@rebasepro/cli 0.19.1-canary.gafb2f80 → 0.19.1

package/dist/commands/db.d.ts

@@ -112,6 +112,36 @@ export declare function refuseAtlasOnManagedDatabase(rawArgs: string[], kind: st
  * cover. It does now.
  */
 export declare function refuseBranchOnManagedDatabase(rawArgs: string[], kind: string): void;
+/**
+ * The one place this CLI spawns the driver's own CLI.
+ *
+ * There were three, each with its own copy of "tsx for a `.ts` entry, `node`
+ * otherwise". That rule was right only while the driver shipped `src/`; once it
+ * shipped `dist/cli.js` all three quietly switched to plain `node`, and the
+ * driver loads the PROJECT's TypeScript in process:
+ *
+ *   - `schema stale` reads the collections, could not resolve `./authors` onto
+ *     `authors.ts`, and answered "⏭ Not checked" while exiting 0;
+ *   - `db push` does the same in `ensureAuthTables`, so `rebase.users` was never
+ *     created and the push died at "Applying RLS policies" with
+ *     `relation "rebase.users" does not exist` — on a virgin database, which is
+ *     the documented bring-your-own-Postgres first run.
+ *
+ * Two were fixed and the third was missed, because three copies of a decision
+ * are three chances to miss one. There is one now, and a gate holds it at one.
+ *
+ * tsx whenever it is installed — a devDependency of every scaffold, for exactly
+ * this reason. Without it a `.ts` entry cannot run at all; a built entry still
+ * runs, and the subcommands that never touch the project's TypeScript still work.
+ */
+export declare function spawnDriverCli(resolved: {
+    projectRoot: string;
+    backendDir: string;
+    pluginCli: string;
+    env: Record<string, string>;
+}, childArgs: string[], options?: {
+    quiet?: boolean;
+}): Promise<void>;
 /**
  * Run a `schema` subcommand through the active driver's CLI.
  *

package/dist/{daemon-YDZK9NZ1.js → daemon-DR9Tk0La.js}

@@ -28,6 +28,7 @@ var daemon_exports = /* @__PURE__ */ __exportAll({
 	findRunningDaemon: () => findRunningDaemon,
 	isDaemonAlive: () => isDaemonAlive,
 	managedUrl: () => managedUrl,
+	pgliteLogTail: () => pgliteLogTail,
 	resetManagedDatabase: () => resetManagedDatabase,
 	resolveSpawn: () => resolveSpawn,
 	stopManagedDatabase: () => stopManagedDatabase
@@ -60,6 +61,29 @@ var MANAGED_DATABASE = "postgres";
 * Putting it in the URL fixes every consumer at once — Atlas, `pg`, and anything
 * a driver shells out to later — rather than teaching each one about PGlite.
 */
+/**
+* The end of `pglite.log`, for an error message that has to carry its own reason.
+*
+* The daemon writes its output to a file because it is detached — it has to
+* outlive the command that started it. That is right, and it means every
+* startup failure used to be reported as a path: "see pglite.log for the
+* reason". On a laptop that is a fair trade. In CI it is not a trade at all,
+* because the runner discards the workspace: the log named in the message no
+* longer exists by the time anybody reads the message, so a failed run says
+* only that something failed.
+*
+* So the tail comes with the error. Bounded, because a log that has been
+* appended to across many runs is not something to paste in full.
+*/
+function pgliteLogTail(projectRoot, lines = 12) {
+	try {
+		const contents = fs.readFileSync(path.join(devDbDir(projectRoot), "pglite.log"), "utf8").trimEnd();
+		if (!contents) return "  (pglite.log is empty — the daemon wrote nothing before exiting)";
+		return contents.split("\n").slice(-lines).map((line) => `      ${line}`).join("\n");
+	} catch {
+		return "  (pglite.log could not be read)";
+	}
+}
 function managedUrl(port) {
 	return `postgresql://${MANAGED_USER}@127.0.0.1:${port}/${MANAGED_DATABASE}?sslmode=disable`;
 }
@@ -243,10 +267,10 @@ async function ensureManagedDatabase(projectRoot, options = {}) {
 				announced = true;
 				options.onProgress?.("Starting the development database…");
 			}
-			if (child.exitCode !== null && child.exitCode !== 0) throw new Error(`The development database failed to start (exit ${child.exitCode}).\n  See ${path.join(devDbDir(projectRoot), "pglite.log")} for the reason.`);
+			if (child.exitCode !== null && child.exitCode !== 0) throw new Error(`The development database failed to start (exit ${child.exitCode}).\n  ${path.join(devDbDir(projectRoot), "pglite.log")} ends:\n` + pgliteLogTail(projectRoot));
 			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
 		}
-		throw new Error(`The development database did not start within ${Math.round(START_TIMEOUT_MS / 1e3)}s.\n  See ${path.join(devDbDir(projectRoot), "pglite.log")} for the reason.\n  To use your own Postgres instead, set DATABASE_URL or pass --database-url.`);
+		throw new Error(`The development database did not start within ${Math.round(START_TIMEOUT_MS / 1e3)}s.\n  ${path.join(devDbDir(projectRoot), "pglite.log")} ends:\n` + pgliteLogTail(projectRoot) + "\n  To use your own Postgres instead, set DATABASE_URL or pass --database-url.");
 	} finally {
 		releaseStartLock(projectRoot);
 	}
@@ -328,4 +352,4 @@ function ensureGitignore(projectRoot) {
 //#endregion
 export { managedUrl as i, ensureManagedDatabase as n, findRunningDaemon as r, daemon_exports as t };
 
-//# sourceMappingURL=daemon-YDZK9NZ1.js.map
+//# sourceMappingURL=daemon-DR9Tk0La.js.map

package/dist/daemon-DR9Tk0La.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"daemon-DR9Tk0La.js","names":[],"sources":["../src/dev-db/daemon.ts"],"sourcesContent":["/**\n * Starting, finding and stopping the managed database, from the caller's side.\n *\n * Every command that needs Postgres calls {@link ensureManagedDatabase} and\n * gets a connection string back. Whether that started a process or found one\n * already running is not the caller's business, which is the point: `rebase\n * db push`, `rebase dev` and `rebase studio` in three terminals must all reach\n * the same database without coordinating, because two processes opening one\n * PGlite data directory would corrupt it.\n *\n * The hard part is not starting the daemon; it is deciding whether the one the\n * state file describes is still there. A pid can be recycled after a reboot and\n * a port can be taken by a stranger, so believing either on its own would let\n * Rebase send a migration somewhere unintended. {@link isDaemonAlive} asks the\n * daemon to identify itself instead.\n */\n\nimport { randomBytes } from \"crypto\";\nimport { type ChildProcess, spawn } from \"child_process\";\nimport fs from \"fs\";\nimport net from \"net\";\nimport path from \"path\";\nimport { fileURLToPath } from \"url\";\n\nimport {\n    acquireStartLock,\n    clearState,\n    type DaemonState,\n    dataDir,\n    devDbDir,\n    findFreePort,\n    pidRunning,\n    readState,\n    releaseStartLock,\n    stateFile\n} from \"./state\";\n\n/** How long to wait for a first boot. PGlite runs initdb on an empty data dir. */\nconst START_TIMEOUT_MS = 60_000;\n/** Poll interval while waiting for the daemon to publish its state file. */\nconst POLL_INTERVAL_MS = 150;\n/** How long the identity handshake may take before we call it dead. */\nconst IDENTITY_TIMEOUT_MS = 1_500;\n\nexport interface ManagedDatabase {\n    /** Connection string for this project's managed database. */\n    url: string;\n    /** Where the data lives, for diagnostics and `--reset`. */\n    dataDir: string;\n    port: number;\n    pid: number;\n    /** True when this call started the daemon rather than finding it. */\n    started: boolean;\n    /**\n     * Connection strings for the additional databases the caller asked for,\n     * by declared key — `database(\"analytics\")` → `analytics`. Each is its\n     * own PGlite instance behind the same daemon.\n     */\n    additional: Record<string, string>;\n}\n\n/**\n * PGlite's built-in superuser and database.\n *\n * Fixed by PGlite rather than chosen here, and asserted by the socket spike:\n * `session_user` comes back as `postgres`.\n */\nconst MANAGED_USER = \"postgres\";\nconst MANAGED_DATABASE = \"postgres\";\n\n/**\n * The DSN for the managed development database.\n *\n * **`sslmode=disable` is not decoration.** PGlite's socket server speaks no TLS,\n * and libpq-family clients try SSL first — so Atlas, which `rebase db push`\n * shells out to, failed the whole push with\n * `pq: SSL is not enabled on the server`. Its remedy box then told the reader to\n * append `sslmode=disable` to `DATABASE_URL`, which on this path is not set at\n * all: `rebase init` leaves it commented out precisely so the managed database\n * is used. The advice was correct and unfollowable.\n *\n * Putting it in the URL fixes every consumer at once — Atlas, `pg`, and anything\n * a driver shells out to later — rather than teaching each one about PGlite.\n */\n\n/**\n * The end of `pglite.log`, for an error message that has to carry its own reason.\n *\n * The daemon writes its output to a file because it is detached — it has to\n * outlive the command that started it. That is right, and it means every\n * startup failure used to be reported as a path: \"see pglite.log for the\n * reason\". On a laptop that is a fair trade. In CI it is not a trade at all,\n * because the runner discards the workspace: the log named in the message no\n * longer exists by the time anybody reads the message, so a failed run says\n * only that something failed.\n *\n * So the tail comes with the error. Bounded, because a log that has been\n * appended to across many runs is not something to paste in full.\n */\nexport function pgliteLogTail(projectRoot: string, lines = 12): string {\n    try {\n        const contents = fs.readFileSync(path.join(devDbDir(projectRoot), \"pglite.log\"), \"utf8\").trimEnd();\n        if (!contents) return \"  (pglite.log is empty — the daemon wrote nothing before exiting)\";\n        return contents.split(\"\\n\").slice(-lines).map(line => `      ${line}`).join(\"\\n\");\n    } catch {\n        return \"  (pglite.log could not be read)\";\n    }\n}\n\nexport function managedUrl(port: number): string {\n    return `postgresql://${MANAGED_USER}@127.0.0.1:${port}/${MANAGED_DATABASE}?sslmode=disable`;\n}\n\n/**\n * Ask the process behind a state record to prove it is the one we wrote down.\n *\n * A pid check alone answers \"is *a* process running\", and a port check alone\n * answers \"is *something* listening\" — after a reboot both say yes about\n * strangers. The daemon answers with the token from its own state file, so a\n * match is the only evidence accepted.\n */\nexport function isDaemonAlive(state: DaemonState): Promise<boolean> {\n    if (!pidRunning(state.pid)) return Promise.resolve(false);\n\n    return new Promise((resolve) => {\n        const socket = new net.Socket();\n        let answer = \"\";\n        const settle = (alive: boolean) => {\n            socket.removeAllListeners();\n            socket.destroy();\n            resolve(alive);\n        };\n        socket.setTimeout(IDENTITY_TIMEOUT_MS);\n        socket.once(\"timeout\", () => settle(false));\n        socket.once(\"error\", () => settle(false));\n        socket.on(\"data\", (chunk) => {\n            answer += chunk.toString(\"utf8\");\n            if (answer.includes(\"\\n\")) settle(answer.trim() === `rebase-dev-db ${state.token}`);\n        });\n        socket.once(\"close\", () => settle(answer.trim() === `rebase-dev-db ${state.token}`));\n        socket.connect(state.identityPort, \"127.0.0.1\");\n    });\n}\n\n/** The running daemon for this project, or `null`. Never starts anything. */\nexport async function findRunningDaemon(projectRoot: string): Promise<DaemonState | null> {\n    const state = readState(projectRoot);\n    if (!state) return null;\n    if (await isDaemonAlive(state)) return state;\n\n    // The record describes something that is not there. Clearing it is the\n    // whole recovery: the next ensure call starts a fresh daemon, and leaving\n    // it would make every subsequent check pay the identity timeout.\n    clearState(projectRoot);\n\n    return null;\n}\n\n/**\n * Resolve the CLI entry point, so the daemon can be spawned as ourselves.\n *\n * A hidden subcommand rather than a second build entry: under `tsx` this file\n * is `src/dev-db/daemon.ts` and in a published CLI it is bundled into\n * `dist/index.js`, and in both cases the executable to re-invoke is the one\n * already running.\n */\nfunction resolveCliEntry(): string {\n    // `process.argv[1]` is `bin/rebase.js` for a real invocation, which is\n    // exactly what should be re-run. Under a test runner it is the runner, so\n    // fall back to this module's own directory.\n    const argvEntry = process.argv[1];\n    if (argvEntry && fs.existsSync(argvEntry)) return argvEntry;\n\n    return fileURLToPath(new URL(\"../index.js\", import.meta.url));\n}\n\n/**\n * How to re-invoke ourselves, which differs between a published CLI and this\n * repository.\n *\n * A published `rebase` is `node bin/rebase.js`, and re-running that is trivial.\n * Inside the monorepo the entry is TypeScript, which plain `node` cannot load —\n * so the daemon has to be started through the same loader that is running now.\n * Getting this wrong fails as a spawn that exits instantly with a syntax error,\n * which is why the caller reads `pglite.log` on failure.\n */\nexport function resolveSpawn(entry: string): { execPath: string; prefixArgs: string[] } {\n    if (!/\\.[cm]?ts$/.test(entry)) return { execPath: process.execPath, prefixArgs: [] };\n\n    // Node can load TypeScript when tsx is registered as an import hook. tsx is\n    // already a dependency of this package, because `rebase dev` runs the\n    // backend through it.\n    return { execPath: process.execPath, prefixArgs: [\"--import\", \"tsx\"] };\n}\n\nexport interface EnsureOptions {\n    /** Silence the \"starting…\" progress line. */\n    quiet?: boolean;\n    /** Milliseconds of inactivity before the daemon exits. 0 disables. */\n    idleTimeoutMs?: number;\n    /** Where progress goes. Injected for tests. */\n    onProgress?: (message: string) => void;\n    /** Override how the daemon process is launched. For tests. */\n    spawn?: { execPath: string; prefixArgs: string[] };\n    /**\n     * Override the CLI entry to re-invoke. For tests.\n     *\n     * Necessary because under a test runner `process.argv[1]` is the runner\n     * itself, which exists and is therefore accepted by {@link resolveCliEntry}\n     * — spawning vitest with `__dev-db-daemon` rather than the CLI.\n     */\n    entry?: string;\n    /**\n     * Keys of the additional databases the project declares, beyond the\n     * default. Each is served by the daemon on request, so a project that\n     * adds `database(\"analytics\")` while the daemon is running gets it\n     * without a restart.\n     */\n    additionalKeys?: readonly string[];\n}\n\n/**\n * Ask the running daemon for one additional database, and get its port.\n *\n * The identity socket doubles as the command channel: the daemon answers\n * with its token first, which is how the caller knows it is talking to the\n * daemon the state file describes and not to a stranger on a recycled port.\n */\nfunction ensureAdditionalDatabase(state: DaemonState, key: string): Promise<number> {\n    return new Promise((resolve, reject) => {\n        const socket = new net.Socket();\n        let answer = \"\";\n        let identified = false;\n        const fail = (message: string) => {\n            socket.removeAllListeners();\n            socket.destroy();\n            reject(new Error(message));\n        };\n        socket.setTimeout(START_TIMEOUT_MS);\n        socket.once(\"timeout\", () => fail(`The development database did not answer for \"${key}\" within ${Math.round(START_TIMEOUT_MS / 1000)}s.`));\n        socket.once(\"error\", (err) => fail(`Could not reach the development database for \"${key}\": ${err.message}`));\n        socket.on(\"data\", (chunk) => {\n            answer += chunk.toString(\"utf8\");\n            let newline = answer.indexOf(\"\\n\");\n            while (newline !== -1) {\n                const line = answer.slice(0, newline).trim();\n                answer = answer.slice(newline + 1);\n                if (!identified) {\n                    if (line !== `rebase-dev-db ${state.token}`) return fail(\"The process on the development database's port is not the daemon.\");\n                    identified = true;\n                    socket.write(`ensure ${key}\\n`);\n                } else if (line.startsWith(\"ok \")) {\n                    const port = Number(line.slice(3));\n                    socket.removeAllListeners();\n                    socket.destroy();\n                    if (!Number.isInteger(port) || port <= 0) return reject(new Error(`The development database answered with an invalid port for \"${key}\": ${line}`));\n                    return resolve(port);\n                } else {\n                    return fail(`The development database could not serve \"${key}\": ${line.replace(/^error\\s*/, \"\")}`);\n                }\n                newline = answer.indexOf(\"\\n\");\n            }\n        });\n        socket.connect(state.identityPort, \"127.0.0.1\");\n    });\n}\n\n/** Every additional database the caller asked for, as connection strings. */\nasync function adoptWithAdditional(state: DaemonState, started: boolean, keys: readonly string[]): Promise<ManagedDatabase> {\n    const additional: Record<string, string> = {};\n    for (const key of keys) {\n        const known = state.databases?.[key];\n        const port = known ? known.port : await ensureAdditionalDatabase(state, key);\n        additional[key] = managedUrl(port);\n    }\n    return { ...adopt(state, started), additional };\n}\n\n/**\n * The project's managed database, started if it is not already running.\n *\n * Safe to call concurrently from several commands: the loser of the race finds\n * the winner's state file during its poll and adopts it rather than starting a\n * second daemon.\n */\nexport async function ensureManagedDatabase(\n    projectRoot: string,\n    options: EnsureOptions = {}\n): Promise<ManagedDatabase> {\n    const keys = options.additionalKeys ?? [];\n    const existing = await findRunningDaemon(projectRoot);\n    if (existing) return adoptWithAdditional(existing, false, keys);\n\n    fs.mkdirSync(devDbDir(projectRoot), { recursive: true });\n    ensureGitignore(projectRoot);\n\n    // Exactly one process may spawn a daemon. Without this, `rebase dev` and\n    // `rebase db push` started in the same second both see no state file, both\n    // spawn, and two processes open one PGlite data directory — the corruption\n    // the single-daemon design exists to prevent.\n    if (!acquireStartLock(projectRoot, START_TIMEOUT_MS)) {\n        const adopted = await waitForDaemon(projectRoot, START_TIMEOUT_MS);\n        if (adopted) return adoptWithAdditional(adopted, false, keys);\n\n        // The holder gave up or died without publishing. Falling through to\n        // start one ourselves is better than failing: the lock is stale by now,\n        // so the next acquire will break it.\n        if (!acquireStartLock(projectRoot, 0)) {\n            throw new Error(\n                \"Another process is starting the development database and did not finish.\\n\" +\n                `  Remove ${path.join(devDbDir(projectRoot), \"starting.lock\")} if nothing is running.`\n            );\n        }\n    }\n\n    const port = await findFreePort();\n    const token = randomBytes(16).toString(\"hex\");\n    const entry = options.entry ?? resolveCliEntry();\n\n    const spawnPlan = options.spawn ?? resolveSpawn(entry);\n    const args = [\n        ...spawnPlan.prefixArgs,\n        entry,\n        \"__dev-db-daemon\",\n        \"--project\", projectRoot,\n        \"--port\", String(port),\n        \"--token\", token\n    ];\n    if (options.idleTimeoutMs !== undefined) {\n        args.push(\"--idle-timeout\", String(options.idleTimeoutMs));\n    }\n\n    const log = fs.openSync(path.join(devDbDir(projectRoot), \"pglite.log\"), \"a\");\n    const child: ChildProcess = spawn(spawnPlan.execPath, args, {\n        // Detached with no stdin and its output on a file: the daemon must\n        // survive the command that started it, and must not hold the terminal\n        // open when that command exits.\n        detached: true,\n        stdio: [\"ignore\", log, log]\n    });\n    child.unref();\n\n    try {\n        const deadline = Date.now() + START_TIMEOUT_MS;\n        let announced = false;\n        while (Date.now() < deadline) {\n            const state = readState(projectRoot);\n            if (state && (await isDaemonAlive(state))) return adoptWithAdditional(state, true, keys);\n\n            if (!announced && !options.quiet) {\n                announced = true;\n                options.onProgress?.(\"Starting the development database…\");\n            }\n\n            // A daemon that died on startup will never publish a state file, and\n            // waiting the full minute for that is a bad way to learn it. The log\n            // is the only place the reason exists.\n            if (child.exitCode !== null && child.exitCode !== 0) {\n                throw new Error(\n                    `The development database failed to start (exit ${child.exitCode}).\\n` +\n                    `  ${path.join(devDbDir(projectRoot), \"pglite.log\")} ends:\\n` +\n                    pgliteLogTail(projectRoot)\n                );\n            }\n\n            await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n        }\n\n        throw new Error(\n            `The development database did not start within ${Math.round(START_TIMEOUT_MS / 1000)}s.\\n` +\n            `  ${path.join(devDbDir(projectRoot), \"pglite.log\")} ends:\\n` +\n            pgliteLogTail(projectRoot) + \"\\n\" +\n            \"  To use your own Postgres instead, set DATABASE_URL or pass --database-url.\"\n        );\n    } finally {\n        // Released whether we succeeded, timed out or threw. A lock left behind\n        // by a crash is broken by age, but only after a full timeout — which a\n        // developer should never have to wait out.\n        releaseStartLock(projectRoot);\n    }\n}\n\n/** Shape a live state record as the caller's result. */\nfunction adopt(state: DaemonState, started: boolean): ManagedDatabase {\n    return {\n        url: managedUrl(state.port),\n        dataDir: state.dataDir,\n        port: state.port,\n        pid: state.pid,\n        started,\n        additional: {}\n    };\n}\n\n/** Poll until another process publishes a live daemon, or give up. */\nasync function waitForDaemon(projectRoot: string, timeoutMs: number): Promise<DaemonState | null> {\n    const deadline = Date.now() + timeoutMs;\n    while (Date.now() < deadline) {\n        const state = readState(projectRoot);\n        if (state && (await isDaemonAlive(state))) return state;\n        await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));\n    }\n\n    return null;\n}\n\n/** Stop the daemon. Returns false when there was nothing running. */\nexport async function stopManagedDatabase(projectRoot: string): Promise<boolean> {\n    const state = await findRunningDaemon(projectRoot);\n    if (!state) return false;\n\n    try {\n        process.kill(state.pid, \"SIGTERM\");\n    } catch {\n        clearState(projectRoot);\n\n        return false;\n    }\n\n    // Wait for it to clear its own state file, which is how it says it closed\n    // the data directory cleanly. A hard kill here would risk the WAL.\n    const deadline = Date.now() + 10_000;\n    while (Date.now() < deadline) {\n        if (!fs.existsSync(stateFile(projectRoot))) return true;\n        await new Promise((resolve) => setTimeout(resolve, 100));\n    }\n\n    clearState(projectRoot);\n\n    return true;\n}\n\n/**\n * Stop the daemon and delete the data directory.\n *\n * Destructive and deliberately not clever: it removes the whole directory\n * rather than dropping schemas, because \"give me an empty database\" is the only\n * thing anyone means by it.\n */\nexport async function resetManagedDatabase(projectRoot: string): Promise<void> {\n    await stopManagedDatabase(projectRoot);\n    fs.rmSync(dataDir(projectRoot), { recursive: true, force: true });\n    // Every additional database too: `pgdata__<key>` beside `pgdata`. \"Give\n    // me an empty database\" means all of them — a reset that emptied the\n    // default and kept the analytics rows would be a surprise on first read.\n    const dir = devDbDir(projectRoot);\n    if (fs.existsSync(dir)) {\n        for (const entry of fs.readdirSync(dir)) {\n            if (entry.startsWith(\"pgdata__\")) fs.rmSync(path.join(dir, entry), { recursive: true, force: true });\n        }\n    }\n    clearState(projectRoot);\n}\n\n/**\n * Keep the generated directory out of git.\n *\n * `.rebase/` holds a Postgres data directory and a log. A project that commits\n * it will push hundreds of megabytes and a database that only makes sense on\n * one machine, so the ignore file is written next to the data rather than\n * relying on the project's root `.gitignore` having been updated.\n */\nfunction ensureGitignore(projectRoot: string): void {\n    const target = path.join(devDbDir(projectRoot), \".gitignore\");\n    if (fs.existsSync(target)) return;\n    fs.writeFileSync(\n        target,\n        \"# Generated by `rebase dev` — a local Postgres data directory and its log.\\n\" +\n        \"# Machine-specific and large; never commit it.\\n*\\n\",\n        \"utf8\"\n    );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,IAAM,mBAAmB;;AAEzB,IAAM,mBAAmB;;AAEzB,IAAM,sBAAsB;;;;;;;AAyB5B,IAAM,eAAe;AACrB,IAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+BzB,SAAgB,cAAc,aAAqB,QAAQ,IAAY;CACnE,IAAI;EACA,MAAM,WAAW,GAAG,aAAa,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,GAAG,MAAM,CAAC,CAAC,QAAQ;EACjG,IAAI,CAAC,UAAU,OAAO;EACtB,OAAO,SAAS,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAI,SAAQ,SAAS,MAAM,CAAC,CAAC,KAAK,IAAI;CACpF,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAAgB,WAAW,MAAsB;CAC7C,OAAO,gBAAgB,aAAa,aAAa,KAAK,GAAG,iBAAiB;AAC9E;;;;;;;;;AAUA,SAAgB,cAAc,OAAsC;CAChE,IAAI,CAAC,WAAW,MAAM,GAAG,GAAG,OAAO,QAAQ,QAAQ,KAAK;CAExD,OAAO,IAAI,SAAS,YAAY;EAC5B,MAAM,SAAS,IAAI,IAAI,OAAO;EAC9B,IAAI,SAAS;EACb,MAAM,UAAU,UAAmB;GAC/B,OAAO,mBAAmB;GAC1B,OAAO,QAAQ;GACf,QAAQ,KAAK;EACjB;EACA,OAAO,WAAW,mBAAmB;EACrC,OAAO,KAAK,iBAAiB,OAAO,KAAK,CAAC;EAC1C,OAAO,KAAK,eAAe,OAAO,KAAK,CAAC;EACxC,OAAO,GAAG,SAAS,UAAU;GACzB,UAAU,MAAM,SAAS,MAAM;GAC/B,IAAI,OAAO,SAAS,IAAI,GAAG,OAAO,OAAO,KAAK,MAAM,iBAAiB,MAAM,OAAO;EACtF,CAAC;EACD,OAAO,KAAK,eAAe,OAAO,OAAO,KAAK,MAAM,iBAAiB,MAAM,OAAO,CAAC;EACnF,OAAO,QAAQ,MAAM,cAAc,WAAW;CAClD,CAAC;AACL;;AAGA,eAAsB,kBAAkB,aAAkD;CACtF,MAAM,QAAQ,UAAU,WAAW;CACnC,IAAI,CAAC,OAAO,OAAO;CACnB,IAAI,MAAM,cAAc,KAAK,GAAG,OAAO;CAKvC,WAAW,WAAW;CAEtB,OAAO;AACX;;;;;;;;;AAUA,SAAS,kBAA0B;CAI/B,MAAM,YAAY,QAAQ,KAAK;CAC/B,IAAI,aAAa,GAAG,WAAW,SAAS,GAAG,OAAO;CAElD,OAAO,cAAc,IAAA,IAAA,mmDAAA,KAAA,OAAA,KAAA,GAAA,CAAuC;AAChE;;;;;;;;;;;AAYA,SAAgB,aAAa,OAA2D;CACpF,IAAI,CAAC,aAAa,KAAK,KAAK,GAAG,OAAO;EAAE,UAAU,QAAQ;EAAU,YAAY,CAAC;CAAE;CAKnF,OAAO;EAAE,UAAU,QAAQ;EAAU,YAAY,CAAC,YAAY,KAAK;CAAE;AACzE;;;;;;;;AAmCA,SAAS,yBAAyB,OAAoB,KAA8B;CAChF,OAAO,IAAI,SAAS,SAAS,WAAW;EACpC,MAAM,SAAS,IAAI,IAAI,OAAO;EAC9B,IAAI,SAAS;EACb,IAAI,aAAa;EACjB,MAAM,QAAQ,YAAoB;GAC9B,OAAO,mBAAmB;GAC1B,OAAO,QAAQ;GACf,OAAO,IAAI,MAAM,OAAO,CAAC;EAC7B;EACA,OAAO,WAAW,gBAAgB;EAClC,OAAO,KAAK,iBAAiB,KAAK,gDAAgD,IAAI,WAAW,KAAK,MAAM,mBAAmB,GAAI,EAAE,GAAG,CAAC;EACzI,OAAO,KAAK,UAAU,QAAQ,KAAK,iDAAiD,IAAI,KAAK,IAAI,SAAS,CAAC;EAC3G,OAAO,GAAG,SAAS,UAAU;GACzB,UAAU,MAAM,SAAS,MAAM;GAC/B,IAAI,UAAU,OAAO,QAAQ,IAAI;GACjC,OAAO,YAAY,IAAI;IACnB,MAAM,OAAO,OAAO,MAAM,GAAG,OAAO,CAAC,CAAC,KAAK;IAC3C,SAAS,OAAO,MAAM,UAAU,CAAC;IACjC,IAAI,CAAC,YAAY;KACb,IAAI,SAAS,iBAAiB,MAAM,SAAS,OAAO,KAAK,mEAAmE;KAC5H,aAAa;KACb,OAAO,MAAM,UAAU,IAAI,GAAG;IAClC,OAAO,IAAI,KAAK,WAAW,KAAK,GAAG;KAC/B,MAAM,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC;KACjC,OAAO,mBAAmB;KAC1B,OAAO,QAAQ;KACf,IAAI,CAAC,OAAO,UAAU,IAAI,KAAK,QAAQ,GAAG,OAAO,uBAAO,IAAI,MAAM,+DAA+D,IAAI,KAAK,MAAM,CAAC;KACjJ,OAAO,QAAQ,IAAI;IACvB,OACI,OAAO,KAAK,6CAA6C,IAAI,KAAK,KAAK,QAAQ,aAAa,EAAE,GAAG;IAErG,UAAU,OAAO,QAAQ,IAAI;GACjC;EACJ,CAAC;EACD,OAAO,QAAQ,MAAM,cAAc,WAAW;CAClD,CAAC;AACL;;AAGA,eAAe,oBAAoB,OAAoB,SAAkB,MAAmD;CACxH,MAAM,aAAqC,CAAC;CAC5C,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,QAAQ,MAAM,YAAY;EAEhC,WAAW,OAAO,WADL,QAAQ,MAAM,OAAO,MAAM,yBAAyB,OAAO,GAAG,CAC1C;CACrC;CACA,OAAO;EAAE,GAAG,MAAM,OAAO,OAAO;EAAG;CAAW;AAClD;;;;;;;;AASA,eAAsB,sBAClB,aACA,UAAyB,CAAC,GACF;CACxB,MAAM,OAAO,QAAQ,kBAAkB,CAAC;CACxC,MAAM,WAAW,MAAM,kBAAkB,WAAW;CACpD,IAAI,UAAU,OAAO,oBAAoB,UAAU,OAAO,IAAI;CAE9D,GAAG,UAAU,SAAS,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CACvD,gBAAgB,WAAW;CAM3B,IAAI,CAAC,iBAAiB,aAAa,gBAAgB,GAAG;EAClD,MAAM,UAAU,MAAM,cAAc,aAAa,gBAAgB;EACjE,IAAI,SAAS,OAAO,oBAAoB,SAAS,OAAO,IAAI;EAK5D,IAAI,CAAC,iBAAiB,aAAa,CAAC,GAChC,MAAM,IAAI,MACN;WACY,KAAK,KAAK,SAAS,WAAW,GAAG,eAAe,EAAE,wBAClE;CAER;CAEA,MAAM,OAAO,MAAM,aAAa;CAChC,MAAM,QAAQ,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;CAC5C,MAAM,QAAQ,QAAQ,SAAS,gBAAgB;CAE/C,MAAM,YAAY,QAAQ,SAAS,aAAa,KAAK;CACrD,MAAM,OAAO;EACT,GAAG,UAAU;EACb;EACA;EACA;EAAa;EACb;EAAU,OAAO,IAAI;EACrB;EAAW;CACf;CACA,IAAI,QAAQ,kBAAkB,KAAA,GAC1B,KAAK,KAAK,kBAAkB,OAAO,QAAQ,aAAa,CAAC;CAG7D,MAAM,MAAM,GAAG,SAAS,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,GAAG,GAAG;CAC3E,MAAM,QAAsB,MAAM,UAAU,UAAU,MAAM;EAIxD,UAAU;EACV,OAAO;GAAC;GAAU;GAAK;EAAG;CAC9B,CAAC;CACD,MAAM,MAAM;CAEZ,IAAI;EACA,MAAM,WAAW,KAAK,IAAI,IAAI;EAC9B,IAAI,YAAY;EAChB,OAAO,KAAK,IAAI,IAAI,UAAU;GAC1B,MAAM,QAAQ,UAAU,WAAW;GACnC,IAAI,SAAU,MAAM,cAAc,KAAK,GAAI,OAAO,oBAAoB,OAAO,MAAM,IAAI;GAEvF,IAAI,CAAC,aAAa,CAAC,QAAQ,OAAO;IAC9B,YAAY;IACZ,QAAQ,aAAa,oCAAoC;GAC7D;GAKA,IAAI,MAAM,aAAa,QAAQ,MAAM,aAAa,GAC9C,MAAM,IAAI,MACN,kDAAkD,MAAM,SAAS,QAC5D,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,EAAE,YACpD,cAAc,WAAW,CAC7B;GAGJ,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,gBAAgB,CAAC;EACxE;EAEA,MAAM,IAAI,MACN,iDAAiD,KAAK,MAAM,mBAAmB,GAAI,EAAE,QAChF,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY,EAAE,YACpD,cAAc,WAAW,IAAI,gFAEjC;CACJ,UAAU;EAIN,iBAAiB,WAAW;CAChC;AACJ;;AAGA,SAAS,MAAM,OAAoB,SAAmC;CAClE,OAAO;EACH,KAAK,WAAW,MAAM,IAAI;EAC1B,SAAS,MAAM;EACf,MAAM,MAAM;EACZ,KAAK,MAAM;EACX;EACA,YAAY,CAAC;CACjB;AACJ;;AAGA,eAAe,cAAc,aAAqB,WAAgD;CAC9F,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC1B,MAAM,QAAQ,UAAU,WAAW;EACnC,IAAI,SAAU,MAAM,cAAc,KAAK,GAAI,OAAO;EAClD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,gBAAgB,CAAC;CACxE;CAEA,OAAO;AACX;;AAGA,eAAsB,oBAAoB,aAAuC;CAC7E,MAAM,QAAQ,MAAM,kBAAkB,WAAW;CACjD,IAAI,CAAC,OAAO,OAAO;CAEnB,IAAI;EACA,QAAQ,KAAK,MAAM,KAAK,SAAS;CACrC,QAAQ;EACJ,WAAW,WAAW;EAEtB,OAAO;CACX;CAIA,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;EAC1B,IAAI,CAAC,GAAG,WAAW,UAAU,WAAW,CAAC,GAAG,OAAO;EACnD,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;CAC3D;CAEA,WAAW,WAAW;CAEtB,OAAO;AACX;;;;;;;;AASA,eAAsB,qBAAqB,aAAoC;CAC3E,MAAM,oBAAoB,WAAW;CACrC,GAAG,OAAO,QAAQ,WAAW,GAAG;EAAE,WAAW;EAAM,OAAO;CAAK,CAAC;CAIhE,MAAM,MAAM,SAAS,WAAW;CAChC,IAAI,GAAG,WAAW,GAAG;OACZ,MAAM,SAAS,GAAG,YAAY,GAAG,GAClC,IAAI,MAAM,WAAW,UAAU,GAAG,GAAG,OAAO,KAAK,KAAK,KAAK,KAAK,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAAA;CAG3G,WAAW,WAAW;AAC1B;;;;;;;;;AAUA,SAAS,gBAAgB,aAA2B;CAChD,MAAM,SAAS,KAAK,KAAK,SAAS,WAAW,GAAG,YAAY;CAC5D,IAAI,GAAG,WAAW,MAAM,GAAG;CAC3B,GAAG,cACC,QACA,mIAEA,MACJ;AACJ"}

package/dist/dev-db/daemon.d.ts

@@ -45,6 +45,21 @@ export interface ManagedDatabase {
  * Putting it in the URL fixes every consumer at once — Atlas, `pg`, and anything
  * a driver shells out to later — rather than teaching each one about PGlite.
  */
+/**
+ * The end of `pglite.log`, for an error message that has to carry its own reason.
+ *
+ * The daemon writes its output to a file because it is detached — it has to
+ * outlive the command that started it. That is right, and it means every
+ * startup failure used to be reported as a path: "see pglite.log for the
+ * reason". On a laptop that is a fair trade. In CI it is not a trade at all,
+ * because the runner discards the workspace: the log named in the message no
+ * longer exists by the time anybody reads the message, so a failed run says
+ * only that something failed.
+ *
+ * So the tail comes with the error. Bounded, because a log that has been
+ * appended to across many runs is not something to paste in full.
+ */
+export declare function pgliteLogTail(projectRoot: string, lines?: number): string;
 export declare function managedUrl(port: number): string;
 /**
  * Ask the process behind a state record to prove it is the one we wrote down.

package/dist/index.es.js

@@ -3,7 +3,7 @@ import { _ as validateTsxInstallation, a as findBackendDir, c as findProjectRoot
 import { i as probeTcp, r as ensureDevDatabase, t as composeDatabaseUrl } from "./dev-preflight-CNLl4rdo.js";
 import { r as readActiveBranch, t as branchUrl } from "./branch-pointer-dBiClJ0p.js";
 import { t as MANAGED_LIMITATIONS } from "./constraints-DKGbNfUW.js";
-import { i as managedUrl, n as ensureManagedDatabase, r as findRunningDaemon } from "./daemon-YDZK9NZ1.js";
+import { i as managedUrl, n as ensureManagedDatabase, r as findRunningDaemon } from "./daemon-DR9Tk0La.js";
 import { n as resolveDevDatabase, t as describeDevDatabase } from "./resolve-Y56osuQH.js";
 import chalk from "chalk";
 import arg from "arg";
@@ -2452,6 +2452,19 @@ async function configureEnvFile(targetDirectory, databaseUrl) {
 				`# DATABASE_URL=postgresql://rebase_app:${dbPassword}@127.0.0.1:${dbPort}/rebase?options=-c%20search_path%3Dpublic&sslmode=disable`,
 				`DATABASE_PASSWORD=${dbPassword}`
 			].join("\n"));
+			const envExampleReference = path.join(targetDirectory, ".env.example");
+			if (fs.existsSync(envExampleReference)) {
+				let exampleContent = fs.readFileSync(envExampleReference, "utf-8");
+				exampleContent = exampleContent.replace(/^DATABASE_URL=postgresql:\/\/[^\n]*$/m, [
+					"# Commented out on purpose — that is what selects the managed database.",
+					"# To use the docker-compose Postgres this project ships instead:",
+					"#   docker compose up -d db, then uncomment the line below in .env",
+					"#   (with DATABASE_PASSWORD from that file, not the placeholder here).",
+					`# DATABASE_URL=postgresql://rebase_app:changeme@127.0.0.1:${dbPort}/rebase?options=-c%20search_path%3Dpublic&sslmode=disable`
+				].join("\n"));
+				exampleContent = exampleContent.replaceAll("@localhost:5432/rebase", `@127.0.0.1:${dbPort}/rebase`);
+				fs.writeFileSync(envExampleReference, exampleContent, "utf-8");
+			}
 			const dockerComposePath = path.join(targetDirectory, "docker-compose.yml");
 			if (fs.existsSync(dockerComposePath)) {
 				let dockerComposeContent = fs.readFileSync(dockerComposePath, "utf-8");
@@ -2844,62 +2857,6 @@ function reportSpawnFailure(error) {
 	if (message) console.error(chalk.red(`✗ ${message}`));
 }
 //#endregion
-//#region src/utils/command-words.ts
-/**
-* The words that name a command, with the flags taken back out.
-*
-* `rawArgs` is the whole of `process.argv`, and reading the command's words at
-* fixed indices off it assumes nothing precedes them. Something routinely does:
-* `--debug` is what `bin/rebase.js` prints after every failure as the thing to
-* re-run with, so it is the single most likely token to appear before a command
-* word, and it shifted every index by one.
-*
-* What that cost is not a bad error message. `rebase db branch switch feature`
-* writes a per-checkout pointer that the CLI owns; the driver, running as a
-* child process, cannot persist it and does not try. The dispatch found
-* `switch` by position, so `rebase --debug db branch switch feature` missed the
-* CLI's branch and handed the line to the driver — which reported success and
-* left the checkout on the main database. Every subsequent `dev`, `push` and
-* `backup` then ran against the wrong database, believing it was the branch,
-* which is the exact failure branching exists to prevent.
-*
-* The words are anchored on the command name rather than taken from position
-* zero, because a flag written in the space form (`--database-url <url>`) leaves
-* its value behind as a bare token and no parser at this level knows which
-* flags take values. Anchoring survives that: the value would have to be the
-* literal command name to fool it.
-*
-* Returns `[]` when the command name is not on the line at all.
-*/
-function commandWords(rawArgs, command) {
-	const words = rawArgs.slice(2).filter((token) => !token.startsWith("-"));
-	const start = words.indexOf(command);
-	return start === -1 ? [] : words.slice(start);
-}
-/**
-* The line to hand a spawned driver, starting at the command word.
-*
-* The same defect one layer down, and it does not degrade gracefully: the
-* driver reads its domain from `args[0]`, so `rebase --debug db push` spawned
-* it with `["--debug", "db", "push"]` and it answered "Unknown domain command:
-* --debug" — for a flag the CLI itself tells you to add after any failure.
-*
-* Tokens written *before* the command word are moved after it rather than
-* dropped. Dropping them would be the same class of bug in the other direction:
-* `rebase --database-url postgres://… db push` would silently lose the flag that
-* says which database to touch. Appending keeps each flag next to its value, and
-* `arg` reads flags wherever they appear.
-*
-* Falls back to `rawArgs.slice(2)` when the command word is not on the line,
-* which is what an internally synthesised argv looks like.
-*/
-function argsFromCommand(rawArgs, command) {
-	const tail = rawArgs.slice(2);
-	const start = tail.findIndex((token) => token === command);
-	if (start <= 0) return [...tail];
-	return [...tail.slice(start), ...tail.slice(0, start)];
-}
-//#endregion
 //#region src/utils/unknown-command.ts
 /**
 * What every command family says when it does not recognise a subcommand.
@@ -2994,6 +2951,62 @@ function unknownCommand(typed, known, family = "") {
 	process.exit(1);
 }
 //#endregion
+//#region src/utils/command-words.ts
+/**
+* The words that name a command, with the flags taken back out.
+*
+* `rawArgs` is the whole of `process.argv`, and reading the command's words at
+* fixed indices off it assumes nothing precedes them. Something routinely does:
+* `--debug` is what `bin/rebase.js` prints after every failure as the thing to
+* re-run with, so it is the single most likely token to appear before a command
+* word, and it shifted every index by one.
+*
+* What that cost is not a bad error message. `rebase db branch switch feature`
+* writes a per-checkout pointer that the CLI owns; the driver, running as a
+* child process, cannot persist it and does not try. The dispatch found
+* `switch` by position, so `rebase --debug db branch switch feature` missed the
+* CLI's branch and handed the line to the driver — which reported success and
+* left the checkout on the main database. Every subsequent `dev`, `push` and
+* `backup` then ran against the wrong database, believing it was the branch,
+* which is the exact failure branching exists to prevent.
+*
+* The words are anchored on the command name rather than taken from position
+* zero, because a flag written in the space form (`--database-url <url>`) leaves
+* its value behind as a bare token and no parser at this level knows which
+* flags take values. Anchoring survives that: the value would have to be the
+* literal command name to fool it.
+*
+* Returns `[]` when the command name is not on the line at all.
+*/
+function commandWords(rawArgs, command) {
+	const words = rawArgs.slice(2).filter((token) => !token.startsWith("-"));
+	const start = words.indexOf(command);
+	return start === -1 ? [] : words.slice(start);
+}
+/**
+* The line to hand a spawned driver, starting at the command word.
+*
+* The same defect one layer down, and it does not degrade gracefully: the
+* driver reads its domain from `args[0]`, so `rebase --debug db push` spawned
+* it with `["--debug", "db", "push"]` and it answered "Unknown domain command:
+* --debug" — for a flag the CLI itself tells you to add after any failure.
+*
+* Tokens written *before* the command word are moved after it rather than
+* dropped. Dropping them would be the same class of bug in the other direction:
+* `rebase --database-url postgres://… db push` would silently lose the flag that
+* says which database to touch. Appending keeps each flag next to its value, and
+* `arg` reads flags wherever they appear.
+*
+* Falls back to `rawArgs.slice(2)` when the command word is not on the line,
+* which is what an internally synthesised argv looks like.
+*/
+function argsFromCommand(rawArgs, command) {
+	const tail = rawArgs.slice(2);
+	const start = tail.findIndex((token) => token === command);
+	if (start <= 0) return [...tail];
+	return [...tail.slice(start), ...tail.slice(0, start)];
+}
+//#endregion
 //#region src/dev-db/prepare.ts
 /**
 * The one place a command asks "which database, and how do I reach it?".
@@ -3179,122 +3192,6 @@ function managedNotices(prepared) {
 	return lines;
 }
 //#endregion
-//#region src/commands/schema.ts
-/**
-* CLI command: rebase schema <action>
-*/
-async function schemaCommand(subcommand, rawArgs) {
-	if (!subcommand || subcommand === "--help" || wantsHelp(rawArgs)) {
-		printSchemaHelp(subcommand === "--help" ? void 0 : subcommand);
-		return;
-	}
-	if (!SCHEMA_ACTION_HELP[subcommand]) unknownCommand(subcommand, Object.keys(SCHEMA_ACTION_HELP), "schema");
-	const projectRoot = requireProjectRoot();
-	recordEvent("cli.schema", { subcommand: subcommand ?? "none" }, { projectRoot });
-	const backendDir = requireBackendDir(projectRoot);
-	const activePlugin = getActiveBackendPlugin(backendDir);
-	if (!activePlugin) {
-		console.error(chalk.red("✗ Could not detect an active database plugin."));
-		console.error(chalk.gray("  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json."));
-		process.exit(1);
-	}
-	const pluginCli = resolvePluginCliScript(backendDir, activePlugin);
-	if (!pluginCli) exitDependenciesNotInstalled(projectRoot);
-	const envFile = findEnvFile(projectRoot);
-	const env = { ...process.env };
-	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
-	env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? "";
-	try {
-		/**
-		* tsx, whether the driver CLI is source or built.
-		*
-		* This chose the interpreter from the file extension — tsx for a `.ts`
-		* entry, `node` for a built one — which was right only for as long as
-		* the driver shipped `src/`. Once it shipped `dist/cli.js`, the built
-		* CLI ran under plain `node`, and some of its subcommands load the
-		* PROJECT's collections in process. `schema stale` does: on the stock
-		* scaffold, whose collections import each other, Node could not resolve
-		* `./authors` onto `authors.ts` and the command reported "⏭ Not
-		* checked" — answering "is the generated schema stale?" with nothing,
-		* and exiting 0.
-		*
-		* The same rule lives in `execDriverCli` (commands/db.ts). Two copies of
-		* one decision is how they came to disagree; this one is kept because
-		* `schema` deliberately does NOT resolve a database, and `execDriverCli`
-		* is reached through a path that does.
-		*/
-		const tsxBin = resolveTsx(projectRoot);
-		if (!tsxBin && pluginCli.endsWith(".ts")) exitDependenciesNotInstalled(projectRoot);
-		await execa(tsxBin ?? "node", [pluginCli, ...argsFromCommand(rawArgs, "schema")], {
-			cwd: backendDir,
-			stdio: "inherit",
-			env
-		});
-	} catch (error) {
-		reportSpawnFailure(error);
-		process.exit(1);
-	}
-}
-/** One page per subcommand, so `rebase schema <action> --help` says something. */
-var SCHEMA_ACTION_HELP = {
-	generate: {
-		usage: "rebase schema generate [--collections <dir>] [--output <file>] [--watch]",
-		summary: "Generate the Drizzle schema from the collection definitions.",
-		notes: ["--watch regenerates on every change to a collection file."]
-	},
-	introspect: {
-		usage: "rebase schema introspect [--collections <dir>] [--output <dir>] [--schema <name>] [--force]",
-		summary: "Read an existing database and write Rebase collection definitions from it.",
-		notes: ["--force overwrites collection files that are already there."]
-	},
-	stale: {
-		usage: "rebase schema stale [--collections <dir>] [--output <file>] [--fix]",
-		summary: "Report generated schema files that no longer match the collections.",
-		notes: ["--fix regenerates them instead of only reporting."]
-	}
-};
-function printSchemaHelp(action) {
-	const entry = action ? SCHEMA_ACTION_HELP[action] : void 0;
-	if (entry) {
-		console.log(`
-${chalk.bold(`rebase schema ${action}`)}
-
-  ${entry.summary}
-
-${chalk.green.bold("Usage")}
-  ${chalk.blue(entry.usage)}
-${entry.notes?.length ? `\n${chalk.green.bold("Notes")}\n${entry.notes.map((n) => `  ${chalk.gray(`• ${n}`)}`).join("\n")}\n` : ""}
-${chalk.gray("Run `rebase schema --help` for every subcommand.")}
-`);
-		return;
-	}
-	console.log(`
-${chalk.bold("rebase schema")} — Schema management commands
-
-${chalk.green.bold("Usage")}
-  rebase schema ${chalk.blue("<command>")} [options]
-
-${chalk.green.bold("Commands")}
-  ${chalk.gray("(Commands are provided by your active database driver plugin)")}
-  ${chalk.blue.bold("generate")}    Generate Schema from collection definitions
-  ${chalk.blue.bold("introspect")}  Introspect an existing database to generate collection definitions
-  ${chalk.blue.bold("stale")}       Report generated schema files that no longer match the collections
-
-${chalk.green.bold("generate Options")}
-  ${chalk.blue("--collections, -c")}  Path to collections directory
-  ${chalk.blue("--output, -o")}       Output path for generated schema
-  ${chalk.blue("--watch, -w")}        Watch for changes and regenerate automatically
-
-${chalk.green.bold("introspect Options")}
-  ${chalk.blue("--output, -o")}       Output directory for generated collection files
-  ${chalk.blue("--schema")}           Postgres schema to read (default: public)
-  ${chalk.blue("--force, -f")}        Overwrite collection files that already exist
-
-${chalk.green.bold("stale Options")}
-  ${chalk.blue("--fix")}              Regenerate the stale files instead of only reporting them
-`);
-}
-//#endregion
 //#region src/commands/db.ts
 /**
 * CLI command: rebase db <action>
@@ -3588,42 +3485,41 @@ async function resolveDriverCli() {
 		env
 	};
 }
-/** Run the resolved driver CLI with the given child arguments. */
-async function execDriverCli(resolved, childArgs, options = {}) {
+/**
+* The one place this CLI spawns the driver's own CLI.
+*
+* There were three, each with its own copy of "tsx for a `.ts` entry, `node`
+* otherwise". That rule was right only while the driver shipped `src/`; once it
+* shipped `dist/cli.js` all three quietly switched to plain `node`, and the
+* driver loads the PROJECT's TypeScript in process:
+*
+*   - `schema stale` reads the collections, could not resolve `./authors` onto
+*     `authors.ts`, and answered "⏭ Not checked" while exiting 0;
+*   - `db push` does the same in `ensureAuthTables`, so `rebase.users` was never
+*     created and the push died at "Applying RLS policies" with
+*     `relation "rebase.users" does not exist` — on a virgin database, which is
+*     the documented bring-your-own-Postgres first run.
+*
+* Two were fixed and the third was missed, because three copies of a decision
+* are three chances to miss one. There is one now, and a gate holds it at one.
+*
+* tsx whenever it is installed — a devDependency of every scaffold, for exactly
+* this reason. Without it a `.ts` entry cannot run at all; a built entry still
+* runs, and the subcommands that never touch the project's TypeScript still work.
+*/
+async function spawnDriverCli(resolved, childArgs, options = {}) {
 	const { projectRoot, backendDir, pluginCli, env } = resolved;
 	const stdio = options.quiet ? "pipe" : "inherit";
-	/**
-	* tsx, whether the driver CLI is source or built.
-	*
-	* It used to be tsx only for a `.ts` entry, which happened to be right for
-	* as long as the driver shipped `src/`. Once it shipped `dist/cli.js`
-	* instead, this ran the built CLI under plain `node` — and some of its
-	* subcommands load the PROJECT's collections in process. `schema stale`
-	* does, so on every scaffold whose collections import each other (the stock
-	* one does) it failed to resolve them and reported "⏭ Not checked": a
-	* command that answers "is the generated schema stale?" with nothing at all,
-	* exiting 0, on the default project.
-	*
-	* Node cannot load a `.ts` file, and cannot resolve `./authors` or
-	* `./authors.js` onto `authors.ts`. tsx does both. It is a devDependency of
-	* every scaffold for exactly this reason.
-	*/
 	const tsxBin = resolveTsx(projectRoot);
-	if (tsxBin) {
-		await execa(tsxBin, [pluginCli, ...childArgs], {
-			cwd: backendDir,
-			stdio,
-			env
-		});
-		return;
-	}
-	if (pluginCli.endsWith(".ts")) throw new Error(dependenciesNotInstalled(projectRoot));
-	await execa("node", [pluginCli, ...childArgs], {
+	if (!tsxBin && pluginCli.endsWith(".ts")) throw new Error(dependenciesNotInstalled(projectRoot));
+	await execa(tsxBin ?? "node", [pluginCli, ...childArgs], {
 		cwd: backendDir,
 		stdio,
 		env
 	});
 }
+/** @deprecated Use {@link spawnDriverCli}. Kept as the internal name callers use. */
+var execDriverCli = spawnDriverCli;
 /**
 * Run a `schema` subcommand through the active driver's CLI.
 *
@@ -3666,21 +3562,12 @@ async function runDriverDbCommand(rawArgs, options = {}) {
 	if (!options.quiet) for (const line of managedNotices(prepared)) console.log(chalk.gray(`  ${line}`));
 	refuseAtlasOnManagedDatabase(rawArgs, prepared.database.kind);
 	const childArgs = absolutizeLocalPathArgs(argsFromCommand(rawArgs, "db"), process.cwd());
-	if (pluginCli.endsWith(".ts")) {
-		const tsxBin = resolveTsx(projectRoot);
-		if (!tsxBin) throw new Error(dependenciesNotInstalled(projectRoot));
-		await execa(tsxBin, [pluginCli, ...childArgs], {
-			cwd: backendDir,
-			stdio: "inherit",
-			env
-		});
-		return;
-	}
-	await execa("node", [pluginCli, ...childArgs], {
-		cwd: backendDir,
-		stdio: "inherit",
+	await spawnDriverCli({
+		projectRoot,
+		backendDir,
+		pluginCli,
 		env
-	});
+	}, childArgs, options);
 }
 async function dbCommand$1(subcommand, rawArgs) {
 	if (!subcommand || subcommand === "--help" || rawArgs.includes("--help") || rawArgs.includes("-h")) {
@@ -3777,7 +3664,7 @@ async function printDatabaseUrl(projectRoot, rawArgs) {
 * removing the directory cannot leave a half-dropped schema behind.
 */
 async function manageLocalDatabase(subcommand, projectRoot, rawArgs) {
-	const { resetManagedDatabase, stopManagedDatabase, findRunningDaemon } = await import("./daemon-YDZK9NZ1.js").then((n) => n.t);
+	const { resetManagedDatabase, stopManagedDatabase, findRunningDaemon } = await import("./daemon-DR9Tk0La.js").then((n) => n.t);
 	const { dataDir } = await import("./state-C59Elrnt.js").then((n) => n.d);
 	const nothingHere = () => {
 		const kind = devDatabaseKind(projectRoot);
@@ -4348,6 +4235,103 @@ function dbExamples(kind) {
 `;
 }
 //#endregion
+//#region src/commands/schema.ts
+/**
+* CLI command: rebase schema <action>
+*/
+async function schemaCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help" || wantsHelp(rawArgs)) {
+		printSchemaHelp(subcommand === "--help" ? void 0 : subcommand);
+		return;
+	}
+	if (!SCHEMA_ACTION_HELP[subcommand]) unknownCommand(subcommand, Object.keys(SCHEMA_ACTION_HELP), "schema");
+	const projectRoot = requireProjectRoot();
+	recordEvent("cli.schema", { subcommand: subcommand ?? "none" }, { projectRoot });
+	const backendDir = requireBackendDir(projectRoot);
+	const activePlugin = getActiveBackendPlugin(backendDir);
+	if (!activePlugin) {
+		console.error(chalk.red("✗ Could not detect an active database plugin."));
+		console.error(chalk.gray("  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json."));
+		process.exit(1);
+	}
+	const pluginCli = resolvePluginCliScript(backendDir, activePlugin);
+	if (!pluginCli) exitDependenciesNotInstalled(projectRoot);
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? "";
+	try {
+		await spawnDriverCli({
+			projectRoot,
+			backendDir,
+			pluginCli,
+			env
+		}, argsFromCommand(rawArgs, "schema"));
+	} catch (error) {
+		reportSpawnFailure(error);
+		process.exit(1);
+	}
+}
+/** One page per subcommand, so `rebase schema <action> --help` says something. */
+var SCHEMA_ACTION_HELP = {
+	generate: {
+		usage: "rebase schema generate [--collections <dir>] [--output <file>] [--watch]",
+		summary: "Generate the Drizzle schema from the collection definitions.",
+		notes: ["--watch regenerates on every change to a collection file."]
+	},
+	introspect: {
+		usage: "rebase schema introspect [--collections <dir>] [--output <dir>] [--schema <name>] [--force]",
+		summary: "Read an existing database and write Rebase collection definitions from it.",
+		notes: ["--force overwrites collection files that are already there."]
+	},
+	stale: {
+		usage: "rebase schema stale [--collections <dir>] [--output <file>] [--fix]",
+		summary: "Report generated schema files that no longer match the collections.",
+		notes: ["--fix regenerates them instead of only reporting."]
+	}
+};
+function printSchemaHelp(action) {
+	const entry = action ? SCHEMA_ACTION_HELP[action] : void 0;
+	if (entry) {
+		console.log(`
+${chalk.bold(`rebase schema ${action}`)}
+
+  ${entry.summary}
+
+${chalk.green.bold("Usage")}
+  ${chalk.blue(entry.usage)}
+${entry.notes?.length ? `\n${chalk.green.bold("Notes")}\n${entry.notes.map((n) => `  ${chalk.gray(`• ${n}`)}`).join("\n")}\n` : ""}
+${chalk.gray("Run `rebase schema --help` for every subcommand.")}
+`);
+		return;
+	}
+	console.log(`
+${chalk.bold("rebase schema")} — Schema management commands
+
+${chalk.green.bold("Usage")}
+  rebase schema ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.gray("(Commands are provided by your active database driver plugin)")}
+  ${chalk.blue.bold("generate")}    Generate Schema from collection definitions
+  ${chalk.blue.bold("introspect")}  Introspect an existing database to generate collection definitions
+  ${chalk.blue.bold("stale")}       Report generated schema files that no longer match the collections
+
+${chalk.green.bold("generate Options")}
+  ${chalk.blue("--collections, -c")}  Path to collections directory
+  ${chalk.blue("--output, -o")}       Output path for generated schema
+  ${chalk.blue("--watch, -w")}        Watch for changes and regenerate automatically
+
+${chalk.green.bold("introspect Options")}
+  ${chalk.blue("--output, -o")}       Output directory for generated collection files
+  ${chalk.blue("--schema")}           Postgres schema to read (default: public)
+  ${chalk.blue("--force, -f")}        Overwrite collection files that already exist
+
+${chalk.green.bold("stale Options")}
+  ${chalk.blue("--fix")}              Regenerate the stale files instead of only reporting them
+`);
+}
+//#endregion
 //#region src/manifest.ts
 /**
 * Loading, validating and synthesizing `rebase.json`.