@rebasepro/cli 0.17.3 → 0.18.0

package/dist/project-3WCbrrfW.js

@@ -0,0 +1,499 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import chalk from "chalk";
+import path from "path";
+import fs from "fs";
+import { execSync, spawnSync } from "child_process";
+import dotenv from "dotenv";
+//#region src/utils/package-manager.ts
+/**
+* Package manager detection and command abstraction.
+*
+* Detects whether the user is running pnpm or npm and provides
+* a unified interface for common package-manager operations so
+* the rest of the CLI never has to hardcode a specific PM.
+*/
+/**
+* How long to wait for `pnpm --version` before giving up on the probe.
+*
+* `pnpm --version` is a cold Node start, and on a machine that is busy — a
+* parallel install, a full test run — it routinely takes seconds. Measured at
+* 630ms, 990ms and 4293ms on three consecutive runs of one developer laptop
+* under load, so the previous 3s budget was inside the normal spread rather
+* than safely outside it.
+*/
+var PNPM_PROBE_TIMEOUT_MS = 5e3;
+/** Memoised result of the probe. pnpm cannot appear or vanish mid-process. */
+var cachedPnpmAvailable;
+/**
+* Decide availability from a `spawnSync` outcome.
+*
+* Split out from the spawn itself so the decision is testable without starting
+* a process — which is what made the old test load-sensitive and occasionally
+* red for reasons that had nothing to do with the code under test.
+*
+* The three outcomes are distinguishable, and the old code conflated two of
+* them by asking only `status === 0`:
+*
+*   not installed   status null, signal null,    error.code ENOENT
+*   timed out       status null, signal SIGTERM, error.code ETIMEDOUT
+*   broken install  status non-zero, no error
+*/
+function pnpmAvailabilityFromProbe(res) {
+	const code = res.error?.code;
+	if (code === "ENOENT") return false;
+	if (code === "ETIMEDOUT" || res.signal) return true;
+	if (res.error) return false;
+	return res.status === 0;
+}
+/**
+* Whether pnpm is runnable on this machine.
+*
+* Used to decide whether a fresh project can be scaffolded with pnpm. Kept
+* cheap and non-interactive (bounded timeout, output discarded) so it never
+* hangs detection if a corepack shim misbehaves, and memoised so that repeated
+* detection in one CLI run costs one process rather than one per call.
+*/
+function isPnpmAvailable() {
+	if (cachedPnpmAvailable !== void 0) return cachedPnpmAvailable;
+	try {
+		cachedPnpmAvailable = pnpmAvailabilityFromProbe(spawnSync("pnpm", ["--version"], {
+			stdio: "ignore",
+			timeout: PNPM_PROBE_TIMEOUT_MS
+		}));
+	} catch {
+		cachedPnpmAvailable = false;
+	}
+	return cachedPnpmAvailable;
+}
+/**
+* Detect the package manager for a Rebase project.
+*
+* Rebase recommends pnpm, so detection prefers it. Crucially, *how the CLI was
+* invoked* (`npx` vs `pnpm dlx`, i.e. `npm_config_user_agent`) is deliberately
+* ignored: running `npx @rebasepro/cli init` says nothing about how the user
+* wants to manage the project they're creating, and letting it pin the scaffold
+* to npm is what made every `npx`-invoked project an npm project.
+*
+* Detection order:
+* 1. An existing lock file — an explicit choice we always respect
+*    (`pnpm-lock.yaml` wins over `package-lock.json` when both are present).
+* 2. pnpm, whenever it is installed.
+* 3. npm, only as a fallback when pnpm is genuinely unavailable.
+*/
+function detectPackageManager(targetDir) {
+	const dirs = [targetDir, process.cwd()].filter((d) => !!d);
+	for (const dir of dirs) {
+		if (fs.existsSync(path.join(dir, "pnpm-lock.yaml"))) return "pnpm";
+		if (fs.existsSync(path.join(dir, "package-lock.json"))) return "npm";
+		for (const [lock, name] of [
+			["yarn.lock", "yarn"],
+			["bun.lockb", "bun"],
+			["bun.lock", "bun"]
+		]) {
+			if (!fs.existsSync(path.join(dir, lock))) continue;
+			console.warn(`[rebase] Found ${lock}, but Rebase scaffolds pnpm or npm workspaces only — ${name} is not supported yet. Continuing with ${isPnpmAvailable() ? "pnpm" : "npm"}.`);
+			return isPnpmAvailable() ? "pnpm" : "npm";
+		}
+	}
+	if (isPnpmAvailable()) return "pnpm";
+	return "npm";
+}
+/** Build the command helpers for a given package manager. */
+function getPMCommands(pm) {
+	if (pm === "npm") return {
+		name: "npm",
+		install: ["npm", "install"],
+		run: (script) => [
+			"npm",
+			"run",
+			script
+		],
+		exec: (bin, args) => [
+			"npx",
+			bin,
+			...args
+		],
+		view: (pkg, field) => [
+			"npm",
+			"view",
+			pkg,
+			field
+		],
+		runAll: (script) => [
+			"npm",
+			"run",
+			script,
+			"--workspaces",
+			"--if-present"
+		],
+		runWorkspace: (workspace, script) => [
+			"npm",
+			"run",
+			script,
+			"-w",
+			workspace
+		],
+		dlx: (pkg, args) => [
+			"npx",
+			"-y",
+			pkg,
+			...args
+		],
+		workspaceProtocol: "*"
+	};
+	return {
+		name: "pnpm",
+		install: ["pnpm", "install"],
+		run: (script) => [
+			"pnpm",
+			"run",
+			script
+		],
+		exec: (bin, args) => [
+			"pnpm",
+			"exec",
+			bin,
+			...args
+		],
+		view: (pkg, field) => [
+			"pnpm",
+			"view",
+			pkg,
+			field
+		],
+		runAll: (script) => [
+			"pnpm",
+			"-r",
+			"run",
+			script
+		],
+		runWorkspace: (workspace, script) => [
+			"pnpm",
+			"--filter",
+			`./${workspace}`,
+			"run",
+			script
+		],
+		dlx: (pkg, args) => [
+			"pnpm",
+			"dlx",
+			pkg,
+			...args
+		],
+		workspaceProtocol: "workspace:*"
+	};
+}
+//#endregion
+//#region src/utils/project.ts
+/**
+* Project discovery utilities for the Rebase CLI.
+*
+* These helpers locate the project root, backend directory, .env file,
+* and local binaries — used by all CLI command modules.
+*/
+var project_exports = /* @__PURE__ */ __exportAll({
+	MANIFEST_FILENAME: () => MANIFEST_FILENAME,
+	dependenciesNotInstalled: () => dependenciesNotInstalled,
+	exitDependenciesNotInstalled: () => exitDependenciesNotInstalled,
+	failAsJson: () => failAsJson,
+	findBackendDir: () => findBackendDir,
+	findEnvFile: () => findEnvFile,
+	findFrontendDir: () => findFrontendDir,
+	findProjectRoot: () => findProjectRoot,
+	getActiveBackendPlugin: () => getActiveBackendPlugin,
+	readEnvFile: () => readEnvFile,
+	requireBackendDir: () => requireBackendDir,
+	requireProjectRoot: () => requireProjectRoot,
+	resolveLocalBin: () => resolveLocalBin,
+	resolvePluginCliScript: () => resolvePluginCliScript,
+	resolveTsx: () => resolveTsx,
+	validateTsxInstallation: () => validateTsxInstallation,
+	wantsJsonOutput: () => wantsJsonOutput
+});
+/** The authored project manifest. Its presence alone marks a project root. */
+var MANIFEST_FILENAME = "rebase.json";
+/**
+* Walk up from `startDir` to find the Rebase project root.
+*
+* A directory is the root when it holds a `rebase.json`, or when it holds a
+* `package.json` that either lists `backend` as a workspace or sits beside both
+* `backend/` and `config/`.
+*
+* `rebase.json` is checked first and needs no `package.json` beside it, because
+* the conventions below all describe a repository that *contains the backend*.
+* A repository holding only a frontend — the normal shape once a project's apps
+* live in separate repositories — matches none of them, so without this the
+* tooling could not run there at all.
+*/
+function findProjectRoot(startDir = process.cwd()) {
+	let dir = path.resolve(startDir);
+	const root = path.parse(dir).root;
+	while (dir !== root) {
+		if (fs.existsSync(path.join(dir, "rebase.json"))) return dir;
+		const pkgPath = path.join(dir, "package.json");
+		if (fs.existsSync(pkgPath)) {
+			try {
+				const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+				if (pkg.workspaces && Array.isArray(pkg.workspaces)) {
+					if (pkg.workspaces.some((w) => w === "backend")) return dir;
+				}
+			} catch {}
+			if (fs.existsSync(path.join(dir, "backend")) && fs.existsSync(path.join(dir, "config"))) return dir;
+		}
+		dir = path.dirname(dir);
+	}
+	return null;
+}
+/**
+* Locate the backend directory within the project root.
+*/
+function findBackendDir(projectRoot) {
+	const backendDir = path.join(projectRoot, "backend");
+	return fs.existsSync(backendDir) ? backendDir : null;
+}
+/**
+* Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.
+*/
+function getActiveBackendPlugin(backendDir) {
+	const pkgPath = path.join(backendDir, "package.json");
+	if (!fs.existsSync(pkgPath)) return null;
+	try {
+		const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+		const deps = {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+		const candidates = Object.keys(deps).filter((dep) => dep.startsWith("@rebasepro/server-") && dep !== "@rebasepro/server");
+		if (candidates.length === 0) return null;
+		if (candidates.includes("@rebasepro/server-postgres")) return "@rebasepro/server-postgres";
+		for (const candidate of candidates) if (resolvePluginCliScript(backendDir, candidate)) return candidate;
+		return candidates[0];
+	} catch {}
+	return null;
+}
+/**
+* Resolve the active plugin's CLI script.
+*/
+function resolvePluginCliScript(backendDir, pluginName) {
+	const candidates = [];
+	let dir = path.resolve(backendDir);
+	const fsRoot = path.parse(dir).root;
+	while (dir !== fsRoot) {
+		candidates.push(path.join(dir, "node_modules", pluginName, "src", "cli.ts"), path.join(dir, "node_modules", pluginName, "dist", "cli.js"));
+		dir = path.dirname(dir);
+	}
+	candidates.push(path.resolve(backendDir, "..", "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"), path.resolve(backendDir, "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"), path.resolve(backendDir, "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"));
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	return null;
+}
+/**
+* Locate the frontend directory within the project root.
+*/
+function findFrontendDir(projectRoot) {
+	const frontendDir = path.join(projectRoot, "frontend");
+	return fs.existsSync(frontendDir) ? frontendDir : null;
+}
+/**
+* Find the .env file. Checks the project root first, then backend.
+*/
+function findEnvFile(projectRoot) {
+	const candidates = [path.join(projectRoot, ".env"), path.join(projectRoot, "backend", ".env")];
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	return null;
+}
+/**
+* Read the project's `.env` into a plain object.
+*
+* One reader, because there were four: `dotenv` in `start`, a hand-rolled
+* `indexOf("=")` loop in `api-keys`, a single-key regex in `auth`, and its own
+* splitting in `cloud env`. `dotenv` is a declared dependency of this package,
+* so the other three existed for no reason and disagreed with the correct one
+* on the two things people actually write in a `.env`:
+*
+*   - `export KEY=value`, which the hand-rolled parser keyed as
+*     `export KEY` — so the command reported the key as unset while it was
+*     right there in the file;
+*   - `KEY=value # comment`, whose comment travelled into the value and then
+*     into an `Authorization` header, coming back as a 401 with nothing
+*     pointing at the cause.
+*
+* Returns `{}` when the project has no `.env`, so callers can treat "absent"
+* and "empty" alike.
+*/
+function readEnvFile(projectRoot) {
+	const envFile = findEnvFile(projectRoot);
+	if (!envFile || !fs.existsSync(envFile)) return {};
+	try {
+		return dotenv.parse(fs.readFileSync(envFile, "utf-8"));
+	} catch {
+		return {};
+	}
+}
+/**
+* Resolve a binary from the project's node_modules/.bin.
+* Checks backend, root, parent monorepo root, then falls back to PATH.
+*/
+function resolveLocalBin(projectRoot, binName) {
+	const candidates = [path.join(projectRoot, "backend", "node_modules", ".bin", binName), path.join(projectRoot, "node_modules", ".bin", binName)];
+	let parent = path.dirname(projectRoot);
+	const rootDir = path.parse(parent).root;
+	while (parent !== rootDir) {
+		candidates.push(path.join(parent, "node_modules", ".bin", binName));
+		parent = path.dirname(parent);
+	}
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	try {
+		const globalPath = execSync(`which ${binName}`, { encoding: "utf-8" }).trim();
+		if (globalPath && fs.existsSync(globalPath)) return globalPath;
+	} catch {}
+	return null;
+}
+/**
+* Resolve the tsx binary. Checks backend node_modules first, then root.
+*/
+function resolveTsx(projectRoot) {
+	return resolveLocalBin(projectRoot, "tsx");
+}
+/**
+* Validate that a resolved tsx binary actually has an intact installation.
+*
+* `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
+* exists. If the pnpm content-addressable store was cleaned or a previous
+* install was interrupted, the symlink can exist while critical files inside
+* the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
+* confusing MODULE_NOT_FOUND error at runtime.
+*
+* This function follows the symlink, walks up to find the tsx package root
+* (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
+* is present. Returns `null` when the installation looks healthy, or an
+* error description string when it appears corrupted.
+*/
+function validateTsxInstallation(tsxBinPath) {
+	try {
+		const realPath = fs.realpathSync(tsxBinPath);
+		let dir = path.dirname(realPath);
+		const fsRoot = path.parse(dir).root;
+		for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {
+			const pkgPath = path.join(dir, "package.json");
+			if (fs.existsSync(pkgPath)) try {
+				if (JSON.parse(fs.readFileSync(pkgPath, "utf-8")).name === "tsx") {
+					const preflightPath = path.join(dir, "dist", "preflight.cjs");
+					if (!fs.existsSync(preflightPath)) return `tsx package at ${dir} is missing dist/preflight.cjs`;
+					return null;
+				}
+			} catch {}
+			dir = path.dirname(dir);
+		}
+		return null;
+	} catch (err) {
+		return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;
+	}
+}
+/**
+* The one sentence a command says when the project's dependencies are missing.
+*
+* Six commands each had their own wording for the same state, and none of them
+* named the remedy:
+*
+*   ✗ Could not find CLI entry point for @rebasepro/server-postgres.
+*   ✗ Could not find tsx binary.
+*   ✗ Could not find tsx binary for backend.
+*
+* All three mean "you have not installed yet" — `getActiveBackendPlugin` has
+* already read the driver out of `backend/package.json` by the time the first
+* one fires, so the package is declared and simply not on disk, and `tsx` is a
+* devDependency of every scaffold. But they read as *Rebase* being broken, and
+* they name an internal path or a binary the developer never asked for rather
+* than the command that fixes it. That is the whole of the failure someone sees
+* on a fresh clone, where `node_modules/` is the one thing a checkout does not
+* carry.
+*
+* So: one sentence, naming the package manager this project uses and the
+* directory to run it in — the working directory is usually neither.
+*/
+function dependenciesNotInstalled(projectRoot) {
+	return `Dependencies are not installed — run \`${getPMCommands(detectPackageManager(projectRoot)).install.join(" ")}\` in ${projectRoot}`;
+}
+/**
+* Print {@link dependenciesNotInstalled} and exit 1.
+*
+* For the five commands that report and stop. `db.ts` throws instead, because
+* its caller adds the `✗` and the exit itself.
+*/
+function exitDependenciesNotInstalled(projectRoot) {
+	console.error(chalk.red(`✗ ${dependenciesNotInstalled(projectRoot)}`));
+	process.exit(1);
+}
+/**
+* The refusal envelope, for a caller that asked for JSON.
+*
+* Same shape as the cloud family's `fail()` — `{ error: { message, code, hint } }`
+* — because there is one CLI and a caller should not have to know which half of
+* it answered. `code` is what a caller branches on and is never absent; the
+* cloud family's reasoning about that applies here unchanged. `issues` carries
+* the per-problem detail a human reader gets as a bullet list, because a
+* refusal that says "2 problem(s)" and does not say which two is not
+* machine-readable in any useful sense.
+*
+* On **stdout**, like every other `--json` result: the contract those commands
+* make is that stdout holds one JSON value, and a caller that pipes stdout to a
+* parser must get a parseable refusal rather than an empty stream and a
+* human sentence it never sees. That contract used to hold for exactly one
+* failure of each command — the one that goes through `requireProjectRoot` —
+* while every other exit of the *same* command wrote human text to stderr and
+* left stdout empty. So `rebase status --json` was parseable outside a project
+* and unparseable inside a broken one, which is the case a caller actually has
+* to handle.
+*
+* The flag is read off `process.argv` because the failure happens inside a
+* helper the command calls before it has parsed anything. Coarse — a literal
+* `--json` as some other flag's value would count — and worth it: the failure
+* mode of being coarse is a JSON error where a human one was wanted, and the
+* failure mode of not doing it is an unparseable stream.
+*/
+function failAsJson(message, code, hint, issues) {
+	const error = {
+		message,
+		code
+	};
+	if (hint !== void 0) error.hint = hint;
+	if (issues !== void 0) error.issues = issues;
+	console.log(JSON.stringify({ error }, null, 2));
+	process.exit(1);
+}
+/** Did the command line ask for machine-readable output? */
+function wantsJsonOutput(argv = process.argv) {
+	return argv.includes("--json");
+}
+/**
+* Require the project root or exit with a helpful error.
+*/
+function requireProjectRoot() {
+	const root = findProjectRoot();
+	if (!root) {
+		if (wantsJsonOutput()) failAsJson("Could not find a Rebase project root.", "no_project_root", `Looked in this directory and every parent for a ${MANIFEST_FILENAME}, a package.json with a "backend" workspace, or a backend/ next to a config/.`);
+		console.error(chalk.red("✗ Could not find a Rebase project root."));
+		console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));
+		console.error(chalk.gray("  a package.json with a \"backend\" workspace, or a backend/ next to a config/."));
+		console.error(chalk.gray("  Run this from inside a project, or create one with `rebase init`."));
+		process.exit(1);
+	}
+	return root;
+}
+/**
+* Require the backend directory or exit with a helpful error.
+*/
+function requireBackendDir(projectRoot) {
+	const backendDir = findBackendDir(projectRoot);
+	if (!backendDir) {
+		if (wantsJsonOutput()) failAsJson("Could not find a backend/ directory.", "no_backend_dir", `Expected at: ${path.join(projectRoot, "backend")}`);
+		console.error(chalk.red("✗ Could not find a backend/ directory."));
+		console.error(chalk.gray(`  Expected at: ${path.join(projectRoot, "backend")}`));
+		process.exit(1);
+	}
+	return backendDir;
+}
+//#endregion
+export { validateTsxInstallation as _, findBackendDir as a, findProjectRoot as c, readEnvFile as d, requireBackendDir as f, resolveTsx as g, resolvePluginCliScript as h, failAsJson as i, getActiveBackendPlugin as l, resolveLocalBin as m, dependenciesNotInstalled as n, findEnvFile as o, requireProjectRoot as p, exitDependenciesNotInstalled as r, findFrontendDir as s, MANIFEST_FILENAME as t, project_exports as u, detectPackageManager as v, getPMCommands as y };
+
+//# sourceMappingURL=project-3WCbrrfW.js.map

package/dist/project-3WCbrrfW.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"project-3WCbrrfW.js","names":[],"sources":["../src/utils/package-manager.ts","../src/utils/project.ts"],"sourcesContent":["/**\n * Package manager detection and command abstraction.\n *\n * Detects whether the user is running pnpm or npm and provides\n * a unified interface for common package-manager operations so\n * the rest of the CLI never has to hardcode a specific PM.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport { spawnSync } from \"child_process\";\n\n/**\n * The two package managers the CLI can scaffold for.\n *\n * Yarn and bun are deliberately absent, and this is the note that says so\n * rather than leaving it to be discovered. A yarn or bun user gets an npm\n * project: `detectPackageManager` finds no `pnpm-lock.yaml` and no\n * `package-lock.json`, falls through to the pnpm probe, and lands on npm —\n * silently, and with a `yarn.lock` or `bun.lockb` sitting right there in the\n * directory it was asked about.\n *\n * The reason is not indifference. Every generated project is a workspace, and\n * the scaffold writes one protocol for the workspace links —\n * `workspaceProtocol` below is `\"workspace:*\"` or `\"*\"`. Yarn understands\n * `workspace:*` and bun does not; the two also disagree with pnpm about where\n * `node_modules` goes, which is what `rebase dev` walks to find the backend.\n * Supporting them means a fourth and fifth scaffold shape, each needing its own\n * end-to-end test, and neither exists.\n *\n * So the honest position is: pnpm (recommended) or npm. A yarn or bun user is\n * better served knowing they will get an npm workspace than finding out from\n * the lockfile that appears after their first install. See\n * {@link detectPackageManager}, which now says so out loud.\n */\nexport type PackageManager = \"pnpm\" | \"npm\";\n\nexport interface PMCommands {\n    /** The binary name (\"pnpm\" | \"npm\"). */\n    name: PackageManager;\n    /** Install all dependencies — e.g. `pnpm install` / `npm install`. */\n    install: string[];\n    /** Run a script — e.g. `pnpm run dev` / `npm run dev`. */\n    run: (script: string) => string[];\n    /** Execute a local bin — e.g. `pnpm exec rebase ...` / `npx rebase ...`. */\n    exec: (bin: string, args: string[]) => string[];\n    /** Query the registry — e.g. `pnpm view <pkg> version` / `npm view <pkg> version`. */\n    view: (pkg: string, field: string) => string[];\n    /** Run all workspace scripts — e.g. `pnpm -r run build` / `npm run build --workspaces`. */\n    runAll: (script: string) => string[];\n    /** Run a script in a specific workspace — e.g. `pnpm --filter \"*-backend\" start` / `npm run start -w backend`. */\n    runWorkspace: (workspace: string, script: string) => string[];\n    /** Execute a one-off package — e.g. `pnpm dlx skills ...` / `npx -y skills ...`. */\n    dlx: (pkg: string, args: string[]) => string[];\n    /** The workspace dependency protocol: `\"workspace:*\"` for pnpm, `\"*\"` for npm. */\n    workspaceProtocol: string;\n}\n\n/**\n * How long to wait for `pnpm --version` before giving up on the probe.\n *\n * `pnpm --version` is a cold Node start, and on a machine that is busy — a\n * parallel install, a full test run — it routinely takes seconds. Measured at\n * 630ms, 990ms and 4293ms on three consecutive runs of one developer laptop\n * under load, so the previous 3s budget was inside the normal spread rather\n * than safely outside it.\n */\nconst PNPM_PROBE_TIMEOUT_MS = 5000;\n\n/** Memoised result of the probe. pnpm cannot appear or vanish mid-process. */\nlet cachedPnpmAvailable: boolean | undefined;\n\n/**\n * Decide availability from a `spawnSync` outcome.\n *\n * Split out from the spawn itself so the decision is testable without starting\n * a process — which is what made the old test load-sensitive and occasionally\n * red for reasons that had nothing to do with the code under test.\n *\n * The three outcomes are distinguishable, and the old code conflated two of\n * them by asking only `status === 0`:\n *\n *   not installed   status null, signal null,    error.code ENOENT\n *   timed out       status null, signal SIGTERM, error.code ETIMEDOUT\n *   broken install  status non-zero, no error\n */\nexport function pnpmAvailabilityFromProbe(res: {\n    status: number | null;\n    signal?: NodeJS.Signals | null;\n    error?: { code?: string } | Error;\n}): boolean {\n    const code = (res.error as { code?: string } | undefined)?.code;\n\n    // The binary is not on PATH. Genuinely absent.\n    if (code === \"ENOENT\") return false;\n\n    // We killed it for taking too long. That means it WAS found and did start,\n    // so pnpm is installed — it was merely slow, which on a loaded machine is\n    // routine rather than exceptional. Reporting \"absent\" here is what silently\n    // scaffolded npm projects for developers who had pnpm all along.\n    //\n    // The trade-off, stated plainly: a pnpm that hangs forever (a misbehaving\n    // corepack shim) now resolves to pnpm instead of falling back to npm. That\n    // is the rarer and more visible failure — the user sees their next command\n    // hang — whereas the case this fixes was silent and produced a project\n    // pinned to the wrong package manager. The timeout still bounds how long\n    // detection itself waits, which was always its real job.\n    if (code === \"ETIMEDOUT\" || res.signal) return true;\n\n    // Any other spawn error: treat as unavailable rather than guess.\n    if (res.error) return false;\n\n    return res.status === 0;\n}\n\n/**\n * Whether pnpm is runnable on this machine.\n *\n * Used to decide whether a fresh project can be scaffolded with pnpm. Kept\n * cheap and non-interactive (bounded timeout, output discarded) so it never\n * hangs detection if a corepack shim misbehaves, and memoised so that repeated\n * detection in one CLI run costs one process rather than one per call.\n */\nexport function isPnpmAvailable(): boolean {\n    if (cachedPnpmAvailable !== undefined) return cachedPnpmAvailable;\n    try {\n        const res = spawnSync(\"pnpm\", [\"--version\"], {\n            stdio: \"ignore\",\n            timeout: PNPM_PROBE_TIMEOUT_MS\n        });\n        cachedPnpmAvailable = pnpmAvailabilityFromProbe(res);\n    } catch {\n        cachedPnpmAvailable = false;\n    }\n    return cachedPnpmAvailable;\n}\n\n/** Forget the memoised probe. For tests; nothing in a CLI run needs it. */\nexport function resetPnpmAvailabilityCache(): void {\n    cachedPnpmAvailable = undefined;\n}\n\n/**\n * Detect the package manager for a Rebase project.\n *\n * Rebase recommends pnpm, so detection prefers it. Crucially, *how the CLI was\n * invoked* (`npx` vs `pnpm dlx`, i.e. `npm_config_user_agent`) is deliberately\n * ignored: running `npx @rebasepro/cli init` says nothing about how the user\n * wants to manage the project they're creating, and letting it pin the scaffold\n * to npm is what made every `npx`-invoked project an npm project.\n *\n * Detection order:\n * 1. An existing lock file — an explicit choice we always respect\n *    (`pnpm-lock.yaml` wins over `package-lock.json` when both are present).\n * 2. pnpm, whenever it is installed.\n * 3. npm, only as a fallback when pnpm is genuinely unavailable.\n */\nexport function detectPackageManager(targetDir?: string): PackageManager {\n    // 1. Respect an existing project's lock file.\n    const dirs = [targetDir, process.cwd()].filter((d): d is string => !!d);\n    for (const dir of dirs) {\n        if (fs.existsSync(path.join(dir, \"pnpm-lock.yaml\"))) return \"pnpm\";\n        if (fs.existsSync(path.join(dir, \"package-lock.json\"))) return \"npm\";\n\n        // A yarn or bun lockfile is a stated choice this CLI cannot honour —\n        // see the note on `PackageManager`. Say so once, here, rather than\n        // scaffolding an npm workspace beside their lockfile without comment.\n        for (const [lock, name] of [[\"yarn.lock\", \"yarn\"], [\"bun.lockb\", \"bun\"], [\"bun.lock\", \"bun\"]] as const) {\n            if (!fs.existsSync(path.join(dir, lock))) continue;\n            console.warn(\n                `[rebase] Found ${lock}, but Rebase scaffolds pnpm or npm workspaces only — ` +\n                `${name} is not supported yet. Continuing with ` +\n                `${isPnpmAvailable() ? \"pnpm\" : \"npm\"}.`\n            );\n            return isPnpmAvailable() ? \"pnpm\" : \"npm\";\n        }\n    }\n\n    // 2. Prefer pnpm whenever it's installed.\n    if (isPnpmAvailable()) return \"pnpm\";\n\n    // 3. Fall back to npm only when pnpm is genuinely unavailable.\n    return \"npm\";\n}\n\n/** Build the command helpers for a given package manager. */\nexport function getPMCommands(pm: PackageManager): PMCommands {\n    if (pm === \"npm\") {\n        return {\n            name: \"npm\",\n            install: [\"npm\", \"install\"],\n            run: (script) => [\"npm\", \"run\", script],\n            exec: (bin, args) => [\"npx\", bin, ...args],\n            view: (pkg, field) => [\"npm\", \"view\", pkg, field],\n            runAll: (script) => [\"npm\", \"run\", script, \"--workspaces\", \"--if-present\"],\n            runWorkspace: (workspace, script) => [\"npm\", \"run\", script, \"-w\", workspace],\n            dlx: (pkg, args) => [\"npx\", \"-y\", pkg, ...args],\n            workspaceProtocol: \"*\"\n        };\n    }\n\n    return {\n        name: \"pnpm\",\n        install: [\"pnpm\", \"install\"],\n        run: (script) => [\"pnpm\", \"run\", script],\n        exec: (bin, args) => [\"pnpm\", \"exec\", bin, ...args],\n        view: (pkg, field) => [\"pnpm\", \"view\", pkg, field],\n        runAll: (script) => [\"pnpm\", \"-r\", \"run\", script],\n        // Filter by directory (`./backend`), not name: pnpm's `--filter` matches\n        // the package *name* (e.g. `my-app-backend`), so a bare `backend` matches\n        // nothing. npm's `-w` is path-based, which is why this only bites pnpm.\n        runWorkspace: (workspace, script) => [\"pnpm\", \"--filter\", `./${workspace}`, \"run\", script],\n        dlx: (pkg, args) => [\"pnpm\", \"dlx\", pkg, ...args],\n        workspaceProtocol: \"workspace:*\"\n    };\n}\n","/**\n * Project discovery utilities for the Rebase CLI.\n *\n * These helpers locate the project root, backend directory, .env file,\n * and local binaries — used by all CLI command modules.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport { execSync } from \"child_process\";\nimport dotenv from \"dotenv\";\nimport chalk from \"chalk\";\nimport { detectPackageManager, getPMCommands } from \"./package-manager\";\n\n/** The authored project manifest. Its presence alone marks a project root. */\nexport const MANIFEST_FILENAME = \"rebase.json\";\n\n/**\n * Walk up from `startDir` to find the Rebase project root.\n *\n * A directory is the root when it holds a `rebase.json`, or when it holds a\n * `package.json` that either lists `backend` as a workspace or sits beside both\n * `backend/` and `config/`.\n *\n * `rebase.json` is checked first and needs no `package.json` beside it, because\n * the conventions below all describe a repository that *contains the backend*.\n * A repository holding only a frontend — the normal shape once a project's apps\n * live in separate repositories — matches none of them, so without this the\n * tooling could not run there at all.\n */\nexport function findProjectRoot(startDir: string = process.cwd()): string | null {\n    let dir = path.resolve(startDir);\n    const root = path.parse(dir).root;\n\n    while (dir !== root) {\n        if (fs.existsSync(path.join(dir, MANIFEST_FILENAME))) {\n            return dir;\n        }\n\n        const pkgPath = path.join(dir, \"package.json\");\n\n        if (fs.existsSync(pkgPath)) {\n            try {\n                const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n                // Check for workspace-based project (monorepo root)\n                if (pkg.workspaces && Array.isArray(pkg.workspaces)) {\n                    const hasBackend = pkg.workspaces.some((w: string) =>\n                        w === \"backend\"\n                    );\n                    if (hasBackend) return dir;\n                }\n            } catch {\n                // ignore parse errors\n            }\n\n            // Check for sibling backend directory\n            if (fs.existsSync(path.join(dir, \"backend\")) && fs.existsSync(path.join(dir, \"config\"))) {\n                return dir;\n            }\n        }\n\n        dir = path.dirname(dir);\n    }\n\n    return null;\n}\n\n/**\n * Locate the backend directory within the project root.\n */\nexport function findBackendDir(projectRoot: string): string | null {\n    const backendDir = path.join(projectRoot, \"backend\");\n    return fs.existsSync(backendDir) ? backendDir : null;\n}\n\n/**\n * Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.\n */\nexport function getActiveBackendPlugin(backendDir: string): string | null {\n    const pkgPath = path.join(backendDir, \"package.json\");\n    if (!fs.existsSync(pkgPath)) return null;\n\n    try {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n        const deps = { ...pkg.dependencies,\n...pkg.devDependencies };\n\n        // Collect all @rebasepro/server-* driver plugins (exclude server itself)\n        const candidates = Object.keys(deps).filter(\n            dep => dep.startsWith(\"@rebasepro/server-\") && dep !== \"@rebasepro/server\"\n        );\n\n        if (candidates.length === 0) return null;\n\n        // Prefer server-postgres — it's the primary supported driver\n        if (candidates.includes(\"@rebasepro/server-postgres\")) {\n            return \"@rebasepro/server-postgres\";\n        }\n\n        // Fallback: return the first candidate that actually has a CLI entry point\n        for (const candidate of candidates) {\n            if (resolvePluginCliScript(backendDir, candidate)) {\n                return candidate;\n            }\n        }\n\n        // Last resort: return whatever we found\n        return candidates[0];\n    } catch {\n        // Ignore parse errors\n    }\n    return null;\n}\n\n/**\n * Resolve the active plugin's CLI script.\n */\nexport function resolvePluginCliScript(backendDir: string, pluginName: string): string | null {\n    const candidates: string[] = [];\n\n    // Walk up from the backend dir: pnpm links the plugin into\n    // backend/node_modules, while npm workspaces hoist it to the project (or an\n    // enclosing monorepo) root.\n    let dir = path.resolve(backendDir);\n    const fsRoot = path.parse(dir).root;\n    while (dir !== fsRoot) {\n        candidates.push(\n            path.join(dir, \"node_modules\", pluginName, \"src\", \"cli.ts\"),\n            path.join(dir, \"node_modules\", pluginName, \"dist\", \"cli.js\")\n        );\n        dir = path.dirname(dir);\n    }\n\n    candidates.push(\n        // For monorepo dev mode:\n        path.resolve(backendDir, \"..\", \"..\", \"..\", \"packages\", pluginName.replace(\"@rebasepro/\", \"\"), \"src\", \"cli.ts\"),\n        path.resolve(backendDir, \"..\", \"..\", \"packages\", pluginName.replace(\"@rebasepro/\", \"\"), \"src\", \"cli.ts\"),\n        path.resolve(backendDir, \"..\", \"packages\", pluginName.replace(\"@rebasepro/\", \"\"), \"src\", \"cli.ts\")\n    );\n\n    for (const candidate of candidates) {\n        if (fs.existsSync(candidate)) return candidate;\n    }\n    return null;\n}\n\n/**\n * Locate the frontend directory within the project root.\n */\nexport function findFrontendDir(projectRoot: string): string | null {\n    const frontendDir = path.join(projectRoot, \"frontend\");\n    return fs.existsSync(frontendDir) ? frontendDir : null;\n}\n\n/**\n * Find the .env file. Checks the project root first, then backend.\n */\nexport function findEnvFile(projectRoot: string): string | null {\n    const candidates = [\n        path.join(projectRoot, \".env\"),\n        path.join(projectRoot, \"backend\", \".env\")\n    ];\n\n    for (const candidate of candidates) {\n        if (fs.existsSync(candidate)) return candidate;\n    }\n\n    return null;\n}\n\n/**\n * Read the project's `.env` into a plain object.\n *\n * One reader, because there were four: `dotenv` in `start`, a hand-rolled\n * `indexOf(\"=\")` loop in `api-keys`, a single-key regex in `auth`, and its own\n * splitting in `cloud env`. `dotenv` is a declared dependency of this package,\n * so the other three existed for no reason and disagreed with the correct one\n * on the two things people actually write in a `.env`:\n *\n *   - `export KEY=value`, which the hand-rolled parser keyed as\n *     `export KEY` — so the command reported the key as unset while it was\n *     right there in the file;\n *   - `KEY=value # comment`, whose comment travelled into the value and then\n *     into an `Authorization` header, coming back as a 401 with nothing\n *     pointing at the cause.\n *\n * Returns `{}` when the project has no `.env`, so callers can treat \"absent\"\n * and \"empty\" alike.\n */\nexport function readEnvFile(projectRoot: string): Record<string, string> {\n    const envFile = findEnvFile(projectRoot);\n    if (!envFile || !fs.existsSync(envFile)) return {};\n    try {\n        return dotenv.parse(fs.readFileSync(envFile, \"utf-8\"));\n    } catch {\n        // An unreadable or malformed file is not worth failing a command over;\n        // the caller reports the missing value it was looking for.\n        return {};\n    }\n}\n\n/**\n * Resolve a binary from the project's node_modules/.bin.\n * Checks backend, root, parent monorepo root, then falls back to PATH.\n */\nexport function resolveLocalBin(projectRoot: string, binName: string): string | null {\n    const candidates = [\n        path.join(projectRoot, \"backend\", \"node_modules\", \".bin\", binName),\n        path.join(projectRoot, \"node_modules\", \".bin\", binName)\n    ];\n\n    // Also check parent directories (for monorepo setups where app/ is nested)\n    let parent = path.dirname(projectRoot);\n    const rootDir = path.parse(parent).root;\n    while (parent !== rootDir) {\n        candidates.push(path.join(parent, \"node_modules\", \".bin\", binName));\n        parent = path.dirname(parent);\n    }\n\n    for (const candidate of candidates) {\n        if (fs.existsSync(candidate)) return candidate;\n    }\n\n    // Fall back to globally installed binary via which\n    try {\n        const globalPath = execSync(`which ${binName}`, { encoding: \"utf-8\" }).trim();\n        if (globalPath && fs.existsSync(globalPath)) return globalPath;\n    } catch {\n        // not found globally\n    }\n\n    return null;\n}\n\n/**\n * Resolve the tsx binary. Checks backend node_modules first, then root.\n */\nexport function resolveTsx(projectRoot: string): string | null {\n    return resolveLocalBin(projectRoot, \"tsx\");\n}\n\n/**\n * Validate that a resolved tsx binary actually has an intact installation.\n *\n * `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)\n * exists. If the pnpm content-addressable store was cleaned or a previous\n * install was interrupted, the symlink can exist while critical files inside\n * the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a\n * confusing MODULE_NOT_FOUND error at runtime.\n *\n * This function follows the symlink, walks up to find the tsx package root\n * (`package.json` with `name: \"tsx\"`), and verifies that `dist/preflight.cjs`\n * is present. Returns `null` when the installation looks healthy, or an\n * error description string when it appears corrupted.\n */\nexport function validateTsxInstallation(tsxBinPath: string): string | null {\n    try {\n        // Follow the symlink chain to the real tsx entry script\n        const realPath = fs.realpathSync(tsxBinPath);\n\n        // Walk up from the real binary to locate the tsx package root\n        let dir = path.dirname(realPath);\n        const fsRoot = path.parse(dir).root;\n        for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {\n            const pkgPath = path.join(dir, \"package.json\");\n            if (fs.existsSync(pkgPath)) {\n                try {\n                    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n                    if (pkg.name === \"tsx\") {\n                        // Found the tsx package root — verify critical preload file\n                        const preflightPath = path.join(dir, \"dist\", \"preflight.cjs\");\n                        if (!fs.existsSync(preflightPath)) {\n                            return `tsx package at ${dir} is missing dist/preflight.cjs`;\n                        }\n                        return null; // Installation looks healthy\n                    }\n                } catch {\n                    // Malformed package.json — keep walking\n                }\n            }\n            dir = path.dirname(dir);\n        }\n\n        // Could not determine tsx root — don't block, assume valid\n        return null;\n    } catch (err) {\n        // realpathSync throws if the symlink target is completely gone\n        return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;\n    }\n}\n\n/**\n * The one sentence a command says when the project's dependencies are missing.\n *\n * Six commands each had their own wording for the same state, and none of them\n * named the remedy:\n *\n *   ✗ Could not find CLI entry point for @rebasepro/server-postgres.\n *   ✗ Could not find tsx binary.\n *   ✗ Could not find tsx binary for backend.\n *\n * All three mean \"you have not installed yet\" — `getActiveBackendPlugin` has\n * already read the driver out of `backend/package.json` by the time the first\n * one fires, so the package is declared and simply not on disk, and `tsx` is a\n * devDependency of every scaffold. But they read as *Rebase* being broken, and\n * they name an internal path or a binary the developer never asked for rather\n * than the command that fixes it. That is the whole of the failure someone sees\n * on a fresh clone, where `node_modules/` is the one thing a checkout does not\n * carry.\n *\n * So: one sentence, naming the package manager this project uses and the\n * directory to run it in — the working directory is usually neither.\n */\nexport function dependenciesNotInstalled(projectRoot: string): string {\n    const install = getPMCommands(detectPackageManager(projectRoot)).install.join(\" \");\n    return `Dependencies are not installed — run \\`${install}\\` in ${projectRoot}`;\n}\n\n/**\n * Print {@link dependenciesNotInstalled} and exit 1.\n *\n * For the five commands that report and stop. `db.ts` throws instead, because\n * its caller adds the `✗` and the exit itself.\n */\nexport function exitDependenciesNotInstalled(projectRoot: string): never {\n    console.error(chalk.red(`✗ ${dependenciesNotInstalled(projectRoot)}`));\n    process.exit(1);\n}\n\n/** One problem inside a refusal, when the command found several. */\nexport interface JsonFailureIssue {\n    /** Where it is — a config path, a manifest key, a file. */\n    path?: string;\n    message: string;\n}\n\n/**\n * The refusal envelope, for a caller that asked for JSON.\n *\n * Same shape as the cloud family's `fail()` — `{ error: { message, code, hint } }`\n * — because there is one CLI and a caller should not have to know which half of\n * it answered. `code` is what a caller branches on and is never absent; the\n * cloud family's reasoning about that applies here unchanged. `issues` carries\n * the per-problem detail a human reader gets as a bullet list, because a\n * refusal that says \"2 problem(s)\" and does not say which two is not\n * machine-readable in any useful sense.\n *\n * On **stdout**, like every other `--json` result: the contract those commands\n * make is that stdout holds one JSON value, and a caller that pipes stdout to a\n * parser must get a parseable refusal rather than an empty stream and a\n * human sentence it never sees. That contract used to hold for exactly one\n * failure of each command — the one that goes through `requireProjectRoot` —\n * while every other exit of the *same* command wrote human text to stderr and\n * left stdout empty. So `rebase status --json` was parseable outside a project\n * and unparseable inside a broken one, which is the case a caller actually has\n * to handle.\n *\n * The flag is read off `process.argv` because the failure happens inside a\n * helper the command calls before it has parsed anything. Coarse — a literal\n * `--json` as some other flag's value would count — and worth it: the failure\n * mode of being coarse is a JSON error where a human one was wanted, and the\n * failure mode of not doing it is an unparseable stream.\n */\nexport function failAsJson(\n    message: string,\n    code: string,\n    hint?: string,\n    issues?: JsonFailureIssue[]\n): never {\n    const error: Record<string, unknown> = { message, code };\n    if (hint !== undefined) error.hint = hint;\n    if (issues !== undefined) error.issues = issues;\n    console.log(JSON.stringify({ error }, null, 2));\n    process.exit(1);\n}\n\n/** Did the command line ask for machine-readable output? */\nexport function wantsJsonOutput(argv: readonly string[] = process.argv): boolean {\n    return argv.includes(\"--json\");\n}\n\n/**\n * Require the project root or exit with a helpful error.\n */\nexport function requireProjectRoot(): string {\n    const root = findProjectRoot();\n    if (!root) {\n        if (wantsJsonOutput()) {\n            // `rebase status --json` outside a project wrote four grey lines to\n            // stderr and nothing at all to stdout, so the agent or CI step that\n            // asked for JSON got an empty parse and no reason.\n            failAsJson(\n                \"Could not find a Rebase project root.\",\n                \"no_project_root\",\n                `Looked in this directory and every parent for a ${MANIFEST_FILENAME}, `\n                + \"a package.json with a \\\"backend\\\" workspace, or a backend/ next to a config/.\"\n            );\n        }\n        // Name what is actually looked for, in the order `findProjectRoot`\n        // looks for it. The old wording (\"backend/, frontend/, and config/\")\n        // described neither the manifest — which is the primary marker and the\n        // only one `rebase init` writes — nor a `--headless` project, which has\n        // no frontend at all and would read this as \"you are in the wrong\n        // place\" while standing in the right one.\n        console.error(chalk.red(\"✗ Could not find a Rebase project root.\"));\n        console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));\n        console.error(chalk.gray(\"  a package.json with a \\\"backend\\\" workspace, or a backend/ next to a config/.\"));\n        console.error(chalk.gray(\"  Run this from inside a project, or create one with `rebase init`.\"));\n        process.exit(1);\n    }\n    return root;\n}\n\n/**\n * Require the backend directory or exit with a helpful error.\n */\nexport function requireBackendDir(projectRoot: string): string {\n    const backendDir = findBackendDir(projectRoot);\n    if (!backendDir) {\n        if (wantsJsonOutput()) {\n            failAsJson(\n                \"Could not find a backend/ directory.\",\n                \"no_backend_dir\",\n                `Expected at: ${path.join(projectRoot, \"backend\")}`\n            );\n        }\n        console.error(chalk.red(\"✗ Could not find a backend/ directory.\"));\n        console.error(chalk.gray(`  Expected at: ${path.join(projectRoot, \"backend\")}`));\n        process.exit(1);\n    }\n    return backendDir;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAkEA,IAAM,wBAAwB;;AAG9B,IAAI;;;;;;;;;;;;;;;AAgBJ,SAAgB,0BAA0B,KAI9B;CACR,MAAM,OAAQ,IAAI,OAAyC;CAG3D,IAAI,SAAS,UAAU,OAAO;CAa9B,IAAI,SAAS,eAAe,IAAI,QAAQ,OAAO;CAG/C,IAAI,IAAI,OAAO,OAAO;CAEtB,OAAO,IAAI,WAAW;AAC1B;;;;;;;;;AAUA,SAAgB,kBAA2B;CACvC,IAAI,wBAAwB,KAAA,GAAW,OAAO;CAC9C,IAAI;EAKA,sBAAsB,0BAJV,UAAU,QAAQ,CAAC,WAAW,GAAG;GACzC,OAAO;GACP,SAAS;EACb,CACgD,CAAG;CACvD,QAAQ;EACJ,sBAAsB;CAC1B;CACA,OAAO;AACX;;;;;;;;;;;;;;;;AAsBA,SAAgB,qBAAqB,WAAoC;CAErE,MAAM,OAAO,CAAC,WAAW,QAAQ,IAAI,CAAC,CAAC,CAAC,QAAQ,MAAmB,CAAC,CAAC,CAAC;CACtE,KAAK,MAAM,OAAO,MAAM;EACpB,IAAI,GAAG,WAAW,KAAK,KAAK,KAAK,gBAAgB,CAAC,GAAG,OAAO;EAC5D,IAAI,GAAG,WAAW,KAAK,KAAK,KAAK,mBAAmB,CAAC,GAAG,OAAO;EAK/D,KAAK,MAAM,CAAC,MAAM,SAAS;GAAC,CAAC,aAAa,MAAM;GAAG,CAAC,aAAa,KAAK;GAAG,CAAC,YAAY,KAAK;EAAC,GAAY;GACpG,IAAI,CAAC,GAAG,WAAW,KAAK,KAAK,KAAK,IAAI,CAAC,GAAG;GAC1C,QAAQ,KACJ,kBAAkB,KAAK,uDACpB,KAAK,yCACL,gBAAgB,IAAI,SAAS,MAAM,EAC1C;GACA,OAAO,gBAAgB,IAAI,SAAS;EACxC;CACJ;CAGA,IAAI,gBAAgB,GAAG,OAAO;CAG9B,OAAO;AACX;;AAGA,SAAgB,cAAc,IAAgC;CAC1D,IAAI,OAAO,OACP,OAAO;EACH,MAAM;EACN,SAAS,CAAC,OAAO,SAAS;EAC1B,MAAM,WAAW;GAAC;GAAO;GAAO;EAAM;EACtC,OAAO,KAAK,SAAS;GAAC;GAAO;GAAK,GAAG;EAAI;EACzC,OAAO,KAAK,UAAU;GAAC;GAAO;GAAQ;GAAK;EAAK;EAChD,SAAS,WAAW;GAAC;GAAO;GAAO;GAAQ;GAAgB;EAAc;EACzE,eAAe,WAAW,WAAW;GAAC;GAAO;GAAO;GAAQ;GAAM;EAAS;EAC3E,MAAM,KAAK,SAAS;GAAC;GAAO;GAAM;GAAK,GAAG;EAAI;EAC9C,mBAAmB;CACvB;CAGJ,OAAO;EACH,MAAM;EACN,SAAS,CAAC,QAAQ,SAAS;EAC3B,MAAM,WAAW;GAAC;GAAQ;GAAO;EAAM;EACvC,OAAO,KAAK,SAAS;GAAC;GAAQ;GAAQ;GAAK,GAAG;EAAI;EAClD,OAAO,KAAK,UAAU;GAAC;GAAQ;GAAQ;GAAK;EAAK;EACjD,SAAS,WAAW;GAAC;GAAQ;GAAM;GAAO;EAAM;EAIhD,eAAe,WAAW,WAAW;GAAC;GAAQ;GAAY,KAAK;GAAa;GAAO;EAAM;EACzF,MAAM,KAAK,SAAS;GAAC;GAAQ;GAAO;GAAK,GAAG;EAAI;EAChD,mBAAmB;CACvB;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACxMA,IAAa,oBAAoB;;;;;;;;;;;;;;AAejC,SAAgB,gBAAgB,WAAmB,QAAQ,IAAI,GAAkB;CAC7E,IAAI,MAAM,KAAK,QAAQ,QAAQ;CAC/B,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC;CAE7B,OAAO,QAAQ,MAAM;EACjB,IAAI,GAAG,WAAW,KAAK,KAAK,KAAA,aAAsB,CAAC,GAC/C,OAAO;EAGX,MAAM,UAAU,KAAK,KAAK,KAAK,cAAc;EAE7C,IAAI,GAAG,WAAW,OAAO,GAAG;GACxB,IAAI;IACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;IAExD,IAAI,IAAI,cAAc,MAAM,QAAQ,IAAI,UAAU;SAC3B,IAAI,WAAW,MAAM,MACpC,MAAM,SAEN,GAAY,OAAO;IAAA;GAE/B,QAAQ,CAER;GAGA,IAAI,GAAG,WAAW,KAAK,KAAK,KAAK,SAAS,CAAC,KAAK,GAAG,WAAW,KAAK,KAAK,KAAK,QAAQ,CAAC,GAClF,OAAO;EAEf;EAEA,MAAM,KAAK,QAAQ,GAAG;CAC1B;CAEA,OAAO;AACX;;;;AAKA,SAAgB,eAAe,aAAoC;CAC/D,MAAM,aAAa,KAAK,KAAK,aAAa,SAAS;CACnD,OAAO,GAAG,WAAW,UAAU,IAAI,aAAa;AACpD;;;;AAKA,SAAgB,uBAAuB,YAAmC;CACtE,MAAM,UAAU,KAAK,KAAK,YAAY,cAAc;CACpD,IAAI,CAAC,GAAG,WAAW,OAAO,GAAG,OAAO;CAEpC,IAAI;EACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;EACxD,MAAM,OAAO;GAAE,GAAG,IAAI;GAC9B,GAAG,IAAI;EAAgB;EAGf,MAAM,aAAa,OAAO,KAAK,IAAI,CAAC,CAAC,QACjC,QAAO,IAAI,WAAW,oBAAoB,KAAK,QAAQ,mBAC3D;EAEA,IAAI,WAAW,WAAW,GAAG,OAAO;EAGpC,IAAI,WAAW,SAAS,4BAA4B,GAChD,OAAO;EAIX,KAAK,MAAM,aAAa,YACpB,IAAI,uBAAuB,YAAY,SAAS,GAC5C,OAAO;EAKf,OAAO,WAAW;CACtB,QAAQ,CAER;CACA,OAAO;AACX;;;;AAKA,SAAgB,uBAAuB,YAAoB,YAAmC;CAC1F,MAAM,aAAuB,CAAC;CAK9B,IAAI,MAAM,KAAK,QAAQ,UAAU;CACjC,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;CAC/B,OAAO,QAAQ,QAAQ;EACnB,WAAW,KACP,KAAK,KAAK,KAAK,gBAAgB,YAAY,OAAO,QAAQ,GAC1D,KAAK,KAAK,KAAK,gBAAgB,YAAY,QAAQ,QAAQ,CAC/D;EACA,MAAM,KAAK,QAAQ,GAAG;CAC1B;CAEA,WAAW,KAEP,KAAK,QAAQ,YAAY,MAAM,MAAM,MAAM,YAAY,WAAW,QAAQ,eAAe,EAAE,GAAG,OAAO,QAAQ,GAC7G,KAAK,QAAQ,YAAY,MAAM,MAAM,YAAY,WAAW,QAAQ,eAAe,EAAE,GAAG,OAAO,QAAQ,GACvG,KAAK,QAAQ,YAAY,MAAM,YAAY,WAAW,QAAQ,eAAe,EAAE,GAAG,OAAO,QAAQ,CACrG;CAEA,KAAK,MAAM,aAAa,YACpB,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CAEzC,OAAO;AACX;;;;AAKA,SAAgB,gBAAgB,aAAoC;CAChE,MAAM,cAAc,KAAK,KAAK,aAAa,UAAU;CACrD,OAAO,GAAG,WAAW,WAAW,IAAI,cAAc;AACtD;;;;AAKA,SAAgB,YAAY,aAAoC;CAC5D,MAAM,aAAa,CACf,KAAK,KAAK,aAAa,MAAM,GAC7B,KAAK,KAAK,aAAa,WAAW,MAAM,CAC5C;CAEA,KAAK,MAAM,aAAa,YACpB,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CAGzC,OAAO;AACX;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,YAAY,aAA6C;CACrE,MAAM,UAAU,YAAY,WAAW;CACvC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,OAAO,GAAG,OAAO,CAAC;CACjD,IAAI;EACA,OAAO,OAAO,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;CACzD,QAAQ;EAGJ,OAAO,CAAC;CACZ;AACJ;;;;;AAMA,SAAgB,gBAAgB,aAAqB,SAAgC;CACjF,MAAM,aAAa,CACf,KAAK,KAAK,aAAa,WAAW,gBAAgB,QAAQ,OAAO,GACjE,KAAK,KAAK,aAAa,gBAAgB,QAAQ,OAAO,CAC1D;CAGA,IAAI,SAAS,KAAK,QAAQ,WAAW;CACrC,MAAM,UAAU,KAAK,MAAM,MAAM,CAAC,CAAC;CACnC,OAAO,WAAW,SAAS;EACvB,WAAW,KAAK,KAAK,KAAK,QAAQ,gBAAgB,QAAQ,OAAO,CAAC;EAClE,SAAS,KAAK,QAAQ,MAAM;CAChC;CAEA,KAAK,MAAM,aAAa,YACpB,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CAIzC,IAAI;EACA,MAAM,aAAa,SAAS,SAAS,WAAW,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK;EAC5E,IAAI,cAAc,GAAG,WAAW,UAAU,GAAG,OAAO;CACxD,QAAQ,CAER;CAEA,OAAO;AACX;;;;AAKA,SAAgB,WAAW,aAAoC;CAC3D,OAAO,gBAAgB,aAAa,KAAK;AAC7C;;;;;;;;;;;;;;;AAgBA,SAAgB,wBAAwB,YAAmC;CACvE,IAAI;EAEA,MAAM,WAAW,GAAG,aAAa,UAAU;EAG3C,IAAI,MAAM,KAAK,QAAQ,QAAQ;EAC/B,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;EAC/B,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,QAAQ,SAAS;GACvD,MAAM,UAAU,KAAK,KAAK,KAAK,cAAc;GAC7C,IAAI,GAAG,WAAW,OAAO,GACrB,IAAI;IAEA,IADY,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CACnD,CAAA,CAAI,SAAS,OAAO;KAEpB,MAAM,gBAAgB,KAAK,KAAK,KAAK,QAAQ,eAAe;KAC5D,IAAI,CAAC,GAAG,WAAW,aAAa,GAC5B,OAAO,kBAAkB,IAAI;KAEjC,OAAO;IACX;GACJ,QAAQ,CAER;GAEJ,MAAM,KAAK,QAAQ,GAAG;EAC1B;EAGA,OAAO;CACX,SAAS,KAAK;EAEV,OAAO,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC3F;AACJ;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,yBAAyB,aAA6B;CAElE,OAAO,0CADS,cAAc,qBAAqB,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,GAC7B,EAAQ,QAAQ;AACrE;;;;;;;AAQA,SAAgB,6BAA6B,aAA4B;CACrE,QAAQ,MAAM,MAAM,IAAI,KAAK,yBAAyB,WAAW,GAAG,CAAC;CACrE,QAAQ,KAAK,CAAC;AAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,WACZ,SACA,MACA,MACA,QACK;CACL,MAAM,QAAiC;EAAE;EAAS;CAAK;CACvD,IAAI,SAAS,KAAA,GAAW,MAAM,OAAO;CACrC,IAAI,WAAW,KAAA,GAAW,MAAM,SAAS;CACzC,QAAQ,IAAI,KAAK,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CAC9C,QAAQ,KAAK,CAAC;AAClB;;AAGA,SAAgB,gBAAgB,OAA0B,QAAQ,MAAe;CAC7E,OAAO,KAAK,SAAS,QAAQ;AACjC;;;;AAKA,SAAgB,qBAA6B;CACzC,MAAM,OAAO,gBAAgB;CAC7B,IAAI,CAAC,MAAM;EACP,IAAI,gBAAgB,GAIhB,WACI,yCACA,mBACA,mDAAmD,kBAAkB,8EAEzE;EAQJ,QAAQ,MAAM,MAAM,IAAI,yCAAyC,CAAC;EAClE,QAAQ,MAAM,MAAM,KAAK,qDAAqD,kBAAkB,EAAE,CAAC;EACnG,QAAQ,MAAM,MAAM,KAAK,iFAAiF,CAAC;EAC3G,QAAQ,MAAM,MAAM,KAAK,qEAAqE,CAAC;EAC/F,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;;;;AAKA,SAAgB,kBAAkB,aAA6B;CAC3D,MAAM,aAAa,eAAe,WAAW;CAC7C,IAAI,CAAC,YAAY;EACb,IAAI,gBAAgB,GAChB,WACI,wCACA,kBACA,gBAAgB,KAAK,KAAK,aAAa,SAAS,GACpD;EAEJ,QAAQ,MAAM,MAAM,IAAI,wCAAwC,CAAC;EACjE,QAAQ,MAAM,MAAM,KAAK,kBAAkB,KAAK,KAAK,aAAa,SAAS,GAAG,CAAC;EAC/E,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX"}

package/dist/{pull-DqPRu1te.js → pull-Bj0XnH5s.js}

@@ -105,6 +105,35 @@ function anonymizeStatements(columns) {
 		return `UPDATE ${table.split(".").map((part) => `"${part}"`).join(".")} SET ${assignments};`;
 	});
 }
+/**
+* Schemas the restored copy needs the app role provisioned on.
+*
+* `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives
+* with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no
+* privileges behind them. Measured on a 30-table project: 68 policies restored,
+* 14 tables with RLS on, and **0** grants to `rebase_user` — where the source
+* had 60. Reading one table as the role Rebase serves every request through:
+*
+*     source:  6
+*     copy:    ERROR: permission denied for table leads
+*
+* The dump flags are right and stay: without `--no-owner`/`--no-privileges`
+* every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails
+* against roles that do not exist on a laptop, and buries the real output. The
+* repair belongs after the restore, and belongs to `ensureAppRole` — the same
+* routine boot and `rebase db push` call — rather than to a second list of
+* grants written here.
+*
+* Which schemas: every non-system schema the restored database actually has.
+* Boot knows its `managedSchemas` from the collections; a restore knows only
+* what arrived, and a source may carry schemas this project does not declare.
+* `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to
+* grant on and PostgreSQL would refuse anyway.
+*/
+function provisionableSchemas(rows) {
+	const skip = (name) => name === "information_schema" || name.startsWith("pg_");
+	return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();
+}
 /** Host and database of a connection string, with no credentials in it. */
 function describeTarget(connectionString) {
 	try {
@@ -162,6 +191,6 @@ async function findPgDump() {
 	}
 }
 //#endregion
-export { anonymizeStatements, describeTarget, dumpArgs, findPgDump, restoreArgs };
+export { anonymizeStatements, describeTarget, dumpArgs, findPgDump, provisionableSchemas, restoreArgs };
 
-//# sourceMappingURL=pull-DqPRu1te.js.map
+//# sourceMappingURL=pull-Bj0XnH5s.js.map

package/dist/pull-Bj0XnH5s.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull-Bj0XnH5s.js","names":[],"sources":["../src/dev-db/pull.ts"],"sourcesContent":["/**\n * `rebase db pull` — copy a database's contents into local development.\n *\n * The common case is production into local, and the reason it exists is that\n * the alternative is worse: without it people hand-roll a `pg_dump | psql` and\n * get the flags wrong in ways that either fail loudly at 2am or, more often,\n * quietly restore half a schema.\n *\n * Three things this command insists on, because copying a production database\n * onto a laptop is a data-protection event whether or not anyone calls it one:\n *\n * 1. **It says what it is about to do, in full, before doing it** — which\n *    database it will read, which one it will overwrite, and where the data will\n *    come to rest on disk. The target path matters: people forget that\n *    `.rebase/pgdata` is a directory their backup software may be indexing.\n *\n * 2. **It refuses to run unattended without being told to.** The target is\n *    destroyed, so a mistyped `--from` with no confirmation would take the\n *    developer's working database with it.\n *\n * 3. **It will not write to a remote database.** The target is always the local\n *    development database; there is no flag that makes this push. A tool that\n *    can copy in both directions eventually copies in the wrong one.\n *\n * Anonymization is opt-in (`--anonymize`), which is a deliberate choice and not\n * an obviously safe one — the flag nobody types is the flag nobody gets. It is\n * a best-effort pass over columns whose *names* look like personal data, and\n * {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in\n * a column called `notes`, and this file says so rather than implying a\n * guarantee it cannot keep.\n */\n\nimport { execa } from \"execa\";\n\n/**\n * Column-name patterns the anonymizer overwrites.\n *\n * Names, not contents: inspecting values would be slower, and would still miss\n * the same things. This is a reasonable-effort measure for making a local copy\n * less dangerous, and it is not a compliance control.\n */\nexport const ANONYMIZE_PATTERNS: readonly { pattern: RegExp; replacement: string }[] = [\n    { pattern: /^(.*_)?e?mail(_.*)?$/i, replacement: \"concat('user', id::text, '@example.invalid')\" },\n    { pattern: /^(.*_)?(phone|mobile|tel|telephone)(_.*)?$/i, replacement: \"'+10000000000'\" },\n    { pattern: /^(.*_)?(first_name|last_name|full_name|surname|given_name)(_.*)?$/i, replacement: \"'Redacted'\" },\n    { pattern: /^(.*_)?(address|street|postcode|zip|zipcode)(_.*)?$/i, replacement: \"'Redacted'\" },\n    { pattern: /^(.*_)?(ssn|tax_id|national_id|passport)(_.*)?$/i, replacement: \"'REDACTED'\" },\n    { pattern: /^(.*_)?(password|password_hash|secret|token|api_key|access_token|refresh_token)(_.*)?$/i, replacement: \"'REDACTED'\" },\n    { pattern: /^(.*_)?(ip|ip_address|user_agent)(_.*)?$/i, replacement: \"'REDACTED'\" }\n];\n\nexport function shouldAnonymize(columnName: string): boolean {\n    return ANONYMIZE_PATTERNS.some((rule) => rule.pattern.test(columnName));\n}\n\nexport function replacementFor(columnName: string): string | null {\n    return ANONYMIZE_PATTERNS.find((rule) => rule.pattern.test(columnName))?.replacement ?? null;\n}\n\n/** A text-ish column the anonymizer can overwrite without a type error. */\nexport interface ColumnRef {\n    schema: string;\n    table: string;\n    column: string;\n    dataType: string;\n}\n\n/**\n * Anonymizable columns: name looks personal, and the type can hold the\n * replacement.\n *\n * The type check is what stops this generating `UPDATE … SET user_id =\n * 'Redacted'` for an integer column called `user_id_email_seq` and failing the\n * whole pass on a technicality.\n */\nexport function anonymizableColumns(columns: readonly ColumnRef[]): ColumnRef[] {\n    const textual = new Set([\"text\", \"character varying\", \"varchar\", \"character\", \"char\", \"citext\"]);\n\n    return columns.filter((column) => shouldAnonymize(column.column) && textual.has(column.dataType.toLowerCase()));\n}\n\n/** `UPDATE` statements for one anonymization pass, in a stable order. */\nexport function anonymizeStatements(columns: readonly ColumnRef[]): string[] {\n    const byTable = new Map<string, ColumnRef[]>();\n    for (const column of anonymizableColumns(columns)) {\n        const key = `${column.schema}.${column.table}`;\n        byTable.set(key, [...(byTable.get(key) ?? []), column]);\n    }\n\n    return [...byTable.entries()]\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([table, cols]) => {\n            const assignments = [...cols]\n                .sort((a, b) => a.column.localeCompare(b.column))\n                .map((column) => `\"${column.column}\" = ${replacementFor(column.column)}`)\n                .join(\", \");\n\n            return `UPDATE ${table.split(\".\").map((part) => `\"${part}\"`).join(\".\")} SET ${assignments};`;\n        });\n}\n\n/**\n * Schemas the restored copy needs the app role provisioned on.\n *\n * `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives\n * with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no\n * privileges behind them. Measured on a 30-table project: 68 policies restored,\n * 14 tables with RLS on, and **0** grants to `rebase_user` — where the source\n * had 60. Reading one table as the role Rebase serves every request through:\n *\n *     source:  6\n *     copy:    ERROR: permission denied for table leads\n *\n * The dump flags are right and stay: without `--no-owner`/`--no-privileges`\n * every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails\n * against roles that do not exist on a laptop, and buries the real output. The\n * repair belongs after the restore, and belongs to `ensureAppRole` — the same\n * routine boot and `rebase db push` call — rather than to a second list of\n * grants written here.\n *\n * Which schemas: every non-system schema the restored database actually has.\n * Boot knows its `managedSchemas` from the collections; a restore knows only\n * what arrived, and a source may carry schemas this project does not declare.\n * `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to\n * grant on and PostgreSQL would refuse anyway.\n */\nexport function provisionableSchemas(rows: readonly { schema: string }[]): string[] {\n    const skip = (name: string) => name === \"information_schema\" || name.startsWith(\"pg_\");\n\n    return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();\n}\n\n/** Host and database of a connection string, with no credentials in it. */\nexport function describeTarget(connectionString: string): string {\n    try {\n        const url = new URL(connectionString);\n        const database = url.pathname.replace(/^\\//, \"\") || \"(default)\";\n\n        return `${url.hostname}${url.port ? `:${url.port}` : \"\"}/${database}`;\n    } catch {\n        // Never echo the raw string: it carries a password, and this line is\n        // printed to a terminal people paste into issues.\n        return \"(unparseable connection string)\";\n    }\n}\n\nexport interface PullPlan {\n    /** Where the data comes from. */\n    source: string;\n    /** Where it lands. Always local. */\n    target: string;\n    anonymize: boolean;\n    /** Schemas to copy. Empty means every non-system schema. */\n    schemas: string[];\n}\n\n/**\n * `pg_dump` arguments for the source.\n *\n * `--no-owner` and `--no-acl` because the roles on a production server do not\n * exist locally, and without them every `ALTER … OWNER TO` in the dump fails and\n * buries the real output in noise. `--format=custom` so `pg_restore` can be told\n * to continue past errors selectively rather than all-or-nothing.\n */\nexport function dumpArgs(plan: PullPlan): string[] {\n    const args = [\"--format=custom\", \"--no-owner\", \"--no-acl\", \"--no-privileges\"];\n    for (const schema of plan.schemas) args.push(\"--schema\", schema);\n    args.push(\"--dbname\", plan.source);\n\n    return args;\n}\n\n/**\n * `pg_restore` arguments for the target.\n *\n * `--clean --if-exists` because a pull replaces what is there: restoring into a\n * database that already has the tables would otherwise fail on every one of\n * them. `--no-owner` for the same reason as the dump.\n */\nexport function restoreArgs(plan: PullPlan, dumpFile: string): string[] {\n    return [\"--clean\", \"--if-exists\", \"--no-owner\", \"--no-privileges\", \"--dbname\", plan.target, dumpFile];\n}\n\n/** Is `pg_dump` on PATH, and what version? Checked before anything destructive. */\nexport async function findPgDump(): Promise<string | null> {\n    try {\n        const { stdout } = await execa(\"pg_dump\", [\"--version\"]);\n\n        return stdout.trim();\n    } catch {\n        return null;\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAyCA,IAAa,qBAA0E;CACnF;EAAE,SAAS;EAAyB,aAAa;CAA+C;CAChG;EAAE,SAAS;EAA+C,aAAa;CAAiB;CACxF;EAAE,SAAS;EAAsE,aAAa;CAAa;CAC3G;EAAE,SAAS;EAAwD,aAAa;CAAa;CAC7F;EAAE,SAAS;EAAoD,aAAa;CAAa;CACzF;EAAE,SAAS;EAA2F,aAAa;CAAa;CAChI;EAAE,SAAS;EAA6C,aAAa;CAAa;AACtF;AAEA,SAAgB,gBAAgB,YAA6B;CACzD,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC;AAC1E;AAEA,SAAgB,eAAe,YAAmC;CAC9D,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC,CAAC,EAAE,eAAe;AAC5F;;;;;;;;;AAkBA,SAAgB,oBAAoB,SAA4C;CAC5E,MAAM,0BAAU,IAAI,IAAI;EAAC;EAAQ;EAAqB;EAAW;EAAa;EAAQ;CAAQ,CAAC;CAE/F,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,SAAS,YAAY,CAAC,CAAC;AAClH;;AAGA,SAAgB,oBAAoB,SAAyC;CACzE,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC/C,MAAM,MAAM,GAAG,OAAO,OAAO,GAAG,OAAO;EACvC,QAAQ,IAAI,KAAK,CAAC,GAAI,QAAQ,IAAI,GAAG,KAAK,CAAC,GAAI,MAAM,CAAC;CAC1D;CAEA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,OAAO,UAAU;EACpB,MAAM,cAAc,CAAC,GAAG,IAAI,CAAC,CACxB,MAAM,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC,CAAC,CAChD,KAAK,WAAW,IAAI,OAAO,OAAO,MAAM,eAAe,OAAO,MAAM,GAAG,CAAC,CACxE,KAAK,IAAI;EAEd,OAAO,UAAU,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,OAAO,YAAY;CAC9F,CAAC;AACT;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,MAA+C;CAChF,MAAM,QAAQ,SAAiB,SAAS,wBAAwB,KAAK,WAAW,KAAK;CAErF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;AAC1F;;AAGA,SAAgB,eAAe,kBAAkC;CAC7D,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,MAAM,WAAW,IAAI,SAAS,QAAQ,OAAO,EAAE,KAAK;EAEpD,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,GAAG;CAC/D,QAAQ;EAGJ,OAAO;CACX;AACJ;;;;;;;;;AAoBA,SAAgB,SAAS,MAA0B;CAC/C,MAAM,OAAO;EAAC;EAAmB;EAAc;EAAY;CAAiB;CAC5E,KAAK,MAAM,UAAU,KAAK,SAAS,KAAK,KAAK,YAAY,MAAM;CAC/D,KAAK,KAAK,YAAY,KAAK,MAAM;CAEjC,OAAO;AACX;;;;;;;;AASA,SAAgB,YAAY,MAAgB,UAA4B;CACpE,OAAO;EAAC;EAAW;EAAe;EAAc;EAAmB;EAAY,KAAK;EAAQ;CAAQ;AACxG;;AAGA,eAAsB,aAAqC;CACvD,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,WAAW,CAAC,WAAW,CAAC;EAEvD,OAAO,OAAO,KAAK;CACvB,QAAQ;EACJ,OAAO;CACX;AACJ"}