value
+* the parser does not recognise still counts, and the refusal holds. Only the
+* platform's spellings of no turn one off. It was `!== "0"` for two of them and
+* `!== "false"` for `CI`, so `CI=0` read as a runner.
+*/
+function setAndNotNo(value) {
+	return value !== void 0 && value.trim() !== "" && parseEnvBoolean(value) !== false;
+}
+/**
+* The one function that decides whether anything leaves the machine.
+*
+* Every path is a refusal except the last, which is the point: consent is
+* opt-in, so the default answer at every branch — never asked, unreadable
+* config, a set env var, a CI runner — is no.
+*
+* `DO_NOT_TRACK` is honoured because it is the cross-tool convention
+* (consoledonottrack.com); a user who has set it globally has already answered
+* this question and should not be asked again by us.
+*
+* `CI` is refused for a different reason: a build runner is not a person, and
+* counting one is both useless and misleading. A single pipeline re-running on
+* every push would otherwise outweigh every real developer in the data.
+*
+* A project's own `"telemetry": false` is checked *before* the machine setting,
+* because it has to beat an individual opt-in to be worth anything — see
+* project.ts on why the reverse is refused.
+*/
+function suppressionReason(env = process.env, cwd = process.cwd()) {
+	if (setAndNotNo(env.DO_NOT_TRACK)) return "do_not_track";
+	if (setAndNotNo(env.REBASE_TELEMETRY_DISABLED)) return "rebase_telemetry_disabled";
+	if (setAndNotNo(env.CI)) return "ci";
+	if (readProjectPolicy(cwd) === "opt_out") return "project_opt_out";
+	const config = readConfig();
+	if (config.enabled === void 0) return "not_asked";
+	if (!config.enabled) return "declined";
+	return null;
+}
+function isEnabled(env = process.env, cwd = process.cwd()) {
+	return suppressionReason(env, cwd) === null;
+}
+/**
+* Record the user's answer. `false` is final — nothing prompts again.
+*
+* Returns whether the choice could actually be persisted. A read-only or full
+* home directory makes `writeConfig` throw, and the direction of that failure
+* matters enormously: someone turning sharing **off** who sees a stack trace,
+* or worse sees nothing, is left sharing. The caller is expected to say so and
+* point at `REBASE_TELEMETRY_DISABLED`, which needs no disk.
+*/
+function setConsent(enabled) {
+	const config = readConfig();
+	try {
+		writeConfig({
+			...config,
+			enabled,
+			decidedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			machineId: enabled ? config.machineId ?? void 0 : void 0
+		});
+		if (enabled) ensureMachineId();
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Build the event that *would* be sent, without sending it.
+*
+* This is what `rebase telemetry show` prints, and it is deliberately the same
+* function the sender uses — a preview assembled by separate code is a promise
+* that drifts. Returns `null` when nothing would be sent, so the command can
+* say why instead of showing a payload that is never going anywhere.
+*/
+function previewEvent(event, properties = {}, projectRoot) {
+	const config = readConfig();
+	if (!config.machineId) return null;
+	return buildEvent(event, properties, {
+		machineId: config.machineId,
+		projectId: projectRoot ? ensureProjectId(projectRoot) : void 0
+	});
+}
+/**
+* Send one event, or quietly do nothing.
+*
+* Three properties this must hold, in order of importance:
+*
+*  1. **It never throws.** Telemetry failing is not a reason for `rebase dev`
+*     to fail. Every error is swallowed.
+*  2. **It never blocks meaningfully.** A two-second ceiling, after which the
+*     command carries on regardless — a collector having a bad day must not
+*     become the CLI hanging.
+*  3. **It never sends without consent.** Enforced here rather than at the call
+*     sites, so a new call site cannot get it wrong.
+*/
+async function recordEvent(event, properties = {}, options = {}) {
+	try {
+		if (!isEnabled(process.env, options.projectRoot ?? process.cwd())) return;
+		const payload = buildEvent(event, properties, {
+			machineId: ensureMachineId(),
+			projectId: options.projectRoot ? ensureProjectId(options.projectRoot) : void 0
+		});
+		const abort = new AbortController();
+		const timer = setTimeout(() => abort.abort(), options.timeoutMs ?? 2e3);
+		try {
+			await fetch(endpoint(), {
+				method: "POST",
+				headers: { "Content-Type": "application/json" },
+				body: JSON.stringify(payload),
+				signal: abort.signal
+			});
+		} finally {
+			clearTimeout(timer);
+		}
+	} catch {}
+}
+//#endregion
+export { setConsent as a, buildEvent as c, configPath as d, readConfig as f, recordEvent as i, durationBucket as l, isEnabled as n, suppressionReason as o, previewEvent as r, readProjectPolicy as s, endpoint as t, errorClass as u };
+
+//# sourceMappingURL=telemetry-EMFRVRQi.js.map

package/dist/telemetry-EMFRVRQi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"telemetry-EMFRVRQi.js","names":[],"sources":["../src/telemetry/identity.ts","../src/telemetry/payload.ts","../src/telemetry/project.ts","../src/telemetry/index.ts"],"sourcesContent":["import fs from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\nimport crypto from \"crypto\";\n\n/**\n * Who is reporting, and where that is remembered.\n *\n * Two identifiers, because they answer two different questions and conflating\n * them would make the answers wrong:\n *\n *  - `machineId` — one developer's machine. Lives beside the cloud credentials\n *    in `~/.rebase/`, so it survives across every project they scaffold.\n *  - `projectId` — one *checkout*. Lives in the project's gitignored\n *    `.rebase/`, in a file of its own, `telemetry-project.json`, so it lasts\n *    as long as the checkout does.\n *\n * Without the split, a developer trying five templates in an afternoon reads as\n * five installations. With it, that is one machine and five projects, which is\n * the shape the funnel actually needs.\n *\n * ## Why `projectId` is not committed\n *\n * `rebase.json` is checked in, and a stable identifier sitting in a public\n * repository is a correlation handle for anyone who finds it — it ties a named\n * organisation to whatever that id did. `.rebase/` is gitignored, so the id\n * stays on the machine that generated it. It also makes the unit honest: what\n * is being counted is a developer working on a project, not the project.\n *\n * ## Why both are random\n *\n * Neither is derived from a hostname, a database name, an email or a machine\n * fingerprint. Hashing any of those only *looks* anonymous — the space of real\n * hostnames is small enough to brute-force a salted hash back to the original\n * in minutes. A random UUID carries no information at all and does the same job.\n */\n\n/** Bumped when the stored shape changes in a way old CLIs cannot read. */\nexport const TELEMETRY_CONFIG_VERSION = 1;\n\nexport type TelemetryConfig = {\n    version: number;\n    /**\n     * `undefined` means never asked — which is *not* the same as declining, and\n     * is the only state in which anything may prompt.\n     */\n    enabled?: boolean;\n    machineId?: string;\n    /** When the choice was made, so a later release can tell stale consent from fresh. */\n    decidedAt?: string;\n};\n\nexport function configPath(): string {\n    return path.join(os.homedir(), \".rebase\", \"telemetry.json\");\n}\n\nexport function readConfig(): TelemetryConfig {\n    try {\n        const raw = JSON.parse(fs.readFileSync(configPath(), \"utf-8\"));\n        if (raw && typeof raw === \"object\") {\n            return {\n                version: typeof raw.version === \"number\" ? raw.version : TELEMETRY_CONFIG_VERSION,\n                enabled: typeof raw.enabled === \"boolean\" ? raw.enabled : undefined,\n                machineId: typeof raw.machineId === \"string\" ? raw.machineId : undefined,\n                decidedAt: typeof raw.decidedAt === \"string\" ? raw.decidedAt : undefined\n            };\n        }\n    } catch {\n        // Missing, unreadable or corrupt all mean the same thing: we have no\n        // record of a decision, so nothing may be sent.\n    }\n    return { version: TELEMETRY_CONFIG_VERSION };\n}\n\nexport function writeConfig(config: TelemetryConfig): void {\n    const file = configPath();\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    // 0600: it sits beside `credentials.json`, and a world-readable identifier\n    // on a shared machine is a way to link one developer's activity to another's.\n    fs.writeFileSync(file, JSON.stringify({ ...config,\nversion: TELEMETRY_CONFIG_VERSION }, null, 2), {\n        encoding: \"utf-8\",\n        mode: 0o600\n    });\n}\n\n/**\n * The machine's id, generating and persisting one on first use.\n *\n * Only called once consent exists — an id written before the user agreed would\n * be a record we had no right to create, even unsent.\n */\nexport function ensureMachineId(): string {\n    const config = readConfig();\n    if (config.machineId) return config.machineId;\n    const machineId = crypto.randomUUID();\n    writeConfig({ ...config,\nmachineId });\n    return machineId;\n}\n\n/** Where a checkout keeps its id, under the project's gitignored `.rebase/`. */\nexport const PROJECT_ID_FILE = \"telemetry-project.json\";\n\n/**\n * The checkout's id, generating one if this project has none.\n *\n * The directory is created when it is missing, but **only** where a\n * `rebase.json` proves this really is a project root. An earlier version\n * required `.rebase/` to already exist, on the assumption that `rebase init`\n * created it — it does not. It is written only when a scaffold is linked to\n * Rebase Cloud, so every self-hosted project reported no `projectId` at all,\n * for ever. That silently broke the funnel this id exists for, on exactly the\n * population the telemetry is meant to learn about.\n *\n * The `rebase.json` check is what keeps the fix from being \"scatter `.rebase/`\n * wherever a command happens to run\": no manifest, no project, no directory,\n * and the event simply reports no project.\n *\n * A file of its own, written by nothing else. The id used to be a key in\n * `.rebase/state.json`, which is the dev server's runtime file: rewritten\n * from scratch on every start and deleted on every shutdown. So every\n * restart of `rebase dev` minted a new id, and one checkout read as a new\n * project each time — the error this split exists to prevent, by another way.\n */\nexport function ensureProjectId(projectRoot: string): string | undefined {\n    if (!fs.existsSync(path.join(projectRoot, \"rebase.json\"))) return undefined;\n\n    const dir = path.join(projectRoot, \".rebase\");\n    try {\n        fs.mkdirSync(dir, { recursive: true });\n    } catch {\n        return undefined;\n    }\n\n    const file = path.join(dir, PROJECT_ID_FILE);\n    if (fs.existsSync(file)) return readProjectId(file);\n\n    const projectId = crypto.randomUUID();\n    try {\n        // `wx`: of two commands minting the first id at once, one writes and\n        // the other reads what it wrote.\n        fs.writeFileSync(file, `${JSON.stringify({ projectId }, null, 2)}\\n`, { encoding: \"utf-8\", flag: \"wx\", mode: 0o600 });\n    } catch {\n        return fs.existsSync(file) ? readProjectId(file) : undefined;\n    }\n    return projectId;\n}\n\n/**\n * The id a checkout's file holds. A file that does not parse is not ours to\n * repair — overwriting it would quietly start a second id for the same\n * checkout — so the event reports no project instead.\n */\nfunction readProjectId(file: string): string | undefined {\n    try {\n        const raw = JSON.parse(fs.readFileSync(file, \"utf-8\"));\n        if (raw && typeof raw === \"object\" && typeof raw.projectId === \"string\") return raw.projectId;\n    } catch {\n        // Unreadable or corrupt: see above.\n    }\n    return undefined;\n}\n","import os from \"os\";\nimport fs from \"fs\";\nimport path from \"path\";\nimport { fileURLToPath } from \"url\";\n\n/**\n * Every field that may ever leave the machine, and nothing else.\n *\n * ## The rule this file exists to enforce\n *\n * **No value here may be free text.** Every property is either a number, a\n * boolean, or a string drawn from a set enumerated in this file. That is not\n * fussiness — free text is the mechanism by which telemetry leaks. An error\n * message carries `/Users/francesco/rebase/...`, which is a real person's name.\n * A collection name carries a customer's product vocabulary. A database URL\n * carries a password. None of those are things anyone intends to send; they\n * arrive by being interpolated into a string that a well-meaning field was\n * happy to accept.\n *\n * So the payload is closed by construction. Adding a field means adding it\n * here, where the review question — \"can this ever contain something the user\n * typed?\" — is unavoidable.\n *\n * ## What is deliberately absent\n *\n * Project names, directory paths, collection or table names, hostnames,\n * database URLs, error messages, stack traces, email addresses, exact row or\n * user counts. Anything that would let a payload be traced to an organisation\n * rather than to an anonymous id.\n */\n\n/**\n * Bumped whenever a field is added, removed or changes meaning.\n *\n * Sent with every event so the receiving end can reject or migrate old shapes,\n * and so `rebase telemetry show` can state which contract the user agreed to.\n */\nexport const TELEMETRY_SCHEMA_VERSION = 1;\n\n/** The events the CLI reports. Closed set — a name not listed cannot be sent. */\nexport type TelemetryEventName =\n    | \"cli.init\"\n    | \"cli.dev\"\n    | \"cli.deploy\"\n    // Named for the command group, not for one of its subcommands. These were\n    // `cli.schema_generate` and `cli.db_push` and were sent for *every*\n    // subcommand of their group — so `rebase db restore` was recorded as a\n    // push, and anything counting pushes counted every database command. The\n    // subcommand travels as a property, where it can be read.\n    | \"cli.schema\"\n    | \"cli.db\"\n    | \"cli.error\";\n\n/** A single non-free-text value. */\nexport type TelemetryValue = string | number | boolean;\n\nexport type TelemetryEvent = {\n    schema: number;\n    event: TelemetryEventName;\n    /** Random per machine — see identity.ts on why it is not derived. */\n    machineId: string;\n    /** Random per checkout. Absent when the command ran outside a project. */\n    projectId?: string;\n    /** The CLI's own version, so old releases can be told apart. */\n    cliVersion: string;\n    /** Coarse platform facts, for the support matrix. */\n    nodeMajor: number;\n    platform: NodeJS.Platform;\n    arch: string;\n    /** UTC, second precision. Not a device clock reading anyone can fingerprint. */\n    at: string;\n    properties: Record<string, TelemetryValue>;\n};\n\n/**\n * Buckets rather than exact counts.\n *\n * An exact figure is a surprisingly good fingerprint — \"this install has 37\n * collections\" narrows the field a great deal when combined with a version and\n * a driver. A bucket answers \"roughly how big\" without doing that.\n */\nexport function bucket(value: number): string {\n    if (!Number.isFinite(value) || value < 0) return \"unknown\";\n    if (value === 0) return \"0\";\n    if (value <= 5) return \"1-5\";\n    if (value <= 20) return \"6-20\";\n    if (value <= 50) return \"21-50\";\n    if (value <= 200) return \"51-200\";\n    return \"200+\";\n}\n\n/** Duration in coarse bands — enough to see \"slow\", not enough to fingerprint. */\nexport function durationBucket(ms: number): string {\n    if (!Number.isFinite(ms) || ms < 0) return \"unknown\";\n    if (ms < 5_000) return \"<5s\";\n    if (ms < 30_000) return \"5-30s\";\n    if (ms < 120_000) return \"30-120s\";\n    return \"120s+\";\n}\n\n/**\n * An error reduced to something safe to transmit.\n *\n * The message and the stack are discarded, always. What survives is the\n * constructor name and, for the errors that carry one, a `code` — both of which\n * come from the program rather than from anything the user typed or named.\n * `EACCES` is useful and safe; \"cannot write /Users/francesco/clients/acme\" is\n * neither.\n */\nexport function errorClass(error: unknown): string {\n    if (error && typeof error === \"object\") {\n        const code = (error as { code?: unknown }).code;\n        if (typeof code === \"string\" && /^[A-Z][A-Z0-9_]{1,31}$/.test(code)) return code;\n        const name = (error as { name?: unknown }).name;\n        if (typeof name === \"string\" && /^[A-Za-z][A-Za-z0-9]{0,31}$/.test(name)) return name;\n    }\n    return \"Unknown\";\n}\n\n/**\n * Drop anything that is not a permitted value type, and clamp strings.\n *\n * The last line of defence rather than the first. Every call site is supposed\n * to pass enumerated values; this is what stops a future one that forgets from\n * turning into an incident. Strings are capped at 64 characters because no\n * legitimate enumerated value is longer, and a path or a message always is.\n */\n/**\n * Key names that shadow an `Object.prototype` member.\n *\n * `__proto__` is already excluded by the pattern (it starts with an\n * underscore), and assigning any of these to an object literal shadows rather\n * than pollutes — so nothing is exploitable here. They are refused because a\n * stored property called `constructor` is a trap for every consumer downstream\n * that reaches for `properties.constructor` and gets a string.\n */\nconst RESERVED_KEYS = new Set([\"constructor\", \"prototype\", \"hasownproperty\", \"tostring\", \"valueof\"]);\n\nexport function sanitize(properties: Record<string, unknown>): Record<string, TelemetryValue> {\n    const out: Record<string, TelemetryValue> = {};\n    for (const [key, value] of Object.entries(properties)) {\n        if (!/^[a-z][a-z0-9_]{0,31}$/.test(key) || RESERVED_KEYS.has(key.toLowerCase())) continue;\n        if (typeof value === \"boolean\" || (typeof value === \"number\" && Number.isFinite(value))) {\n            out[key] = value;\n        } else if (typeof value === \"string\" && value.length > 0 && value.length <= 64) {\n            // Anything with a separator in it is a path, a URL or a sentence —\n            // never one of our enumerated tokens.\n            if (!/[/\\\\@:\\s]/.test(value)) out[key] = value;\n        }\n    }\n    return out;\n}\n\n/**\n * The CLI's own version, read by walking up to this package's manifest.\n *\n * The obvious `require(\"../../package.json\")` was wrong everywhere, not only on\n * one install path: `vite build` bundles this module into `dist/index.es.js`, so\n * the specifier resolves relative to `<pkg>/dist/` and lands on\n * `<parent-of-pkg>/package.json` — a file that does not exist under npm, pnpm or\n * the monorepo. Every event ever sent carried `cliVersion: \"unknown\"`, which is\n * the one field that makes the rest of a payload interpretable.\n *\n * So walk up and check the manifest's `name` rather than counting directory\n * levels: the count differs between `src/telemetry/` and the bundled `dist/`,\n * and a wrong count fails silently by finding *some* package.json — the nearest\n * dependency's, under a hoisted layout. Matching the name cannot do that.\n */\nfunction cliVersion(): string {\n    try {\n        let dir = path.dirname(fileURLToPath(import.meta.url));\n        const root = path.parse(dir).root;\n        while (dir && dir !== root) {\n            const manifest = path.join(dir, \"package.json\");\n            if (fs.existsSync(manifest)) {\n                const pkg = JSON.parse(fs.readFileSync(manifest, \"utf-8\"));\n                if (pkg?.name === \"@rebasepro/cli\" && typeof pkg.version === \"string\" && pkg.version) {\n                    return pkg.version;\n                }\n            }\n            dir = path.dirname(dir);\n        }\n    } catch {\n        // Fall through — a version we cannot read is reported as such.\n    }\n    return \"unknown\";\n}\n\nexport function buildEvent(\n    event: TelemetryEventName,\n    properties: Record<string, unknown>,\n    identity: { machineId: string; projectId?: string }\n): TelemetryEvent {\n    return {\n        schema: TELEMETRY_SCHEMA_VERSION,\n        event,\n        machineId: identity.machineId,\n        projectId: identity.projectId,\n        cliVersion: cliVersion(),\n        nodeMajor: Number(process.versions.node.split(\".\")[0]) || 0,\n        platform: os.platform(),\n        arch: os.arch(),\n        at: new Date().toISOString().replace(/\\.\\d{3}Z$/, \"Z\"),\n        properties: sanitize(properties)\n    };\n}\n","import fs from \"fs\";\nimport path from \"path\";\n\nimport { findProjectRoot, MANIFEST_FILENAME } from \"../utils/project\";\n\n/**\n * A repository's own policy on usage sharing.\n *\n * ## Why this is deliberately one-directional\n *\n * `rebase.json` is committed, so whatever it says applies to everyone who\n * clones the repository — including people who have never seen our prompt. That\n * makes it the right place for exactly one of the two answers:\n *\n *  - **`false` is honoured**, and beats an individual's opt-in. An organisation\n *    restricting its own repository is setting policy for work done on its\n *    behalf, which is theirs to set. It is the same shape as a committed\n *    `.npmrc`.\n *  - **`true` is ignored**, and says so. It would be one developer answering a\n *    privacy question for every colleague who later clones the repo — consent\n *    by proxy, which is the precise thing opt-in exists to prevent.\n *\n * The asymmetry is the whole feature. A symmetric flag would be a worse version\n * of the machine-level setting, and a quietly-obeyed `true` would be a way to\n * enrol people without asking them.\n *\n * Read straight from the file rather than through `parseManifest`, for two\n * reasons: the parser builds a typed object and drops keys it does not model,\n * and a manifest too malformed to parse must still be able to switch telemetry\n * off. A repository that says no should be obeyed even when it is broken.\n */\nexport type ProjectTelemetryPolicy =\n    /** `\"telemetry\": false` — suppress, regardless of the machine setting. */\n    | \"opt_out\"\n    /** `\"telemetry\": true` — refused; the machine setting still decides. */\n    | \"ignored_opt_in\"\n    /** No manifest, no key, or an unreadable one. */\n    | \"unset\";\n\nexport function readProjectPolicy(startDir: string = process.cwd()): ProjectTelemetryPolicy {\n    try {\n        const root = findProjectRoot(startDir);\n        if (!root) return \"unset\";\n\n        const file = path.join(root, MANIFEST_FILENAME);\n        if (!fs.existsSync(file)) return \"unset\";\n\n        // A regex rather than JSON.parse: a manifest with a trailing comma or a\n        // half-finished edit still parses badly but reads clearly, and \"your\n        // JSON is malformed\" is not a reason to start sending data the file\n        // plainly asks us not to send.\n        const raw = fs.readFileSync(file, \"utf-8\");\n        const match = /\"telemetry\"\\s*:\\s*(true|false)/.exec(raw);\n        if (!match) return \"unset\";\n        return match[1] === \"false\" ? \"opt_out\" : \"ignored_opt_in\";\n    } catch {\n        return \"unset\";\n    }\n}\n","import { ensureMachineId, ensureProjectId, readConfig, writeConfig } from \"./identity\";\nimport { buildEvent, TelemetryEvent, TelemetryEventName } from \"./payload\";\nimport { readProjectPolicy } from \"./project\";\nimport { parseEnvBoolean } from \"@rebasepro/types\";\n\nexport { TELEMETRY_SCHEMA_VERSION, bucket, durationBucket, errorClass, buildEvent, sanitize } from \"./payload\";\nexport type { TelemetryEvent, TelemetryEventName, TelemetryValue } from \"./payload\";\nexport { configPath, readConfig, writeConfig } from \"./identity\";\nexport type { TelemetryConfig } from \"./identity\";\nexport { readProjectPolicy } from \"./project\";\nexport type { ProjectTelemetryPolicy } from \"./project\";\n\n/**\n * Where events go. Overridable so a fork can point at its own collector, and so\n * the tests never touch the network.\n */\nexport const DEFAULT_TELEMETRY_ENDPOINT = \"https://app.rebase.pro/api/functions/telemetry\";\n\nexport function endpoint(): string {\n    return process.env.REBASE_TELEMETRY_ENDPOINT?.trim() || DEFAULT_TELEMETRY_ENDPOINT;\n}\n\n/**\n * Set to anything but a spelled no.\n *\n * The conventions behind these variables make presence the signal —\n * `CI=woodpecker` is a CI run, `DO_NOT_TRACK=please` is an answer — so a value\n * the parser does not recognise still counts, and the refusal holds. Only the\n * platform's spellings of no turn one off. It was `!== \"0\"` for two of them and\n * `!== \"false\"` for `CI`, so `CI=0` read as a runner.\n */\nfunction setAndNotNo(value: string | undefined): boolean {\n    return value !== undefined && value.trim() !== \"\" && parseEnvBoolean(value) !== false;\n}\n\n/** Why nothing would be sent right now, or `null` when it would. */\nexport type SuppressionReason =\n    | \"not_asked\"\n    | \"declined\"\n    | \"do_not_track\"\n    | \"rebase_telemetry_disabled\"\n    | \"ci\"\n    | \"project_opt_out\";\n\n/**\n * The one function that decides whether anything leaves the machine.\n *\n * Every path is a refusal except the last, which is the point: consent is\n * opt-in, so the default answer at every branch — never asked, unreadable\n * config, a set env var, a CI runner — is no.\n *\n * `DO_NOT_TRACK` is honoured because it is the cross-tool convention\n * (consoledonottrack.com); a user who has set it globally has already answered\n * this question and should not be asked again by us.\n *\n * `CI` is refused for a different reason: a build runner is not a person, and\n * counting one is both useless and misleading. A single pipeline re-running on\n * every push would otherwise outweigh every real developer in the data.\n *\n * A project's own `\"telemetry\": false` is checked *before* the machine setting,\n * because it has to beat an individual opt-in to be worth anything — see\n * project.ts on why the reverse is refused.\n */\nexport function suppressionReason(\n    env: NodeJS.ProcessEnv = process.env,\n    cwd: string = process.cwd()\n): SuppressionReason | null {\n    if (setAndNotNo(env.DO_NOT_TRACK)) return \"do_not_track\";\n    if (setAndNotNo(env.REBASE_TELEMETRY_DISABLED)) return \"rebase_telemetry_disabled\";\n    if (setAndNotNo(env.CI)) return \"ci\";\n    if (readProjectPolicy(cwd) === \"opt_out\") return \"project_opt_out\";\n\n    const config = readConfig();\n    if (config.enabled === undefined) return \"not_asked\";\n    if (!config.enabled) return \"declined\";\n    return null;\n}\n\nexport function isEnabled(env: NodeJS.ProcessEnv = process.env, cwd: string = process.cwd()): boolean {\n    return suppressionReason(env, cwd) === null;\n}\n\n/**\n * Record the user's answer. `false` is final — nothing prompts again.\n *\n * Returns whether the choice could actually be persisted. A read-only or full\n * home directory makes `writeConfig` throw, and the direction of that failure\n * matters enormously: someone turning sharing **off** who sees a stack trace,\n * or worse sees nothing, is left sharing. The caller is expected to say so and\n * point at `REBASE_TELEMETRY_DISABLED`, which needs no disk.\n */\nexport function setConsent(enabled: boolean): boolean {\n    const config = readConfig();\n    try {\n        writeConfig({\n            ...config,\n            enabled,\n            decidedAt: new Date().toISOString(),\n            // An id is minted only on acceptance. Generating one at decline\n            // time would create the very record the user just refused.\n            machineId: enabled ? (config.machineId ?? undefined) : undefined\n        });\n        if (enabled) ensureMachineId();\n        return true;\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Build the event that *would* be sent, without sending it.\n *\n * This is what `rebase telemetry show` prints, and it is deliberately the same\n * function the sender uses — a preview assembled by separate code is a promise\n * that drifts. Returns `null` when nothing would be sent, so the command can\n * say why instead of showing a payload that is never going anywhere.\n */\nexport function previewEvent(\n    event: TelemetryEventName,\n    properties: Record<string, unknown> = {},\n    projectRoot?: string\n): TelemetryEvent | null {\n    const config = readConfig();\n    if (!config.machineId) return null;\n    return buildEvent(event, properties, {\n        machineId: config.machineId,\n        projectId: projectRoot ? ensureProjectId(projectRoot) : undefined\n    });\n}\n\n/**\n * Send one event, or quietly do nothing.\n *\n * Three properties this must hold, in order of importance:\n *\n *  1. **It never throws.** Telemetry failing is not a reason for `rebase dev`\n *     to fail. Every error is swallowed.\n *  2. **It never blocks meaningfully.** A two-second ceiling, after which the\n *     command carries on regardless — a collector having a bad day must not\n *     become the CLI hanging.\n *  3. **It never sends without consent.** Enforced here rather than at the call\n *     sites, so a new call site cannot get it wrong.\n */\nexport async function recordEvent(\n    event: TelemetryEventName,\n    properties: Record<string, unknown> = {},\n    options: { projectRoot?: string; timeoutMs?: number } = {}\n): Promise<void> {\n    try {\n        // The project's own policy is read relative to the project being acted\n        // on, not the shell's cwd — `rebase dev` run from a subdirectory must\n        // still see its own repository's opt-out.\n        if (!isEnabled(process.env, options.projectRoot ?? process.cwd())) return;\n\n        const machineId = ensureMachineId();\n        const projectId = options.projectRoot ? ensureProjectId(options.projectRoot) : undefined;\n        const payload = buildEvent(event, properties, { machineId,\nprojectId });\n\n        const abort = new AbortController();\n        const timer = setTimeout(() => abort.abort(), options.timeoutMs ?? 2000);\n        try {\n            await fetch(endpoint(), {\n                method: \"POST\",\n                headers: { \"Content-Type\": \"application/json\" },\n                body: JSON.stringify(payload),\n                signal: abort.signal\n            });\n        } finally {\n            clearTimeout(timer);\n        }\n    } catch {\n        // Deliberately silent. A warning here would be worse than useless: it\n        // draws attention to a subsystem the user opted into and cannot act on,\n        // in the middle of output they were actually reading.\n    }\n}\n"],"mappings":";;;;;;;AAoDA,SAAgB,aAAqB;CACjC,OAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,gBAAgB;AAC9D;AAEA,SAAgB,aAA8B;CAC1C,IAAI;EACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,WAAW,GAAG,OAAO,CAAC;EAC7D,IAAI,OAAO,OAAO,QAAQ,UACtB,OAAO;GACH,SAAS,OAAO,IAAI,YAAY,WAAW,IAAI,UAAA;GAC/C,SAAS,OAAO,IAAI,YAAY,YAAY,IAAI,UAAU,KAAA;GAC1D,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY,KAAA;GAC/D,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY,KAAA;EACnE;CAER,QAAQ,CAGR;CACA,OAAO,EAAE,SAAA,EAAkC;AAC/C;AAEA,SAAgB,YAAY,QAA+B;CACvD,MAAM,OAAO,WAAW;CACxB,GAAG,UAAU,KAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAGpD,GAAG,cAAc,MAAM,KAAK,UAAU;EAAE,GAAG;EAC/C,SAAA;CAAkC,GAAG,MAAM,CAAC,GAAG;EACvC,UAAU;EACV,MAAM;CACV,CAAC;AACL;;;;;;;AAQA,SAAgB,kBAA0B;CACtC,MAAM,SAAS,WAAW;CAC1B,IAAI,OAAO,WAAW,OAAO,OAAO;CACpC,MAAM,YAAY,OAAO,WAAW;CACpC,YAAY;EAAE,GAAG;EACrB;CAAU,CAAC;CACP,OAAO;AACX;;AAGA,IAAa,kBAAkB;;;;;;;;;;;;;;;;;;;;;;AAuB/B,SAAgB,gBAAgB,aAAyC;CACrE,IAAI,CAAC,GAAG,WAAW,KAAK,KAAK,aAAa,aAAa,CAAC,GAAG,OAAO,KAAA;CAElE,MAAM,MAAM,KAAK,KAAK,aAAa,SAAS;CAC5C,IAAI;EACA,GAAG,UAAU,KAAK,EAAE,WAAW,KAAK,CAAC;CACzC,QAAQ;EACJ;CACJ;CAEA,MAAM,OAAO,KAAK,KAAK,KAAK,eAAe;CAC3C,IAAI,GAAG,WAAW,IAAI,GAAG,OAAO,cAAc,IAAI;CAElD,MAAM,YAAY,OAAO,WAAW;CACpC,IAAI;EAGA,GAAG,cAAc,MAAM,GAAG,KAAK,UAAU,EAAE,UAAU,GAAG,MAAM,CAAC,EAAE,KAAK;GAAE,UAAU;GAAS,MAAM;GAAM,MAAM;EAAM,CAAC;CACxH,QAAQ;EACJ,OAAO,GAAG,WAAW,IAAI,IAAI,cAAc,IAAI,IAAI,KAAA;CACvD;CACA,OAAO;AACX;;;;;;AAOA,SAAS,cAAc,MAAkC;CACrD,IAAI;EACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,MAAM,OAAO,CAAC;EACrD,IAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,IAAI,cAAc,UAAU,OAAO,IAAI;CACxF,QAAQ,CAER;AAEJ;;ACtEA,SAAgB,eAAe,IAAoB;CAC/C,IAAI,CAAC,OAAO,SAAS,EAAE,KAAK,KAAK,GAAG,OAAO;CAC3C,IAAI,KAAK,KAAO,OAAO;CACvB,IAAI,KAAK,KAAQ,OAAO;CACxB,IAAI,KAAK,MAAS,OAAO;CACzB,OAAO;AACX;;;;;;;;;;AAWA,SAAgB,WAAW,OAAwB;CAC/C,IAAI,SAAS,OAAO,UAAU,UAAU;EACpC,MAAM,OAAQ,MAA6B;EAC3C,IAAI,OAAO,SAAS,YAAY,yBAAyB,KAAK,IAAI,GAAG,OAAO;EAC5E,MAAM,OAAQ,MAA6B;EAC3C,IAAI,OAAO,SAAS,YAAY,8BAA8B,KAAK,IAAI,GAAG,OAAO;CACrF;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;AAmBA,IAAM,gCAAgB,IAAI,IAAI;CAAC;CAAe;CAAa;CAAkB;CAAY;AAAS,CAAC;AAEnG,SAAgB,SAAS,YAAqE;CAC1F,MAAM,MAAsC,CAAC;CAC7C,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,UAAU,GAAG;EACnD,IAAI,CAAC,yBAAyB,KAAK,GAAG,KAAK,cAAc,IAAI,IAAI,YAAY,CAAC,GAAG;EACjF,IAAI,OAAO,UAAU,aAAc,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,GACjF,IAAI,OAAO;OACR,IAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,UAAU;OAGpE,CAAC,YAAY,KAAK,KAAK,GAAG,IAAI,OAAO;EAAA;CAEjD;CACA,OAAO;AACX;;;;;;;;;;;;;;;;AAiBA,SAAS,aAAqB;CAC1B,IAAI;EACA,IAAI,MAAM,KAAK,QAAQ,cAAc,OAAO,KAAK,GAAG,CAAC;EACrD,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC;EAC7B,OAAO,OAAO,QAAQ,MAAM;GACxB,MAAM,WAAW,KAAK,KAAK,KAAK,cAAc;GAC9C,IAAI,GAAG,WAAW,QAAQ,GAAG;IACzB,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,UAAU,OAAO,CAAC;IACzD,IAAI,KAAK,SAAS,oBAAoB,OAAO,IAAI,YAAY,YAAY,IAAI,SACzE,OAAO,IAAI;GAEnB;GACA,MAAM,KAAK,QAAQ,GAAG;EAC1B;CACJ,QAAQ,CAER;CACA,OAAO;AACX;AAEA,SAAgB,WACZ,OACA,YACA,UACc;CACd,OAAO;EACH,QAAA;EACA;EACA,WAAW,SAAS;EACpB,WAAW,SAAS;EACpB,YAAY,WAAW;EACvB,WAAW,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,KAAK;EAC1D,UAAU,GAAG,SAAS;EACtB,MAAM,GAAG,KAAK;EACd,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY,CAAC,CAAC,QAAQ,aAAa,GAAG;EACrD,YAAY,SAAS,UAAU;CACnC;AACJ;;;ACtKA,SAAgB,kBAAkB,WAAmB,QAAQ,IAAI,GAA2B;CACxF,IAAI;EACA,MAAM,OAAO,gBAAgB,QAAQ;EACrC,IAAI,CAAC,MAAM,OAAO;EAElB,MAAM,OAAO,KAAK,KAAK,MAAM,iBAAiB;EAC9C,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,OAAO;EAMjC,MAAM,MAAM,GAAG,aAAa,MAAM,OAAO;EACzC,MAAM,QAAQ,iCAAiC,KAAK,GAAG;EACvD,IAAI,CAAC,OAAO,OAAO;EACnB,OAAO,MAAM,OAAO,UAAU,YAAY;CAC9C,QAAQ;EACJ,OAAO;CACX;AACJ;ACxCA,SAAgB,WAAmB;CAC/B,OAAO,QAAQ,IAAI,2BAA2B,KAAK,KAAA;AACvD;;;;;;;;;;AAWA,SAAS,YAAY,OAAoC;CACrD,OAAO,UAAU,KAAA,KAAa,MAAM,KAAK,MAAM,MAAM,gBAAgB,KAAK,MAAM;AACpF;;;;;;;;;;;;;;;;;;;;AA8BA,SAAgB,kBACZ,MAAyB,QAAQ,KACjC,MAAc,QAAQ,IAAI,GACF;CACxB,IAAI,YAAY,IAAI,YAAY,GAAG,OAAO;CAC1C,IAAI,YAAY,IAAI,yBAAyB,GAAG,OAAO;CACvD,IAAI,YAAY,IAAI,EAAE,GAAG,OAAO;CAChC,IAAI,kBAAkB,GAAG,MAAM,WAAW,OAAO;CAEjD,MAAM,SAAS,WAAW;CAC1B,IAAI,OAAO,YAAY,KAAA,GAAW,OAAO;CACzC,IAAI,CAAC,OAAO,SAAS,OAAO;CAC5B,OAAO;AACX;AAEA,SAAgB,UAAU,MAAyB,QAAQ,KAAK,MAAc,QAAQ,IAAI,GAAY;CAClG,OAAO,kBAAkB,KAAK,GAAG,MAAM;AAC3C;;;;;;;;;;AAWA,SAAgB,WAAW,SAA2B;CAClD,MAAM,SAAS,WAAW;CAC1B,IAAI;EACA,YAAY;GACR,GAAG;GACH;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAGlC,WAAW,UAAW,OAAO,aAAa,KAAA,IAAa,KAAA;EAC3D,CAAC;EACD,IAAI,SAAS,gBAAgB;EAC7B,OAAO;CACX,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;AAUA,SAAgB,aACZ,OACA,aAAsC,CAAC,GACvC,aACqB;CACrB,MAAM,SAAS,WAAW;CAC1B,IAAI,CAAC,OAAO,WAAW,OAAO;CAC9B,OAAO,WAAW,OAAO,YAAY;EACjC,WAAW,OAAO;EAClB,WAAW,cAAc,gBAAgB,WAAW,IAAI,KAAA;CAC5D,CAAC;AACL;;;;;;;;;;;;;;AAeA,eAAsB,YAClB,OACA,aAAsC,CAAC,GACvC,UAAwD,CAAC,GAC5C;CACb,IAAI;EAIA,IAAI,CAAC,UAAU,QAAQ,KAAK,QAAQ,eAAe,QAAQ,IAAI,CAAC,GAAG;EAInE,MAAM,UAAU,WAAW,OAAO,YAAY;GAAE,WAF9B,gBAE8B;GACxD,WAF0B,QAAQ,cAAc,gBAAgB,QAAQ,WAAW,IAAI,KAAA;EAE7E,CAAC;EAEH,MAAM,QAAQ,IAAI,gBAAgB;EAClC,MAAM,QAAQ,iBAAiB,MAAM,MAAM,GAAG,QAAQ,aAAa,GAAI;EACvE,IAAI;GACA,MAAM,MAAM,SAAS,GAAG;IACpB,QAAQ;IACR,SAAS,EAAE,gBAAgB,mBAAmB;IAC9C,MAAM,KAAK,UAAU,OAAO;IAC5B,QAAQ,MAAM;GAClB,CAAC;EACL,UAAU;GACN,aAAa,KAAK;EACtB;CACJ,QAAQ,CAIR;AACJ"}

package/dist/unknown-command-DNwDcX3w.js

@@ -0,0 +1,98 @@
+import chalk from "chalk";
+//#region src/utils/unknown-command.ts
+/**
+* What every command family says when it does not recognise a subcommand.
+*
+* Six families each did it differently, and the differences were not stylistic:
+*
+*   rebase statsu       "Unknown command: statsu" + the whole top-level help
+*   rebase auth foo     "Unknown auth command: foo" + the whole auth help
+*   rebase apps foo     "Unknown subcommand: foo"   — which command's?
+*   rebase skills foo   "Unknown skills subcommand: foo" + the whole help
+*   rebase telemetry x  the help, silently, with exit code 1 and no error line
+*   rebase cloud debug x both a JSON error *and* the human one, in JSON mode
+*
+* Dumping a screen of help after an error is the wrong shape: the one line that
+* says what happened scrolls off the top, and in a CI log it is buried in
+* forty. None of them offered the correction, which for a typo is the entire
+* answer — `statsu` is one transposition from `status`.
+*
+* So: one line, the near-miss when there is one, and where to read the rest.
+*/
+/**
+* Damerau–Levenshtein distance, capped by the caller.
+*
+* The transposition is the reason this is not plain Levenshtein: `statsu` for
+* `status` and `craete` for `create` are the two most common typing errors
+* there are, and both are distance 2 without it — the same as two unrelated
+* edits, which is too far to suggest anything at all.
+*/
+function editDistance(a, b) {
+	const rows = a.length + 1;
+	const cols = b.length + 1;
+	const d = Array.from({ length: rows }, () => new Array(cols).fill(0));
+	for (let i = 0; i < rows; i++) d[i][0] = i;
+	for (let j = 0; j < cols; j++) d[0][j] = j;
+	for (let i = 1; i < rows; i++) for (let j = 1; j < cols; j++) {
+		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+		d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+		if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+	}
+	return d[a.length][b.length];
+}
+/**
+* The one command the user probably meant, or nothing.
+*
+* Tight on purpose. A suggestion that is wrong is worse than none: it sends
+* someone to read the help for a command that was never the answer, and on a
+* family like `db` — where `push` and `pull` are one edit apart — a loose
+* threshold would confidently propose the destructive neighbour of what they
+* typed. So: one edit for a short word, two for a long one, and a prefix match
+* always counts (`rebase cloud dep` for `deploy`).
+*/
+function suggestCommand(typed, known) {
+	const word = typed.toLowerCase();
+	if (!word) return void 0;
+	if (word.length >= 3) {
+		const prefixed = known.filter((name) => name.toLowerCase().startsWith(word));
+		if (prefixed.length === 1) return prefixed[0];
+	}
+	const budget = word.length <= 4 ? 1 : 2;
+	let best;
+	for (const candidate of known) {
+		const distance = editDistance(word, candidate.toLowerCase());
+		if (distance > budget) continue;
+		if (!best || distance < best.distance) best = {
+			name: candidate,
+			distance
+		};
+	}
+	return best?.name;
+}
+/**
+* The line itself, without printing it — so callers that must answer in JSON
+* (the cloud family, whose `fail()` writes a machine-readable envelope) use the
+* same words as the ones that print.
+*
+* `family` is empty for the top level: `rebase --help`, not `rebase  --help`.
+*/
+function unknownCommandMessage(typed, known, family = "") {
+	const what = family ? `${family} command` : "command";
+	const suggestion = typed ? suggestCommand(typed, known) : void 0;
+	const help = family ? `rebase ${family} --help` : "rebase --help";
+	return suggestion ? `Unknown ${what} "${typed}" — did you mean \`${suggestion}\`? Run \`${help}\` for the rest.` : `Unknown ${what} "${typed ?? ""}". Run \`${help}\` for the ones there are.`;
+}
+/**
+* Print the line to stderr and exit 1.
+*
+* stderr, not stdout: a mistyped command is a failure, and the families with a
+* `--json` mode guarantee that stdout holds only their envelope.
+*/
+function unknownCommand(typed, known, family = "") {
+	console.error(chalk.red(`✗ ${unknownCommandMessage(typed, known, family)}`));
+	process.exit(1);
+}
+//#endregion
+export { unknownCommandMessage as n, unknownCommand as t };
+
+//# sourceMappingURL=unknown-command-DNwDcX3w.js.map

package/dist/unknown-command-DNwDcX3w.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unknown-command-DNwDcX3w.js","names":[],"sources":["../src/utils/unknown-command.ts"],"sourcesContent":["/**\n * What every command family says when it does not recognise a subcommand.\n *\n * Six families each did it differently, and the differences were not stylistic:\n *\n *   rebase statsu       \"Unknown command: statsu\" + the whole top-level help\n *   rebase auth foo     \"Unknown auth command: foo\" + the whole auth help\n *   rebase apps foo     \"Unknown subcommand: foo\"   — which command's?\n *   rebase skills foo   \"Unknown skills subcommand: foo\" + the whole help\n *   rebase telemetry x  the help, silently, with exit code 1 and no error line\n *   rebase cloud debug x both a JSON error *and* the human one, in JSON mode\n *\n * Dumping a screen of help after an error is the wrong shape: the one line that\n * says what happened scrolls off the top, and in a CI log it is buried in\n * forty. None of them offered the correction, which for a typo is the entire\n * answer — `statsu` is one transposition from `status`.\n *\n * So: one line, the near-miss when there is one, and where to read the rest.\n */\nimport chalk from \"chalk\";\n\n/**\n * Damerau–Levenshtein distance, capped by the caller.\n *\n * The transposition is the reason this is not plain Levenshtein: `statsu` for\n * `status` and `craete` for `create` are the two most common typing errors\n * there are, and both are distance 2 without it — the same as two unrelated\n * edits, which is too far to suggest anything at all.\n */\nfunction editDistance(a: string, b: string): number {\n    const rows = a.length + 1;\n    const cols = b.length + 1;\n    const d: number[][] = Array.from({ length: rows }, () => new Array<number>(cols).fill(0));\n\n    for (let i = 0; i < rows; i++) d[i][0] = i;\n    for (let j = 0; j < cols; j++) d[0][j] = j;\n\n    for (let i = 1; i < rows; i++) {\n        for (let j = 1; j < cols; j++) {\n            const cost = a[i - 1] === b[j - 1] ? 0 : 1;\n            d[i][j] = Math.min(\n                d[i - 1][j] + 1,\n                d[i][j - 1] + 1,\n                d[i - 1][j - 1] + cost\n            );\n            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {\n                d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);\n            }\n        }\n    }\n    return d[a.length][b.length];\n}\n\n/**\n * The one command the user probably meant, or nothing.\n *\n * Tight on purpose. A suggestion that is wrong is worse than none: it sends\n * someone to read the help for a command that was never the answer, and on a\n * family like `db` — where `push` and `pull` are one edit apart — a loose\n * threshold would confidently propose the destructive neighbour of what they\n * typed. So: one edit for a short word, two for a long one, and a prefix match\n * always counts (`rebase cloud dep` for `deploy`).\n */\nexport function suggestCommand(typed: string, known: readonly string[]): string | undefined {\n    const word = typed.toLowerCase();\n    if (!word) return undefined;\n\n    // An abbreviation, but only when it names exactly one command. \"res\" is a\n    // prefix of both `reset` and `restore`, and picking whichever comes first\n    // in the list would be a coin toss dressed up as an answer.\n    if (word.length >= 3) {\n        const prefixed = known.filter(name => name.toLowerCase().startsWith(word));\n        if (prefixed.length === 1) return prefixed[0];\n    }\n\n    const budget = word.length <= 4 ? 1 : 2;\n    let best: { name: string; distance: number } | undefined;\n\n    for (const candidate of known) {\n        const distance = editDistance(word, candidate.toLowerCase());\n        if (distance > budget) continue;\n        if (!best || distance < best.distance) best = { name: candidate, distance };\n    }\n\n    return best?.name;\n}\n\n/**\n * The line itself, without printing it — so callers that must answer in JSON\n * (the cloud family, whose `fail()` writes a machine-readable envelope) use the\n * same words as the ones that print.\n *\n * `family` is empty for the top level: `rebase --help`, not `rebase  --help`.\n */\nexport function unknownCommandMessage(\n    typed: string | undefined,\n    known: readonly string[],\n    family = \"\"\n): string {\n    const what = family ? `${family} command` : \"command\";\n    const suggestion = typed ? suggestCommand(typed, known) : undefined;\n    const help = family ? `rebase ${family} --help` : \"rebase --help\";\n\n    return suggestion\n        ? `Unknown ${what} \"${typed}\" — did you mean \\`${suggestion}\\`? Run \\`${help}\\` for the rest.`\n        : `Unknown ${what} \"${typed ?? \"\"}\". Run \\`${help}\\` for the ones there are.`;\n}\n\n/**\n * Print the line to stderr and exit 1.\n *\n * stderr, not stdout: a mistyped command is a failure, and the families with a\n * `--json` mode guarantee that stdout holds only their envelope.\n */\nexport function unknownCommand(\n    typed: string | undefined,\n    known: readonly string[],\n    family = \"\"\n): never {\n    console.error(chalk.red(`✗ ${unknownCommandMessage(typed, known, family)}`));\n    process.exit(1);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6BA,SAAS,aAAa,GAAW,GAAmB;CAChD,MAAM,OAAO,EAAE,SAAS;CACxB,MAAM,OAAO,EAAE,SAAS;CACxB,MAAM,IAAgB,MAAM,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAc,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;CAExF,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC,KAAK;CACzC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC,KAAK;CAEzC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK;EAC3B,MAAM,OAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI;EACzC,EAAE,EAAE,CAAC,KAAK,KAAK,IACX,EAAE,IAAI,EAAE,CAAC,KAAK,GACd,EAAE,EAAE,CAAC,IAAI,KAAK,GACd,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,IACtB;EACA,IAAI,IAAI,KAAK,IAAI,KAAK,EAAE,IAAI,OAAO,EAAE,IAAI,MAAM,EAAE,IAAI,OAAO,EAAE,IAAI,IAC9D,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;CAEvD;CAEJ,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;AACzB;;;;;;;;;;;AAYA,SAAgB,eAAe,OAAe,OAA8C;CACxF,MAAM,OAAO,MAAM,YAAY;CAC/B,IAAI,CAAC,MAAM,OAAO,KAAA;CAKlB,IAAI,KAAK,UAAU,GAAG;EAClB,MAAM,WAAW,MAAM,QAAO,SAAQ,KAAK,YAAY,CAAC,CAAC,WAAW,IAAI,CAAC;EACzE,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS;CAC/C;CAEA,MAAM,SAAS,KAAK,UAAU,IAAI,IAAI;CACtC,IAAI;CAEJ,KAAK,MAAM,aAAa,OAAO;EAC3B,MAAM,WAAW,aAAa,MAAM,UAAU,YAAY,CAAC;EAC3D,IAAI,WAAW,QAAQ;EACvB,IAAI,CAAC,QAAQ,WAAW,KAAK,UAAU,OAAO;GAAE,MAAM;GAAW;EAAS;CAC9E;CAEA,OAAO,MAAM;AACjB;;;;;;;;AASA,SAAgB,sBACZ,OACA,OACA,SAAS,IACH;CACN,MAAM,OAAO,SAAS,GAAG,OAAO,YAAY;CAC5C,MAAM,aAAa,QAAQ,eAAe,OAAO,KAAK,IAAI,KAAA;CAC1D,MAAM,OAAO,SAAS,UAAU,OAAO,WAAW;CAElD,OAAO,aACD,WAAW,KAAK,IAAI,MAAM,qBAAqB,WAAW,YAAY,KAAK,oBAC3E,WAAW,KAAK,IAAI,SAAS,GAAG,WAAW,KAAK;AAC1D;;;;;;;AAQA,SAAgB,eACZ,OACA,OACA,SAAS,IACJ;CACL,QAAQ,MAAM,MAAM,IAAI,KAAK,sBAAsB,OAAO,OAAO,MAAM,GAAG,CAAC;CAC3E,QAAQ,KAAK,CAAC;AAClB"}