@rebasepro/cli 0.24.0 → 0.24.1-canary.gcb918fc

package/dist/prepare-Btn9Ewbn.js

@@ -0,0 +1,1052 @@
+import { c as findProjectRoot, d as readEnvFile } from "./project-Wp2zoyeN.js";
+import { a as devDbDir, c as readState, i as dataDir, l as releaseStartLock, o as findFreePort, p as MANAGED_LIMITATIONS, r as clearState, s as pidRunning, t as acquireStartLock, u as stateFile } from "./state-Do7ZJYkF.js";
+import chalk from "chalk";
+import fs from "fs";
+import path from "path";
+import { randomBytes } from "crypto";
+import { fileURLToPath } from "url";
+import { spawn } from "child_process";
+import { resourceEnvSuffix } from "@rebasepro/types";
+import { execa } from "execa";
+import net from "net";
+//#region src/utils/dev-preflight.ts
+/**
+* Make `rebase dev` the only command a new project needs.
+*
+* The scaffolded project prints three steps — start the database container,
+* push the schema, start the dev server — and a first-time reader has to
+* perform all three correctly before anything works. Two of them are
+* mechanical, and both fail in ways that do not name themselves: skipping the
+* container gives `ECONNREFUSED` from a stack the reader has never seen, and
+* skipping the push gives a server that starts cleanly and then 500s on the
+* first request because the tables are not there.
+*
+* So `dev` does them. Not always, and not silently — under four conditions that
+* together mean "this is a throwaway development database on this laptop, and
+* it is not running":
+*
+*   1. The DSN resolves to a loopback address. A remote database is somebody's
+*      real data and is never touched here, whatever else is true.
+*   2. Nothing is listening on it. A database that answers is left completely
+*      alone — no push, no inspection, no connection.
+*   3. The project has a `docker-compose.yml` declaring a `db` service, i.e.
+*      the one `rebase init` wrote. Without it there is nothing to start and
+*      the backend's own error is the better message.
+*   4. Docker is available. If it is not, the manual steps are printed and dev
+*      continues — a preflight must never be the reason the command fails.
+*
+* The schema push happens only when this function actually started the
+* container, which is the one moment a local database is known to be new or
+* stale relative to the collections. A `dev` against an already-running
+* database never mutates its schema.
+*/
+/**
+* Hosts that mean "this machine", and so may be provisioned automatically.
+*
+* An exact-match set, never a prefix or substring test: `localhost.example.com`
+* is a perfectly resolvable name that somebody else controls.
+*/
+var LOOPBACK = /* @__PURE__ */ new Set([
+	"localhost",
+	"127.0.0.1",
+	"::1",
+	"0.0.0.0"
+]);
+/**
+* The host and port of a Postgres DSN, but only when it points at this machine.
+*
+* Returns null for anything else — a remote host, an unparseable string, a
+* non-postgres scheme. Callers treat null as "do nothing", so every parse
+* failure fails closed onto the safe behaviour rather than onto a guess.
+*/
+function parseLoopbackDsn(dsn) {
+	if (!dsn) return null;
+	let url;
+	try {
+		url = new URL(dsn);
+	} catch {
+		return null;
+	}
+	if (!/^postgres(ql)?:$/.test(url.protocol)) return null;
+	const host = url.hostname.replace(/^\[(.+)\]$/, "$1");
+	if (!LOOPBACK.has(host)) return null;
+	const port = url.port ? Number(url.port) : 5432;
+	if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+	return {
+		host,
+		port
+	};
+}
+/**
+* Whether a compose file declares a `db` service.
+*
+* Deliberately a text scan and not a YAML parse: the CLI has no YAML
+* dependency, and the question is only ever asked of a file this tool wrote.
+* A false negative costs the automation and nothing else — the reader gets the
+* manual steps, which are correct.
+*/
+function composeDeclaresDbService(yamlText) {
+	let inServices = false;
+	for (const rawLine of yamlText.split(/\r?\n/)) {
+		const line = rawLine.replace(/\t/g, "    ");
+		if (/^\s*#/.test(line) || line.trim() === "") continue;
+		if (/^services:\s*$/.test(line)) {
+			inServices = true;
+			continue;
+		}
+		if (inServices && /^\S/.test(line)) {
+			inServices = false;
+			continue;
+		}
+		if (inServices && /^\s{2,}db:\s*$/.test(line)) return true;
+	}
+	return false;
+}
+/**
+* The connection string the compose file's `db` service will answer on.
+*
+* `--docker` used to be a flag that changed a banner and nothing else: it
+* resolved to `kind: "docker"`, and every caller then had no URL to reach the
+* container with, so the backend booted with no `DATABASE_URL` at all and died
+* on the message a project with no database gets. The container it had just
+* been asked for was never started, because the preflight that starts it needs
+* a DSN to decide the database is local and not running.
+*
+* So the URL is derived rather than required: the compose file names the user,
+* the database and the published host port, and `.env` holds the password
+* compose itself interpolates. That is the same string `rebase init` writes as
+* the commented-out `DATABASE_URL`, which is what makes uncommenting that line
+* and passing `--docker` reach the same database.
+*
+* Returns null when the file declares no `db` service, or declares one this
+* scan cannot read — a `--docker` that cannot be honoured has to say so, and
+* a guess would point at somebody else's Postgres on 5432.
+*
+* Same text scan as {@link composeDeclaresDbService}, for the same reason.
+*/
+function composeDatabaseUrl(yamlText, env = {}) {
+	const found = scanComposeDbService(yamlText);
+	const user = expandComposeValue(found.POSTGRES_USER, env);
+	const password = expandComposeValue(found.POSTGRES_PASSWORD, env);
+	const database = expandComposeValue(found.POSTGRES_DB, env);
+	if (!user || !password || !database || !found.hostPort) return null;
+	return `postgresql://${encodeURIComponent(user)}:${encodeURIComponent(password)}@127.0.0.1:${found.hostPort}/${database}?options=-c%20search_path%3Dpublic&sslmode=disable`;
+}
+/**
+* The host port the compose `db` service publishes, or null.
+*
+* Separate from {@link composeDatabaseUrl} because the port is answerable on
+* its own: the URL needs the user, the password and the database name too, and
+* a compose file missing any of them still says which port a container would
+* listen on. That is the question "would starting this container answer the
+* DSN in `.env`?" — see the `wrong-port` branch of {@link ensureDevDatabase},
+* where getting it wrong meant starting a container nobody asked for.
+*/
+function composeHostPort(yamlText) {
+	const port = scanComposeDbService(yamlText).hostPort;
+	return port ? Number(port) : null;
+}
+/** The raw values of the compose `db` service, before any expansion. */
+function scanComposeDbService(yamlText) {
+	let inServices = false;
+	let inDb = false;
+	let dbIndent = 0;
+	let section = null;
+	const found = {};
+	let hostPort = null;
+	for (const rawLine of yamlText.split(/\r?\n/)) {
+		const line = rawLine.replace(/\t/g, "    ");
+		if (/^\s*#/.test(line) || line.trim() === "") continue;
+		if (/^services:\s*$/.test(line)) {
+			inServices = true;
+			continue;
+		}
+		if (inServices && /^\S/.test(line)) {
+			inServices = false;
+			inDb = false;
+			continue;
+		}
+		if (!inServices) continue;
+		const indent = line.length - line.trimStart().length;
+		const dbHeader = line.match(/^(\s{2,})db:\s*$/);
+		if (dbHeader) {
+			inDb = true;
+			dbIndent = dbHeader[1].length;
+			section = null;
+			continue;
+		}
+		if (inDb && indent <= dbIndent) {
+			inDb = false;
+			section = null;
+			continue;
+		}
+		if (!inDb) continue;
+		const key = line.match(/^\s+(environment|ports):\s*$/);
+		if (key) {
+			section = key[1];
+			continue;
+		}
+		if (/^\s+[A-Za-z_][\w-]*:\s*\S/.test(line) && !/^\s+POSTGRES_/.test(line)) {
+			if (!/^\s*-\s/.test(line.trimStart())) section = null;
+		}
+		if (section === "environment") {
+			const pair = line.match(/^\s+(POSTGRES_(?:USER|PASSWORD|DB)):\s*(.+?)\s*$/);
+			if (pair) found[pair[1]] = pair[2].replace(/^["']|["']$/g, "");
+			continue;
+		}
+		if (section === "ports" && hostPort === null) {
+			const mapping = line.match(/^\s*-\s*["']?(?:[\d.]+:)?(\d+):5432(?:\/tcp)?["']?\s*$/);
+			if (mapping) hostPort = mapping[1];
+		}
+	}
+	return hostPort === null ? found : {
+		...found,
+		hostPort
+	};
+}
+/**
+* `${VAR:-default}`, `${VAR}` and a literal, resolved the way compose resolves
+* them — against the project's `.env`, which is the file compose itself reads.
+*/
+function expandComposeValue(raw, env) {
+	if (!raw) return null;
+	const trimmed = raw.replace(/\$\{([A-Za-z_][\w]*)(?::?-([^}]*))?\}/g, (_all, name, fallback) => {
+		const value = env[name];
+		if (value !== void 0 && value !== "") return value;
+		return fallback ?? "";
+	}).trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+/** Is something accepting connections there right now? */
+function probeTcp(host, port, timeoutMs = 700) {
+	return new Promise((resolve) => {
+		const socket = new net.Socket();
+		let settled = false;
+		const done = (open) => {
+			if (settled) return;
+			settled = true;
+			socket.destroy();
+			resolve(open);
+		};
+		socket.setTimeout(timeoutMs);
+		socket.once("connect", () => done(true));
+		socket.once("timeout", () => done(false));
+		socket.once("error", () => done(false));
+		socket.connect(port, host);
+	});
+}
+/**
+* Poll until the port answers, or give up.
+*
+* Postgres publishes its port before it is ready to accept queries, so the
+* caller still has to tolerate a first connection that is refused at the
+* protocol level. This only answers "has the container got as far as listening",
+* which is the part that takes the seconds.
+*/
+async function waitForPort(host, port, timeoutMs = 6e4, intervalMs = 500) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		if (await probeTcp(host, port, 700)) return true;
+		await new Promise((resolve) => setTimeout(resolve, intervalMs));
+	}
+	return false;
+}
+/**
+* Start the project's development database if it is not running, and give it a
+* schema if this call is what started it.
+*/
+async function ensureDevDatabase(options) {
+	const { projectRoot, databaseUrl, disabled, hasCollections, pushSchema } = options;
+	const log = options.log ?? ((message) => console.log(message));
+	if (disabled) return { action: "disabled" };
+	const target = parseLoopbackDsn(databaseUrl);
+	if (!databaseUrl) return { action: "no-dsn" };
+	if (!target) {
+		let host = "the configured host";
+		try {
+			host = new URL(databaseUrl).hostname || host;
+		} catch {}
+		return {
+			action: "remote-dsn",
+			host
+		};
+	}
+	if (await probeTcp(target.host, target.port)) return {
+		action: "already-running",
+		host: target.host,
+		port: target.port
+	};
+	const composePath = path.join(projectRoot, "docker-compose.yml");
+	if (!fs.existsSync(composePath)) return { action: "no-compose" };
+	const composeText = fs.readFileSync(composePath, "utf8");
+	if (!composeDeclaresDbService(composeText)) return { action: "no-compose" };
+	const manualSteps = `${chalk.cyan("docker compose up -d db")} then ${chalk.cyan("rebase db push")}`;
+	const composePort = composeHostPort(composeText);
+	if (composePort !== null && composePort !== target.port) {
+		const hint = `DATABASE_URL points at ${target.host}:${target.port} and nothing listens there. The compose file's db service publishes ${composePort}, so starting it would not answer that URL — nothing was started. Either correct the port in .env, or point DATABASE_URL at 127.0.0.1:${composePort}.`;
+		log("");
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+		return {
+			action: "wrong-port",
+			hint,
+			port: target.port,
+			composePort
+		};
+	}
+	log("");
+	log(`  ${chalk.gray("Database not running — starting it…")}`);
+	const startDatabase = options.startDatabase ?? (async (root) => {
+		await execa("docker", [
+			"compose",
+			"up",
+			"-d",
+			"db"
+		], {
+			cwd: root,
+			stdio: "pipe"
+		});
+	});
+	try {
+		await startDatabase(projectRoot);
+	} catch (error) {
+		const message = error instanceof Error ? error.message : String(error);
+		if (/ENOENT|not found|command not found/i.test(message)) {
+			const hint = `Docker was not found. Start a Postgres yourself, then run ${manualSteps}.`;
+			log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+			return {
+				action: "no-docker",
+				hint
+			};
+		}
+		const hint = `Could not start the database container. Run ${manualSteps} to see why.`;
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+		return {
+			action: "start-failed",
+			hint
+		};
+	}
+	if (!await waitForPort(target.host, target.port)) {
+		const hint = `The database container did not begin listening on port ${target.port}. Run ${manualSteps} to see why.`;
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(hint)}`);
+		return {
+			action: "start-failed",
+			hint
+		};
+	}
+	log(`  ${chalk.green("✓")} ${chalk.gray(`Database ready on port ${target.port}`)}`);
+	if (!hasCollections) return {
+		action: "started",
+		port: target.port,
+		pushed: false
+	};
+	log(`  ${chalk.gray("Pushing the schema…")}`);
+	try {
+		await pushSchema();
+		log(`  ${chalk.green("✓")} ${chalk.gray("Schema pushed")}`);
+		return {
+			action: "started",
+			port: target.port,
+			pushed: true
+		};
+	} catch {
+		log(`  ${chalk.yellow("⚠")} ${chalk.gray(`Schema push failed. The database is running; fix the error above and run ${chalk.cyan("rebase db push")}.`)}`);
+		return {
+			action: "started",
+			port: target.port,
+			pushed: false
+		};
+	}
+}
+//#endregion
+//#region src/dev-db/branch-pointer.ts
+/**
+* Which database branch this checkout is working on.
+*
+* `rebase db branch create` made a full copy of the database in about a second
+* and then stopped one step short of being a feature: there was no `switch`, no
+* `--branch` on `rebase dev`, and nothing wrote the branch anywhere a command
+* would read it. The only way to *use* a branch was to hand-edit
+* `DATABASE_URL`, and the documentation claimed otherwise — "the CLI updates
+* your local development configuration" — which it did not; the `.env` was
+* byte-identical afterwards.
+*
+* This is that missing step, and the shape of it is chosen to avoid three
+* things:
+*
+* 1. **It does not touch `.env`.** That file holds secrets, comments and the
+*    developer's own ordering, and a command that rewrites it in place will
+*    eventually lose something that was not its business. The branch is
+*    recorded beside the other per-checkout state in `.rebase/`, which is
+*    already gitignored — a branch is a fact about one machine, never about
+*    the project.
+*
+* 2. **It stores a name, not a connection string.** The credentials stay in
+*    exactly one place; the URL is derived by swapping the database name on
+*    the base one at resolution time. A stored URL would be a second copy of
+*    the password, and would go stale the moment `.env` changed.
+*
+* 3. **It does not outrank an explicit instruction.** `--database-url` and a
+*    `DATABASE_URL` in the shell are more immediate and more specific than a
+*    switch made yesterday, so they still win. The pointer sits directly above
+*    the project's `.env`: it is a deliberate, persistent choice, and `.env` is
+*    the project default it is meant to override. Anything less and `switch`
+*    would silently do nothing on every project that sets `DATABASE_URL` —
+*    which is every project not using the managed database.
+*/
+/** Where the pointer lives, next to the rest of the per-checkout state. */
+function branchPointerPath(projectRoot) {
+	return path.join(projectRoot, ".rebase", "branch.json");
+}
+function branchDatabaseName(name) {
+	return `rb_${name}`;
+}
+/** Read the active branch, or null when the checkout is on the main database. */
+function readActiveBranch(projectRoot) {
+	try {
+		const raw = fs.readFileSync(branchPointerPath(projectRoot), "utf-8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.name !== "string" || typeof parsed.database !== "string") return null;
+		if (!parsed.name || !parsed.database) return null;
+		return {
+			name: parsed.name,
+			database: parsed.database
+		};
+	} catch {
+		return null;
+	}
+}
+function writeActiveBranch(projectRoot, branch) {
+	const file = branchPointerPath(projectRoot);
+	fs.mkdirSync(path.dirname(file), { recursive: true });
+	fs.writeFileSync(file, `${JSON.stringify(branch, null, 2)}\n`, "utf-8");
+}
+/** Return to the main database. Absent is success — this is idempotent. */
+function clearActiveBranch(projectRoot) {
+	fs.rmSync(branchPointerPath(projectRoot), { force: true });
+}
+/**
+* The base connection string with its database swapped for the branch's.
+*
+* Everything else is carried across untouched — credentials, host, port, and
+* the query string, which is load-bearing here: `?sslmode=disable` is what a
+* local Docker Postgres needs, and dropping it turns a switch into a TLS error
+* that says nothing about branches.
+*
+* Returns null for a connection string that cannot be parsed, so the caller can
+* say so plainly rather than emitting a mangled URL that fails later.
+*/
+function branchUrl(baseUrl, database) {
+	try {
+		const url = new URL(baseUrl);
+		url.pathname = `/${database}`;
+		return url.toString();
+	} catch {
+		return null;
+	}
+}
+/** The database name in a connection string, for reporting what you are on. */
+function databaseNameOf(connectionString) {
+	try {
+		return new URL(connectionString).pathname.replace(/^\//, "") || null;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/dev-db/daemon.ts
+/**
+* Starting, finding and stopping the managed database, from the caller's side.
+*
+* Every command that needs Postgres calls {@link ensureManagedDatabase} and
+* gets a connection string back. Whether that started a process or found one
+* already running is not the caller's business, which is the point: `rebase
+* db push`, `rebase dev` and `rebase studio` in three terminals must all reach
+* the same database without coordinating, because two processes opening one
+* PGlite data directory would corrupt it.
+*
+* The hard part is not starting the daemon; it is deciding whether the one the
+* state file describes is still there. A pid can be recycled after a reboot and
+* a port can be taken by a stranger, so believing either on its own would let
+* Rebase send a migration somewhere unintended. {@link isDaemonAlive} asks the
+* daemon to identify itself instead.
+*/
+/** How long to wait for a first boot. PGlite runs initdb on an empty data dir. */
+var START_TIMEOUT_MS = 6e4;
+/** Poll interval while waiting for the daemon to publish its state file. */
+var POLL_INTERVAL_MS = 150;
+/** How long the identity handshake may take before we call it dead. */
+var IDENTITY_TIMEOUT_MS = 1500;
+/**
+* PGlite's built-in superuser and database.
+*
+* Fixed by PGlite rather than chosen here, and asserted by the socket spike:
+* `session_user` comes back as `postgres`.
+*/
+var MANAGED_USER = "postgres";
+var MANAGED_DATABASE = "postgres";
+/**
+* The DSN for the managed development database.
+*
+* **`sslmode=disable` is not decoration.** PGlite's socket server speaks no TLS,
+* and libpq-family clients try SSL first — so Atlas, which `rebase db push`
+* shells out to, failed the whole push with
+* `pq: SSL is not enabled on the server`. Its remedy box then told the reader to
+* append `sslmode=disable` to `DATABASE_URL`, which on this path is not set at
+* all: `rebase init` leaves it commented out precisely so the managed database
+* is used. The advice was correct and unfollowable.
+*
+* Putting it in the URL fixes every consumer at once — Atlas, `pg`, and anything
+* a driver shells out to later — rather than teaching each one about PGlite.
+*/
+/**
+* The end of `pglite.log`, for an error message that has to carry its own reason.
+*
+* The daemon writes its output to a file because it is detached — it has to
+* outlive the command that started it. That is right, and it means every
+* startup failure used to be reported as a path: "see pglite.log for the
+* reason". On a laptop that is a fair trade. In CI it is not a trade at all,
+* because the runner discards the workspace: the log named in the message no
+* longer exists by the time anybody reads the message, so a failed run says
+* only that something failed.
+*
+* So the tail comes with the error. Bounded, because a log that has been
+* appended to across many runs is not something to paste in full.
+*/
+function pgliteLogTail(projectRoot, lines = 12) {
+	try {
+		const contents = fs.readFileSync(path.join(devDbDir(projectRoot), "pglite.log"), "utf8").trimEnd();
+		if (!contents) return "  (pglite.log is empty — the daemon wrote nothing before exiting)";
+		return contents.split("\n").slice(-lines).map((line) => `      ${line}`).join("\n");
+	} catch {
+		return "  (pglite.log could not be read)";
+	}
+}
+function managedUrl(port) {
+	return `postgresql://${MANAGED_USER}@127.0.0.1:${port}/${MANAGED_DATABASE}?sslmode=disable`;
+}
+/**
+* Ask the process behind a state record to prove it is the one we wrote down.
+*
+* A pid check alone answers "is *a* process running", and a port check alone
+* answers "is *something* listening" — after a reboot both say yes about
+* strangers. The daemon answers with the token from its own state file, so a
+* match is the only evidence accepted.
+*/
+function isDaemonAlive(state) {
+	if (!pidRunning(state.pid)) return Promise.resolve(false);
+	return new Promise((resolve) => {
+		const socket = new net.Socket();
+		let answer = "";
+		const settle = (alive) => {
+			socket.removeAllListeners();
+			socket.destroy();
+			resolve(alive);
+		};
+		socket.setTimeout(IDENTITY_TIMEOUT_MS);
+		socket.once("timeout", () => settle(false));
+		socket.once("error", () => settle(false));
+		socket.on("data", (chunk) => {
+			answer += chunk.toString("utf8");
+			if (answer.includes("\n")) settle(answer.trim() === `rebase-dev-db ${state.token}`);
+		});
+		socket.once("close", () => settle(answer.trim() === `rebase-dev-db ${state.token}`));
+		socket.connect(state.identityPort, "127.0.0.1");
+	});
+}
+/** The running daemon for this project, or `null`. Never starts anything. */
+async function findRunningDaemon(projectRoot) {
+	const state = readState(projectRoot);
+	if (!state) return null;
+	if (await isDaemonAlive(state)) return state;
+	clearState(projectRoot);
+	return null;
+}
+/**
+* Resolve the CLI entry point, so the daemon can be spawned as ourselves.
+*
+* A hidden subcommand rather than a second build entry: under `tsx` this file
+* is `src/dev-db/daemon.ts` and in a published CLI it is bundled into
+* `dist/index.js`, and in both cases the executable to re-invoke is the one
+* already running. `rebase dev` re-runs itself the same way to regenerate the
+* SDK types.
+*/
+function resolveCliEntry() {
+	const argvEntry = process.argv[1];
+	if (argvEntry && fs.existsSync(argvEntry)) return argvEntry;
+	return fileURLToPath(new URL("data:video/mp2t;base64,LyoqCiAqIFRoZSBDTEkncyBwdWJsaWMgZW50cnkg4oCUIGRlbGliZXJhdGVseSBzbWFsbC4KICoKICogVGhpcyBmaWxlIHVzZWQgdG8gYGV4cG9ydCAqYCBmcm9tIHNpeHRlZW4gbW9kdWxlczogZXZlcnkgY29tbWFuZCBmdW5jdGlvbiwKICogYGRldGVjdFBhY2thZ2VNYW5hZ2VyYCwgYGZpbmRQcm9qZWN0Um9vdGAsIHRoZSB3aG9sZSBvZiBgY29tbWFuZHMvY2xvdWRgLiBOb25lCiAqIG9mIGl0IHdhcyBpbXBvcnRlZCBieSBhbnl0aGluZywgaW4gdGhpcyByZXBvc2l0b3J5IG9yIHRoZSBjb250cm9sIHBsYW5lLCBhbmQKICogbm9uZSBvZiBpdCB3YXMgbWVhbnQgdG8gYmU6IGBAcmViYXNlcHJvL2NsaWAgaXMgYSBwcm9ncmFtLCBhbmQgYSBwcm9ncmFtJ3MKICogaW50ZXJuYWxzIGJlY29tZSBhbiBBUEkgdGhlIG1vbWVudCB0aGV5IGFyZSBleHBvcnRlZCBhbmQgcHVibGlzaGVkLiBUaGUKICogYmFycmVsIHdhcyB3cml0dGVuIHRoZSB3YXkgYmFycmVscyBnZXQgd3JpdHRlbiDigJQgb25lIGxpbmUgcGVyIGZpbGUg4oCUIGFuZCB0aGUKICogc3VyZmFjZSBpdCBjcmVhdGVkIHdhcyBhbiBhY2NpZGVudCBvZiB0aGF0IGNvbnZlbnRpb24gcmF0aGVyIHRoYW4gYSBkZWNpc2lvbi4KICoKICogVGhyZWUgdGhpbmdzIGFyZSBleHBvcnRlZCwgZWFjaCBmb3IgYSBzdGF0ZWQgcmVhc29uLgogKi8KCi8qKgogKiBXaGF0IGBiaW4vcmViYXNlLmpzYCBjYWxscy4gVGhlIGJpbmFyeSBpbXBvcnRzIGBkaXN0L2luZGV4LmVzLmpzYCBhbmQgaW52b2tlcwogKiBgZW50cnkoKWAsIHNvIHRoaXMgaXMgdGhlIG9uZSBleHBvcnQgdGhlIENMSSBjYW5ub3QgcnVuIHdpdGhvdXQuCiAqLwpleHBvcnQgeyBlbnRyeSB9IGZyb20gIi4vY2xpIjsKCi8qKgogKiBUaGUgbWFuaWZlc3QgYW5kIGJ1bmRsZSBjb250cmFjdHMuCiAqCiAqIEV4cG9ydGVkIGJlY2F1c2UgdmFsaWRhdGluZyB0aGVtIGlzIG5vdCBvbmx5IHRoZSBDTEkncyBqb2I6IGEgY29udHJvbCBwbGFuZQogKiBoYXMgdG8gZGVjaWRlIHdoZXRoZXIgYSBzdWJtaXR0ZWQgYnVuZGxlIGNhbiBydW4gYmVmb3JlIGl0IGRlcGxveXMgaXQsIGFuZCBpdAogKiBtdXN0IHJlYWNoIHRoYXQgdmVyZGljdCB3aXRoIHRoZSBzYW1lIGNvZGUgdGhhdCBwcm9kdWNlZCB0aGUgYXJ0aWZhY3QuCiAqLwpleHBvcnQgKiBmcm9tICIuL21hbmlmZXN0IjsKZXhwb3J0ICogZnJvbSAiLi9idW5kbGUiOwo=", "" + import.meta.url));
+}
+/**
+* How to re-invoke ourselves, which differs between a published CLI and this
+* repository.
+*
+* A published `rebase` is `node bin/rebase.js`, and re-running that is trivial.
+* Inside the monorepo the entry is TypeScript, which plain `node` cannot load —
+* so the daemon has to be started through the same loader that is running now.
+* Getting this wrong fails as a spawn that exits instantly with a syntax error,
+* which is why the caller reads `pglite.log` on failure.
+*/
+function resolveSpawn(entry) {
+	if (!/\.[cm]?ts$/.test(entry)) return {
+		execPath: process.execPath,
+		prefixArgs: []
+	};
+	return {
+		execPath: process.execPath,
+		prefixArgs: ["--import", "tsx"]
+	};
+}
+/**
+* Ask the running daemon for one additional database, and get its port.
+*
+* The identity socket doubles as the command channel: the daemon answers
+* with its token first, which is how the caller knows it is talking to the
+* daemon the state file describes and not to a stranger on a recycled port.
+*/
+function ensureAdditionalDatabase(state, key) {
+	return new Promise((resolve, reject) => {
+		const socket = new net.Socket();
+		let answer = "";
+		let identified = false;
+		const fail = (message) => {
+			socket.removeAllListeners();
+			socket.destroy();
+			reject(new Error(message));
+		};
+		socket.setTimeout(START_TIMEOUT_MS);
+		socket.once("timeout", () => fail(`The development database did not answer for "${key}" within ${Math.round(START_TIMEOUT_MS / 1e3)}s.`));
+		socket.once("error", (err) => fail(`Could not reach the development database for "${key}": ${err.message}`));
+		socket.on("data", (chunk) => {
+			answer += chunk.toString("utf8");
+			let newline = answer.indexOf("\n");
+			while (newline !== -1) {
+				const line = answer.slice(0, newline).trim();
+				answer = answer.slice(newline + 1);
+				if (!identified) {
+					if (line !== `rebase-dev-db ${state.token}`) return fail("The process on the development database's port is not the daemon.");
+					identified = true;
+					socket.write(`ensure ${key}\n`);
+				} else if (line.startsWith("ok ")) {
+					const port = Number(line.slice(3));
+					socket.removeAllListeners();
+					socket.destroy();
+					if (!Number.isInteger(port) || port <= 0) return reject(/* @__PURE__ */ new Error(`The development database answered with an invalid port for "${key}": ${line}`));
+					return resolve(port);
+				} else return fail(`The development database could not serve "${key}": ${line.replace(/^error\s*/, "")}`);
+				newline = answer.indexOf("\n");
+			}
+		});
+		socket.connect(state.identityPort, "127.0.0.1");
+	});
+}
+/** Every additional database the caller asked for, as connection strings. */
+async function adoptWithAdditional(state, started, keys) {
+	const additional = {};
+	for (const key of keys) {
+		const known = state.databases?.[key];
+		additional[key] = managedUrl(known ? known.port : await ensureAdditionalDatabase(state, key));
+	}
+	return {
+		...adopt(state, started),
+		additional
+	};
+}
+/**
+* The project's managed database, started if it is not already running.
+*
+* Safe to call concurrently from several commands: the loser of the race finds
+* the winner's state file during its poll and adopts it rather than starting a
+* second daemon.
+*/
+async function ensureManagedDatabase(projectRoot, options = {}) {
+	const keys = options.additionalKeys ?? [];
+	const existing = await findRunningDaemon(projectRoot);
+	if (existing) return adoptWithAdditional(existing, false, keys);
+	fs.mkdirSync(devDbDir(projectRoot), { recursive: true });
+	ensureGitignore(projectRoot);
+	if (!acquireStartLock(projectRoot, START_TIMEOUT_MS)) {
+		const adopted = await waitForDaemon(projectRoot, START_TIMEOUT_MS);
+		if (adopted) return adoptWithAdditional(adopted, false, keys);
+		if (!acquireStartLock(projectRoot, 0)) throw new Error(`Another process is starting the development database and did not finish.
+  Remove ${path.join(devDbDir(projectRoot), "starting.lock")} if nothing is running.`);
+	}
+	const port = await findFreePort();
+	const token = randomBytes(16).toString("hex");
+	const entry = options.entry ?? resolveCliEntry();
+	const spawnPlan = options.spawn ?? resolveSpawn(entry);
+	const args = [
+		...spawnPlan.prefixArgs,
+		entry,
+		"__dev-db-daemon",
+		"--project",
+		projectRoot,
+		"--port",
+		String(port),
+		"--token",
+		token
+	];
+	if (options.idleTimeoutMs !== void 0) args.push("--idle-timeout", String(options.idleTimeoutMs));
+	const log = fs.openSync(path.join(devDbDir(projectRoot), "pglite.log"), "a");
+	const child = spawn(spawnPlan.execPath, args, {
+		detached: true,
+		stdio: [
+			"ignore",
+			log,
+			log
+		]
+	});
+	child.unref();
+	try {
+		const deadline = Date.now() + START_TIMEOUT_MS;
+		let announced = false;
+		while (Date.now() < deadline) {
+			const state = readState(projectRoot);
+			if (state && await isDaemonAlive(state)) return adoptWithAdditional(state, true, keys);
+			if (!announced && !options.quiet) {
+				announced = true;
+				options.onProgress?.("Starting the development database…");
+			}
+			if (child.exitCode !== null && child.exitCode !== 0) throw new Error(`The development database failed to start (exit ${child.exitCode}).\n  ${path.join(devDbDir(projectRoot), "pglite.log")} ends:\n` + pgliteLogTail(projectRoot));
+			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+		}
+		throw new Error(`The development database did not start within ${Math.round(START_TIMEOUT_MS / 1e3)}s.\n  ${path.join(devDbDir(projectRoot), "pglite.log")} ends:\n` + pgliteLogTail(projectRoot) + "\n  To use your own Postgres instead, set DATABASE_URL or pass --database-url.");
+	} finally {
+		releaseStartLock(projectRoot);
+	}
+}
+/** Shape a live state record as the caller's result. */
+function adopt(state, started) {
+	return {
+		url: managedUrl(state.port),
+		dataDir: state.dataDir,
+		port: state.port,
+		pid: state.pid,
+		started,
+		additional: {}
+	};
+}
+/** Poll until another process publishes a live daemon, or give up. */
+async function waitForDaemon(projectRoot, timeoutMs) {
+	const deadline = Date.now() + timeoutMs;
+	while (Date.now() < deadline) {
+		const state = readState(projectRoot);
+		if (state && await isDaemonAlive(state)) return state;
+		await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+	}
+	return null;
+}
+/** Stop the daemon. Returns false when there was nothing running. */
+async function stopManagedDatabase(projectRoot) {
+	const state = await findRunningDaemon(projectRoot);
+	if (!state) return false;
+	try {
+		process.kill(state.pid, "SIGTERM");
+	} catch {
+		clearState(projectRoot);
+		return false;
+	}
+	const deadline = Date.now() + 1e4;
+	while (Date.now() < deadline) {
+		if (!fs.existsSync(stateFile(projectRoot))) return true;
+		await new Promise((resolve) => setTimeout(resolve, 100));
+	}
+	clearState(projectRoot);
+	return true;
+}
+/**
+* Stop the daemon and delete the data directory.
+*
+* Destructive and deliberately not clever: it removes the whole directory
+* rather than dropping schemas, because "give me an empty database" is the only
+* thing anyone means by it.
+*/
+async function resetManagedDatabase(projectRoot) {
+	await stopManagedDatabase(projectRoot);
+	fs.rmSync(dataDir(projectRoot), {
+		recursive: true,
+		force: true
+	});
+	const dir = devDbDir(projectRoot);
+	if (fs.existsSync(dir)) {
+		for (const entry of fs.readdirSync(dir)) if (entry.startsWith("pgdata__")) fs.rmSync(path.join(dir, entry), {
+			recursive: true,
+			force: true
+		});
+	}
+	clearState(projectRoot);
+}
+/**
+* Keep the generated directory out of git.
+*
+* `.rebase/` holds a Postgres data directory and a log. A project that commits
+* it will push hundreds of megabytes and a database that only makes sense on
+* one machine, so the ignore file is written next to the data rather than
+* relying on the project's root `.gitignore` having been updated.
+*/
+function ensureGitignore(projectRoot) {
+	const target = path.join(devDbDir(projectRoot), ".gitignore");
+	if (fs.existsSync(target)) return;
+	fs.writeFileSync(target, "# Generated by `rebase dev` — a local Postgres data directory and its log.\n# Machine-specific and large; never commit it.\n*\n", "utf8");
+}
+//#endregion
+//#region src/dev-db/resolve.ts
+/**
+* A value that is present but empty is treated as absent.
+*
+* `DATABASE_URL=` in a `.env` is what a developer writes when they mean "not
+* this one" — honouring it literally would hand an empty connection string to
+* libpq and produce an error about a missing host, which explains nothing.
+*/
+function present(value) {
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : null;
+}
+function resolveDevDatabase(input = {}) {
+	const flagUrl = present(input.flagUrl);
+	if (flagUrl) return {
+		kind: "external",
+		url: flagUrl,
+		source: "flag"
+	};
+	const fromEnvironment = present(input.env?.DATABASE_URL);
+	if (fromEnvironment) return {
+		kind: "external",
+		url: fromEnvironment,
+		source: "environment"
+	};
+	const fromBranch = present(input.branch?.url);
+	if (fromBranch && input.branch) return {
+		kind: "external",
+		url: fromBranch,
+		source: "branch",
+		branch: input.branch.name
+	};
+	const fromEnvFile = present(input.envFile?.DATABASE_URL);
+	if (fromEnvFile) return {
+		kind: "external",
+		url: fromEnvFile,
+		source: "env-file"
+	};
+	if (input.flagDocker) return {
+		kind: "docker",
+		source: "docker",
+		url: present(input.composeUrl)
+	};
+	return {
+		kind: "managed",
+		source: "managed"
+	};
+}
+/** One line for the startup banner, naming both the database and why. */
+function describeDevDatabase(database) {
+	switch (database.kind) {
+		case "external":
+			switch (database.source) {
+				case "flag": return "your database (--database-url)";
+				case "environment": return "your database (DATABASE_URL in the environment)";
+				case "env-file": return "your database (DATABASE_URL in .env)";
+				case "branch": return `branch "${database.branch}" (rebase db branch switch)`;
+			}
+			break;
+		case "docker": return "Postgres in Docker";
+		case "managed": return "the managed development database (PGlite)";
+	}
+	throw new Error(`Unhandled dev database: ${JSON.stringify(database)}`);
+}
+//#endregion
+//#region src/dev-db/prepare.ts
+/**
+* The one place a command asks "which database, and how do I reach it?".
+*
+* Every command that touches Postgres — `dev`, and the whole `db` namespace
+* through the driver plugin — goes through {@link prepareDatabaseEnv}. It
+* resolves the ordering in `resolve.ts`, starts the managed database if that is
+* what the ordering chose, and hands back the environment additions the child
+* process needs.
+*
+* Two things it deliberately does *not* do:
+*
+* - **It never overwrites an existing `DATABASE_URL`.** When the developer has
+*   named a database, the returned environment is empty and the child inherits
+*   exactly what it would have inherited before this feature existed. A
+*   migration must never be redirected away from the database its author meant.
+*
+* - **It never starts anything for a command that is not going to connect.**
+*   `--help` and argument errors are handled by the caller before this is
+*   reached, because booting a Postgres to print usage would be absurd.
+*/
+/**
+* The branch this checkout is switched to, as a connection string.
+*
+* Derived rather than stored: the pointer holds a name, and the credentials
+* stay in the one place the developer wrote them. The base is the project's
+* `.env` — a switch is a statement about *this project's* database, so a
+* `DATABASE_URL` that happens to be in the shell is not the thing being
+* branched, and it outranks the branch anyway.
+*
+* Returns null when there is no branch, and also when there is no base to swap
+* the database name on: a project with no `DATABASE_URL` is on the managed
+* database, where branching does not work at all.
+*
+* Exported for its tests. Asserting this through {@link prepareDatabaseEnv}
+* would start a real PGlite daemon to check a decision made before any daemon
+* is involved.
+*/
+function resolveActiveBranch(projectRoot, envFile) {
+	const active = readActiveBranch(projectRoot);
+	if (!active) return null;
+	const base = envFile.DATABASE_URL?.trim();
+	if (!base) return null;
+	const url = branchUrl(base, active.database);
+	return url ? {
+		name: active.name,
+		url
+	} : null;
+}
+/**
+* The compose `db` service's connection string for this project, or null.
+*
+* Read here rather than in `resolve.ts` so the ordering there stays pure, and
+* exported so `rebase dev` can hand the same URL to the preflight that starts
+* the container — the preflight decides "local, and not running" from a DSN,
+* so without one `--docker` asked for a container nothing ever started.
+*/
+function resolveComposeUrl(projectRoot, envFile) {
+	const composePath = path.join(projectRoot, "docker-compose.yml");
+	if (!fs.existsSync(composePath)) return null;
+	try {
+		return composeDatabaseUrl(fs.readFileSync(composePath, "utf8"), envFile);
+	} catch {
+		return null;
+	}
+}
+/**
+* Which database a project is on, decided without starting anything.
+*
+* `resolveDevDatabase` is pure, so the answer is available to help text and to
+* a driver child alike — and neither should pay for a daemon to learn it. The
+* driver cannot work it out for itself: on the managed path `DATABASE_URL` is a
+* perfectly ordinary connection string to a Postgres on loopback, so a child
+* handed only that has no way to know that `rebase db generate` will be refused.
+*
+* Null when there is no project here, which is legal — `rebase db --help` is
+* answered outside one — and when anything at all goes wrong reading the
+* project, because help text must not fail to print over an unreadable `.env`.
+*/
+function devDatabaseKind(projectRoot) {
+	try {
+		const root = projectRoot ?? findProjectRoot();
+		if (!root) return null;
+		const envFile = readEnvFile(root);
+		return resolveDevDatabase({
+			env: process.env,
+			envFile,
+			branch: resolveActiveBranch(root, envFile),
+			composeUrl: resolveComposeUrl(root, envFile)
+		}).kind;
+	} catch {
+		return null;
+	}
+}
+/**
+* The variable a driver child reads {@link devDatabaseKind} from.
+*
+* One name, exported, because three commands build that child's environment and
+* a fourth reads it in another package.
+*/
+var DEV_DATABASE_KIND_ENV = "REBASE_DEV_DATABASE_KIND";
+/**
+* The variable that tells a server started on a branch which database it was
+* branched from.
+*
+* The branch registry lives in that database, and a branch database holds
+* only a snapshot of it taken when it was copied — so a server on a branch
+* keeps its branches, and copies new ones from, the database named here. A
+* branch URL does not say which that is; only this checkout's `.env` does.
+*/
+var BRANCH_PARENT_DATABASE_ENV = "REBASE_BRANCH_PARENT_DATABASE";
+/**
+* Resolve, start if needed, and describe the database for this command.
+*
+* `projectRoot` is where the managed database's data lives, so two projects on
+* one machine get two databases without either being told about the other.
+*/
+async function prepareDatabaseEnv(projectRoot, options = {}) {
+	const envFile = readEnvFile(projectRoot);
+	const database = resolveDevDatabase({
+		flagUrl: options.flagUrl,
+		flagDocker: options.flagDocker,
+		env: process.env,
+		envFile,
+		branch: resolveActiveBranch(projectRoot, envFile),
+		composeUrl: resolveComposeUrl(projectRoot, envFile)
+	});
+	const description = describeDevDatabase(database);
+	if (database.kind === "external" && (database.source === "branch" || database.source === "flag")) {
+		const parent = database.source === "branch" ? databaseNameOf(envFile.DATABASE_URL?.trim() ?? "") : null;
+		return {
+			database,
+			env: {
+				DATABASE_URL: database.url,
+				...parent ? { [BRANCH_PARENT_DATABASE_ENV]: parent } : {}
+			},
+			description
+		};
+	}
+	if (database.kind === "docker") {
+		if (!database.url) throw new Error("--docker needs a docker-compose.yml with a db service in this project, and this one has none that names POSTGRES_USER, POSTGRES_DB and a published port. Set DATABASE_URL in .env to point at the database you mean instead.");
+		return {
+			database,
+			env: { DATABASE_URL: database.url },
+			description
+		};
+	}
+	if (database.kind !== "managed") return {
+		database,
+		env: {},
+		description
+	};
+	const unbound = (options.additionalKeys ?? []).filter((key) => {
+		const name = `DATABASE_URL${resourceEnvSuffix(key)}`;
+		return !process.env[name] && !envFile[name];
+	});
+	const managed = await ensureManagedDatabase(projectRoot, {
+		quiet: options.quiet,
+		onProgress: options.onProgress,
+		additionalKeys: unbound
+	});
+	const additionalEnv = {};
+	for (const [key, url] of Object.entries(managed.additional)) additionalEnv[`DATABASE_URL${resourceEnvSuffix(key)}`] = url;
+	return {
+		database,
+		description,
+		dataDir: managed.dataDir,
+		startedDaemon: managed.started,
+		additional: managed.additional,
+		env: {
+			DATABASE_URL: managed.url,
+			REBASE_DB_POOL_MAX: String(1),
+			...additionalEnv
+		}
+	};
+}
+/**
+* The lines to print about a managed database, in the order to print them.
+*
+* Returned rather than printed so the caller decides where they go — `dev` has
+* a banner, `db push` has a single line above its own output — and so a test can
+* assert on them without capturing a stream.
+*/
+function managedNotices(prepared) {
+	if (prepared.database.kind !== "managed") return [];
+	const lines = [`Using ${prepared.description}.`];
+	if (prepared.dataDir) lines.push(`Data: ${prepared.dataDir}`);
+	for (const key of Object.keys(prepared.additional ?? {})) lines.push(`Also serving database "${key}" as DATABASE_URL${resourceEnvSuffix(key)}`);
+	for (const limitation of MANAGED_LIMITATIONS) lines.push(`${limitation.summary} ${limitation.remedy}`);
+	lines.push("To use your own Postgres instead, set DATABASE_URL in .env.");
+	return lines;
+}
+//#endregion
+export { parseLoopbackDsn as C, DEV_DATABASE_KIND_ENV, ensureDevDatabase as S, waitForPort as T, readActiveBranch as _, isDaemonAlive as a, composeDeclaresDbService as b, resetManagedDatabase as c, stopManagedDatabase as d, devDatabaseKind, branchDatabaseName as f, databaseNameOf as g, clearActiveBranch as h, findRunningDaemon as i, resolveCliEntry as l, branchUrl as m, managedNotices, resolveDevDatabase as n, managedUrl as o, branchPointerPath as p, prepareDatabaseEnv, ensureManagedDatabase as r, resolveActiveBranch, resolveComposeUrl, pgliteLogTail as s, describeDevDatabase as t, resolveSpawn as u, writeActiveBranch as v, probeTcp as w, composeHostPort as x, composeDatabaseUrl as y };
+
+//# sourceMappingURL=prepare-Btn9Ewbn.js.map