@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/auth-aySHEF45.js

@@ -0,0 +1,414 @@
+import { d as readEnvFile, f as requireBackendDir, g as resolveTsx, o as findEnvFile, p as requireProjectRoot, r as exitDependenciesNotInstalled } from "./project-Wp2zoyeN.js";
+import { n as parseCommandArgs, r as wantsHelp } from "./args-BnmsEXvu.js";
+import { t as unknownCommand } from "./unknown-command-DNwDcX3w.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import { spawn } from "child_process";
+import { randomBytes } from "node:crypto";
+//#region src/commands/auth.ts
+/**
+* CLI command: rebase auth <action>
+*
+* Subcommands:
+*   reset-password — Reset a user's password
+*/
+/** The backend was reached and refused: not a reason to fall back to the database. */
+var ApiAnswered = class extends Error {};
+/** Everything the switch below dispatches, for the did-you-mean. */
+var AUTH_SUBCOMMANDS = ["reset-password"];
+/**
+* Pick the user with exactly this email out of a search response.
+*
+* `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display
+* name**, ordered by role count descending. This used to take row `[0]` and
+* reset it, then print the email it had been *given* as confirmation — so two
+* ordinary situations ended in a successful-looking reset of somebody else's
+* account:
+*
+*   - a substring collision: `bob@example.com` also matches
+*     `robert.bob@example.com`;
+*   - a display name, which is user-controlled and accepted up to 255
+*     characters with no constraint on its content, containing an address
+*     belonging to someone else.
+*
+* The ordering makes it worse rather than better — `array_length(roles) DESC
+* NULLS LAST` puts the most privileged match first, so the account most likely
+* to be reset by mistake is an admin's.
+*
+* Returns `undefined` when nothing matched exactly, which the caller reports
+* rather than falling through to a guess. The direct-database fallback below
+* has always matched with `eq(usersTable.email, email)`; this is the same
+* definition, so the command no longer resets different accounts depending on
+* whether the backend happened to be running.
+*/
+function selectUserForEmail(payload, email) {
+	const wanted = email.trim().toLowerCase();
+	if (!wanted) return void 0;
+	const rows = Array.isArray(payload) ? payload : payload && typeof payload === "object" && Array.isArray(payload.users) ? payload.users : [];
+	for (const row of rows) {
+		if (!row || typeof row !== "object") continue;
+		const record = row;
+		const rowEmail = typeof record.email === "string" ? record.email.trim().toLowerCase() : void 0;
+		if (!rowEmail || rowEmail !== wanted) continue;
+		const id = typeof record.id === "string" ? record.id : typeof record.uid === "string" ? record.uid : void 0;
+		if (!id) continue;
+		return {
+			id,
+			email: record.email
+		};
+	}
+}
+async function authCommand(subcommand, rawArgs) {
+	if (!subcommand || subcommand === "--help" || wantsHelp(rawArgs)) {
+		printAuthHelp();
+		return;
+	}
+	switch (subcommand) {
+		case "reset-password":
+			await resetPassword(rawArgs);
+			break;
+		default: unknownCommand(subcommand, AUTH_SUBCOMMANDS, "auth");
+	}
+}
+/**
+* The flags `rebase auth reset-password` takes.
+*
+* `-p` was advertised in this command's own help and never declared here, so
+* `arg` — running permissively — pushed it into the positionals and the value
+* *after* it shifted out of reach: anyone following the help set the account's
+* password to the two-character string `-p`. Declared now, and `auth.test.ts`
+* asserts that the help and this spec list the same aliases.
+*/
+var RESET_PASSWORD_FLAGS = {
+	"--email": String,
+	"--password": String,
+	"-e": "--email",
+	"-p": "--password"
+};
+/**
+* Which account, and which password, this invocation names.
+*
+* Both may still be absent — the caller reports a missing email — but neither
+* can be a flag. `parseCommandArgs` parses the whole line strictly, so an
+* undeclared flag is an error rather than a positional. That is what stops
+* `rebase auth reset-password bob@example.com --debug` from setting Bob's
+* password to `--debug`, which is the flag the CLI itself prints after every
+* failure as the thing to re-run with.
+*
+* Exported so its tests can drive the real parser rather than a copy of it.
+*/
+function resolveResetPasswordArgs(rawArgs) {
+	const { flags, positionals } = parseCommandArgs({
+		spec: RESET_PASSWORD_FLAGS,
+		rawArgs,
+		commandWords: 2,
+		command: "auth reset-password",
+		maxPositionals: 2
+	});
+	return {
+		email: flags["--email"] || positionals[0],
+		password: flags["--password"] || positionals[1]
+	};
+}
+/**
+* A password for a reset that was not given one.
+*
+* This used to be a constant, and `--help` printed it as the default. Reset is
+* the documented way back into an account nobody can sign in to — an admin,
+* usually — so the recovery path set every such account to a fixed string that
+* ships inside a public repository and a published npm package, and left it
+* there until somebody remembered to change it.
+*
+* base64url of 18 random bytes: 24 characters, ~144 bits, no shell-quoting
+* hazard, and nothing that reads like a placeholder somebody might keep.
+*/
+function generatePassword() {
+	return randomBytes(18).toString("base64url");
+}
+/**
+* What a refusing backend said, from its `{ error: { message, code } }` body.
+*
+* The body used to be printed as it came, so a weak password read
+* `{"error":{"message":"…","code":"…"}}`. A body that is not the envelope is
+* still shown, since it is the only account of the refusal there is.
+*/
+async function refusalReason(response) {
+	const text = await response.text().catch(() => "");
+	try {
+		const parsed = JSON.parse(text);
+		const error = parsed && typeof parsed === "object" && "error" in parsed ? parsed.error : void 0;
+		if (error && typeof error === "object" && "message" in error && typeof error.message === "string") {
+			const code = "code" in error && typeof error.code === "string" ? ` (${error.code})` : "";
+			return `${error.message}${code}`;
+		}
+	} catch {}
+	return text.trim() || `${response.status} ${response.statusText}`.trim();
+}
+async function resetPassword(rawArgs) {
+	const { email, password: providedPassword } = resolveResetPasswordArgs(rawArgs);
+	const wasGenerated = !providedPassword;
+	const newPassword = providedPassword || generatePassword();
+	if (!email) {
+		console.error(chalk.red("✗ Email is required."));
+		console.log("");
+		console.log(chalk.gray("  Usage: rebase auth reset-password <email> [new-password]"));
+		console.log(chalk.gray("         rebase auth reset-password --email user@example.com --password NewPass123!"));
+		process.exit(1);
+	}
+	const projectRoot = requireProjectRoot();
+	const envFile = findEnvFile(projectRoot);
+	const envServiceKey = readEnvFile(projectRoot).REBASE_SERVICE_KEY;
+	let baseUrl = process.env.REBASE_BASE_URL;
+	let serviceKey = process.env.REBASE_SERVICE_KEY || envServiceKey;
+	const statePath = path.join(projectRoot, ".rebase", "state.json");
+	if (fs.existsSync(statePath)) try {
+		const state = JSON.parse(fs.readFileSync(statePath, "utf8"));
+		if (state && typeof state === "object") {
+			if (typeof state.baseUrl === "string" && !baseUrl) baseUrl = state.baseUrl;
+			if (typeof state.serviceKey === "string" && !serviceKey) serviceKey = state.serviceKey;
+		}
+	} catch {}
+	const devUrlPath = path.join(projectRoot, ".rebase-dev-url");
+	if (fs.existsSync(devUrlPath) && !baseUrl) try {
+		baseUrl = fs.readFileSync(devUrlPath, "utf8").trim();
+	} catch {}
+	if (baseUrl && serviceKey) {
+		console.log("Trying API-first reset via running backend...");
+		try {
+			const finalPass = newPassword;
+			const cleanBaseUrl = baseUrl.replace(/\/+$/, "");
+			const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=50`;
+			const searchRes = await fetch(searchUrl, { headers: {
+				"Authorization": `Bearer ${serviceKey}`,
+				"Accept": "application/json"
+			} });
+			if (!searchRes.ok) throw new ApiAnswered(`Failed to list users: ${searchRes.status} ${searchRes.statusText}`);
+			const searchData = await searchRes.json();
+			if (!searchData || typeof searchData !== "object") throw new Error("Invalid response format from user search API.");
+			const matched = selectUserForEmail(searchData, email);
+			if (!matched) throw new ApiAnswered(`No user has the email ${email}.`);
+			const resetUrl = `${cleanBaseUrl}/api/admin/users/${matched.id}/reset-password`;
+			const resetRes = await fetch(resetUrl, {
+				method: "POST",
+				headers: {
+					"Authorization": `Bearer ${serviceKey}`,
+					"Content-Type": "application/json",
+					"Accept": "application/json"
+				},
+				body: JSON.stringify({ password: finalPass })
+			});
+			if (!resetRes.ok) throw new ApiAnswered(`Password reset refused: ${await refusalReason(resetRes)}`);
+			console.log("API reset successful.");
+			console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (via API)"));
+			console.log("");
+			console.log(`  ${chalk.gray("Email:")} ${matched.email}`);
+			console.log(`  ${chalk.gray("Password:")} ${wasGenerated ? finalPass : "*".repeat(finalPass.length)}`);
+			console.log("");
+			return;
+		} catch (err) {
+			const errMsg = err instanceof Error ? err.message : String(err);
+			if (err instanceof ApiAnswered) {
+				console.error(chalk.red(`✗ ${errMsg}`));
+				process.exitCode = 1;
+				return;
+			}
+			console.warn(chalk.yellow("API reset failed, falling back to direct database update..."));
+			console.warn(chalk.gray(`  Details: ${errMsg}`));
+		}
+	}
+	const backendDir = requireBackendDir(projectRoot);
+	const tsxBin = resolveTsx(projectRoot);
+	if (!tsxBin) exitDependenciesNotInstalled(projectRoot);
+	try {
+		const env = { ...process.env };
+		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+		env.REBASE_RESET_EMAIL = email;
+		env.REBASE_RESET_PASSWORD = newPassword;
+		env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, ".env");
+		const { prepareDatabaseEnv } = await import("./prepare-CDN6lSpz.js");
+		const prepared = await prepareDatabaseEnv(projectRoot, { onProgress: (message) => console.log(chalk.gray(`  ${message}`)) });
+		Object.assign(env, prepared.env);
+		const scriptContent = resetPasswordScript(wasGenerated);
+		const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
+		fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
+		console.log("");
+		console.log(chalk.bold("  🔑 Rebase Auth — Reset Password (Direct DB Fallback)"));
+		console.log("");
+		console.log(`  ${chalk.gray("Email:")} ${email}`);
+		console.log(`  ${chalk.gray("Database:")} ${prepared.description}`);
+		if (!wasGenerated) console.log(`  ${chalk.gray("Password:")} ${"*".repeat(newPassword.length)}`);
+		console.log("");
+		const child = spawn(tsxBin, [tmpScriptPath], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+		const cleanup = () => {
+			try {
+				fs.unlinkSync(tmpScriptPath);
+			} catch {}
+		};
+		return new Promise((resolve) => {
+			child.on("error", (err) => {
+				cleanup();
+				console.error(chalk.red("✗ Could not run the reset script."));
+				console.error(chalk.gray(`  ${err.message}`));
+				process.exit(1);
+			});
+			child.on("close", (code) => {
+				cleanup();
+				if (code !== 0) process.exit(code ?? 1);
+				resolve();
+			});
+		});
+	} catch (err) {
+		console.error(chalk.red("✗ Direct database update failed."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
+}
+/**
+* The script the direct-database fallback runs under the project's own tsx, so
+* it resolves the project's `@rebasepro/server-postgres` and schema.
+*
+* It ends the account's sessions in the transaction that sets the password,
+* as every door through the API does (`replaceUserPassword`): the refresh
+* tokens and outstanding reset links go, and `tokens_valid_after` voids the
+* access tokens already handed out. An operator resetting a phished account
+* with the backend down is the case this exists for, and a reset that left the
+* attacker's refresh token minting access tokens did not recover anything.
+*
+* It exits 0 only when a row was updated: a missing user and a thrown error are
+* both exit 1. `echoPassword` prints the new password, for a generated one.
+*
+* Exported so its tests can run it.
+*/
+function resetPasswordScript(echoPassword) {
+	return `
+import { createPostgresDatabaseConnection } from "@rebasepro/server-postgres";
+import { hashPassword } from "@rebasepro/server";
+import { getTableConfig } from "drizzle-orm/pg-core";
+import * as dotenv from "dotenv";
+import path from "path";
+import fs from "fs";
+
+dotenv.config({ path: process.env.REBASE_ENV_FILE_PATH, quiet: true });
+
+// Lowercased, as every address is stored (\`normalizeEmail\`): matched as
+// typed, "Ops@Acme.test" found no row.
+const email = process.env.REBASE_RESET_EMAIL!.trim().toLowerCase();
+const newPassword = process.env.REBASE_RESET_PASSWORD!;
+
+const quote = (identifier: string) => '"' + identifier.replace(/"/g, '""') + '"';
+
+async function resetPassword() {
+    const { pool } = createPostgresDatabaseConnection(process.env.DATABASE_URL!);
+    const hash = await hashPassword(newPassword);
+
+    let usersTable;
+    try {
+        const schemaPath = path.resolve("./src/schema.generated.ts");
+        if (fs.existsSync(schemaPath)) {
+            const schema = await import("file://" + schemaPath);
+            usersTable = schema.users || schema.tables?.users;
+        }
+    } catch (e) {
+        // ignore and fallback
+    }
+
+    if (!usersTable) {
+        const pgServer = await import("@rebasepro/server-postgres");
+        usersTable = pgServer.users;
+    }
+
+    // The physical names, from the table object: the collection may map its
+    // properties to other columns, and the statements below are plain SQL.
+    const { name: tableName, schema: tableSchema } = getTableConfig(usersTable);
+    const usersSchema = tableSchema || "public";
+    const users = quote(usersSchema) + "." + quote(tableName);
+    const idColumn = quote(usersTable.id.name);
+    const emailColumn = quote(usersTable.email.name);
+    const passwordColumn = quote((usersTable.passwordHash ?? usersTable.password_hash).name);
+    // Where \`ensureAuthTablesExist\` puts the tables that hang off the users
+    // table: beside it, or in \`rebase\` when it lives in \`public\`.
+    const authSchema = usersSchema === "public" ? "rebase" : usersSchema;
+
+    const client = await pool.connect();
+    try {
+        await client.query("BEGIN");
+        const updated = await client.query(
+            "UPDATE " + users + " SET " + passwordColumn + " = $1 WHERE " + emailColumn + " = $2 " +
+            "RETURNING " + idColumn + " AS id, " + emailColumn + " AS email",
+            [hash, email]
+        );
+        if (updated.rows.length === 0) {
+            await client.query("ROLLBACK");
+            // Nothing was updated, so nothing was reset. Exiting 0 here reported
+            // success for a no-op, which is what a script would have believed.
+            console.error("✗ User not found: " + email);
+            process.exit(1);
+        }
+        const uid = updated.rows[0].id;
+
+        // A table or column the server has not created yet (it never booted
+        // against this database) holds no session to end.
+        const watermark = await client.query(
+            "SELECT 1 FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 AND column_name = 'tokens_valid_after'",
+            [usersSchema, tableName]
+        );
+        if (watermark.rows.length > 0) {
+            await client.query("UPDATE " + users + " SET tokens_valid_after = NOW() WHERE " + idColumn + " = $1", [uid]);
+        }
+        for (const table of ["refresh_tokens", "password_reset_tokens"]) {
+            const qualified = quote(authSchema) + "." + quote(table);
+            const present = await client.query("SELECT to_regclass($1) IS NOT NULL AS present", [qualified]);
+            if (present.rows[0]?.present) {
+                await client.query("DELETE FROM " + qualified + " WHERE uid = $1", [uid]);
+            }
+        }
+        await client.query("COMMIT");
+
+        console.log("✅ Password reset for: " + updated.rows[0].email);
+        console.log("   Every session of this account has ended.");
+        ${echoPassword ? "console.log(\"   Password: \" + newPassword);" : ""}
+        process.exit(0);
+    } catch (error) {
+        await client.query("ROLLBACK").catch(() => undefined);
+        throw error;
+    } finally {
+        client.release();
+    }
+}
+
+// A thrown error is a failed reset, and exits like one — a refused connection
+// that exits 0 reads as a reset to anything checking the exit code.
+resetPassword().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});
+`;
+}
+function printAuthHelp() {
+	console.log(`
+${chalk.bold("rebase auth")} — Authentication management commands
+
+${chalk.green.bold("Usage")}
+  rebase auth ${chalk.blue("<command>")} [options]
+
+${chalk.green.bold("Commands")}
+  ${chalk.blue.bold("reset-password")}    Reset a user's password
+
+${chalk.green.bold("reset-password Options")}
+  ${chalk.blue("--email, -e")}        User's email address
+  ${chalk.blue("--password, -p")}     New password (default: one is generated and printed)
+
+${chalk.green.bold("Examples")}
+  rebase auth reset-password user@example.com
+  rebase auth reset-password --email user@example.com --password MyNewPass!
+`);
+}
+//#endregion
+export { AUTH_SUBCOMMANDS, authCommand };
+
+//# sourceMappingURL=auth-aySHEF45.js.map

package/dist/auth-aySHEF45.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-aySHEF45.js","names":[],"sources":["../src/commands/auth.ts"],"sourcesContent":["/**\n * CLI command: rebase auth <action>\n *\n * Subcommands:\n *   reset-password — Reset a user's password\n */\nimport chalk from \"chalk\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport { spawn } from \"child_process\";\nimport { randomBytes } from \"node:crypto\";\nimport {\n    requireProjectRoot,\n    requireBackendDir,\n    findEnvFile,\n    readEnvFile,\n    resolveTsx,\n    exitDependenciesNotInstalled\n} from \"../utils/project\";\nimport { unknownCommand } from \"../utils/unknown-command\";\n\n/** The backend was reached and refused: not a reason to fall back to the database. */\nclass ApiAnswered extends Error {}\n\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const AUTH_SUBCOMMANDS = [\"reset-password\"] as const;\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\n\n/** A user as the admin API returns it, reduced to what this command needs. */\nexport interface ResolvedUser {\n    id: string;\n    email: string;\n}\n\n/**\n * Pick the user with exactly this email out of a search response.\n *\n * `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display\n * name**, ordered by role count descending. This used to take row `[0]` and\n * reset it, then print the email it had been *given* as confirmation — so two\n * ordinary situations ended in a successful-looking reset of somebody else's\n * account:\n *\n *   - a substring collision: `bob@example.com` also matches\n *     `robert.bob@example.com`;\n *   - a display name, which is user-controlled and accepted up to 255\n *     characters with no constraint on its content, containing an address\n *     belonging to someone else.\n *\n * The ordering makes it worse rather than better — `array_length(roles) DESC\n * NULLS LAST` puts the most privileged match first, so the account most likely\n * to be reset by mistake is an admin's.\n *\n * Returns `undefined` when nothing matched exactly, which the caller reports\n * rather than falling through to a guess. The direct-database fallback below\n * has always matched with `eq(usersTable.email, email)`; this is the same\n * definition, so the command no longer resets different accounts depending on\n * whether the backend happened to be running.\n */\nexport function selectUserForEmail(payload: unknown, email: string): ResolvedUser | undefined {\n    const wanted = email.trim().toLowerCase();\n    if (!wanted) return undefined;\n\n    const rows: unknown[] = Array.isArray(payload)\n        ? payload\n        : (payload && typeof payload === \"object\" && Array.isArray((payload as { users?: unknown }).users)\n            ? (payload as { users: unknown[] }).users\n            : []);\n\n    for (const row of rows) {\n        if (!row || typeof row !== \"object\") continue;\n        const record = row as Record<string, unknown>;\n        const rowEmail = typeof record.email === \"string\" ? record.email.trim().toLowerCase() : undefined;\n        if (!rowEmail || rowEmail !== wanted) continue;\n\n        const id = typeof record.id === \"string\"\n            ? record.id\n            : (typeof record.uid === \"string\" ? record.uid : undefined);\n        if (!id) continue;\n\n        return { id, email: record.email as string };\n    }\n\n    return undefined;\n}\n\nexport async function authCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    // `--help` is answered here and never reaches a handler. `cli.ts` only\n    // rewrites the subcommand to `\"--help\"` when no subcommand was named, so\n    // `rebase auth reset-password --help` used to *run the reset*: `--help`\n    // became the email, the backend was contacted, `.tmp-reset-password.ts` was\n    // written into the user's `backend/`, and a database UPDATE ran for a user\n    // named `--help`. A flag whose whole job is to print text cannot be allowed\n    // to reach code that writes.\n    if (!subcommand || subcommand === \"--help\" || wantsHelp(rawArgs)) {\n        printAuthHelp();\n        return;\n    }\n\n    switch (subcommand) {\n        case \"reset-password\":\n            await resetPassword(rawArgs);\n            break;\n        default:\n            unknownCommand(subcommand, AUTH_SUBCOMMANDS, \"auth\");\n    }\n}\n\n/**\n * The flags `rebase auth reset-password` takes.\n *\n * `-p` was advertised in this command's own help and never declared here, so\n * `arg` — running permissively — pushed it into the positionals and the value\n * *after* it shifted out of reach: anyone following the help set the account's\n * password to the two-character string `-p`. Declared now, and `auth.test.ts`\n * asserts that the help and this spec list the same aliases.\n */\nexport const RESET_PASSWORD_FLAGS = {\n    \"--email\": String,\n    \"--password\": String,\n    \"-e\": \"--email\",\n    \"-p\": \"--password\"\n} as const;\n\n/**\n * Which account, and which password, this invocation names.\n *\n * Both may still be absent — the caller reports a missing email — but neither\n * can be a flag. `parseCommandArgs` parses the whole line strictly, so an\n * undeclared flag is an error rather than a positional. That is what stops\n * `rebase auth reset-password bob@example.com --debug` from setting Bob's\n * password to `--debug`, which is the flag the CLI itself prints after every\n * failure as the thing to re-run with.\n *\n * Exported so its tests can drive the real parser rather than a copy of it.\n */\nexport function resolveResetPasswordArgs(rawArgs: string[]): {\n    email?: string;\n    password?: string;\n} {\n    const { flags, positionals } = parseCommandArgs({\n        spec: RESET_PASSWORD_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"auth reset-password\",\n        maxPositionals: 2\n    });\n\n    // Both spellings are supported: `<email> [password]` and `--email/--password`.\n    return {\n        email: flags[\"--email\"] || positionals[0],\n        password: flags[\"--password\"] || positionals[1]\n    };\n}\n\n/**\n * A password for a reset that was not given one.\n *\n * This used to be a constant, and `--help` printed it as the default. Reset is\n * the documented way back into an account nobody can sign in to — an admin,\n * usually — so the recovery path set every such account to a fixed string that\n * ships inside a public repository and a published npm package, and left it\n * there until somebody remembered to change it.\n *\n * base64url of 18 random bytes: 24 characters, ~144 bits, no shell-quoting\n * hazard, and nothing that reads like a placeholder somebody might keep.\n */\nexport function generatePassword(): string {\n    return randomBytes(18).toString(\"base64url\");\n}\n\n/**\n * What a refusing backend said, from its `{ error: { message, code } }` body.\n *\n * The body used to be printed as it came, so a weak password read\n * `{\"error\":{\"message\":\"…\",\"code\":\"…\"}}`. A body that is not the envelope is\n * still shown, since it is the only account of the refusal there is.\n */\nasync function refusalReason(response: Response): Promise<string> {\n    const text = await response.text().catch(() => \"\");\n    try {\n        const parsed: unknown = JSON.parse(text);\n        const error = parsed && typeof parsed === \"object\" && \"error\" in parsed ? parsed.error : undefined;\n        if (error && typeof error === \"object\" && \"message\" in error && typeof error.message === \"string\") {\n            const code = \"code\" in error && typeof error.code === \"string\" ? ` (${error.code})` : \"\";\n            return `${error.message}${code}`;\n        }\n    } catch {\n        // Not JSON: the text is the answer.\n    }\n    return text.trim() || `${response.status} ${response.statusText}`.trim();\n}\n\nasync function resetPassword(rawArgs: string[]): Promise<void> {\n    const { email, password: providedPassword } = resolveResetPasswordArgs(rawArgs);\n    // Generated once, so both reset paths set and report the same thing.\n    const wasGenerated = !providedPassword;\n    const newPassword = providedPassword || generatePassword();\n\n    if (!email) {\n        console.error(chalk.red(\"✗ Email is required.\"));\n        console.log(\"\");\n        console.log(chalk.gray(\"  Usage: rebase auth reset-password <email> [new-password]\"));\n        console.log(chalk.gray(\"         rebase auth reset-password --email user@example.com --password NewPass123!\"));\n        process.exit(1);\n    }\n\n    const projectRoot = requireProjectRoot();\n\n    // 1. Try API-first reset\n    // Was a single-key regex, which did not match `export REBASE_SERVICE_KEY=…`\n    // and kept a trailing `# comment` in the value. The command then fell\n    // through to the direct-database path as though no key were configured.\n    const envFile = findEnvFile(projectRoot);\n    const envServiceKey: string | undefined = readEnvFile(projectRoot).REBASE_SERVICE_KEY;\n\n    let baseUrl = process.env.REBASE_BASE_URL;\n    let serviceKey = process.env.REBASE_SERVICE_KEY || envServiceKey;\n\n    const statePath = path.join(projectRoot, \".rebase\", \"state.json\");\n    if (fs.existsSync(statePath)) {\n        try {\n            const state = JSON.parse(fs.readFileSync(statePath, \"utf8\")) as Record<string, unknown>;\n            if (state && typeof state === \"object\") {\n                if (typeof state.baseUrl === \"string\" && !baseUrl) {\n                    baseUrl = state.baseUrl;\n                }\n                if (typeof state.serviceKey === \"string\" && !serviceKey) {\n                    serviceKey = state.serviceKey;\n                }\n            }\n        } catch {\n            // Ignore\n        }\n    }\n\n    const devUrlPath = path.join(projectRoot, \".rebase-dev-url\");\n    if (fs.existsSync(devUrlPath) && !baseUrl) {\n        try {\n            baseUrl = fs.readFileSync(devUrlPath, \"utf8\").trim();\n        } catch {\n            // Ignore\n        }\n    }\n\n    if (baseUrl && serviceKey) {\n        console.log(\"Trying API-first reset via running backend...\");\n        try {\n            const finalPass = newPassword;\n            const cleanBaseUrl = baseUrl.replace(/\\/+$/, \"\");\n            // Not `limit=1`: the search is fuzzy and ordered by role count, so\n            // the exact match is not necessarily first — asking for one row can\n            // make it unreachable. Ask for a page, then match exactly.\n            const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=50`;\n            const searchRes = await fetch(searchUrl, {\n                headers: {\n                    \"Authorization\": `Bearer ${serviceKey}`,\n                    \"Accept\": \"application/json\"\n                }\n            });\n            if (!searchRes.ok) {\n                throw new ApiAnswered(`Failed to list users: ${searchRes.status} ${searchRes.statusText}`);\n            }\n            const searchData = await searchRes.json() as unknown;\n            if (!searchData || typeof searchData !== \"object\") {\n                throw new Error(\"Invalid response format from user search API.\");\n            }\n\n            const matched = selectUserForEmail(searchData, email);\n            if (!matched) {\n                throw new ApiAnswered(`No user has the email ${email}.`);\n            }\n\n            const resetUrl = `${cleanBaseUrl}/api/admin/users/${matched.id}/reset-password`;\n            const resetRes = await fetch(resetUrl, {\n                method: \"POST\",\n                headers: {\n                    \"Authorization\": `Bearer ${serviceKey}`,\n                    \"Content-Type\": \"application/json\",\n                    \"Accept\": \"application/json\"\n                },\n                body: JSON.stringify({ password: finalPass })\n            });\n\n            if (!resetRes.ok) {\n                throw new ApiAnswered(`Password reset refused: ${await refusalReason(resetRes)}`);\n            }\n\n            console.log(\"API reset successful.\");\n            console.log(chalk.bold(\"  🔑 Rebase Auth — Reset Password (via API)\"));\n            console.log(\"\");\n            // The address as stored, not as typed — they differ in case often\n            // enough that echoing the input hides which account was touched.\n            console.log(`  ${chalk.gray(\"Email:\")} ${matched.email}`);\n            // Echoed only when we invented it. A password the operator typed\n            // is already theirs; printing it again only adds scrollback.\n            console.log(`  ${chalk.gray(\"Password:\")} ${wasGenerated ? finalPass : \"*\".repeat(finalPass.length)}`);\n            console.log(\"\");\n            return;\n        } catch (err) {\n            const errMsg = err instanceof Error ? err.message : String(err);\n            // The backend answered and said no — a password too weak, a user\n            // it does not have. That answer stands: writing the hash straight\n            // into the database instead skipped the strength rule it had just\n            // applied, and ended no sessions. Only a backend that could not be\n            // reached is a reason to go round it.\n            if (err instanceof ApiAnswered) {\n                console.error(chalk.red(`✗ ${errMsg}`));\n                process.exitCode = 1;\n                return;\n            }\n            console.warn(chalk.yellow(\"API reset failed, falling back to direct database update...\"));\n            console.warn(chalk.gray(`  Details: ${errMsg}`));\n        }\n    }\n\n    // 2. Direct-DB Fallback\n    const backendDir = requireBackendDir(projectRoot);\n    const tsxBin = resolveTsx(projectRoot);\n\n    if (!tsxBin) {\n        exitDependenciesNotInstalled(projectRoot);\n    }\n\n    try {\n        const env: Record<string, string> = { ...process.env as Record<string, string> };\n        if (envFile) {\n            env.DOTENV_CONFIG_PATH = envFile;\n        }\n        env.REBASE_RESET_EMAIL = email;\n        env.REBASE_RESET_PASSWORD = newPassword;\n        env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, \".env\");\n\n        // The database the `db` family would use, resolved the same way. A\n        // stock scaffold leaves DATABASE_URL commented out and runs on the\n        // managed database, which only exists in a child's environment when\n        // something puts it there — without this the script connected with\n        // libpq's defaults, localhost:5432 as the OS user. An external\n        // DATABASE_URL adds nothing here: the child already reads it.\n        const { prepareDatabaseEnv } = await import(\"../dev-db/prepare\");\n        const prepared = await prepareDatabaseEnv(projectRoot, {\n            onProgress: (message) => console.log(chalk.gray(`  ${message}`))\n        });\n        Object.assign(env, prepared.env);\n\n        const scriptContent = resetPasswordScript(wasGenerated);\n\n        const tmpScriptPath = path.join(backendDir, \".tmp-reset-password.ts\");\n        fs.writeFileSync(tmpScriptPath, scriptContent, \"utf-8\");\n\n        console.log(\"\");\n        console.log(chalk.bold(\"  🔑 Rebase Auth — Reset Password (Direct DB Fallback)\"));\n        console.log(\"\");\n        console.log(`  ${chalk.gray(\"Email:\")} ${email}`);\n        console.log(`  ${chalk.gray(\"Database:\")} ${prepared.description}`);\n        if (!wasGenerated) {\n            console.log(`  ${chalk.gray(\"Password:\")} ${\"*\".repeat(newPassword.length)}`);\n        }\n        console.log(\"\");\n\n        const child = spawn(tsxBin, [tmpScriptPath], {\n            cwd: backendDir,\n            stdio: \"inherit\",\n            env\n        });\n\n        // The script is written into the user's backend directory, so every\n        // exit has to remove it. Without an `error` handler a failed spawn\n        // raises an unhandled event, the process dies before `close`, and\n        // `.tmp-reset-password.ts` is left behind to be committed.\n        const cleanup = () => {\n            try { fs.unlinkSync(tmpScriptPath); } catch { /* already gone */ }\n        };\n\n        return new Promise((resolve) => {\n            child.on(\"error\", (err) => {\n                cleanup();\n                console.error(chalk.red(\"✗ Could not run the reset script.\"));\n                console.error(chalk.gray(`  ${err.message}`));\n                process.exit(1);\n            });\n            child.on(\"close\", (code) => {\n                cleanup();\n                if (code !== 0) {\n                    process.exit(code ?? 1);\n                }\n                resolve();\n            });\n        });\n    } catch (err) {\n        console.error(chalk.red(\"✗ Direct database update failed.\"));\n        console.error(err instanceof Error ? err.message : String(err));\n        process.exit(1);\n    }\n}\n\n/**\n * The script the direct-database fallback runs under the project's own tsx, so\n * it resolves the project's `@rebasepro/server-postgres` and schema.\n *\n * It ends the account's sessions in the transaction that sets the password,\n * as every door through the API does (`replaceUserPassword`): the refresh\n * tokens and outstanding reset links go, and `tokens_valid_after` voids the\n * access tokens already handed out. An operator resetting a phished account\n * with the backend down is the case this exists for, and a reset that left the\n * attacker's refresh token minting access tokens did not recover anything.\n *\n * It exits 0 only when a row was updated: a missing user and a thrown error are\n * both exit 1. `echoPassword` prints the new password, for a generated one.\n *\n * Exported so its tests can run it.\n */\nexport function resetPasswordScript(echoPassword: boolean): string {\n    return `\nimport { createPostgresDatabaseConnection } from \"@rebasepro/server-postgres\";\nimport { hashPassword } from \"@rebasepro/server\";\nimport { getTableConfig } from \"drizzle-orm/pg-core\";\nimport * as dotenv from \"dotenv\";\nimport path from \"path\";\nimport fs from \"fs\";\n\ndotenv.config({ path: process.env.REBASE_ENV_FILE_PATH, quiet: true });\n\n// Lowercased, as every address is stored (\\`normalizeEmail\\`): matched as\n// typed, \"Ops@Acme.test\" found no row.\nconst email = process.env.REBASE_RESET_EMAIL!.trim().toLowerCase();\nconst newPassword = process.env.REBASE_RESET_PASSWORD!;\n\nconst quote = (identifier: string) => '\"' + identifier.replace(/\"/g, '\"\"') + '\"';\n\nasync function resetPassword() {\n    const { pool } = createPostgresDatabaseConnection(process.env.DATABASE_URL!);\n    const hash = await hashPassword(newPassword);\n\n    let usersTable;\n    try {\n        const schemaPath = path.resolve(\"./src/schema.generated.ts\");\n        if (fs.existsSync(schemaPath)) {\n            const schema = await import(\"file://\" + schemaPath);\n            usersTable = schema.users || schema.tables?.users;\n        }\n    } catch (e) {\n        // ignore and fallback\n    }\n\n    if (!usersTable) {\n        const pgServer = await import(\"@rebasepro/server-postgres\");\n        usersTable = pgServer.users;\n    }\n\n    // The physical names, from the table object: the collection may map its\n    // properties to other columns, and the statements below are plain SQL.\n    const { name: tableName, schema: tableSchema } = getTableConfig(usersTable);\n    const usersSchema = tableSchema || \"public\";\n    const users = quote(usersSchema) + \".\" + quote(tableName);\n    const idColumn = quote(usersTable.id.name);\n    const emailColumn = quote(usersTable.email.name);\n    const passwordColumn = quote((usersTable.passwordHash ?? usersTable.password_hash).name);\n    // Where \\`ensureAuthTablesExist\\` puts the tables that hang off the users\n    // table: beside it, or in \\`rebase\\` when it lives in \\`public\\`.\n    const authSchema = usersSchema === \"public\" ? \"rebase\" : usersSchema;\n\n    const client = await pool.connect();\n    try {\n        await client.query(\"BEGIN\");\n        const updated = await client.query(\n            \"UPDATE \" + users + \" SET \" + passwordColumn + \" = $1 WHERE \" + emailColumn + \" = $2 \" +\n            \"RETURNING \" + idColumn + \" AS id, \" + emailColumn + \" AS email\",\n            [hash, email]\n        );\n        if (updated.rows.length === 0) {\n            await client.query(\"ROLLBACK\");\n            // Nothing was updated, so nothing was reset. Exiting 0 here reported\n            // success for a no-op, which is what a script would have believed.\n            console.error(\"✗ User not found: \" + email);\n            process.exit(1);\n        }\n        const uid = updated.rows[0].id;\n\n        // A table or column the server has not created yet (it never booted\n        // against this database) holds no session to end.\n        const watermark = await client.query(\n            \"SELECT 1 FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 AND column_name = 'tokens_valid_after'\",\n            [usersSchema, tableName]\n        );\n        if (watermark.rows.length > 0) {\n            await client.query(\"UPDATE \" + users + \" SET tokens_valid_after = NOW() WHERE \" + idColumn + \" = $1\", [uid]);\n        }\n        for (const table of [\"refresh_tokens\", \"password_reset_tokens\"]) {\n            const qualified = quote(authSchema) + \".\" + quote(table);\n            const present = await client.query(\"SELECT to_regclass($1) IS NOT NULL AS present\", [qualified]);\n            if (present.rows[0]?.present) {\n                await client.query(\"DELETE FROM \" + qualified + \" WHERE uid = $1\", [uid]);\n            }\n        }\n        await client.query(\"COMMIT\");\n\n        console.log(\"✅ Password reset for: \" + updated.rows[0].email);\n        console.log(\"   Every session of this account has ended.\");\n        ${echoPassword ? 'console.log(\"   Password: \" + newPassword);' : \"\"}\n        process.exit(0);\n    } catch (error) {\n        await client.query(\"ROLLBACK\").catch(() => undefined);\n        throw error;\n    } finally {\n        client.release();\n    }\n}\n\n// A thrown error is a failed reset, and exits like one — a refused connection\n// that exits 0 reads as a reset to anything checking the exit code.\nresetPassword().catch((error) => {\n    console.error(error);\n    process.exit(1);\n});\n`;\n}\n\nfunction printAuthHelp() {\n    console.log(`\n${chalk.bold(\"rebase auth\")} — Authentication management commands\n\n${chalk.green.bold(\"Usage\")}\n  rebase auth ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.blue.bold(\"reset-password\")}    Reset a user's password\n\n${chalk.green.bold(\"reset-password Options\")}\n  ${chalk.blue(\"--email, -e\")}        User's email address\n  ${chalk.blue(\"--password, -p\")}     New password (default: one is generated and printed)\n\n${chalk.green.bold(\"Examples\")}\n  rebase auth reset-password user@example.com\n  rebase auth reset-password --email user@example.com --password MyNewPass!\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAsBA,IAAM,cAAN,cAA0B,MAAM,CAAC;;AAGjC,IAAa,mBAAmB,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCjD,SAAgB,mBAAmB,SAAkB,OAAyC;CAC1F,MAAM,SAAS,MAAM,KAAK,CAAC,CAAC,YAAY;CACxC,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,OAAkB,MAAM,QAAQ,OAAO,IACvC,UACC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAS,QAAgC,KAAK,IAC1F,QAAiC,QAClC,CAAC;CAEX,KAAK,MAAM,OAAO,MAAM;EACpB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;EACrC,MAAM,SAAS;EACf,MAAM,WAAW,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,KAAK,CAAC,CAAC,YAAY,IAAI,KAAA;EACxF,IAAI,CAAC,YAAY,aAAa,QAAQ;EAEtC,MAAM,KAAK,OAAO,OAAO,OAAO,WAC1B,OAAO,KACN,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,KAAA;EACrD,IAAI,CAAC,IAAI;EAET,OAAO;GAAE;GAAI,OAAO,OAAO;EAAgB;CAC/C;AAGJ;AAEA,eAAsB,YAAY,YAAgC,SAAkC;CAQhG,IAAI,CAAC,cAAc,eAAe,YAAY,UAAU,OAAO,GAAG;EAC9D,cAAc;EACd;CACJ;CAEA,QAAQ,YAAR;EACI,KAAK;GACD,MAAM,cAAc,OAAO;GAC3B;EACJ,SACI,eAAe,YAAY,kBAAkB,MAAM;CAC3D;AACJ;;;;;;;;;;AAWA,IAAa,uBAAuB;CAChC,WAAW;CACX,cAAc;CACd,MAAM;CACN,MAAM;AACV;;;;;;;;;;;;;AAcA,SAAgB,yBAAyB,SAGvC;CACE,MAAM,EAAE,OAAO,gBAAgB,iBAAiB;EAC5C,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAGD,OAAO;EACH,OAAO,MAAM,cAAc,YAAY;EACvC,UAAU,MAAM,iBAAiB,YAAY;CACjD;AACJ;;;;;;;;;;;;;AAcA,SAAgB,mBAA2B;CACvC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC/C;;;;;;;;AASA,eAAe,cAAc,UAAqC;CAC9D,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,IAAI;EACA,MAAM,SAAkB,KAAK,MAAM,IAAI;EACvC,MAAM,QAAQ,UAAU,OAAO,WAAW,YAAY,WAAW,SAAS,OAAO,QAAQ,KAAA;EACzF,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,SAAS,OAAO,MAAM,YAAY,UAAU;GAC/F,MAAM,OAAO,UAAU,SAAS,OAAO,MAAM,SAAS,WAAW,KAAK,MAAM,KAAK,KAAK;GACtF,OAAO,GAAG,MAAM,UAAU;EAC9B;CACJ,QAAQ,CAER;CACA,OAAO,KAAK,KAAK,KAAK,GAAG,SAAS,OAAO,GAAG,SAAS,aAAa,KAAK;AAC3E;AAEA,eAAe,cAAc,SAAkC;CAC3D,MAAM,EAAE,OAAO,UAAU,qBAAqB,yBAAyB,OAAO;CAE9E,MAAM,eAAe,CAAC;CACtB,MAAM,cAAc,oBAAoB,iBAAiB;CAEzD,IAAI,CAAC,OAAO;EACR,QAAQ,MAAM,MAAM,IAAI,sBAAsB,CAAC;EAC/C,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,4DAA4D,CAAC;EACpF,QAAQ,IAAI,MAAM,KAAK,qFAAqF,CAAC;EAC7G,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,cAAc,mBAAmB;CAMvC,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,gBAAoC,YAAY,WAAW,CAAC,CAAC;CAEnE,IAAI,UAAU,QAAQ,IAAI;CAC1B,IAAI,aAAa,QAAQ,IAAI,sBAAsB;CAEnD,MAAM,YAAY,KAAK,KAAK,aAAa,WAAW,YAAY;CAChE,IAAI,GAAG,WAAW,SAAS,GACvB,IAAI;EACA,MAAM,QAAQ,KAAK,MAAM,GAAG,aAAa,WAAW,MAAM,CAAC;EAC3D,IAAI,SAAS,OAAO,UAAU,UAAU;GACpC,IAAI,OAAO,MAAM,YAAY,YAAY,CAAC,SACtC,UAAU,MAAM;GAEpB,IAAI,OAAO,MAAM,eAAe,YAAY,CAAC,YACzC,aAAa,MAAM;EAE3B;CACJ,QAAQ,CAER;CAGJ,MAAM,aAAa,KAAK,KAAK,aAAa,iBAAiB;CAC3D,IAAI,GAAG,WAAW,UAAU,KAAK,CAAC,SAC9B,IAAI;EACA,UAAU,GAAG,aAAa,YAAY,MAAM,CAAC,CAAC,KAAK;CACvD,QAAQ,CAER;CAGJ,IAAI,WAAW,YAAY;EACvB,QAAQ,IAAI,+CAA+C;EAC3D,IAAI;GACA,MAAM,YAAY;GAClB,MAAM,eAAe,QAAQ,QAAQ,QAAQ,EAAE;GAI/C,MAAM,YAAY,GAAG,aAAa,0BAA0B,mBAAmB,KAAK,EAAE;GACtF,MAAM,YAAY,MAAM,MAAM,WAAW,EACrC,SAAS;IACL,iBAAiB,UAAU;IAC3B,UAAU;GACd,EACJ,CAAC;GACD,IAAI,CAAC,UAAU,IACX,MAAM,IAAI,YAAY,yBAAyB,UAAU,OAAO,GAAG,UAAU,YAAY;GAE7F,MAAM,aAAa,MAAM,UAAU,KAAK;GACxC,IAAI,CAAC,cAAc,OAAO,eAAe,UACrC,MAAM,IAAI,MAAM,+CAA+C;GAGnE,MAAM,UAAU,mBAAmB,YAAY,KAAK;GACpD,IAAI,CAAC,SACD,MAAM,IAAI,YAAY,yBAAyB,MAAM,EAAE;GAG3D,MAAM,WAAW,GAAG,aAAa,mBAAmB,QAAQ,GAAG;GAC/D,MAAM,WAAW,MAAM,MAAM,UAAU;IACnC,QAAQ;IACR,SAAS;KACL,iBAAiB,UAAU;KAC3B,gBAAgB;KAChB,UAAU;IACd;IACA,MAAM,KAAK,UAAU,EAAE,UAAU,UAAU,CAAC;GAChD,CAAC;GAED,IAAI,CAAC,SAAS,IACV,MAAM,IAAI,YAAY,2BAA2B,MAAM,cAAc,QAAQ,GAAG;GAGpF,QAAQ,IAAI,uBAAuB;GACnC,QAAQ,IAAI,MAAM,KAAK,6CAA6C,CAAC;GACrE,QAAQ,IAAI,EAAE;GAGd,QAAQ,IAAI,KAAK,MAAM,KAAK,QAAQ,EAAE,GAAG,QAAQ,OAAO;GAGxD,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,GAAG,eAAe,YAAY,IAAI,OAAO,UAAU,MAAM,GAAG;GACrG,QAAQ,IAAI,EAAE;GACd;EACJ,SAAS,KAAK;GACV,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAM9D,IAAI,eAAe,aAAa;IAC5B,QAAQ,MAAM,MAAM,IAAI,KAAK,QAAQ,CAAC;IACtC,QAAQ,WAAW;IACnB;GACJ;GACA,QAAQ,KAAK,MAAM,OAAO,6DAA6D,CAAC;GACxF,QAAQ,KAAK,MAAM,KAAK,cAAc,QAAQ,CAAC;EACnD;CACJ;CAGA,MAAM,aAAa,kBAAkB,WAAW;CAChD,MAAM,SAAS,WAAW,WAAW;CAErC,IAAI,CAAC,QACD,6BAA6B,WAAW;CAG5C,IAAI;EACA,MAAM,MAA8B,EAAE,GAAG,QAAQ,IAA8B;EAC/E,IAAI,SACA,IAAI,qBAAqB;EAE7B,IAAI,qBAAqB;EACzB,IAAI,wBAAwB;EAC5B,IAAI,uBAAuB,WAAW,KAAK,KAAK,aAAa,MAAM;EAQnE,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAC5C,MAAM,WAAW,MAAM,mBAAmB,aAAa,EACnD,aAAa,YAAY,QAAQ,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC,EACnE,CAAC;EACD,OAAO,OAAO,KAAK,SAAS,GAAG;EAE/B,MAAM,gBAAgB,oBAAoB,YAAY;EAEtD,MAAM,gBAAgB,KAAK,KAAK,YAAY,wBAAwB;EACpE,GAAG,cAAc,eAAe,eAAe,OAAO;EAEtD,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,wDAAwD,CAAC;EAChF,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,KAAK,QAAQ,EAAE,GAAG,OAAO;EAChD,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,GAAG,SAAS,aAAa;EAClE,IAAI,CAAC,cACD,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,GAAG,IAAI,OAAO,YAAY,MAAM,GAAG;EAEhF,QAAQ,IAAI,EAAE;EAEd,MAAM,QAAQ,MAAM,QAAQ,CAAC,aAAa,GAAG;GACzC,KAAK;GACL,OAAO;GACP;EACJ,CAAC;EAMD,MAAM,gBAAgB;GAClB,IAAI;IAAE,GAAG,WAAW,aAAa;GAAG,QAAQ,CAAqB;EACrE;EAEA,OAAO,IAAI,SAAS,YAAY;GAC5B,MAAM,GAAG,UAAU,QAAQ;IACvB,QAAQ;IACR,QAAQ,MAAM,MAAM,IAAI,mCAAmC,CAAC;IAC5D,QAAQ,MAAM,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC;IAC5C,QAAQ,KAAK,CAAC;GAClB,CAAC;GACD,MAAM,GAAG,UAAU,SAAS;IACxB,QAAQ;IACR,IAAI,SAAS,GACT,QAAQ,KAAK,QAAQ,CAAC;IAE1B,QAAQ;GACZ,CAAC;EACL,CAAC;CACL,SAAS,KAAK;EACV,QAAQ,MAAM,MAAM,IAAI,kCAAkC,CAAC;EAC3D,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9D,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;;;;;;;AAkBA,SAAgB,oBAAoB,cAA+B;CAC/D,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAsFD,eAAe,kDAAgD,GAAG;;;;;;;;;;;;;;;;;AAiB5E;AAEA,SAAS,gBAAgB;CACrB,QAAQ,IAAI;EACd,MAAM,KAAK,aAAa,EAAE;;EAE1B,MAAM,MAAM,KAAK,OAAO,EAAE;gBACZ,MAAM,KAAK,WAAW,EAAE;;EAEtC,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,KAAK,gBAAgB,EAAE;;EAEpC,MAAM,MAAM,KAAK,wBAAwB,EAAE;IACzC,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,gBAAgB,EAAE;;EAE/B,MAAM,MAAM,KAAK,UAAU,EAAE;;;CAG9B;AACD"}

package/dist/branch-pointer-DvSHBjjz.js

@@ -0,0 +1,2 @@
+import { C as writeActiveBranch, S as readActiveBranch, _ as branchDatabaseName, b as clearActiveBranch, x as databaseNameOf } from "./prepare-CDN6lSpz.js";
+export { branchDatabaseName, clearActiveBranch, databaseNameOf, readActiveBranch, writeActiveBranch };