@rebasepro/cli 0.24.0 → 0.24.1-canary.g56af4a4

package/dist/dev-C9P5Yp9k.js

@@ -0,0 +1,1593 @@
+import { i as recordEvent } from "./telemetry-CAWNCugs.js";
+import { n as getPMCommands, t as detectPackageManager } from "./package-manager-DSEOwTqM.js";
+import { a as findBackendDir, d as readEnvFile, g as resolveTsx, h as resolvePluginCliScript, l as getActiveBackendPlugin, n as dependenciesNotInstalled, o as findEnvFile, p as requireProjectRoot, s as findFrontendDir, v as validateTsxInstallation } from "./project-Wp2zoyeN.js";
+import { n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-BnmsEXvu.js";
+import { d as findBackendApp, f as formatAppAddress, g as resolveBackendPaths, l as cmsMountOf, p as loadManifest, v as staticAppAddress } from "./manifest-DzlC60WX.js";
+import { DEV_DATABASE_KIND_ENV, S as ensureDevDatabase, l as resolveCliEntry, managedNotices, prepareDatabaseEnv, resolveComposeUrl, u as resolveSpawn, w as probeTcp } from "./prepare-Btn9Ewbn.js";
+import { runDriverDbCommand, runDriverSchemaCommand } from "./db-CMpBK3sv.js";
+import { t as affectsSqlSchema } from "./collection-drift-BKj_BoMq.js";
+import chalk from "chalk";
+import fs from "fs";
+import os from "os";
+import path from "path";
+import { createHash } from "crypto";
+import { fileURLToPath } from "url";
+import dotenv from "dotenv";
+import { DEFAULT_RESOURCE_KEY, parseEnvBoolean } from "@rebasepro/types";
+import { execa, execaCommandSync } from "execa";
+import { StringDecoder } from "string_decoder";
+//#region src/commands/dev.ts
+/**
+* CLI command: rebase dev
+*
+* Starts the full development environment:
+* - Backend: tsx watch with auto-reload
+* - Frontend: vite dev server
+*
+* Both processes stream output with color-coded prefixes.
+*
+* When the backend uses port-retry (i.e. the configured port is busy and it
+* binds to the next free one), the CLI detects the actual port from stdout
+* and injects VITE_API_URL into the frontend so it connects automatically.
+*
+* Each project gets a deterministic default port derived from the project
+* root path, so multiple Rebase instances never collide.
+*/
+/**
+* The line the watcher prints when it is about to run the entry again.
+*
+* `rebase dev` has no exit code to read: the watcher outlives the process it
+* started, so a backend that dies leaves it running and the CLI printing
+* "Press Ctrl+C to stop all servers." under the stack trace, as if everything
+* were fine.
+*
+* What used to be here was `/Waiting for file changes before restarting/` —
+* **Node's** message, on the theory that `--watch=…` was passed through to
+* Node. It is not: the backend is spawned as `tsx watch …` (see `watchArgs`),
+* so tsx does the watching and Node's line is never printed. The marker
+* matched nothing at all — and the test guarding it ran `node --watch`
+* directly, so it kept proving that Node's wording was intact while the CLI
+* watched a stream that never contained it. That is precisely the silent death
+* the old comment warned about, reached by a different route.
+*
+* So this is tsx's, captured from tsx 4.23.1:
+*
+*     6:26:11 AM [tsx] change in ./src/index.ts Rerunning...
+*     6:26:11 AM [tsx] change in ./src/index.ts Restarting...
+*
+* "Rerunning" when the previous run had already exited, "Restarting" when it
+* was still up and had to be killed first. Both mean the same thing here: the
+* backend that was announced is gone, and whether another one arrives is an
+* open question again — so the readiness deadline is re-armed.
+*
+* Exported so `dev-crash-marker.test.ts` can hold the running tsx to it.
+*/
+var WATCHER_RESTART_MARKER = /\[tsx\][^\n]*\b(?:Rerunning|Restarting)\b/i;
+/**
+* How often to ask whether the announced backend is still listening.
+*
+* The watcher says nothing when its child is killed outright, so a poll is the
+* only signal there is. Five seconds is chosen against the thing it must not
+* do — report a healthy server as dead — rather than against detection speed:
+* two consecutive misses are needed, so it takes ten seconds of a genuinely
+* closed port to say anything.
+*/
+var LIVENESS_INTERVAL_MS = 5e3;
+/**
+* Strip ANSI codes before matching.
+*
+* At module scope so `portMovedNotice` below can use the same one the stream
+* handlers do: a second copy of this regex is a second thing to keep in step.
+*/
+var stripAnsi = (str) => str.replace(/[\u001b\u009b][[()#;?]*(?:[0-9]{1,4}(?:;[0-9]{0,4})*)?[0-9A-ORZcf-nqry=><]/g, "");
+/**
+* Calls `onLine` with each line a child process writes to `stream`.
+*
+* A pipe hands over whatever has been written so far, so one line can arrive
+* in two chunks. Split chunk by chunk, "Server running at http://localhost:3001"
+* could read as two fragments that neither matched, and `rebase dev` then
+* never announced the backend or started the admin panel. So the piece after
+* the last newline is held for the next chunk, decoded as UTF-8 across chunk
+* boundaries. A held piece is handed over at the end of the stream, or after
+* `idleFlushMs` with nothing more written, so a prompt or a progress line
+* still shows when it is written.
+*
+* Exported for its test.
+*/
+function forEachOutputLine(stream, onLine, idleFlushMs = 100) {
+	if (!stream) return;
+	const decoder = new StringDecoder("utf8");
+	let pending = "";
+	let idle;
+	const emit = (text) => {
+		for (const line of text.split("\n")) if (line) onLine(line);
+	};
+	const flush = (atEnd) => {
+		clearTimeout(idle);
+		idle = void 0;
+		const rest = pending + (atEnd ? decoder.end() : "");
+		pending = "";
+		emit(rest);
+	};
+	stream.on("data", (data) => {
+		clearTimeout(idle);
+		const text = pending + (typeof data === "string" ? data : decoder.write(data));
+		const lastNewline = text.lastIndexOf("\n");
+		pending = text.slice(lastNewline + 1);
+		if (lastNewline >= 0) emit(text.slice(0, lastNewline));
+		if (pending) {
+			idle = setTimeout(() => flush(false), idleFlushMs);
+			idle.unref?.();
+		}
+	});
+	stream.on("end", () => flush(true));
+}
+/**
+* The corrected banner line, when the backend says it moved port.
+*
+* `↳ PORT = 3014` is printed before the server binds — the backend's
+* environment has to be fixed before it spawns — so when the port turns out to
+* be taken and the server moves, the banner two inches up is simply wrong. The
+* true number then appears in a `[backend]` line a hundred lines of DDL later,
+* which nobody scrolls back through, and the banner is where a reader looks for
+* the port.
+*
+* A correction rather than a rewrite: the terminal is a transcript, and a line
+* that changes after the fact is a line nobody can trust. So the old number is
+* named too.
+*
+* Exported for its test.
+*/
+function portMovedNotice(line) {
+	const moved = stripAnsi(line).match(/Port (\d+) is in use — trying (\d+)/);
+	return moved ? {
+		from: moved[1],
+		to: moved[2]
+	} : null;
+}
+/**
+* Quote a path for the shell `execa` runs the backend through.
+*
+* The dev runtime's path is absolute and therefore contains whatever the
+* developer's directories are called. Double quotes do not neutralize `$`,
+* backticks or backslashes in a POSIX shell, so a checkout under a directory
+* named `$(...)` would execute it. Single quotes disable all expansion; on
+* Windows, `cmd.exe` performs no such expansion and wants double quotes.
+*/
+function quoteForShell(value) {
+	if (process.platform === "win32") return `"${value.replace(/"/g, "\\\"")}"`;
+	return `'${value.replace(/'/g, "'\\''")}'`;
+}
+/**
+* Locate the dev runtime shim shipped with the CLI.
+*
+* Published under `runtime/` in the package rather than compiled into `dist/`,
+* because tsx executes it as a file and it must exist on disk at a stable path.
+*/
+function resolveDevRuntimeEntry() {
+	let dir = path.dirname(fileURLToPath(import.meta.url));
+	for (let i = 0; i < 5; i++) {
+		const candidate = path.join(dir, "runtime", "dev-server.mjs");
+		if (fs.existsSync(candidate)) return candidate;
+		const parent = path.dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	throw new Error("Could not find the Rebase dev runtime (runtime/dev-server.mjs). Reinstall @rebasepro/cli, or add a backend/src/index.ts to run your own entrypoint.");
+}
+/**
+* Tell the dev runtime where this project keeps its parts.
+*
+* Read from `rebase.json` when there is one, so a project that moved its config
+* directory is honoured; otherwise the conventional layout.
+*/
+function devRuntimeEnv(projectRoot) {
+	const result = {
+		REBASE_DEV_PROJECT_ROOT: projectRoot,
+		REBASE_DEV_CONFIG: "config",
+		REBASE_DEV_FUNCTIONS: "backend/functions",
+		REBASE_DEV_CRONS: "backend/crons",
+		REBASE_DEV_SCHEMA: "backend/src/schema.generated.ts"
+	};
+	try {
+		const backend = findBackendApp(loadManifest(projectRoot).manifest);
+		if (backend) {
+			const paths = resolveBackendPaths(backend.app, projectRoot);
+			result.REBASE_DEV_CONFIG = paths.config;
+			result.REBASE_DEV_FUNCTIONS = paths.functions;
+			result.REBASE_DEV_CRONS = paths.crons;
+			result.REBASE_DEV_SCHEMA = paths.schema;
+			result.REBASE_DEV_APP = backend.name;
+		}
+	} catch {}
+	return result;
+}
+/**
+* Directories `tsx watch` must be told about explicitly, as absolute paths.
+*
+* tsx restarts on a change to anything the entrypoint *imports*. Functions and
+* crons are not imported: the runtime scans their directories at boot. So
+* adding `backend/functions/new.ts` while `rebase dev` ran did nothing —
+* `GET /api/functions/new` stayed 404, and a new cron never registered — until
+* somebody restarted by hand. The same is true of `config/`, which is read as
+* data.
+*
+* `--include` is tsx's own answer to this, it takes a directory rather than a
+* glob, and it tolerates a directory that does not exist yet: a `crons/`
+* created mid-session starts being watched when it appears.
+*
+* @param projectRoot   Absolute path the relative entries are resolved against.
+* @param paths         The `REBASE_DEV_*` map from {@link devRuntimeEnv}.
+*/
+function devWatchIncludes(projectRoot, paths) {
+	const dirs = [paths.REBASE_DEV_FUNCTIONS, paths.REBASE_DEV_CRONS].filter((entry) => Boolean(entry)).map((entry) => path.resolve(projectRoot, entry));
+	dirs.push(path.join(projectRoot, "config"));
+	return dirs;
+}
+/** Where dev watches the collections it regenerates the schema and SDK from. */
+function devCollectionsDir(projectRoot) {
+	return path.join(projectRoot, "config", "collections");
+}
+/**
+* The file dev writes to restart the backend, or `null` when tsx would not see it.
+*
+* Outside the project, so nothing appears in the developer's tree, and keyed by
+* the project so two `rebase dev`s never restart each other. tsx ignores every
+* path with a dot-named segment (its built-in `**\/.*\/**`), so a trigger under
+* `.rebase/` — or under a TMPDIR inside a dot directory — would never fire; in
+* that case there is no trigger and {@link devWatchArgs} leaves the
+* collections to tsx, as before.
+*/
+function devRestartTrigger(projectRoot) {
+	let tmp = os.tmpdir();
+	try {
+		tmp = fs.realpathSync(tmp);
+	} catch {}
+	const key = createHash("sha256").update(projectRoot).digest("hex").slice(0, 16);
+	const trigger = path.join(tmp, "rebase-dev", key, "collections-changed");
+	return trigger.split(path.sep).some((segment) => segment.startsWith(".")) ? null : trigger;
+}
+/**
+* tsx's built-in watch ignores (tsx 4's `watch` command), which it applies
+* relative to its cwd only. {@link devWatchArgs} repeats them under every
+* directory it includes from outside that cwd.
+*/
+var TSX_DEFAULT_IGNORES = [
+	"**/.*/**",
+	"**/.*",
+	"**/{node_modules,bower_components,vendor}/**"
+];
+/**
+* The `tsx watch` argument list for the backend (unquoted).
+*
+* One save of a collection file must restart the backend once. The runtime
+* `import()`s the collections, so tsx tracks them as dependencies and used to
+* restart the moment a file was saved — before dev had regenerated
+* `schema.generated.ts`. That boot warned "schema.generated.ts no longer
+* describes the database … Run `rebase schema generate`", telling the reader to
+* run what dev was running at that moment, and the regeneration then rewrote
+* the file and restarted the backend a second time. So tsx is told to leave the
+* collections directory alone (`--exclude` wins over its dependency tracking),
+* and dev restarts the backend itself, once, after the regeneration — through
+* `restartTrigger`, which tsx watches.
+*
+* Every included directory also gets tsx's own default ignores, made absolute.
+* tsx resolves those defaults (`**\/node_modules/**`, `**\/.*`, …) against its
+* cwd, which is `backend/`, so they never reached `config/`, a sibling: chokidar
+* walked `config/node_modules` — following symlinks — before tsx spawned the
+* backend at all, and kept every file in it watched. In the monorepo's example
+* app that was 17 s before the first backend line and 1,400 open files, and any
+* install (or another checkout's Vite build writing `.vite-temp` deep inside
+* that tree) restarted the backend. A `.DS_Store` or an editor swap file in
+* `config/` restarted it too.
+*/
+function devWatchArgs(projectRoot, paths, entryTarget, restartTrigger) {
+	const args = ["watch"];
+	const glob = (dir) => dir.split(path.sep).join("/");
+	for (const dir of devWatchIncludes(projectRoot, paths)) {
+		args.push("--include", dir);
+		for (const ignored of TSX_DEFAULT_IGNORES) args.push("--exclude", `${glob(dir)}/${ignored}`);
+	}
+	if (restartTrigger) {
+		args.push("--include", restartTrigger);
+		args.push("--exclude", `${glob(devCollectionsDir(projectRoot))}/**`);
+	}
+	args.push("--conditions", "development", entryTarget);
+	return args;
+}
+/**
+* The databases the project declares beyond the default, by key.
+*
+* Read from the graph, so `database("analytics")` in `config/resources.ts`
+* is enough for `rebase dev` to serve a second database — the declaration is
+* the request. A config that does not evaluate is the backend's problem to
+* report, in the terms it already uses; here it means "no additional
+* databases", not a refusal to start.
+*/
+async function declaredAdditionalDatabases(projectRoot) {
+	try {
+		const backend = findBackendApp(loadManifest(projectRoot).manifest);
+		if (!backend) return [];
+		const { deriveResourceGraph, deriveOptionsFor } = await import("./derive-RPIsAVO4.js").then((n) => n.i);
+		const { graph } = await deriveResourceGraph({
+			...deriveOptionsFor(projectRoot, backend.app),
+			cronsDir: void 0,
+			functionsDir: void 0
+		});
+		return graph.resources.filter((r) => r.kind === "database" && r.transport === "server" && r.key !== DEFAULT_RESOURCE_KEY).map((r) => r.key);
+	} catch {
+		return [];
+	}
+}
+/** Well-known filename the backend writes its actual port to. */
+var DEV_PORT_FILENAME = ".rebase-dev-port";
+/**
+* Compute a deterministic port from the project root path.
+* Range: 3001–3999 (avoids privileged ports and common services).
+* Two different project directories will almost always get different ports.
+*/
+function getProjectPort(projectRoot) {
+	let hash = 0;
+	for (let i = 0; i < projectRoot.length; i++) hash = (hash << 5) - hash + projectRoot.charCodeAt(i) | 0;
+	return 3001 + Math.abs(hash) % 999;
+}
+/** What the banner says after the port, naming the rung. */
+var START_PORT_SOURCE_LABELS = {
+	"--port": "from --port",
+	PORT: "from PORT",
+	affinity: "kept from the last run",
+	derived: "derived"
+};
+/**
+* A TCP port, or `undefined` for anything that is not one.
+*
+* One predicate for both sources below. The port file was already checked for
+* range, and `PORT` — the source a human or a platform actually sets — was not,
+* so `PORT=oops` reached `parseInt` and was returned as `NaN`: the dev server
+* then bound to whatever the OS handed out and the CLI printed a URL for a port
+* nothing was listening on.
+*/
+function parsePort(raw) {
+	if (raw === void 0) return void 0;
+	const port = Number(raw.trim());
+	if (!Number.isInteger(port) || port <= 0 || port >= 65536) return void 0;
+	return port;
+}
+/**
+* The port this project's backend starts on, and the rung that decided it:
+* 1. `--port` (highest priority)
+* 2. `PORT` **in the shell environment** — a `PORT` in `.env` is not read here
+* 3. the port a previous run saved in `.rebase-dev-port` (affinity)
+* 4. a port derived from the project path, unique per project
+*/
+function resolveStartPort(projectRoot, explicitPort) {
+	if (explicitPort) return {
+		port: explicitPort,
+		source: "--port"
+	};
+	if (process.env.PORT) {
+		const fromEnv = parsePort(process.env.PORT);
+		if (fromEnv !== void 0) return {
+			port: fromEnv,
+			source: "PORT"
+		};
+		console.warn(chalk.yellow(`  ⚠ Ignoring PORT="${process.env.PORT}" — not a port between 1 and 65535.`));
+	}
+	try {
+		const portFile = path.join(projectRoot, DEV_PORT_FILENAME);
+		if (fs.existsSync(portFile)) {
+			const saved = parsePort(fs.readFileSync(portFile, "utf-8"));
+			if (saved !== void 0) return {
+				port: saved,
+				source: "affinity"
+			};
+		}
+	} catch {}
+	return {
+		port: getProjectPort(projectRoot),
+		source: "derived"
+	};
+}
+/**
+* Where a connection string actually points, as `host:port/name`.
+*
+* The banner used to name the database only by *provenance* — "your database
+* (DATABASE_URL in the environment)" — and the boot that follows it writes
+* thirty DDL statements. Which host, which port, which database name appeared
+* nowhere on the success path; only a *failed* connection printed an address.
+* So the one question after pointing a project at staging by accident — did it
+* touch staging? — had no answer in a hundred and twenty lines of output.
+*
+* The password is never in it. `new URL` keeps the credentials in their own
+* fields, so building the string out of `hostname`, `port` and `pathname`
+* cannot carry them by accident, which string surgery on a DSN reliably does.
+*
+* A DSN with no host is a UNIX socket (`postgresql:///app?host=/tmp`), and the
+* socket directory is the address there.
+*
+* Returns null for anything that is not a parseable URL rather than guessing:
+* a banner line that is wrong about the database is worse than one that is
+* missing.
+*
+* Exported for its test.
+*/
+function databaseEndpoint(url) {
+	if (!url) return null;
+	let parsed;
+	try {
+		parsed = new URL(url);
+	} catch {
+		return null;
+	}
+	const host = parsed.hostname || parsed.searchParams.get("host");
+	if (!host) return null;
+	const name = parsed.pathname.replace(/^\//, "");
+	return `${host}${parsed.port ? `:${parsed.port}` : ""}${name ? `/${name}` : ""}`;
+}
+/**
+* Read {@link DevStaticShape} out of a loaded manifest. Exported for its test.
+*
+* Which declared app is running is decided by its `root` being `frontend/`,
+* because that directory is what `startFrontend` launches and nothing else is.
+* When no declared app has that root, which app serves the CMS cannot be told,
+* and it is read as the frontend that does run — what the banner has always
+* assumed, and right for every project `rebase init` scaffolds.
+*/
+function devStaticShape(manifest, projectRoot, frontendDir) {
+	const statics = [];
+	for (const [name, app] of Object.entries(manifest.apps ?? {})) if (app.type === "static") statics.push([name, app]);
+	let served;
+	if (frontendDir) {
+		const running = path.resolve(frontendDir);
+		const match = statics.find(([, app]) => path.resolve(projectRoot, app.root) === running);
+		if (match) served = {
+			appName: match[0],
+			address: staticAppAddress(match[0], match[1])
+		};
+	}
+	const mount = cmsMountOf(manifest);
+	return {
+		declaresStaticApp: statics.length > 0,
+		...served ? { served } : {},
+		...mount ? { cms: {
+			appName: mount.appName,
+			path: mount.path,
+			...mount.host ? { host: mount.host } : {},
+			servedLocally: served ? served.appName === mount.appName : true
+		} } : {}
+	};
+}
+/**
+* The banner's lines for a project with a frontend. Exported for its test.
+*
+* Every address is printed whole, once: the local one Vite answers on, and —
+* for an app with a hostname — the https URL it answers on once deployed, on a
+* line of its own beneath it. A CMS in an app `rebase dev` does not run gets its
+* deployed address and a note saying so, rather than a localhost URL that the
+* running frontend's SPA fallback would answer with the wrong app.
+*/
+function appBannerLines(frontendUrl, api, shape) {
+	const deployedNote = (address) => ["         ", `${address} when deployed`];
+	const lines = [
+		["", ""],
+		["✦ Rebase is ready!", ""],
+		["➜ Admin: ", frontendUrl]
+	];
+	const servedDeployed = shape.served?.address.host ? formatAppAddress(shape.served.address) : void 0;
+	if (servedDeployed) lines.push(deployedNote(servedDeployed));
+	lines.push(["➜ API:   ", api]);
+	const cms = shape.cms;
+	if (!cms) return lines;
+	const cmsDeployed = cms.host ? formatAppAddress({
+		host: cms.host,
+		path: cms.path
+	}) : void 0;
+	if (!cms.servedLocally) {
+		lines.push(["➜ CMS:   ", cmsDeployed ?? cms.path]);
+		lines.push(["         ", `(app "${cms.appName}" — rebase dev only starts frontend/)`]);
+		return lines;
+	}
+	if (cms.path === "/" && cmsDeployed === servedDeployed) return lines;
+	lines.push(["➜ CMS:   ", cms.path === "/" ? frontendUrl : `${frontendUrl.replace(/\/$/, "")}${cms.path}`]);
+	if (cmsDeployed) lines.push(deployedNote(cmsDeployed));
+	return lines;
+}
+/**
+* The `↳ Database =` line: which database, why it was chosen, and where it is.
+*
+* Provenance alone was what this line said, and the boot underneath it applies
+* schema. "your database (DATABASE_URL in the environment)" and "Applied 30
+* additive schema change(s) before boot" together still do not answer the
+* question somebody asks after pointing a project at staging by accident.
+*
+* The managed database gets its address too — the daemon's port is what a
+* `psql` in another terminal needs, and it is nowhere else in the banner.
+*
+* Exported for its test.
+*/
+function databaseBannerValue(prepared) {
+	if (!prepared) return "none (--no-db) — the backend needs DATABASE_URL";
+	const endpoint = databaseEndpoint(prepared.database.kind === "managed" ? prepared.env.DATABASE_URL : prepared.database.url);
+	return endpoint ? `${prepared.description} · ${endpoint}` : prepared.description;
+}
+/**
+* Refuse a port the developer named and something else already answers on.
+*
+* `--port` used to be advice, not an instruction: `resolveStartPort` returned
+* the number, the banner printed it, and the server then walked past the
+* collision to 3141, 3142. Because dev ports are derived per project, the
+* number typed into `--port` is very often *another Rebase backend*, so the
+* curl that followed answered 200 from the wrong project rather than refusing
+* — the one failure mode a port collision is supposed to rule out.
+*
+* Asked here as well as in the server (`listenWithPortRetry`'s `explicit`
+* option, which `REBASE_DEV_PORT_EXPLICIT` below turns on) so the refusal
+* arrives before a database is started and a schema is pushed, rather than a
+* minute later underneath them.
+*
+* Both loopback addresses, because a listener on `::1` alone is the same
+* collision and costs one more connect to rule out. Returns the sentence to
+* print, or `null` when there is nothing to refuse.
+*
+* Exported for its test.
+*/
+async function pinnedPortRefusal(port, pinned) {
+	if (!pinned) return null;
+	if (!(await Promise.all([probeTcp("127.0.0.1", port), probeTcp("::1", port)])).some(Boolean)) return null;
+	return `Port ${port} is in use, and you asked for it with --port. Stop whatever is listening on ${port}, or pass a different port. (Without --port, dev derives a port for this project and walks past a collision.)`;
+}
+/**
+* The frontend port for this project, derived the same way the backend's is.
+*
+* `rebase dev` used to leave this entirely to Vite, which takes 5173 and, when
+* that is busy, silently walks to 5174, 5175 and onward. The backend was then
+* started with whatever `FRONTEND_URL` the scaffold's `.env` happened to say —
+* `http://localhost:5173` — so the welcome email linked a port the app was not
+* on. Deriving it here means the value handed to the backend describes the
+* server we are about to start rather than a default nobody checked.
+*
+* Range 5173–5372, so the familiar port is still the common case for a single
+* project and two projects rarely collide.
+*
+* Note this is passed to Vite WITHOUT `--strictPort` unless the developer
+* pinned it explicitly. Vite keeps its fallback, so a busy port still starts —
+* it just starts somewhere the email link does not name, which is exactly
+* today's behaviour and no worse. Pinning REBASE_FRONTEND_PORT makes both
+* exact.
+*/
+function getProjectFrontendPort(projectRoot) {
+	let hash = 0;
+	for (let i = 0; i < projectRoot.length; i++) hash = (hash << 5) - hash + projectRoot.charCodeAt(i) | 0;
+	return 5173 + Math.abs(hash) % 200;
+}
+/**
+* The flags `rebase dev` takes.
+*
+* Exported so `dev.test.ts` can assert that every short alias the help
+* advertises is declared here: the help said `--port, -p` while the spec has
+* only ever declared `-P`, so `rebase dev -p 4000` typed straight off the help
+* page passed `4000` as a positional and started on the default port.
+*/
+var DEV_FLAGS = {
+	"--backend-only": Boolean,
+	"--frontend-only": Boolean,
+	"--port": Number,
+	/**
+	* Point this run at a database of your own, ahead of everything else.
+	*
+	* The managed development database fills a vacuum; it never redirects a
+	* project that has said which Postgres it wants. This flag is the loudest
+	* way to say it, and outranks DATABASE_URL in the environment and in .env.
+	*/
+	"--database-url": String,
+	/** Use Postgres in Docker rather than the managed database. */
+	"--docker": Boolean,
+	"-b": "--backend-only",
+	"-f": "--frontend-only",
+	"-P": "--port",
+	"--no-db": Boolean
+};
+/**
+* Read one variable out of the project's env file.
+*
+* `dotenv.parse` rather than `dotenv.config`, because this must not put the
+* project's secrets into the CLI process's own environment — the child
+* processes are given the env file by path and read it themselves.
+*/
+function readEnvVar(projectRoot, name) {
+	const envFile = findEnvFile(projectRoot);
+	if (!envFile || !fs.existsSync(envFile)) return void 0;
+	try {
+		return dotenv.parse(fs.readFileSync(envFile))[name] || void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Whether this project declares collections at all.
+*
+* A project with none has no schema to generate or push — the headless BaaS
+* mode serves whatever the database already has.
+*/
+function projectHasCollections(projectRoot) {
+	const collectionsDir = path.join(projectRoot, "config", "collections");
+	return fs.existsSync(collectionsDir) && fs.readdirSync(collectionsDir).some((name) => /\.(ts|js|mts|mjs)$/.test(name) && !name.startsWith("index."));
+}
+/**
+* Make the generated Drizzle schema match the collections before anything reads it.
+*
+* ## The bug this exists for
+*
+* The scaffold ships `backend/src/schema.generated.ts` as a stub — `export const
+* tables = {}` — and something has to replace it. On the Docker path
+* `rebase db push` did, as step one of three. On the **managed PGlite path
+* nothing did**, and that is the path a new project takes, because `rebase init`
+* deliberately leaves `DATABASE_URL` commented out.
+*
+* The result was the worst shape a first run can have: the database was fine.
+* Boot created all 30 tables through the additive ensure, `/health` answered
+* 200, auth worked, the admin panel loaded — and every single
+* `GET /api/data/*` returned a 500, `Table not found for collection 'posts'`,
+* because the driver looked the table up in the generated file rather than in
+* the database. A stranger following the README had no way to guess that
+* `pnpm run schema:generate` was the missing step, and the README told them the
+* schema was pushed for them.
+*
+* That failure is fixed at the root — the driver builds its tables from
+* `information_schema` now, so a stub `schema.generated.ts` cannot empty the
+* API. This still runs, because the file is a real artifact for everything
+* around the server: `db push` diffs it, Atlas plans from it, `eject` writes it
+* out, and application code imports it.
+*
+* ## Why it runs unconditionally
+*
+* Generation reads collection files and writes one file. It needs no database,
+* it is idempotent, and it takes about two seconds. Making it a precondition of
+* starting the dev server — rather than a side effect of one database path —
+* is what makes "the generated schema matches the collections" true by
+* construction instead of true by remembering. The same staleness bites a
+* project whose database was already running, where the push never ran either.
+*
+* Failure is not fatal: the server still starts, and it will report the real
+* problem itself. A dev server that refuses to boot because codegen failed is
+* worse than one that boots and says so.
+*/
+async function ensureGeneratedSchema(projectRoot) {
+	if (!projectHasCollections(projectRoot)) return "skipped";
+	try {
+		await runDriverSchemaCommand([
+			"node",
+			"rebase",
+			"schema",
+			"generate"
+		], { quiet: true });
+		return "generated";
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		console.log(`  ${chalk.yellow("⚠")} ${chalk.gray(`Could not regenerate the database schema: ${message}`)}`);
+		console.log(`  ${chalk.gray(`Run ${chalk.cyan("rebase schema generate")} to see why. Collection reads will fail until it succeeds.`)}`);
+		return "failed";
+	}
+}
+/**
+* Whether dev must still run the driver's `schema stale --fix` before the
+* backend boots.
+*
+* Not after a regeneration that succeeded: that wrote `schema.generated.ts`
+* from these collections with this driver, moments earlier, and `stale`
+* compares the file against the same generator — it can only answer "nothing
+* stale", and it cost a driver process (~0.6 s) on every start. The repair it
+* exists for, a library upgrade that changed what the generator derives, is
+* exactly what the regeneration already did. When generation was skipped or
+* failed, the preflight is the remaining safety net and still runs.
+*/
+function needsStaleSchemaPreflight(generation) {
+	return generation !== "generated";
+}
+/**
+* Make `generated/sdk` match the collections, the same way the schema is kept.
+*
+* This used to happen only under `--generate`, and `generated/` is gitignored,
+* so a fresh clone had no SDK types at all until someone ran
+* `rebase generate-sdk`, and every collection edit left the typed client one
+* step behind. A frontend compiling against a `Database` type that no longer
+* describes the backend is the drift this whole command exists to prevent.
+*
+* A child process rather than a call into `generateSdkCommand`: that loads the
+* collections through jiti, whose module cache would hand the second
+* regeneration the collections the first one loaded. And this CLI re-run
+* directly, not `pnpm exec rebase`: the package manager's pre-run dependency
+* check can start an install on every save, and its `rebase` is whichever one
+* it resolves, not necessarily the one running `dev`.
+*
+* The generator's own output is a usage guide meant for a person who ran it by
+* hand, so it is captured, and on failure only the lines that say what went
+* wrong are shown — not the stack under them. Like the schema, a failure never
+* stops `dev`.
+*/
+async function regenerateSdk(projectRoot) {
+	if (!projectHasCollections(projectRoot)) return;
+	const entry = resolveCliEntry();
+	const { execPath, prefixArgs } = resolveSpawn(entry);
+	try {
+		await execa(execPath, [
+			...prefixArgs,
+			entry,
+			"generate-sdk"
+		], {
+			cwd: projectRoot,
+			all: true
+		});
+	} catch (error) {
+		const cause = (typeof error === "object" && error !== null && "all" in error && typeof error.all === "string" ? error.all : "").split("\n").filter((line) => line.trim() && !/^\s+at /.test(line)).slice(-6);
+		console.log(`  ${chalk.yellow("⚠")} ${chalk.gray("Could not regenerate the SDK types in generated/sdk.")}`);
+		if (cause.length > 0) console.log(chalk.gray(cause.map((line) => `    ${line.trim()}`).join("\n")));
+		console.log(`  ${chalk.gray(`Run ${chalk.cyan("rebase generate-sdk")} to see why.`)}`);
+	}
+}
+/**
+* One variable's value out of `.env` text, or undefined when it has none.
+*
+* The obvious `\s*(.+?)\s*$` does not do this, because `\s` matches a newline
+* and `$` under /m matches at every line end: on `VITE_API_URL=` followed by
+* `# VITE_GOOGLE_CLIENT_ID=`, the leading `\s*` ate the line break and the
+* capture returned the *next* line. The scaffold ships `VITE_API_URL=` empty,
+* so every first `rebase dev` read a comment as its value, decided it differed
+* from the derived URL, and warned that a variable the developer had not set
+* was being ignored.
+*
+* Horizontal whitespace only, so a value stops at its own line.
+*/
+function readEnvValue(envText, key) {
+	const match = envText.match(new RegExp(`^[^\\S\\r\\n]*${key}[^\\S\\r\\n]*=[^\\S\\r\\n]*(.*?)[^\\S\\r\\n]*$`, "m"));
+	if (!match) return void 0;
+	const value = match[1].replace(/^["']|["']$/g, "");
+	return value.length > 0 ? value : void 0;
+}
+/**
+* The argv the first-boot schema push runs with.
+*
+* The database is named on the command line rather than left to be re-resolved.
+* `runDriverDbCommand` runs the resolver again for whatever argv it is handed,
+* and the argv it used to be handed (`["node","rebase","db","push"]`) carried
+* nothing at all — so on the `--docker` path it read a `.env` whose
+* `DATABASE_URL` is commented out, concluded "managed PGlite", and refused the
+* push for a database that was not the one the preflight had just started.
+*
+* Exported for its test: the missing pair of arguments is the whole defect, and
+* it is invisible in any assertion about the push's *outcome*.
+*/
+function schemaPushArgv(databaseUrl) {
+	const argv = [
+		"node",
+		"rebase",
+		"db",
+		"push"
+	];
+	if (databaseUrl) argv.push("--database-url", databaseUrl);
+	return argv;
+}
+/**
+* Start-up's independent halves, overlapped rather than run one after another.
+*
+* `rebase dev` used to regenerate the schema and the SDK, then derive the
+* resource graph (every collection evaluated again, in this process), then
+* start the managed database and wait for it — about a second when it was not
+* already running — and only then spawn the backend. None of the three reads
+* what another writes: the generators read `config/` and write
+* `backend/src/schema.generated.ts` and `generated/sdk/`; the derivation reads
+* `config/resources.ts` and the collections; the database needs neither, and
+* `schema generate` never connects to one. So `database` starts first and is
+* collected last.
+*
+* `preflight` is the exception, and the reason this is not one `Promise.all`:
+* on the `--docker` path it pushes the schema the generators have just written,
+* so it still runs after them.
+*
+* A database that fails to start is reported where it always was — after the
+* generators' and the preflight's output — rather than ahead of it, and it is
+* never an unhandled rejection while they run.
+*
+* Exported for its test.
+*/
+async function overlapDevStartup(steps) {
+	const database = steps.database ? steps.database().then((value) => ({
+		ok: true,
+		value
+	}), (error) => ({
+		ok: false,
+		error
+	})) : null;
+	const schemaGeneration = await steps.generate();
+	await steps.preflight();
+	const settled = database ? await database : null;
+	if (settled && !settled.ok) throw settled.error;
+	return {
+		schemaGeneration,
+		database: settled ? settled.value : null
+	};
+}
+/**
+* The database half of `rebase dev` starting up.
+*
+* Separated from `ensureDevDatabase` so that everything needing a project on
+* disk lives here and the decision logic stays testable without one.
+*/
+async function runDatabasePreflight(options) {
+	const { projectRoot, disabled } = options;
+	const hasCollections = projectHasCollections(projectRoot);
+	const databaseUrl = options.databaseUrl ?? readEnvVar(projectRoot, "DATABASE_URL");
+	if ((await ensureDevDatabase({
+		projectRoot,
+		databaseUrl,
+		disabled,
+		hasCollections,
+		pushSchema: async () => {
+			await runDriverDbCommand(schemaPushArgv(databaseUrl), { quiet: true });
+		}
+	})).action === "started") console.log("");
+}
+/**
+* Kill a child `rebase dev` started, with everything it started in turn.
+*
+* Both servers run detached, in a process group of their own, behind a shell
+* and a package manager — so the group is what has to go, not the pid.
+*/
+function killChildTree(child) {
+	if (child.killed) return;
+	try {
+		if (!child.pid) throw new Error("no pid");
+		if (process.platform === "win32") execaCommandSync(`taskkill /pid ${child.pid} /T /F`);
+		else process.kill(-child.pid, "SIGKILL");
+	} catch {
+		try {
+			child.kill("SIGKILL");
+		} catch {}
+	}
+}
+/**
+* The port the last `rebase dev` backend landed on, from `.rebase-dev-port`.
+*
+* Read the way the server reads it (`listenWithPortRetry`): the first number,
+* whether the file is the server's `<bound> <requested>` or the CLI's bare
+* `<bound>`. `null` when there is no file or no number in it.
+*/
+function rememberedDevPort(projectRoot) {
+	try {
+		const raw = fs.readFileSync(path.join(projectRoot, DEV_PORT_FILENAME), "utf-8").trim().split(/\s+/)[0];
+		return parsePort(raw) ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Whether the admin panel can start beside the backend instead of after it.
+*
+* Vite has to be told the backend's URL when it starts (`VITE_API_URL`), and
+* the backend's port is only certain once it has bound — so the admin panel
+* used to wait for "Server running at", and the time to it was the backend's
+* whole boot plus Vite's start. It can start beside the backend whenever the
+* port the backend will bind is known in advance:
+*
+* - **named with `--port`**: the server binds it or refuses to start, never
+*   walks past it (`REBASE_DEV_PORT_EXPLICIT`), and `pinnedPortRefusal` has
+*   already checked that nothing answers there;
+* - **free, and the port the backend tries first**: the server tries the port
+*   its last run landed on before the one it is given (`.rebase-dev-port`), so
+*   a remembered port must be this one — the "kept from the last run" rung —
+*   or absent, which it is after every clean exit, and the derived port is
+*   then the one tried. A port something already answers on would make the
+*   backend move, so that case keeps the old order.
+*
+* Nothing here can rule out another process taking the port in the second the
+* backend boots, so `devCommand` still compares the announced port with the
+* one Vite was given and restarts the admin panel when they differ.
+*
+* Exported for its test.
+*/
+async function frontendCanStartWithBackend(options) {
+	if (options.pinned) return true;
+	const remembered = rememberedDevPort(options.projectRoot);
+	if (remembered !== null && remembered !== options.port) return false;
+	const probe = options.probe ?? probeTcp;
+	return !(await Promise.all([probe("127.0.0.1", options.port), probe("::1", options.port)])).some(Boolean);
+}
+/**
+* The tsx the backend is watched with, or exit saying why there is none.
+*
+* Checked before anything is started rather than just before the backend
+* spawns: start-up begins the database at once now, and a project whose
+* dependencies are missing should hear that first, not after two generators
+* have each failed on the same cause.
+*/
+function requireUsableTsx(projectRoot) {
+	const tsxBin = resolveTsx(projectRoot);
+	if (!tsxBin) {
+		console.error(chalk.red(`  ✗ ${dependenciesNotInstalled(projectRoot)}`));
+		process.exit(1);
+	}
+	const tsxValidationError = validateTsxInstallation(tsxBin);
+	if (tsxValidationError) {
+		const installCmd = getPMCommands(detectPackageManager(projectRoot)).install.join(" ");
+		console.error(chalk.red("  ✗ tsx installation appears corrupted."));
+		console.error(chalk.gray(`    ${tsxValidationError}`));
+		console.error("");
+		console.error(chalk.gray("    To fix, run:"));
+		console.error(chalk.cyan(`      rm -rf node_modules && ${installCmd}`));
+		process.exit(1);
+	}
+	return tsxBin;
+}
+async function devCommand(rawArgs) {
+	if (wantsHelp(rawArgs)) {
+		printDevHelp();
+		return;
+	}
+	if (rawArgs.includes("--generate") || rawArgs.includes("-g")) throw new UsageError("`rebase dev --generate` is gone: dev now regenerates the schema and the SDK types on every start and every collection save. Drop the flag.");
+	const { flags: args } = parseCommandArgs({
+		spec: DEV_FLAGS,
+		rawArgs,
+		commandWords: 1,
+		command: "dev",
+		maxPositionals: 0
+	});
+	const projectRoot = requireProjectRoot();
+	recordEvent("cli.dev", {
+		backend_only: Boolean(args["--backend-only"]),
+		frontend_only: Boolean(args["--frontend-only"])
+	}, { projectRoot });
+	const backendDir = findBackendDir(projectRoot);
+	const frontendDir = findFrontendDir(projectRoot);
+	const backendOnly = args["--backend-only"] || false;
+	const frontendOnly = args["--frontend-only"] || false;
+	/**
+	* Start no database at all — not the compose container, and not the managed
+	* one either. Read once, here, because both halves of `dev` have to agree:
+	* gating only the preflight left the managed PGlite starting anyway, which
+	* is the one database a scaffolded project would otherwise get.
+	*/
+	const noDb = Boolean(args["--no-db"]) || parseEnvBoolean(process.env.REBASE_DEV_NO_DB) === true;
+	const { port: startPort, source: startPortSource } = resolveStartPort(projectRoot, args["--port"]);
+	const portIsPinned = args["--port"] !== void 0;
+	const pinnedFrontendPort = process.env.REBASE_FRONTEND_PORT;
+	if (pinnedFrontendPort && !/^\d+$/.test(pinnedFrontendPort)) throw new Error(`REBASE_FRONTEND_PORT must be a number, got ${JSON.stringify(pinnedFrontendPort)}.`);
+	const frontendPort = pinnedFrontendPort ? Number(pinnedFrontendPort) : getProjectFrontendPort(projectRoot);
+	if (!frontendOnly) {
+		const refusal = await pinnedPortRefusal(startPort, portIsPinned);
+		if (refusal) {
+			console.error(chalk.red(`  ✗ ${refusal}`));
+			process.exit(1);
+		}
+	}
+	const startsBackend = !frontendOnly && Boolean(backendDir);
+	const tsxBin = startsBackend ? requireUsableTsx(projectRoot) : null;
+	console.log("");
+	console.log(chalk.bold("  🚀 Rebase Dev Server"));
+	console.log("");
+	let schemaGeneration = "skipped";
+	/**
+	* The database this run's backend gets. A project with a DATABASE_URL is
+	* untouched; a project without one gets a managed Postgres, which is what
+	* makes `rebase dev` the only command a new project needs.
+	*
+	* `--no-db` means start nothing, and that includes the managed database.
+	* It used to gate only the preflight, so the one path that actually starts
+	* a database on a scaffolded project — the managed PGlite — ran anyway:
+	* `rebase dev --no-db` wrote `.rebase/pglite/`, booted a daemon and served
+	* against it, which is the opposite of what a reader asking for no database
+	* expects. The backend is left to fail on the DATABASE_URL it cannot find,
+	* which is the failure the flag exists to produce.
+	*/
+	let prepared = null;
+	if (!frontendOnly) ({schemaGeneration, database: prepared} = await overlapDevStartup({
+		generate: async () => (await Promise.all([ensureGeneratedSchema(projectRoot), regenerateSdk(projectRoot)]))[0],
+		preflight: () => runDatabasePreflight({
+			projectRoot,
+			disabled: noDb,
+			databaseUrl: args["--docker"] ? resolveComposeUrl(projectRoot, readEnvFile(projectRoot)) ?? void 0 : void 0
+		}),
+		database: startsBackend && !noDb ? async () => prepareDatabaseEnv(projectRoot, {
+			flagUrl: typeof args["--database-url"] === "string" ? args["--database-url"] : null,
+			flagDocker: Boolean(args["--docker"]),
+			onProgress: (message) => console.log(chalk.gray(`  ${message}`)),
+			additionalKeys: await declaredAdditionalDatabases(projectRoot)
+		}) : null
+	}));
+	const children = [];
+	/**
+	* Whether this project has an admin panel to serve at all.
+	*
+	* A headless project declares one app, of type "backend", so there is no
+	* `frontend/` and never will be. Warning that a directory is "missing" for
+	* a shape that has no such directory reads as a broken scaffold on the
+	* very first run of the very command the headless quickstart names.
+	*/
+	const staticShape = (() => {
+		try {
+			return devStaticShape(loadManifest(projectRoot).manifest, projectRoot, frontendDir);
+		} catch {
+			return { declaresStaticApp: Boolean(frontendDir) };
+		}
+	})();
+	const declaresStaticApp = staticShape.declaresStaticApp;
+	let frontendUrl = "";
+	let backendUrl = "";
+	let debounceSummary = null;
+	let bannerPrinted = false;
+	/** Actual backend port, resolved once the server prints its URL. */
+	let resolvedBackendPort = null;
+	/**
+	* The connection string of the database this run started, when it started
+	* one. Filled in below; read by the headless banner, which is the only
+	* place a headless project could learn it — there is no admin panel to
+	* open, and `.env` deliberately does not name the managed database.
+	*/
+	let managedConnectionString = null;
+	/**
+	* Where the backend mounted Swagger, if it mounted it at all.
+	*
+	* Read from the backend's own log rather than assumed: a headless project
+	* with no tables yet serves no data API and no Swagger, and the banner must
+	* not name a URL that answers 404.
+	*/
+	let swaggerPath = null;
+	function printSummary() {
+		if (!backendUrl) return;
+		if (declaresStaticApp && !frontendUrl) return;
+		if (debounceSummary) clearTimeout(debounceSummary);
+		debounceSummary = setTimeout(() => {
+			if (bannerPrinted) return;
+			const api = `http://localhost:${resolvedBackendPort}`;
+			/** `[label, value]` per line; an empty pair is a blank line. */
+			const lines = declaresStaticApp ? appBannerLines(stripAnsi(frontendUrl), api, staticShape) : [
+				["", ""],
+				["✦ Rebase API is ready!", ""],
+				["➜ API:      ", api]
+			];
+			if (!declaresStaticApp) {
+				if (swaggerPath) lines.push(["➜ Swagger:  ", `${api}${swaggerPath}`]);
+				else lines.push(["  ", "(no tables served yet, so no data API and no docs)"]);
+				if (managedConnectionString) {
+					lines.push(["", ""]);
+					lines.push(["Database (managed, this project only):", ""]);
+					lines.push(["  ", managedConnectionString]);
+					lines.push(["  ", "also: rebase db url"]);
+				}
+			}
+			lines.push(["", ""]);
+			lines.push(["First login: ", "the first account to register becomes admin"]);
+			lines.push(["  ", "(a production boot seeds REBASE_ADMIN_EMAIL from .env instead)"]);
+			lines.push(["", ""]);
+			const inner = Math.max(...lines.map(([label, value]) => label.length + value.length)) + 4;
+			console.log("");
+			console.log(chalk.cyan("┌" + "─".repeat(inner) + "┐"));
+			for (const [label, value] of lines) console.log(chalk.cyan("│  ") + label + chalk.white(value) + " ".repeat(inner - 2 - label.length - value.length) + chalk.cyan("│"));
+			console.log(chalk.cyan("└" + "─".repeat(inner) + "┘"));
+			console.log("");
+			bannerPrinted = true;
+		}, 500);
+	}
+	/**
+	* Set once Ctrl+C has been seen, so a child dying on the way out is not
+	* reported as a crash. Everything below distinguishes "the backend fell
+	* over" from "you asked me to stop" by this flag alone — an exit code of
+	* `null` with a signal is the shape of both.
+	*/
+	let shuttingDown = false;
+	const cleanup = () => {
+		shuttingDown = true;
+		try {
+			const portFile = path.join(projectRoot, DEV_PORT_FILENAME);
+			if (fs.existsSync(portFile)) fs.unlinkSync(portFile);
+			const urlFile = path.join(projectRoot, ".rebase-dev-url");
+			if (fs.existsSync(urlFile)) fs.unlinkSync(urlFile);
+		} catch {}
+		children.forEach(killChildTree);
+		process.exit(typeof process.exitCode === "number" ? process.exitCode : 0);
+	};
+	process.on("SIGINT", cleanup);
+	process.on("SIGTERM", cleanup);
+	/** The running admin panel, and the backend port it was told (`VITE_API_URL`). */
+	let frontendChild = null;
+	let frontendApiPort = null;
+	/**
+	* Start the Vite frontend, optionally injecting the backend port.
+	*/
+	function startFrontend(backendPort) {
+		if (!frontendDir) return;
+		console.log(`  ${chalk.magenta("▶")} Frontend: ${chalk.gray(frontendDir)}`);
+		const frontendEnv = { ...process.env };
+		frontendApiPort = backendPort;
+		if (backendPort) {
+			frontendEnv.VITE_API_URL = `http://localhost:${backendPort}`;
+			console.log(`  ${chalk.gray("↳ VITE_API_URL")} = ${chalk.white(`http://localhost:${backendPort}`)}`);
+		}
+		const pm = detectPackageManager(projectRoot);
+		const runDevCmd = getPMCommands(pm).run("dev");
+		/**
+		* Pin the frontend's port when asked.
+		*
+		* Vite takes 5173 and hands it to the first asker, so a machine already
+		* running one dev server gives the second either a bind failure or —
+		* worse — somebody else's app on the address you expected. The backend
+		* port has been pinnable since it had the same problem; this is the
+		* other half.
+		*
+		* npm needs `--` before script arguments and pnpm does not, which is
+		* the kind of difference that silently passes `--port` to the package
+		* manager instead of to Vite.
+		*/
+		if (pm === "npm") runDevCmd.push("--");
+		runDevCmd.push("--port", String(frontendPort));
+		if (pinnedFrontendPort) runDevCmd.push("--strictPort");
+		console.log(`  ${chalk.gray("↳ frontend port")} = ${chalk.white(String(frontendPort))}`);
+		const child = execa(runDevCmd[0], runDevCmd.slice(1), {
+			cwd: frontendDir,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			env: frontendEnv,
+			shell: true,
+			detached: process.platform !== "win32"
+		});
+		child.catch(() => {});
+		frontendChild = child;
+		forEachOutputLine(child.stdout, (line) => {
+			console.log(`${chalk.magenta.bold("[admin]")} ${line}`);
+			const cleanLine = stripAnsi(line);
+			const urlMatch = cleanLine.match(/(http:\/\/(?:localhost|127\.0\.0\.1):\d+)/);
+			if (cleanLine.includes("Local:") && urlMatch && child === frontendChild) {
+				frontendUrl = urlMatch[1];
+				printSummary();
+			}
+		});
+		forEachOutputLine(child.stderr, (line) => {
+			console.log(`${chalk.magenta.bold("[admin]")} ${line}`);
+		});
+		children.push(child);
+	}
+	/**
+	* Start the admin panel again, told the port the backend actually bound.
+	*
+	* Only reachable when it was started beside the backend
+	* ({@link frontendCanStartWithBackend}) and something took that port in the
+	* second the backend booted, so the backend moved. Left alone, the admin
+	* panel would talk to whatever now answers on the old port — very often
+	* another Rebase backend, since dev ports are derived per project.
+	*/
+	async function restartFrontend(backendPort) {
+		const stale = frontendChild;
+		frontendUrl = "";
+		console.log(`  ${chalk.gray(`↳ The backend moved from ${frontendApiPort} to ${backendPort}; restarting the admin panel on it.`)}`);
+		if (stale) {
+			frontendChild = null;
+			const index = children.indexOf(stale);
+			if (index >= 0) children.splice(index, 1);
+			killChildTree(stale);
+			await stale.then(() => void 0, () => void 0);
+			for (let attempt = 0; attempt < 30 && await probeTcp("127.0.0.1", frontendPort, 200); attempt++) await new Promise((resolve) => setTimeout(resolve, 100));
+		}
+		if (!shuttingDown) startFrontend(backendPort);
+	}
+	if (startsBackend && backendDir && tsxBin) {
+		const envFile = findEnvFile(projectRoot);
+		const env = { ...process.env };
+		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
+		if (prepared) Object.assign(env, prepared.env);
+		/**
+		* Whether this run is on the managed database.
+		*
+		* `db push` is the remedy for what boot leaves alone, and it cannot run
+		* against the managed one at all — Atlas plans by diffing against a
+		* second, empty database, and PGlite serves exactly one. So every
+		* remedy that names it has to know which database is under this run.
+		*/
+		const managed = prepared?.database.kind === "managed";
+		if (managed) managedConnectionString = prepared?.env.DATABASE_URL ?? null;
+		if (prepared) env[DEV_DATABASE_KIND_ENV] = prepared.database.kind;
+		env.PORT = String(startPort);
+		env.REBASE_DEV_PORT_EXPLICIT = String(portIsPinned);
+		if (!backendOnly && frontendDir) env.FRONTEND_URL = `http://localhost:${frontendPort}`;
+		console.log(`  ${chalk.cyan("▶")} Backend:  ${chalk.gray(backendDir)}`);
+		console.log(`  ${chalk.gray("↳ PORT")} = ${chalk.white(String(startPort))} ${chalk.gray(`(${START_PORT_SOURCE_LABELS[startPortSource]})`)}`);
+		console.log(`  ${chalk.gray("↳ Database")} = ${chalk.white(databaseBannerValue(prepared))}`);
+		if (prepared) for (const line of managedNotices(prepared).slice(1)) console.log(`  ${chalk.gray(line)}`);
+		if (envFile) try {
+			const envText = fs.readFileSync(envFile, "utf-8");
+			const envPort = readEnvValue(envText, "PORT");
+			const envApiUrl = readEnvValue(envText, "VITE_API_URL");
+			const overridden = [];
+			if (Boolean(envPort) && envPort !== String(3001) && envPort !== String(startPort)) overridden.push("PORT");
+			if (envApiUrl && envApiUrl !== `http://localhost:${startPort}`) overridden.push("VITE_API_URL");
+			if (overridden.length > 0) console.log(chalk.yellow(`  ⚠ dev uses a derived per-project port (${startPort}); your .env ${overridden.join(" / ")} ${overridden.length > 1 ? "are" : "is"} ignored here (avoids cross-project collisions). Pass ${chalk.white("--port")} to pin a port.`));
+		} catch {}
+		/** Whether the frontend has been launched (we only launch it once). */
+		let frontendLaunched = false;
+		/**
+		* Whether the backend's first "Server running at" has been compared
+		* with the port an admin panel started beside it was given. Once:
+		* where a later restart lands is the watcher's business, as before.
+		*/
+		let frontendPortChecked = false;
+		try {
+			const activePlugin = getActiveBackendPlugin(backendDir);
+			const pluginCli = activePlugin ? resolvePluginCliScript(backendDir, activePlugin) : null;
+			if (pluginCli && needsStaleSchemaPreflight(schemaGeneration)) await execa(tsxBin, [
+				pluginCli,
+				"schema",
+				"stale",
+				"--fix"
+			], {
+				cwd: backendDir,
+				stdio: "inherit",
+				env
+			});
+		} catch {}
+		const ejectedEntry = path.join(backendDir, "src", "index.ts");
+		const usesStockRuntime = !fs.existsSync(ejectedEntry);
+		const entryTarget = usesStockRuntime ? resolveDevRuntimeEntry() : "src/index.ts";
+		const runtimePaths = devRuntimeEnv(projectRoot);
+		if (usesStockRuntime) Object.assign(env, runtimePaths);
+		const restartTrigger = devRestartTrigger(projectRoot);
+		if (restartTrigger) try {
+			fs.mkdirSync(path.dirname(restartTrigger), { recursive: true });
+			fs.writeFileSync(restartTrigger, String(Date.now()));
+		} catch {}
+		const usableTrigger = restartTrigger && fs.existsSync(restartTrigger) ? restartTrigger : null;
+		const watchArgs = devWatchArgs(projectRoot, runtimePaths, entryTarget, usableTrigger).map(quoteForShell);
+		/** Restart the backend once, after dev has finished reacting to a collection save. */
+		const restartBackend = () => {
+			if (!usableTrigger) return;
+			try {
+				fs.writeFileSync(usableTrigger, String(Date.now()));
+			} catch {}
+		};
+		const generatedSchemaFile = path.resolve(projectRoot, runtimePaths.REBASE_DEV_SCHEMA);
+		/** What tsx reacts to: a write, even of identical bytes, moves the mtime. */
+		const generatedSchemaStamp = () => {
+			try {
+				const stat = fs.statSync(generatedSchemaFile);
+				return `${stat.mtimeMs}:${stat.size}`;
+			} catch {
+				return null;
+			}
+		};
+		const collectionsDir = devCollectionsDir(projectRoot);
+		if (fs.existsSync(collectionsDir)) {
+			let debounce = null;
+			let sqlSchemaAffected = false;
+			let changed = "";
+			fs.watch(collectionsDir, { recursive: true }, (_eventType, filename) => {
+				if (!filename || filename.startsWith(".") || filename.endsWith(".tmp")) return;
+				sqlSchemaAffected = sqlSchemaAffected || affectsSqlSchema(collectionsDir, filename);
+				changed = filename;
+				if (debounce) clearTimeout(debounce);
+				debounce = setTimeout(() => {
+					const regenerateSchema = sqlSchemaAffected;
+					sqlSchemaAffected = false;
+					(async () => {
+						if (!regenerateSchema) {
+							await regenerateSdk(projectRoot);
+							restartBackend();
+							return;
+						}
+						const shown = changed.length > 31 ? `…${changed.slice(-30)}` : changed.padEnd(31);
+						console.log([
+							"",
+							chalk.yellow("  ┌──────────────────────────────────────────────────────────────┐"),
+							chalk.yellow("  │  🔄 Collection file changed: ") + chalk.white(shown) + chalk.yellow("│"),
+							chalk.yellow("  │     Regenerating the schema and the SDK types…               │"),
+							chalk.yellow("  └──────────────────────────────────────────────────────────────┘")
+						].join("\n"));
+						const schemaBefore = generatedSchemaStamp();
+						await Promise.all([ensureGeneratedSchema(projectRoot), regenerateSdk(projectRoot)]);
+						if (!(usesStockRuntime && generatedSchemaStamp() !== schemaBefore)) restartBackend();
+						console.log([
+							chalk.green("  ✓ Schema and SDK types regenerated. The backend restarts and boot"),
+							chalk.green("    creates what is missing — a new collection, a new property."),
+							...managed ? [chalk.gray("    A renamed column, a narrowed type or a removed field needs your"), chalk.gray("    own PostgreSQL: set DATABASE_URL, then rebase db push.")] : [chalk.gray("    For what boot leaves alone — a renamed column, a narrowed type,"), chalk.gray(`    a removed field — run ${chalk.cyan("rebase db push")}.`)],
+							""
+						].join("\n"));
+					})();
+				}, 500);
+			});
+		}
+		if (!backendOnly && frontendDir && await frontendCanStartWithBackend({
+			projectRoot,
+			port: startPort,
+			pinned: portIsPinned
+		})) {
+			frontendLaunched = true;
+			startFrontend(startPort);
+		}
+		const backendChild = execa(tsxBin, watchArgs, {
+			cwd: backendDir,
+			stdio: [
+				"inherit",
+				"pipe",
+				"pipe"
+			],
+			env,
+			shell: true,
+			detached: process.platform !== "win32"
+		});
+		backendChild.catch(() => {});
+		/**
+		* Whether the backend ever said "Server running at".
+		*
+		* The one fact this command has about whether the thing it started
+		* works. Without it, a backend that threw on boot left `rebase dev`
+		* printing "Press Ctrl+C to stop all servers." under a stack trace, as
+		* if everything were fine — and `tsx watch` keeps its own process alive
+		* after the entry crashes, so nothing exits to contradict it.
+		*/
+		let backendAnnounced = false;
+		/** The verdict, printed once per failure rather than once per line. */
+		let backendDownReported = false;
+		const reportBackendDown = (headline) => {
+			if (shuttingDown || backendDownReported) return;
+			backendDownReported = true;
+			console.log("");
+			console.error(chalk.red(`  ✗ ${headline}`));
+			console.error(chalk.gray("    Fix the error above; the watcher restarts it on the next change."));
+			console.log("");
+			if (backendOnly) process.exitCode = 1;
+		};
+		/**
+		* Say so when the backend is not up.
+		*
+		* A deadline rather than an exit code, because there is usually no exit
+		* to watch: the watcher survives its child and waits for a file change,
+		* so a crash is visible only as an absence.
+		*
+		* Armed once at spawn and **re-armed on every restart**, which is the
+		* half that was missing. The old timer fired once, thirty seconds after
+		* start-up, and its body began `if (backendAnnounced) return` — so a
+		* backend that came up and then died on the next save was covered by
+		* nothing at all. Breaking `config/resources.ts` under a running
+		* `rebase dev` printed a stack trace, took `/health` to nothing, and
+		* left the CLI saying "Press Ctrl+C to stop all servers."
+		*/
+		const readyTimeoutMs = Number(env.REBASE_DEV_READY_TIMEOUT_MS ?? process.env.REBASE_DEV_READY_TIMEOUT_MS ?? 3e4);
+		let readyDeadline;
+		const disarmReadyDeadline = () => {
+			if (readyDeadline) clearTimeout(readyDeadline);
+			readyDeadline = void 0;
+		};
+		const armReadyDeadline = (headline) => {
+			disarmReadyDeadline();
+			if (readyTimeoutMs <= 0) return;
+			readyDeadline = setTimeout(() => {
+				if (backendAnnounced) return;
+				reportBackendDown(headline);
+			}, readyTimeoutMs);
+			readyDeadline.unref?.();
+		};
+		const readySeconds = Math.round(readyTimeoutMs / 1e3);
+		armReadyDeadline(`The backend has not started after ${readySeconds}s.`);
+		const noticePortMoved = (line) => {
+			const moved = portMovedNotice(line);
+			if (!moved) return;
+			console.log(`  ${chalk.gray("↳ PORT")} = ${chalk.white(moved.to)} ${chalk.gray(`(${moved.from} was in use)`)}`);
+		};
+		/**
+		* The restart line, on either stream.
+		*
+		* A restart means the announced backend is gone: it either exited on
+		* its own (tsx says "Rerunning") or is being killed (tsx says
+		* "Restarting"). Either way the question "is there a server?" is open
+		* again, so readiness is un-announced and the deadline re-armed. Without
+		* this the flag stayed true forever after the first successful boot.
+		*
+		* Checked on both streams because which pipe it lands on is tsx's
+		* business, and a marker watched on the wrong one never fires.
+		*/
+		const noticeWatcherRestart = (line) => {
+			if (!WATCHER_RESTART_MARKER.test(stripAnsi(line))) return;
+			backendAnnounced = false;
+			backendDownReported = false;
+			armReadyDeadline(`The backend did not come back up after ${readySeconds}s.`);
+		};
+		/**
+		* And notice a backend that dies without tsx saying anything.
+		*
+		* `kill -9` of the server process is the plain case: tsx stays alive,
+		* prints nothing, and waits for a file change that may never come.
+		* Measured on tsx 4.23.1 — the watcher's transcript after the kill is
+		* empty. So the only honest question left is whether anything is still
+		* listening on the port the backend announced, and this asks it.
+		*
+		* Only runs between an announcement and the next restart, so an
+		* ordinary restart (where the port is legitimately closed for a second)
+		* cannot trip it: `noticeWatcherRestart` clears `backendAnnounced`
+		* before the process is killed. Two misses rather than one, because a
+		* single refused connect under load is not yet news.
+		*/
+		let missedProbes = 0;
+		const liveness = setInterval(() => {
+			if (shuttingDown || !backendAnnounced || !resolvedBackendPort) {
+				missedProbes = 0;
+				return;
+			}
+			const port = resolvedBackendPort;
+			probeTcp("127.0.0.1", port, 1e3).then((alive) => {
+				if (!backendAnnounced || resolvedBackendPort !== port) return;
+				if (alive) {
+					missedProbes = 0;
+					return;
+				}
+				if (++missedProbes < 2) return;
+				backendAnnounced = false;
+				missedProbes = 0;
+				reportBackendDown(`The backend stopped listening on port ${port}.`);
+			});
+		}, LIVENESS_INTERVAL_MS);
+		liveness.unref?.();
+		/**
+		* And say so when tsx itself gives up.
+		*
+		* Distinct from the deadline above: this is the watcher exiting, not
+		* the app under it. It happens when the entry cannot be resolved at
+		* all, when node_modules is broken, or when something kills the
+		* process — none of which tsx will retry, so the run is over and the
+		* exit code should say so.
+		*/
+		backendChild.on("exit", (code, signal) => {
+			disarmReadyDeadline();
+			clearInterval(liveness);
+			backendAnnounced = false;
+			backendDownReported = false;
+			reportBackendDown(signal ? `Backend was killed by ${signal}.` : `Backend exited with code ${code ?? 1}.`);
+			if (backendOnly) process.exitCode = code ?? 1;
+		});
+		forEachOutputLine(backendChild.stdout, (line) => {
+			console.log(`${chalk.cyan.bold("[backend]")}  ${line}`);
+			noticeWatcherRestart(line);
+			noticePortMoved(line);
+			const cleanLine = stripAnsi(line);
+			const swaggerMatch = cleanLine.match(/Swagger UI available.*"path":"([^"]+)"/);
+			if (swaggerMatch) swaggerPath = swaggerMatch[1];
+			const serverMatch = cleanLine.match(/Server running at http:\/\/(?:localhost|127\.0\.0\.1):(\d+)/);
+			if (serverMatch) {
+				backendAnnounced = true;
+				backendDownReported = false;
+				missedProbes = 0;
+				if (backendOnly) process.exitCode = 0;
+				disarmReadyDeadline();
+				resolvedBackendPort = parseInt(serverMatch[1], 10);
+				backendUrl = "started";
+				if (!backendOnly && frontendDir) {
+					if (!frontendLaunched) {
+						frontendLaunched = true;
+						startFrontend(resolvedBackendPort);
+					} else if (!frontendPortChecked && frontendApiPort !== resolvedBackendPort) restartFrontend(resolvedBackendPort);
+					frontendPortChecked = true;
+				}
+				printSummary();
+				const urlFile = path.join(projectRoot, ".rebase-dev-url");
+				fs.writeFileSync(urlFile, `http://localhost:${resolvedBackendPort}`, "utf-8");
+				const portFile = path.join(projectRoot, DEV_PORT_FILENAME);
+				fs.writeFileSync(portFile, String(resolvedBackendPort), "utf-8");
+			}
+		});
+		/** Whether we've already shown a corrupted-modules recovery hint. */
+		let corruptedModulesWarned = false;
+		forEachOutputLine(backendChild.stderr, (line) => {
+			console.log(`${chalk.cyan.bold("[backend]")}  ${line}`);
+			noticeWatcherRestart(line);
+			noticePortMoved(line);
+			if (!corruptedModulesWarned) {
+				const cleanLine = stripAnsi(line);
+				if (cleanLine.includes("Cannot find module") && cleanLine.includes("node_modules/.pnpm/")) {
+					corruptedModulesWarned = true;
+					setTimeout(() => {
+						const installCmd = getPMCommands(detectPackageManager(projectRoot)).install.join(" ");
+						console.error("");
+						console.error(chalk.red("  ✗ node_modules appears corrupted — a required file is missing."));
+						console.error(chalk.gray("    This usually happens when a previous install was interrupted"));
+						console.error(chalk.gray("    or the package manager store was cleaned."));
+						console.error("");
+						console.error(chalk.gray("    To fix, stop the dev server and run:"));
+						console.error(chalk.cyan(`      rm -rf node_modules && ${installCmd}`));
+						console.error("");
+					}, 200);
+				}
+			}
+		});
+		children.push(backendChild);
+	} else if (!frontendOnly && !backendDir) console.warn(chalk.yellow("  ⚠ No backend/ directory found, skipping backend."));
+	if (!backendOnly && frontendDir && (frontendOnly || !backendDir)) startFrontend(null);
+	else if (!backendOnly && !frontendDir && declaresStaticApp) console.warn(chalk.yellow("  ⚠ No frontend/ directory found, skipping frontend."));
+	if (children.length === 0) {
+		console.error(chalk.red("  ✗ Nothing to start. Check your project structure."));
+		process.exit(1);
+	}
+	console.log("");
+	console.log(chalk.gray("  Press Ctrl+C to stop all servers."));
+	console.log("");
+	const awaited = /* @__PURE__ */ new Set();
+	for (let pending = [...children]; pending.length > 0; pending = children.filter((child) => !awaited.has(child))) {
+		for (const child of pending) awaited.add(child);
+		await Promise.all(pending.map((child) => child.then(() => void 0, () => void 0)));
+	}
+}
+function printDevHelp() {
+	console.log(`
+${chalk.bold("rebase dev")} — Start the development server
+
+${chalk.green.bold("Usage")}
+  rebase dev [options]
+
+${chalk.green.bold("Options")}
+  ${chalk.blue("--backend-only, -b")}    Only start the backend server
+  ${chalk.blue("--frontend-only, -f")}   Only start the frontend server
+  ${chalk.blue("--port, -P")}            Backend port (default: auto-detected per project)
+  ${chalk.blue("--database-url")} ${chalk.gray("<url>")}  Use this Postgres, ahead of everything else
+  ${chalk.blue("--docker")}              Use the project's docker-compose ${chalk.gray("db")} service
+  ${chalk.blue("--no-db")}               Start no database at all
+
+${chalk.green.bold("Which database")}
+  Ordered, and the order is the promise. The first of these that says
+  something wins:
+
+    1. ${chalk.blue("--database-url <url>")}    on this command line
+    2. ${chalk.gray("DATABASE_URL")}            in the shell environment
+    3. the branch this checkout is switched to ${chalk.gray("(rebase db branch switch)")}
+    4. ${chalk.gray("DATABASE_URL")}            in the project's .env
+    5. ${chalk.blue("--docker")}                on this command line
+    6. the managed development database ${chalk.gray("(PGlite, data in .rebase/)")}
+
+  A scaffolded project sets none of 1–5, so it lands on (6): no Docker,
+  nothing to install, and the collections' tables are created at boot.
+
+  ${chalk.blue("--docker")} reaches the ${chalk.gray("db")} service in this project's docker-compose.yml,
+  starting the container if nothing is listening on its port, and pushing
+  the schema when this command is what started it. Its connection string
+  is derived from the compose file and ${chalk.gray("DATABASE_PASSWORD")} in .env — the same
+  string .env carries, commented out, as ${chalk.gray("DATABASE_URL")}.
+
+  A database that is already running is never touched: no schema push,
+  no connection. A DATABASE_URL pointing anywhere other than this machine
+  is left alone entirely. Pass ${chalk.blue("--no-db")}, or set REBASE_DEV_NO_DB=1, to
+  start nothing — the backend then fails on the database it cannot reach,
+  which is the point.
+
+${chalk.green.bold("Which port")}
+  Ordered like the database, and the order is the promise. The first of
+  these that says something wins, and the start banner names which one did:
+
+    1. ${chalk.blue("--port <n>")}              on this command line
+    2. ${chalk.gray("PORT")}                    in the shell environment
+    3. the port the last ${chalk.gray("rebase dev")} used ${chalk.gray("(.rebase-dev-port)")}
+    4. a port derived from this project's path
+
+  ${chalk.gray("PORT")} in the project's .env is ${chalk.bold("not")} read here: this command resolves
+  its port before .env is loaded and then sets ${chalk.gray("PORT")} for the backend from
+  what it resolved. Export it in your shell, or pass ${chalk.blue("--port")}.
+
+${chalk.green.bold("Description")}
+  Starts both the backend (tsx watch + Hono) and frontend (Vite)
+  dev servers concurrently with color-coded output prefixes.
+
+  Each project automatically receives a unique default port derived
+  from its directory path, preventing collisions when running multiple
+  Rebase instances simultaneously.
+
+  If the assigned port is already in use, the server will automatically
+  try the next available port. The frontend starts beside the backend
+  when the backend's port is known in advance (named with --port, or
+  free), and after the backend is ready otherwise. Either way
+  VITE_API_URL is injected with the port the backend actually bound —
+  the frontend is restarted if the backend had to move.
+
+  On startup and on every save under config/collections, the Drizzle
+  schema (backend/src/schema.generated.ts) and the SDK types
+  (generated/sdk) are regenerated from the collections.
+`);
+}
+//#endregion
+export { devCommand };
+
+//# sourceMappingURL=dev-C9P5Yp9k.js.map