@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/dev-db/pull.d.ts

@@ -28,7 +28,28 @@
  * {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in
  * a column called `notes`, and this file says so rather than implying a
  * guarantee it cannot keep.
+ *
+ * What it does guarantee is that it never half-happens: {@link anonymizeCopy}
+ * runs the pass in one transaction, and when the pass fails it empties the
+ * tables it would have rewritten rather than leave their real values behind.
  */
+import type { Client } from "pg";
+/**
+ * How one kind of personal-looking column is overwritten.
+ *
+ * Two forms, because a constant is the most readable replacement and is wrong
+ * for exactly one kind of column: a unique one. Every `token_hash` becoming
+ * `'REDACTED'` is what `UNIQUE(token_hash)` refused on the second row of
+ * `rebase.refresh_tokens` — so on any project where someone had signed in twice.
+ */
+export interface AnonymizeRule {
+    pattern: RegExp;
+    /** The value for a column no unique index covers, or null to always use the unique form. */
+    value: string | null;
+    /** The unique form is `prefix` + random hex + `suffix`, cut to fit the column. */
+    prefix: string;
+    suffix: string;
+}
 /**
  * Column-name patterns the anonymizer overwrites.
  *
@@ -36,19 +57,32 @@
  * the same things. This is a reasonable-effort measure for making a local copy
  * less dangerous, and it is not a compliance control.
  */
-export declare const ANONYMIZE_PATTERNS: readonly {
-    pattern: RegExp;
-    replacement: string;
-}[];
+export declare const ANONYMIZE_PATTERNS: readonly AnonymizeRule[];
 export declare function shouldAnonymize(columnName: string): boolean;
-export declare function replacementFor(columnName: string): string | null;
 /** A text-ish column the anonymizer can overwrite without a type error. */
 export interface ColumnRef {
     schema: string;
     table: string;
     column: string;
     dataType: string;
+    /** `character_maximum_length`: null or absent for an unbounded type. */
+    maxLength?: number | null;
+    /** Covered by a unique index — a primary key, a UNIQUE constraint, or a unique expression index. */
+    unique?: boolean;
 }
+/**
+ * The SQL expression that overwrites one column, or null when no rule names it.
+ *
+ * Unique per row when an index makes the column unique, and always cut to the
+ * column's declared length — `zip char(5)` refused `'Redacted'` outright, and a
+ * failed statement now empties the tables rather than skip one. To fit a short
+ * unique column the prefix goes first, then the suffix, and the random part is
+ * kept to at least {@link MIN_UNIQUE_HEX} digits while there is room for them.
+ * A NULL stays NULL: an empty optional field is not personal data.
+ */
+export declare function replacementFor(column: ColumnRef): string | null;
+/** A double-quoted identifier, with any `"` in it doubled — a table called `order` or `a"b` still works. */
+export declare function quoteIdentifier(name: string): string;
 /**
  * Anonymizable columns: name looks personal, and the type can hold the
  * replacement.
@@ -58,8 +92,55 @@ export interface ColumnRef {
  * whole pass on a technicality.
  */
 export declare function anonymizableColumns(columns: readonly ColumnRef[]): ColumnRef[];
+/** `"schema"."table"` for each table the pass rewrites, sorted. */
+export declare function anonymizedTables(columns: readonly ColumnRef[]): string[];
 /** `UPDATE` statements for one anonymization pass, in a stable order. */
 export declare function anonymizeStatements(columns: readonly ColumnRef[]): string[];
+/**
+ * Every column the pass could overwrite, with what decides how.
+ *
+ * Base tables only — a view has an `email` column too, and is not something to
+ * UPDATE. Generated columns are skipped for the same reason: `email_domain
+ * GENERATED ALWAYS AS (…)` matches by name and refuses any value but DEFAULT,
+ * and it follows the column it is generated from anyway. An extension type such
+ * as `citext` reports `USER-DEFINED`, so its own name is what is compared.
+ *
+ * `unique` comes from the indexes, through `pg_depend` as well as `indkey`: a
+ * unique index on `lower(email)` names no column in `indkey`, and is exactly
+ * what a constant replacement would violate.
+ */
+export declare const ANONYMIZE_COLUMNS_SQL = "\nWITH unique_columns AS (\n    SELECT DISTINCT i.indrelid AS relid, a.attname AS column_name\n      FROM pg_index i\n      JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum > 0 AND NOT a.attisdropped\n     WHERE i.indisunique\n       AND (a.attnum = ANY (i.indkey)\n            OR EXISTS (SELECT 1 FROM pg_depend d\n                        WHERE d.classid = 'pg_class'::regclass AND d.objid = i.indexrelid\n                          AND d.refclassid = 'pg_class'::regclass AND d.refobjid = i.indrelid\n                          AND d.refobjsubid = a.attnum))\n)\nSELECT c.table_schema AS \"schema\",\n       c.table_name AS \"table\",\n       c.column_name AS \"column\",\n       CASE WHEN c.data_type = 'USER-DEFINED' THEN c.udt_name ELSE c.data_type END AS \"dataType\",\n       c.character_maximum_length AS \"maxLength\",\n       (u.column_name IS NOT NULL) AS \"unique\"\n  FROM information_schema.columns c\n  JOIN information_schema.tables t ON t.table_schema = c.table_schema AND t.table_name = c.table_name\n  LEFT JOIN unique_columns u\n         ON u.relid = format('%I.%I', c.table_schema, c.table_name)::regclass AND u.column_name = c.column_name\n WHERE t.table_type = 'BASE TABLE'\n   AND c.is_generated = 'NEVER'\n   AND c.table_schema NOT IN ('pg_catalog', 'information_schema')";
+/** How {@link anonymizeCopy} ended. */
+export type AnonymizeOutcome = {
+    ok: true;
+    tables: string[];
+} | {
+    ok: false;
+    /** Why the pass failed. Nothing it wrote was kept. */
+    error: string;
+    /** The tables emptied instead, so none of their real values are left. */
+    emptied: string[];
+    /** Why they could not be emptied, when they could not: the copy then holds real data. */
+    emptyError: string | null;
+};
+/**
+ * Overwrite the personal-looking columns of a restored copy, all or nothing.
+ *
+ * One transaction, so a failure part-way leaves no table half done — the old
+ * pass ran its UPDATEs one by one, so a failure on `rebase.refresh_tokens` left
+ * `public.authors` anonymized and `rebase.users` holding every real email.
+ *
+ * A rollback alone would be worse than that, though: it puts back the real
+ * value of every column, in a copy the developer asked to be anonymized. So on
+ * failure the tables the pass would have rewritten are emptied (`TRUNCATE …
+ * CASCADE`, which takes the rows that reference them too), and the outcome
+ * says which — or, if even that failed, says the copy holds real data, so the
+ * caller can say it louder.
+ *
+ * `row_security = off` makes a role that RLS would filter fail the pass instead
+ * of rewriting only the rows its policies show it, which looked like success.
+ */
+export declare function anonymizeCopy(client: Client): Promise<AnonymizeOutcome>;
 /**
  * Schemas the restored copy needs the app role provisioned on.
  *
@@ -108,6 +189,10 @@ export interface PullPlan {
  * to continue past errors selectively rather than all-or-nothing.
  */
 export declare function dumpArgs(plan: PullPlan): string[];
+/** The environment `pg_dump` runs with: the source's password, if it has one. */
+export declare function dumpEnv(plan: PullPlan): Record<string, string>;
+/** The environment `pg_restore` runs with: the target's password, if it has one. */
+export declare function restoreEnv(plan: PullPlan): Record<string, string>;
 /**
  * `pg_restore` arguments for the target.
  *

package/dist/dev-db/resolve.d.ts

@@ -13,7 +13,7 @@
  *   2. `DATABASE_URL` in the shell environment
  *   3. the database branch this checkout is switched to
  *   4. `DATABASE_URL` in the project's `.env`
- *   5. `--docker`
+ *   5. `--docker`, or the last `rebase dev` having run with it
  *   6. the managed PGlite database
  *
  * An explicit connection string always wins. That is the whole point of the
@@ -22,6 +22,11 @@
  * with no cleverness in between. The managed database is what fills the vacuum
  * when nobody has said anything, and it is the only case where the CLI picks.
  *
+ * The second half of (5) is `rebase dev --docker` remembered, so that `rebase
+ * db url`, `db push` and the rest reach the database a dev server is on rather
+ * than start an empty PGlite beside it (`last-dev-database.ts`). It is exactly
+ * as strong as the flag it stands in for, and no stronger.
+ *
  * The branch at (3) is the one addition that is not an explicit connection
  * string, and it sits where it does deliberately. It has to outrank `.env` or
  * `rebase db branch switch` would silently do nothing on every project that
@@ -46,6 +51,8 @@ export type DevDatabaseSource =
  | "branch"
 /** `--docker`. */
  | "docker"
+/** `--docker`, on the last `rebase dev` rather than this command line. */
+ | "last-dev"
 /** Nobody said anything, so the managed database fills in. */
  | "managed";
 export type DevDatabase = {
@@ -57,7 +64,7 @@ export type DevDatabase = {
     branch?: string;
 } | {
     kind: "docker";
-    source: "docker";
+    source: Extract<DevDatabaseSource, "docker" | "last-dev">;
     /**
      * The compose `db` service's connection string, derived by the caller.
      *
@@ -75,6 +82,12 @@ export interface ResolveDevDatabaseInput {
     flagUrl?: string | null;
     /** `--docker`, if given. */
     flagDocker?: boolean;
+    /**
+     * Whether the last `rebase dev` ran with `--docker`. Followed only while
+     * the compose file still names a database, since there is none to go back
+     * to otherwise.
+     */
+    lastDevDocker?: boolean;
     /** The shell environment. Only `DATABASE_URL` is read. */
     env?: Record<string, string | undefined>;
     /** Parsed `.env` from the project root. Only `DATABASE_URL` is read. */
@@ -99,5 +112,16 @@ export interface ResolveDevDatabaseInput {
     } | null;
 }
 export declare function resolveDevDatabase(input?: ResolveDevDatabaseInput): DevDatabase;
+/**
+ * The line to print when `--docker` was typed and a connection string outranked
+ * it, or null when it was not typed or was what this command used.
+ *
+ * The order stays as documented: asking for Docker says how to get a database,
+ * and a `DATABASE_URL` that already names one wins. But a flag on this command
+ * line that changes nothing without a word reads as a flag that worked. Only the
+ * typed flag is reported — the last `rebase dev --docker` standing in for it is
+ * a default, and losing to `.env` is what a default does.
+ */
+export declare function outrankedDockerFlagNotice(database: DevDatabase, flagDocker: boolean | undefined): string | null;
 /** One line for the startup banner, naming both the database and why. */
 export declare function describeDevDatabase(database: DevDatabase): string;

package/dist/dev-preflight-B-LYyBf1.js

@@ -0,0 +1,2 @@
+import { D as ensureDevDatabase } from "./prepare-CDN6lSpz.js";
+export { ensureDevDatabase };

package/dist/dev-server-DG8Tt-uf.js

@@ -0,0 +1,96 @@
+import { c as findProjectRoot } from "./project-Wp2zoyeN.js";
+import fs from "fs";
+import path from "path";
+//#region src/utils/dev-server.ts
+/**
+* Where `rebase dev` serves a project's backend.
+*
+* Not the `PORT` in `.env`: `rebase dev` overrides it with a port derived from
+* the project's path, so two projects on one machine do not collide, and that
+* `PORT` is what `rebase start` listens on. A command that talks to the backend
+* and gets no answer has to be able to say both — its hint named only `.env`'s
+* 3001, for a project whose dev server had been on 3732.
+*/
+/**
+* The port `rebase dev` derives from the project root path.
+* Range: 3001–3999 (avoids privileged ports and common services).
+* Two different project directories will almost always get different ports.
+*/
+function getProjectPort(projectRoot) {
+	let hash = 0;
+	for (let i = 0; i < projectRoot.length; i++) hash = (hash << 5) - hash + projectRoot.charCodeAt(i) | 0;
+	return 3001 + Math.abs(hash) % 999;
+}
+/** A TCP port out of a string or a number, or null. */
+function portOf(raw) {
+	const port = typeof raw === "number" ? raw : typeof raw === "string" ? Number(raw.trim()) : NaN;
+	return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;
+}
+function readText(file) {
+	try {
+		return fs.readFileSync(file, "utf-8").trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* The URL `rebase dev` serves this project on, and how that is known:
+*
+*   - `running` — the URL a running dev wrote to `.rebase-dev-url`;
+*   - `recorded` — the port the last run left in `.rebase/state.json` or
+*     `.rebase-dev-port` (both outlive a dev that did not shut down cleanly);
+*   - `derived` — nothing is recorded, so the port it derives for this path.
+*
+* Asked only to describe where dev is; a `PORT` in the shell would move the
+* next run, and is not something a stopped dev left behind.
+*/
+function devServerUrl(projectRoot) {
+	const running = readText(path.join(projectRoot, ".rebase-dev-url"));
+	if (running) return {
+		url: running,
+		source: "running"
+	};
+	const state = readText(path.join(projectRoot, ".rebase", "state.json"));
+	if (state) try {
+		const parsed = JSON.parse(state);
+		const port = typeof parsed === "object" && parsed !== null && "port" in parsed ? portOf(parsed.port) : null;
+		if (port !== null) return {
+			url: `http://localhost:${port}`,
+			source: "recorded"
+		};
+	} catch {}
+	const portFile = portOf(readText(path.join(projectRoot, ".rebase-dev-port"))?.split(/\s+/)[0]);
+	if (portFile !== null) return {
+		url: `http://localhost:${portFile}`,
+		source: "recorded"
+	};
+	return {
+		url: `http://localhost:${getProjectPort(projectRoot)}`,
+		source: "derived"
+	};
+}
+/**
+* What to say when nothing answered at `baseUrl`.
+*
+* The first line is the question it always asked. The second is added when
+* `rebase dev` serves this project somewhere else, because then `baseUrl` is
+* almost always `.env`'s `PORT`, and a reader who just stopped `rebase dev`
+* reads the number as the one it was using.
+*/
+function serverUnreachableHint(baseUrl, projectRoot = findProjectRoot()) {
+	const lines = [`  Is the Rebase server running at ${baseUrl}? Start it with \`rebase dev\`, or set REBASE_BASE_URL in .env.`];
+	if (!projectRoot) return lines;
+	const dev = devServerUrl(projectRoot);
+	let same = false;
+	try {
+		same = new URL(dev.url).origin === new URL(baseUrl).origin;
+	} catch {}
+	if (same) return lines;
+	const why = dev.source === "derived" ? "the port it picks for this project" : "the port it last used";
+	lines.push(`  \`rebase dev\` serves this project at ${dev.url} (${why}), and this command uses that address while it runs.`);
+	return lines;
+}
+//#endregion
+export { getProjectPort as n, serverUnreachableHint as r, devServerUrl as t };
+
+//# sourceMappingURL=dev-server-DG8Tt-uf.js.map

package/dist/dev-server-DG8Tt-uf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dev-server-DG8Tt-uf.js","names":[],"sources":["../src/utils/dev-server.ts"],"sourcesContent":["/**\n * Where `rebase dev` serves a project's backend.\n *\n * Not the `PORT` in `.env`: `rebase dev` overrides it with a port derived from\n * the project's path, so two projects on one machine do not collide, and that\n * `PORT` is what `rebase start` listens on. A command that talks to the backend\n * and gets no answer has to be able to say both — its hint named only `.env`'s\n * 3001, for a project whose dev server had been on 3732.\n */\nimport fs from \"fs\";\nimport path from \"path\";\n\nimport { findProjectRoot } from \"./project\";\n\n/**\n * The port `rebase dev` derives from the project root path.\n * Range: 3001–3999 (avoids privileged ports and common services).\n * Two different project directories will almost always get different ports.\n */\nexport function getProjectPort(projectRoot: string): number {\n    let hash = 0;\n    for (let i = 0; i < projectRoot.length; i++) {\n        hash = ((hash << 5) - hash + projectRoot.charCodeAt(i)) | 0;\n    }\n    return 3001 + (Math.abs(hash) % 999);\n}\n\n/** A TCP port out of a string or a number, or null. */\nfunction portOf(raw: unknown): number | null {\n    const port = typeof raw === \"number\" ? raw : typeof raw === \"string\" ? Number(raw.trim()) : Number.NaN;\n    return Number.isInteger(port) && port > 0 && port < 65536 ? port : null;\n}\n\nfunction readText(file: string): string | null {\n    try {\n        return fs.readFileSync(file, \"utf-8\").trim();\n    } catch {\n        return null;\n    }\n}\n\n/**\n * The URL `rebase dev` serves this project on, and how that is known:\n *\n *   - `running` — the URL a running dev wrote to `.rebase-dev-url`;\n *   - `recorded` — the port the last run left in `.rebase/state.json` or\n *     `.rebase-dev-port` (both outlive a dev that did not shut down cleanly);\n *   - `derived` — nothing is recorded, so the port it derives for this path.\n *\n * Asked only to describe where dev is; a `PORT` in the shell would move the\n * next run, and is not something a stopped dev left behind.\n */\nexport function devServerUrl(projectRoot: string): { url: string; source: \"running\" | \"recorded\" | \"derived\" } {\n    const running = readText(path.join(projectRoot, \".rebase-dev-url\"));\n    if (running) return { url: running, source: \"running\" };\n\n    const state = readText(path.join(projectRoot, \".rebase\", \"state.json\"));\n    if (state) {\n        try {\n            const parsed: unknown = JSON.parse(state);\n            const port = typeof parsed === \"object\" && parsed !== null && \"port\" in parsed ? portOf(parsed.port) : null;\n            if (port !== null) return { url: `http://localhost:${port}`, source: \"recorded\" };\n        } catch { /* fall through to the port file */ }\n    }\n\n    const portFile = portOf(readText(path.join(projectRoot, \".rebase-dev-port\"))?.split(/\\s+/)[0]);\n    if (portFile !== null) return { url: `http://localhost:${portFile}`, source: \"recorded\" };\n\n    return { url: `http://localhost:${getProjectPort(projectRoot)}`, source: \"derived\" };\n}\n\n/**\n * What to say when nothing answered at `baseUrl`.\n *\n * The first line is the question it always asked. The second is added when\n * `rebase dev` serves this project somewhere else, because then `baseUrl` is\n * almost always `.env`'s `PORT`, and a reader who just stopped `rebase dev`\n * reads the number as the one it was using.\n */\nexport function serverUnreachableHint(baseUrl: string, projectRoot: string | null = findProjectRoot()): string[] {\n    const lines = [`  Is the Rebase server running at ${baseUrl}? Start it with \\`rebase dev\\`, or set REBASE_BASE_URL in .env.`];\n    if (!projectRoot) return lines;\n\n    const dev = devServerUrl(projectRoot);\n    let same = false;\n    try {\n        same = new URL(dev.url).origin === new URL(baseUrl).origin;\n    } catch {\n        // An unparseable URL on either side is not the same address.\n    }\n    if (same) return lines;\n\n    const why = dev.source === \"derived\" ? \"the port it picks for this project\" : \"the port it last used\";\n    lines.push(`  \\`rebase dev\\` serves this project at ${dev.url} (${why}), and this command uses that address while it runs.`);\n\n    return lines;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;AAmBA,SAAgB,eAAe,aAA6B;CACxD,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,YAAY,QAAQ,KACpC,QAAS,QAAQ,KAAK,OAAO,YAAY,WAAW,CAAC,IAAK;CAE9D,OAAO,OAAQ,KAAK,IAAI,IAAI,IAAI;AACpC;;AAGA,SAAS,OAAO,KAA6B;CACzC,MAAM,OAAO,OAAO,QAAQ,WAAW,MAAM,OAAO,QAAQ,WAAW,OAAO,IAAI,KAAK,CAAC,IAAI;CAC5F,OAAO,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,OAAO,QAAQ,OAAO;AACvE;AAEA,SAAS,SAAS,MAA6B;CAC3C,IAAI;EACA,OAAO,GAAG,aAAa,MAAM,OAAO,CAAC,CAAC,KAAK;CAC/C,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;AAaA,SAAgB,aAAa,aAAkF;CAC3G,MAAM,UAAU,SAAS,KAAK,KAAK,aAAa,iBAAiB,CAAC;CAClE,IAAI,SAAS,OAAO;EAAE,KAAK;EAAS,QAAQ;CAAU;CAEtD,MAAM,QAAQ,SAAS,KAAK,KAAK,aAAa,WAAW,YAAY,CAAC;CACtE,IAAI,OACA,IAAI;EACA,MAAM,SAAkB,KAAK,MAAM,KAAK;EACxC,MAAM,OAAO,OAAO,WAAW,YAAY,WAAW,QAAQ,UAAU,SAAS,OAAO,OAAO,IAAI,IAAI;EACvG,IAAI,SAAS,MAAM,OAAO;GAAE,KAAK,oBAAoB;GAAQ,QAAQ;EAAW;CACpF,QAAQ,CAAsC;CAGlD,MAAM,WAAW,OAAO,SAAS,KAAK,KAAK,aAAa,kBAAkB,CAAC,CAAC,EAAE,MAAM,KAAK,CAAC,CAAC,EAAE;CAC7F,IAAI,aAAa,MAAM,OAAO;EAAE,KAAK,oBAAoB;EAAY,QAAQ;CAAW;CAExF,OAAO;EAAE,KAAK,oBAAoB,eAAe,WAAW;EAAK,QAAQ;CAAU;AACvF;;;;;;;;;AAUA,SAAgB,sBAAsB,SAAiB,cAA6B,gBAAgB,GAAa;CAC7G,MAAM,QAAQ,CAAC,qCAAqC,QAAQ,gEAAgE;CAC5H,IAAI,CAAC,aAAa,OAAO;CAEzB,MAAM,MAAM,aAAa,WAAW;CACpC,IAAI,OAAO;CACX,IAAI;EACA,OAAO,IAAI,IAAI,IAAI,GAAG,CAAC,CAAC,WAAW,IAAI,IAAI,OAAO,CAAC,CAAC;CACxD,QAAQ,CAER;CACA,IAAI,MAAM,OAAO;CAEjB,MAAM,MAAM,IAAI,WAAW,YAAY,uCAAuC;CAC9E,MAAM,KAAK,2CAA2C,IAAI,IAAI,IAAI,IAAI,qDAAqD;CAE3H,OAAO;AACX"}