@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/commands/cloud/debug.d.ts

@@ -1,3 +1,4 @@
+import { type CloudClient } from "./context.js";
 /** How a probe's outcome should be read. */
 export type Verdict = 
 /** Behaving as a healthy deployment should. */
@@ -114,5 +115,138 @@ export declare function formatDuration(seconds: number): string;
  * into seconds. Returns null when it is not a duration.
  */
 export declare function parseSince(input: string | undefined): number | null;
+/** One pod's entry in a `runtime-logs` answer. */
+export interface RuntimeLogsPod {
+    pod: string;
+    state: string;
+    /** Lines this pod returned. */
+    lines: number;
+    message: string | null;
+    hint: string | null;
+    /** The server's per-pod BYTE budget cut this pod's output. Says nothing about the line limit. */
+    truncated?: boolean;
+}
+export interface RuntimeLogsResponse {
+    logs?: string;
+    pods?: RuntimeLogsPod[];
+    ordering?: string;
+    /** A byte budget or the pod-count ceiling cut the result. Says nothing about the line limit. */
+    truncated?: boolean;
+    state?: string;
+    message?: string | null;
+}
+/**
+ * The most lines `runtime-logs` returns per pod.
+ *
+ * The control plane enforces this (`MAX_TAIL_LINES` in
+ * `saas/backend/functions/runtime-logs.ts`) by clamping a larger `tailLines`
+ * without saying so: its answer names neither the limit nor the value it used.
+ * `--tail 200000` therefore came back as 2000 lines reported as untruncated.
+ * The CLI clamps first, with the same number, so the lowering is something it
+ * can print rather than something that happened out of sight.
+ */
+export declare const SERVER_MAX_TAIL_LINES = 2000;
+/** How many lines per pod a read asks for, and why that may be less than requested. */
+export interface TailLimit {
+    /** What `--tail` asked for, or the view's default. */
+    requested: number;
+    /** What is sent: `requested`, lowered to {@link SERVER_MAX_TAIL_LINES}. */
+    applied: number;
+    /** Whether `--tail` was given, so a message can name the flag or the default. */
+    explicit: boolean;
+    /** Set when `applied < requested`: the sentence that says so. */
+    note: string | null;
+}
+export declare function resolveTail(requested: number, explicit: boolean): TailLimit;
+/** What one pod's lines actually cover. */
+export interface PodCoverage extends RuntimeLogsPod {
+    /** Earliest and latest timestamps among the lines this pod returned. */
+    firstTimestamp: string | null;
+    lastTimestamp: string | null;
+    /** A limit cut what this pod would otherwise have returned for the window. */
+    truncated: boolean;
+    /** Which limit: the per-pod line limit, or the server's byte budget. */
+    truncatedBy: "tail" | "bytes" | null;
+    /** The plain explanation, when truncated. */
+    truncatedReason: string | null;
+    /**
+     * Every line this pod holds in the window came back. With no window (read
+     * from the start), its first line is the start of its log.
+     */
+    complete: boolean;
+}
+/** The window asked for against the window delivered. */
+export interface LogCoverage {
+    /** Start of the window asked for, ISO. Null when reading each pod from its start. */
+    requestedFrom: string | null;
+    /** Earliest and latest timestamps across every line returned. */
+    firstTimestamp: string | null;
+    lastTimestamp: string | null;
+    pods: PodCoverage[];
+    truncated: boolean;
+    truncatedReasons: string[];
+}
+/** A span of milliseconds as `29d 23h`, `2h 5m`, `35m`, `40s`. */
+export declare function formatSpan(ms: number): string;
+/**
+ * Compare what a read covered with what it asked for.
+ *
+ * The server's `truncated` describes only its byte budgets and pod ceiling, so
+ * a pod that filled the line limit came back marked complete however much of
+ * the window it left unread. The line limit is the cut that matters most, and
+ * it is detected here: a pod that returned as many lines as the limit, whose
+ * earliest line is later than the start of the window, was cut by it.
+ *
+ * Filling the limit is the half that separates a cut from a young pod. A pod
+ * that started an hour ago also has no line older than an hour; it returned
+ * fewer lines than the limit, so what came back is its whole log, and nothing
+ * was cut.
+ */
+export declare function assessCoverage(opts: {
+    res: RuntimeLogsResponse;
+    lines: ParsedLogLine[];
+    /** The window asked for. Null reads each pod from its start. */
+    sinceSeconds: number | null;
+    tail: TailLimit;
+    now: number;
+}): LogCoverage;
+/**
+ * Resolve the public origin a project is served at — or `--host`, when given.
+ *
+ * Shared with `rebase cloud cron`, which reads the runtime at the same address
+ * `debug health` probes.
+ */
+export declare function resolveOrigin(rawArgs: string[], client: CloudClient, url: string, projectId: string): Promise<string>;
+/** What `debug logs`, `errors` and `boot` parse. Their help pairs against this. */
+export declare const LOG_VIEW_FLAGS: {
+    readonly "--since": StringConstructor;
+    readonly "--tail": NumberConstructor;
+    readonly "--previous": BooleanConstructor;
+};
+/** What `debug requests` parses. */
+export declare const REQUESTS_FLAGS: {
+    readonly "--since": StringConstructor;
+    readonly "--tail": NumberConstructor;
+};
+/** What `debug health` parses. */
+export declare const HEALTH_FLAGS: {
+    readonly "--collection": StringConstructor;
+    readonly "--function": StringConstructor;
+    readonly "--host": StringConstructor;
+};
+/**
+ * Whether a boot read reached each pod's start, which is where its startup
+ * lines are. A pod whose read was cut has not been looked at there, so finding
+ * no startup lines in it means nothing — and a line from later in its life
+ * that happens to mention `storage` is not its startup.
+ *
+ * Under `--since` a pod is never counted as reached: a complete read of the
+ * window starts at the pod's first line only if the pod started inside it, and
+ * nothing in the answer says whether it did.
+ */
+export declare function bootReach(pods: PodCoverage[], sinceSeconds: number | null): {
+    reachedStart: boolean;
+    unreached: string[];
+};
 export declare function debugCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
 export declare function printDebugHelp(): void;

package/dist/commands/cloud/index.d.ts

@@ -1,19 +1,96 @@
 import { type HelpAction } from "./context.js";
+/**
+ * Every flag in the `rebase cloud` family that takes a value, and the short
+ * spellings of them — the globals aside, which `GLOBAL_CLOUD_FLAGS` declares.
+ *
+ * {@link positionals} needs them for one reason: `arg` only consumes a flag's
+ * value when the flag is declared, and an undeclared one leaves its value
+ * behind as a bare word in the action's position. `rebase cloud deployments
+ * --limit 5` dispatched to an action called "5", `rebase cloud debug --host
+ * staging.example.com` to one called "staging.example.com", and `rebase cloud
+ * projects --name shop create` to one called "shop" — each refused as an unknown
+ * command, for a line the command's own help offers.
+ *
+ * Every value is `String` whatever the command reads it as: only consumption
+ * matters here, and the command parses the value itself. One list for the whole
+ * family works because no flag takes a value in one command and none in
+ * another; `value-flags.test.ts` holds that, and holds this list to the specs
+ * the commands declare in both directions, so a new value flag fails a test
+ * until it is added here.
+ */
+export declare const CLOUD_VALUE_FLAGS: {
+    readonly "--access-key-id": StringConstructor;
+    readonly "--autoscale-cpu-target": StringConstructor;
+    readonly "--autoscale-max": StringConstructor;
+    readonly "--backup-access-key-id": StringConstructor;
+    readonly "--backup-bucket": StringConstructor;
+    readonly "--backup-endpoint": StringConstructor;
+    readonly "--backup-secret-access-key": StringConstructor;
+    readonly "--base-domain": StringConstructor;
+    readonly "--branch": StringConstructor;
+    readonly "--bucket": StringConstructor;
+    readonly "--bundle-dir": StringConstructor;
+    readonly "--can": StringConstructor;
+    readonly "--collection": StringConstructor;
+    readonly "--connection-string": StringConstructor;
+    readonly "--cpu": StringConstructor;
+    readonly "--db": StringConstructor;
+    readonly "--db-cpu": StringConstructor;
+    readonly "--db-instances": StringConstructor;
+    readonly "--db-memory": StringConstructor;
+    readonly "--email": StringConstructor;
+    readonly "--endpoint": StringConstructor;
+    readonly "--events": StringConstructor;
+    readonly "--expires-in": StringConstructor;
+    readonly "--function": StringConstructor;
+    readonly "--host": StringConstructor;
+    readonly "--ingress-address": StringConstructor;
+    readonly "--kubeconfig": StringConstructor;
+    readonly "--limit": StringConstructor;
+    readonly "--memory": StringConstructor;
+    readonly "--message": StringConstructor;
+    readonly "--name": StringConstructor;
+    readonly "--org": StringConstructor;
+    readonly "--output": StringConstructor;
+    readonly "--password": StringConstructor;
+    readonly "--platform-rebuilds": StringConstructor;
+    readonly "--port": StringConstructor;
+    readonly "--provider": StringConstructor;
+    readonly "--region": StringConstructor;
+    readonly "--replicas": StringConstructor;
+    readonly "--repo": StringConstructor;
+    readonly "--scale-to-zero": StringConstructor;
+    readonly "--secret-access-key": StringConstructor;
+    readonly "--since": StringConstructor;
+    readonly "--slug": StringConstructor;
+    readonly "--source": StringConstructor;
+    readonly "--spot": StringConstructor;
+    readonly "--storage": StringConstructor;
+    readonly "--subdomain": StringConstructor;
+    readonly "--table": StringConstructor;
+    readonly "--tail": StringConstructor;
+    readonly "--target": StringConstructor;
+    readonly "--timeout": StringConstructor;
+    readonly "--type": StringConstructor;
+    readonly "--out": "--output";
+    readonly "-e": "--email";
+    readonly "-m": "--message";
+    readonly "-n": "--name";
+};
 /**
  * Positional tokens after `rebase cloud` (group, action, …).
  *
- * Two things stop a flag being mistaken for the group. `GLOBAL_CLOUD_FLAGS` is
- * declared so `arg` *consumes* the flags that may precede it — critically
- * together with their values, which is the half that filtering cannot do. The
- * leading-`-` skip then covers a flag nobody declared, so an unrecognised
- * boolean shifts nothing.
- *
- * Only leading tokens are skipped: past the group and action, an undeclared
- * flag and its value are somebody else's positionals and none of our business.
- * A flag this file has never heard of, that takes a value, placed before the
- * group, is the one shape still unresolvable here — there is no way to know
- * whether the token after it is its value or the group, and guessing either way
- * is worse than the handler reporting an unknown group.
+ * Two things stop a flag being mistaken for the group or the action.
+ * `GLOBAL_CLOUD_FLAGS` and {@link CLOUD_VALUE_FLAGS} are declared so `arg`
+ * *consumes* every flag of the family that takes a value — critically together
+ * with its value, which is the half that filtering cannot do. The leading-`-`
+ * skip then covers a flag nobody declared, so an unrecognised boolean shifts
+ * nothing.
+ *
+ * A flag this family has never heard of, that takes a value, is the one shape
+ * still unresolvable here — there is no way to know whether the token after it
+ * is its value or the action. The command's own strict parse refuses that flag
+ * anyway, so the only cost is which refusal the caller reads.
  *
  * Exported so its tests can drive the real thing. The dispatch test used to
  * re-implement it locally as `slice(3).filter(a => !a.startsWith("-"))` — which

package/dist/commands/cloud/token-capabilities.d.ts

@@ -0,0 +1,76 @@
+/**
+ * What a Rebase Cloud token may do, named the way a person asks for it.
+ *
+ * A token is a personal API key on the control plane: it acts as the account
+ * that created it, and holds only the scopes it was given. Nobody should have
+ * to know that `rebase cloud deploy` reads the `deployments` collection, uploads
+ * through the `deploy` function and needs `project:deploy` on one project — so
+ * `rebase cloud tokens create --can deploy` and the console's token screen both
+ * ask for a capability, and this module turns capabilities into scopes.
+ *
+ * One map, read by the CLI and by the console. Each capability covers exactly
+ * the control-plane calls its commands make, traced from the commands
+ * themselves and held there by `token-capabilities.test.ts`, which runs them
+ * against a stand-in control plane that refuses everything a token does not
+ * hold:
+ *
+ * - `deploy`   — `rebase cloud deploy` (bundle and source paths, uploads, the
+ *                build follow) and `rebase cloud deployments`.
+ * - `logs`     — `rebase cloud logs` (build, `--follow`, `--runtime`),
+ *                `rebase cloud metrics` and `rebase cloud cron` — whose
+ *                `runtime-token` call is how a token reads the app's own
+ *                cron history.
+ * - `env`      — `rebase cloud env list|set|unset|reveal|pull`.
+ * - `database` — `rebase cloud db list|info|connect`.
+ * - `backups`  — `rebase cloud db backup list|create|status|download` and
+ *                `db pitr status`. Restoring takes `project:restore`, which no
+ *                capability grants: putting old data over a live database is
+ *                for a signed-in person.
+ *
+ * Every project-level scope is narrowed to the one project the token is for
+ * (`project:deploy:<projectId>`). The data and function scopes cannot be: they
+ * name a collection or a function, not a row, and the control plane's
+ * row-level security keeps the token to what its owner can see.
+ *
+ * Deliberately free of imports, so the control plane's console can read the
+ * same file.
+ *
+ * @module
+ */
+/** A capability a token can be given. */
+export type TokenCapability = "deploy" | "logs" | "env" | "database" | "backups";
+/** Every capability, in the order they are offered. */
+export declare const TOKEN_CAPABILITY_NAMES: readonly TokenCapability[];
+/**
+ * Scopes every token holds, whatever it was created for: resolving a project
+ * by its slug, reading the deployment a command follows, the organization a
+ * project belongs to, and the control plane's public description of itself.
+ */
+export declare const ALWAYS_SCOPES: string[];
+/** Each capability: what it lets a token do, and the scopes that does on one project. */
+export declare const TOKEN_CAPABILITIES: Record<TokenCapability, {
+    label: string;
+    scopes: (projectId: string) => string[];
+}>;
+/** Whether a word names a capability. */
+export declare function isTokenCapability(value: string): value is TokenCapability;
+/**
+ * The scopes a token for `capabilities` on one project holds: {@link ALWAYS_SCOPES}
+ * first, then each capability's, each scope once.
+ *
+ * Throws on a project id a scope cannot carry — empty, or with whitespace — and
+ * on an unknown capability, both of which are a caller's mistake rather than
+ * something to mint a token from.
+ */
+export declare function scopesForCapabilities(projectId: string, capabilities: readonly TokenCapability[]): string[];
+/**
+ * Read a token's scopes back as capabilities: the projects its project scopes
+ * name, and, for each, the capabilities it holds every scope of.
+ *
+ * For showing a token — `rebase cloud tokens list`, `rebase cloud whoami` — so
+ * a list of fifteen scope strings reads as "deploy, logs on <project>".
+ */
+export declare function capabilitiesInScopes(scopes: readonly string[]): Array<{
+    projectId: string;
+    capabilities: TokenCapability[];
+}>;

package/dist/commands/cloud/tokens.d.ts

@@ -0,0 +1,23 @@
+import { type TokenCapability } from "./token-capabilities.js";
+/** Every action the group dispatches. */
+export declare const TOKENS_ACTIONS: readonly ["list", "create", "revoke"];
+/** What `rebase cloud tokens create` parses, beside the global flags (`--project` among them). */
+export declare const CREATE_TOKEN_FLAGS: {
+    "--can": [StringConstructor];
+    "--name": StringConstructor;
+    "--expires-in": StringConstructor;
+};
+export declare function tokensCommand(action: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * The capabilities `--can` names, comma-separated or repeated, each once.
+ *
+ * Exported so its tests can drive it without a session.
+ */
+export declare function parseCapabilities(values: readonly string[] | undefined): TokenCapability[];
+/**
+ * `--expires-in <days>` as an ISO timestamp, or null for a token that does not
+ * expire.
+ *
+ * Exported so its tests can drive it without a session.
+ */
+export declare function resolveTokenExpiry(value: string | undefined, now?: Date): string | null;

package/dist/commands/console.d.ts

@@ -0,0 +1,12 @@
+export declare const CONSOLE_FLAGS: {
+    readonly "--eval": StringConstructor;
+    readonly "-e": "--eval";
+    readonly "--collections": StringConstructor;
+    readonly "-c": "--collections";
+    readonly "--database-url": StringConstructor;
+    readonly "--docker": BooleanConstructor;
+};
+/** Where the REPL keeps its history: the project's own `.rebase/`, which the scaffold ignores. */
+export declare function consoleHistoryPath(projectRoot: string): string;
+export declare function printConsoleHelp(): void;
+export declare function consoleCommand(rawArgs: string[]): Promise<void>;

package/dist/commands/db.d.ts

@@ -1,5 +1,6 @@
 import { type PreparedDatabase } from "../dev-db/prepare.js";
 import { type DevDatabase } from "../dev-db/resolve.js";
+import type { AtlasDevDatabase } from "../dev-db/atlas-dev-database.js";
 /**
  * The connection string a prepared database actually answers on.
  *
@@ -17,6 +18,20 @@ import { type DevDatabase } from "../dev-db/resolve.js";
  * it open.
  */
 export declare function databaseUrlOf(prepared: Pick<PreparedDatabase, "env" | "database">, envFile: Record<string, string>): string | undefined;
+/**
+ * The flags whose value is a local path, on every line the CLI relays.
+ *
+ * All three spellings of the destination, because the driver accepts all
+ * three: `backup-cli.ts` maps `--output` and `-o` onto `--out`, and `rebase db
+ * backup --help` advertises `--output` as an alias. Only `--out` and `-o` were
+ * absolutised once, so the one spelling the help page names was the one that
+ * landed in `backend/` — and the success line still echoed the path as typed.
+ *
+ * And `--collections`, which was not absolutised at all: from the project root,
+ * `rebase schema generate --collections ./config/collections` was "not found",
+ * while the same spelling worked for `generate-sdk`. See `utils/path-flags.ts`.
+ */
+export declare const LOCAL_PATH_FLAGS: readonly string[];
 /**
  * Rewrite local path arguments so they mean what the user typed.
  *
@@ -31,7 +46,7 @@ export declare function databaseUrlOf(prepared: Pick<PreparedDatabase, "env" | "
  * Absolutising here rather than inside the plugin keeps the fix where the cwd
  * is actually changed, and leaves the plugin usable on its own terms.
  */
-export declare function absolutizeLocalPathArgs(args: string[], cwd: string): string[];
+export declare function absolutizeLocalPathArgs(args: string[], cwd: string, pathFlags?: readonly string[]): string[];
 /**
  * A managed-database refusal, raised so the caller decides what it costs.
  *
@@ -55,30 +70,35 @@ export declare class ManagedDatabaseRefusal extends Error {
 /** Print a refusal exactly as the guards used to print it themselves. */
 export declare function printManagedDatabaseRefusal(refusal: ManagedDatabaseRefusal): void;
 /**
- * Stop an Atlas-backed subcommand before it fails inside Atlas on the managed
+ * The variable the driver reads for Atlas's dev database
+ * (`ATLAS_DEV_URL_ENV` in `@rebasepro/server-postgres`, which this CLI does not
+ * depend on).
+ */
+export declare const ATLAS_DEV_URL_ENV = "REBASE_ATLAS_DEV_URL";
+/**
+ * The empty database an Atlas-backed subcommand plans against, on the managed
  * development database.
  *
- * **PGlite serves exactly one database.** `CREATE DATABASE "postgres_dev_diff"`
- * against it reports success and creates nothing, so Atlas connects its dev-url
- * straight back to the database it is meant to be comparing against, finds the
- * project's own tables there, and stops with
- * `connected database is not clean: found schema "public"`. Verified on a
- * completely fresh scaffold, so this is not a leftover-state problem that a
- * reset would fix — the model does not fit the engine.
- *
- * Before this guard the failure was worse than unhelpful. The first thing the
- * reader hit was `pq: SSL is not enabled on the server`, whose remedy box said
- * to append `sslmode=disable` to `DATABASE_URL` — a variable `rebase init`
- * deliberately leaves unset, which is the very reason the managed database was
- * in use. Two errors deep, about a variable that does not exist, for a command
- * the quickstart told them to run.
- *
- * There is nothing to fix by trying harder here: Atlas's other dev-url option
- * is `docker://`, and needing Docker is precisely what the managed database
- * exists to avoid. So this says what the managed database can and cannot do,
- * and names the two things that work.
+ * **PGlite serves exactly one database.** Atlas computes a change by replaying
+ * the desired schema into a second, empty one; on a real server the driver
+ * makes it as `<db>_dev_diff`, but `CREATE DATABASE` against PGlite reports
+ * success and creates nothing, so Atlas connected straight back to the
+ * database it was comparing and stopped with `connected database is not
+ * clean`. These commands were refused outright on the managed database — and
+ * with them every way to drop, rename or narrow a column there, since boot
+ * only adds.
+ *
+ * So a throwaway second PGlite is started for the command instead — in
+ * memory, in this process, gone when the command ends — and handed to the
+ * driver as `REBASE_ATLAS_DEV_URL`. Nothing else about the push changes: the
+ * destructive gate is the driver's, and holds as it does everywhere.
+ *
+ * `undefined` when none is needed: another database kind (the driver makes its
+ * own), a subcommand that is not Atlas's, or a `REBASE_ATLAS_DEV_URL` the
+ * developer set. When one cannot be started — PGlite is an optional
+ * dependency — the old refusal stands, with the reason.
  */
-export declare function refuseAtlasOnManagedDatabase(rawArgs: string[], kind: string): void;
+export declare function atlasDevDatabaseFor(rawArgs: string[], kind: string, env: Readonly<Record<string, string | undefined>>, start?: () => Promise<AtlasDevDatabase>): Promise<AtlasDevDatabase | undefined>;
 /**
  * Stop `rebase db branch` before it reports a branch that is not one.
  *
@@ -107,11 +127,25 @@ export declare function refuseAtlasOnManagedDatabase(rawArgs: string[], kind: st
  * an invitation to do the broken thing, and `info` would confirm a size for a
  * database that was never made.
  *
- * `refuseAtlasOnManagedDatabase` above is the same shape for a different
- * reason, and its comment named `branch` as one of the subcommands it does not
- * cover. It does now.
+ * Push, generate and migrate had the same problem — Atlas's scratch database
+ * is a second database too — and get a throwaway PGlite of their own instead
+ * (`atlasDevDatabaseFor` above). A branch cannot: it is meant to keep the
+ * project's data, and a throwaway instance has none.
  */
 export declare function refuseBranchOnManagedDatabase(rawArgs: string[], kind: string): void;
+/**
+ * Resolve the active driver's CLI and the environment it should run in.
+ *
+ * Shared by the two runners below. Deliberately does NOT resolve a database:
+ * `schema generate` reads collection files and writes one file, and starting a
+ * database to run it would be a side effect nobody asked for.
+ */
+export declare function resolveDriverCli(): Promise<{
+    projectRoot: string;
+    backendDir: string;
+    pluginCli: string;
+    env: Record<string, string>;
+}>;
 /**
  * The one place this CLI spawns the driver's own CLI.
  *
@@ -133,6 +167,12 @@ export declare function refuseBranchOnManagedDatabase(rawArgs: string[], kind: s
  * tsx whenever it is installed — a devDependency of every scaffold, for exactly
  * this reason. Without it a `.ts` entry cannot run at all; a built entry still
  * runs, and the subcommands that never touch the project's TypeScript still work.
+ *
+ * tsx's loader in one Node (`node --import`) rather than the `tsx` binary,
+ * which is a shell shim and a relay Node in front of the same loader: one Node
+ * start instead of two, ~50–100 ms on each of the driver runs every `rebase
+ * dev` start and every collection save makes. The binary stays the fallback for
+ * a tsx whose loader does not resolve as a package — a global install.
  */
 export declare function spawnDriverCli(resolved: {
     projectRoot: string;
@@ -157,6 +197,20 @@ export declare function runDriverDbCommand(rawArgs: string[], options?: {
     quiet?: boolean;
 }): Promise<void>;
 export declare function dbCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
+/**
+ * Start the compose database a `db … --docker` was asked to talk to.
+ *
+ * `--docker` resolved the compose URL and stopped there, so every `db`
+ * subcommand carrying it reached a container nobody had started —
+ * `ECONNREFUSED 127.0.0.1:5436`, two lines, no diagnosis — including the
+ * commands the managed-database refusals send readers to `--docker` for.
+ *
+ * `rebase dev --docker`'s preflight, called with the compose URL and nothing
+ * to push: this is not a schema step, and `rebase db push --docker` is the
+ * push. A failure here is reported and not fatal — the command runs and its
+ * own connection error follows, which is the same contract `dev` keeps.
+ */
+export declare function ensureDockerDatabase(projectRoot: string, rawArgs: readonly string[]): Promise<void>;
 /** Every subcommand the family dispatches — the help table's keys. */
 export declare const DB_SUBCOMMANDS: string[];
 /**