@rebasepro/cli 0.16.0 → 0.16.1-canary.g041c925

package/dist/bundle.d.ts

@@ -1,4 +1,4 @@
-import { type DeclaredStorageSources, type NativeDependency, type RebaseBundleManifest, type RebaseBackendAppConfig } from "@rebasepro/types";
+import { type ResourceGraph, type NativeDependency, type RebaseBundleManifest, type RebaseBackendAppConfig } from "@rebasepro/types";
 export declare const DEFAULT_BUNDLE_DIR = "dist-bundle";
 export interface BuildBundleOptions {
     projectRoot: string;
@@ -14,7 +14,14 @@ export interface BuildBundleOptions {
      * Passed in rather than re-read here so `rebase.json` is parsed and validated
      * once, by the command that owns it.
      */
-    storage?: DeclaredStorageSources;
+    /**
+     * The project's resource graph, derived from its config.
+     *
+     * Recorded in the bundle manifest so a host can read what the project needs
+     * without running it — which is what lets a console show "wants a `media`
+     * bucket, has none" before a first deploy has produced anything.
+     */
+    resources?: ResourceGraph;
     /**
      * Install the declared dependencies into the bundle at build time.
      *
@@ -193,6 +200,25 @@ export interface VendorResult {
  * the upload is compressed: crossing it means "getting close", not "will fail".
  */
 export declare const VENDOR_SIZE_WARN_BYTES: number;
+/**
+ * Where vendoring stops being an optimisation and becomes a bundle nobody can
+ * deploy.
+ *
+ * Past this, shipping the tree anyway trades a faster cold start for a 413 — and
+ * the 413 arrives at deploy time, after a build nobody watches, with a remedy
+ * (`--no-vendor`) that requires knowing this happened. Unvendoring here costs
+ * 40–60s of cold start and produces a bundle that uploads; that is the better
+ * side of the trade to be on by default.
+ *
+ * 200 MB assumes a **2x** floor on compression, which is pessimistic for a tree
+ * of JavaScript (3–5x is typical) and deliberately so: source maps and prebuilt
+ * binaries compress far worse than source, and the failure this prevents is
+ * asymmetric — a bundle refused at the door versus a minute of cold start.
+ * `--vendor` overrides it, for a deploy path with no upload at all (a Dockerfile
+ * built from source, where the tree is copied into an image and the control
+ * plane never sees it).
+ */
+export declare const VENDOR_SIZE_MAX_BYTES: number;
 /**
  * Install the bundle's declared dependencies into the bundle itself.
  *

package/dist/commands/build.d.ts

@@ -1 +1,11 @@
+import type { RebaseAppConfig } from "@rebasepro/types";
 export declare function buildCommand(rawArgs?: string[]): Promise<void>;
+/**
+ * Build a static app and package it into a static bundle.
+ *
+ * Runs the app's own build command, checks it produced the declared output, then
+ * packages that output into a `static`-kind bundle — the same deployable shape as
+ * a backend bundle, so a frontend or admin app deploys through the identical
+ * path and runs on the identical image, just serving files instead of an API.
+ */
+export declare function buildAssetApp(projectRoot: string, name: string, app: RebaseAppConfig, runtimeRange: string, outOverride?: string): Promise<string | undefined>;

package/dist/commands/cloud/deployments.d.ts

@@ -37,6 +37,47 @@ export declare function triggerInfo(dep: DeploymentRow): {
 };
 /** Shape one deployment row into the stable JSON view the CLI publishes. */
 export declare function deploymentView(dep: DeploymentRow): Record<string, unknown>;
+/** What `POST /api/functions/deploy/cancel` answers. */
+export interface CancelResponse {
+    success: boolean;
+    /**
+     * The deployment that was cancelled — `null` when there was none.
+     *
+     * Nullable because "nothing was in flight" is a real, successful outcome
+     * and not an error: a project's `status` column can claim `deploying` while
+     * no deployment row backs the claim, and cancelling is what clears it.
+     */
+    deploymentId: string | null;
+    buildJobDeleted: boolean;
+    /** The request cleared a stuck `deploying` claim rather than stopping a build. */
+    unstranded?: boolean;
+    /** The status the project settled on when it did. */
+    projectStatus?: string | null;
+}
+/**
+ * What `rebase cloud cancel` says it did.
+ *
+ * Split out of the command because there are now two outcomes behind one
+ * `success: true`, and only one of them is "a build was stopped". The control
+ * plane learned to clear a project stranded at `deploying` with no deployment
+ * row behind it — the state `prospector` was wedged in for five days — and it
+ * reports that through this same endpoint. An unbranched caller printed
+ * "Cancelled deployment null" for it, which reads as a bug in the thing that
+ * had just fixed the bug.
+ *
+ * The ABSENT ID is what decides, not the `unstranded` flag: the flag is the
+ * server being explicit, and it is the newer half of the contract. Branching on
+ * the id means a client that meets a control plane which grew the behaviour
+ * without the flag still says something true.
+ */
+export declare function cancelView(res: CancelResponse): {
+    /** The headline, for `success()`. */
+    headline: string;
+    /** Dimmed follow-ups, printed under it. */
+    notes: string[];
+    /** The stable JSON view, which is what a piped run gets. */
+    json: Record<string, unknown>;
+};
 /**
  * Rows shown when `--limit` is not given.
  *

package/dist/commands/cloud/projects.d.ts

@@ -1,4 +1,4 @@
-import { type DeployTarget, type CloudClient } from "./context";
+import { type DeployTarget, type CloudClient } from "./context.js";
 export declare function listProjects(rawArgs: string[]): Promise<void>;
 /**
  * Where this project says it runs.
@@ -9,8 +9,9 @@ export declare function listProjects(rawArgs: string[]): Promise<void>;
  * never contradicted by a failure; it just sits in the record. The CLI used to
  * default to `hetzner`/`nbg1` unconditionally, which is how projects running on
  * our GKE cluster came to describe themselves as Hetzner in the console — and
- * `provider` is half the Stripe compute lookup key (`compute_<provider>_<vmSize>`),
- * so that is a mispricing, not a cosmetic slip.
+ * `provider` also decides which substrate's rules a project's dials are clamped
+ * to — Autopilot's 250m floor and 1:1-6.5:1 band do not apply on Hetzner or EKS
+ * — so a wrong value here resizes pods, it is not a cosmetic slip.
  *
  * The control plane already publishes the infrastructure that actually exists,
  * and the console's create wizard reads it. Ask the same question here.
@@ -39,10 +40,19 @@ export declare const CREATE_PROJECT_FLAGS: {
     readonly "--branch": StringConstructor;
     readonly "--provider": StringConstructor;
     readonly "--region": StringConstructor;
-    readonly "--vm-size": StringConstructor;
     readonly "--org": StringConstructor;
     readonly "--link": BooleanConstructor;
     readonly "-n": "--name";
+    readonly "--cpu": StringConstructor;
+    readonly "--memory": StringConstructor;
+    readonly "--replicas": StringConstructor;
+    readonly "--spot": StringConstructor;
+    readonly "--scale-to-zero": StringConstructor;
+    readonly "--db-mode": StringConstructor;
+    readonly "--db-instances": StringConstructor;
+    readonly "--db-cpu": StringConstructor;
+    readonly "--db-memory": StringConstructor;
+    readonly "--storage": StringConstructor;
 };
 export declare function createProject(rawArgs: string[]): Promise<void>;
 /**

package/dist/commands/cloud/resources.d.ts

@@ -106,7 +106,16 @@ export declare function resourcesCommand(action: string | undefined, rawArgs: st
  * the same shape `buildSettingsPatch` uses. Returns an error string rather than
  * throwing, because the caller owns how a refusal is printed in JSON mode.
  */
-export declare function buildDialPatch(rawArgs: string[]): {
+export declare function buildDialPatch(rawArgs: string[], 
+/**
+ * `requireOne: false` for `projects create`, where naming no dial is the
+ * ordinary case — a new project takes the platform default. On
+ * `resources set` a patch with nothing in it is a typo, and saying so beats
+ * a success message for a change nobody made.
+ */
+opts?: {
+    requireOne?: boolean;
+}): {
     patch: Record<string, unknown>;
     error?: string;
 };

package/dist/commands/db.d.ts

@@ -13,4 +13,20 @@
  * is actually changed, and leaves the plugin usable on its own terms.
  */
 export declare function absolutizeLocalPathArgs(args: string[], cwd: string): string[];
+/**
+ * Run a database subcommand through the active driver's CLI, throwing on
+ * failure instead of exiting.
+ *
+ * `dbCommand` below turns every failure into `process.exit(1)`, which is right
+ * for a command the user invoked directly and wrong for a caller that has more
+ * to do afterwards — `rebase dev` runs a schema push during start-up and must
+ * survive it failing. Exiting is therefore the wrapper's job, not this
+ * function's.
+ *
+ * The database is resolved *here* rather than in the wrapper, so the schema
+ * push `rebase dev` performs during start-up reaches the managed database too.
+ */
+export declare function runDriverDbCommand(rawArgs: string[], options?: {
+    quiet?: boolean;
+}): Promise<void>;
 export declare function dbCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;

package/dist/commands/dev.d.ts

@@ -20,9 +20,20 @@ export declare const DEV_FLAGS: {
     readonly "--frontend-only": BooleanConstructor;
     readonly "--port": NumberConstructor;
     readonly "--generate": BooleanConstructor;
+    /**
+     * Point this run at a database of your own, ahead of everything else.
+     *
+     * The managed development database fills a vacuum; it never redirects a
+     * project that has said which Postgres it wants. This flag is the loudest
+     * way to say it, and outranks DATABASE_URL in the environment and in .env.
+     */
+    readonly "--database-url": StringConstructor;
+    /** Use Postgres in Docker rather than the managed database. */
+    readonly "--docker": BooleanConstructor;
     readonly "-b": "--backend-only";
     readonly "-f": "--frontend-only";
     readonly "-P": "--port";
     readonly "-g": "--generate";
+    readonly "--no-db": BooleanConstructor;
 };
 export declare function devCommand(rawArgs: string[]): Promise<void>;

package/dist/commands/doctor.d.ts

@@ -1,4 +1,4 @@
-import { type LibpqUrlFinding } from "../utils/libpq-url";
+import { type LibpqUrlFinding } from "../utils/libpq-url.js";
 /**
  * Find connection strings libpq cannot parse, anywhere in the project.
  *

package/dist/commands/init.d.ts

@@ -1,4 +1,4 @@
-import type { PackageManager, PMCommands } from "../utils/package-manager";
+import type { PackageManager, PMCommands } from "../utils/package-manager.js";
 /**
  * Every scaffolded file that carries a `{{PLACEHOLDER}}`.
  *

package/dist/commands/resources.d.ts

@@ -0,0 +1 @@
+export declare function resourcesCommand(rawArgs: string[]): Promise<void>;

package/dist/constraints-BK1_4vci.js

@@ -0,0 +1,80 @@
+//#region src/dev-db/constraints.ts
+/**
+* What PGlite can and cannot do as a development database, measured rather
+* than assumed.
+*
+* Everything in this directory is shaped by four facts, each established by
+* running it against `@electric-sql/pglite` 0.5.6 and
+* `@electric-sql/pglite-socket` 0.2.9 rather than by reading their docs. They
+* are recorded here because two of them are silent failures — the kind that
+* make a developer lose an evening to a feature that reports success and does
+* nothing.
+*
+* 1. **It is really PostgreSQL 18.3.** `select version()` over the socket
+*    returns `PostgreSQL 18.3 (PGlite 0.5.6) on wasm32`, which is the same
+*    major as the `postgres:18-alpine` the eject template ships. So a dev
+*    database here and a compose database there are the same Postgres, and
+*    schema behaviour does not diverge between them.
+*
+* 2. **`pg_trgm` and `unaccent` are available**, which is what search
+*    collections need. They are not installed by a bare `CREATE EXTENSION`,
+*    though — PGlite ships them as separate bundles that must be passed to the
+*    constructor, and without that `CREATE EXTENSION pg_trgm` fails with
+*    `extension "pg_trgm" is not available`. {@link PGLITE_EXTENSIONS} is that
+*    list, and it has to stay in step with what the schema generator emits.
+*
+* 3. **RLS is enforced exactly as it is on a real server.** With
+*    `SET LOCAL ROLE "rebase_user"` inside a transaction — which is how
+*    `PostgresBackendDriver` isolates every request — `current_user` becomes
+*    the restricted role, `session_user` stays the owner, and a policy using
+*    `current_setting('app.tenant')` filters rows correctly, including under
+*    `FORCE ROW LEVEL SECURITY`. Measured: an owner saw 3 rows and the
+*    role-switched transaction saw 2, with the cross-tenant probe returning 0.
+*    This is the one that mattered most: a dev database that quietly failed to
+*    apply RLS would give false confidence about the product's central claim.
+*
+* 4. **Concurrency is the real limit, and it fails badly.** PGlite is a single
+*    session, and `PGLiteSocketServer` multiplexes connections onto it. Two
+*    pooled clients that hold *overlapping transactions* deadlock — not error,
+*    hang — which is precisely what a request-per-transaction server does under
+*    any concurrent load. {@link MANAGED_POOL_MAX} is the answer: one client
+*    connection, so requests queue in the pool instead of deadlocking in the
+*    multiplexer. Measured: with a pool of 1, four concurrent queries and a
+*    role-switched RLS transaction all pass; with a pool of 5 the same script
+*    hangs indefinitely.
+*
+* 5. **LISTEN/NOTIFY needed repairing, and now works.** A notification is an
+*    asynchronous message with no request to answer, and the multiplexer hands
+*    it to whichever socket is reading rather than to the one that issued
+*    `LISTEN` — so a dedicated listener connection, which is exactly how the
+*    realtime engine works, received nothing while the *writer* received
+*    notifications it never asked for. `notification-proxy.ts` corrects that by
+*    copying every `NotificationResponse` frame to every client, which for a
+*    single-session database is simply the truth. Realtime therefore works
+*    against the managed database, with no change to the server: it does
+*    ordinary `LISTEN` over ordinary libpq.
+*/
+/**
+* Extensions to hand PGlite's constructor.
+*
+* `CREATE EXTENSION` alone cannot install these — PGlite resolves them from
+* bundles supplied at construction time, so anything missing here is missing
+* from the database no matter what the migration says.
+*/
+var PGLITE_EXTENSION_NAMES = ["pg_trgm", "unaccent"];
+/**
+* Announced at startup, every time, rather than discovered.
+*
+* A developer who does not know realtime is off will read the silence as a bug
+* in their own code, which is a worse outcome than not offering the managed
+* database at all.
+*/
+var MANAGED_LIMITATIONS = [{
+	id: "concurrency",
+	summary: "Requests are served one at a time. Behaviour is correct but serialized, so lock contention and job-queue concurrency cannot be reproduced here.",
+	remedy: "Reproduce concurrency against a real Postgres: rebase dev --docker"
+}];
+//#endregion
+export { PGLITE_EXTENSION_NAMES as n, MANAGED_LIMITATIONS as t };
+
+//# sourceMappingURL=constraints-BK1_4vci.js.map

package/dist/constraints-BK1_4vci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constraints-BK1_4vci.js","names":[],"sources":["../src/dev-db/constraints.ts"],"sourcesContent":["/**\n * What PGlite can and cannot do as a development database, measured rather\n * than assumed.\n *\n * Everything in this directory is shaped by four facts, each established by\n * running it against `@electric-sql/pglite` 0.5.6 and\n * `@electric-sql/pglite-socket` 0.2.9 rather than by reading their docs. They\n * are recorded here because two of them are silent failures — the kind that\n * make a developer lose an evening to a feature that reports success and does\n * nothing.\n *\n * 1. **It is really PostgreSQL 18.3.** `select version()` over the socket\n *    returns `PostgreSQL 18.3 (PGlite 0.5.6) on wasm32`, which is the same\n *    major as the `postgres:18-alpine` the eject template ships. So a dev\n *    database here and a compose database there are the same Postgres, and\n *    schema behaviour does not diverge between them.\n *\n * 2. **`pg_trgm` and `unaccent` are available**, which is what search\n *    collections need. They are not installed by a bare `CREATE EXTENSION`,\n *    though — PGlite ships them as separate bundles that must be passed to the\n *    constructor, and without that `CREATE EXTENSION pg_trgm` fails with\n *    `extension \"pg_trgm\" is not available`. {@link PGLITE_EXTENSIONS} is that\n *    list, and it has to stay in step with what the schema generator emits.\n *\n * 3. **RLS is enforced exactly as it is on a real server.** With\n *    `SET LOCAL ROLE \"rebase_user\"` inside a transaction — which is how\n *    `PostgresBackendDriver` isolates every request — `current_user` becomes\n *    the restricted role, `session_user` stays the owner, and a policy using\n *    `current_setting('app.tenant')` filters rows correctly, including under\n *    `FORCE ROW LEVEL SECURITY`. Measured: an owner saw 3 rows and the\n *    role-switched transaction saw 2, with the cross-tenant probe returning 0.\n *    This is the one that mattered most: a dev database that quietly failed to\n *    apply RLS would give false confidence about the product's central claim.\n *\n * 4. **Concurrency is the real limit, and it fails badly.** PGlite is a single\n *    session, and `PGLiteSocketServer` multiplexes connections onto it. Two\n *    pooled clients that hold *overlapping transactions* deadlock — not error,\n *    hang — which is precisely what a request-per-transaction server does under\n *    any concurrent load. {@link MANAGED_POOL_MAX} is the answer: one client\n *    connection, so requests queue in the pool instead of deadlocking in the\n *    multiplexer. Measured: with a pool of 1, four concurrent queries and a\n *    role-switched RLS transaction all pass; with a pool of 5 the same script\n *    hangs indefinitely.\n *\n * 5. **LISTEN/NOTIFY needed repairing, and now works.** A notification is an\n *    asynchronous message with no request to answer, and the multiplexer hands\n *    it to whichever socket is reading rather than to the one that issued\n *    `LISTEN` — so a dedicated listener connection, which is exactly how the\n *    realtime engine works, received nothing while the *writer* received\n *    notifications it never asked for. `notification-proxy.ts` corrects that by\n *    copying every `NotificationResponse` frame to every client, which for a\n *    single-session database is simply the truth. Realtime therefore works\n *    against the managed database, with no change to the server: it does\n *    ordinary `LISTEN` over ordinary libpq.\n */\n\n/**\n * Extensions to hand PGlite's constructor.\n *\n * `CREATE EXTENSION` alone cannot install these — PGlite resolves them from\n * bundles supplied at construction time, so anything missing here is missing\n * from the database no matter what the migration says.\n */\nexport const PGLITE_EXTENSION_NAMES = [\"pg_trgm\", \"unaccent\"] as const;\n\n/**\n * Client connections the managed database tolerates: exactly one.\n *\n * Not a tuning choice. Two concurrent transactions over the socket\n * multiplexer deadlock, and a request-per-transaction server produces those\n * the moment two requests overlap. One connection converts that deadlock into\n * ordinary queueing, which is slower and correct.\n */\nexport const MANAGED_POOL_MAX = 1;\n\n/**\n * Connections the socket server will accept.\n *\n * Above {@link MANAGED_POOL_MAX} so that a second *non-transactional* client —\n * `rebase db push` in another terminal while `rebase dev` runs — is refused\n * with a connection error rather than corrupting the multiplexer. The pool\n * limit is what prevents overlapping transactions; this only stops a stampede.\n */\nexport const MANAGED_SERVER_MAX_CONNECTIONS = 4;\n\n/** What a managed PGlite database cannot do, in the words the user needs. */\nexport interface ManagedLimitation {\n    /** Stable id, so a warning can be suppressed or tested for. */\n    id: string;\n    /** One line, naming the feature rather than the mechanism. */\n    summary: string;\n    /** What to do instead. Always a concrete command. */\n    remedy: string;\n}\n\n/**\n * Announced at startup, every time, rather than discovered.\n *\n * A developer who does not know realtime is off will read the silence as a bug\n * in their own code, which is a worse outcome than not offering the managed\n * database at all.\n */\nexport const MANAGED_LIMITATIONS: readonly ManagedLimitation[] = [\n    {\n        id: \"concurrency\",\n        summary:\n            \"Requests are served one at a time. Behaviour is correct but serialized, so \" +\n            \"lock contention and job-queue concurrency cannot be reproduced here.\",\n        remedy: \"Reproduce concurrency against a real Postgres: rebase dev --docker\"\n    }\n] as const;\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,IAAa,yBAAyB,CAAC,WAAW,UAAU;;;;;;;;AAuC5D,IAAa,sBAAoD,CAC7D;CACI,IAAI;CACJ,SACI;CAEJ,QAAQ;AACZ,CACJ"}

package/dist/daemon-Bdl4lrdt.js

@@ -0,0 +1,252 @@
+import { a as findFreePort, c as releaseStartLock, f as __exportAll, i as devDbDir, l as stateFile, n as clearState, o as pidRunning, r as dataDir, s as readState, t as acquireStartLock } from "./state-c0CJ6Kwb.js";
+import path from "path";
+import fs from "fs";
+import net from "net";
+import { fileURLToPath } from "url";
+import { randomBytes } from "crypto";
+import { spawn } from "child_process";
+//#region src/dev-db/daemon.ts
+/**
+* Starting, finding and stopping the managed database, from the caller's side.
+*
+* Every command that needs Postgres calls {@link ensureManagedDatabase} and
+* gets a connection string back. Whether that started a process or found one
+* already running is not the caller's business, which is the point: `rebase
+* db push`, `rebase dev` and `rebase studio` in three terminals must all reach
+* the same database without coordinating, because two processes opening one
+* PGlite data directory would corrupt it.
+*
+* The hard part is not starting the daemon; it is deciding whether the one the
+* state file describes is still there. A pid can be recycled after a reboot and
+* a port can be taken by a stranger, so believing either on its own would let
+* Rebase send a migration somewhere unintended. {@link isDaemonAlive} asks the
+* daemon to identify itself instead.
+*/
+var daemon_exports = /* @__PURE__ */ __exportAll({
+	ensureManagedDatabase: () => ensureManagedDatabase,
+	findRunningDaemon: () => findRunningDaemon,
+	isDaemonAlive: () => isDaemonAlive,
+	managedUrl: () => managedUrl,
+	resetManagedDatabase: () => resetManagedDatabase,
+	resolveSpawn: () => resolveSpawn,
+	stopManagedDatabase: () => stopManagedDatabase
+});
+/** How long to wait for a first boot. PGlite runs initdb on an empty data dir. */
+var START_TIMEOUT_MS = 6e4;
+/** Poll interval while waiting for the daemon to publish its state file. */
+var POLL_INTERVAL_MS = 150;
+/** How long the identity handshake may take before we call it dead. */
+var IDENTITY_TIMEOUT_MS = 1500;
+/**
+* PGlite's built-in superuser and database.
+*
+* Fixed by PGlite rather than chosen here, and asserted by the socket spike:
+* `session_user` comes back as `postgres`.
+*/
+var MANAGED_USER = "postgres";
+var MANAGED_DATABASE = "postgres";
+function managedUrl(port) {
+	return `postgresql://${MANAGED_USER}@127.0.0.1:${port}/${MANAGED_DATABASE}`;
+}
+/**
+* Ask the process behind a state record to prove it is the one we wrote down.
+*
+* A pid check alone answers "is *a* process running", and a port check alone
+* answers "is *something* listening" — after a reboot both say yes about
+* strangers. The daemon answers with the token from its own state file, so a
+* match is the only evidence accepted.
+*/
+function isDaemonAlive(state) {
+	if (!pidRunning(state.pid)) return Promise.resolve(false);
+	return new Promise((resolve) => {
+		const socket = new net.Socket();
+		let answer = "";
+		const settle = (alive) => {
+			socket.removeAllListeners();
+			socket.destroy();
+			resolve(alive);
+		};
+		socket.setTimeout(IDENTITY_TIMEOUT_MS);
+		socket.once("timeout", () => settle(false));
+		socket.once("error", () => settle(false));
+		socket.on("data", (chunk) => {
+			answer += chunk.toString("utf8");
+			if (answer.includes("\n")) settle(answer.trim() === `rebase-dev-db ${state.token}`);
+		});
+		socket.once("close", () => settle(answer.trim() === `rebase-dev-db ${state.token}`));
+		socket.connect(state.identityPort, "127.0.0.1");
+	});
+}
+/** The running daemon for this project, or `null`. Never starts anything. */
+async function findRunningDaemon(projectRoot) {
+	const state = readState(projectRoot);
+	if (!state) return null;
+	if (await isDaemonAlive(state)) return state;
+	clearState(projectRoot);
+	return null;
+}
+/**
+* Resolve the CLI entry point, so the daemon can be spawned as ourselves.
+*
+* A hidden subcommand rather than a second build entry: under `tsx` this file
+* is `src/dev-db/daemon.ts` and in a published CLI it is bundled into
+* `dist/index.js`, and in both cases the executable to re-invoke is the one
+* already running.
+*/
+function resolveCliEntry() {
+	const argvEntry = process.argv[1];
+	if (argvEntry && fs.existsSync(argvEntry)) return argvEntry;
+	return fileURLToPath(new URL("data:video/mp2t;base64,ZXhwb3J0ICogZnJvbSAiLi9jbGkiOwpleHBvcnQgKiBmcm9tICIuL2NvbW1hbmRzL2luaXQiOwpleHBvcnQgKiBmcm9tICIuL2NvbW1hbmRzL3NjaGVtYSI7CmV4cG9ydCAqIGZyb20gIi4vY29tbWFuZHMvZGIiOwpleHBvcnQgKiBmcm9tICIuL2NvbW1hbmRzL2RldiI7CmV4cG9ydCAqIGZyb20gIi4vY29tbWFuZHMvYnVpbGQiOwpleHBvcnQgKiBmcm9tICIuL2NvbW1hbmRzL2VqZWN0IjsKZXhwb3J0ICogZnJvbSAiLi9jb21tYW5kcy9zdGFydCI7CmV4cG9ydCAqIGZyb20gIi4vY29tbWFuZHMvYXV0aCI7CmV4cG9ydCAqIGZyb20gIi4vY29tbWFuZHMvZG9jdG9yIjsKZXhwb3J0ICogZnJvbSAiLi9jb21tYW5kcy9nZW5lcmF0ZV9zZGsiOwpleHBvcnQgKiBmcm9tICIuL2NvbW1hbmRzL2Nsb3VkIjsKZXhwb3J0ICogZnJvbSAiLi9jb21tYW5kcy9hcHBzIjsKZXhwb3J0ICogZnJvbSAiLi91dGlscy9wcm9qZWN0IjsKZXhwb3J0ICogZnJvbSAiLi91dGlscy9wYWNrYWdlLW1hbmFnZXIiOwoKLy8gVGhlIG1hbmlmZXN0IGFuZCBidW5kbGUgY29udHJhY3RzLgovLwovLyBFeHBvcnRlZCBiZWNhdXNlIHZhbGlkYXRpbmcgdGhlbSBpcyBub3Qgb25seSB0aGUgQ0xJJ3Mgam9iOiBhIGNvbnRyb2wgcGxhbmUKLy8gaGFzIHRvIGRlY2lkZSB3aGV0aGVyIGEgc3VibWl0dGVkIGJ1bmRsZSBjYW4gcnVuIGJlZm9yZSBpdCBkZXBsb3lzIGl0LCBhbmQgaXQKLy8gbXVzdCByZWFjaCB0aGF0IHZlcmRpY3Qgd2l0aCB0aGUgc2FtZSBjb2RlIHRoYXQgcHJvZHVjZWQgdGhlIGFydGlmYWN0LgpleHBvcnQgKiBmcm9tICIuL21hbmlmZXN0IjsKZXhwb3J0ICogZnJvbSAiLi9idW5kbGUiOwo=", "" + import.meta.url));
+}
+/**
+* How to re-invoke ourselves, which differs between a published CLI and this
+* repository.
+*
+* A published `rebase` is `node bin/rebase.js`, and re-running that is trivial.
+* Inside the monorepo the entry is TypeScript, which plain `node` cannot load —
+* so the daemon has to be started through the same loader that is running now.
+* Getting this wrong fails as a spawn that exits instantly with a syntax error,
+* which is why the caller reads `pglite.log` on failure.
+*/
+function resolveSpawn(entry) {
+	if (!/\.[cm]?ts$/.test(entry)) return {
+		execPath: process.execPath,
+		prefixArgs: []
+	};
+	return {
+		execPath: process.execPath,
+		prefixArgs: ["--import", "tsx"]
+	};
+}
+/**
+* The project's managed database, started if it is not already running.
+*
+* Safe to call concurrently from several commands: the loser of the race finds
+* the winner's state file during its poll and adopts it rather than starting a
+* second daemon.
+*/
+async function ensureManagedDatabase(projectRoot, options = {}) {
+	const existing = await findRunningDaemon(projectRoot);
+	if (existing) return adopt(existing, false);
+	fs.mkdirSync(devDbDir(projectRoot), { recursive: true });
+	ensureGitignore(projectRoot);
+	if (!acquireStartLock(projectRoot, START_TIMEOUT_MS)) {
+		const adopted = await waitForDaemon(projectRoot, START_TIMEOUT_MS);
+		if (adopted) return adopt(adopted, false);
+		if (!acquireStartLock(projectRoot, 0)) throw new Error(`Another process is starting the development database and did not finish.
+  Remove ${path.join(devDbDir(projectRoot), "starting.lock")} if nothing is running.`);
+	}
+	const port = await findFreePort();
+	const token = randomBytes(16).toString("hex");
+	const entry = options.entry ?? resolveCliEntry();
+	const spawnPlan = options.spawn ?? resolveSpawn(entry);
+	const args = [
+		...spawnPlan.prefixArgs,
+		entry,
+		"__dev-db-daemon",
+		"--project",
+		projectRoot,
+		"--port",
+		String(port),
+		"--token",
+		token
+	];
+	if (options.idleTimeoutMs !== void 0) args.push("--idle-timeout", String(options.idleTimeoutMs));
+	const log = fs.openSync(path.join(devDbDir(projectRoot), "pglite.log"), "a");
+	const child = spawn(spawnPlan.execPath, args, {
+		detached: true,
+		stdio: [
+			"ignore",
+			log,
+			log
+		]
+	});
+	child.unref();
+	try {
+		const deadline = Date.now() + START_TIMEOUT_MS;
+		let announced = false;
+		while (Date.now() < deadline) {
+			const state = readState(projectRoot);
+			if (state && await isDaemonAlive(state)) return adopt(state, true);
+			if (!announced && !options.quiet) {
+				announced = true;
+				options.onProgress?.("Starting the development database…");
+			}
+			if (child.exitCode !== null && child.exitCode !== 0) throw new Error(`The development database failed to start (exit ${child.exitCode}).\n  See ${path.join(devDbDir(projectRoot), "pglite.log")} for the reason.`);
+			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+		}
+		throw new Error(`The development database did not start within ${Math.round(START_TIMEOUT_MS / 1e3)}s.\n  See ${path.join(devDbDir(projectRoot), "pglite.log")} for the reason.\n  To use your own Postgres instead, set DATABASE_URL or pass --database-url.`);
+	} finally {
+		releaseStartLock(projectRoot);
+	}
+}
+/** Shape a live state record as the caller's result. */
+function adopt(state, started) {
+	return {
+		url: managedUrl(state.port),
+		dataDir: state.dataDir,
+		port: state.port,
+		pid: state.pid,
+		started
+	};
+}
+/** Poll until another process publishes a live daemon, or give up. */
+async function waitForDaemon(projectRoot, timeoutMs) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		const state = readState(projectRoot);
+		if (state && await isDaemonAlive(state)) return state;
+		await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+	}
+	return null;
+}
+/** Stop the daemon. Returns false when there was nothing running. */
+async function stopManagedDatabase(projectRoot) {
+	const state = await findRunningDaemon(projectRoot);
+	if (!state) return false;
+	try {
+		process.kill(state.pid, "SIGTERM");
+	} catch {
+		clearState(projectRoot);
+		return false;
+	}
+	const deadline = Date.now() + 1e4;
+	while (Date.now() < deadline) {
+		if (!fs.existsSync(stateFile(projectRoot))) return true;
+		await new Promise((resolve) => setTimeout(resolve, 100));
+	}
+	clearState(projectRoot);
+	return true;
+}
+/**
+* Stop the daemon and delete the data directory.
+*
+* Destructive and deliberately not clever: it removes the whole directory
+* rather than dropping schemas, because "give me an empty database" is the only
+* thing anyone means by it.
+*/
+async function resetManagedDatabase(projectRoot) {
+	await stopManagedDatabase(projectRoot);
+	fs.rmSync(dataDir(projectRoot), {
+		recursive: true,
+		force: true
+	});
+	clearState(projectRoot);
+}
+/**
+* Keep the generated directory out of git.
+*
+* `.rebase/` holds a Postgres data directory and a log. A project that commits
+* it will push hundreds of megabytes and a database that only makes sense on
+* one machine, so the ignore file is written next to the data rather than
+* relying on the project's root `.gitignore` having been updated.
+*/
+function ensureGitignore(projectRoot) {
+	const target = path.join(devDbDir(projectRoot), ".gitignore");
+	if (fs.existsSync(target)) return;
+	fs.writeFileSync(target, "# Generated by `rebase dev` — a local Postgres data directory and its log.\n# Machine-specific and large; never commit it.\n*\n", "utf8");
+}
+//#endregion
+export { ensureManagedDatabase as n, daemon_exports as t };
+
+//# sourceMappingURL=daemon-Bdl4lrdt.js.map

package/dist/daemon-Bdl4lrdt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-Bdl4lrdt.js","names":[],"sources":["../src/dev-db/daemon.ts"],"sourcesContent":["/**\n * Starting, finding and stopping the managed database, from the caller's side.\n *\n * Every command that needs Postgres calls {@link ensureManagedDatabase} and\n * gets a connection string back. Whether that started a process or found one\n * already running is not the caller's business, which is the point: `rebase\n * db push`, `rebase dev` and `rebase studio` in three terminals must all reach\n * the same database without coordinating, because two processes opening one\n * PGlite data directory would corrupt it.\n *\n * The hard part is not starting the daemon; it is deciding whether the one the\n * state file describes is still there. A pid can be recycled after a reboot and\n * a port can be taken by a stranger, so believing either on its own would let\n * Rebase send a migration somewhere unintended. {@link isDaemonAlive} asks the\n * daemon to identify itself instead.\n */\n\nimport { randomBytes } from \"crypto\";\nimport { type ChildProcess, spawn } from \"child_process\";\nimport fs from \"fs\";\nimport net from \"net\";\nimport path from \"path\";\nimport { fileURLToPath } from \"url\";\n\nimport {\n    acquireStartLock,\n    clearState,\n    type DaemonState,\n    dataDir,\n    devDbDir,\n    findFreePort,\n    pidRunning,\n    readState,\n    releaseStartLock,\n    stateFile\n} from \"./state\";\n\n/** How long to wait for a first boot. PGlite runs initdb on an empty data dir. */\nconst START_TIMEOUT_MS = 60_000;\n/** Poll interval while waiting for the daemon to publish its state file. */\nconst POLL_INTERVAL_MS = 150;\n/** How long the identity handshake may take before we call it dead. */\nconst IDENTITY_TIMEOUT_MS = 1_500;\n\nexport interface ManagedDatabase {\n    /** Connection string for this project's managed database. */\n    url: string;\n    /** Where the data lives, for diagnostics and `--reset`. */\n    dataDir: string;\n    port: number;\n    pid: number;\n    /** True when this call started the daemon rather than finding it. */\n    started: boolean;\n}\n\n/**\n * PGlite's built-in superuser and database.\n *\n * Fixed by PGlite rather than chosen here, and asserted by the socket spike:\n * `session_user` comes back as `postgres`.\n */\nconst MANAGED_USER = \"postgres\";\nconst MANAGED_DATABASE = \"postgres\";\n\nexport function managedUrl(port: number): string {\n    return `postgresql://${MANAGED_USER}@127.0.0.1:${port}/${MANAGED_DATABASE}`;\n}\n\n/**\n * Ask the process behind a state record to prove it is the one we wrote down.\n *\n * A pid check alone answers \"is *a* process running\", and a port check alone\n * answers \"is *something* listening\" — after a reboot both say yes about\n * strangers. The daemon answers with the token from its own state file, so a\n * match is the only evidence accepted.\n */\nexport function isDaemonAlive(state: DaemonState): Promise<boolean> {\n    if (!pidRunning(state.pid)) return Promise.resolve(false);\n\n    return new Promise((resolve) => {\n        const socket = new net.Socket();\n        let answer = \"\";\n        const settle = (alive: boolean) => {\n            socket.removeAllListeners();\n            socket.destroy();\n            resolve(alive);\n        };\n        socket.setTimeout(IDENTITY_TIMEOUT_MS);\n        socket.once(\"timeout\", () => settle(false));\n        socket.once(\"error\", () => settle(false));\n        socket.on(\"data\", (chunk) => {\n            answer += chunk.toString(\"utf8\");\n            if (answer.includes(\"\\n\")) settle(answer.trim() === `rebase-dev-db ${state.token}`);\n        });\n        socket.once(\"close\", () => settle(answer.trim() === `rebase-dev-db ${state.token}`));\n        socket.connect(state.identityPort, \"127.0.0.1\");\n    });\n}\n\n/** The running daemon for this project, or `null`. Never starts anything. */\nexport async function findRunningDaemon(projectRoot: string): Promise<DaemonState | null> {\n    const state = readState(projectRoot);\n    if (!state) return null;\n    if (await isDaemonAlive(state)) return state;\n\n    // The record describes something that is not there. Clearing it is the\n    // whole recovery: the next ensure call starts a fresh daemon, and leaving\n    // it would make every subsequent check pay the identity timeout.\n    clearState(projectRoot);\n\n    return null;\n}\n\n/**\n * Resolve the CLI entry point, so the daemon can be spawned as ourselves.\n *\n * A hidden subcommand rather than a second build entry: under `tsx` this file\n * is `src/dev-db/daemon.ts` and in a published CLI it is bundled into\n * `dist/index.js`, and in both cases the executable to re-invoke is the one\n * already running.\n */\nfunction resolveCliEntry(): string {\n    // `process.argv[1]` is `bin/rebase.js` for a real invocation, which is\n    // exactly what should be re-run. Under a test runner it is the runner, so\n    // fall back to this module's own directory.\n    const argvEntry = process.argv[1];\n    if (argvEntry && fs.existsSync(argvEntry)) return argvEntry;\n\n    return fileURLToPath(new URL(\"../index.js\", import.meta.url));\n}\n\n/**\n * How to re-invoke ourselves, which differs between a published CLI and this\n * repository.\n *\n * A published `rebase` is `node bin/rebase.js`, and re-running that is trivial.\n * Inside the monorepo the entry is TypeScript, which plain `node` cannot load —\n * so the daemon has to be started through the same loader that is running now.\n * Getting this wrong fails as a spawn that exits instantly with a syntax error,\n * which is why the caller reads `pglite.log` on failure.\n */\nexport function resolveSpawn(entry: string): { execPath: string; prefixArgs: string[] } {\n    if (!/\\.[cm]?ts$/.test(entry)) return { execPath: process.execPath, prefixArgs: [] };\n\n    // Node can load TypeScript when tsx is registered as an import hook. tsx is\n    // already a dependency of this package, because `rebase dev` runs the\n    // backend through it.\n    return { execPath: process.execPath, prefixArgs: [\"--import\", \"tsx\"] };\n}\n\nexport interface EnsureOptions {\n    /** Silence the \"starting…\" progress line. */\n    quiet?: boolean;\n    /** Milliseconds of inactivity before the daemon exits. 0 disables. */\n    idleTimeoutMs?: number;\n    /** Where progress goes. Injected for tests. */\n    onProgress?: (message: string) => void;\n    /** Override how the daemon process is launched. For tests. */\n    spawn?: { execPath: string; prefixArgs: string[] };\n    /**\n     * Override the CLI entry to re-invoke. For tests.\n     *\n     * Necessary because under a test runner `process.argv[1]` is the runner\n     * itself, which exists and is therefore accepted by {@link resolveCliEntry}\n     * — spawning vitest with `__dev-db-daemon` rather than the CLI.\n     */\n    entry?: string;\n}\n\n/**\n * The project's managed database, started if it is not already running.\n *\n * Safe to call concurrently from several commands: the loser of the race finds\n * the winner's state file during its poll and adopts it rather than starting a\n * second daemon.\n */\nexport async function ensureManagedDatabase(\n    projectRoot: string,\n    options: EnsureOptions = {}\n): Promise<ManagedDatabase> {\n    const existing = await findRunningDaemon(projectRoot);\n    if (existing) return adopt(existing, false);\n\n    fs.mkdirSync(devDbDir(projectRoot), { recursive: true });\n    ensureGitignore(projectRoot);\n\n    // Exactly one process may spawn a daemon. Without this, `rebase dev` and\n    // `rebase db push` started in the same second both see no state file, both\n    // spawn, and two processes open one PGlite data directory — the corruption\n    // the single-daemon design exists to prevent.\n    if (!acquireStartLock(projectRoot, START_TIMEOUT_MS)) {\n        const adopted = await waitForDaemon(projectRoot, START_TIMEOUT_MS);\n        if (adopted) return adopt(adopted, false);\n\n        // The holder gave up or died without publishing. Falling through to\n        // start one ourselves is better than failing: the lock is stale by now,\n        // so the next acquire will break it.\n        if (!acquireStartLock(projectRoot, 0)) {\n            throw new Error(\n                \"Another process is starting the development database and did not finish.\\n\" +\n                `  Remove ${path.join(devDbDir(projectRoot), \"starting.lock\")} if nothing is running.`\n            );\n        }\n    }\n\n    const port = await findFreePort();\n    const token = randomBytes(16).toString(\"hex\");\n    const entry = options.entry ?? resolveCliEntry();\n\n    const spawnPlan = options.spawn ?? resolveSpawn(entry);\n    const args = [\n        ...spawnPlan.prefixArgs,\n        entry,\n        \"__dev-db-daemon\",\n        \"--project\", projectRoot,\n        \"--port\", String(port),\n        \"--token\", token\n    ];\n    if (options.idleTimeoutMs !== undefined) {\n        args.push(\"--idle-timeout\", String(options.idleTimeoutMs));\n    }\n\n    const log = fs.openSync(path.join(devDbDir(projectRoot), \"pglite.log\"), \"a\");\n    const child: ChildProcess = spawn(spawnPlan.execPath, args, {\n        // Detached with no stdin and its output on a file: the daemon must\n        // survive the command that started it, and must not hold the terminal\n        // open when that command exits.\n        detached: true,\n        stdio: [\"ignore\", log, log]\n    });\n    child.unref();\n\n    try {\n        const deadline = Date.now() + START_TIMEOUT_MS;\n        let announced = false;\n        while (Date.now() < deadline) {\n            const state = readState(projectRoot);\n            if (state && (await isDaemonAlive(state))) return adopt(state, true);\n\n            if (!announced && !options.quiet) {\n                announced = true;\n                options.onProgress?.(\"Starting the development database…\");\n            }\n\n            // A daemon that died on startup will never publish a state file, and\n            // waiting the full minute for that is a bad way to learn it. The log\n            // is the only place the reason exists.\n            if (child.exitCode !== null && child.exitCode !== 0) {\n                throw new Error(\n                    `The development database failed to start (exit ${child.exitCode}).\\n` +\n                    `  See ${path.join(devDbDir(projectRoot), \"pglite.log\")} for the reason.`\n                );\n            }\n\n            await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n        }\n\n        throw new Error(\n            `The development database did not start within ${Math.round(START_TIMEOUT_MS / 1000)}s.\\n` +\n            `  See ${path.join(devDbDir(projectRoot), \"pglite.log\")} for the reason.\\n` +\n            \"  To use your own Postgres instead, set DATABASE_URL or pass --database-url.\"\n        );\n    } finally {\n        // Released whether we succeeded, timed out or threw. A lock left behind\n        // by a crash is broken by age, but only after a full timeout — which a\n        // developer should never have to wait out.\n        releaseStartLock(projectRoot);\n    }\n}\n\n/** Shape a live state record as the caller's result. */\nfunction adopt(state: DaemonState, started: boolean): ManagedDatabase {\n    return {\n        url: managedUrl(state.port),\n        dataDir: state.dataDir,\n        port: state.port,\n        pid: state.pid,\n        started\n    };\n}\n\n/** Poll until another process publishes a live daemon, or give up. */\nasync function waitForDaemon(projectRoot: string, timeoutMs: number): Promise<DaemonState | null> {\n    const deadline = Date.now() + timeoutMs;\n    while (Date.now() < deadline) {\n        const state = readState(projectRoot);\n        if (state && (await isDaemonAlive(state))) return state;\n        await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n    }\n\n    return null;\n}\n\n/** Stop the daemon. Returns false when there was nothing running. */\nexport async function stopManagedDatabase(projectRoot: string): Promise<boolean> {\n    const state = await findRunningDaemon(projectRoot);\n    if (!state) return false;\n\n    try {\n        process.kill(state.pid, \"SIGTERM\");\n    } catch {\n        clearState(projectRoot);\n\n        return false;\n    }\n\n    // Wait for it to clear its own state file, which is how it says it closed\n    // the data directory cleanly. A hard kill here would risk the WAL.\n    const deadline = Date.now() + 10_000;\n    while (Date.now() < deadline) {\n        if (!fs.existsSync(stateFile(projectRoot))) return true;\n        await new Promise((resolve) => setTimeout(resolve, 100));\n    }\n\n    clearState(projectRoot);\n\n    return true;\n}\n\n/**\n * Stop the daemon and delete the data directory.\n *\n * Destructive and deliberately not clever: it removes the whole directory\n * rather than dropping schemas, because \"give me an empty database\" is the only\n * thing anyone means by it.\n */\nexport async function resetManagedDatabase(projectRoot: string): Promise<void> {\n    await stopManagedDatabase(projectRoot);\n    fs.rmSync(dataDir(projectRoot), { recursive: true, force: true });\n    clearState(projectRoot);\n}\n\n/**\n * Keep the generated directory out of git.\n *\n * `.rebase/` holds a Postgres data directory and a log. A project that commits\n * it will push hundreds of megabytes and a database that only makes sense on\n * one machine, so the ignore file is written next to the data rather than\n * relying on the project's root `.gitignore` having been updated.\n */\nfunction ensureGitignore(projectRoot: string): void {\n    const target = path.join(devDbDir(projectRoot), \".gitignore\");\n    if (fs.existsSync(target)) return;\n    fs.writeFileSync(\n        target,\n        \"# Generated by `rebase dev` — a local Postgres data directory and its log.\\n\" +\n        \"# Machine-specific and large; never commit it.\\n*\\n\",\n        \"utf8\"\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAM,mBAAmB;;AAEzB,IAAM,mBAAmB;;AAEzB,IAAM,sBAAsB;;;;;;;AAmB5B,IAAM,eAAe;AACrB,IAAM,mBAAmB;AAEzB,SAAgB,WAAW,MAAsB;CAC7C,OAAO,gBAAgB,aAAa,aAAa,KAAK,GAAG;AAC7D;;;;;;;;;AAUA,SAAgB,cAAc,OAAsC;CAChE,IAAI,CAAC,WAAW,MAAM,GAAG,GAAG,OAAO,QAAQ,QAAQ,KAAK;CAExD,OAAO,IAAI,SAAS,YAAY;EAC5B,MAAM,SAAS,IAAI,IAAI,OAAO;EAC9B,IAAI,SAAS;EACb,MAAM,UAAU,UAAmB;GAC/B,OAAO,mBAAmB;GAC1B,OAAO,QAAQ;GACf,QAAQ,KAAK;EACjB;EACA,OAAO,WAAW,mBAAmB;EACrC,OAAO,KAAK,iBAAiB,OAAO,KAAK,CAAC;EAC1C,OAAO,KAAK,eAAe,OAAO,KAAK,CAAC;EACxC,OAAO,GAAG,SAAS,UAAU;GACzB,UAAU,MAAM,SAAS,MAAM;GAC/B,IAAI,OAAO,SAAS,IAAI,GAAG,OAAO,OAAO,KAAK,MAAM,iBAAiB,MAAM,OAAO;EACtF,CAAC;EACD,OAAO,KAAK,eAAe,OAAO,OAAO,KAAK,MAAM,iBAAiB,MAAM,OAAO,CAAC;EACnF,OAAO,QAAQ,MAAM,cAAc,WAAW;CAClD,CAAC;AACL;;AAGA,eAAsB,kBAAkB,aAAkD;CACtF,MAAM,QAAQ,UAAU,WAAW;CACnC,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO;CAKvC,WAAW,WAAW;CAEtB,OAAO;AACX;;;;;;;;;AAUA,SAAS,kBAA0B;CAI/B,MAAM,YAAY,QAAQ,KAAK;CAC/B,IAAI,aAAa,GAAG,WAAW,SAAS,GAAG,OAAO;CAElD,OAAO,cAAc,IAAA,IAAA,unCAAA,KAAA,OAAA,KAAA,GAAA,CAAuC;AAChE;;;;;;;;;;;AAYA,SAAgB,aAAa,OAA2D;CACpF,IAAI,CAAC,aAAa,KAAK,KAAK,GAAG,OAAO;EAAE,UAAU,QAAQ;EAAU,YAAY,CAAC;CAAE;CAKnF,OAAO;EAAE,UAAU,QAAQ;EAAU,YAAY,CAAC,YAAY,KAAK;CAAE;AACzE;;;;;;;;AA4BA,eAAsB,sBAClB,aACA,UAAyB,CAAC,GACF;CACxB,MAAM,WAAW,MAAM,kBAAkB,WAAW;CACpD,IAAI,UAAU,OAAO,MAAM,UAAU,KAAK;CAE1C,GAAG,UAAU,SAAS,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CACvD,gBAAgB,WAAW;CAM3B,IAAI,CAAC,iBAAiB,aAAa,gBAAgB,GAAG;EAClD,MAAM,UAAU,MAAM,cAAc,aAAa,gBAAgB;EACjE,IAAI,SAAS,OAAO,MAAM,SAAS,KAAK;EAKxC,IAAI,CAAC,iBAAiB,aAAa,CAAC,GAChC,MAAM,IAAI,MACN;WACY,KAAK,KAAK,SAAS,WAAW,GAAG,eAAe,EAAE,wBAClE;CAER;CAEA,MAAM,OAAO,MAAM,aAAa;CAChC,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAC5C,MAAM,QAAQ,QAAQ,SAAS,gBAAgB;CAE/C,MAAM,YAAY,QAAQ,SAAS,aAAa,KAAK;CACrD,MAAM,OAAO;EACT,GAAG,UAAU;EACb;EACA;EACA;EAAa;EACb;EAAU,OAAO,IAAI;EACrB;EAAW;CACf;CACA,IAAI,QAAQ,kBAAkB,KAAA,GAC1B,KAAK,KAAK,kBAAkB,OAAO,QAAQ,aAAa,CAAC;CAG7D,MAAM,MAAM,GAAG,SAAS,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,GAAG,GAAG;CAC3E,MAAM,QAAsB,MAAM,UAAU,UAAU,MAAM;EAIxD,UAAU;EACV,OAAO;GAAC;GAAU;GAAK;EAAG;CAC9B,CAAC;CACD,MAAM,MAAM;CAEZ,IAAI;EACA,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,YAAY;EAChB,OAAO,KAAK,IAAI,IAAI,UAAU;GAC1B,MAAM,QAAQ,UAAU,WAAW;GACnC,IAAI,SAAU,MAAM,cAAc,KAAK,GAAI,OAAO,MAAM,OAAO,IAAI;GAEnE,IAAI,CAAC,aAAa,CAAC,QAAQ,OAAO;IAC9B,YAAY;IACZ,QAAQ,aAAa,oCAAoC;GAC7D;GAKA,IAAI,MAAM,aAAa,QAAQ,MAAM,aAAa,GAC9C,MAAM,IAAI,MACN,kDAAkD,MAAM,SAAS,YACxD,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,EAAE,iBAC5D;GAGJ,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,gBAAgB,CAAC;EACxE;EAEA,MAAM,IAAI,MACN,iDAAiD,KAAK,MAAM,mBAAmB,GAAI,EAAE,YAC5E,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,EAAE,+FAE5D;CACJ,UAAU;EAIN,iBAAiB,WAAW;CAChC;AACJ;;AAGA,SAAS,MAAM,OAAoB,SAAmC;CAClE,OAAO;EACH,KAAK,WAAW,MAAM,IAAI;EAC1B,SAAS,MAAM;EACf,MAAM,MAAM;EACZ,KAAK,MAAM;EACX;CACJ;AACJ;;AAGA,eAAe,cAAc,aAAqB,WAAgD;CAC9F,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC1B,MAAM,QAAQ,UAAU,WAAW;EACnC,IAAI,SAAU,MAAM,cAAc,KAAK,GAAI,OAAO;EAClD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,gBAAgB,CAAC;CACxE;CAEA,OAAO;AACX;;AAGA,eAAsB,oBAAoB,aAAuC;CAC7E,MAAM,QAAQ,MAAM,kBAAkB,WAAW;CACjD,IAAI,CAAC,OAAO,OAAO;CAEnB,IAAI;EACA,QAAQ,KAAK,MAAM,KAAK,SAAS;CACrC,QAAQ;EACJ,WAAW,WAAW;EAEtB,OAAO;CACX;CAIA,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC1B,IAAI,CAAC,GAAG,WAAW,UAAU,WAAW,CAAC,GAAG,OAAO;EACnD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;CAC3D;CAEA,WAAW,WAAW;CAEtB,OAAO;AACX;;;;;;;;AASA,eAAsB,qBAAqB,aAAoC;CAC3E,MAAM,oBAAoB,WAAW;CACrC,GAAG,OAAO,QAAQ,WAAW,GAAG;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAChE,WAAW,WAAW;AAC1B;;;;;;;;;AAUA,SAAS,gBAAgB,aAA2B;CAChD,MAAM,SAAS,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY;CAC5D,IAAI,GAAG,WAAW,MAAM,GAAG;CAC3B,GAAG,cACC,QACA,mIAEA,MACJ;AACJ"}