@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/init-Utstvh2Q.js

@@ -0,0 +1,1149 @@
+import { i as recordEvent, l as durationBucket } from "./telemetry-EMFRVRQi.js";
+import { n as getPMCommands, t as detectPackageManager } from "./package-manager-DSEOwTqM.js";
+import { n as parseCommandArgs, r as wantsHelp } from "./args-BnmsEXvu.js";
+import { n as cliVersion } from "./version-Buyyo1ut.js";
+import { AGENTS, AGENT_KEYS, resolveAgentNames } from "./skills-DTFibT1m.js";
+import { configureAgents, printAgentSetup, promptForAgents, retargetScaffoldMcpConfig } from "./agent-setup-B31F00DC.js";
+import { W as resolveCloudUrl, Z as writeLink } from "./context-BqhRydBg.js";
+import { n as promptForConsent } from "./consent-ClRHmcxf.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import crypto from "crypto";
+import { fileURLToPath } from "url";
+import { parseEnvBoolean } from "@rebasepro/types";
+import inquirer from "inquirer";
+import { execa } from "execa";
+import net from "net";
+import { promisify } from "util";
+import { cp } from "fs/promises";
+//#region src/commands/init.ts
+var access = promisify(fs.access);
+var __filename = fileURLToPath(import.meta.url);
+var __dirname = path.dirname(__filename);
+function findParentDir(currentDir, targetName) {
+	const root = path.parse(currentDir).root;
+	while (currentDir && currentDir !== root) {
+		if (path.basename(currentDir) === targetName) return currentDir;
+		currentDir = path.dirname(currentDir);
+	}
+	return null;
+}
+var cliRoot = findParentDir(__dirname, "cli");
+var PROJECT_NAME_RE = /^[a-z0-9][a-z0-9._-]*$/;
+/**
+* Every scaffolded file that carries a `{{PLACEHOLDER}}`.
+*
+* Exported because it is the single source of truth: `init.test.ts` reads it and
+* asserts that every template file containing `{{` appears here. It used to be a
+* local, with the test harness keeping a *second* copy — so the two drifted, and
+* a test built on the copy could not observe the production list at all.
+*
+* The drift shipped: `docker-compose.yml` arrived with the self-host work
+* (26fd5259c) and was added to neither, so every scaffolded project got a literal
+* `name: {{PROJECT_NAME}}`. In YAML `{{...}}` is a map, not a string, so the
+* documented `docker compose up` path failed on the file before doing anything:
+*
+*   yaml: unmarshal errors: line 28: cannot unmarshal !!map into string
+*/
+var TEMPLATE_PLACEHOLDER_FILES = [
+	"package.json",
+	"frontend/package.json",
+	"backend/package.json",
+	"config/package.json",
+	"frontend/index.html",
+	"pnpm-workspace.yaml",
+	"docker-compose.yml",
+	"README.md"
+];
+/** Returns an error message, or null when the name is a valid package name. */
+function validateProjectName(name) {
+	if (!name.trim()) return "Project name is required";
+	if (!PROJECT_NAME_RE.test(name)) return "Project name must start with a lowercase letter or number and contain only lowercase letters, numbers, hyphens, dots, or underscores";
+	return null;
+}
+/**
+* Whether to scaffold the admin panel alongside the backend.
+*
+* A boolean, not a named pair. It was `--flavor cms|baas`, and neither word
+* survived what they described: "cms" is a product category rather than a thing
+* this tool builds, and "baas" was the same value that used to appear as
+* `backend.mode` — which is now derived from whether collections are declared.
+* What is left is one question: does this project get an admin UI?
+*/
+var HEADLESS_CHOICES = [{
+	name: "Backend + admin  — API plus an admin UI, driven by collections you define (like Payload/Directus)",
+	value: false,
+	short: "Backend + admin"
+}, {
+	name: "Backend only     — headless API over your database. No collections, no UI (like Supabase)",
+	value: true,
+	short: "Backend only"
+}];
+var PRESET_CHOICES = [
+	{
+		name: "Blog         — Posts, Authors, Tags (with markdown editor)",
+		value: "blog",
+		short: "Blog"
+	},
+	{
+		name: "E-commerce   — Products, Categories, Orders",
+		value: "ecommerce",
+		short: "E-commerce"
+	},
+	{
+		name: "Blank        — Empty project, just authentication",
+		value: "blank",
+		short: "Blank"
+	}
+];
+/**
+* Why `input` cannot be this project's `DATABASE_URL`, or null when it can.
+*
+* The runtime refuses anything that is not a URL, and only a Postgres one can
+* work, so `init` refuses the same — before the scaffold is written around it.
+* The value itself is never repeated back: it may hold a password.
+*/
+function databaseUrlProblem(input) {
+	const expected = "(expected postgresql://user:password@host:5432/database)";
+	let parsed;
+	try {
+		parsed = new URL(input.trim());
+	} catch {
+		return `not a PostgreSQL connection string ${expected}`;
+	}
+	if (parsed.protocol !== "postgresql:" && parsed.protocol !== "postgres:") return `not a PostgreSQL connection string: it starts with ${parsed.protocol}// ${expected}`;
+	return null;
+}
+/** One line saying `dir` already holds files, or null when it may be scaffolded into. */
+function scaffoldConflictLine(dir) {
+	const conflicts = scaffoldDirectoryConflicts(dir);
+	if (conflicts.length === 0) return null;
+	const shown = conflicts.slice(0, 4).join(", ") + (conflicts.length > 4 ? `, and ${conflicts.length - 4} more` : "");
+	return `"${path.basename(dir)}" already holds files a new project would overwrite or mix with (${shown}). Choose another name.`;
+}
+function buildInitQuestions(params) {
+	const { nameArg, templateArg, headlessArg, hasGitFlag, hasInstallFlag, pm } = params;
+	const questions = [];
+	if (!nameArg) questions.push({
+		type: "input",
+		name: "projectName",
+		message: "Project name:",
+		default: "my-app",
+		validate: (input) => validateProjectName(input) ?? scaffoldConflictLine(path.resolve(process.cwd(), input)) ?? true
+	});
+	if (headlessArg === void 0) questions.push({
+		type: "select",
+		name: "headless",
+		message: "What do you want to build?",
+		choices: HEADLESS_CHOICES,
+		default: false
+	});
+	if (!templateArg) questions.push({
+		type: "select",
+		name: "preset",
+		message: "Choose a starter template:",
+		choices: PRESET_CHOICES,
+		default: "blog",
+		when: (answers) => !(headlessArg ?? answers.headless)
+	});
+	if (!hasGitFlag) questions.push({
+		type: "confirm",
+		name: "git",
+		message: "Initialize a git repository?",
+		default: true
+	});
+	if (!hasInstallFlag) questions.push({
+		type: "confirm",
+		name: "installDeps",
+		message: `Install dependencies with ${pm}?`,
+		default: true
+	});
+	questions.push({
+		type: "input",
+		name: "databaseUrl",
+		message: "PostgreSQL connection string (blank = a managed database for this project, no setup):",
+		default: "",
+		validate: (input) => {
+			if (!input.trim()) return true;
+			if (/[\r\n]/.test(input)) return "Database URL cannot contain newline characters.";
+			const problem = databaseUrlProblem(input);
+			return problem ? `That is ${problem}. Leave it blank for the managed database.` : true;
+		}
+	});
+	questions.push({
+		type: "confirm",
+		name: "introspect",
+		message: "Would you like to introspect this database to automatically generate collections?",
+		default: true,
+		when: (answers) => !!answers.databaseUrl?.trim()
+	});
+	return questions;
+}
+/**
+* The `cd` a user must type to enter the new project.
+*
+* Not the project's basename: `init apps/my-app` has to say `cd apps/my-app`,
+* and `init .` returns "" because they are already in the project.
+*/
+function formatCdTarget(cwd, targetDirectory) {
+	return path.relative(cwd, targetDirectory);
+}
+/** Help for `rebase init` — the flags were previously only discoverable by
+* triggering the non-TTY error. */
+function printInitHelp() {
+	console.log(`
+${chalk.bold("rebase init")} — Create a new Rebase project
+
+${chalk.bold("Usage")}
+  rebase init ${chalk.blue("[name]")} [options]
+
+  ${chalk.gray("The name may be a nested path (apps/my-app) or \".\" for the current directory.")}
+  ${chalk.gray("Asks when omitted; defaults to \"my-app\", and takes it without asking under --yes.")}
+
+${chalk.bold("Options")}
+  ${chalk.blue("-t, --template")} ${chalk.gray("<preset>")}   blog | ecommerce | blank ${chalk.gray("(default: blog)")}
+  ${chalk.blue("--headless")}                Backend only — no admin panel, no collections
+  ${chalk.blue("-y, --yes")}                 Never prompt ${chalk.gray("(required for CI / non-TTY)")}
+                            ${chalk.gray("Skips git init and dependency install — the interactive")}
+                            ${chalk.gray("defaults say yes to both. Pass --git / --install for those.")}
+  ${chalk.blue("-i, --install")}             Install dependencies after scaffolding
+  ${chalk.blue("--no-install")}              Scaffold only, install nothing ${chalk.gray("(the default)")}
+  ${chalk.blue("-g, --git")}                 Initialize a git repository and make an initial commit
+  ${chalk.blue("--database-url")} ${chalk.gray("<url>")}      Use an existing database instead of the generated one
+  ${chalk.blue("--introspect")}              Generate collections from that database ${chalk.gray("(implies --template blank; needs --install)")}
+  ${chalk.blue("--project")} ${chalk.gray("<slug>")}          Link the scaffold to a Rebase Cloud project
+  ${chalk.blue("--setup-key")} ${chalk.gray("<key>")}         One-time key authenticating the cloud link ${chalk.gray("(use with --project)")}
+  ${chalk.blue("-a, --agent")} ${chalk.gray("<name>")}        Set up an AI coding agent: Rebase skills + the MCP server.
+                            ${chalk.gray(`Repeatable or comma-separated: ${AGENT_KEYS.join(" | ")} | all`)}
+                            ${chalk.gray("Asks when omitted, pre-ticking the agents installed on this")}
+                            ${chalk.gray("machine; under --yes, none unless named.")}
+
+${chalk.bold("What gets scaffolded")}
+  ${chalk.gray("default")}     Backend + an admin UI, driven by collections you define ${chalk.gray("(like Payload/Directus)")}
+  ${chalk.blue("--headless")}  Backend only, over your existing database ${chalk.gray("(like Supabase)")}
+              ${chalk.gray("--template has no effect: there are no collections to seed.")}
+
+${chalk.bold("Examples")}
+  ${chalk.gray("$")} rebase init my-shop --template ecommerce --install
+  ${chalk.gray("$")} rebase init my-api --headless --yes
+  ${chalk.gray("$")} rebase init . --yes --git
+  ${chalk.gray("$")} rebase init my-app --yes --agent claude,cursor
+`);
+}
+async function createRebaseApp(rawArgs) {
+	if (wantsHelp(rawArgs)) {
+		printInitHelp();
+		return;
+	}
+	console.log(`
+${chalk.bold("Rebase")} — Create a new project 🚀
+`);
+	await createProject(await promptForOptions(rawArgs, detectPackageManager()));
+}
+/** The flags `rebase init` takes. */
+var INIT_FLAGS = {
+	"--git": Boolean,
+	"--install": Boolean,
+	"--no-install": Boolean,
+	"--database-url": String,
+	"--introspect": Boolean,
+	"--template": String,
+	"--headless": Boolean,
+	"--project": String,
+	"--setup-key": String,
+	"--agent": [String],
+	"--yes": Boolean,
+	"-a": "--agent",
+	"-g": "--git",
+	"-i": "--install",
+	"-t": "--template",
+	"-y": "--yes"
+};
+async function promptForOptions(rawArgs, pm) {
+	const { flags: args, positionals } = parseCommandArgs({
+		spec: INIT_FLAGS,
+		rawArgs,
+		commandWords: 1,
+		command: "init",
+		maxPositionals: 1
+	});
+	const nameArg = positionals[0];
+	const isNonInteractive = args["--yes"] || false;
+	if (nameArg) {
+		const resolvedName = path.basename(path.resolve(process.cwd(), nameArg));
+		const nameError = validateProjectName(resolvedName);
+		if (nameError) {
+			console.error(chalk.red(`Invalid project name "${resolvedName}": ${nameError}`));
+			process.exit(1);
+		}
+		const targetDirectory = path.resolve(process.cwd(), nameArg);
+		const conflicts = scaffoldDirectoryConflicts(targetDirectory);
+		if (conflicts.length > 0) {
+			for (const line of scaffoldConflictMessage(resolvedName, formatCdTarget(process.cwd(), targetDirectory), conflicts)) console.error(line);
+			process.exit(1);
+		}
+	}
+	const databaseUrlArg = args["--database-url"]?.trim();
+	if (databaseUrlArg) {
+		const problem = databaseUrlProblem(databaseUrlArg);
+		if (problem) {
+			console.error(chalk.red(`✗ --database-url is ${problem}.`));
+			console.error(chalk.gray("  Leave the flag out to use a managed database for this project, with no setup."));
+			process.exit(1);
+		}
+	}
+	const templateArg = args["--template"];
+	if (templateArg && !PRESET_CHOICES.some((p) => p.value === templateArg)) {
+		console.error(chalk.red(`Unknown template "${templateArg}". Available: ${PRESET_CHOICES.map((p) => p.value).join(", ")}`));
+		process.exit(1);
+	}
+	const headlessArg = args["--headless"] === true ? true : void 0;
+	const namedAgents = resolveAgentNames(args["--agent"] ?? []);
+	const noInstall = args["--no-install"] === true;
+	const installFlag = noInstall ? false : args["--install"] ?? false;
+	const hasInstallFlag = noInstall || args["--install"] === true;
+	if (isNonInteractive) {
+		const projectName = nameArg || "my-app";
+		const targetDirectory = path.resolve(process.cwd(), projectName);
+		const templateDirectory = path.resolve(cliRoot, "templates", "template");
+		const pmCommands = getPMCommands(pm);
+		return {
+			projectName: path.basename(targetDirectory),
+			git: args["--git"] ?? false,
+			installDeps: installFlag,
+			targetDirectory,
+			templateDirectory,
+			databaseUrl: args["--database-url"] || void 0,
+			introspect: args["--introspect"] || false,
+			preset: templateArg || "blog",
+			explicitPreset: !!templateArg,
+			headless: headlessArg ?? false,
+			pm,
+			pmCommands,
+			cloudProject: args["--project"] || void 0,
+			setupKey: args["--setup-key"] || void 0,
+			cloudUrl: resolveCloudUrl(rawArgs),
+			agents: namedAgents ?? [],
+			interactive: false
+		};
+	}
+	if (!process.stdin.isTTY) {
+		console.error(chalk.red("Cannot prompt: this is a non-interactive terminal (no TTY)."));
+		console.error(chalk.yellow("  Re-run with --yes to accept defaults, passing any choices as flags, e.g.:"));
+		console.error(chalk.yellow(`    rebase init ${nameArg || "my-app"} --yes --template blog`));
+		console.error(chalk.gray("  Options: --template <blog|ecommerce|blank>  --headless  --database-url <url>  --install  --git  --agent <name>"));
+		process.exit(1);
+	}
+	const questions = buildInitQuestions({
+		nameArg,
+		templateArg,
+		headlessArg,
+		hasGitFlag: !!args["--git"],
+		hasInstallFlag,
+		pm
+	});
+	const answers = await inquirer.prompt(questions);
+	const agents = namedAgents ?? await promptForAgents();
+	const targetDirectory = path.resolve(process.cwd(), nameArg || answers.projectName);
+	const projectName = path.basename(targetDirectory);
+	const templateDirectory = path.resolve(cliRoot, "templates", "template");
+	const pmCommands = getPMCommands(pm);
+	return {
+		projectName,
+		git: args["--git"] || answers.git || false,
+		installDeps: noInstall ? false : args["--install"] || answers.installDeps || false,
+		targetDirectory,
+		templateDirectory,
+		databaseUrl: answers.databaseUrl?.trim() || void 0,
+		introspect: answers.introspect || false,
+		preset: templateArg || answers.preset || "blog",
+		explicitPreset: !!templateArg,
+		headless: headlessArg ?? Boolean(answers.headless),
+		pm,
+		pmCommands,
+		cloudProject: args["--project"] || void 0,
+		setupKey: args["--setup-key"] || void 0,
+		cloudUrl: resolveCloudUrl(rawArgs),
+		agents,
+		interactive: true
+	};
+}
+/**
+* Redeem the one-time setup key from the console's setup page and write the
+* `.rebase/cloud.json` link into the scaffold, so `rebase cloud deploy` etc.
+* work in the new directory with no further flags. `--project` carries the
+* project's slug (its subdomain, as shown in console URLs); the control plane
+* also accepts a raw id for old copies of the command.
+*
+* Best-effort by design: a failed link must never fail the scaffold, so every
+* exit path other than success is a warning plus instructions to link later.
+*/
+async function linkScaffoldToCloud(options) {
+	if (!options.cloudProject && !options.setupKey) return;
+	const linkLater = `Link it later with ${chalk.bold("rebase cloud login")} then ${chalk.bold("rebase cloud link")}.`;
+	if (!options.cloudProject || !options.setupKey) {
+		console.warn(chalk.yellow("  --project and --setup-key go together; skipping the cloud link."));
+		console.warn(chalk.yellow(`  ${linkLater}`));
+		return;
+	}
+	try {
+		const res = await fetch(`${options.cloudUrl}/api/functions/setup-key/validate`, {
+			method: "POST",
+			headers: { "Content-Type": "application/json" },
+			body: JSON.stringify({
+				projectId: options.cloudProject,
+				setupKey: options.setupKey
+			})
+		});
+		const body = await res.json().catch(() => ({}));
+		if (!res.ok || body.project?.id === void 0) {
+			console.warn(chalk.yellow(`  Could not verify the setup key: ${body.error?.message || res.statusText}`));
+			console.warn(chalk.yellow(`  ${linkLater}`));
+			return;
+		}
+		writeLink({
+			url: String(options.cloudUrl),
+			projectId: String(body.project.id),
+			slug: body.project.subdomain,
+			projectName: body.project.name
+		}, options.targetDirectory);
+		console.log("");
+		console.log(`  ${chalk.green("✓")} Linked to cloud project ${chalk.bold(body.project.subdomain ?? options.cloudProject)}`);
+	} catch (e) {
+		console.warn(chalk.yellow(`  Could not reach the control plane: ${e instanceof Error ? e.message : String(e)}`));
+		console.warn(chalk.yellow(`  ${linkLater}`));
+	}
+}
+/**
+* Make the initial commit, after everything that writes into the project has run.
+*
+* It used to happen immediately after `git init`, which is before dependency
+* installation and before introspection — so `init --git --install` ended on a
+* dirty tree whose only untracked file was `pnpm-lock.yaml`. A lockfile is
+* precisely the thing that should be in a project's first commit, and a brand
+* new scaffold whose first `git status` is dirty invites the reader to conclude
+* the lockfile is deliberately ignored and never commit it at all.
+*
+* Introspection has the same shape: it generates `config/collections` and
+* `schema.generated.ts`, which belong in the commit describing the scaffold that
+* produced them.
+*
+* `git init` stays where it was. Creating the repository early costs nothing and
+* means a failed install still leaves the user a repository to commit into.
+*/
+async function commitScaffold(targetDirectory) {
+	try {
+		await execa("git", ["add", "-A"], { cwd: targetDirectory });
+		let identity = {};
+		try {
+			await execa("git", ["config", "user.email"], { cwd: targetDirectory });
+		} catch {
+			identity = {
+				GIT_AUTHOR_NAME: "Rebase",
+				GIT_AUTHOR_EMAIL: "noreply@rebase.pro",
+				GIT_COMMITTER_NAME: "Rebase",
+				GIT_COMMITTER_EMAIL: "noreply@rebase.pro"
+			};
+		}
+		await execa("git", [
+			"commit",
+			"-m",
+			"Initial commit from Rebase"
+		], {
+			cwd: targetDirectory,
+			env: identity
+		});
+	} catch {
+		console.warn(chalk.yellow("  Warning: Failed to create the initial commit"));
+	}
+}
+/**
+* The "Next steps" `init` closes on, every command one that works as printed.
+*
+* Each flavour has its own steps, and the branch for one flavour must not run
+* for another. The `--database-url` branch was checked before the headless one,
+* so `init --headless --database-url` — the documented BaaS path — opened on
+* `pnpm run db:push`: a script the headless scaffold does not have, for a
+* schema it does not declare (its tables are the developer's own), with an
+* Atlas it does not install. `init-next-steps.test.ts` holds every script
+* named here to the scaffold it is printed for.
+*/
+function initNextSteps(input) {
+	const { headless, ownDatabase, introspect, introspected, installed, cdTarget, pm } = input;
+	const cmd = (parts) => `  ${chalk.cyan(parts.join(" "))}`;
+	const note = (text) => chalk.gray(`  # ${text}`);
+	const runDev = cmd(pm.run("dev"));
+	const lines = [];
+	if (cdTarget) lines.push(`  ${chalk.cyan("cd")} ${cdTarget}`);
+	if (!installed) lines.push(cmd(pm.install));
+	lines.push("");
+	if (introspected) {
+		lines.push(note("Database has been introspected & collections generated!"));
+		lines.push(note(headless ? "Start the API over it:" : "Start the development server (frontend + backend):"));
+		lines.push(runDev);
+	} else if (introspect) {
+		lines.push(note("Introspection did not run — finish it with:"));
+		lines.push(cmd(pm.exec("rebase", [
+			"schema",
+			"introspect",
+			"--force"
+		])));
+		lines.push(cmd(pm.exec("rebase", ["schema", "generate"])));
+		lines.push("");
+		lines.push(note("Then start the development server:"));
+		lines.push(runDev);
+	} else if (headless) {
+		lines.push(note(ownDatabase ? "Your database is configured in .env (DATABASE_URL)." : "A local database configuration has been generated in .env."));
+		lines.push(note(ownDatabase ? "1. Start the API over it:" : "1. Start everything — the database comes up with it:"));
+		lines.push(runDev);
+		lines.push("");
+		lines.push(note(ownDatabase ? "2. Serve your tables." : "2. Create your tables (migrations, SQL, any tool you like)."));
+		lines.push(note("   A table is served once row-level security is enabled on it, and a"));
+		lines.push(note("   policy is what opens its rows:"));
+		lines.push(cmd(["ALTER TABLE your_table ENABLE ROW LEVEL SECURITY;"]));
+		lines.push(cmd(["CREATE POLICY your_table_owner ON your_table FOR ALL USING (user_id = rebase.uid());"]));
+		lines.push(note("   The API logs any table it skips, and why."));
+	} else if (ownDatabase) {
+		lines.push(note("Your custom database is configured in .env."));
+		lines.push(note("If the database is empty, push the Rebase schema to initialize it:"));
+		lines.push(cmd(pm.run("db:push")));
+		lines.push("");
+		lines.push(note("Then start the development server:"));
+		lines.push(runDev);
+	} else {
+		lines.push(note("A local database configuration has been generated in .env."));
+		lines.push(note("Start everything — the database and schema are set up for you,"));
+		lines.push(note("with no Docker and nothing else to install:"));
+		lines.push(runDev);
+		lines.push("");
+		lines.push(note("To use a Postgres of your own instead, uncomment DATABASE_URL in .env."));
+	}
+	lines.push("");
+	lines.push(note("Sign in: the first account you register becomes the admin."));
+	lines.push(note("In production (docker compose) that window is shut and the account named by"));
+	lines.push(note("REBASE_ADMIN_EMAIL in .env is created at boot instead."));
+	lines.push("");
+	lines.push(headless ? introspected ? chalk.gray("This starts a headless API (Hono + PostgreSQL) over the collections just ") + chalk.gray("generated from your database in config/collections. Edit them to change what the ") + chalk.gray("API exposes; docs are at /api/swagger.") : chalk.gray("This starts a headless API (Hono + PostgreSQL). There are no collection files: ") + chalk.gray("the API is derived from your database schema. Once it serves a table, docs are at /api/swagger.") : chalk.gray("This starts both the backend (Hono + PostgreSQL)") + chalk.gray(" and the frontend (Vite + React) concurrently."));
+	return lines;
+}
+/**
+* The closing "AI Agent Skills" lines, each command one its reader can run.
+*
+* `rebase skills install` with no `--agent` prompts, and refuses without a
+* TTY — so printing it bare at the end of `rebase init --yes`, the agent and
+* CI path, told that reader to run a command that answers "Cannot prompt".
+* Named agents are spelled out (a refresh must not depend on detection, which
+* never finds Copilot); otherwise a TTY reader gets the prompt, anyone else
+* the `--agent` form.
+*/
+function agentNextSteps(agents, interactive, pm) {
+	const both = (args) => `  ${chalk.cyan(["rebase", ...args].join(" "))}  ${chalk.gray("or")}  ${chalk.cyan(pm.exec("rebase", args).join(" "))}`;
+	if (agents.length > 0) return [
+		chalk.gray(`  Set up for ${agents.map((a) => AGENTS[a].label).join(", ")}. Commit the files to share them;`),
+		chalk.gray("  after a Rebase upgrade, refresh the skills with:"),
+		"",
+		both([
+			"skills",
+			"install",
+			"--agent",
+			agents.join(",")
+		])
+	];
+	if (interactive) return [
+		chalk.gray("  Install Rebase agent skills, and the Rebase MCP server, for your AI coding assistant:"),
+		"",
+		both([
+			"skills",
+			"install",
+			"--mcp"
+		])
+	];
+	return [
+		chalk.gray("  Install Rebase agent skills, and the Rebase MCP server, for your AI coding assistant —"),
+		chalk.gray(`  name it: ${AGENT_KEYS.join(", ")}, or all.`),
+		"",
+		both([
+			"skills",
+			"install",
+			"--agent",
+			"<agent>",
+			"--mcp"
+		])
+	];
+}
+/**
+* What a directory may already hold for `rebase init` to scaffold into it.
+*
+* `git clone` of an empty repository, or `git init`, leaves exactly `.git` —
+* and `rebase init . --yes --git` is the help's own example. Counting every
+* entry as "not empty" refused the one directory that example is most likely
+* to be typed in. The entries here are a repository's metadata, the files
+* operating systems drop into any folder, and a licence: none of them is
+* something the scaffold writes (`init.test.ts` holds the template to that),
+* so tolerating them can never overwrite anything. Everything else is a
+* conflict and is named, never merged into.
+*/
+var SCAFFOLD_TOLERATED_ENTRIES = /* @__PURE__ */ new Set([
+	".git",
+	".hg",
+	".svn",
+	".gitattributes",
+	".DS_Store",
+	"Thumbs.db",
+	"desktop.ini",
+	"LICENSE",
+	"LICENSE.md",
+	"LICENSE.txt"
+]);
+/** Entries in `dir` the scaffold would overwrite or mix with — `[]` when it may proceed. */
+function scaffoldDirectoryConflicts(dir) {
+	if (!fs.existsSync(dir)) return [];
+	return fs.readdirSync(dir, { withFileTypes: true }).filter((entry) => !SCAFFOLD_TOLERATED_ENTRIES.has(entry.name)).map((entry) => entry.isDirectory() ? `${entry.name}/` : entry.name).sort();
+}
+/** The refusal for a directory that already holds files, with the two ways forward. */
+function scaffoldConflictMessage(projectName, displayPath, conflicts) {
+	const shown = conflicts.slice(0, 8).join(", ") + (conflicts.length > 8 ? `, and ${conflicts.length - 8} more` : "");
+	return [
+		`${chalk.red.bold("ERROR")} Directory "${projectName}" already holds files a new project would overwrite or mix with: ${shown}`,
+		chalk.yellow(`  Scaffold somewhere new — ${chalk.cyan("rebase init <new-directory>")} — or move those out of ${displayPath || "this directory"} and run this again.`),
+		chalk.gray(`  A repository's own metadata (.git) and a LICENSE are fine to leave in place.`)
+	];
+}
+/**
+* `git init`, or nothing when the directory is already a repository.
+*
+* A cloned repository keeps its branch, its remote and its history: the
+* scaffold is committed on top of what is there. Only a repository this
+* function created is pointed at `main`.
+*/
+async function initGitRepository(targetDirectory) {
+	if (fs.existsSync(path.join(targetDirectory, ".git"))) {
+		console.log(chalk.gray("  Using the existing git repository..."));
+		return true;
+	}
+	console.log(chalk.gray("  Initializing git repository..."));
+	try {
+		await execa("git", ["init"], { cwd: targetDirectory });
+		try {
+			await execa("git", [
+				"symbolic-ref",
+				"HEAD",
+				"refs/heads/main"
+			], { cwd: targetDirectory });
+		} catch {}
+		return true;
+	} catch {
+		console.warn(chalk.yellow("  Warning: Failed to initialize git repository"));
+		return false;
+	}
+}
+async function createProject(options) {
+	const startedAt = Date.now();
+	const conflicts = scaffoldDirectoryConflicts(options.targetDirectory);
+	if (conflicts.length > 0) {
+		for (const line of scaffoldConflictMessage(options.projectName, formatCdTarget(process.cwd(), options.targetDirectory), conflicts)) console.error(line);
+		process.exit(1);
+	}
+	fs.mkdirSync(options.targetDirectory, { recursive: true });
+	try {
+		await access(options.templateDirectory, fs.constants.R_OK);
+	} catch {
+		console.error(`${chalk.red.bold("ERROR")} Template not found at ${options.templateDirectory}`);
+		process.exit(1);
+	}
+	console.log(chalk.gray("  Copying project files..."));
+	try {
+		await cp(options.templateDirectory, options.targetDirectory, {
+			recursive: true,
+			filter: (source) => {
+				const basename = path.basename(source);
+				return basename !== "node_modules" && basename !== ".DS_Store";
+			}
+		});
+	} catch (err) {
+		console.error(`${chalk.red.bold("ERROR")} Failed to copy template files: ${err instanceof Error ? err.message : String(err)}`);
+		process.exit(1);
+	}
+	for (const [from, to] of [["gitignore", ".gitignore"], ["npmrc", ".npmrc"]]) {
+		const shipped = path.join(options.targetDirectory, from);
+		if (fs.existsSync(shipped)) fs.renameSync(shipped, path.join(options.targetDirectory, to));
+	}
+	if (options.headless && options.explicitPreset) console.log(chalk.yellow(`  Ignoring --template ${options.preset}: a headless project declares no collections.`));
+	if (!options.headless) {
+		if (options.introspect && options.preset !== "blank") console.log(chalk.gray("  Using the blank template: collections will come from your database."));
+		const applied = await applyPreset(options.targetDirectory, options.introspect ? "blank" : options.preset);
+		writeShippedSchema(options.targetDirectory, applied);
+	}
+	await applyHeadless(options.targetDirectory, options.headless);
+	await replacePlaceholders(options);
+	await configureEnvFile(options.targetDirectory, options.databaseUrl);
+	await writeProjectPackageManagerIntoManifest(options.targetDirectory, options.pmCommands);
+	retargetScaffoldMcpConfig(options.targetDirectory, options.pm);
+	if (options.agents.length > 0) {
+		console.log(chalk.gray("  Setting up AI coding agents..."));
+		printAgentSetup(configureAgents(options.agents, options.targetDirectory, void 0, options.pm), options.pm);
+	}
+	const gitInitialized = options.git ? await initGitRepository(options.targetDirectory) : false;
+	const { pm, pmCommands } = options;
+	const installCmd = pmCommands.install;
+	const execCmd = pmCommands.exec("rebase", [
+		"schema",
+		"introspect",
+		"--force"
+	]);
+	const generateCmd = pmCommands.exec("rebase", ["schema", "generate"]);
+	let installed = false;
+	if (options.installDeps) {
+		console.log("");
+		console.log(chalk.gray(`  Installing dependencies with ${pm}...`));
+		console.log("");
+		try {
+			await execa(installCmd[0], installCmd.slice(1), {
+				cwd: options.targetDirectory,
+				stdio: "inherit"
+			});
+			installed = true;
+		} catch {
+			console.warn(chalk.yellow(`  Warning: Failed to install dependencies. You may need to run \`${installCmd.join(" ")}\` manually.`));
+		}
+	}
+	let introspected = false;
+	if (options.introspect) {
+		console.log("");
+		if (options.installDeps) {
+			console.log(chalk.gray("  Introspecting database and generating collections..."));
+			console.log("");
+			try {
+				await execa(execCmd[0], execCmd.slice(1), {
+					cwd: options.targetDirectory,
+					stdio: "inherit"
+				});
+				await execa(generateCmd[0], generateCmd.slice(1), {
+					cwd: options.targetDirectory,
+					stdio: "inherit"
+				});
+				console.log(chalk.green("  Database successfully introspected!"));
+				introspected = true;
+			} catch {
+				console.warn(chalk.yellow("  Warning: Failed to introspect database automatically."));
+				console.warn(chalk.yellow(`  You can run \`${execCmd.join(" ")}\` then \`${generateCmd.join(" ")}\` manually after setup.`));
+			}
+		} else {
+			console.warn(chalk.yellow("  Skipping introspection because dependencies were not installed."));
+			console.warn(chalk.yellow(`  Run \`${installCmd.join(" ")}\` then \`${execCmd.join(" ")}\` manually.`));
+		}
+	}
+	if (gitInitialized) await commitScaffold(options.targetDirectory);
+	await linkScaffoldToCloud(options);
+	console.log("");
+	console.log(`${chalk.green.bold("✓")} Project ${chalk.bold(options.projectName)} created successfully!`);
+	console.log("");
+	console.log(chalk.bold("Next steps:"));
+	console.log("");
+	const nextSteps = initNextSteps({
+		headless: options.headless,
+		ownDatabase: Boolean(options.databaseUrl),
+		introspect: Boolean(options.introspect),
+		introspected,
+		installed,
+		cdTarget: formatCdTarget(process.cwd(), options.targetDirectory),
+		pm: pmCommands
+	});
+	for (const line of nextSteps) console.log(line);
+	console.log("");
+	console.log(chalk.gray("Docs: https://rebase.pro/docs"));
+	console.log(chalk.gray("GitHub: https://github.com/rebasepro/rebase"));
+	console.log("");
+	console.log(chalk.bold("🤖 AI Agent Skills"));
+	console.log("");
+	for (const line of agentNextSteps(options.agents, options.interactive === true, pmCommands)) console.log(line);
+	console.log("");
+	const initProperties = {
+		preset: options.headless ? "none" : options.preset,
+		headless: Boolean(options.headless),
+		package_manager: options.pm,
+		installed_deps: Boolean(options.installDeps),
+		introspected,
+		own_database: Boolean(options.databaseUrl),
+		cloud_linked: Boolean(options.cloudProject),
+		git: Boolean(options.git),
+		duration: durationBucket(Date.now() - startedAt)
+	};
+	if (await promptForConsent({ reAskDeclined: true })) await recordEvent("cli.init", initProperties, { projectRoot: options.targetDirectory });
+}
+/**
+* Apply a template preset by replacing the default collection files.
+*
+* The template ships with blog collections at the top level and
+* preset alternatives under `config/collections/presets/<name>/`.
+* This function swaps the active collection files and removes the
+* presets directory so the final project is clean.
+*/
+/**
+* Reduce the scaffolded project to the chosen shape.
+*
+* The base template is the full triad. `--headless` drops the frontend and the
+* declared collections — there is nothing to define, since the server derives
+* its API from the database — and overlays the files that differ.
+*
+* The config *package* stays, holding only `storageAuthorize`. Storage is not
+* under row-level security, so a deployment with file storage enabled and no
+* access model serves every user's files to every signed-in user; the server
+* refuses to boot in that state. Deleting the package outright would leave a
+* headless project with nowhere to put the hook, and the scaffold's own
+* docker-compose.yml enables storage — so the first `docker compose up` would
+* crash-loop.
+*/
+async function applyHeadless(targetDirectory, headless) {
+	if (!headless) return;
+	fs.rmSync(path.join(targetDirectory, "frontend"), {
+		recursive: true,
+		force: true
+	});
+	fs.rmSync(path.join(targetDirectory, "config", "collections"), {
+		recursive: true,
+		force: true
+	});
+	for (const stray of ["cms.d.ts", "frontend-assets.d.ts"]) fs.rmSync(path.join(targetDirectory, "config", stray), { force: true });
+	fs.rmSync(path.join(targetDirectory, "backend", "src", "schema.generated.ts"), { force: true });
+	const overlayDir = path.resolve(cliRoot, "templates", "overlays", "baas");
+	if (!fs.existsSync(overlayDir)) {
+		console.error(`${chalk.red.bold("ERROR")} BaaS template overlay not found at ${overlayDir}`);
+		process.exit(1);
+	}
+	await cp(overlayDir, targetDirectory, {
+		recursive: true,
+		force: true,
+		filter: (source) => {
+			const basename = path.basename(source);
+			return basename !== "node_modules" && basename !== ".DS_Store";
+		}
+	});
+}
+/**
+* Rewrite `rebase.json`'s static-app build command for this project's package manager.
+*
+* The template must spell one of them, and it spells npm. In a pnpm project
+* that is a second package manager invoked against a lockfile it did not
+* write — `rebase build` then either installs a second tree or fails on a
+* workspace flag npm and pnpm spell differently.
+*/
+async function writeProjectPackageManagerIntoManifest(targetDirectory, pmCommands) {
+	const manifestPath = path.join(targetDirectory, "rebase.json");
+	if (!fs.existsSync(manifestPath)) return;
+	try {
+		const manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+		let changed = false;
+		for (const app of Object.values(manifest.apps ?? {})) {
+			if (app.type !== "static" || !app.root || !app.build) continue;
+			const rewritten = pmCommands.runWorkspace(app.root, "build").join(" ");
+			if (rewritten !== app.build) {
+				app.build = rewritten;
+				changed = true;
+			}
+		}
+		if (changed) fs.writeFileSync(manifestPath, `${JSON.stringify(manifest, null, 4)}\n`, "utf8");
+	} catch {}
+}
+/** Swap in the preset's collection files. Returns the preset actually applied. */
+async function applyPreset(targetDirectory, preset) {
+	const collectionsDir = path.join(targetDirectory, "config", "collections");
+	const presetsDir = path.join(collectionsDir, "presets");
+	if (preset !== "blog") {
+		const presetDir = path.join(presetsDir, preset);
+		if (!fs.existsSync(presetDir)) {
+			console.warn(chalk.yellow(`  Warning: Preset "${preset}" not found, falling back to blog template.`));
+			cleanupPresets(presetsDir);
+			return "blog";
+		}
+		for (const file of [
+			"posts.ts",
+			"authors.ts",
+			"tags.ts",
+			"index.ts"
+		]) {
+			const filePath = path.join(collectionsDir, file);
+			if (fs.existsSync(filePath)) fs.unlinkSync(filePath);
+		}
+		const presetFiles = fs.readdirSync(presetDir).filter((f) => f.endsWith(".ts"));
+		for (const file of presetFiles) fs.copyFileSync(path.join(presetDir, file), path.join(collectionsDir, file));
+	}
+	cleanupPresets(presetsDir);
+	return preset;
+}
+/**
+* Where the generated Drizzle schema for each preset ships, beside the template.
+*
+* `rebase dev` regenerates `backend/src/schema.generated.ts` on every start, and
+* the Studio's schema editor refuses to commit over a dirty copy of it — a
+* schema change must not sweep up somebody's work in progress. So whatever
+* `init` writes there, and commits under `--git`, has to be byte-for-byte what
+* that first regeneration produces. A stub (`export const tables = {}`) was
+* rewritten on the first `rebase dev`, and every new project's first Studio
+* edit was refused with `SCHEMA_EDIT_DIRTY_TREE` before its owner had changed
+* a thing.
+*
+* The file cannot be generated here: generation loads the collection files,
+* and they import `@rebasepro/cms-types`, which the project does not have
+* until it is installed — `init --git` without `--install` commits first. So
+* each preset's output is generated in this repository and shipped, and
+* `init-generated-schema.test.ts` fails the moment one of them differs from
+* what the generator writes for that preset's collections.
+*
+* Outside `templates/template` on purpose: a preset's schema must not be
+* copied into a project that chose another preset.
+*/
+function shippedSchemaPath(preset) {
+	return path.resolve(cliRoot, "templates", "generated-schemas", `${preset}.ts`);
+}
+/** Write the preset's generated schema to `backend/src/schema.generated.ts`. */
+function writeShippedSchema(targetDirectory, preset) {
+	const destination = path.join(targetDirectory, "backend", "src", "schema.generated.ts");
+	fs.mkdirSync(path.dirname(destination), { recursive: true });
+	fs.copyFileSync(shippedSchemaPath(preset), destination);
+}
+function cleanupPresets(presetsDir) {
+	if (fs.existsSync(presetsDir)) fs.rmSync(presetsDir, {
+		recursive: true,
+		force: true
+	});
+}
+/** The package the probe asks about. Not the CLI: the CLI is what is running. */
+var RELEASE_PROBE_PACKAGE = "@rebasepro/server";
+async function probeRelease(version) {
+	try {
+		const { stdout } = await execa("npm", [
+			"view",
+			`${RELEASE_PROBE_PACKAGE}@${version}`,
+			"version"
+		]);
+		if (stdout.trim() === version) return { kind: "published" };
+		return {
+			kind: "gap",
+			found: stdout.trim() || "nothing"
+		};
+	} catch (error) {
+		const text = `${error.stderr ?? ""}${error.message ?? ""}`;
+		if (/E404|404 Not Found|No match(ing)? version/i.test(text)) return {
+			kind: "gap",
+			found: "nothing"
+		};
+		return {
+			kind: "unreachable",
+			reason: firstLine(text) || "the registry could not be reached"
+		};
+	}
+}
+function firstLine(text) {
+	return text.split("\n").map((l) => l.trim()).filter(Boolean)[0] ?? "";
+}
+async function replacePlaceholders(options) {
+	const filesToProcess = TEMPLATE_PLACEHOLDER_FILES;
+	const version = cliVersion();
+	const fileContents = /* @__PURE__ */ new Map();
+	const allPackages = /* @__PURE__ */ new Set();
+	for (const file of filesToProcess) {
+		const fullPath = path.resolve(options.targetDirectory, file);
+		if (!fs.existsSync(fullPath)) continue;
+		const content = fs.readFileSync(fullPath, "utf-8");
+		fileContents.set(fullPath, content);
+		const matches = [...content.matchAll(/"(@rebasepro\/[^"]+)":\s*"workspace:\*"/g)];
+		for (const match of matches) allPackages.add(match[1]);
+	}
+	const probe = parseEnvBoolean(process.env.REBASE_E2E) === true || version === "unknown" ? { kind: "published" } : await probeRelease(version);
+	if (probe.kind === "gap") throw new Error(`Rebase ${version} is not fully published to npm.\n\n${RELEASE_PROBE_PACKAGE} has no ${version} release — the registry has ${probe.found}.\nEvery @rebasepro package ships at one version, so scaffolding would pin ${allPackages.size}\ndependencies at a version that is not there, and the install would fail.\n\nThat is a release gap in Rebase itself — not a problem with your machine,
+your network, or your package manager.
+
+Stopped before writing dependency versions or installing anything. The
+project directory ${path.basename(options.targetDirectory)}/ was created and is safe to delete.\nPlease report this.`);
+	if (probe.kind === "published") console.log(chalk.gray(`  Pinning ${allPackages.size} @rebasepro package(s) to ${version}...`));
+	if (probe.kind === "unreachable") {
+		console.log(chalk.gray(`  Pinning @rebasepro packages to ${version} (this CLI's version).`));
+		console.log(chalk.yellow(`  Could not reach npm to confirm the release: ${probe.reason}`));
+		console.log(chalk.gray("  The pin is right either way — install will say so if the version is missing."));
+	}
+	for (const [fullPath, originalContent] of fileContents.entries()) {
+		let content = originalContent.replace(/\{\{PROJECT_NAME\}\}/g, options.projectName);
+		for (const pkgName of allPackages) content = content.replace(new RegExp(`"${pkgName}":\\s*"workspace:\\*"`, "g"), `"${pkgName}": "${version}"`);
+		fs.writeFileSync(fullPath, content, "utf-8");
+	}
+}
+/** `undefined` binds the wildcard address, which is a different question — see isPortAvailable. */
+function canBind(port, host) {
+	return new Promise((resolve) => {
+		const server = net.createServer();
+		server.once("error", (err) => {
+			resolve(err.code === "EAFNOSUPPORT" || err.code === "EADDRNOTAVAIL");
+		});
+		server.once("listening", () => {
+			server.close(() => resolve(true));
+		});
+		if (host === void 0) server.listen(port);
+		else server.listen(port, host);
+	});
+}
+/**
+* Whether `port` is free — on the wildcard address *and* on both loopback addresses.
+*
+* All three, because on macOS/BSD a successful bind does not mean the port is
+* unused. Sockets carry `SO_REUSEADDR` (Node sets it), under which a wildcard
+* bind and a specific-address bind on the same port do not conflict — in either
+* direction. So each probe alone has a blind spot, and they are different ones:
+*
+* - **Wildcard only** (what this used to do) misses a server bound to
+*   `127.0.0.1` and `[::1]` — a Homebrew or Postgres.app install, i.e. most
+*   developer machines. 5432 was reported free while it was already serving
+*   another project's database. Docker then published `*:5432` for the same
+*   reason and the container started cleanly, with no "port already allocated"
+*   error anywhere to hint at the collision. `DATABASE_URL` pointed at
+*   `localhost:5432`, `localhost` resolves to `::1` first, and every command
+*   reported success while reading and writing the *pre-existing* database — a
+*   `db push` would have created tables, roles and RLS policies inside it.
+*
+* - **Loopback only** misses the opposite case: Docker Desktop publishes a
+*   container's port on `*`, and a specific-address bind succeeds right past it.
+*   That port is free to probe and unusable to publish, so `docker compose up -d
+*   db` fails on "Bind for 0.0.0.0:PORT failed: port is already allocated" —
+*   loudly, but only after the project has been generated around the bad port.
+*
+* Requiring all three costs three sockets and leaves neither gap. The wildcard
+* bind is the one the container itself has to make; the loopback binds are the
+* addresses `DATABASE_URL` will actually name.
+*/
+async function isPortAvailable(port) {
+	return await canBind(port) && await canBind(port, "127.0.0.1") && await canBind(port, "::1");
+}
+async function findAvailablePort(startPort) {
+	let port = startPort;
+	while (!await isPortAvailable(port)) port++;
+	return port;
+}
+/**
+* The CLI's own version, which is the runtime image tag a scaffolded project
+* pins. They move together: the CLI, the packages and the runtime image are cut
+* from one release, so the version that installed the project is the version
+* whose runtime can boot its bundle.
+*
+* Falls back to `latest` only when the CLI cannot read its own manifest — a
+* floating tag is worse than a pinned one, but better than a compose file that
+* names a version that was never published.
+*/
+function readCliVersion() {
+	const version = cliVersion();
+	return version === "unknown" ? "latest" : version;
+}
+/**
+* The runtime image tag to pin, given the version of the CLI doing the scaffolding.
+*
+* Only a stable release publishes `rebasepro/server` — a multi-arch build on
+* every push to main would cost minutes per commit for an image nobody pulls.
+* So pinning a prerelease CLI's own version writes a tag that cannot exist, and
+* `docker compose up` fails on `manifest unknown`, which is the same dead end
+* as the missing-repository bug this pinning was added to prevent.
+*
+* A prerelease therefore falls back to `latest`, which is correct rather than
+* merely available: a bundle's manifest declares the runtime range it needs
+* (`^1`), the image supplies only `@rebasepro/server`, and the framework a
+* bundle runs is installed from its own `deps.declared` at boot. The current
+* stable runtime boots a canary bundle by design.
+*
+* A floating tag is a real cost — it is what pinning exists to avoid — so say
+* so in the file rather than leaving a reader to discover it.
+*/
+function resolveRuntimeImageTag(cliVersion) {
+	if (/^\d+\.\d+\.\d+-/.test(cliVersion)) return {
+		tag: "latest",
+		note: `# Scaffolded by a prerelease CLI (${cliVersion}), which publishes no runtime image,\n# so this floats to the newest stable runtime. Pin an exact version once you
+# deploy: a moving tag changes what you are running with no version changing.`
+	};
+	return { tag: cliVersion };
+}
+/**
+* Set `KEY=value` in a .env body, whether the key ships set, commented out or
+* missing entirely.
+*
+* The missing case is not hypothetical: `configureEnvFile` runs against
+* whatever `.env.example` is in the target directory, which for a project
+* scaffolded from an older template — or from one somebody edited — may not
+* carry a key this version of `init` is expected to write. Silently skipping it
+* produces a `.env` that satisfies no `${VAR:?…}` in the compose file, which
+* surfaces as a stack that refuses to interpolate rather than as anything
+* pointing back here.
+*/
+function setEnvValue(content, key, value, header) {
+	const line = new RegExp(`^#?\\s*${key}=.*$`, "m");
+	if (line.test(content)) return content.replace(line, `${key}=${value}`);
+	return `${content.trimEnd()}\n\n${header ? `${header}\n` : ""}${key}=${value}\n`;
+}
+async function configureEnvFile(targetDirectory, databaseUrl) {
+	const envExamplePath = path.join(targetDirectory, ".env.example");
+	const envPath = path.join(targetDirectory, ".env");
+	if (fs.existsSync(envExamplePath) && !fs.existsSync(envPath)) {
+		fs.copyFileSync(envExamplePath, envPath);
+		fs.chmodSync(envPath, 384);
+		const jwtSecret = crypto.randomBytes(32).toString("hex");
+		const dbPassword = crypto.randomBytes(16).toString("hex");
+		const serviceKey = crypto.randomBytes(48).toString("base64");
+		const adminPassword = crypto.randomBytes(18).toString("base64url");
+		let envContent = fs.readFileSync(envPath, "utf-8");
+		envContent = envContent.replace(/^(# ║ {2})(Copy this file to \.env and fill in the values)( +║)$/m, (_match, open, old, close) => {
+			const replacement = "Generated by `rebase init` — the secrets below are already set";
+			const width = old.length + close.length - 1;
+			return open + replacement.slice(0, width).padEnd(width, " ") + "║";
+		});
+		envContent = envContent.replace(/^JWT_SECRET=.*$/m, `JWT_SECRET=${jwtSecret}`);
+		envContent = envContent.replace(/^#\s*REBASE_SERVICE_KEY=.*$/m, `REBASE_SERVICE_KEY=${serviceKey}`);
+		const composeApiPort = /^PORT=(\d+)/m.exec(envContent)?.[1] ?? "3001";
+		envContent = envContent.replace(/^#\s*CORS_ORIGINS=.*$/m, `CORS_ORIGINS=http://localhost:${composeApiPort}`);
+		envContent = setEnvValue(envContent, "REBASE_ADMIN_EMAIL", "admin@example.com", "# ── The first admin account, in production only ──────────────────────\n# `rebase dev` ignores both of these: on a laptop the first account to\n# register becomes the admin, and it says so at boot. In production —\n# `docker compose up`, or anything with NODE_ENV=production — that\n# window is shut, because the server answers on a hostname before you\n# have typed anything. So the operator names the account here instead.\n# Created once, while the user table is empty. Change the email to\n# yours, sign in, and change the password below.");
+		envContent = setEnvValue(envContent, "REBASE_ADMIN_PASSWORD", adminPassword);
+		envContent = envContent.replace(/^#?\s*VITE_API_URL=.*$/m, "VITE_API_URL=");
+		const { tag: runtimeVersion, note } = resolveRuntimeImageTag(readCliVersion());
+		const pinned = `${note ? `${note}\n` : ""}REBASE_VERSION=${runtimeVersion}`;
+		envContent = /^#?\s*REBASE_VERSION=.*$/m.test(envContent) ? envContent.replace(/^#?\s*REBASE_VERSION=.*$/m, pinned) : `${envContent.trimEnd()}\n\n# The Rebase runtime image tag docker-compose.yml pulls.\n# Change this and restart to upgrade; your project bundle is untouched.\n${pinned}\n`;
+		if (databaseUrl) {
+			if (/[\r\n]/.test(databaseUrl)) throw new Error("Invalid DATABASE_URL: multiline values are not allowed.");
+			const { pinSearchPath } = await import("@rebasepro/server-postgres");
+			const pinnedUrl = pinSearchPath(databaseUrl);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, () => `DATABASE_URL=${pinnedUrl}\nDATABASE_PASSWORD=${dbPassword}`);
+		} else {
+			const dbPort = await findAvailablePort(5432);
+			envContent = envContent.replace(/^DATABASE_URL=.*$/m, [
+				"# Commented out on purpose — that is what selects the managed database.",
+				"# To use the docker-compose Postgres this project ships instead:",
+				"#   docker compose up -d db, then uncomment the line below.",
+				`# DATABASE_URL=postgresql://rebase_app:${dbPassword}@127.0.0.1:${dbPort}/rebase?options=-c%20search_path%3Dpublic&sslmode=disable`,
+				`DATABASE_PASSWORD=${dbPassword}`
+			].join("\n"));
+			const envExampleReference = path.join(targetDirectory, ".env.example");
+			if (fs.existsSync(envExampleReference)) {
+				let exampleContent = fs.readFileSync(envExampleReference, "utf-8");
+				exampleContent = exampleContent.replace(/^DATABASE_URL=postgresql:\/\/[^\n]*$/m, [
+					"# Commented out on purpose — that is what selects the managed database.",
+					"# To use the docker-compose Postgres this project ships instead:",
+					"#   docker compose up -d db, then uncomment the line below in .env",
+					"#   (with DATABASE_PASSWORD from that file, not the placeholder here).",
+					`# DATABASE_URL=postgresql://rebase_app:changeme@127.0.0.1:${dbPort}/rebase?options=-c%20search_path%3Dpublic&sslmode=disable`
+				].join("\n"));
+				exampleContent = exampleContent.replaceAll("@localhost:5432/rebase", `@127.0.0.1:${dbPort}/rebase`);
+				fs.writeFileSync(envExampleReference, exampleContent, "utf-8");
+			}
+			const dockerComposePath = path.join(targetDirectory, "docker-compose.yml");
+			if (fs.existsSync(dockerComposePath)) {
+				let dockerComposeContent = fs.readFileSync(dockerComposePath, "utf-8");
+				dockerComposeContent = dockerComposeContent.replace(/-\s*"5432:5432"/g, `- "${dbPort}:5432"`);
+				fs.writeFileSync(dockerComposePath, dockerComposeContent, "utf-8");
+			}
+		}
+		fs.writeFileSync(envPath, envContent, {
+			encoding: "utf-8",
+			mode: 384
+		});
+		fs.chmodSync(envPath, 384);
+	}
+}
+//#endregion
+export { createRebaseApp };
+
+//# sourceMappingURL=init-Utstvh2Q.js.map