@rebasepro/cli 0.24.0 → 0.24.1-canary.g19596ef

package/dist/doctor-BP8cZ-7F.js

@@ -0,0 +1,771 @@
+import { f as requireBackendDir, g as resolveTsx, h as resolvePluginCliScript, l as getActiveBackendPlugin, o as findEnvFile, p as requireProjectRoot, r as exitDependenciesNotInstalled } from "./project-Wp2zoyeN.js";
+import { n as parseCommandArgs, r as wantsHelp } from "./args-BnmsEXvu.js";
+import { d as findBackendApp, g as resolveBackendPaths, p as loadManifest } from "./manifest-DRp0UVTj.js";
+import { n as summarisePortability, t as analyseFunctionsDirectory } from "./function-portability-BIvlvR9q.js";
+import { r as refuseMissingCollectionsPath, t as COLLECTIONS_FLAG_HELP } from "./path-flags-BFgG9V6y.js";
+import { DEV_DATABASE_KIND_ENV, devDatabaseKind, managedNotices, prepareDatabaseEnv } from "./prepare-CDN6lSpz.js";
+import { absolutizeLocalPathArgs, n as argsFromCommand, t as reportSpawnFailure } from "./db-B7RuNuaQ.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+import { createRequire } from "module";
+import { execa } from "execa";
+//#region src/utils/libpq-url.ts
+/** Postgres URI schemes. A key/value DSN ("host=… dbname=…") is not one. */
+var POSTGRES_URI_RE = /^postgres(ql)?:\/\//i;
+/**
+* Return the query parameters libpq would reject, or an empty array.
+*
+* Deliberately not built on `new URL()`: that parser is happy to accept the
+* broken form (it splits on the first `=` and keeps the rest as the value),
+* so it cannot see the defect at all. The rule being checked is libpq's, and
+* it is about the raw text.
+*/
+function findUnparseableParams(connectionString) {
+	if (!POSTGRES_URI_RE.test(connectionString)) return [];
+	const q = connectionString.indexOf("?");
+	if (q === -1) return [];
+	const query = connectionString.slice(q + 1).split("#")[0];
+	if (!query) return [];
+	const found = [];
+	for (const part of query.split("&")) {
+		if (!part) continue;
+		if (part.split("=").length > 2) found.push({
+			name: part.slice(0, part.indexOf("=")),
+			raw: part
+		});
+	}
+	return found;
+}
+/**
+* Percent-encode the offending `=` characters, leaving everything else byte for
+* byte as it was.
+*
+* Only the second and later `=` in a parameter are rewritten — the first is the
+* real separator. Nothing else is touched: re-serialising through `URL` would
+* also reorder parameters and turn spaces into `+`, which libpq does not decode,
+* so a "tidy up" would trade one unparseable string for another.
+*/
+function encodeExtraEquals(connectionString) {
+	if (findUnparseableParams(connectionString).length === 0) return connectionString;
+	const q = connectionString.indexOf("?");
+	const head = connectionString.slice(0, q + 1);
+	const rest = connectionString.slice(q + 1);
+	const hash = rest.indexOf("#");
+	const query = hash === -1 ? rest : rest.slice(0, hash);
+	const fragment = hash === -1 ? "" : rest.slice(hash);
+	return `${head}${query.split("&").map((part) => {
+		const first = part.indexOf("=");
+		if (first === -1) return part;
+		return `${part.slice(0, first)}=${part.slice(first + 1).replace(/=/g, "%3D")}`;
+	}).join("&")}${fragment}`;
+}
+/** Variables whose value is a Postgres connection string. */
+var CONNECTION_VARIABLES = ["DATABASE_URL", "ADMIN_CONNECTION_STRING"];
+/**
+* Scan one file's text for connection strings libpq would reject.
+*
+* Handles both shapes a scaffolded project uses, because both shipped with the
+* defect and a deployed stack is broken by the compose one alone:
+*
+*   .env               DATABASE_URL=postgresql://…
+*   docker-compose.yml   DATABASE_URL: postgresql://…
+*/
+function scanTextForLibpqUrls(file, text) {
+	const findings = [];
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (trimmed.startsWith("#")) continue;
+		for (const variable of CONNECTION_VARIABLES) {
+			const match = trimmed.match(new RegExp(`^(?:export\\s+)?${variable}\\s*[:=]\\s*(.+)$`));
+			if (!match) continue;
+			let value = match[1].trim();
+			const quoted = value.match(/^(['"])(.*)\1$/);
+			if (quoted) value = quoted[2];
+			if (!value) continue;
+			const params = findUnparseableParams(value);
+			if (params.length === 0) continue;
+			findings.push({
+				file,
+				variable,
+				params: params.map((p) => p.name),
+				suggested: encodeExtraEquals(value)
+			});
+		}
+	}
+	return findings;
+}
+//#endregion
+//#region src/doctor-environment.ts
+/**
+* Whether `db push`, `db generate` and `db migrate` can run at all.
+*
+* They shell out to `atlas`, and its absence is invisible until one of them is
+* run: `@ariga/atlas` downloads its platform binary in `preinstall`, pnpm 10+
+* and npm 12+ refuse a dependency's lifecycle scripts unless allowlisted, and
+* the install exits 0 either way. The scaffold allowlists it, so this is a
+* problem for the person who added `@rebasepro/server-postgres` to a project
+* they already had — five lines of `ERR_PNPM_IGNORED_BUILDS` and
+* `Failed to create bin … ENOENT`, several screens up, with nothing saying that
+* a schema push will fail later.
+*
+* Three states, because two of them need opposite advice. The package absent is
+* an install; the package present with no binary is an allowlist; the binary
+* present with no `.bin` shim is a re-install, and telling that reader their
+* build scripts are blocked sends them to a command that does nothing.
+*/
+function checkAtlasBinary(state) {
+	if (!state || state.onPath) return [];
+	if (!state.packageInstalled) return [{
+		check: "atlas",
+		severity: "warning",
+		message: "The atlas binary is not on PATH and @ariga/atlas is not installed — `db push`, `db generate` and `db migrate` will fail.",
+		fix: `Install it: ${state.manager} add -D @ariga/atlas, and allow its install script.`
+	}];
+	if (!state.binaryOnDisk) return [{
+		check: "atlas",
+		severity: "warning",
+		message: "@ariga/atlas is installed and its binary is missing — its `preinstall` script was blocked, so `db push` and `db migrate` will fail.",
+		fix: "Allow the build script (pnpm: `allowBuilds` in pnpm-workspace.yaml or `pnpm approve-builds`; npm: `allowScripts` in package.json), then re-install."
+	}];
+	return [{
+		check: "atlas",
+		severity: "warning",
+		message: "The atlas binary is on disk but node_modules/.bin/atlas is missing, so nothing can invoke it.",
+		fix: "Re-resolve the tree so the link is recreated: `pnpm install --force`, or delete node_modules and install again."
+	}];
+}
+/**
+* `20.11.0` → `[20, 11, 0]`, ignoring anything after the patch.
+*
+* A bare major is a version: `>=20` is how every `engines.node` in this repo is
+* written, and requiring a minor here made the whole check return nothing —
+* silently, which is the only way a check like this ever fails.
+*/
+function parseVersion(raw) {
+	const match = raw.trim().replace(/^v/, "").match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?/);
+	if (!match) return null;
+	return [
+		Number(match[1]),
+		Number(match[2] ?? 0),
+		Number(match[3] ?? 0)
+	];
+}
+/** The lowest version a `>=x.y.z` range admits, or null for anything else. */
+function minimumFromRange(range) {
+	const match = range.match(/>=\s*v?(\d+(?:\.\d+)?(?:\.\d+)?)/);
+	return match ? parseVersion(match[1]) : null;
+}
+function isBelow(actual, minimum) {
+	for (let i = 0; i < 3; i++) {
+		if (actual[i] < minimum[i]) return true;
+		if (actual[i] > minimum[i]) return false;
+	}
+	return false;
+}
+/**
+* Is the running Node old enough to break things that will not say so?
+*
+* The symptoms are not "unsupported Node". They are a syntax error inside a
+* dependency, a missing global, or — the one that costs the most time — a
+* `node:` builtin that resolves and then behaves differently. Naming the
+* version is the whole check.
+*/
+function checkNodeVersion(running, required) {
+	if (!required) return [];
+	const minimum = minimumFromRange(required);
+	const actual = parseVersion(running);
+	if (!minimum || !actual) return [];
+	if (!isBelow(actual, minimum)) return [];
+	return [{
+		check: "node",
+		severity: "error",
+		message: `Node ${running} is running, and Rebase needs ${required}.`,
+		fix: `Install Node ${minimum[0]} or newer (nvm install ${minimum[0]}), then reinstall dependencies.`
+	}];
+}
+/** The lockfiles a project may have, and the manager each one belongs to. */
+var LOCKFILES = {
+	"pnpm-lock.yaml": "pnpm",
+	"package-lock.json": "npm",
+	"yarn.lock": "yarn",
+	"bun.lockb": "bun"
+};
+/**
+* Two package managers in one project.
+*
+* A Rebase project is a pnpm workspace, and running `npm install` inside one
+* rewrites `node_modules` into a hoisted layout that pnpm then disagrees with.
+* The result is not an install error: it is `Cannot find module` from inside a
+* dependency, hours later, on a machine where it worked yesterday. The
+* leftover `package-lock.json` is the only durable evidence, and nothing looked
+* at it.
+*/
+function checkPackageManager(lockfilesPresent, declared) {
+	const known = lockfilesPresent.filter((file) => file in LOCKFILES);
+	if (known.length < 2) {
+		const declaredName = declared?.split("@")[0];
+		if (known.length === 1 && declaredName && LOCKFILES[known[0]] !== declaredName) return [{
+			check: "package-manager",
+			severity: "warning",
+			message: `This project declares packageManager "${declared}" and has a ${LOCKFILES[known[0]]} lockfile (${known[0]}).`,
+			fix: `Delete ${known[0]} and node_modules, then install with ${declaredName}.`
+		}];
+		return [];
+	}
+	const managers = known.map((file) => LOCKFILES[file]);
+	return [{
+		check: "package-manager",
+		severity: "error",
+		message: `Two package managers have installed here: ${known.join(" and ")}.`,
+		fix: `Keep one. Delete the others and node_modules, then reinstall with ${declared?.split("@")[0] ?? managers[0]}.`
+	}];
+}
+/**
+* Two collections claiming one slug.
+*
+* The slug is the route, the table lookup and the registry key, and the
+* registry keeps the last one registered. So the loser is not reported missing:
+* it is served as the winner, with the winner's properties, under its own name.
+* Every symptom of this points somewhere else.
+*/
+function checkDuplicateSlugs(collections) {
+	const byslug = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		if (!collection.slug) continue;
+		byslug.set(collection.slug, (byslug.get(collection.slug) ?? 0) + 1);
+	}
+	return [...byslug].filter(([, count]) => count > 1).map(([slug, count]) => ({
+		check: "collections",
+		severity: "error",
+		message: `${count} collections declare the slug "${slug}". Only the last one registered is served.`,
+		fix: `Give each collection its own slug. The one that loses is not reported missing — it answers as the winner.`
+	}));
+}
+/**
+* The two `.env` facts that fail late and confusingly.
+*
+* A short `JWT_SECRET` boots fine and is refused by `loadEnv` only in
+* production, which is the worst place to find out. Missing CORS in production
+* is the opposite shape — it does not fail at all; the API simply accepts
+* requests from anywhere.
+*
+* Values are never echoed. This reads a file that holds every credential the
+* project has, and doctor's output goes wherever a terminal goes.
+*/
+function checkEnvSanity(values) {
+	const findings = [];
+	const production = values.NODE_ENV === "production";
+	const secret = values.JWT_SECRET;
+	if (secret !== void 0 && secret.length > 0 && secret.length < 32) findings.push({
+		check: "env",
+		severity: production ? "error" : "warning",
+		message: `JWT_SECRET is ${secret.length} characters. The runtime requires at least 32, and refuses to boot below it in production.`,
+		fix: "Generate one: openssl rand -hex 32"
+	});
+	if (production && !values.CORS_ORIGINS && !values.FRONTEND_URL) findings.push({
+		check: "env",
+		severity: "error",
+		message: "NODE_ENV=production with neither CORS_ORIGINS nor FRONTEND_URL set — the API will accept requests from any origin.",
+		fix: "Set CORS_ORIGINS to the origins that may call this API."
+	});
+	return findings;
+}
+/**
+* Parse a `.env` into a plain object.
+*
+* Deliberately not `dotenv`: this must not touch `process.env`, and doctor may
+* be reading a file for a different environment than the one it is running in.
+*/
+function parseEnvFile(text) {
+	const values = {};
+	for (const line of text.split("\n")) {
+		const trimmed = line.trim();
+		if (!trimmed || trimmed.startsWith("#")) continue;
+		const eq = trimmed.indexOf("=");
+		if (eq <= 0) continue;
+		const key = trimmed.slice(0, eq).replace(/^export\s+/, "").trim();
+		let value = trimmed.slice(eq + 1).trim();
+		if (value.startsWith("\"") && value.endsWith("\"") || value.startsWith("'") && value.endsWith("'")) value = value.slice(1, -1);
+		values[key] = value;
+	}
+	return values;
+}
+/**
+* The same `@rebasepro/*` package pinned to different versions in one project.
+*
+* A Rebase project declares them in several package.json files — the root, the
+* backend, the frontend, the config workspace — and nothing has ever compared
+* them. The failure that produces is not an install error: pnpm installs both,
+* `instanceof` stops working across the two copies, and the symptom is a
+* `CollectionConfig` that fails a type guard written against an identical type.
+*
+* `workspace:` ranges are excluded: inside this repo's own workspaces they all
+* resolve to the same build by construction.
+*/
+function checkVersionSkew(declared) {
+	const byPackage = /* @__PURE__ */ new Map();
+	for (const dependency of declared) {
+		if (!dependency.name.startsWith("@rebasepro/")) continue;
+		if (dependency.range.startsWith("workspace:") || dependency.range.startsWith("link:")) continue;
+		if (dependency.range === "*" || dependency.range === "latest") continue;
+		const ranges = byPackage.get(dependency.name) ?? /* @__PURE__ */ new Map();
+		ranges.set(dependency.range, [...ranges.get(dependency.range) ?? [], dependency.file]);
+		byPackage.set(dependency.name, ranges);
+	}
+	const findings = [];
+	for (const [name, ranges] of byPackage) {
+		if (ranges.size < 2) continue;
+		const described = [...ranges].map(([range, files]) => `${range} (${files.join(", ")})`).join(", ");
+		findings.push({
+			check: "versions",
+			severity: "error",
+			message: `${name} is pinned to different versions in this project: ${described}.`,
+			fix: "Run `rebase upgrade` to pin every @rebasepro package to one release and reinstall. Two copies of a Rebase package break `instanceof` between them, which fails as a type guard rejecting its own type."
+		});
+	}
+	return findings;
+}
+//#endregion
+//#region src/commands/doctor.ts
+/**
+* CLI command: rebase doctor
+*
+* Detects three-way schema drift between collection definitions,
+* the generated Drizzle schema, and the live PostgreSQL database.
+*/
+/**
+* Files that can hold a connection string the project actually runs on.
+*
+* `.env` is what local commands read; the compose files are what a self-hosted
+* stack and its scheduled backup cron read. Both shipped with the defect, and a
+* deployed stack is broken by the compose one even when `.env` has been fixed.
+* `.env.example` is deliberately absent: nothing runs on it.
+*/
+var CONNECTION_FILES = [
+	".env",
+	".env.local",
+	"docker-compose.yml",
+	"docker-compose.yaml",
+	"docker-compose.custom.yml"
+];
+/**
+* Find connection strings libpq cannot parse, anywhere in the project.
+*
+* Exported for the tests; `envFile` is passed separately because a project may
+* keep its `.env` outside the root (see `findEnvFile`).
+*/
+function findLibpqUrlProblems(projectRoot, envFile) {
+	const candidates = CONNECTION_FILES.map((f) => path.join(projectRoot, f));
+	if (envFile) candidates.push(envFile);
+	const findings = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const file of candidates) {
+		if (seen.has(file)) continue;
+		seen.add(file);
+		let text;
+		try {
+			if (!fs.existsSync(file)) continue;
+			text = fs.readFileSync(file, "utf-8");
+		} catch {
+			continue;
+		}
+		findings.push(...scanTextForLibpqUrls(path.relative(projectRoot, file) || path.basename(file), text));
+	}
+	return findings;
+}
+/**
+* Report unparseable connection strings, if any. Returns true when there were,
+* so the finding reaches the exit code like the environment errors do.
+*
+* Runs before the plugin's drift check and never blocks it. The plugin connects
+* through node-postgres, which parses these URLs happily — so it cannot see this
+* defect, and a project with it will otherwise get a clean bill of health while
+* `rebase db backup` fails.
+*/
+function reportLibpqUrlProblems(findings) {
+	if (findings.length === 0) return false;
+	console.log("");
+	console.log(chalk.red.bold("  ✗ Connection string that PostgreSQL's own tools cannot parse"));
+	console.log("");
+	for (const f of findings) {
+		console.log(`    ${chalk.bold(f.file)} → ${chalk.bold(f.variable)}`);
+		console.log(chalk.gray(`      the "${f.params.join("\", \"")}" parameter contains an unencoded "=".`));
+		console.log(chalk.gray("      Replace the value with:"));
+		console.log(`      ${chalk.cyan(f.suggested)}`);
+		console.log("");
+	}
+	console.log(chalk.gray("    libpq splits a query parameter on the first \"=\" and rejects any further"));
+	console.log(chalk.gray("    one, so this fails:"));
+	console.log(chalk.gray("      extra key/value separator \"=\" in URI query parameter"));
+	console.log("");
+	console.log(chalk.gray("    Affects rebase db backup / restore, scheduled backups, and psql."));
+	console.log(chalk.gray("    NOT rebase dev or db push — those use a driver that accepts it, which"));
+	console.log(chalk.gray("    is why a project can look healthy and still have no working backups."));
+	console.log(chalk.gray("    Projects scaffolded before 2026-08-18 all carry it."));
+	console.log("");
+	return true;
+}
+/**
+* `--help` is answered before the project guard, not after.
+*
+* `doctor` declared no `--help` at all, so the flag fell through to the command
+* body and hit `requireProjectRoot()` — and `rebase doctor --help` outside a
+* project answered "✗ Could not find a Rebase project root." Asking a command
+* what it does is the one question that cannot require being somewhere
+* particular to ask.
+*/
+/**
+* What each custom function needs from its host.
+*
+* Prints nothing when there is nothing to say — which is the common case, and
+* the reason it can afford to run every time. When it does print, the ordering
+* is deliberate: the one finding that is a bug *today* comes first, and the
+* rest is a single descriptive line about where these functions could run.
+*/
+function reportFunctionPortability(projectRoot) {
+	let results;
+	try {
+		const backend = findBackendApp(loadManifest(projectRoot).manifest);
+		if (!backend) return;
+		const paths = resolveBackendPaths(backend.app, projectRoot);
+		results = analyseFunctionsDirectory(path.join(projectRoot, paths.functions), projectRoot);
+	} catch {
+		return;
+	}
+	const lines = summarisePortability(results);
+	if (lines.length === 0) return;
+	console.log(chalk.bold("\nCustom functions"));
+	for (const line of lines) console.log(line.trimStart().startsWith("⚠") ? chalk.yellow(line) : chalk.gray(line));
+	console.log(chalk.gray("      See https://rebase.pro/docs/backend/custom-functions#runtime-portability"));
+}
+/**
+* Read everything the environment checks need, then run them.
+*
+* The reading is here and the deciding is in `doctor-environment.ts`, so every
+* check has a fixture that fails it without a project on disk.
+*/
+function collectEnvironmentFindings(projectRoot, envFile) {
+	const findings = [];
+	findings.push(...checkNodeVersion(process.versions.node, readCliEngines()));
+	const rootPackage = readJson(path.join(projectRoot, "package.json"));
+	findings.push(...checkPackageManager(Object.keys(LOCKFILES).filter((file) => fs.existsSync(path.join(projectRoot, file))), typeof rootPackage?.packageManager === "string" ? rootPackage.packageManager : void 0));
+	findings.push(...checkDuplicateSlugs(readDeclaredSlugs(projectRoot)));
+	if (envFile && fs.existsSync(envFile)) try {
+		findings.push(...checkEnvSanity(parseEnvFile(fs.readFileSync(envFile, "utf-8"))));
+	} catch {}
+	findings.push(...checkVersionSkew(readDeclaredRebaseDeps(projectRoot)));
+	findings.push(...checkAtlasBinary(readAtlasBinaryState(projectRoot)));
+	return findings;
+}
+/**
+* What is actually on disk for `@ariga/atlas`, from the project's point of view.
+*
+* Three separate questions, because the three states they distinguish need
+* three different remedies — see `checkAtlasBinary`. Directories are searched
+* from the project root upwards and through the workspaces a scaffold has,
+* because `db push` runs from `backend/` and the install may be hoisted to the
+* root.
+*/
+function readAtlasBinaryState(projectRoot) {
+	const roots = [
+		projectRoot,
+		path.join(projectRoot, "backend"),
+		path.join(projectRoot, "config")
+	];
+	const findUpwards = (starts, relative) => {
+		for (const start of starts) {
+			let dir = start;
+			for (let i = 0; i < 8; i++) {
+				const candidate = path.join(dir, "node_modules", relative);
+				if (fs.existsSync(candidate)) return candidate;
+				const parent = path.dirname(dir);
+				if (parent === dir) break;
+				dir = parent;
+			}
+		}
+		return null;
+	};
+	const resolveFrom = (from, request) => {
+		try {
+			return createRequire(pathToFileURL(from)).resolve(request);
+		} catch {
+			return null;
+		}
+	};
+	const bases = roots.map((dir) => path.join(dir, "package.json")).filter((file) => fs.existsSync(file));
+	const driverManifests = bases.map((base) => resolveFrom(base, "@rebasepro/server-postgres/package.json")).filter((file) => file !== null);
+	let manifest = findUpwards(roots, path.join("@ariga", "atlas", "package.json"));
+	if (!manifest) for (const base of [...bases, ...driverManifests]) {
+		manifest = resolveFrom(base, "@ariga/atlas/package.json");
+		if (manifest) break;
+	}
+	const onPath = findUpwards([...roots, ...driverManifests.map((file) => path.dirname(file))], path.join(".bin", "atlas")) !== null;
+	let binaryOnDisk = false;
+	if (manifest) try {
+		const pkg = JSON.parse(fs.readFileSync(manifest, "utf-8"));
+		const dir = path.dirname(manifest);
+		binaryOnDisk = (typeof pkg.bin === "string" ? [pkg.bin] : Object.values(pkg.bin ?? {}).filter((t) => typeof t === "string")).some((target) => fs.existsSync(path.resolve(dir, target)));
+	} catch {}
+	return {
+		onPath,
+		packageInstalled: manifest !== null,
+		binaryOnDisk,
+		manager: readPackageManagerName(projectRoot)
+	};
+}
+/** The reader's own package manager, from the lockfile beside their project. */
+function readPackageManagerName(projectRoot) {
+	for (const [file, manager] of Object.entries(LOCKFILES)) if (fs.existsSync(path.join(projectRoot, file))) return manager;
+	return "pnpm";
+}
+/** The `engines.node` range of the CLI actually running. */
+function readCliEngines() {
+	try {
+		const here = path.dirname(fileURLToPath(import.meta.url));
+		for (let dir = here, i = 0; i < 5; i++) {
+			const candidate = path.join(dir, "package.json");
+			if (fs.existsSync(candidate)) {
+				const parsed = readJson(candidate);
+				if (parsed?.name === "@rebasepro/cli") return parsed.engines?.node;
+			}
+			const parent = path.dirname(dir);
+			if (parent === dir) break;
+			dir = parent;
+		}
+	} catch {}
+}
+function readJson(file) {
+	try {
+		return JSON.parse(fs.readFileSync(file, "utf-8"));
+	} catch {
+		return;
+	}
+}
+/** Where a project's package.json files live, relative to its root. */
+var PACKAGE_JSON_LOCATIONS = [
+	"package.json",
+	"backend/package.json",
+	"frontend/package.json",
+	"config/package.json"
+];
+function readDeclaredRebaseDeps(projectRoot) {
+	const declared = [];
+	for (const relative of PACKAGE_JSON_LOCATIONS) {
+		const parsed = readJson(path.join(projectRoot, relative));
+		if (!parsed) continue;
+		for (const field of [
+			"dependencies",
+			"devDependencies",
+			"peerDependencies"
+		]) {
+			const block = parsed[field];
+			if (!block) continue;
+			for (const [name, range] of Object.entries(block)) if (typeof range === "string") declared.push({
+				file: relative,
+				name,
+				range
+			});
+		}
+	}
+	return declared;
+}
+/**
+* Does this project declare its collections in code?
+*
+* `resolveBackendPaths` answers it against the manifest's own `config` path
+* rather than the convention, because a project may move the directory. A
+* project with no manifest, or one shaped differently, is treated as declaring
+* them: the wrong answer there would silently skip the drift report, which is
+* the reason the command exists.
+*/
+function hasDeclaredCollections(projectRoot) {
+	try {
+		const backend = findBackendApp(loadManifest(projectRoot).manifest);
+		if (!backend) return true;
+		return resolveBackendPaths(backend.app, projectRoot).hasCollections;
+	} catch {
+		return true;
+	}
+}
+/**
+* Every `slug:` a collection file declares, read as text.
+*
+* Deliberately not by importing them: a collection file may import anything the
+* project depends on, and doctor must not run a project's code to tell it two
+* slugs collide. A regex over `slug: "..."` finds the literal in every shape
+* the scaffold and the docs use; a computed slug is simply not seen, which is
+* the right failure for a check that only ever reports.
+*/
+function readDeclaredSlugs(projectRoot) {
+	const dir = path.join(projectRoot, "config", "collections");
+	if (!fs.existsSync(dir)) return [];
+	const slugs = [];
+	let entries;
+	try {
+		entries = fs.readdirSync(dir);
+	} catch {
+		return [];
+	}
+	for (const entry of entries) {
+		if (!/\.(ts|js|mts|mjs)$/.test(entry) || entry.startsWith("index.")) continue;
+		try {
+			const text = fs.readFileSync(path.join(dir, entry), "utf-8");
+			for (const match of text.matchAll(/\bslug:\s*["'`]([^"'`]+)["'`]/g)) slugs.push({ slug: match[1] });
+		} catch {}
+	}
+	return slugs;
+}
+/** Print what the environment checks found, grouped, or nothing at all. */
+function reportEnvironmentFindings(findings) {
+	if (findings.length === 0) return false;
+	console.log("");
+	console.log(chalk.bold("  Environment"));
+	for (const finding of findings) {
+		const mark = finding.severity === "error" ? chalk.red("  ✗") : chalk.yellow("  ⚠");
+		console.log(`${mark} ${finding.message}`);
+		console.log(chalk.gray(`      ${finding.fix}`));
+	}
+	console.log("");
+	return findings.some((finding) => finding.severity === "error");
+}
+/**
+* The flags `rebase doctor` takes, and what each is for.
+*
+* One table, read by both the parser and the help page, because they were two
+* things that had to agree and did not: the page listed no flags at all, so
+* `--policies` — the form `cli/index.md` calls "the form to use as a CI gate" —
+* was invisible to anyone who ran `rebase doctor --help` to find it. And with
+* nothing parsing the line here, a typo travelled to the driver's permissive
+* parser and was silently dropped, so `rebase doctor --polices` ran the ordinary
+* doctor and reported success on a gate that never ran.
+*
+* The spec mirrors the driver's own (`doctorPluginCommand` in
+* `server-postgres/src/cli.ts`), because the line is relayed to it verbatim.
+*/
+var DOCTOR_FLAGS = {
+	"--policies": Boolean,
+	"--collections": String,
+	"-c": "--collections",
+	"--schema": String,
+	"-s": "--schema",
+	"--sdk": String,
+	"-k": "--sdk"
+};
+/** What each long flag above does, for the Options block. */
+var DOCTOR_FLAG_HELP = {
+	"--policies": "Also audit the row-level security policies. The form to use as a CI gate.",
+	"--collections": COLLECTIONS_FLAG_HELP,
+	"--schema": "Path to the generated Drizzle schema (default: backend/src/schema.generated.ts)",
+	"--sdk": "Path to the generated SDK types (default: generated/sdk/database.types.ts)"
+};
+/**
+* The line handed to the driver, every path on it resolved from where the
+* command was run — the driver runs in `backend/`. See `utils/path-flags.ts`.
+*/
+function doctorDriverArgs(rawArgs, cwd) {
+	return absolutizeLocalPathArgs(argsFromCommand(rawArgs, "doctor"), cwd, [
+		"--collections",
+		"-c",
+		"--schema",
+		"-s",
+		"--sdk",
+		"-k"
+	]);
+}
+/** `--collections, -c` — the aliases, resolved from the spec rather than retyped. */
+function doctorFlagLabel(flag) {
+	return [flag, ...Object.entries(DOCTOR_FLAGS).filter(([, target]) => target === flag).map(([alias]) => alias)].join(", ");
+}
+function printDoctorHelp() {
+	console.log(`
+${chalk.bold("rebase doctor")} — Check a project for drift and misconfiguration
+
+${chalk.green.bold("Usage")}
+  rebase doctor [options]
+
+${chalk.green.bold("Options")}
+${Object.keys(DOCTOR_FLAG_HELP).map((flag) => `  ${chalk.blue(doctorFlagLabel(flag).padEnd(22))} ${DOCTOR_FLAG_HELP[flag]}`).join("\n")}
+
+Compares the collections you declare, the generated Drizzle schema, and the
+tables that actually exist, then reports what disagrees and how to reconcile it.
+
+Also checks the connection strings in .env and the compose files for the
+unencoded "=" that makes PostgreSQL's own tools refuse to parse them — which
+breaks backups and psql while leaving the app itself working.
+
+Run from inside a Rebase project — it reads the project's collections and
+connects to its database.
+`);
+}
+async function doctorCommand(rawArgs) {
+	if (wantsHelp(rawArgs)) {
+		printDoctorHelp();
+		return;
+	}
+	parseCommandArgs({
+		spec: DOCTOR_FLAGS,
+		rawArgs,
+		commandWords: 1,
+		command: "doctor",
+		maxPositionals: 0
+	});
+	const projectRoot = requireProjectRoot();
+	const backendDir = requireBackendDir(projectRoot);
+	refuseMissingCollectionsPath(rawArgs, process.cwd(), backendDir, "doctor");
+	const activePlugin = getActiveBackendPlugin(backendDir);
+	if (!activePlugin) {
+		console.error(chalk.red("✗ Could not detect an active database plugin."));
+		console.error(chalk.gray("  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json."));
+		process.exit(1);
+	}
+	const pluginCli = resolvePluginCliScript(backendDir, activePlugin);
+	if (!pluginCli) exitDependenciesNotInstalled(projectRoot);
+	const envFile = findEnvFile(projectRoot);
+	const env = { ...process.env };
+	if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+	env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? "";
+	const connectionFailed = reportLibpqUrlProblems(findLibpqUrlProblems(projectRoot, envFile));
+	reportFunctionPortability(projectRoot);
+	const environmentFailed = reportEnvironmentFindings(collectEnvironmentFindings(projectRoot, envFile));
+	const failed = connectionFailed || environmentFailed;
+	try {
+		const prepared = await prepareDatabaseEnv(projectRoot, { onProgress: (message) => console.log(chalk.gray(`  ${message}`)) });
+		Object.assign(env, prepared.env);
+		for (const line of managedNotices(prepared)) console.log(chalk.gray(`  ${line}`));
+	} catch (error) {
+		console.log("");
+		console.error(chalk.yellow(`  ⚠ Could not resolve this project's database: ${error instanceof Error ? error.message : String(error)}`));
+		console.error(chalk.gray("    The checks that need one are reported below as not run."));
+	}
+	if (!hasDeclaredCollections(projectRoot)) {
+		console.log("");
+		console.log(chalk.gray("  ○ Schema drift not checked: this project derives its API from the database — run `rebase schema introspect` first."));
+		if (failed) process.exit(1);
+		return;
+	}
+	try {
+		if (pluginCli.endsWith(".ts")) {
+			const tsxBin = resolveTsx(projectRoot);
+			if (!tsxBin) exitDependenciesNotInstalled(projectRoot);
+			await execa(tsxBin, [pluginCli, ...doctorDriverArgs(rawArgs, process.cwd())], {
+				cwd: backendDir,
+				stdio: "inherit",
+				env
+			});
+		} else await execa("node", [pluginCli, ...doctorDriverArgs(rawArgs, process.cwd())], {
+			cwd: backendDir,
+			stdio: "inherit",
+			env
+		});
+	} catch (error) {
+		reportSpawnFailure(error);
+		process.exit(1);
+	}
+	if (failed) process.exit(1);
+}
+//#endregion
+export { doctorCommand };
+
+//# sourceMappingURL=doctor-BP8cZ-7F.js.map