@rebasepro/cli 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/db-YbPMFY4Y.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-YbPMFY4Y.js","names":[],"sources":["../src/utils/command-words.ts","../src/utils/spawn-error.ts","../src/commands/db.ts"],"sourcesContent":["/**\n * The words that name a command, with the flags taken back out.\n *\n * `rawArgs` is the whole of `process.argv`, and reading the command's words at\n * fixed indices off it assumes nothing precedes them. Something routinely does:\n * `--debug` is what `bin/rebase.js` prints after every failure as the thing to\n * re-run with, so it is the single most likely token to appear before a command\n * word, and it shifted every index by one.\n *\n * What that cost is not a bad error message. `rebase db branch switch feature`\n * writes a per-checkout pointer that the CLI owns; the driver, running as a\n * child process, cannot persist it and does not try. The dispatch found\n * `switch` by position, so `rebase --debug db branch switch feature` missed the\n * CLI's branch and handed the line to the driver — which reported success and\n * left the checkout on the main database. Every subsequent `dev`, `push` and\n * `backup` then ran against the wrong database, believing it was the branch,\n * which is the exact failure branching exists to prevent.\n *\n * The words are anchored on the command name rather than taken from position\n * zero, because a flag written in the space form (`--database-url <url>`) leaves\n * its value behind as a bare token and no parser at this level knows which\n * flags take values. Anchoring survives that: the value would have to be the\n * literal command name to fool it.\n *\n * Returns `[]` when the command name is not on the line at all.\n */\nexport function commandWords(rawArgs: readonly string[], command: string): string[] {\n    const words = rawArgs.slice(2).filter(token => !token.startsWith(\"-\"));\n    const start = words.indexOf(command);\n    return start === -1 ? [] : words.slice(start);\n}\n\n/**\n * The line to hand a spawned driver, starting at the command word.\n *\n * The same defect one layer down, and it does not degrade gracefully: the\n * driver reads its domain from `args[0]`, so `rebase --debug db push` spawned\n * it with `[\"--debug\", \"db\", \"push\"]` and it answered \"Unknown domain command:\n * --debug\" — for a flag the CLI itself tells you to add after any failure.\n *\n * Tokens written *before* the command word are moved after it rather than\n * dropped. Dropping them would be the same class of bug in the other direction:\n * `rebase --database-url postgres://… db push` would silently lose the flag that\n * says which database to touch. Appending keeps each flag next to its value, and\n * `arg` reads flags wherever they appear.\n *\n * Falls back to `rawArgs.slice(2)` when the command word is not on the line,\n * which is what an internally synthesised argv looks like.\n */\nexport function argsFromCommand(rawArgs: readonly string[], command: string): string[] {\n    const tail = rawArgs.slice(2);\n    const start = tail.findIndex(token => token === command);\n    if (start <= 0) return [...tail];\n    return [...tail.slice(start), ...tail.slice(0, start)];\n}\n","/**\n * What to say when a spawned child process fails.\n *\n * Two failures arrive through the same `catch` and need opposite treatment:\n *\n *  - **The child ran and exited non-zero.** It had inherited stdio, so it has\n *    already printed its own diagnostics. execa's \"Command failed with exit\n *    code 1: …\" is a second, worse copy of the same news with the whole argv\n *    appended.\n *  - **The child never started.** ENOENT on the tsx binary, EACCES on a script\n *    that lost its permissions, ENOMEM on a full machine. Nobody printed\n *    anything, because nothing ran. `schema.ts` and `doctor.ts` both swallowed\n *    these — `catch { process.exit(1); }`, the error not even bound — so\n *    `rebase schema generate` against a broken tsx exited 1 in silence, and so\n *    did `rebase doctor`, the command whose entire job is to say what is wrong.\n *\n * The tsx symlink surviving a cleaned pnpm store is the ordinary way to get\n * here: `resolveLocalBin` finds the symlink, so \"dependencies are not\n * installed\" never fires, and the spawn is where it breaks.\n *\n * ## Why the message is not what decides it\n *\n * `db.ts` did make this distinction, by testing the message against\n * `/Command failed|exited with code/i` — and that test is wrong for every case\n * it was written to catch. execa prefixes **all** of them the same way:\n *\n *     Command failed with exit code 3: /bin/sh -c 'exit 3'\n *     Command failed with ENOENT: /…/tsx x⏎spawn /…/tsx ENOENT\n *     Command failed with EACCES: /…/tsx x⏎spawn /…/tsx EACCES\n *\n * So the filter matched the spawn failures too and `db push` was as silent as\n * the other two. The structured fields do distinguish them: a child that ran\n * has a numeric `exitCode` (or a `signal`, if something killed it), and a child\n * that never started has neither — only an errno in `code`.\n */\nimport chalk from \"chalk\";\n\ninterface ChildProcessFailure {\n    exitCode?: unknown;\n    signal?: unknown;\n    /** execa's message without the \"Command failed with …: <argv>\" preamble. */\n    originalMessage?: unknown;\n}\n\n/** Did the process start? Only then has anything else already been printed. */\nfunction childRan(error: unknown): boolean {\n    if (!(error instanceof Error)) return false;\n    const failure = error as Error & ChildProcessFailure;\n    return typeof failure.exitCode === \"number\" || typeof failure.signal === \"string\";\n}\n\nexport function reportSpawnFailure(error: unknown): void {\n    if (childRan(error) || !(error instanceof Error)) return;\n\n    // `originalMessage` is \"spawn /…/tsx ENOENT\" — the same fact as `message`\n    // without a second copy of the argv the user just typed. Absent on the\n    // errors these commands raise themselves, which are already one sentence.\n    const failure = error as Error & ChildProcessFailure;\n    const message = typeof failure.originalMessage === \"string\"\n        ? failure.originalMessage\n        : error.message;\n    if (message) console.error(chalk.red(`✗ ${message}`));\n}\n","/**\n * CLI command: rebase db <action>\n */\nimport chalk from \"chalk\";\nimport fs from \"fs\";\nimport inquirer from \"inquirer\";\nimport os from \"os\";\nimport path from \"path\";\nimport { execa } from \"execa\";\nimport {\n    requireProjectRoot,\n    requireBackendDir,\n    getActiveBackendPlugin,\n    resolvePluginCliScript,\n    resolveTsx,\n    resolveTsxLoader,\n    findEnvFile,\n    dependenciesNotInstalled\n} from \"../utils/project\";\nimport { reportSpawnFailure } from \"../utils/spawn-error\";\nimport { parseCommandArgs } from \"../utils/args\";\nimport { unknownCommand } from \"../utils/unknown-command\";\nimport { argsFromCommand, commandWords } from \"../utils/command-words\";\nimport { COLLECTIONS_FLAG_HELP, refuseMissingCollectionsPath } from \"../utils/path-flags\";\nimport { recordEvent } from \"../telemetry\";\nimport { DEV_DATABASE_KIND_ENV, devDatabaseKind, type PreparedDatabase } from \"../dev-db/prepare\";\nimport { type DevDatabase } from \"../dev-db/resolve\";\nimport type { AtlasDevDatabase } from \"../dev-db/atlas-dev-database\";\n\n/**\n * The connection string a prepared database actually answers on.\n *\n * One function, because `db url` and `db pull` disagreed about it and the\n * disagreement was a dead command: `prepareDatabaseEnv` returns `env: {}` for a\n * plain external database — the connection string is already somewhere the\n * child looks — so `db pull`'s `prepared.env.DATABASE_URL ?? process.env\n * .DATABASE_URL` was empty for the standard `.env` configuration and answered\n * `✗ No local database to pull into.` on a project whose `rebase db url` had\n * just printed one. Exporting the same URL in the shell made it work, which is\n * the shape of a bug nobody reports as one.\n *\n * `readEnvFile` is passed in rather than imported: this module loads\n * `../utils/project` dynamically everywhere else, and the callers already have\n * it open.\n */\nexport function databaseUrlOf(\n    prepared: Pick<PreparedDatabase, \"env\" | \"database\">,\n    envFile: Record<string, string>\n): string | undefined {\n    // An empty string is \"nothing named a database\", not \"the database is the\n    // empty string\" — `docker` resolves to `url: null` when the compose file\n    // declares no usable db service.\n    const named = (value: string | null | undefined) => (value && value.trim() ? value : undefined);\n\n    return named(prepared.env.DATABASE_URL)\n        ?? named(prepared.database.kind === \"managed\" ? undefined : prepared.database.url)\n        ?? named(envFile.DATABASE_URL)\n        ?? named(process.env.DATABASE_URL);\n}\n\n/**\n * A destination that names a remote store rather than a local path.\n *\n * Matched as \"scheme://\" generally, not as a list of the schemes we support:\n * an unknown scheme is still not something to join onto a filesystem path, and\n * a Windows drive letter (\"C:\\backups\") has no \"//\" so it stays a path.\n */\nconst REMOTE_DESTINATION_RE = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\n/**\n * The flags whose value is a local path, on every line the CLI relays.\n *\n * All three spellings of the destination, because the driver accepts all\n * three: `backup-cli.ts` maps `--output` and `-o` onto `--out`, and `rebase db\n * backup --help` advertises `--output` as an alias. Only `--out` and `-o` were\n * absolutised once, so the one spelling the help page names was the one that\n * landed in `backend/` — and the success line still echoed the path as typed.\n *\n * And `--collections`, which was not absolutised at all: from the project root,\n * `rebase schema generate --collections ./config/collections` was \"not found\",\n * while the same spelling worked for `generate-sdk`. See `utils/path-flags.ts`.\n */\nexport const LOCAL_PATH_FLAGS: readonly string[] = [\"--out\", \"--output\", \"-o\", \"--collections\", \"-c\"];\n\n/**\n * Rewrite local path arguments so they mean what the user typed.\n *\n * The plugin CLI is spawned with `cwd: backendDir` — it has to be, because that\n * is where the plugin and its dependencies resolve from. But the developer runs\n * `rebase db` from the project root, so a relative `--out ./backups` was being\n * resolved against `backend/` and landed in `backend/backups`, while the\n * success line echoed the path as typed. The file was real and the reported\n * location was wrong, which is the worst way for a backup command to behave.\n * `rebase db --help` documents exactly this invocation.\n *\n * Absolutising here rather than inside the plugin keeps the fix where the cwd\n * is actually changed, and leaves the plugin usable on its own terms.\n */\nexport function absolutizeLocalPathArgs(\n    args: string[],\n    cwd: string,\n    pathFlags: readonly string[] = LOCAL_PATH_FLAGS\n): string[] {\n    const takesPath = (flag: string) => pathFlags.includes(flag);\n    /**\n     * Flags whose next token is a value, not a positional.\n     *\n     * Mirrors the `arg` specs in `@rebasepro/server-postgres`'s backup CLI.\n     * Needed only to find the `db restore` dump argument: without it,\n     * `restore --target-db app_restored ./x.dump` treats `app_restored` as the\n     * positional — it is the first token not starting with `-` — and turns a\n     * database name into a path while leaving the real dump path unresolved.\n     */\n    const VALUE_FLAGS = new Set([\n        \"--out\", \"--output\", \"-o\", \"--target-db\", \"--exclude-schema\", \"--row-security-role\"\n    ]);\n    const out = [...args];\n\n    for (let i = 0; i < out.length; i++) {\n        const arg = out[i];\n\n        // `--out=<value>`\n        const eq = arg.indexOf(\"=\");\n        if (eq > 0 && takesPath(arg.slice(0, eq))) {\n            const value = arg.slice(eq + 1);\n            if (value && !REMOTE_DESTINATION_RE.test(value)) {\n                out[i] = `${arg.slice(0, eq)}=${path.resolve(cwd, value)}`;\n            }\n            continue;\n        }\n\n        // `--out <value>`\n        if (takesPath(arg)) {\n            const value = out[i + 1];\n            if (value && !value.startsWith(\"-\") && !REMOTE_DESTINATION_RE.test(value)) {\n                out[i + 1] = path.resolve(cwd, value);\n                i++;\n            }\n        }\n    }\n\n    // `db restore <file>` — the dump to read is a positional, and a relative one\n    // was resolved against `backend/` too, so the path printed by a preceding\n    // `db backup` could not be pasted into `db restore`.\n    const restoreAt = out.indexOf(\"restore\");\n    if (restoreAt !== -1) {\n        for (let i = restoreAt + 1; i < out.length; i++) {\n            const arg = out[i];\n            if (arg.startsWith(\"-\")) {\n                // `--flag=value` carries its value inline; `--flag value` eats\n                // the next token only when the flag actually takes one.\n                if (!arg.includes(\"=\") && VALUE_FLAGS.has(arg)) i++;\n                continue;\n            }\n            // First true positional: the dump to restore.\n            if (!REMOTE_DESTINATION_RE.test(arg)) out[i] = path.resolve(cwd, arg);\n            break;\n        }\n    }\n\n    return out;\n}\n\n/**\n/**\n * Read `--flag value` or `--flag=value` out of the raw argv.\n *\n * This command forwards its arguments to the driver plugin rather than parsing\n * them, so the two flags the CLI itself acts on are picked out by hand instead\n * of adding a spec that would then have to strip them back out again.\n */\nfunction readFlagValue(rawArgs: readonly string[], flag: string): string | null {\n    for (let index = 0; index < rawArgs.length; index += 1) {\n        const arg = rawArgs[index];\n        if (arg === flag) return rawArgs[index + 1] ?? null;\n        if (arg.startsWith(`${flag}=`)) return arg.slice(flag.length + 1);\n    }\n\n    return null;\n}\n\n/**\n * Run a database subcommand through the active driver's CLI, throwing on\n * failure instead of exiting.\n *\n * `dbCommand` below turns every failure into `process.exit(1)`, which is right\n * for a command the user invoked directly and wrong for a caller that has more\n * to do afterwards — `rebase dev` runs a schema push during start-up and must\n * survive it failing. Exiting is therefore the wrapper's job, not this\n * function's.\n *\n * The database is resolved *here* rather than in the wrapper, so the schema\n * push `rebase dev` performs during start-up reaches the managed database too.\n */\n/**\n * The `db` subcommands that plan their work with Atlas.\n *\n * Atlas computes a diff by replaying the desired schema into a **second, empty\n * database** and comparing. That is why these three are listed and `backup` and\n * `restore` are not — those shell out to `pg_dump`, which fails loudly on its\n * own. `branch` is refused too, but for its own reason and with its own\n * message: see {@link refuseBranchOnManagedDatabase}.\n */\nconst ATLAS_BACKED_SUBCOMMANDS = new Set([\"push\", \"generate\", \"migrate\"]);\n\n/**\n * A managed-database refusal, raised so the caller decides what it costs.\n *\n * These two guards used to `process.exit(1)` where they stood. That is right\n * for `rebase db push`, typed by a person, and catastrophic for the same code\n * reached from inside `rebase dev`: the dev server's first-boot schema push\n * runs in-process, so an exit there took the whole dev server down — with a\n * `try/catch` around it written expressly to prevent that, which could never\n * run. The first `rebase dev --docker` of every scaffold died this way.\n *\n * So the refusal is a value now. It carries the block it wants printed rather\n * than printing it, because who prints (and whether printing is even right) is\n * the caller's question: `dbCommand` prints it and exits 1, and `rebase dev`\n * keeps serving.\n */\nexport class ManagedDatabaseRefusal extends Error {\n    /** The lines to print, in order, already coloured. */\n    readonly lines: readonly string[];\n\n    constructor(summary: string, lines: readonly string[]) {\n        super(summary);\n        this.name = \"ManagedDatabaseRefusal\";\n        this.lines = lines;\n    }\n}\n\n/** Print a refusal exactly as the guards used to print it themselves. */\nexport function printManagedDatabaseRefusal(refusal: ManagedDatabaseRefusal): void {\n    for (const line of refusal.lines) console.error(line);\n}\n\n/**\n * The variable the driver reads for Atlas's dev database\n * (`ATLAS_DEV_URL_ENV` in `@rebasepro/server-postgres`, which this CLI does not\n * depend on).\n */\nexport const ATLAS_DEV_URL_ENV = \"REBASE_ATLAS_DEV_URL\";\n\n/** Loaded only when a command needs one: PGlite is 25 MB of WASM. */\nconst startAtlasDevDatabase = async (): Promise<AtlasDevDatabase> =>\n    (await import(\"../dev-db/atlas-dev-database\")).startAtlasDevDatabase();\n\n/**\n * The empty database an Atlas-backed subcommand plans against, on the managed\n * development database.\n *\n * **PGlite serves exactly one database.** Atlas computes a change by replaying\n * the desired schema into a second, empty one; on a real server the driver\n * makes it as `<db>_dev_diff`, but `CREATE DATABASE` against PGlite reports\n * success and creates nothing, so Atlas connected straight back to the\n * database it was comparing and stopped with `connected database is not\n * clean`. These commands were refused outright on the managed database — and\n * with them every way to drop, rename or narrow a column there, since boot\n * only adds.\n *\n * So a throwaway second PGlite is started for the command instead — in\n * memory, in this process, gone when the command ends — and handed to the\n * driver as `REBASE_ATLAS_DEV_URL`. Nothing else about the push changes: the\n * destructive gate is the driver's, and holds as it does everywhere.\n *\n * `undefined` when none is needed: another database kind (the driver makes its\n * own), a subcommand that is not Atlas's, or a `REBASE_ATLAS_DEV_URL` the\n * developer set. When one cannot be started — PGlite is an optional\n * dependency — the old refusal stands, with the reason.\n */\nexport async function atlasDevDatabaseFor(\n    rawArgs: string[],\n    kind: string,\n    env: Readonly<Record<string, string | undefined>>,\n    start: () => Promise<AtlasDevDatabase> = startAtlasDevDatabase\n): Promise<AtlasDevDatabase | undefined> {\n    if (kind !== \"managed\") return undefined;\n    const [domain, subcommand] = commandWords(rawArgs, \"db\");\n    if (domain !== \"db\" || !ATLAS_BACKED_SUBCOMMANDS.has(subcommand ?? \"\")) return undefined;\n    if (env[ATLAS_DEV_URL_ENV]?.trim()) return undefined;\n\n    try {\n        return await start();\n    } catch (err) {\n        const summary = `rebase db ${subcommand} could not start the database Atlas plans against.`;\n        throw new ManagedDatabaseRefusal(summary, [\n            \"\",\n            chalk.red(`  ✗ ${summary}`),\n            chalk.gray(`    ${err instanceof Error ? err.message : String(err)}`),\n            \"\",\n            chalk.gray(\"  Atlas plans every change against a second, empty database. On the managed\"),\n            chalk.gray(\"  database that is a throwaway PGlite, started for the command.\"),\n            \"\",\n            chalk.gray(`  ${chalk.cyan(\"rebase dev\")} still applies your collections at boot, additively. Otherwise,`),\n            chalk.gray(`  set ${ATLAS_DEV_URL_ENV} to an empty Postgres database Atlas may fill and clear,`),\n            chalk.gray(\"  or point the project at a real Postgres (uncomment DATABASE_URL in .env).\"),\n            \"\"\n        ]);\n    }\n}\n\n/**\n * Stop `rebase db branch` before it reports a branch that is not one.\n *\n * **PGlite serves exactly one database**, and this is the second thing that\n * follows from it. `CREATE DATABASE \"rb_feature_x\" TEMPLATE \"postgres\"` there\n * writes a `pg_database` catalog row and nothing else. Nothing errors, so the\n * whole feature reports success end to end:\n *\n *     $ rebase db branch create feature_x\n *       ✓ Branch \"feature_x\" created successfully.\n *     $ rebase db branch list\n *       ● feature_x (7.1 MB) — created just now\n *\n * `listBranches` joins `pg_database`, the catalog row is there, and\n * `pg_database_size` answers with the one database's size — so the listing\n * corroborates the lie. Then connecting to `rb_feature_x` reports\n * `current_database()` = `postgres`, and a table created \"in the branch\" is\n * visible in the parent immediately. Measured on a fresh `rebase init` scaffold.\n *\n * **The branch is the parent.** Every write made in the belief that it is\n * sandboxed lands in the developer's real development database — which is the\n * exact failure branching exists to prevent, announced as a success.\n *\n * So this refuses the whole `branch` domain rather than `create` alone: `list`\n * on the managed database ends with \"Create one with: rebase db branch create\",\n * an invitation to do the broken thing, and `info` would confirm a size for a\n * database that was never made.\n *\n * Push, generate and migrate had the same problem — Atlas's scratch database\n * is a second database too — and get a throwaway PGlite of their own instead\n * (`atlasDevDatabaseFor` above). A branch cannot: it is meant to keep the\n * project's data, and a throwaway instance has none.\n */\nexport function refuseBranchOnManagedDatabase(rawArgs: string[], kind: string): void {\n    if (kind !== \"managed\") return;\n    const [domain, subcommand] = commandWords(rawArgs, \"db\");\n    if (domain !== \"db\" || subcommand !== \"branch\") return;\n\n    const summary = \"rebase db branch does not work on the managed development database.\";\n\n    throw new ManagedDatabaseRefusal(summary, [\n        \"\",\n        chalk.red(`  ✗ ${summary}`),\n        \"\",\n        chalk.gray(\"  Branching copies a database with CREATE DATABASE ... TEMPLATE. The managed\"),\n        chalk.gray(\"  database is PGlite, which serves exactly one — the copy would be the\"),\n        chalk.gray(\"  original, and every write you meant to sandbox would land in it.\"),\n        \"\",\n        chalk.gray(\"  Branching needs a real Postgres. Either:\"),\n        chalk.gray(`  ${chalk.cyan(\"rebase dev --docker\")}    starts one, and branches work against it`),\n        chalk.gray(\"  or uncomment DATABASE_URL in .env to point at your own.\"),\n        \"\"\n    ]);\n}\n\n/**\n * Resolve the active driver's CLI and the environment it should run in.\n *\n * Shared by the two runners below. Deliberately does NOT resolve a database:\n * `schema generate` reads collection files and writes one file, and starting a\n * database to run it would be a side effect nobody asked for.\n */\nexport async function resolveDriverCli(): Promise<{\n    projectRoot: string;\n    backendDir: string;\n    pluginCli: string;\n    env: Record<string, string>;\n}> {\n    const projectRoot = requireProjectRoot();\n    const backendDir = requireBackendDir(projectRoot);\n\n    const activePlugin = getActiveBackendPlugin(backendDir);\n    if (!activePlugin) {\n        throw new Error(\n            \"Could not detect an active database plugin. Make sure a package like \"\n            + \"@rebasepro/server-postgres is installed in backend/package.json.\"\n        );\n    }\n    const pluginCli = resolvePluginCliScript(backendDir, activePlugin);\n    if (!pluginCli) {\n        throw new Error(dependenciesNotInstalled(projectRoot));\n    }\n\n    const envFile = findEnvFile(projectRoot);\n    const env: Record<string, string> = { ...process.env as Record<string, string> };\n    if (envFile) {\n        env.DOTENV_CONFIG_PATH = envFile;\n    }\n    env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? \"\";\n\n    return { projectRoot, backendDir, pluginCli, env };\n}\n\n/**\n * The one place this CLI spawns the driver's own CLI.\n *\n * There were three, each with its own copy of \"tsx for a `.ts` entry, `node`\n * otherwise\". That rule was right only while the driver shipped `src/`; once it\n * shipped `dist/cli.js` all three quietly switched to plain `node`, and the\n * driver loads the PROJECT's TypeScript in process:\n *\n *   - `schema stale` reads the collections, could not resolve `./authors` onto\n *     `authors.ts`, and answered \"⏭ Not checked\" while exiting 0;\n *   - `db push` does the same in `ensureAuthTables`, so `rebase.users` was never\n *     created and the push died at \"Applying RLS policies\" with\n *     `relation \"rebase.users\" does not exist` — on a virgin database, which is\n *     the documented bring-your-own-Postgres first run.\n *\n * Two were fixed and the third was missed, because three copies of a decision\n * are three chances to miss one. There is one now, and a gate holds it at one.\n *\n * tsx whenever it is installed — a devDependency of every scaffold, for exactly\n * this reason. Without it a `.ts` entry cannot run at all; a built entry still\n * runs, and the subcommands that never touch the project's TypeScript still work.\n *\n * tsx's loader in one Node (`node --import`) rather than the `tsx` binary,\n * which is a shell shim and a relay Node in front of the same loader: one Node\n * start instead of two, ~50–100 ms on each of the driver runs every `rebase\n * dev` start and every collection save makes. The binary stays the fallback for\n * a tsx whose loader does not resolve as a package — a global install.\n */\nexport async function spawnDriverCli(\n    resolved: { projectRoot: string; backendDir: string; pluginCli: string; env: Record<string, string> },\n    childArgs: string[],\n    options: { quiet?: boolean } = {}\n): Promise<void> {\n    const { projectRoot, backendDir, pluginCli, env } = resolved;\n    const stdio = options.quiet ? \"pipe\" : \"inherit\";\n\n    const tsxBin = resolveTsx(projectRoot);\n    const tsxLoader = resolveTsxLoader(projectRoot);\n    if (!tsxBin && !tsxLoader && pluginCli.endsWith(\".ts\")) {\n        throw new Error(dependenciesNotInstalled(projectRoot));\n    }\n\n    const [command, ...prefix] = tsxLoader ? [process.execPath, \"--import\", tsxLoader] : [tsxBin ?? \"node\"];\n    await execa(command, [...prefix, pluginCli, ...childArgs], { cwd: backendDir, stdio, env });\n}\n\n/** @deprecated Use {@link spawnDriverCli}. Kept as the internal name callers use. */\nconst execDriverCli = spawnDriverCli;\n\n/**\n * Run a `schema` subcommand through the active driver's CLI.\n *\n * Separate from {@link runDriverDbCommand} because it must NOT resolve a\n * database. `rebase dev` calls this before the database exists, which is the\n * whole point: the generated schema has to be right before anything reads it.\n * Throws rather than exiting — the caller has more to do.\n */\nexport async function runDriverSchemaCommand(\n    rawArgs: string[],\n    options: { quiet?: boolean } = {}\n): Promise<void> {\n    const resolved = await resolveDriverCli();\n    await execDriverCli(resolved, rawArgs.slice(2), options);\n}\n\nexport async function runDriverDbCommand(\n    rawArgs: string[],\n    options: { quiet?: boolean } = {}\n): Promise<void> {\n    const projectRoot = requireProjectRoot();\n    const backendDir = requireBackendDir(projectRoot);\n\n    const activePlugin = getActiveBackendPlugin(backendDir);\n    if (!activePlugin) {\n        throw new Error(\n            \"Could not detect an active database plugin. Make sure a package like \"\n            + \"@rebasepro/server-postgres is installed in backend/package.json.\"\n        );\n    }\n\n    const pluginCli = resolvePluginCliScript(backendDir, activePlugin);\n    if (!pluginCli) {\n        throw new Error(dependenciesNotInstalled(projectRoot));\n    }\n\n    // Set up environment with DOTENV_CONFIG_PATH\n    const envFile = findEnvFile(projectRoot);\n    const env: Record<string, string> = { ...process.env as Record<string, string> };\n    if (envFile) {\n        env.DOTENV_CONFIG_PATH = envFile;\n    }\n    env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? \"\";\n\n    // Every `db` subcommand reaches Postgres through the driver plugin, which\n    // reads DATABASE_URL from this environment — so resolving the database once\n    // here covers push, generate, migrate, backup and restore alike, and any\n    // subcommand a driver adds later. When the developer has named their own\n    // database this adds nothing at all.\n    // Refused before anything is started. `prepareDatabaseEnv` below *boots*\n    // the managed database, and booting PGlite in order to say that PGlite\n    // cannot branch is latency spent on an answer already known — the resolver\n    // is a pure function and settles it. It also keeps the refusal working when\n    // the managed database would have failed to start, where the developer\n    // would otherwise be told about a daemon rather than about branching.\n    const { resolveDevDatabase } = await import(\"../dev-db/resolve\");\n    const { readEnvFile } = await import(\"../utils/project\");\n    refuseBranchOnManagedDatabase(rawArgs, resolveDevDatabase({\n        flagUrl: readFlagValue(rawArgs, \"--database-url\"),\n        flagDocker: rawArgs.includes(\"--docker\"),\n        env: process.env,\n        envFile: readEnvFile(projectRoot)\n    }).kind);\n\n    const { prepareDatabaseEnv, managedNotices } = await import(\"../dev-db/prepare\");\n    const prepared = await prepareDatabaseEnv(projectRoot, {\n        flagUrl: readFlagValue(rawArgs, \"--database-url\"),\n        flagDocker: rawArgs.includes(\"--docker\"),\n        onProgress: (message) => { if (!options.quiet) console.log(chalk.gray(`  ${message}`)); }\n    });\n    Object.assign(env, prepared.env);\n    // Suppressed for an internal caller. `rebase dev` runs a schema push during\n    // start-up and has already said all of this in its own banner; repeating it\n    // mid-boot reads as something having gone wrong.\n    if (!options.quiet) {\n        for (const line of managedNotices(prepared)) console.log(chalk.gray(`  ${line}`));\n    }\n\n    // Started after the managed database, stopped when the driver exits —\n    // whatever it exits with.\n    const atlasDev = await atlasDevDatabaseFor(rawArgs, prepared.database.kind, env);\n    if (atlasDev) env[ATLAS_DEV_URL_ENV] = atlasDev.url;\n\n    // Resolved against the directory the developer is standing in, before the\n    // child is handed a different one. See absolutizeLocalPathArgs.\n    //\n    // From the command word, not from index 2: the driver reads its domain out\n    // of `args[0]`, so `rebase --debug db push` spawned it with [\"--debug\",\n    // \"db\", \"push\"] and it answered \"Unknown domain command: --debug\" — for a\n    // flag this CLI prints after every failure as the thing to re-run with.\n    const childArgs = absolutizeLocalPathArgs(argsFromCommand(rawArgs, \"db\"), process.cwd());\n\n    try {\n        await spawnDriverCli({ projectRoot, backendDir, pluginCli, env }, childArgs, options);\n    } finally {\n        await atlasDev?.stop();\n    }\n}\n\nexport async function dbCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    // `--help` is answered here, before anything else, and never by a\n    // subcommand.\n    //\n    // `cli.ts` rewrites the subcommand to `\"--help\"` only when the user named\n    // none, so `rebase db --help` was covered and `rebase db push --help` was\n    // not: the flag went through to `runDriverDbCommand`, which resolves (and\n    // will START) the development database and then hands the whole line to the\n    // driver, whose own dispatch has no `--help` case for `push`. **It ran the\n    // push.** A flag whose entire job is to print text applied a schema to a\n    // database — the single most dangerous shape a help flag can have, and the\n    // same class as `skills install --help` writing files and `auth\n    // reset-password --help` running an UPDATE.\n    //\n    // Answering before `requireProjectRoot` and before the driver spawn makes\n    // it structurally impossible rather than conditionally safe: no subcommand\n    // can act on `--help`, because no subcommand is reached.\n    if (!subcommand || subcommand === \"--help\" || rawArgs.includes(\"--help\") || rawArgs.includes(\"-h\")) {\n        printDbHelp(subcommand === \"--help\" ? undefined : subcommand);\n        return;\n    }\n\n    // A typo is answered here, not by the driver, and not after a database has\n    // been started for it.\n    //\n    // `rebase db psh` used to reach `runDriverDbCommand`, which resolves the\n    // database first — so it **booted the managed PGlite**, a 180 MB daemon,\n    // in order to hand the driver an argv it then rejected with `Unknown db\n    // command. Valid: push, generate, migrate, branch, backup, restore,\n    // backups`: a list missing `url`, `pull`, `stop` and `reset`, all four of\n    // which `rebase db --help` lists and this CLI implements itself. The driver\n    // cannot know about them, which is exactly why the answer does not belong\n    // to the driver.\n    //\n    // The set comes from the help table, so the list a typo is measured against\n    // and the list `--help` prints cannot drift apart.\n    if (!DB_ACTION_HELP[subcommand]) unknownCommand(subcommand, Object.keys(DB_ACTION_HELP), \"db\");\n\n    const projectRoot = requireProjectRoot();\n\n    // Fire-and-forget, and a no-op unless the developer opted in. Never awaited:\n    // the command is what the user is waiting for, and a slow collector must not\n    // sit in front of it.\n    void recordEvent(\"cli.db\", { subcommand: subcommand ?? \"none\" }, { projectRoot });\n\n    // Handled here rather than by the driver plugin: these are about the\n    // *managed* database's process and data directory, which is a CLI concern.\n    // A project pointed at its own Postgres has nothing here to stop or reset,\n    // and is told so rather than silently doing nothing.\n    if (subcommand === \"stop\" || subcommand === \"reset\") {\n        await manageLocalDatabase(subcommand, projectRoot, rawArgs);\n\n        return;\n    }\n\n    // `--docker` on a `db` subcommand meant \"resolve the compose URL\", and\n    // nothing started it: `rebase db branch list --docker` on a stock scaffold\n    // answered `✗ Failed query: CREATE SCHEMA IF NOT EXISTS rebase` and\n    // `connect ECONNREFUSED 127.0.0.1:5436` — two lines, no diagnosis — while\n    // the managed-database refusal that sends the reader here says \"`rebase dev\n    // --docker` starts one, and branches work against it\".\n    //\n    // The same ensure step `rebase dev --docker` runs, not a second one.\n    await ensureDockerDatabase(projectRoot, rawArgs);\n\n    if (subcommand === \"pull\") {\n        await pullIntoLocal(projectRoot, rawArgs);\n\n        return;\n    }\n\n    if (subcommand === \"url\") {\n        await printDatabaseUrl(projectRoot, rawArgs);\n\n        return;\n    }\n\n    // Handled here rather than by the driver, for the same reason `stop` and\n    // `reset` are: it writes per-checkout CLI state. The driver creates and\n    // drops the databases; which one this checkout talks to is not its\n    // business, and it runs as a child process that could not persist the\n    // answer anyway.\n    if (subcommand === \"branch\" && commandWords(rawArgs, \"db\")[2] === \"switch\") {\n        await switchBranch(projectRoot, rawArgs);\n\n        return;\n    }\n\n    // The other two branch actions that need to know where this checkout is\n    // standing, for reasons the driver — a child process with no idea a pointer\n    // exists — cannot answer.\n    let driverArgs = rawArgs;\n    if (subcommand === \"branch\") {\n        const action = commandWords(rawArgs, \"db\")[2];\n        if (action === \"delete\") await refuseDeletingActiveBranch(projectRoot, rawArgs);\n        if (action && REGISTRY_ACTIONS.has(action)) driverArgs = await onParentDatabase(projectRoot, rawArgs, action);\n    }\n\n    // Before the database is resolved — and, for the managed one, started —\n    // and in the reader's terms. See utils/path-flags.ts.\n    refuseMissingCollectionsPath(driverArgs, process.cwd(), requireBackendDir(projectRoot));\n\n    try {\n        await runDriverDbCommand(driverArgs);\n    } catch (error) {\n        // The CLI entry point is where a managed-database refusal becomes an\n        // exit code. The guards raise it instead of exiting so that `rebase dev`,\n        // which runs `db push` in-process, survives one; here, where a person\n        // typed the command, it is exactly as fatal as it always was.\n        if (error instanceof ManagedDatabaseRefusal) {\n            printManagedDatabaseRefusal(error);\n            process.exit(1);\n        }\n        // A child that exited non-zero already printed its diagnostics through\n        // inherited stdio; only the errors raised above have a message worth\n        // adding here.\n        reportSpawnFailure(error);\n        process.exit(1);\n    }\n}\n\n/**\n * `rebase db url` — the connection string this project is using, on stdout.\n *\n * The managed database is the one case where nothing on disk names it: `.env`\n * ships `DATABASE_URL` commented out on purpose, the port is derived from the\n * project path, and the data lives under `.rebase/`. A headless project has no\n * admin panel to open either, so before this there was no way to point `psql`,\n * a GUI client or a seeding script at the database `rebase dev` had just\n * created — short of reading the CLI's source.\n *\n * Resolution is the same ordered rule every other command uses, so this prints\n * your own `DATABASE_URL` when you have set one rather than inventing a second\n * answer. Nothing but the URL goes to stdout, so it pipes:\n *\n *     psql \"$(rebase db url)\"\n *\n * It starts the managed database if it is not running, because a connection\n * string for a database nobody is serving is not an answer.\n */\nasync function printDatabaseUrl(projectRoot: string, rawArgs: readonly string[]): Promise<void> {\n    // Strict about its flags, like every other command.\n    //\n    // The `db` family's strictness lives in the driver, and `url` is answered\n    // here, before the driver is ever spawned — so it accepted anything.\n    // `rebase db url --bogus` printed the URL and exited 0, and so did\n    // `rebase db url --json`, which is worse: a flag that looks like it asks\n    // for a different output format, silently ignored, hands a script a bare\n    // string it will try to parse as JSON.\n    parseCommandArgs({\n        spec: { \"--database-url\": String, \"--docker\": Boolean },\n        rawArgs: [...rawArgs],\n        commandWords: 2,\n        command: \"db url\",\n        maxPositionals: 0\n    });\n\n    const { prepareDatabaseEnv } = await import(\"../dev-db/prepare\");\n    const { readEnvFile } = await import(\"../utils/project\");\n\n    const prepared = await prepareDatabaseEnv(projectRoot, {\n        flagUrl: readFlagValue(rawArgs, \"--database-url\"),\n        flagDocker: rawArgs.includes(\"--docker\"),\n        quiet: true,\n        // Progress goes to stderr: stdout is the URL and nothing else.\n        onProgress: message => console.error(chalk.gray(`  ${message}`))\n    });\n\n    const url = databaseUrlOf(prepared, readEnvFile(projectRoot));\n    if (!url) {\n        console.error(chalk.red(\"  ✗ This project has no database URL to print.\"));\n        console.error(chalk.gray(\"    Set DATABASE_URL in .env, or run `rebase dev` to start the managed one.\"));\n        process.exit(1);\n    }\n\n    console.log(url);\n}\n\n/**\n * `rebase db stop` and `rebase db reset`, for the managed database only.\n *\n * `reset` deletes the data directory rather than dropping schemas: \"give me an\n * empty database\" is the only thing anyone means by it, and doing it by\n * removing the directory cannot leave a half-dropped schema behind.\n */\nasync function manageLocalDatabase(\n    subcommand: \"stop\" | \"reset\",\n    projectRoot: string,\n    rawArgs: readonly string[]\n): Promise<void> {\n    const { resetManagedDatabase, stopManagedDatabase, findRunningDaemon } = await import(\"../dev-db/daemon\");\n    const { dataDir } = await import(\"../dev-db/state\");\n\n    // What \"nothing here\" means, in the words of the project it is said to.\n    //\n    // \"No development database was running\" / \"No development database to\n    // reset\" is true of the managed one and reads as being about the reader's\n    // own Postgres — which these commands do not touch and could not stop.\n    // On a project that named its own database, the sentence they need is that\n    // it was not what this command was about.\n    const nothingHere = (): string => {\n        const kind = devDatabaseKind(projectRoot);\n        const verb = subcommand === \"stop\" ? \"was not running\" : \"does not exist\";\n        if (kind && kind !== \"managed\") {\n            return `  The managed development database (PGlite) ${verb}; `\n                + `this project uses its own DATABASE_URL, which is untouched.`;\n        }\n\n        return subcommand === \"stop\"\n            ? \"  The managed development database (PGlite) was not running.\"\n            : \"  There is no managed development database (PGlite) to reset.\";\n    };\n\n    if (subcommand === \"stop\") {\n        const stopped = await stopManagedDatabase(projectRoot);\n        console.log(stopped\n            ? chalk.green(\"✓ Development database stopped. Data is kept — `rebase dev` will start it again.\")\n            : chalk.gray(nothingHere()));\n\n        return;\n    }\n\n    const running = await findRunningDaemon(projectRoot);\n    const hasData = fs.existsSync(dataDir(projectRoot));\n    if (!running && !hasData) {\n        console.log(chalk.gray(nothingHere()));\n\n        return;\n    }\n\n    // Destructive, and the data is not backed up anywhere: it only ever existed\n    // on this machine. So it asks, unless the caller has said not to — and\n    // without a TTY there is nobody to ask, which is a refusal rather than an\n    // assumption.\n    if (!rawArgs.includes(\"--yes\") && !rawArgs.includes(\"-y\")) {\n        if (!process.stdin.isTTY) {\n            console.error(chalk.red(\"✗ `rebase db reset` deletes the local database and cannot prompt here.\"));\n            console.error(chalk.yellow(\"  Re-run with --yes if that is what you intend.\"));\n            process.exit(1);\n        }\n\n        const { confirmed } = await inquirer.prompt([{\n            type: \"confirm\",\n            name: \"confirmed\",\n            message: `Delete the development database at ${dataDir(projectRoot)}? This cannot be undone.`,\n            default: false\n        }]);\n        if (!confirmed) {\n            console.log(chalk.gray(\"  Left alone.\"));\n\n            return;\n        }\n    }\n\n    await resetManagedDatabase(projectRoot);\n    console.log(chalk.green(\"✓ Development database deleted. `rebase dev` will create a fresh one.\"));\n}\n\n/**\n * `rebase db pull --from <url>` — copy another database's contents into local\n * development.\n *\n * Deliberately one-directional. There is no flag that makes this push, because\n * a tool that can copy in both directions eventually copies in the wrong one,\n * and the wrong one here means overwriting production with a laptop.\n */\nasync function pullIntoLocal(projectRoot: string, rawArgs: readonly string[]): Promise<void> {\n    const { anonymizeStatements, describeTarget, dumpArgs, findPgTool, restoreArgs, restoreOutcome } =\n        await import(\"../dev-db/pull\");\n    const { prepareDatabaseEnv } = await import(\"../dev-db/prepare\");\n    const { readEnvFile } = await import(\"../utils/project\");\n\n    const source = readFlagValue(rawArgs, \"--from\");\n    if (!source) {\n        console.error(chalk.red(\"✗ `rebase db pull` needs a source: --from <connection-string>\"));\n        console.error(chalk.gray(\"  Example: rebase db pull --from \\\"$PRODUCTION_DATABASE_URL\\\"\"));\n        process.exit(1);\n    }\n\n    const schemas = rawArgs.flatMap((arg, index) =>\n        arg === \"--schema\" && rawArgs[index + 1] ? [rawArgs[index + 1]] : []);\n    const anonymize = rawArgs.includes(\"--anonymize\");\n\n    // Both checked before anything destructive: discovering either is missing\n    // after dropping the local database would be the worst possible ordering.\n    for (const tool of [\"pg_dump\", \"pg_restore\"] as const) {\n        if (!await findPgTool(tool)) {\n            console.error(chalk.red(`✗ \\`${tool}\\` is not on PATH, and this command cannot run without it.`));\n            console.error(chalk.gray(\"  Install the PostgreSQL client tools, e.g. `brew install libpq`.\"));\n            process.exit(1);\n        }\n    }\n\n    // `--database-url` is refused rather than honoured, and refused rather than\n    // ignored — which is what it was.\n    //\n    // Ignored is the dangerous one. The flag was accepted, dropped on the floor,\n    // and the pull went ahead against the `.env` database: someone writing\n    // `rebase db pull --from prod --database-url scratch --yes` destroyed their\n    // working database while naming a different one. A flag that changes nothing\n    // is a bug; a destructive flag that changes nothing is a data-loss bug.\n    //\n    // Honoured is the other tempting answer, and it breaks the one guarantee\n    // this command makes. The target is always the local development database\n    // *by construction* — there is no `--to`, and no flag that reverses the\n    // direction — because a tool that can copy both ways eventually copies the\n    // wrong way, and the wrong way here is a laptop over production.\n    // `--database-url prod` is exactly that instruction written as a target.\n    //\n    // `--docker` is a different question and is passed through: it says how to\n    // get a local database, not which database to overwrite.\n    const targetFlag = readFlagValue(rawArgs, \"--database-url\");\n    if (targetFlag !== null) {\n        console.error(chalk.red(\"✗ `rebase db pull` does not take --database-url.\"));\n        console.error(\"\");\n        console.error(chalk.gray(\"  The target is always this project's local development database. There is\"));\n        console.error(chalk.gray(\"  no flag that makes this write somewhere else, deliberately: a command that\"));\n        console.error(chalk.gray(\"  can copy in both directions eventually copies in the wrong one.\"));\n        console.error(\"\");\n        console.error(chalk.gray(`  To read from another database, that is ${chalk.cyan(\"--from\")}:`));\n        console.error(chalk.gray(`  rebase db pull --from ${targetFlag}`));\n        process.exit(1);\n    }\n\n    const prepared = await prepareDatabaseEnv(projectRoot, {\n        flagDocker: rawArgs.includes(\"--docker\"),\n        onProgress: (message) => console.log(chalk.gray(`  ${message}`))\n    });\n    // The database `rebase db url` prints, resolved the one way — see\n    // `databaseUrlOf`. Reading only `prepared.env` missed the commonest\n    // configuration there is: `DATABASE_URL` in `.env` and nowhere else.\n    const target = databaseUrlOf(prepared, readEnvFile(projectRoot)) ?? \"\";\n    if (!target) {\n        console.error(chalk.red(\"✗ No local database to pull into.\"));\n        console.error(chalk.gray(\"  Set DATABASE_URL in .env, or run `rebase dev` to start the managed one.\"));\n        process.exit(1);\n    }\n\n    const plan = { source, target, anonymize, schemas };\n\n    // Said in full, before anything happens. The target is destroyed, and where\n    // the data comes to rest on disk is the part people forget.\n    console.log(\"\");\n    console.log(chalk.bold(\"  This will replace your local database.\"));\n    console.log(`    ${chalk.gray(\"From\")}  ${describeTarget(source)}`);\n    console.log(`    ${chalk.gray(\"Into\")}  ${describeTarget(target)}${prepared.dataDir ? chalk.gray(`  (${prepared.dataDir})`) : \"\"}`);\n    console.log(`    ${chalk.gray(\"Data\")}  ${anonymize\n        ? \"personal-looking columns will be overwritten after the copy\"\n        : chalk.yellow(\"copied as-is, including any personal data\")}`);\n    if (schemas.length > 0) console.log(`    ${chalk.gray(\"Schemas\")}  ${schemas.join(\", \")}`);\n    console.log(\"\");\n\n    if (!rawArgs.includes(\"--yes\") && !rawArgs.includes(\"-y\")) {\n        if (!process.stdin.isTTY) {\n            console.error(chalk.red(\"✗ This replaces the local database and cannot prompt here.\"));\n            console.error(chalk.yellow(\"  Re-run with --yes if that is what you intend.\"));\n            process.exit(1);\n        }\n        const { confirmed } = await inquirer.prompt([{\n            type: \"confirm\", name: \"confirmed\", message: \"Continue?\", default: false\n        }]);\n        if (!confirmed) {\n            console.log(chalk.gray(\"  Nothing was changed.\"));\n\n            return;\n        }\n    }\n\n    const dumpFile = path.join(os.tmpdir(), `rebase-pull-${process.pid}.dump`);\n    let failure: string | null = null;\n    try {\n        console.log(chalk.gray(\"  Dumping…\"));\n        await execa(\"pg_dump\", [...dumpArgs(plan), \"--file\", dumpFile], { stdio: [\"ignore\", \"inherit\", \"inherit\"] });\n\n        console.log(chalk.gray(\"  Restoring…\"));\n        // stderr is shown as it arrives and kept, for the count in its summary\n        // line. Not rejected: every way this ends is judged by `restoreOutcome`,\n        // and a failure is reported only after whatever did arrive has been\n        // anonymized.\n        const restored = restoreOutcome(await execa(\"pg_restore\", restoreArgs(plan, dumpFile), {\n            stdin: \"ignore\",\n            stdout: \"inherit\",\n            stderr: [\"pipe\", \"inherit\"],\n            reject: false\n        }));\n        failure = restored.failure;\n\n        // Before the verdict: a partial copy of personal data on a laptop is\n        // still personal data on a laptop.\n        if (anonymize && restored.started) {\n            const { Client } = await import(\"pg\");\n            const client = new Client({ connectionString: target });\n            await client.connect();\n            try {\n                const { rows } = await client.query<{ schema: string; table: string; column: string; dataType: string }>(\n                    `SELECT table_schema AS \"schema\", table_name AS \"table\",\n                            column_name AS \"column\", data_type AS \"dataType\"\n                       FROM information_schema.columns\n                      WHERE table_schema NOT IN ('pg_catalog','information_schema')`\n                );\n                const statements = anonymizeStatements(rows);\n                for (const statement of statements) await client.query(statement);\n                console.log(chalk.green(`  ✓ Anonymized ${statements.length} table(s).`));\n                console.log(chalk.gray(\"    Name-based and best-effort: a free-text column may still hold personal data.\"));\n            } finally {\n                await client.end();\n            }\n        }\n\n        if (!failure) await restoreAppRole(target);\n    } finally {\n        fs.rmSync(dumpFile, { force: true });\n    }\n\n    if (failure) {\n        console.error(chalk.red(`✗ ${failure}`));\n        console.error(chalk.yellow(`  The local database holds an incomplete copy of ${describeTarget(source)}.`));\n        console.error(chalk.gray(\"  Fix what the errors above name — often an extension or a role the source has — and pull again.\"));\n        process.exit(1);\n    }\n\n    console.log(chalk.green(\"✓ Local database now holds a copy of \" + describeTarget(source)));\n}\n\n/**\n * Give the restored copy back the privileges `pg_dump` stripped.\n *\n * A pull without this ends on a green tick and hands over a database the\n * application cannot read: `--no-privileges` removes every GRANT, so the copy\n * has the source's RLS policies and none of the grants behind them, and the\n * first query as `rebase_user` fails with `permission denied`. Measured — 68\n * policies and 60 grants in, 68 policies and 0 grants out.\n *\n * `ensureAppRole` is the routine boot runs and `rebase db push` runs, so the\n * pulled database ends up in the state a booted one is in, and there is no\n * second description of these grants to drift. `detectConnectionPosture` gates\n * it the same way `db push` does: a connection that cannot create roles reports\n * that rather than failing the pull, which has already succeeded by this point.\n *\n * Failure here is a warning, not an error. The data is restored and correct; a\n * missing grant is repaired by the next `rebase dev` or `rebase db push`, and\n * saying so beats unwinding a copy that is fine.\n */\nasync function restoreAppRole(target: string): Promise<void> {\n    const { Client } = await import(\"pg\");\n    const { detectConnectionPosture, ensureAppRole, REBASE_USER_ROLE } =\n        await import(\"@rebasepro/server-postgres\");\n    const { provisionableSchemas } = await import(\"../dev-db/pull\");\n\n    const client = new Client({ connectionString: target });\n    await client.connect();\n    try {\n        const runSql = async (text: string) => (await client.query(text)).rows as Record<string, unknown>[];\n        const posture = await detectConnectionPosture(runSql);\n        if (!posture.privileged) {\n            console.log(chalk.yellow(\n                `  ⚠ Could not re-grant the \"${REBASE_USER_ROLE}\" role — this connection may not create roles.`\n            ));\n            console.log(chalk.gray(\"    The copy has its RLS policies but no privileges behind them;\"));\n            console.log(chalk.gray(\"    `rebase dev` or `rebase db push` will provision them.\"));\n\n            return;\n        }\n\n        const { rows } = await client.query<{ schema: string }>(\n            \"SELECT nspname AS \\\"schema\\\" FROM pg_namespace\"\n        );\n        const schemas = provisionableSchemas(rows);\n        await ensureAppRole(runSql, schemas);\n        console.log(chalk.gray(\n            `  ✓ Re-granted \"${REBASE_USER_ROLE}\" on ${schemas.length} schema(s) — pg_dump strips privileges.`\n        ));\n    } catch (error) {\n        console.log(chalk.yellow(\n            `  ⚠ Restored, but could not re-grant \"rebase_user\": ${error instanceof Error ? error.message : String(error)}`\n        ));\n        console.log(chalk.gray(\"    Run `rebase db push` (or start `rebase dev`) to provision it.\"));\n    } finally {\n        await client.end();\n    }\n}\n\n/**\n * Start the compose database a `db … --docker` was asked to talk to.\n *\n * `--docker` resolved the compose URL and stopped there, so every `db`\n * subcommand carrying it reached a container nobody had started —\n * `ECONNREFUSED 127.0.0.1:5436`, two lines, no diagnosis — including the\n * commands the managed-database refusals send readers to `--docker` for.\n *\n * `rebase dev --docker`'s preflight, called with the compose URL and nothing\n * to push: this is not a schema step, and `rebase db push --docker` is the\n * push. A failure here is reported and not fatal — the command runs and its\n * own connection error follows, which is the same contract `dev` keeps.\n */\nexport async function ensureDockerDatabase(projectRoot: string, rawArgs: readonly string[]): Promise<void> {\n    if (!rawArgs.includes(\"--docker\")) return;\n\n    const { ensureDevDatabase } = await import(\"../utils/dev-preflight\");\n    const { readEnvFile } = await import(\"../utils/project\");\n    const { resolveComposeUrl } = await import(\"../dev-db/prepare\");\n\n    const composeUrl = resolveComposeUrl(projectRoot, readEnvFile(projectRoot));\n    if (!composeUrl) {\n        // `prepareDatabaseEnv` raises the full message a moment later; saying\n        // it twice would be worse than saying it once, in its own words.\n        return;\n    }\n\n    await ensureDevDatabase({\n        projectRoot,\n        databaseUrl: composeUrl,\n        disabled: false,\n        // Never a push. `rebase db push --docker` is one, and it runs next.\n        hasCollections: false,\n        pushSchema: async () => undefined,\n        log: message => console.log(message)\n    });\n}\n\n/**\n * You cannot delete the branch you are standing on.\n *\n * Not a new rule — it was always refused, by a message about a database the\n * developer had never named. After `switch feature_x` the resolved DSN *is*\n * `rb_feature_x`, so `BranchService.deleteBranch` compared it against the\n * connected database, found them equal, and answered `✗ Cannot delete the main\n * database.` The main database is precisely what the developer was not on.\n *\n * Answered here because the pointer is the CLI's: the driver runs as a child\n * process that has never heard of it, and cannot tell \"the branch you are on\"\n * from \"the main database\" — those are the same connection string to it.\n */\nasync function refuseDeletingActiveBranch(projectRoot: string, rawArgs: readonly string[]): Promise<void> {\n    const [, , , name] = commandWords(rawArgs, \"db\");\n    if (!name) return;\n\n    const { readActiveBranch } = await import(\"../dev-db/branch-pointer\");\n    const active = readActiveBranch(projectRoot);\n    if (active?.name !== name) return;\n\n    const off = \"rebase db branch switch --off\";\n    const del = `rebase db branch delete ${name}`;\n    const column = Math.max(off.length, del.length) + 4;\n\n    console.error(\"\");\n    console.error(chalk.red(`✗ You are on branch \"${name}\" — leave it before deleting it.`));\n    console.error(\"\");\n    console.error(chalk.gray(`  Every database command in this checkout is pointed at ${active.database},`));\n    console.error(chalk.gray(\"  including this one, so the delete would be asking that database to drop\"));\n    console.error(chalk.gray(\"  itself.\"));\n    console.error(\"\");\n    console.error(`  ${chalk.cyan(off)}${\" \".repeat(column - off.length)}back to the main database`);\n    console.error(`  ${chalk.cyan(del)}${\" \".repeat(column - del.length)}then this works`);\n    console.error(\"\");\n    process.exit(1);\n}\n\n/** The `branch` actions that read or write the registry — every one but `switch`. */\nconst REGISTRY_ACTIONS = new Set([\"list\", \"create\", \"delete\", \"info\", \"prune\"]);\n\n/**\n * Every `branch` action runs against the parent, where the registry lives.\n *\n * `rebase.branches` is written in the database branches are made *from*, and a\n * branch is a `CREATE DATABASE … TEMPLATE` copy — so the copy carries a\n * snapshot of that table taken at branch time, and every branch made since is\n * missing from it. After `switch feature_x`, `branch list` connected to\n * `rb_feature_x` and answered `No branches found. Create one with: rebase db\n * branch create <name>` while `branch switch` with no argument, one command\n * earlier, had said `● On branch feature_x`.\n *\n * The same snapshot answered `create`, `delete`, `info` and `prune`: a branch\n * created from a switched checkout was recorded only in the copy, so `list`\n * never showed it and `delete` from the main checkout said \"not found\" while\n * its database stayed; `info` and `delete` could not find a branch made after\n * the one this checkout is on. The Branches pane in Studio was fixed the same\n * way (`REBASE_BRANCH_PARENT_DATABASE`).\n *\n * `create` still copies what this checkout is on — a branch of the branch, a\n * thing the developer asked for by switching first — so it is given\n * `--from <the branch's database>` unless it names a source itself.\n *\n * Resolved with `branch: null` — the same rule `switch` uses to find what to\n * branch *from* — and relayed as `--database-url`, which the driver honours\n * over anything it would resolve for itself.\n */\nasync function onParentDatabase(projectRoot: string, rawArgs: string[], action: string): Promise<string[]> {\n    // An explicit `--database-url` is the developer naming the database; this\n    // never overrides one.\n    if (readFlagValue(rawArgs, \"--database-url\") !== null) return rawArgs;\n\n    const { readActiveBranch } = await import(\"../dev-db/branch-pointer\");\n    const active = readActiveBranch(projectRoot);\n    if (!active) return rawArgs;\n\n    const { readEnvFile } = await import(\"../utils/project\");\n    const { resolveDevDatabase } = await import(\"../dev-db/resolve\");\n    const { resolveComposeUrl } = await import(\"../dev-db/prepare\");\n\n    const envFile = readEnvFile(projectRoot);\n    const parent = resolveDevDatabase({\n        flagDocker: rawArgs.includes(\"--docker\"),\n        env: process.env,\n        envFile,\n        branch: null,\n        composeUrl: resolveComposeUrl(projectRoot, envFile)\n    });\n    const url = (parent.kind === \"managed\" ? null : parent.url)?.trim();\n    if (!url) return rawArgs;\n\n    console.log(chalk.gray(`  ● On branch ${active.name} — using the main database, where the branch registry lives.`));\n\n    const from = action === \"create\" && readFlagValue(rawArgs, \"--from\") === null\n        ? [\"--from\", active.database]\n        : [];\n\n    return [...rawArgs, ...from, \"--database-url\", url];\n}\n\n/**\n * `rebase db branch switch <name>` — point this checkout at a branch.\n *\n * The step branching was missing. `create` copied the database in about a\n * second and then printed `Database: rb_feature_auth` and stopped: there was no\n * `switch`, no `--branch` on `rebase dev`, and no `REBASE_BRANCH`. The only way\n * to use a branch was to hand-edit `DATABASE_URL`, while the documentation said\n * \"the CLI updates your local development configuration\" — it did not, and the\n * `.env` was byte-identical afterwards.\n *\n * Three things it insists on:\n *\n * - **The branch has to exist.** Writing a pointer to a database that was never\n *   created turns a typo into a connection error on the *next* command, which\n *   is the one place it cannot be explained. Checked against\n *   `rebase.branches` and `pg_database` both, because a branch dropped outside\n *   Rebase leaves the metadata row behind.\n *\n * - **It says what changed, and how to undo it.** A command that silently\n *   redirects every subsequent database operation owes the reader the database\n *   name it moved to and the words that move it back.\n *\n * - **It never edits `.env`.** See `branch-pointer.ts`.\n */\nasync function switchBranch(projectRoot: string, rawArgs: readonly string[]): Promise<void> {\n    const { branchDatabaseName, clearActiveBranch, databaseNameOf, readActiveBranch, writeActiveBranch } =\n        await import(\"../dev-db/branch-pointer\");\n    const { readEnvFile } = await import(\"../utils/project\");\n    const { resolveDevDatabase } = await import(\"../dev-db/resolve\");\n    const { resolveComposeUrl } = await import(\"../dev-db/prepare\");\n\n    // Read as a flag rather than as the name in the third position, so\n    // `switch --off` and `switch feature --off` mean the same thing. The doc\n    // verifier reads a command's flags out of exactly this shape, which is the\n    // other reason: a flag it cannot see is one it reports as unrunnable in\n    // every page that documents it.\n    const goingOff = rawArgs.includes(\"--off\") || rawArgs.includes(\"--main\");\n\n    // [\"db\", \"branch\", \"switch\", <name>], with any flags taken back out —\n    // `rebase --debug db branch switch feature` read the name as \"switch\".\n    const name = commandWords(rawArgs, \"db\")[3];\n\n    // The database to branch from, resolved by the ordered rule every sibling\n    // uses. This read `readEnvFile(projectRoot).DATABASE_URL` and nothing else,\n    // so `export DATABASE_URL=…; rebase db branch create x` created a branch and\n    // `rebase db branch switch x` then answered \"This project has no\n    // DATABASE_URL, so there is no database to branch from\" — about a project\n    // that had one, in the shell, where `branching.md` documents it as rule (2)\n    // and `create` had just read it.\n    //\n    // `branch: null`, deliberately: this command is what sets the pointer, and\n    // the pointer that exists must never become the base of the next switch —\n    // that is how a branch of a branch of a branch happens by accident.\n    const envFile = readEnvFile(projectRoot);\n    const resolved = resolveDevDatabase({\n        flagUrl: readFlagValue(rawArgs, \"--database-url\"),\n        flagDocker: rawArgs.includes(\"--docker\"),\n        env: process.env,\n        envFile,\n        branch: null,\n        composeUrl: resolveComposeUrl(projectRoot, envFile)\n    });\n    const base = (resolved.kind === \"managed\" ? null : resolved.url)?.trim() || undefined;\n\n    // `switch` with no argument reports rather than changes. \"Which branch am I\n    // on\" is asked far more often than \"move me\", and answering it should not\n    // require guessing a flag.\n    if (!name && !goingOff) {\n        const active = readActiveBranch(projectRoot);\n        console.log(\"\");\n        if (active) {\n            console.log(`  ${chalk.green(\"●\")} On branch ${chalk.bold(active.name)} ${chalk.gray(`(${active.database})`)}`);\n            console.log(chalk.gray(`    Back to the main database: ${chalk.cyan(\"rebase db branch switch --off\")}`));\n        } else {\n            const main = base ? databaseNameOf(base) : null;\n            console.log(`  ${chalk.gray(\"●\")} On the main database${main ? chalk.gray(` (${main})`) : \"\"}`);\n            console.log(chalk.gray(`    Switch to a branch: ${chalk.cyan(\"rebase db branch switch <name>\")}`));\n        }\n        console.log(\"\");\n\n        return;\n    }\n\n    if (goingOff) {\n        const active = readActiveBranch(projectRoot);\n        clearActiveBranch(projectRoot);\n        console.log(\"\");\n        console.log(active\n            ? chalk.green(`  ✓ Back on the main database${base ? ` (${databaseNameOf(base)})` : \"\"}.`)\n            : chalk.gray(\"  Already on the main database.\"));\n        console.log(\"\");\n\n        return;\n    }\n\n    if (!base) {\n        console.error(chalk.red(\"✗ There is no database to branch from.\"));\n        console.error(chalk.gray(resolved.kind === \"managed\"\n            ? \"  This project is on the managed development database, which serves exactly one —\"\n            : \"  --docker needs a docker-compose.yml with a db service, and this project has none —\"));\n        console.error(chalk.gray(\"  and branching copies a database. Set DATABASE_URL in .env or in your\"));\n        console.error(chalk.gray(\"  shell, or run `rebase dev --docker`.\"));\n        process.exit(1);\n    }\n\n    const database = branchDatabaseName(name);\n\n    // Verified before the pointer is written, not after.\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: base });\n    try {\n        await client.connect();\n    } catch (error) {\n        console.error(chalk.red(`✗ Could not reach the database to check that branch \"${name}\" exists.`));\n        console.error(chalk.gray(`  ${error instanceof Error ? error.message : String(error)}`));\n        process.exit(1);\n    }\n    try {\n        const { rows } = await client.query<{ registered: boolean; present: boolean }>(\n            `SELECT EXISTS (SELECT 1 FROM rebase.branches WHERE name = $1)      AS registered,\n                    EXISTS (SELECT 1 FROM pg_database    WHERE datname = $2)    AS present`,\n            [name, database]\n        ).catch(() => ({ rows: [{ registered: false, present: false }] }));\n\n        const { registered, present } = rows[0] ?? { registered: false, present: false };\n        if (!present) {\n            console.error(chalk.red(`✗ Branch \"${name}\" does not exist.`));\n            console.error(registered\n                // The metadata row outlives a database dropped with plain SQL.\n                ? chalk.gray(`  It is registered but its database (${database}) is gone — someone dropped it outside Rebase.`)\n                : chalk.gray(`  ${chalk.cyan(\"rebase db branch list\")} shows the ones that do.`));\n            process.exit(1);\n        }\n    } finally {\n        await client.end();\n    }\n\n    writeActiveBranch(projectRoot, { name, database });\n\n    console.log(\"\");\n    console.log(chalk.green(`  ✓ Switched to branch \"${name}\".`));\n    console.log(chalk.gray(`    Database: ${database}`));\n    console.log(chalk.gray(\"    Every rebase command in this checkout now uses it — dev, db push, migrate.\"));\n    console.log(chalk.gray(`    Back to the main database: ${chalk.cyan(\"rebase db branch switch --off\")}`));\n    console.log(\"\");\n}\n\n/**\n * What each `rebase db <action>` does and takes.\n *\n * Kept here rather than delegated to the driver because the driver is reached\n * by *running* it — which is exactly what `--help` must not do. The page is\n * deliberately short: the authority on a flag is the command's own spec, and\n * `check-doc-commands.mjs` holds every command written in this repository's\n * markdown to it. What a reader needs from here is which subcommands exist and\n * what the destructive ones want before they will run.\n */\nconst DB_ACTION_HELP: Record<string, { usage: string; summary: string; notes?: string[] }> = {\n    push: {\n        usage: \"rebase db push [--collections <dir>] [--dry-run] [--allow-destructive] [--yes]\",\n        summary: \"Apply the schema straight to the database. Development only — it does not write a migration.\",\n        notes: [\n            \"--dry-run prints the SQL and applies nothing. Read it before you approve it.\",\n            \"A change that drops data, or re-keys a table (every row gets a new id), needs --allow-destructive.\",\n            `--collections <dir>: ${COLLECTIONS_FLAG_HELP}.`\n        ]\n    },\n    generate: {\n        usage: \"rebase db generate [--collections <dir>]\",\n        summary: \"Generate the Drizzle schema, the Postgres DDL and a SQL migration file from the collections.\",\n        notes: [\n            \"A migration that drops or narrows data is named when it is written. It is still written.\",\n            `--collections <dir>: ${COLLECTIONS_FLAG_HELP}.`\n        ]\n    },\n    migrate: {\n        usage: \"rebase db migrate [--baseline <version>] [--refuse-destructive] [amount]\",\n        summary: \"Run the pending migration files against the database.\",\n        notes: [\n            \"--refuse-destructive dry-runs the pending files and applies nothing when one drops or narrows data.\",\n            \"--baseline <version> records that version as already applied and starts from the next one.\",\n            \"It is what a database Rebase has already booted against needs: boot ensures the schema, so the first migration would try to create tables that are already there.\",\n            \"The version is the numeric prefix of a file in drizzle/migrations.\"\n        ]\n    },\n    branch: {\n        // Every action the dispatch answers and every flag its specs declare.\n        // The page is kept here rather than delegated because reaching the\n        // driver's own `printBranchHelp` means *running* the driver, which is\n        // what `--help` must not do — so `help-coverage.test.ts` holds the two\n        // to each other instead. It went two releases without learning `prune`,\n        // `--from`, `--force` or `--older-than`, all four of which the dispatch\n        // answers and the docs teach.\n        usage: \"rebase db branch <create|list|switch|delete|info|prune> [name]\",\n        summary: \"Database branching.\",\n        notes: [\n            \"create <name> [--from <source>] copies an existing database, files and all.\",\n            \"switch <name> points this checkout at a branch; every later command uses it.\",\n            \"switch with no name reports where you are; switch --off returns to the main database.\",\n            \"prune [--older-than <14|14d|2w>] removes branches nothing is using, and the entries that drifted.\",\n            \"prune --include-dev-diff also removes the Atlas scratch databases `db push` leaves behind.\",\n            \"prune asks before it drops anything; --yes, -y answers for you, which is the form a CI job wants.\",\n            \"--force disconnects other sessions first — Postgres refuses to copy or drop a database anything is connected to, usually your own `rebase dev`.\"\n        ]\n    },\n    backup: {\n        usage: \"rebase db backup [--out <path|s3://…>]\",\n        summary: \"Create a pg_dump backup. --out is resolved against the directory you are standing in.\",\n        notes: [\n            \"--output is accepted as an alias, as it is on `rebase build`.\",\n            \"`rebase db backup list` lists them, the way `rebase cloud db backup list` does.\"\n        ]\n    },\n    backups: {\n        usage: \"rebase db backups list [--out <path|s3://…>]\",\n        summary: \"List stored backups.\",\n        notes: [\"`rebase db backup list` is the same command, spelled the cloud family's way.\"]\n    },\n    url: {\n        usage: \"rebase db url [--database-url <url>] [--docker]\",\n        summary: \"Print the connection string this project uses. Nothing else goes to stdout, so it pipes.\",\n        notes: [\n            \"psql \\\"$(rebase db url)\\\"\",\n            \"Starts the managed database if it is not already running.\",\n            \"--database-url and --docker answer for the database `rebase dev` would pick with the same flag.\"\n        ]\n    },\n    restore: {\n        usage: \"rebase db restore <dump> [--target-db <name>] [--create-db] --yes\",\n        summary: \"Restore a backup with pg_restore.\",\n        notes: [\"Destructive, and refuses to run without --yes.\"]\n    },\n    pull: {\n        usage: \"rebase db pull --from <url> [--schema <name>] [--anonymize] [--yes]\",\n        summary: \"Copy another database into local development. One-directional by design — it can never push.\",\n        notes: [\"The target is not selectable: --database-url is refused, so this can never write to a remote database.\"]\n    },\n    stop: { usage: \"rebase db stop\", summary: \"Stop the managed development database. Data is kept.\" },\n    reset: {\n        usage: \"rebase db reset [--yes]\",\n        summary: \"Delete the managed development database and start over.\",\n        notes: [\"Destructive, and the data exists only on this machine.\"]\n    }\n};\n\n/** Every subcommand the family dispatches — the help table's keys. */\nexport const DB_SUBCOMMANDS = Object.keys(DB_ACTION_HELP);\n\nfunction printDbHelp(action?: string) {\n    const entry = action ? DB_ACTION_HELP[action] : undefined;\n    if (entry) {\n        console.log(`\n${chalk.bold(`rebase db ${action}`)}\n\n  ${entry.summary}\n\n${chalk.green.bold(\"Usage\")}\n  ${chalk.blue(entry.usage)}\n${entry.notes?.length ? `\\n${chalk.green.bold(\"Notes\")}\\n${entry.notes.map(n => `  ${chalk.gray(`• ${n}`)}`).join(\"\\n\")}\\n` : \"\"}\n${chalk.gray(\"Run `rebase db --help` for every subcommand.\")}\n`);\n        return;\n    }\n\n    console.log(`\n${chalk.bold(\"rebase db\")} — Database management commands\n\n${chalk.green.bold(\"Usage\")}\n  rebase db ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.gray(\"(Commands are provided by your active database driver plugin)\")}\n  ${chalk.blue.bold(\"url\")}        Print the connection string this project uses (pipes into psql)\n  ${chalk.blue.bold(\"pull\")}       Copy another database into local dev (--from <url>, --anonymize)\n  ${chalk.blue.bold(\"stop\")}       Stop the managed development database (data is kept)\n  ${chalk.blue.bold(\"reset\")}      Delete the managed development database and start over\n  ${chalk.blue.bold(\"push\")}       Apply schema directly to database (development)\n  ${chalk.blue.bold(\"generate\")}   Generate migration files\n  ${chalk.blue.bold(\"migrate\")}    Run pending migrations\n  ${chalk.blue.bold(\"branch\")}     Database branching (create, list, switch, delete, info, prune)\n  ${chalk.blue.bold(\"backup\")}     Create a backup with pg_dump (--out <path|s3://…>)\n  ${chalk.blue.bold(\"restore\")}    Restore a backup with pg_restore (destructive; needs --yes)\n  ${chalk.blue.bold(\"backups\")}    List stored backups (db backup list is the same)\n\n${chalk.green.bold(\"Examples\")}\n${dbExamples(devDatabaseKind())}\n  ${chalk.gray(\"# Back up to a local directory, then to object storage\")}\n  rebase db backup --out ./backups\n  rebase db backup --out s3://my-private-bucket/backups\n\n  ${chalk.gray(\"# Restore into a fresh database (safe: does not touch the live one)\")}\n  rebase db restore ./backups/rebase-app-20260714T030000Z.dump --create-db --target-db app_restored\n`);\n}\n\n/**\n * The examples, which are not the same on the managed development database.\n *\n * Every one of the four the help used to lead with — `db push`, `db generate`,\n * `db migrate`, `db branch` — is refused there, by guards in this same file\n * that explain exactly why. So on the project the CLI had just scaffolded, the\n * first thing `rebase db --help` offered was a command that answers with a\n * refusal, and the reader's most likely conclusion is that their install is\n * broken.\n *\n * Exported for its test.\n */\nexport function dbExamples(kind: DevDatabase[\"kind\"] | null): string {\n    if (kind === \"managed\") {\n        return `  ${chalk.gray(\"# Quick development workflow (this project is on the managed database)\")}\n  rebase schema generate\n  rebase dev                        ${chalk.gray(\"# boot applies your collections to it, additively\")}\n  rebase db push                    ${chalk.gray(\"# also drops, renames and narrows columns\")}\n\n  ${chalk.gray(\"# branch needs a Postgres of your own\")}\n  rebase dev --docker               ${chalk.gray(\"# starts one; or uncomment DATABASE_URL in .env\")}\n\n`;\n    }\n\n    return `  ${chalk.gray(\"# Quick development workflow\")}\n  rebase schema generate && rebase db push\n\n  ${chalk.gray(\"# Production migration workflow\")}\n  rebase db generate\n  rebase db migrate\n\n  ${chalk.gray(\"# Create a database branch and work on it\")}\n  rebase db branch create feature_auth\n  rebase db branch switch feature_auth\n  rebase db branch switch --off\n\n`;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,SAAgB,aAAa,SAA4B,SAA2B;CAChF,MAAM,QAAQ,QAAQ,MAAM,CAAC,CAAC,CAAC,QAAO,UAAS,CAAC,MAAM,WAAW,GAAG,CAAC;CACrE,MAAM,QAAQ,MAAM,QAAQ,OAAO;CACnC,OAAO,UAAU,KAAK,CAAC,IAAI,MAAM,MAAM,KAAK;AAChD;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,gBAAgB,SAA4B,SAA2B;CACnF,MAAM,OAAO,QAAQ,MAAM,CAAC;CAC5B,MAAM,QAAQ,KAAK,WAAU,UAAS,UAAU,OAAO;CACvD,IAAI,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI;CAC/B,OAAO,CAAC,GAAG,KAAK,MAAM,KAAK,GAAG,GAAG,KAAK,MAAM,GAAG,KAAK,CAAC;AACzD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACTA,SAAS,SAAS,OAAyB;CACvC,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,MAAM,UAAU;CAChB,OAAO,OAAO,QAAQ,aAAa,YAAY,OAAO,QAAQ,WAAW;AAC7E;AAEA,SAAgB,mBAAmB,OAAsB;CACrD,IAAI,SAAS,KAAK,KAAK,EAAE,iBAAiB,QAAQ;CAKlD,MAAM,UAAU;CAChB,MAAM,UAAU,OAAO,QAAQ,oBAAoB,WAC7C,QAAQ,kBACR,MAAM;CACZ,IAAI,SAAS,QAAQ,MAAM,MAAM,IAAI,KAAK,SAAS,CAAC;AACxD;;;;;;;;;;;;;;;;;;;;;;ACjBA,SAAgB,cACZ,UACA,SACkB;CAIlB,MAAM,SAAS,UAAsC,SAAS,MAAM,KAAK,IAAI,QAAQ,KAAA;CAErF,OAAO,MAAM,SAAS,IAAI,YAAY,KAC/B,MAAM,SAAS,SAAS,SAAS,YAAY,KAAA,IAAY,SAAS,SAAS,GAAG,KAC9E,MAAM,QAAQ,YAAY,KAC1B,MAAM,QAAQ,IAAI,YAAY;AACzC;;;;;;;;AASA,IAAM,wBAAwB;;;;;;;;;;;;;;AAe9B,IAAa,mBAAsC;CAAC;CAAS;CAAY;CAAM;CAAiB;AAAI;;;;;;;;;;;;;;;AAgBpG,SAAgB,wBACZ,MACA,KACA,YAA+B,kBACvB;CACR,MAAM,aAAa,SAAiB,UAAU,SAAS,IAAI;;;;;;;;;;CAU3D,MAAM,8BAAc,IAAI,IAAI;EACxB;EAAS;EAAY;EAAM;EAAe;EAAoB;CAClE,CAAC;CACD,MAAM,MAAM,CAAC,GAAG,IAAI;CAEpB,KAAK,IAAI,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;EACjC,MAAM,MAAM,IAAI;EAGhB,MAAM,KAAK,IAAI,QAAQ,GAAG;EAC1B,IAAI,KAAK,KAAK,UAAU,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG;GACvC,MAAM,QAAQ,IAAI,MAAM,KAAK,CAAC;GAC9B,IAAI,SAAS,CAAC,sBAAsB,KAAK,KAAK,GAC1C,IAAI,KAAK,GAAG,IAAI,MAAM,GAAG,EAAE,EAAE,GAAG,KAAK,QAAQ,KAAK,KAAK;GAE3D;EACJ;EAGA,IAAI,UAAU,GAAG,GAAG;GAChB,MAAM,QAAQ,IAAI,IAAI;GACtB,IAAI,SAAS,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,sBAAsB,KAAK,KAAK,GAAG;IACvE,IAAI,IAAI,KAAK,KAAK,QAAQ,KAAK,KAAK;IACpC;GACJ;EACJ;CACJ;CAKA,MAAM,YAAY,IAAI,QAAQ,SAAS;CACvC,IAAI,cAAc,IACd,KAAK,IAAI,IAAI,YAAY,GAAG,IAAI,IAAI,QAAQ,KAAK;EAC7C,MAAM,MAAM,IAAI;EAChB,IAAI,IAAI,WAAW,GAAG,GAAG;GAGrB,IAAI,CAAC,IAAI,SAAS,GAAG,KAAK,YAAY,IAAI,GAAG,GAAG;GAChD;EACJ;EAEA,IAAI,CAAC,sBAAsB,KAAK,GAAG,GAAG,IAAI,KAAK,KAAK,QAAQ,KAAK,GAAG;EACpE;CACJ;CAGJ,OAAO;AACX;;;;;;;;;AAUA,SAAS,cAAc,SAA4B,MAA6B;CAC5E,KAAK,IAAI,QAAQ,GAAG,QAAQ,QAAQ,QAAQ,SAAS,GAAG;EACpD,MAAM,MAAM,QAAQ;EACpB,IAAI,QAAQ,MAAM,OAAO,QAAQ,QAAQ,MAAM;EAC/C,IAAI,IAAI,WAAW,GAAG,KAAK,EAAE,GAAG,OAAO,IAAI,MAAM,KAAK,SAAS,CAAC;CACpE;CAEA,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;AAwBA,IAAM,2CAA2B,IAAI,IAAI;CAAC;CAAQ;CAAY;AAAS,CAAC;;;;;;;;;;;;;;;;AAiBxE,IAAa,yBAAb,cAA4C,MAAM;;CAE9C;CAEA,YAAY,SAAiB,OAA0B;EACnD,MAAM,OAAO;EACb,KAAK,OAAO;EACZ,KAAK,QAAQ;CACjB;AACJ;;AAGA,SAAgB,4BAA4B,SAAuC;CAC/E,KAAK,MAAM,QAAQ,QAAQ,OAAO,QAAQ,MAAM,IAAI;AACxD;;;;;;AAOA,IAAa,oBAAoB;;AAGjC,IAAM,wBAAwB,aACzB,MAAM,OAAO,oCAAA,CAAiC,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;AAyBzE,eAAsB,oBAClB,SACA,MACA,KACA,QAAyC,uBACJ;CACrC,IAAI,SAAS,WAAW,OAAO,KAAA;CAC/B,MAAM,CAAC,QAAQ,cAAc,aAAa,SAAS,IAAI;CACvD,IAAI,WAAW,QAAQ,CAAC,yBAAyB,IAAI,cAAc,EAAE,GAAG,OAAO,KAAA;CAC/E,IAAI,IAAA,uBAAsB,EAAE,KAAK,GAAG,OAAO,KAAA;CAE3C,IAAI;EACA,OAAO,MAAM,MAAM;CACvB,SAAS,KAAK;EACV,MAAM,UAAU,aAAa,WAAW;EACxC,MAAM,IAAI,uBAAuB,SAAS;GACtC;GACA,MAAM,IAAI,OAAO,SAAS;GAC1B,MAAM,KAAK,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG;GACpE;GACA,MAAM,KAAK,6EAA6E;GACxF,MAAM,KAAK,iEAAiE;GAC5E;GACA,MAAM,KAAK,KAAK,MAAM,KAAK,YAAY,EAAE,gEAAgE;GACzG,MAAM,KAAK,SAAS,kBAAkB,yDAAyD;GAC/F,MAAM,KAAK,6EAA6E;GACxF;EACJ,CAAC;CACL;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCA,SAAgB,8BAA8B,SAAmB,MAAoB;CACjF,IAAI,SAAS,WAAW;CACxB,MAAM,CAAC,QAAQ,cAAc,aAAa,SAAS,IAAI;CACvD,IAAI,WAAW,QAAQ,eAAe,UAAU;CAEhD,MAAM,UAAU;CAEhB,MAAM,IAAI,uBAAuB,SAAS;EACtC;EACA,MAAM,IAAI,OAAO,SAAS;EAC1B;EACA,MAAM,KAAK,8EAA8E;EACzF,MAAM,KAAK,wEAAwE;EACnF,MAAM,KAAK,oEAAoE;EAC/E;EACA,MAAM,KAAK,4CAA4C;EACvD,MAAM,KAAK,KAAK,MAAM,KAAK,qBAAqB,EAAE,6CAA6C;EAC/F,MAAM,KAAK,2DAA2D;EACtE;CACJ,CAAC;AACL;;;;;;;;AASA,eAAsB,mBAKnB;CACC,MAAM,cAAc,mBAAmB;CACvC,MAAM,aAAa,kBAAkB,WAAW;CAEhD,MAAM,eAAe,uBAAuB,UAAU;CACtD,IAAI,CAAC,cACD,MAAM,IAAI,MACN,uIAEJ;CAEJ,MAAM,YAAY,uBAAuB,YAAY,YAAY;CACjE,IAAI,CAAC,WACD,MAAM,IAAI,MAAM,yBAAyB,WAAW,CAAC;CAGzD,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,MAA8B,EAAE,GAAG,QAAQ,IAA8B;CAC/E,IAAI,SACA,IAAI,qBAAqB;CAE7B,IAAI,yBAAyB,gBAAgB,WAAW,KAAK;CAE7D,OAAO;EAAE;EAAa;EAAY;EAAW;CAAI;AACrD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA8BA,eAAsB,eAClB,UACA,WACA,UAA+B,CAAC,GACnB;CACb,MAAM,EAAE,aAAa,YAAY,WAAW,QAAQ;CACpD,MAAM,QAAQ,QAAQ,QAAQ,SAAS;CAEvC,MAAM,SAAS,WAAW,WAAW;CACrC,MAAM,YAAY,iBAAiB,WAAW;CAC9C,IAAI,CAAC,UAAU,CAAC,aAAa,UAAU,SAAS,KAAK,GACjD,MAAM,IAAI,MAAM,yBAAyB,WAAW,CAAC;CAGzD,MAAM,CAAC,SAAS,GAAG,UAAU,YAAY;EAAC,QAAQ;EAAU;EAAY;CAAS,IAAI,CAAC,UAAU,MAAM;CACtG,MAAM,MAAM,SAAS;EAAC,GAAG;EAAQ;EAAW,GAAG;CAAS,GAAG;EAAE,KAAK;EAAY;EAAO;CAAI,CAAC;AAC9F;;AAGA,IAAM,gBAAgB;;;;;;;;;AAUtB,eAAsB,uBAClB,SACA,UAA+B,CAAC,GACnB;CAEb,MAAM,cAAc,MADG,iBAAiB,GACV,QAAQ,MAAM,CAAC,GAAG,OAAO;AAC3D;AAEA,eAAsB,mBAClB,SACA,UAA+B,CAAC,GACnB;CACb,MAAM,cAAc,mBAAmB;CACvC,MAAM,aAAa,kBAAkB,WAAW;CAEhD,MAAM,eAAe,uBAAuB,UAAU;CACtD,IAAI,CAAC,cACD,MAAM,IAAI,MACN,uIAEJ;CAGJ,MAAM,YAAY,uBAAuB,YAAY,YAAY;CACjE,IAAI,CAAC,WACD,MAAM,IAAI,MAAM,yBAAyB,WAAW,CAAC;CAIzD,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,MAA8B,EAAE,GAAG,QAAQ,IAA8B;CAC/E,IAAI,SACA,IAAI,qBAAqB;CAE7B,IAAI,yBAAyB,gBAAgB,WAAW,KAAK;CAa7D,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,EAAE,gBAAgB,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CACrC,8BAA8B,SAAS,mBAAmB;EACtD,SAAS,cAAc,SAAS,gBAAgB;EAChD,YAAY,QAAQ,SAAS,UAAU;EACvC,KAAK,QAAQ;EACb,SAAS,YAAY,WAAW;CACpC,CAAC,CAAC,CAAC,IAAI;CAEP,MAAM,EAAE,oBAAoB,mBAAmB,MAAM,OAAO;CAC5D,MAAM,WAAW,MAAM,mBAAmB,aAAa;EACnD,SAAS,cAAc,SAAS,gBAAgB;EAChD,YAAY,QAAQ,SAAS,UAAU;EACvC,aAAa,YAAY;GAAE,IAAI,CAAC,QAAQ,OAAO,QAAQ,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC;EAAG;CAC5F,CAAC;CACD,OAAO,OAAO,KAAK,SAAS,GAAG;CAI/B,IAAI,CAAC,QAAQ,OACT,KAAK,MAAM,QAAQ,eAAe,QAAQ,GAAG,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;CAKpF,MAAM,WAAW,MAAM,oBAAoB,SAAS,SAAS,SAAS,MAAM,GAAG;CAC/E,IAAI,UAAU,IAAI,qBAAqB,SAAS;CAShD,MAAM,YAAY,wBAAwB,gBAAgB,SAAS,IAAI,GAAG,QAAQ,IAAI,CAAC;CAEvF,IAAI;EACA,MAAM,eAAe;GAAE;GAAa;GAAY;GAAW;EAAI,GAAG,WAAW,OAAO;CACxF,UAAU;EACN,MAAM,UAAU,KAAK;CACzB;AACJ;AAEA,eAAsB,UAAU,YAAgC,SAAkC;CAiB9F,IAAI,CAAC,cAAc,eAAe,YAAY,QAAQ,SAAS,QAAQ,KAAK,QAAQ,SAAS,IAAI,GAAG;EAChG,YAAY,eAAe,WAAW,KAAA,IAAY,UAAU;EAC5D;CACJ;CAgBA,IAAI,CAAC,eAAe,aAAa,eAAe,YAAY,OAAO,KAAK,cAAc,GAAG,IAAI;CAE7F,MAAM,cAAc,mBAAmB;CAKvC,YAAiB,UAAU,EAAE,YAAY,cAAc,OAAO,GAAG,EAAE,YAAY,CAAC;CAMhF,IAAI,eAAe,UAAU,eAAe,SAAS;EACjD,MAAM,oBAAoB,YAAY,aAAa,OAAO;EAE1D;CACJ;CAUA,MAAM,qBAAqB,aAAa,OAAO;CAE/C,IAAI,eAAe,QAAQ;EACvB,MAAM,cAAc,aAAa,OAAO;EAExC;CACJ;CAEA,IAAI,eAAe,OAAO;EACtB,MAAM,iBAAiB,aAAa,OAAO;EAE3C;CACJ;CAOA,IAAI,eAAe,YAAY,aAAa,SAAS,IAAI,CAAC,CAAC,OAAO,UAAU;EACxE,MAAM,aAAa,aAAa,OAAO;EAEvC;CACJ;CAKA,IAAI,aAAa;CACjB,IAAI,eAAe,UAAU;EACzB,MAAM,SAAS,aAAa,SAAS,IAAI,CAAC,CAAC;EAC3C,IAAI,WAAW,UAAU,MAAM,2BAA2B,aAAa,OAAO;EAC9E,IAAI,UAAU,iBAAiB,IAAI,MAAM,GAAG,aAAa,MAAM,iBAAiB,aAAa,SAAS,MAAM;CAChH;CAIA,6BAA6B,YAAY,QAAQ,IAAI,GAAG,kBAAkB,WAAW,CAAC;CAEtF,IAAI;EACA,MAAM,mBAAmB,UAAU;CACvC,SAAS,OAAO;EAKZ,IAAI,iBAAiB,wBAAwB;GACzC,4BAA4B,KAAK;GACjC,QAAQ,KAAK,CAAC;EAClB;EAIA,mBAAmB,KAAK;EACxB,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,iBAAiB,aAAqB,SAA2C;CAS5F,iBAAiB;EACb,MAAM;GAAE,kBAAkB;GAAQ,YAAY;EAAQ;EACtD,SAAS,CAAC,GAAG,OAAO;EACpB,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,EAAE,gBAAgB,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAUrC,MAAM,MAAM,cAAc,MARH,mBAAmB,aAAa;EACnD,SAAS,cAAc,SAAS,gBAAgB;EAChD,YAAY,QAAQ,SAAS,UAAU;EACvC,OAAO;EAEP,aAAY,YAAW,QAAQ,MAAM,MAAM,KAAK,KAAK,SAAS,CAAC;CACnE,CAAC,GAEmC,YAAY,WAAW,CAAC;CAC5D,IAAI,CAAC,KAAK;EACN,QAAQ,MAAM,MAAM,IAAI,gDAAgD,CAAC;EACzE,QAAQ,MAAM,MAAM,KAAK,6EAA6E,CAAC;EACvG,QAAQ,KAAK,CAAC;CAClB;CAEA,QAAQ,IAAI,GAAG;AACnB;;;;;;;;AASA,eAAe,oBACX,YACA,aACA,SACa;CACb,MAAM,EAAE,sBAAsB,qBAAqB,sBAAsB,MAAM,OAAO;CACtF,MAAM,EAAE,YAAY,MAAM,OAAO,sBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CASjC,MAAM,oBAA4B;EAC9B,MAAM,OAAO,gBAAgB,WAAW;EACxC,MAAM,OAAO,eAAe,SAAS,oBAAoB;EACzD,IAAI,QAAQ,SAAS,WACjB,OAAO,+CAA+C,KAAK;EAI/D,OAAO,eAAe,SAChB,iEACA;CACV;CAEA,IAAI,eAAe,QAAQ;EACvB,MAAM,UAAU,MAAM,oBAAoB,WAAW;EACrD,QAAQ,IAAI,UACN,MAAM,MAAM,kFAAkF,IAC9F,MAAM,KAAK,YAAY,CAAC,CAAC;EAE/B;CACJ;CAEA,MAAM,UAAU,MAAM,kBAAkB,WAAW;CACnD,MAAM,UAAU,GAAG,WAAW,QAAQ,WAAW,CAAC;CAClD,IAAI,CAAC,WAAW,CAAC,SAAS;EACtB,QAAQ,IAAI,MAAM,KAAK,YAAY,CAAC,CAAC;EAErC;CACJ;CAMA,IAAI,CAAC,QAAQ,SAAS,OAAO,KAAK,CAAC,QAAQ,SAAS,IAAI,GAAG;EACvD,IAAI,CAAC,QAAQ,MAAM,OAAO;GACtB,QAAQ,MAAM,MAAM,IAAI,wEAAwE,CAAC;GACjG,QAAQ,MAAM,MAAM,OAAO,iDAAiD,CAAC;GAC7E,QAAQ,KAAK,CAAC;EAClB;EAEA,MAAM,EAAE,cAAc,MAAM,SAAS,OAAO,CAAC;GACzC,MAAM;GACN,MAAM;GACN,SAAS,sCAAsC,QAAQ,WAAW,EAAE;GACpE,SAAS;EACb,CAAC,CAAC;EACF,IAAI,CAAC,WAAW;GACZ,QAAQ,IAAI,MAAM,KAAK,eAAe,CAAC;GAEvC;EACJ;CACJ;CAEA,MAAM,qBAAqB,WAAW;CACtC,QAAQ,IAAI,MAAM,MAAM,uEAAuE,CAAC;AACpG;;;;;;;;;AAUA,eAAe,cAAc,aAAqB,SAA2C;CACzF,MAAM,EAAE,qBAAqB,gBAAgB,UAAU,YAAY,aAAa,mBAC5E,MAAM,OAAO;CACjB,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,EAAE,gBAAgB,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CAErC,MAAM,SAAS,cAAc,SAAS,QAAQ;CAC9C,IAAI,CAAC,QAAQ;EACT,QAAQ,MAAM,MAAM,IAAI,+DAA+D,CAAC;EACxF,QAAQ,MAAM,MAAM,KAAK,+DAA+D,CAAC;EACzF,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,UAAU,QAAQ,SAAS,KAAK,UAClC,QAAQ,cAAc,QAAQ,QAAQ,KAAK,CAAC,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC;CACxE,MAAM,YAAY,QAAQ,SAAS,aAAa;CAIhD,KAAK,MAAM,QAAQ,CAAC,WAAW,YAAY,GACvC,IAAI,CAAC,MAAM,WAAW,IAAI,GAAG;EACzB,QAAQ,MAAM,MAAM,IAAI,OAAO,KAAK,2DAA2D,CAAC;EAChG,QAAQ,MAAM,MAAM,KAAK,mEAAmE,CAAC;EAC7F,QAAQ,KAAK,CAAC;CAClB;CAqBJ,MAAM,aAAa,cAAc,SAAS,gBAAgB;CAC1D,IAAI,eAAe,MAAM;EACrB,QAAQ,MAAM,MAAM,IAAI,kDAAkD,CAAC;EAC3E,QAAQ,MAAM,EAAE;EAChB,QAAQ,MAAM,MAAM,KAAK,4EAA4E,CAAC;EACtG,QAAQ,MAAM,MAAM,KAAK,8EAA8E,CAAC;EACxG,QAAQ,MAAM,MAAM,KAAK,mEAAmE,CAAC;EAC7F,QAAQ,MAAM,EAAE;EAChB,QAAQ,MAAM,MAAM,KAAK,4CAA4C,MAAM,KAAK,QAAQ,EAAE,EAAE,CAAC;EAC7F,QAAQ,MAAM,MAAM,KAAK,2BAA2B,YAAY,CAAC;EACjE,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,WAAW,MAAM,mBAAmB,aAAa;EACnD,YAAY,QAAQ,SAAS,UAAU;EACvC,aAAa,YAAY,QAAQ,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC;CACnE,CAAC;CAID,MAAM,SAAS,cAAc,UAAU,YAAY,WAAW,CAAC,KAAK;CACpE,IAAI,CAAC,QAAQ;EACT,QAAQ,MAAM,MAAM,IAAI,mCAAmC,CAAC;EAC5D,QAAQ,MAAM,MAAM,KAAK,2EAA2E,CAAC;EACrG,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,OAAO;EAAE;EAAQ;EAAQ;EAAW;CAAQ;CAIlD,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,0CAA0C,CAAC;CAClE,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,eAAe,MAAM,GAAG;CAClE,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,eAAe,MAAM,IAAI,SAAS,UAAU,MAAM,KAAK,MAAM,SAAS,QAAQ,EAAE,IAAI,IAAI;CAClI,QAAQ,IAAI,OAAO,MAAM,KAAK,MAAM,EAAE,IAAI,YACpC,gEACA,MAAM,OAAO,2CAA2C,GAAG;CACjE,IAAI,QAAQ,SAAS,GAAG,QAAQ,IAAI,OAAO,MAAM,KAAK,SAAS,EAAE,IAAI,QAAQ,KAAK,IAAI,GAAG;CACzF,QAAQ,IAAI,EAAE;CAEd,IAAI,CAAC,QAAQ,SAAS,OAAO,KAAK,CAAC,QAAQ,SAAS,IAAI,GAAG;EACvD,IAAI,CAAC,QAAQ,MAAM,OAAO;GACtB,QAAQ,MAAM,MAAM,IAAI,4DAA4D,CAAC;GACrF,QAAQ,MAAM,MAAM,OAAO,iDAAiD,CAAC;GAC7E,QAAQ,KAAK,CAAC;EAClB;EACA,MAAM,EAAE,cAAc,MAAM,SAAS,OAAO,CAAC;GACzC,MAAM;GAAW,MAAM;GAAa,SAAS;GAAa,SAAS;EACvE,CAAC,CAAC;EACF,IAAI,CAAC,WAAW;GACZ,QAAQ,IAAI,MAAM,KAAK,wBAAwB,CAAC;GAEhD;EACJ;CACJ;CAEA,MAAM,WAAW,KAAK,KAAK,GAAG,OAAO,GAAG,eAAe,QAAQ,IAAI,MAAM;CACzE,IAAI,UAAyB;CAC7B,IAAI;EACA,QAAQ,IAAI,MAAM,KAAK,YAAY,CAAC;EACpC,MAAM,MAAM,WAAW;GAAC,GAAG,SAAS,IAAI;GAAG;GAAU;EAAQ,GAAG,EAAE,OAAO;GAAC;GAAU;GAAW;EAAS,EAAE,CAAC;EAE3G,QAAQ,IAAI,MAAM,KAAK,cAAc,CAAC;EAKtC,MAAM,WAAW,eAAe,MAAM,MAAM,cAAc,YAAY,MAAM,QAAQ,GAAG;GACnF,OAAO;GACP,QAAQ;GACR,QAAQ,CAAC,QAAQ,SAAS;GAC1B,QAAQ;EACZ,CAAC,CAAC;EACF,UAAU,SAAS;EAInB,IAAI,aAAa,SAAS,SAAS;GAC/B,MAAM,EAAE,WAAW,MAAM,OAAO;GAChC,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,OAAO,CAAC;GACtD,MAAM,OAAO,QAAQ;GACrB,IAAI;IACA,MAAM,EAAE,SAAS,MAAM,OAAO,MAC1B;;;oFAIJ;IACA,MAAM,aAAa,oBAAoB,IAAI;IAC3C,KAAK,MAAM,aAAa,YAAY,MAAM,OAAO,MAAM,SAAS;IAChE,QAAQ,IAAI,MAAM,MAAM,kBAAkB,WAAW,OAAO,WAAW,CAAC;IACxE,QAAQ,IAAI,MAAM,KAAK,kFAAkF,CAAC;GAC9G,UAAU;IACN,MAAM,OAAO,IAAI;GACrB;EACJ;EAEA,IAAI,CAAC,SAAS,MAAM,eAAe,MAAM;CAC7C,UAAU;EACN,GAAG,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;CACvC;CAEA,IAAI,SAAS;EACT,QAAQ,MAAM,MAAM,IAAI,KAAK,SAAS,CAAC;EACvC,QAAQ,MAAM,MAAM,OAAO,oDAAoD,eAAe,MAAM,EAAE,EAAE,CAAC;EACzG,QAAQ,MAAM,MAAM,KAAK,kGAAkG,CAAC;EAC5H,QAAQ,KAAK,CAAC;CAClB;CAEA,QAAQ,IAAI,MAAM,MAAM,0CAA0C,eAAe,MAAM,CAAC,CAAC;AAC7F;;;;;;;;;;;;;;;;;;;;AAqBA,eAAe,eAAe,QAA+B;CACzD,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,EAAE,yBAAyB,eAAe,qBAC5C,MAAM,OAAO;CACjB,MAAM,EAAE,yBAAyB,MAAM,OAAO;CAE9C,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,OAAO,CAAC;CACtD,MAAM,OAAO,QAAQ;CACrB,IAAI;EACA,MAAM,SAAS,OAAO,UAAkB,MAAM,OAAO,MAAM,IAAI,EAAA,CAAG;EAElE,IAAI,EAAC,MADiB,wBAAwB,MAAM,EAAA,CACvC,YAAY;GACrB,QAAQ,IAAI,MAAM,OACd,+BAA+B,iBAAiB,+CACpD,CAAC;GACD,QAAQ,IAAI,MAAM,KAAK,kEAAkE,CAAC;GAC1F,QAAQ,IAAI,MAAM,KAAK,2DAA2D,CAAC;GAEnF;EACJ;EAEA,MAAM,EAAE,SAAS,MAAM,OAAO,MAC1B,gDACJ;EACA,MAAM,UAAU,qBAAqB,IAAI;EACzC,MAAM,cAAc,QAAQ,OAAO;EACnC,QAAQ,IAAI,MAAM,KACd,mBAAmB,iBAAiB,OAAO,QAAQ,OAAO,wCAC9D,CAAC;CACL,SAAS,OAAO;EACZ,QAAQ,IAAI,MAAM,OACd,uDAAuD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAChH,CAAC;EACD,QAAQ,IAAI,MAAM,KAAK,mEAAmE,CAAC;CAC/F,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;;;;;;;;;AAeA,eAAsB,qBAAqB,aAAqB,SAA2C;CACvG,IAAI,CAAC,QAAQ,SAAS,UAAU,GAAG;CAEnC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAC3C,MAAM,EAAE,gBAAgB,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CACrC,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAE3C,MAAM,aAAa,kBAAkB,aAAa,YAAY,WAAW,CAAC;CAC1E,IAAI,CAAC,YAGD;CAGJ,MAAM,kBAAkB;EACpB;EACA,aAAa;EACb,UAAU;EAEV,gBAAgB;EAChB,YAAY,YAAY,KAAA;EACxB,MAAK,YAAW,QAAQ,IAAI,OAAO;CACvC,CAAC;AACL;;;;;;;;;;;;;;AAeA,eAAe,2BAA2B,aAAqB,SAA2C;CACtG,MAAM,OAAO,QAAQ,aAAa,SAAS,IAAI;CAC/C,IAAI,CAAC,MAAM;CAEX,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,SAAS,iBAAiB,WAAW;CAC3C,IAAI,QAAQ,SAAS,MAAM;CAE3B,MAAM,MAAM;CACZ,MAAM,MAAM,2BAA2B;CACvC,MAAM,SAAS,KAAK,IAAI,IAAY,IAAI,MAAM,IAAI;CAElD,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,IAAI,wBAAwB,KAAK,iCAAiC,CAAC;CACvF,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,MAAM,KAAK,2DAA2D,OAAO,SAAS,EAAE,CAAC;CACvG,QAAQ,MAAM,MAAM,KAAK,2EAA2E,CAAC;CACrG,QAAQ,MAAM,MAAM,KAAK,WAAW,CAAC;CACrC,QAAQ,MAAM,EAAE;CAChB,QAAQ,MAAM,KAAK,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,SAAS,EAAU,EAAE,0BAA0B;CAC/F,QAAQ,MAAM,KAAK,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,SAAS,IAAI,MAAM,EAAE,gBAAgB;CACrF,QAAQ,MAAM,EAAE;CAChB,QAAQ,KAAK,CAAC;AAClB;;AAGA,IAAM,mCAAmB,IAAI,IAAI;CAAC;CAAQ;CAAU;CAAU;CAAQ;AAAO,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4B9E,eAAe,iBAAiB,aAAqB,SAAmB,QAAmC;CAGvG,IAAI,cAAc,SAAS,gBAAgB,MAAM,MAAM,OAAO;CAE9D,MAAM,EAAE,qBAAqB,MAAM,OAAO;CAC1C,MAAM,SAAS,iBAAiB,WAAW;CAC3C,IAAI,CAAC,QAAQ,OAAO;CAEpB,MAAM,EAAE,gBAAgB,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CACrC,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAE3C,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,SAAS,mBAAmB;EAC9B,YAAY,QAAQ,SAAS,UAAU;EACvC,KAAK,QAAQ;EACb;EACA,QAAQ;EACR,YAAY,kBAAkB,aAAa,OAAO;CACtD,CAAC;CACD,MAAM,OAAO,OAAO,SAAS,YAAY,OAAO,OAAO,IAAA,EAAM,KAAK;CAClE,IAAI,CAAC,KAAK,OAAO;CAEjB,QAAQ,IAAI,MAAM,KAAK,iBAAiB,OAAO,KAAK,6DAA6D,CAAC;CAElH,MAAM,OAAO,WAAW,YAAY,cAAc,SAAS,QAAQ,MAAM,OACnE,CAAC,UAAU,OAAO,QAAQ,IAC1B,CAAC;CAEP,OAAO;EAAC,GAAG;EAAS,GAAG;EAAM;EAAkB;CAAG;AACtD;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,eAAe,aAAa,aAAqB,SAA2C;CACxF,MAAM,EAAE,oBAAoB,mBAAmB,gBAAgB,kBAAkB,sBAC7E,MAAM,OAAO;CACjB,MAAM,EAAE,gBAAgB,MAAM,OAAO,wBAAA,CAAA,MAAA,MAAA,EAAA,CAAA;CACrC,MAAM,EAAE,uBAAuB,MAAM,OAAO;CAC5C,MAAM,EAAE,sBAAsB,MAAM,OAAO;CAO3C,MAAM,WAAW,QAAQ,SAAS,OAAO,KAAK,QAAQ,SAAS,QAAQ;CAIvE,MAAM,OAAO,aAAa,SAAS,IAAI,CAAC,CAAC;CAazC,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,WAAW,mBAAmB;EAChC,SAAS,cAAc,SAAS,gBAAgB;EAChD,YAAY,QAAQ,SAAS,UAAU;EACvC,KAAK,QAAQ;EACb;EACA,QAAQ;EACR,YAAY,kBAAkB,aAAa,OAAO;CACtD,CAAC;CACD,MAAM,QAAQ,SAAS,SAAS,YAAY,OAAO,SAAS,IAAA,EAAM,KAAK,KAAK,KAAA;CAK5E,IAAI,CAAC,QAAQ,CAAC,UAAU;EACpB,MAAM,SAAS,iBAAiB,WAAW;EAC3C,QAAQ,IAAI,EAAE;EACd,IAAI,QAAQ;GACR,QAAQ,IAAI,KAAK,MAAM,MAAM,GAAG,EAAE,aAAa,MAAM,KAAK,OAAO,IAAI,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,GAAG;GAC9G,QAAQ,IAAI,MAAM,KAAK,kCAAkC,MAAM,KAAK,+BAA+B,GAAG,CAAC;EAC3G,OAAO;GACH,MAAM,OAAO,OAAO,eAAe,IAAI,IAAI;GAC3C,QAAQ,IAAI,KAAK,MAAM,KAAK,GAAG,EAAE,uBAAuB,OAAO,MAAM,KAAK,KAAK,KAAK,EAAE,IAAI,IAAI;GAC9F,QAAQ,IAAI,MAAM,KAAK,2BAA2B,MAAM,KAAK,gCAAgC,GAAG,CAAC;EACrG;EACA,QAAQ,IAAI,EAAE;EAEd;CACJ;CAEA,IAAI,UAAU;EACV,MAAM,SAAS,iBAAiB,WAAW;EAC3C,kBAAkB,WAAW;EAC7B,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,SACN,MAAM,MAAM,gCAAgC,OAAO,KAAK,eAAe,IAAI,EAAE,KAAK,GAAG,EAAE,IACvF,MAAM,KAAK,iCAAiC,CAAC;EACnD,QAAQ,IAAI,EAAE;EAEd;CACJ;CAEA,IAAI,CAAC,MAAM;EACP,QAAQ,MAAM,MAAM,IAAI,wCAAwC,CAAC;EACjE,QAAQ,MAAM,MAAM,KAAK,SAAS,SAAS,YACrC,sFACA,sFAAsF,CAAC;EAC7F,QAAQ,MAAM,MAAM,KAAK,wEAAwE,CAAC;EAClG,QAAQ,MAAM,MAAM,KAAK,wCAAwC,CAAC;EAClE,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,WAAW,mBAAmB,IAAI;CAGxC,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,KAAK,CAAC;CACpD,IAAI;EACA,MAAM,OAAO,QAAQ;CACzB,SAAS,OAAO;EACZ,QAAQ,MAAM,MAAM,IAAI,wDAAwD,KAAK,UAAU,CAAC;EAChG,QAAQ,MAAM,MAAM,KAAK,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG,CAAC;EACvF,QAAQ,KAAK,CAAC;CAClB;CACA,IAAI;EACA,MAAM,EAAE,SAAS,MAAM,OAAO,MAC1B;6FAEA,CAAC,MAAM,QAAQ,CACnB,CAAC,CAAC,aAAa,EAAE,MAAM,CAAC;GAAE,YAAY;GAAO,SAAS;EAAM,CAAC,EAAE,EAAE;EAEjE,MAAM,EAAE,YAAY,YAAY,KAAK,MAAM;GAAE,YAAY;GAAO,SAAS;EAAM;EAC/E,IAAI,CAAC,SAAS;GACV,QAAQ,MAAM,MAAM,IAAI,aAAa,KAAK,kBAAkB,CAAC;GAC7D,QAAQ,MAAM,aAER,MAAM,KAAK,wCAAwC,SAAS,+CAA+C,IAC3G,MAAM,KAAK,KAAK,MAAM,KAAK,uBAAuB,EAAE,yBAAyB,CAAC;GACpF,QAAQ,KAAK,CAAC;EAClB;CACJ,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;CAEA,kBAAkB,aAAa;EAAE;EAAM;CAAS,CAAC;CAEjD,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,MAAM,2BAA2B,KAAK,GAAG,CAAC;CAC5D,QAAQ,IAAI,MAAM,KAAK,iBAAiB,UAAU,CAAC;CACnD,QAAQ,IAAI,MAAM,KAAK,gFAAgF,CAAC;CACxG,QAAQ,IAAI,MAAM,KAAK,kCAAkC,MAAM,KAAK,+BAA+B,GAAG,CAAC;CACvG,QAAQ,IAAI,EAAE;AAClB;;;;;;;;;;;AAYA,IAAM,iBAAuF;CACzF,MAAM;EACF,OAAO;EACP,SAAS;EACT,OAAO;GACH;GACA;GACA,wBAAwB,sBAAsB;EAClD;CACJ;CACA,UAAU;EACN,OAAO;EACP,SAAS;EACT,OAAO,CACH,4FACA,wBAAwB,sBAAsB,EAClD;CACJ;CACA,SAAS;EACL,OAAO;EACP,SAAS;EACT,OAAO;GACH;GACA;GACA;GACA;EACJ;CACJ;CACA,QAAQ;EAQJ,OAAO;EACP,SAAS;EACT,OAAO;GACH;GACA;GACA;GACA;GACA;GACA;GACA;EACJ;CACJ;CACA,QAAQ;EACJ,OAAO;EACP,SAAS;EACT,OAAO,CACH,iEACA,iFACJ;CACJ;CACA,SAAS;EACL,OAAO;EACP,SAAS;EACT,OAAO,CAAC,8EAA8E;CAC1F;CACA,KAAK;EACD,OAAO;EACP,SAAS;EACT,OAAO;GACH;GACA;GACA;EACJ;CACJ;CACA,SAAS;EACL,OAAO;EACP,SAAS;EACT,OAAO,CAAC,gDAAgD;CAC5D;CACA,MAAM;EACF,OAAO;EACP,SAAS;EACT,OAAO,CAAC,wGAAwG;CACpH;CACA,MAAM;EAAE,OAAO;EAAkB,SAAS;CAAuD;CACjG,OAAO;EACH,OAAO;EACP,SAAS;EACT,OAAO,CAAC,wDAAwD;CACpE;AACJ;;AAGA,IAAa,iBAAiB,OAAO,KAAK,cAAc;AAExD,SAAS,YAAY,QAAiB;CAClC,MAAM,QAAQ,SAAS,eAAe,UAAU,KAAA;CAChD,IAAI,OAAO;EACP,QAAQ,IAAI;EAClB,MAAM,KAAK,aAAa,QAAQ,EAAE;;IAEhC,MAAM,QAAQ;;EAEhB,MAAM,MAAM,KAAK,OAAO,EAAE;IACxB,MAAM,KAAK,MAAM,KAAK,EAAE;EAC1B,MAAM,OAAO,SAAS,KAAK,MAAM,MAAM,KAAK,OAAO,EAAE,IAAI,MAAM,MAAM,KAAI,MAAK,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,GAAG;EAC/H,MAAM,KAAK,8CAA8C,EAAE;CAC5D;EACO;CACJ;CAEA,QAAQ,IAAI;EACd,MAAM,KAAK,WAAW,EAAE;;EAExB,MAAM,MAAM,KAAK,OAAO,EAAE;cACd,MAAM,KAAK,WAAW,EAAE;;EAEpC,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,+DAA+D,EAAE;IAC5E,MAAM,KAAK,KAAK,KAAK,EAAE;IACvB,MAAM,KAAK,KAAK,MAAM,EAAE;IACxB,MAAM,KAAK,KAAK,MAAM,EAAE;IACxB,MAAM,KAAK,KAAK,OAAO,EAAE;IACzB,MAAM,KAAK,KAAK,MAAM,EAAE;IACxB,MAAM,KAAK,KAAK,UAAU,EAAE;IAC5B,MAAM,KAAK,KAAK,SAAS,EAAE;IAC3B,MAAM,KAAK,KAAK,QAAQ,EAAE;IAC1B,MAAM,KAAK,KAAK,QAAQ,EAAE;IAC1B,MAAM,KAAK,KAAK,SAAS,EAAE;IAC3B,MAAM,KAAK,KAAK,SAAS,EAAE;;EAE7B,MAAM,MAAM,KAAK,UAAU,EAAE;EAC7B,WAAW,gBAAgB,CAAC,EAAE;IAC5B,MAAM,KAAK,wDAAwD,EAAE;;;;IAIrE,MAAM,KAAK,qEAAqE,EAAE;;CAErF;AACD;;;;;;;;;;;;;AAcA,SAAgB,WAAW,MAA0C;CACjE,IAAI,SAAS,WACT,OAAO,KAAK,MAAM,KAAK,wEAAwE,EAAE;;sCAEnE,MAAM,KAAK,mDAAmD,EAAE;sCAChE,MAAM,KAAK,2CAA2C,EAAE;;IAE1F,MAAM,KAAK,uCAAuC,EAAE;sCAClB,MAAM,KAAK,iDAAiD,EAAE;;;CAKhG,OAAO,KAAK,MAAM,KAAK,8BAA8B,EAAE;;;IAGvD,MAAM,KAAK,iCAAiC,EAAE;;;;IAI9C,MAAM,KAAK,2CAA2C,EAAE;;;;;;AAM5D"}