@rebasepro/cli 0.17.3 → 0.18.0

package/dist/dev-db/resolve.d.ts

@@ -11,9 +11,10 @@
  *
  *   1. `--database-url <url>`   — said on this command line, wins over everything
  *   2. `DATABASE_URL` in the shell environment
- *   3. `DATABASE_URL` in the project's `.env`
- *   4. `--docker` / a manifest preference of `docker`
- *   5. the managed PGlite database
+ *   3. the database branch this checkout is switched to
+ *   4. `DATABASE_URL` in the project's `.env`
+ *   5. `--docker` / a manifest preference of `docker`
+ *   6. the managed PGlite database
  *
  * An explicit connection string always wins. That is the whole point of the
  * override: someone pointing Rebase at their own Postgres — a colleague's
@@ -21,9 +22,17 @@
  * with no cleverness in between. The managed database is what fills the vacuum
  * when nobody has said anything, and it is the only case where the CLI picks.
  *
+ * The branch at (3) is the one addition that is not an explicit connection
+ * string, and it sits where it does deliberately. It has to outrank `.env` or
+ * `rebase db branch switch` would silently do nothing on every project that
+ * sets `DATABASE_URL` — which is every project not on the managed database.
+ * It must not outrank (1) or (2), because a flag on this command line and a
+ * variable in this shell are more immediate than a switch made yesterday.
+ *
  * {@link resolveDevDatabase} is pure: inputs in, decision out, no filesystem
- * and no process. Reading `.env` and starting a daemon happen elsewhere, so
- * the ordering above can be tested without either.
+ * and no process. Reading `.env`, reading the branch pointer and starting a
+ * daemon happen elsewhere, so the ordering above can be tested without any of
+ * them.
  */
 /** Where the answer came from. Carried so diagnostics can name it. */
 export type DevDatabaseSource = 
@@ -33,6 +42,8 @@ export type DevDatabaseSource =
  | "environment"
 /** `DATABASE_URL` in the project's `.env`. */
  | "env-file"
+/** The branch this checkout is switched to, over the base connection. */
+ | "branch"
 /** `--docker`, or `devDatabase: "docker"` in the manifest. */
  | "docker"
 /** Nobody said anything, so the managed database fills in. */
@@ -41,10 +52,20 @@ export type DevDatabase = {
     kind: "external";
     /** The connection string, exactly as given. Never rewritten. */
     url: string;
-    source: Extract<DevDatabaseSource, "flag" | "environment" | "env-file">;
+    source: Extract<DevDatabaseSource, "flag" | "environment" | "env-file" | "branch">;
+    /** The branch name, when this checkout is switched to one. */
+    branch?: string;
 } | {
     kind: "docker";
     source: "docker";
+    /**
+     * The compose `db` service's connection string, derived by the caller.
+     *
+     * Null when the project has no compose file to derive one from, which
+     * is a `--docker` that cannot be honoured rather than a fallback: the
+     * caller says so instead of guessing at `localhost:5432`.
+     */
+    url: string | null;
 } | {
     kind: "managed";
     source: "managed";
@@ -60,6 +81,24 @@ export interface ResolveDevDatabaseInput {
     envFile?: Record<string, string> | null;
     /** `devDatabase` from `rebase.json`, if the project recorded a preference. */
     manifestPreference?: "managed" | "docker" | null;
+    /**
+     * The compose `db` service's connection string, when the project has one.
+     *
+     * Passed in rather than read here so this function stays pure. Only
+     * consulted for the Docker case; an explicit `DATABASE_URL` still wins.
+     */
+    composeUrl?: string | null;
+    /**
+     * The branch this checkout is switched to, already resolved to a URL.
+     *
+     * Resolved by the caller rather than here so this stays pure: deriving it
+     * needs the base connection string, which needs the `.env` this function is
+     * handed rather than reads.
+     */
+    branch?: {
+        name: string;
+        url: string;
+    } | null;
 }
 export declare function resolveDevDatabase(input?: ResolveDevDatabaseInput): DevDatabase;
 /** One line for the startup banner, naming both the database and why. */

package/dist/dev-db/state.d.ts

@@ -49,9 +49,30 @@ export interface DaemonState {
     token: string;
     /** Loopback port that answers the identity check. */
     identityPort: number;
+    /**
+     * The additional databases this daemon serves, by declared key.
+     *
+     * One PGlite instance each — PGlite is one database per instance, so
+     * `database("analytics")` is a second data directory and a second port,
+     * not a `CREATE DATABASE`. Started on demand when a command asks for the
+     * key over the identity socket, and recorded here so `rebase status` and
+     * a reset can see them. The default database is the fields above.
+     */
+    databases?: Record<string, {
+        port: number;
+        dataDir: string;
+    }>;
 }
 export declare function devDbDir(projectRoot: string): string;
 export declare function dataDir(projectRoot: string): string;
+/**
+ * The data directory for an additional declared database.
+ *
+ * `pgdata__analytics`: the key spelled the way its variable is, so the
+ * directory beside `pgdata` and `DATABASE_URL__ANALYTICS` are visibly the
+ * same thing.
+ */
+export declare function additionalDataDir(projectRoot: string, key: string): string;
 export declare function stateFile(projectRoot: string): string;
 export declare function startLockFile(projectRoot: string): string;
 /**

package/dist/dev-preflight-CNLl4rdo.js

@@ -0,0 +1,367 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import chalk from "chalk";
+import path from "path";
+import fs from "fs";
+import net from "net";
+import { execa } from "execa";
+//#region src/utils/dev-preflight.ts
+/**
+* Make `rebase dev` the only command a new project needs.
+*
+* The scaffolded project prints three steps — start the database container,
+* push the schema, start the dev server — and a first-time reader has to
+* perform all three correctly before anything works. Two of them are
+* mechanical, and both fail in ways that do not name themselves: skipping the
+* container gives `ECONNREFUSED` from a stack the reader has never seen, and
+* skipping the push gives a server that starts cleanly and then 500s on the
+* first request because the tables are not there.
+*
+* So `dev` does them. Not always, and not silently — under four conditions that
+* together mean "this is a throwaway development database on this laptop, and
+* it is not running":
+*
+*   1. The DSN resolves to a loopback address. A remote database is somebody's
+*      real data and is never touched here, whatever else is true.
+*   2. Nothing is listening on it. A database that answers is left completely
+*      alone — no push, no inspection, no connection.
+*   3. The project has a `docker-compose.yml` declaring a `db` service, i.e.
+*      the one `rebase init` wrote. Without it there is nothing to start and
+*      the backend's own error is the better message.
+*   4. Docker is available. If it is not, the manual steps are printed and dev
+*      continues — a preflight must never be the reason the command fails.
+*
+* The schema push happens only when this function actually started the
+* container, which is the one moment a local database is known to be new or
+* stale relative to the collections. A `dev` against an already-running
+* database never mutates its schema.
+*/
+var dev_preflight_exports = /* @__PURE__ */ __exportAll({
+	composeDatabaseUrl: () => composeDatabaseUrl,
+	composeDeclaresDbService: () => composeDeclaresDbService,
+	composeHostPort: () => composeHostPort,
+	ensureDevDatabase: () => ensureDevDatabase,
+	parseLoopbackDsn: () => parseLoopbackDsn,
+	probeTcp: () => probeTcp,
+	waitForPort: () => waitForPort
+});
+/**
+* Hosts that mean "this machine", and so may be provisioned automatically.
+*
+* An exact-match set, never a prefix or substring test: `localhost.example.com`
+* is a perfectly resolvable name that somebody else controls.
+*/
+var LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"0.0.0.0"
+]);
+/**
+* The host and port of a Postgres DSN, but only when it points at this machine.
+*
+* Returns null for anything else — a remote host, an unparseable string, a
+* non-postgres scheme. Callers treat null as "do nothing", so every parse
+* failure fails closed onto the safe behaviour rather than onto a guess.
+*/
+function parseLoopbackDsn(dsn) {
+	if (!dsn) return null;
+	let url;
+	try {
+		url = new URL(dsn);
+	} catch {
+		return null;
+	}
+	if (!/^postgres(ql)?:$/.test(url.protocol)) return null;
+	const host = url.hostname.replace(/^\[(.+)\]$/, "$1");
+	if (!LOOPBACK.has(host)) return null;
+	const port = url.port ? Number(url.port) : 5432;
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+	return {
+		host,
+		port
+	};
+}
+/**
+* Whether a compose file declares a `db` service.
+*
+* Deliberately a text scan and not a YAML parse: the CLI has no YAML
+* dependency, and the question is only ever asked of a file this tool wrote.
+* A false negative costs the automation and nothing else — the reader gets the
+* manual steps, which are correct.
+*/
+function composeDeclaresDbService(yamlText) {
+	let inServices = false;
+	for (const rawLine of yamlText.split(/\r?\n/)) {
+		const line = rawLine.replace(/\t/g, "    ");
+		if (/^\s*#/.test(line) || line.trim() === "") continue;
+		if (/^services:\s*$/.test(line)) {
+			inServices = true;
+			continue;
+		}
+		if (inServices && /^\S/.test(line)) {
+			inServices = false;
+			continue;
+		}
+		if (inServices && /^\s{2,}db:\s*$/.test(line)) return true;
+	}
+	return false;
+}
+/**
+* The connection string the compose file's `db` service will answer on.
+*
+* `--docker` used to be a flag that changed a banner and nothing else: it
+* resolved to `kind: "docker"`, and every caller then had no URL to reach the
+* container with, so the backend booted with no `DATABASE_URL` at all and died
+* on the message a project with no database gets. The container it had just
+* been asked for was never started, because the preflight that starts it needs
+* a DSN to decide the database is local and not running.
+*
+* So the URL is derived rather than required: the compose file names the user,
+* the database and the published host port, and `.env` holds the password
+* compose itself interpolates. That is the same string `rebase init` writes as
+* the commented-out `DATABASE_URL`, which is what makes uncommenting that line
+* and passing `--docker` reach the same database.
+*
+* Returns null when the file declares no `db` service, or declares one this
+* scan cannot read — a `--docker` that cannot be honoured has to say so, and
+* a guess would point at somebody else's Postgres on 5432.
+*
+* Same text scan as {@link composeDeclaresDbService}, for the same reason.
+*/
+function composeDatabaseUrl(yamlText, env = {}) {
+	const found = scanComposeDbService(yamlText);
+	const user = expandComposeValue(found.POSTGRES_USER, env);
+	const password = expandComposeValue(found.POSTGRES_PASSWORD, env);
+	const database = expandComposeValue(found.POSTGRES_DB, env);
+	if (!user || !password || !database || !found.hostPort) return null;
+	return `postgresql://${encodeURIComponent(user)}:${encodeURIComponent(password)}@127.0.0.1:${found.hostPort}/${database}?options=-c%20search_path%3Dpublic&sslmode=disable`;
+}
+/**
+* The host port the compose `db` service publishes, or null.
+*
+* Separate from {@link composeDatabaseUrl} because the port is answerable on
+* its own: the URL needs the user, the password and the database name too, and
+* a compose file missing any of them still says which port a container would
+* listen on. That is the question "would starting this container answer the
+* DSN in `.env`?" — see the `wrong-port` branch of {@link ensureDevDatabase},
+* where getting it wrong meant starting a container nobody asked for.
+*/
+function composeHostPort(yamlText) {
+	const port = scanComposeDbService(yamlText).hostPort;
+	return port ? Number(port) : null;
+}
+/** The raw values of the compose `db` service, before any expansion. */
+function scanComposeDbService(yamlText) {
+	let inServices = false;
+	let inDb = false;
+	let dbIndent = 0;
+	let section = null;
+	const found = {};
+	let hostPort = null;
+	for (const rawLine of yamlText.split(/\r?\n/)) {
+		const line = rawLine.replace(/\t/g, "    ");
+		if (/^\s*#/.test(line) || line.trim() === "") continue;
+		if (/^services:\s*$/.test(line)) {
+			inServices = true;
+			continue;
+		}
+		if (inServices && /^\S/.test(line)) {
+			inServices = false;
+			inDb = false;
+			continue;
+		}
+		if (!inServices) continue;
+		const indent = line.length - line.trimStart().length;
+		const dbHeader = line.match(/^(\s{2,})db:\s*$/);
+		if (dbHeader) {
+			inDb = true;
+			dbIndent = dbHeader[1].length;
+			section = null;
+			continue;
+		}
+		if (inDb && indent <= dbIndent) {
+			inDb = false;
+			section = null;
+			continue;
+		}
+		if (!inDb) continue;
+		const key = line.match(/^\s+(environment|ports):\s*$/);
+		if (key) {
+			section = key[1];
+			continue;
+		}
+		if (/^\s+[A-Za-z_][\w-]*:\s*\S/.test(line) && !/^\s+POSTGRES_/.test(line)) {
+			if (!/^\s*-\s/.test(line.trimStart())) section = null;
+		}
+		if (section === "environment") {
+			const pair = line.match(/^\s+(POSTGRES_(?:USER|PASSWORD|DB)):\s*(.+?)\s*$/);
+			if (pair) found[pair[1]] = pair[2].replace(/^["']|["']$/g, "");
+			continue;
+		}
+		if (section === "ports" && hostPort === null) {
+			const mapping = line.match(/^\s*-\s*["']?(?:[\d.]+:)?(\d+):5432(?:\/tcp)?["']?\s*$/);
+			if (mapping) hostPort = mapping[1];
+		}
+	}
+	return hostPort === null ? found : {
+		...found,
+		hostPort
+	};
+}
+/**
+* `${VAR:-default}`, `${VAR}` and a literal, resolved the way compose resolves
+* them — against the project's `.env`, which is the file compose itself reads.
+*/
+function expandComposeValue(raw, env) {
+	if (!raw) return null;
+	const trimmed = raw.replace(/\$\{([A-Za-z_][\w]*)(?::?-([^}]*))?\}/g, (_all, name, fallback) => {
+		const value = env[name];
+		if (value !== void 0 && value !== "") return value;
+		return fallback ?? "";
+	}).trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+/** Is something accepting connections there right now? */
+function probeTcp(host, port, timeoutMs = 700) {
+	return new Promise((resolve) => {
+		const socket = new net.Socket();
+		let settled = false;
+		const done = (open) => {
+			if (settled) return;
+			settled = true;
+			socket.destroy();
+			resolve(open);
+		};
+		socket.setTimeout(timeoutMs);
+		socket.once("connect", () => done(true));
+		socket.once("timeout", () => done(false));
+		socket.once("error", () => done(false));
+		socket.connect(port, host);
+	});
+}
+/**
+* Poll until the port answers, or give up.
+*
+* Postgres publishes its port before it is ready to accept queries, so the
+* caller still has to tolerate a first connection that is refused at the
+* protocol level. This only answers "has the container got as far as listening",
+* which is the part that takes the seconds.
+*/
+async function waitForPort(host, port, timeoutMs = 6e4, intervalMs = 500) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (await probeTcp(host, port, 700)) return true;
+		await new Promise((resolve) => setTimeout(resolve, intervalMs));
+	}
+	return false;
+}
+/**
+* Start the project's development database if it is not running, and give it a
+* schema if this call is what started it.
+*/
+async function ensureDevDatabase(options) {
+	const { projectRoot, databaseUrl, disabled, hasCollections, pushSchema } = options;
+	const log = options.log ?? ((message) => console.log(message));
+	if (disabled) return { action: "disabled" };
+	const target = parseLoopbackDsn(databaseUrl);
+	if (!databaseUrl) return { action: "no-dsn" };
+	if (!target) {
+		let host = "the configured host";
+		try {
+			host = new URL(databaseUrl).hostname || host;
+		} catch {}
+		return {
+			action: "remote-dsn",
+			host
+		};
+	}
+	if (await probeTcp(target.host, target.port)) return {
+		action: "already-running",
+		host: target.host,
+		port: target.port
+	};
+	const composePath = path.join(projectRoot, "docker-compose.yml");
+	if (!fs.existsSync(composePath)) return { action: "no-compose" };
+	const composeText = fs.readFileSync(composePath, "utf8");
+	if (!composeDeclaresDbService(composeText)) return { action: "no-compose" };
+	const manualSteps = `${chalk.cyan("docker compose up -d db")} then ${chalk.cyan("rebase db push")}`;
+	const composePort = composeHostPort(composeText);
+	if (composePort !== null && composePort !== target.port) {
+		const hint = `DATABASE_URL points at ${target.host}:${target.port} and nothing listens there. The compose file's db service publishes ${composePort}, so starting it would not answer that URL — nothing was started. Either correct the port in .env, or point DATABASE_URL at 127.0.0.1:${composePort}.`;
+		log("");
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+		return {
+			action: "wrong-port",
+			hint,
+			port: target.port,
+			composePort
+		};
+	}
+	log("");
+	log(`  ${chalk.gray("Database not running — starting it…")}`);
+	const startDatabase = options.startDatabase ?? (async (root) => {
+		await execa("docker", [
+			"compose",
+			"up",
+			"-d",
+			"db"
+		], {
+			cwd: root,
+			stdio: "pipe"
+		});
+	});
+	try {
+		await startDatabase(projectRoot);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		if (/ENOENT|not found|command not found/i.test(message)) {
+			const hint = `Docker was not found. Start a Postgres yourself, then run ${manualSteps}.`;
+			log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+			return {
+				action: "no-docker",
+				hint
+			};
+		}
+		const hint = `Could not start the database container. Run ${manualSteps} to see why.`;
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+		return {
+			action: "start-failed",
+			hint
+		};
+	}
+	if (!await waitForPort(target.host, target.port)) {
+		const hint = `The database container did not begin listening on port ${target.port}. Run ${manualSteps} to see why.`;
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+		return {
+			action: "start-failed",
+			hint
+		};
+	}
+	log(`  ${chalk.green("✓")} ${chalk.gray(`Database ready on port ${target.port}`)}`);
+	if (!hasCollections) return {
+		action: "started",
+		port: target.port,
+		pushed: false
+	};
+	log(`  ${chalk.gray("Pushing the schema…")}`);
+	try {
+		await pushSchema();
+		log(`  ${chalk.green("✓")} ${chalk.gray("Schema pushed")}`);
+		return {
+			action: "started",
+			port: target.port,
+			pushed: true
+		};
+	} catch {
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(`Schema push failed. The database is running; fix the error above and run ${chalk.cyan("rebase db push")}.`)}`);
+		return {
+			action: "started",
+			port: target.port,
+			pushed: false
+		};
+	}
+}
+//#endregion
+export { probeTcp as i, dev_preflight_exports as n, ensureDevDatabase as r, composeDatabaseUrl as t };
+
+//# sourceMappingURL=dev-preflight-CNLl4rdo.js.map

package/dist/dev-preflight-CNLl4rdo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-preflight-CNLl4rdo.js","names":[],"sources":["../src/utils/dev-preflight.ts"],"sourcesContent":["/**\n * Make `rebase dev` the only command a new project needs.\n *\n * The scaffolded project prints three steps — start the database container,\n * push the schema, start the dev server — and a first-time reader has to\n * perform all three correctly before anything works. Two of them are\n * mechanical, and both fail in ways that do not name themselves: skipping the\n * container gives `ECONNREFUSED` from a stack the reader has never seen, and\n * skipping the push gives a server that starts cleanly and then 500s on the\n * first request because the tables are not there.\n *\n * So `dev` does them. Not always, and not silently — under four conditions that\n * together mean \"this is a throwaway development database on this laptop, and\n * it is not running\":\n *\n *   1. The DSN resolves to a loopback address. A remote database is somebody's\n *      real data and is never touched here, whatever else is true.\n *   2. Nothing is listening on it. A database that answers is left completely\n *      alone — no push, no inspection, no connection.\n *   3. The project has a `docker-compose.yml` declaring a `db` service, i.e.\n *      the one `rebase init` wrote. Without it there is nothing to start and\n *      the backend's own error is the better message.\n *   4. Docker is available. If it is not, the manual steps are printed and dev\n *      continues — a preflight must never be the reason the command fails.\n *\n * The schema push happens only when this function actually started the\n * container, which is the one moment a local database is known to be new or\n * stale relative to the collections. A `dev` against an already-running\n * database never mutates its schema.\n */\nimport fs from \"fs\";\nimport net from \"net\";\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { execa } from \"execa\";\n\n/** Where the preflight stopped, and why. Returned so tests can assert it. */\nexport type PreflightOutcome =\n    | { action: \"disabled\" }\n    | { action: \"no-dsn\" }\n    | { action: \"remote-dsn\"; host: string }\n    | { action: \"already-running\"; host: string; port: number }\n    | { action: \"no-compose\" }\n    | { action: \"no-docker\"; hint: string }\n    | { action: \"start-failed\"; hint: string }\n    | { action: \"wrong-port\"; hint: string; port: number; composePort: number }\n    | { action: \"started\"; port: number; pushed: boolean };\n\n/**\n * Hosts that mean \"this machine\", and so may be provisioned automatically.\n *\n * An exact-match set, never a prefix or substring test: `localhost.example.com`\n * is a perfectly resolvable name that somebody else controls.\n */\nconst LOOPBACK = new Set([\"localhost\", \"127.0.0.1\", \"::1\", \"0.0.0.0\"]);\n\n/**\n * The host and port of a Postgres DSN, but only when it points at this machine.\n *\n * Returns null for anything else — a remote host, an unparseable string, a\n * non-postgres scheme. Callers treat null as \"do nothing\", so every parse\n * failure fails closed onto the safe behaviour rather than onto a guess.\n */\nexport function parseLoopbackDsn(dsn: string | undefined): { host: string; port: number } | null {\n    if (!dsn) return null;\n\n    let url: URL;\n    try {\n        url = new URL(dsn);\n    } catch {\n        return null;\n    }\n\n    if (!/^postgres(ql)?:$/.test(url.protocol)) return null;\n\n    // `url.hostname` KEEPS the brackets an IPv6 literal carries in a URL, and\n    // `net.connect` rejects them. Normalising here rather than at each use is\n    // what stops the two representations diverging: everything downstream gets\n    // a host it can dial.\n    const host = url.hostname.replace(/^\\[(.+)\\]$/, \"$1\");\n    if (!LOOPBACK.has(host)) return null;\n\n    const port = url.port ? Number(url.port) : 5432;\n    if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;\n\n    return { host, port };\n}\n\n/**\n * Whether a compose file declares a `db` service.\n *\n * Deliberately a text scan and not a YAML parse: the CLI has no YAML\n * dependency, and the question is only ever asked of a file this tool wrote.\n * A false negative costs the automation and nothing else — the reader gets the\n * manual steps, which are correct.\n */\nexport function composeDeclaresDbService(yamlText: string): boolean {\n    let inServices = false;\n    for (const rawLine of yamlText.split(/\\r?\\n/)) {\n        const line = rawLine.replace(/\\t/g, \"    \");\n        if (/^\\s*#/.test(line) || line.trim() === \"\") continue;\n\n        if (/^services:\\s*$/.test(line)) {\n            inServices = true;\n            continue;\n        }\n        // Any other zero-indent key ends the services block.\n        if (inServices && /^\\S/.test(line)) {\n            inServices = false;\n            continue;\n        }\n        if (inServices && /^\\s{2,}db:\\s*$/.test(line)) return true;\n    }\n    return false;\n}\n\n/**\n * The connection string the compose file's `db` service will answer on.\n *\n * `--docker` used to be a flag that changed a banner and nothing else: it\n * resolved to `kind: \"docker\"`, and every caller then had no URL to reach the\n * container with, so the backend booted with no `DATABASE_URL` at all and died\n * on the message a project with no database gets. The container it had just\n * been asked for was never started, because the preflight that starts it needs\n * a DSN to decide the database is local and not running.\n *\n * So the URL is derived rather than required: the compose file names the user,\n * the database and the published host port, and `.env` holds the password\n * compose itself interpolates. That is the same string `rebase init` writes as\n * the commented-out `DATABASE_URL`, which is what makes uncommenting that line\n * and passing `--docker` reach the same database.\n *\n * Returns null when the file declares no `db` service, or declares one this\n * scan cannot read — a `--docker` that cannot be honoured has to say so, and\n * a guess would point at somebody else's Postgres on 5432.\n *\n * Same text scan as {@link composeDeclaresDbService}, for the same reason.\n */\nexport function composeDatabaseUrl(\n    yamlText: string,\n    env: Record<string, string | undefined> = {}\n): string | null {\n    const found = scanComposeDbService(yamlText);\n\n    const user = expandComposeValue(found.POSTGRES_USER, env);\n    const password = expandComposeValue(found.POSTGRES_PASSWORD, env);\n    const database = expandComposeValue(found.POSTGRES_DB, env);\n    if (!user || !password || !database || !found.hostPort) return null;\n\n    return `postgresql://${encodeURIComponent(user)}:${encodeURIComponent(password)}` +\n        `@127.0.0.1:${found.hostPort}/${database}?options=-c%20search_path%3Dpublic&sslmode=disable`;\n}\n\n/**\n * The host port the compose `db` service publishes, or null.\n *\n * Separate from {@link composeDatabaseUrl} because the port is answerable on\n * its own: the URL needs the user, the password and the database name too, and\n * a compose file missing any of them still says which port a container would\n * listen on. That is the question \"would starting this container answer the\n * DSN in `.env`?\" — see the `wrong-port` branch of {@link ensureDevDatabase},\n * where getting it wrong meant starting a container nobody asked for.\n */\nexport function composeHostPort(yamlText: string): number | null {\n    const port = scanComposeDbService(yamlText).hostPort;\n\n    return port ? Number(port) : null;\n}\n\n/** The raw values of the compose `db` service, before any expansion. */\nfunction scanComposeDbService(yamlText: string): Record<string, string> & { hostPort?: string } {\n    let inServices = false;\n    let inDb = false;\n    let dbIndent = 0;\n    let section: \"environment\" | \"ports\" | null = null;\n    const found: Record<string, string> = {};\n    let hostPort: string | null = null;\n\n    for (const rawLine of yamlText.split(/\\r?\\n/)) {\n        const line = rawLine.replace(/\\t/g, \"    \");\n        if (/^\\s*#/.test(line) || line.trim() === \"\") continue;\n\n        if (/^services:\\s*$/.test(line)) { inServices = true; continue; }\n        if (inServices && /^\\S/.test(line)) { inServices = false; inDb = false; continue; }\n        if (!inServices) continue;\n\n        const indent = line.length - line.trimStart().length;\n        const dbHeader = line.match(/^(\\s{2,})db:\\s*$/);\n        if (dbHeader) { inDb = true; dbIndent = dbHeader[1].length; section = null; continue; }\n        // A sibling service at the same indent as `db:` ends it.\n        if (inDb && indent <= dbIndent) { inDb = false; section = null; continue; }\n        if (!inDb) continue;\n\n        const key = line.match(/^\\s+(environment|ports):\\s*$/);\n        if (key) { section = key[1] as \"environment\" | \"ports\"; continue; }\n        // Any other key of the service ends the block we were reading.\n        if (/^\\s+[A-Za-z_][\\w-]*:\\s*\\S/.test(line) && !/^\\s+POSTGRES_/.test(line)) {\n            if (!/^\\s*-\\s/.test(line.trimStart())) section = null;\n        }\n\n        if (section === \"environment\") {\n            const pair = line.match(/^\\s+(POSTGRES_(?:USER|PASSWORD|DB)):\\s*(.+?)\\s*$/);\n            if (pair) found[pair[1]] = pair[2].replace(/^[\"']|[\"']$/g, \"\");\n            continue;\n        }\n\n        if (section === \"ports\" && hostPort === null) {\n            // `- \"5435:5432\"`. Only a mapping whose container side is Postgres's\n            // own port is the one to dial; anything else is a different service.\n            const mapping = line.match(/^\\s*-\\s*[\"']?(?:[\\d.]+:)?(\\d+):5432(?:\\/tcp)?[\"']?\\s*$/);\n            if (mapping) hostPort = mapping[1];\n        }\n    }\n\n    return hostPort === null ? found : { ...found, hostPort };\n}\n\n/**\n * `${VAR:-default}`, `${VAR}` and a literal, resolved the way compose resolves\n * them — against the project's `.env`, which is the file compose itself reads.\n */\nfunction expandComposeValue(\n    raw: string | undefined,\n    env: Record<string, string | undefined>\n): string | null {\n    if (!raw) return null;\n    const interpolated = raw.replace(/\\$\\{([A-Za-z_][\\w]*)(?::?-([^}]*))?\\}/g, (_all, name, fallback) => {\n        const value = env[name];\n        if (value !== undefined && value !== \"\") return value;\n        return fallback ?? \"\";\n    });\n    const trimmed = interpolated.trim();\n    return trimmed.length > 0 ? trimmed : null;\n}\n\n/** Is something accepting connections there right now? */\nexport function probeTcp(host: string, port: number, timeoutMs = 700): Promise<boolean> {\n    return new Promise(resolve => {\n        const socket = new net.Socket();\n        let settled = false;\n\n        const done = (open: boolean): void => {\n            if (settled) return;\n            settled = true;\n            socket.destroy();\n            resolve(open);\n        };\n\n        socket.setTimeout(timeoutMs);\n        socket.once(\"connect\", () => done(true));\n        socket.once(\"timeout\", () => done(false));\n        socket.once(\"error\", () => done(false));\n        socket.connect(port, host);\n    });\n}\n\n/**\n * Poll until the port answers, or give up.\n *\n * Postgres publishes its port before it is ready to accept queries, so the\n * caller still has to tolerate a first connection that is refused at the\n * protocol level. This only answers \"has the container got as far as listening\",\n * which is the part that takes the seconds.\n */\nexport async function waitForPort(\n    host: string,\n    port: number,\n    timeoutMs = 60_000,\n    intervalMs = 500\n): Promise<boolean> {\n    const deadline = Date.now() + timeoutMs;\n    while (Date.now() < deadline) {\n        if (await probeTcp(host, port, 700)) return true;\n        await new Promise(resolve => setTimeout(resolve, intervalMs));\n    }\n    return false;\n}\n\nexport interface EnsureDevDatabaseOptions {\n    projectRoot: string;\n    /** The DSN from the project's env file, if it has one. */\n    databaseUrl: string | undefined;\n    /** Set by `--no-db` or REBASE_DEV_NO_DB. */\n    disabled: boolean;\n    /** Whether the project has collections worth pushing. */\n    hasCollections: boolean;\n    /** Runs `rebase db push` for this project. Injected so tests need no database. */\n    pushSchema: () => Promise<void>;\n    /**\n     * Brings the compose `db` service up. Injected for the same reason\n     * `pushSchema` is: what happens *after* a start — a push that fails without\n     * taking the dev server with it — is the part worth asserting, and it was\n     * untestable while the only way in was a real `docker compose up`.\n     */\n    startDatabase?: (projectRoot: string) => Promise<void>;\n    log?: (message: string) => void;\n}\n\n/**\n * Start the project's development database if it is not running, and give it a\n * schema if this call is what started it.\n */\nexport async function ensureDevDatabase(options: EnsureDevDatabaseOptions): Promise<PreflightOutcome> {\n    const { projectRoot, databaseUrl, disabled, hasCollections, pushSchema } = options;\n    const log = options.log ?? ((message: string) => console.log(message));\n\n    if (disabled) return { action: \"disabled\" };\n\n    const target = parseLoopbackDsn(databaseUrl);\n    if (!databaseUrl) return { action: \"no-dsn\" };\n    if (!target) {\n        // Not an error, and not worth a warning either: pointing DATABASE_URL at\n        // a real database is a completely ordinary thing to do, and the only\n        // correct response is to keep away from it.\n        let host = \"the configured host\";\n        try {\n            host = new URL(databaseUrl).hostname || host;\n        } catch { /* keep the placeholder */ }\n        return { action: \"remote-dsn\", host };\n    }\n\n    if (await probeTcp(target.host, target.port)) {\n        return { action: \"already-running\", host: target.host, port: target.port };\n    }\n\n    const composePath = path.join(projectRoot, \"docker-compose.yml\");\n    if (!fs.existsSync(composePath)) return { action: \"no-compose\" };\n    const composeText = fs.readFileSync(composePath, \"utf8\");\n    if (!composeDeclaresDbService(composeText)) return { action: \"no-compose\" };\n\n    const manualSteps =\n        `${chalk.cyan(\"docker compose up -d db\")} then ${chalk.cyan(\"rebase db push\")}`;\n\n    // Would starting that container answer *this* DSN? A `.env` naming a port\n    // the compose file does not publish is the commonest way to get here, and\n    // starting the container then told the reader the exact opposite of the\n    // truth: `⚠ The database container did not begin listening on port 3139.\n    // Run docker compose up -d db then rebase db push to see why.` The\n    // container was up and healthy on 5436; the port in `.env` was what was\n    // wrong. And a container nobody asked for was left running.\n    const composePort = composeHostPort(composeText);\n    if (composePort !== null && composePort !== target.port) {\n        const hint =\n            `DATABASE_URL points at ${target.host}:${target.port} and nothing listens there. `\n            + `The compose file's db service publishes ${composePort}, so starting it would not `\n            + `answer that URL — nothing was started. Either correct the port in .env, or point `\n            + `DATABASE_URL at 127.0.0.1:${composePort}.`;\n        log(\"\");\n        log(`  ${chalk.yellow(\"⚠\")} ${chalk.gray(hint)}`);\n        return { action: \"wrong-port\", hint, port: target.port, composePort };\n    }\n\n    log(\"\");\n    log(`  ${chalk.gray(\"Database not running — starting it…\")}`);\n\n    const startDatabase = options.startDatabase ?? (async (root: string) => {\n        await execa(\"docker\", [\"compose\", \"up\", \"-d\", \"db\"], { cwd: root, stdio: \"pipe\" });\n    });\n\n    try {\n        await startDatabase(projectRoot);\n    } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        // Two very different failures land here and the reader needs to know\n        // which: Docker not being installed at all, and Docker being installed\n        // but unable to start this container.\n        if (/ENOENT|not found|command not found/i.test(message)) {\n            const hint = `Docker was not found. Start a Postgres yourself, then run ${manualSteps}.`;\n            log(`  ${chalk.yellow(\"⚠\")} ${chalk.gray(hint)}`);\n            return { action: \"no-docker\", hint };\n        }\n        const hint = `Could not start the database container. Run ${manualSteps} to see why.`;\n        log(`  ${chalk.yellow(\"⚠\")} ${chalk.gray(hint)}`);\n        return { action: \"start-failed\", hint };\n    }\n\n    if (!(await waitForPort(target.host, target.port))) {\n        const hint = `The database container did not begin listening on port ${target.port}. Run ${manualSteps} to see why.`;\n        log(`  ${chalk.yellow(\"⚠\")} ${chalk.gray(hint)}`);\n        return { action: \"start-failed\", hint };\n    }\n\n    log(`  ${chalk.green(\"✓\")} ${chalk.gray(`Database ready on port ${target.port}`)}`);\n\n    if (!hasCollections) return { action: \"started\", port: target.port, pushed: false };\n\n    log(`  ${chalk.gray(\"Pushing the schema…\")}`);\n    try {\n        await pushSchema();\n        log(`  ${chalk.green(\"✓\")} ${chalk.gray(\"Schema pushed\")}`);\n        return { action: \"started\", port: target.port, pushed: true };\n    } catch {\n        // The push prints its own diagnostics through inherited stdio, so\n        // repeating them here would only bury them. What is added is the one\n        // thing the reader now needs: the server is still starting, and against\n        // what.\n        log(`  ${chalk.yellow(\"⚠\")} ${chalk.gray(`Schema push failed. The database is running; fix the error above and run ${chalk.cyan(\"rebase db push\")}.`)}`);\n        return { action: \"started\", port: target.port, pushed: false };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsDA,IAAM,2BAAW,IAAI,IAAI;CAAC;CAAa;CAAa;CAAO;AAAS,CAAC;;;;;;;;AASrE,SAAgB,iBAAiB,KAAgE;CAC7F,IAAI,CAAC,KAAK,OAAO;CAEjB,IAAI;CACJ,IAAI;EACA,MAAM,IAAI,IAAI,GAAG;CACrB,QAAQ;EACJ,OAAO;CACX;CAEA,IAAI,CAAC,mBAAmB,KAAK,IAAI,QAAQ,GAAG,OAAO;CAMnD,MAAM,OAAO,IAAI,SAAS,QAAQ,cAAc,IAAI;CACpD,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,OAAO;CAEhC,MAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,IAAI;CAC3C,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ,KAAK,OAAO,OAAO,OAAO;CAEjE,OAAO;EAAE;EAAM;CAAK;AACxB;;;;;;;;;AAUA,SAAgB,yBAAyB,UAA2B;CAChE,IAAI,aAAa;CACjB,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO,GAAG;EAC3C,MAAM,OAAO,QAAQ,QAAQ,OAAO,MAAM;EAC1C,IAAI,QAAQ,KAAK,IAAI,KAAK,KAAK,KAAK,MAAM,IAAI;EAE9C,IAAI,iBAAiB,KAAK,IAAI,GAAG;GAC7B,aAAa;GACb;EACJ;EAEA,IAAI,cAAc,MAAM,KAAK,IAAI,GAAG;GAChC,aAAa;GACb;EACJ;EACA,IAAI,cAAc,iBAAiB,KAAK,IAAI,GAAG,OAAO;CAC1D;CACA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,mBACZ,UACA,MAA0C,CAAC,GAC9B;CACb,MAAM,QAAQ,qBAAqB,QAAQ;CAE3C,MAAM,OAAO,mBAAmB,MAAM,eAAe,GAAG;CACxD,MAAM,WAAW,mBAAmB,MAAM,mBAAmB,GAAG;CAChE,MAAM,WAAW,mBAAmB,MAAM,aAAa,GAAG;CAC1D,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,YAAY,CAAC,MAAM,UAAU,OAAO;CAE/D,OAAO,gBAAgB,mBAAmB,IAAI,EAAE,GAAG,mBAAmB,QAAQ,EAAA,aAC5D,MAAM,SAAS,GAAG,SAAS;AACjD;;;;;;;;;;;AAYA,SAAgB,gBAAgB,UAAiC;CAC7D,MAAM,OAAO,qBAAqB,QAAQ,CAAC,CAAC;CAE5C,OAAO,OAAO,OAAO,IAAI,IAAI;AACjC;;AAGA,SAAS,qBAAqB,UAAkE;CAC5F,IAAI,aAAa;CACjB,IAAI,OAAO;CACX,IAAI,WAAW;CACf,IAAI,UAA0C;CAC9C,MAAM,QAAgC,CAAC;CACvC,IAAI,WAA0B;CAE9B,KAAK,MAAM,WAAW,SAAS,MAAM,OAAO,GAAG;EAC3C,MAAM,OAAO,QAAQ,QAAQ,OAAO,MAAM;EAC1C,IAAI,QAAQ,KAAK,IAAI,KAAK,KAAK,KAAK,MAAM,IAAI;EAE9C,IAAI,iBAAiB,KAAK,IAAI,GAAG;GAAE,aAAa;GAAM;EAAU;EAChE,IAAI,cAAc,MAAM,KAAK,IAAI,GAAG;GAAE,aAAa;GAAO,OAAO;GAAO;EAAU;EAClF,IAAI,CAAC,YAAY;EAEjB,MAAM,SAAS,KAAK,SAAS,KAAK,UAAU,CAAC,CAAC;EAC9C,MAAM,WAAW,KAAK,MAAM,kBAAkB;EAC9C,IAAI,UAAU;GAAE,OAAO;GAAM,WAAW,SAAS,EAAE,CAAC;GAAQ,UAAU;GAAM;EAAU;EAEtF,IAAI,QAAQ,UAAU,UAAU;GAAE,OAAO;GAAO,UAAU;GAAM;EAAU;EAC1E,IAAI,CAAC,MAAM;EAEX,MAAM,MAAM,KAAK,MAAM,8BAA8B;EACrD,IAAI,KAAK;GAAE,UAAU,IAAI;GAA+B;EAAU;EAElE,IAAI,4BAA4B,KAAK,IAAI,KAAK,CAAC,gBAAgB,KAAK,IAAI;OAChE,CAAC,UAAU,KAAK,KAAK,UAAU,CAAC,GAAG,UAAU;EAAA;EAGrD,IAAI,YAAY,eAAe;GAC3B,MAAM,OAAO,KAAK,MAAM,kDAAkD;GAC1E,IAAI,MAAM,MAAM,KAAK,MAAM,KAAK,EAAE,CAAC,QAAQ,gBAAgB,EAAE;GAC7D;EACJ;EAEA,IAAI,YAAY,WAAW,aAAa,MAAM;GAG1C,MAAM,UAAU,KAAK,MAAM,wDAAwD;GACnF,IAAI,SAAS,WAAW,QAAQ;EACpC;CACJ;CAEA,OAAO,aAAa,OAAO,QAAQ;EAAE,GAAG;EAAO;CAAS;AAC5D;;;;;AAMA,SAAS,mBACL,KACA,KACa;CACb,IAAI,CAAC,KAAK,OAAO;CAMjB,MAAM,UALe,IAAI,QAAQ,2CAA2C,MAAM,MAAM,aAAa;EACjG,MAAM,QAAQ,IAAI;EAClB,IAAI,UAAU,KAAA,KAAa,UAAU,IAAI,OAAO;EAChD,OAAO,YAAY;CACvB,CACgB,CAAA,CAAa,KAAK;CAClC,OAAO,QAAQ,SAAS,IAAI,UAAU;AAC1C;;AAGA,SAAgB,SAAS,MAAc,MAAc,YAAY,KAAuB;CACpF,OAAO,IAAI,SAAQ,YAAW;EAC1B,MAAM,SAAS,IAAI,IAAI,OAAO;EAC9B,IAAI,UAAU;EAEd,MAAM,QAAQ,SAAwB;GAClC,IAAI,SAAS;GACb,UAAU;GACV,OAAO,QAAQ;GACf,QAAQ,IAAI;EAChB;EAEA,OAAO,WAAW,SAAS;EAC3B,OAAO,KAAK,iBAAiB,KAAK,IAAI,CAAC;EACvC,OAAO,KAAK,iBAAiB,KAAK,KAAK,CAAC;EACxC,OAAO,KAAK,eAAe,KAAK,KAAK,CAAC;EACtC,OAAO,QAAQ,MAAM,IAAI;CAC7B,CAAC;AACL;;;;;;;;;AAUA,eAAsB,YAClB,MACA,MACA,YAAY,KACZ,aAAa,KACG;CAChB,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC1B,IAAI,MAAM,SAAS,MAAM,MAAM,GAAG,GAAG,OAAO;EAC5C,MAAM,IAAI,SAAQ,YAAW,WAAW,SAAS,UAAU,CAAC;CAChE;CACA,OAAO;AACX;;;;;AA0BA,eAAsB,kBAAkB,SAA8D;CAClG,MAAM,EAAE,aAAa,aAAa,UAAU,gBAAgB,eAAe;CAC3E,MAAM,MAAM,QAAQ,SAAS,YAAoB,QAAQ,IAAI,OAAO;CAEpE,IAAI,UAAU,OAAO,EAAE,QAAQ,WAAW;CAE1C,MAAM,SAAS,iBAAiB,WAAW;CAC3C,IAAI,CAAC,aAAa,OAAO,EAAE,QAAQ,SAAS;CAC5C,IAAI,CAAC,QAAQ;EAIT,IAAI,OAAO;EACX,IAAI;GACA,OAAO,IAAI,IAAI,WAAW,CAAC,CAAC,YAAY;EAC5C,QAAQ,CAA6B;EACrC,OAAO;GAAE,QAAQ;GAAc;EAAK;CACxC;CAEA,IAAI,MAAM,SAAS,OAAO,MAAM,OAAO,IAAI,GACvC,OAAO;EAAE,QAAQ;EAAmB,MAAM,OAAO;EAAM,MAAM,OAAO;CAAK;CAG7E,MAAM,cAAc,KAAK,KAAK,aAAa,oBAAoB;CAC/D,IAAI,CAAC,GAAG,WAAW,WAAW,GAAG,OAAO,EAAE,QAAQ,aAAa;CAC/D,MAAM,cAAc,GAAG,aAAa,aAAa,MAAM;CACvD,IAAI,CAAC,yBAAyB,WAAW,GAAG,OAAO,EAAE,QAAQ,aAAa;CAE1E,MAAM,cACF,GAAG,MAAM,KAAK,yBAAyB,EAAE,QAAQ,MAAM,KAAK,gBAAgB;CAShF,MAAM,cAAc,gBAAgB,WAAW;CAC/C,IAAI,gBAAgB,QAAQ,gBAAgB,OAAO,MAAM;EACrD,MAAM,OACF,0BAA0B,OAAO,KAAK,GAAG,OAAO,KAAK,sEACR,YAAY,wIAE1B,YAAY;EAC/C,IAAI,EAAE;EACN,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,GAAG;EAChD,OAAO;GAAE,QAAQ;GAAc;GAAM,MAAM,OAAO;GAAM;EAAY;CACxE;CAEA,IAAI,EAAE;CACN,IAAI,KAAK,MAAM,KAAK,qCAAqC,GAAG;CAE5D,MAAM,gBAAgB,QAAQ,kBAAkB,OAAO,SAAiB;EACpE,MAAM,MAAM,UAAU;GAAC;GAAW;GAAM;GAAM;EAAI,GAAG;GAAE,KAAK;GAAM,OAAO;EAAO,CAAC;CACrF;CAEA,IAAI;EACA,MAAM,cAAc,WAAW;CACnC,SAAS,OAAO;EACZ,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAIrE,IAAI,sCAAsC,KAAK,OAAO,GAAG;GACrD,MAAM,OAAO,6DAA6D,YAAY;GACtF,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,GAAG;GAChD,OAAO;IAAE,QAAQ;IAAa;GAAK;EACvC;EACA,MAAM,OAAO,+CAA+C,YAAY;EACxE,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,GAAG;EAChD,OAAO;GAAE,QAAQ;GAAgB;EAAK;CAC1C;CAEA,IAAI,CAAE,MAAM,YAAY,OAAO,MAAM,OAAO,IAAI,GAAI;EAChD,MAAM,OAAO,0DAA0D,OAAO,KAAK,QAAQ,YAAY;EACvG,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,GAAG;EAChD,OAAO;GAAE,QAAQ;GAAgB;EAAK;CAC1C;CAEA,IAAI,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,0BAA0B,OAAO,MAAM,GAAG;CAElF,IAAI,CAAC,gBAAgB,OAAO;EAAE,QAAQ;EAAW,MAAM,OAAO;EAAM,QAAQ;CAAM;CAElF,IAAI,KAAK,MAAM,KAAK,qBAAqB,GAAG;CAC5C,IAAI;EACA,MAAM,WAAW;EACjB,IAAI,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,eAAe,GAAG;EAC1D,OAAO;GAAE,QAAQ;GAAW,MAAM,OAAO;GAAM,QAAQ;EAAK;CAChE,QAAQ;EAKJ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,4EAA4E,MAAM,KAAK,gBAAgB,EAAE,EAAE,GAAG;EACvJ,OAAO;GAAE,QAAQ;GAAW,MAAM,OAAO;GAAM,QAAQ;EAAM;CACjE;AACJ"}

package/dist/doctor-environment.d.ts

@@ -0,0 +1,131 @@
+/**
+ * The checks that need no database, and that catch what breaks a first run.
+ *
+ * `rebase doctor` compared three descriptions of a schema, which is the right
+ * check for a project that is working and the wrong one for a project that has
+ * never worked. Everything that stops a first run — the wrong Node, two
+ * lockfiles disagreeing, two collections claiming one slug, a `JWT_SECRET`
+ * short enough to be guessed, a half-installed workspace with three versions of
+ * `@rebasepro/server` in it — happens before a single table is compared, and
+ * doctor said nothing about any of it.
+ *
+ * Every function here is pure: it takes what it read and returns findings. The
+ * reading and the printing are at the edges, in `commands/doctor.ts`, so each
+ * check has a fixture that fails it without a filesystem, a project or a
+ * database.
+ */
+/** One thing that is wrong, and what to do about it. */
+export interface EnvironmentFinding {
+    /** Which check produced it, for grouping in the report. */
+    check: "node" | "package-manager" | "collections" | "env" | "versions" | "atlas";
+    severity: "error" | "warning";
+    message: string;
+    fix: string;
+}
+/** What is on disk for `@ariga/atlas`, read by `commands/doctor.ts`. */
+export interface AtlasBinaryState {
+    /** A `node_modules/.bin/atlas` the project's commands would find. */
+    onPath: boolean;
+    /** `@ariga/atlas/package.json` resolves from the project. */
+    packageInstalled: boolean;
+    /** The binary the package's `bin` names exists as a file. */
+    binaryOnDisk: boolean;
+    /** For the remedy: the reader's own package manager. */
+    manager: string;
+}
+/**
+ * Whether `db push`, `db generate` and `db migrate` can run at all.
+ *
+ * They shell out to `atlas`, and its absence is invisible until one of them is
+ * run: `@ariga/atlas` downloads its platform binary in `preinstall`, pnpm 10+
+ * and npm 12+ refuse a dependency's lifecycle scripts unless allowlisted, and
+ * the install exits 0 either way. The scaffold allowlists it, so this is a
+ * problem for the person who added `@rebasepro/server-postgres` to a project
+ * they already had — five lines of `ERR_PNPM_IGNORED_BUILDS` and
+ * `Failed to create bin … ENOENT`, several screens up, with nothing saying that
+ * a schema push will fail later.
+ *
+ * Three states, because two of them need opposite advice. The package absent is
+ * an install; the package present with no binary is an allowlist; the binary
+ * present with no `.bin` shim is a re-install, and telling that reader their
+ * build scripts are blocked sends them to a command that does nothing.
+ */
+export declare function checkAtlasBinary(state: AtlasBinaryState | null): EnvironmentFinding[];
+/** The lowest version a `>=x.y.z` range admits, or null for anything else. */
+export declare function minimumFromRange(range: string): [number, number, number] | null;
+/**
+ * Is the running Node old enough to break things that will not say so?
+ *
+ * The symptoms are not "unsupported Node". They are a syntax error inside a
+ * dependency, a missing global, or — the one that costs the most time — a
+ * `node:` builtin that resolves and then behaves differently. Naming the
+ * version is the whole check.
+ */
+export declare function checkNodeVersion(running: string, required: string | undefined): EnvironmentFinding[];
+/** The lockfiles a project may have, and the manager each one belongs to. */
+export declare const LOCKFILES: Record<string, string>;
+/**
+ * Two package managers in one project.
+ *
+ * A Rebase project is a pnpm workspace, and running `npm install` inside one
+ * rewrites `node_modules` into a hoisted layout that pnpm then disagrees with.
+ * The result is not an install error: it is `Cannot find module` from inside a
+ * dependency, hours later, on a machine where it worked yesterday. The
+ * leftover `package-lock.json` is the only durable evidence, and nothing looked
+ * at it.
+ */
+export declare function checkPackageManager(lockfilesPresent: string[], declared: string | undefined): EnvironmentFinding[];
+/**
+ * Two collections claiming one slug.
+ *
+ * The slug is the route, the table lookup and the registry key, and the
+ * registry keeps the last one registered. So the loser is not reported missing:
+ * it is served as the winner, with the winner's properties, under its own name.
+ * Every symptom of this points somewhere else.
+ */
+export declare function checkDuplicateSlugs(collections: Array<{
+    slug?: string;
+    name?: string;
+}>): EnvironmentFinding[];
+/** What `loadEnv` requires of a JWT secret. Mirrors `rebaseEnvSchema`. */
+export declare const MIN_JWT_SECRET_LENGTH = 32;
+/**
+ * The two `.env` facts that fail late and confusingly.
+ *
+ * A short `JWT_SECRET` boots fine and is refused by `loadEnv` only in
+ * production, which is the worst place to find out. Missing CORS in production
+ * is the opposite shape — it does not fail at all; the API simply accepts
+ * requests from anywhere.
+ *
+ * Values are never echoed. This reads a file that holds every credential the
+ * project has, and doctor's output goes wherever a terminal goes.
+ */
+export declare function checkEnvSanity(values: Record<string, string>): EnvironmentFinding[];
+/**
+ * Parse a `.env` into a plain object.
+ *
+ * Deliberately not `dotenv`: this must not touch `process.env`, and doctor may
+ * be reading a file for a different environment than the one it is running in.
+ */
+export declare function parseEnvFile(text: string): Record<string, string>;
+/** One `@rebasepro/*` dependency, and where it was declared. */
+export interface DeclaredDependency {
+    /** Where it was declared, relative to the project root. */
+    file: string;
+    name: string;
+    /** The range exactly as written. */
+    range: string;
+}
+/**
+ * The same `@rebasepro/*` package pinned to different versions in one project.
+ *
+ * A Rebase project declares them in several package.json files — the root, the
+ * backend, the frontend, the config workspace — and nothing has ever compared
+ * them. The failure that produces is not an install error: pnpm installs both,
+ * `instanceof` stops working across the two copies, and the symptom is a
+ * `CollectionConfig` that fails a type guard written against an identical type.
+ *
+ * `workspace:` ranges are excluded: inside this repo's own workspaces they all
+ * resolve to the same build by construction.
+ */
+export declare function checkVersionSkew(declared: DeclaredDependency[]): EnvironmentFinding[];