@rebasepro/cli 0.25.0-canary.ge06257e → 0.25.0

package/dist/{status-D_B3tlDy.js.map → status-BJ26yZOo.js.map}

@@ -1 +1 @@
-{"version":3,"file":"status-D_B3tlDy.js","names":[],"sources":["../src/resources/status.ts","../src/commands/status.ts"],"sourcesContent":["/**\n * What a project declared, what the environment binds it to, and whether the\n * two meet.\n *\n * ## Why this exists\n *\n * Every piece of this was already knowable and none of it was visible in one\n * place. `rebase resources` lists what you declared. The environment holds the\n * variables. The resolvers decide whether a source is usable. So the question a\n * developer actually has — *\"why does uploading to `media` answer 501\"* — could\n * only be answered by knowing the suffix rule, deriving the variable name by\n * hand, and checking it against a `.env` they had to find first.\n *\n * The answer is mechanical, so it should be printed rather than taught.\n *\n * ## Why it calls the resolvers instead of re-deciding\n *\n * The verdict comes from `resolveDataSources` and `resolveStorageBackend` — the\n * same functions that run at boot. A status view that decided for itself what\n * \"configured\" means would be a second implementation of the rule, and the\n * first time it disagreed it would be reassuring a developer about a deployment\n * that is about to refuse to start.\n *\n * The variable *names* come from each kind's `envBases`, and the verdicts from\n * the resolver `@rebasepro/server` registers per kind — one object per kind,\n * held to `envBases` by `resource-env-bases.test.ts`. A kind this view has\n * never heard of is judged by whatever resolver its package registered.\n */\nimport { withImplicitDefaults } from \"./derive\";\nimport {\n    DEFAULT_RESOURCE_KEY,\n    envBasesForResource,\n    resourceEnvSuffix,\n    resourceToDataSource,\n    type ResourceDeclaration,\n    type ResourceGraph\n} from \"@rebasepro/types\";\n\n/** One environment variable a resource reads, and whether it is there. */\nexport interface ResourceBinding {\n    /** The variable this resource reads, suffix included. */\n    name: string;\n    set: boolean;\n    /**\n     * The account-scoped name consulted when `name` is unset.\n     *\n     * Only provider-level bindings have one, and only when the resource named\n     * an `account`. Shown because a developer looking at an unset\n     * `S3_ACCESS_KEY_ID__MEDIA` needs to know it is not the whole story.\n     */\n    fallback?: { name: string; set: boolean };\n}\n\n/** Whether a declared resource can actually be reached. */\nexport type ResourceState =\n    /** Bound and usable. */\n    | \"ready\"\n    /** Nothing set for it. Legal for a bucket, fatal for a database. */\n    | \"unconfigured\"\n    /** Set, and set wrongly. The deployment refuses to start. */\n    | \"broken\";\n\nexport interface ResourceStatus {\n    kind: string;\n    key: string;\n    engine: string;\n    transport: string;\n    /** Present when this resource shares another's credentials. */\n    account?: string;\n    /** True for a resource nobody declared, which exists anyway. */\n    implicit: boolean;\n    bindings: ResourceBinding[];\n    state: ResourceState;\n    /** What this means, in the terms the developer will meet it in. */\n    detail: string;\n    /** Set when a local directory stands in for this engine, in development. */\n    standsIn?: string;\n    /** What in the project reaches this resource, from the graph. */\n    usedBy?: readonly string[];\n}\n\nexport type EnvBag = Record<string, string | undefined>;\n\n/** Set, and not set to the empty string — which the resolvers treat as absent. */\nfunction isSet(env: EnvBag, name: string): boolean {\n    const value = env[name];\n    return typeof value === \"string\" && value !== \"\";\n}\n\n/**\n * The bindings one declaration reads, in the order a reader should scan them.\n *\n * A `direct`-transport resource gets none: the browser reaches it with a\n * provider SDK and the backend binds nothing for it, so listing variables would\n * invite someone to set variables that are never read.\n */\nexport function bindingsFor(\n    declaration: ResourceDeclaration,\n    env: EnvBag,\n    accountScopedBases: readonly string[]\n): ResourceBinding[] {\n    if (declaration.transport !== \"server\") return [];\n\n    const suffix = resourceEnvSuffix(declaration.key);\n    const account = typeof declaration.options.account === \"string\"\n        ? resourceEnvSuffix(declaration.options.account)\n        : undefined;\n\n    return envBasesForResource(declaration).map((base) => {\n        const name = `${base}${suffix}`;\n        const binding: ResourceBinding = { name, set: isSet(env, name) };\n\n        // Only the provider-level bindings fall back, and only for a resource\n        // that named an account. The bucket name never does — it is what\n        // distinguishes one source from another.\n        if (account !== undefined && !binding.set && accountScopedBases.includes(base)) {\n            binding.fallback = { name: `${base}${account}`, set: isSet(env, `${base}${account}`) };\n        }\n        return binding;\n    });\n}\n\n/**\n * What the managed development database covers, when a project is on it.\n *\n * `rebase init` leaves `DATABASE_URL` commented out on purpose and the managed\n * PGlite fills the vacuum — the documented first-run state. Judging that state\n * by the environment alone produced `○ (default) postgres · DATABASE_URL not\n * set` and the remedy \"set DATABASE_URL\", at the same moment `rebase db url`\n * was printing a working connection string for the same project and\n * `rebase dev` was serving from it. The status view was reading the one place\n * the answer deliberately is not.\n *\n * Resolved by the caller, because deciding it needs the project's `.env`, its\n * branch pointer and its compose file, and this module stays free of all three.\n */\nexport interface ManagedDatabaseStatus {\n    /**\n     * The daemon's connection string, or null when it is not running.\n     *\n     * Null is not an error: the managed database exists per project and starts\n     * on demand. It only means there is nothing to run the whole-set check\n     * against, and the row says so rather than implying a misconfiguration.\n     */\n    url: string | null;\n}\n\n/**\n * The compose `db` service, when a project is on Postgres in Docker.\n *\n * `rebase dev --docker` is remembered, and every command follows it with the\n * scaffold's `DATABASE_URL` still commented out — so, judged by `.env` alone,\n * this view said the default database had no connection string while `rebase\n * dev --docker` served the project from it. Unlike the managed database it\n * stands in for the default only: `dev --docker` hands the backend\n * `DATABASE_URL` and nothing else, so a second declared database still needs\n * its own variable.\n */\nexport interface DockerDatabaseStatus {\n    /** The compose service's connection string, which the runtime is given as `DATABASE_URL`. */\n    url: string;\n    /** What the default database's row says it is. */\n    detail: string;\n}\n\n/**\n * The resolver-side of status, as `@rebasepro/server` registers it per kind.\n *\n * Passed in rather than imported so this module stays testable without a\n * server, and so a kind registered by a plugin is judged by the resolver the\n * plugin brought with it rather than by a switch here.\n */\nexport interface StatusResolvers {\n    /** `resourceResolver(kind)` from `@rebasepro/server`. */\n    resolverFor: (kind: string) => {\n        accountScoped?: readonly string[];\n        resolve: (\n            declaration: ResourceDeclaration,\n            env: EnvBag,\n            context: { production: boolean; defaultBasePath: string }\n        ) => { state: \"ready\" | \"unbound\" | \"blocked\" | \"code\"; detail?: string; standsIn?: string };\n    } | undefined;\n    /** `resolveDataSources` from `@rebasepro/server`, for the whole-set check. */\n    resolveDataSources: (env: EnvBag, definitions: unknown) => unknown;\n    /** Whether the process being judged is production. Status judges for development by default. */\n    production?: boolean;\n    /**\n     * Set when this project runs on the managed development database.\n     *\n     * Absent for a project that named its own connection string, and absent in\n     * production — where an unset `DATABASE_URL` is the failure it has always\n     * been.\n     */\n    managedDatabase?: ManagedDatabaseStatus;\n    /** Set when this project runs on Postgres in Docker. Absent in production, like the managed one. */\n    dockerDatabase?: DockerDatabaseStatus;\n}\n\n/**\n * The environment plus the managed database's URL, for the whole-set check.\n *\n * A copy: the bindings a reader sees are computed against the real `.env`, so\n * nothing here can make the view claim a variable is set that is not. This is\n * only what `resolveDataSources` is handed, and it is handed it so the check\n * judges the environment the runtime would actually get rather than throwing\n * \"Data source \"(default)\" has no connection string\" about a database that is\n * running and reachable.\n */\nfunction withManagedUrls(env: EnvBag, graph: ResourceGraph, url: string): EnvBag {\n    const filled: EnvBag = { ...env };\n    const keys = [\n        DEFAULT_RESOURCE_KEY,\n        ...graph.resources.filter(r => r.kind === \"database\").map(r => r.key)\n    ];\n    for (const key of keys) {\n        const name = `DATABASE_URL${resourceEnvSuffix(key)}`;\n        if (!isSet(filled, name)) filled[name] = url;\n    }\n\n    return filled;\n}\n\n/**\n * The environment with the default database's URL filled in, when `.env` leaves it out.\n *\n * What a database's resolver is judged against. The resolver checks a source\n * alongside the default one, so a second database bound by its own\n * `DATABASE_URL__ANALYTICS` was marked ✗ with `Data source \"(default)\" has no\n * connection string` — on a project whose default the managed database or the\n * compose service provides, and whose boot worked. Judged against the\n * environment the runtime actually gets, it is judged on its own string.\n */\nfunction withDefaultUrl(env: EnvBag, url: string | null | undefined): EnvBag {\n    if (!url || isSet(env, \"DATABASE_URL\")) return env;\n\n    return { ...env, DATABASE_URL: url };\n}\n\n/**\n * Resolve every declared resource against an environment.\n *\n * Each kind's verdict comes from the resolver `@rebasepro/server` registered\n * for it — the same one boot calls — so this view cannot say \"ready\" about a\n * binding boot would refuse. A kind with no resolver is reported as such\n * rather than skipped: a resource nobody shows is one nobody remembers to\n * configure, and a kind this runtime cannot bind is exactly what boot will\n * refuse by name.\n *\n * `resolveDataSources` is then run once over the whole set, so anything it\n * would refuse across sources (a driver package it cannot resolve for a custom\n * engine) is reported rather than missed by a view that only looked per row.\n */\nexport function computeStatus(\n    graph: ResourceGraph,\n    env: EnvBag,\n    resolvers: StatusResolvers\n): { resources: ResourceStatus[]; blocked?: string } {\n    const resources: ResourceStatus[] = [];\n    const production = resolvers.production ?? false;\n    const managed = resolvers.managedDatabase;\n    const docker = resolvers.dockerDatabase;\n    /** The default database's URL as the runtime gets it, when `.env` does not name one. */\n    const devDefaultUrl = managed?.url ?? docker?.url ?? null;\n    /** Database rows the managed database answered for, so `blocked` can skip them. */\n    let managedCovered = 0;\n\n    for (const { declaration, implicit } of withImplicitDefaults(graph)) {\n        const resolver = resolvers.resolverFor(declaration.kind);\n        const bindings = bindingsFor(declaration, env, resolver?.accountScoped ?? []);\n        const base: Omit<ResourceStatus, \"state\" | \"detail\"> = {\n            kind: declaration.kind,\n            key: declaration.key,\n            engine: declaration.engine,\n            transport: declaration.transport,\n            ...(typeof declaration.options.account === \"string\"\n                ? { account: declaration.options.account }\n                : {}),\n            implicit,\n            bindings,\n            ...(declaration.usedBy && declaration.usedBy.length > 0 ? { usedBy: declaration.usedBy } : {})\n        };\n\n        if (!resolver) {\n            resources.push({\n                ...base,\n                state: \"broken\",\n                detail: `this runtime has no resolver for a \"${declaration.kind}\" — boot refuses it by name. ` +\n                    \"Upgrade @rebasepro/server, or remove the declaration.\"\n            });\n            continue;\n        }\n\n        // Answered before the resolver, because the resolver reads the\n        // environment and the whole point of the managed database is that the\n        // environment is deliberately empty. Only for a database nobody bound:\n        // a developer who set `DATABASE_URL__ANALYTICS` to a warehouse of their\n        // own has said which database that is, and the managed one fills a\n        // vacuum, never a choice.\n        if (managed && declaration.kind === \"database\" && bindings.every(b => !b.set && !b.fallback?.set)) {\n            managedCovered += 1;\n            resources.push({\n                ...base,\n                state: \"ready\",\n                detail: managed.url\n                    ? \"the managed development database (PGlite), this project only\"\n                    : \"the managed development database (PGlite), this project only — \"\n                        + \"not running; start it with `rebase dev`\"\n            });\n            continue;\n        }\n\n        // The default database on Docker: the compose service, unless `.env`\n        // names one itself.\n        if (docker && declaration.kind === \"database\" && declaration.key === DEFAULT_RESOURCE_KEY\n            && bindings.every(b => !b.set && !b.fallback?.set)) {\n            resources.push({ ...base, state: \"ready\", detail: docker.detail });\n            continue;\n        }\n\n        const judged = declaration.kind === \"database\" ? withDefaultUrl(env, devDefaultUrl) : env;\n        const verdict = resolver.resolve(declaration, judged, { production, defaultBasePath: \"uploads\" });\n        switch (verdict.state) {\n            case \"ready\":\n                resources.push({\n                    ...base,\n                    state: \"ready\",\n                    ...(verdict.standsIn ? { standsIn: verdict.standsIn } : {}),\n                    detail: verdict.detail ?? \"\"\n                });\n                break;\n            case \"code\":\n                resources.push({ ...base, state: \"ready\", detail: verdict.detail ?? \"needs no environment configuration\" });\n                break;\n            case \"unbound\":\n                resources.push({ ...base, state: \"unconfigured\", detail: verdict.detail ?? \"declared, not configured\" });\n                break;\n            case \"blocked\":\n                resources.push({\n                    ...base,\n                    // A database the environment names nothing for is the\n                    // ordinary first-run state, and reads as unconfigured; a\n                    // binding that is set and set wrongly is broken.\n                    state: implicit || bindings.every(b => !b.set && !b.fallback?.set) ? \"unconfigured\" : \"broken\",\n                    detail: verdict.detail ?? \"boot refuses this binding\"\n                });\n                break;\n        }\n    }\n\n    // Only asked when every row already looks fine. Its failures overlap with\n    // the per-resource ones, and a banner repeating a line printed two rows\n    // above teaches nothing — what it is here for is the failure no row models,\n    // such as a custom engine whose driver package cannot be resolved.\n    let blocked: string | undefined;\n    // Not run when the managed database answered for a row and is not running:\n    // there is no connection string to check the set against, and inventing one\n    // to keep the check formally \"run\" is how a green tick gets printed for\n    // work nobody did. The row says the daemon is down; that is the finding.\n    const managedSetUnknown = managedCovered > 0 && !managed?.url;\n    if (resources.every(r => r.state === \"ready\") && !managedSetUnknown) {\n        try {\n            resolvers.resolveDataSources(\n                // The managed URL for the rows it answered for, so the whole-set\n                // check judges the same environment the runtime would get.\n                managed?.url ? withManagedUrls(env, graph, managed.url) : withDefaultUrl(env, docker?.url),\n                graph.resources.filter(r => r.kind === \"database\").map(resourceToDataSource)\n            );\n        } catch (err) {\n            blocked = err instanceof Error ? err.message : String(err);\n        }\n    }\n\n    return { resources, ...(blocked !== undefined ? { blocked } : {}) };\n}\n","/**\n * `rebase status` — what this project is, and whether it can reach its things.\n *\n * The model a developer has to hold is small and was nowhere visible:\n *\n *   rebase.json           where the code is, and who runs the server\n *   config/resources.ts   what the project needs\n *   the environment       how to reach each of them\n *\n * Everything else — `rebase.resources.json`, the bundle manifest — is a\n * generated copy of the middle one, for readers that cannot run the code. A\n * developer never writes them and should not have to think about them.\n *\n * This command prints the three together, resolved. It exists because the\n * question people actually arrive with — \"why does uploading to `media` answer\n * 501\" — was answerable only by knowing the `<BASE>__<KEY>` suffix rule,\n * deriving the variable name by hand, and checking it against a `.env` they had\n * to find first. Every step of that is mechanical, so it is printed instead.\n */\nimport chalk from \"chalk\";\nimport fs from \"fs\";\nimport path from \"path\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { failAsJson, readEnvFile, requireProjectRoot } from \"../utils/project\";\nimport { findBackendApp, loadManifest, ManifestError, resolveBackendPaths } from \"../manifest\";\nimport { deriveOptionsFor, deriveResourceGraph, RESOURCE_GRAPH_FILENAME, readResourceGraphFile, serializeResourceGraph } from \"../resources/derive\";\nimport { computeStatus, type DockerDatabaseStatus, type ManagedDatabaseStatus, type ResourceStatus } from \"../resources/status\";\nimport { findRunningDaemon, managedUrl } from \"../dev-db/daemon\";\nimport { type ResolvedBranch, resolveProjectDatabaseAndBranch } from \"../dev-db/prepare\";\nimport { describeTarget } from \"../dev-db/pull\";\nimport { parseLoopbackDsn, probeTcp } from \"../utils/dev-preflight\";\nimport type { RebaseBackendAppConfig } from \"@rebasepro/types\";\n\nfunction usage(): void {\n    console.log(`\n${chalk.bold(\"rebase status\")} — what this project declares, and whether it is configured\n\n${chalk.bold(\"Usage\")}\n  rebase status                Show every resource and the variables it reads\n  rebase status --json         The same, as JSON\n\n${chalk.bold(\"Reads\")}\n  rebase.json                  which apps exist, and who owns the server process\n  <config>/resources.ts        the databases, buckets, topics and queues declared\n  backend/crons, backend/functions   the crons and functions, by filename\n  .env                         whether each one's variables are set\n`);\n}\n\nconst MARK = {\n    ready: chalk.green(\"✓\"),\n    unconfigured: chalk.yellow(\"○\"),\n    broken: chalk.red(\"✗\")\n} as const;\n\nfunction printResource(status: ResourceStatus): void {\n    const name = status.key === \"(default)\" ? chalk.bold(\"(default)\") : chalk.bold(status.key);\n    const tags = [chalk.gray(status.engine)];\n    if (status.transport !== \"server\") tags.push(chalk.yellow(status.transport));\n    if (status.account) tags.push(chalk.gray(`account:${status.account}`));\n    if (status.implicit) tags.push(chalk.gray(\"implicit\"));\n    // A stand-in is not a binding. It is shown in yellow beside a green tick:\n    // uploads work here, and the same declaration answers 501 in production\n    // until the variable is set.\n    if (status.standsIn) tags.push(chalk.yellow(`local stand-in for ${status.standsIn}`));\n\n    console.log(`  ${MARK[status.state]} ${name}  ${tags.join(\" · \")}`);\n    if (status.usedBy && status.usedBy.length > 0) {\n        console.log(`      ${chalk.gray(\"used by\")} ${chalk.gray(status.usedBy.join(\", \"))}`);\n    }\n\n    let hiddenOptional = 0;\n    for (const binding of status.bindings) {\n        if (binding.set) {\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.name)}`);\n        } else if (binding.fallback?.set) {\n            // Not a gap: the account form is the variable this bucket is\n            // actually reading, and showing only the unset per-key name would\n            // send someone to set the one they were deliberately avoiding.\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.fallback.name)} ${chalk.gray(`(shared, for ${binding.name})`)}`);\n        } else if (status.state === \"ready\") {\n            // It resolved without this one, so this one is optional — which is\n            // the resolver's answer, not a second table of required names kept\n            // here. Listing seven unset optionals under a working database is\n            // how a status view teaches people to skim past the line that\n            // matters.\n            hiddenOptional += 1;\n        } else {\n            const also = binding.fallback ? chalk.gray(` or ${binding.fallback.name}`) : \"\";\n            console.log(`      ${chalk.gray(\"·\")} ${chalk.gray(binding.name)}${also} ${chalk.gray(\"not set\")}`);\n        }\n    }\n    if (hiddenOptional > 0) {\n        console.log(chalk.gray(`      ${hiddenOptional} optional variable${hiddenOptional === 1 ? \"\" : \"s\"} not set`));\n    }\n\n    if (status.detail) {\n        const colour = status.state === \"broken\" ? chalk.red : status.state === \"unconfigured\" ? chalk.yellow : chalk.gray;\n        console.log(`      ${colour(`└ ${status.detail}`)}`);\n    }\n}\n\n/** Which database `rebase status` reports the project on, and what it hands the status view about it. */\nexport interface StatusDatabase {\n    managedDatabase?: ManagedDatabaseStatus;\n    dockerDatabase?: DockerDatabaseStatus;\n    /** The branch this checkout is on, when the database is one. */\n    branch: ResolvedBranch | null;\n    /** A switched-to branch the managed database cannot serve. */\n    ignoredBranch: string | null;\n}\n\n/**\n * Which database this project is on, decided by the same ordered rule\n * `rebase dev` and `rebase db url` use — and read from the project's `.env`,\n * not from this shell: `rebase status` asks what *this project* is on.\n *\n * Nothing is started. `status` is a question, and a question that boots a\n * 180 MB Postgres to answer itself is a different command. So a managed\n * database that is not running is reported as exactly that, rather than as a\n * project with no database; and a compose database likewise, after a probe of\n * its port.\n *\n * `envFile` is the parsed `.env`; production stands nothing in, because there\n * an unset `DATABASE_URL` is the failure it has always been.\n *\n * Exported for its tests.\n */\nexport async function statusDatabase(projectRoot: string, envFile: Record<string, string>): Promise<StatusDatabase> {\n    const { database, branch, ignoredBranch } = resolveProjectDatabaseAndBranch(projectRoot, { env: {} });\n    if (envFile.NODE_ENV === \"production\") return { branch, ignoredBranch };\n\n    if (database.kind === \"managed\") {\n        const daemon = await findRunningDaemon(projectRoot);\n        return { managedDatabase: { url: daemon ? managedUrl(daemon.port) : null }, branch, ignoredBranch };\n    }\n\n    if (database.kind === \"docker\" && database.url) {\n        const target = parseLoopbackDsn(database.url);\n        const listening = target ? await probeTcp(target.host, target.port) : true;\n        const which = branch ? `branch \"${branch.name}\" (${branch.database}) of Postgres in Docker` : \"Postgres in Docker\";\n        return {\n            dockerDatabase: {\n                url: database.url,\n                detail: which + \", as the last `rebase dev --docker` · \" + describeTarget(database.url)\n                    + (listening ? \"\" : \" — not running; `rebase dev --docker` starts it\")\n            },\n            branch,\n            ignoredBranch\n        };\n    }\n\n    return { branch, ignoredBranch };\n}\n\nexport async function statusCommand(rawArgs: string[]): Promise<void> {\n    if (wantsHelp(rawArgs)) return usage();\n\n    const { flags } = parseCommandArgs({\n        spec: { \"--json\": Boolean },\n        rawArgs,\n        commandWords: 1,\n        command: \"status\",\n        maxPositionals: 0\n    });\n\n    const projectRoot = requireProjectRoot();\n\n    // Every exit below has a `--json` arm, because `--json` means stdout holds\n    // one JSON object on *every* exit of the command. It used to mean that for\n    // the one failure `requireProjectRoot` owns and nothing else, so a caller\n    // parsing stdout got an envelope outside a project and an empty stream\n    // inside a broken one — the case it actually has to handle.\n    const asJson = Boolean(flags[\"--json\"]);\n\n    let backend: { name: string; app: RebaseBackendAppConfig };\n    try {\n        const loaded = loadManifest(projectRoot);\n        const found = findBackendApp(loaded.manifest);\n        if (!found) {\n            if (asJson) {\n                failAsJson(\n                    \"This project declares no backend app, so it declares no resources.\",\n                    \"no_backend_app\",\n                    \"Add a backend app to rebase.json, or run `rebase apps init`.\"\n                );\n            }\n            console.error(chalk.red(\"This project declares no backend app, so it declares no resources.\"));\n            process.exitCode = 1;\n            return;\n        }\n        backend = found;\n    } catch (err) {\n        if (err instanceof ManifestError) {\n            if (asJson) {\n                failAsJson(err.message, \"manifest_invalid\", \"Fix rebase.json, then run this again.\",\n                    err.issues.map(issue => ({ path: issue.path, message: issue.message })));\n            }\n            console.error(chalk.red(err.message));\n            for (const issue of err.issues) console.error(`  ${chalk.gray(issue.path)} ${issue.message}`);\n            process.exitCode = 1;\n            return;\n        }\n        throw err;\n    }\n\n    const { name: backendName, app: backendApp } = backend;\n    const paths = resolveBackendPaths(backendApp, projectRoot);\n\n    const { graph, issues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, backendApp));\n    if (issues.length > 0) {\n        if (asJson) {\n            failAsJson(\n                `${issues.length} problem(s) in the declared resources.`,\n                \"resource_declaration_invalid\",\n                \"Fix the declarations the issues name, then run this again.\",\n                issues.map(issue => ({ path: issue.path, message: issue.message }))\n            );\n        }\n        console.error(chalk.red(`\\n✗ ${issues.length} problem(s) in the declared resources:\\n`));\n        for (const issue of issues) console.error(`  ${chalk.bold(issue.path)}  ${issue.message}`);\n        console.error(\"\");\n        process.exitCode = 1;\n        return;\n    }\n\n    // The project's own `.env`, not this process's environment: `rebase status`\n    // is asking what a deployment of THIS repository would do, and the shell a\n    // developer happens to be standing in is not that.\n    const env = readEnvFile(projectRoot);\n\n    const production = env.NODE_ENV === \"production\";\n    const { managedDatabase, dockerDatabase, branch, ignoredBranch } = await statusDatabase(projectRoot, env);\n\n    const server = await import(\"@rebasepro/server\");\n    const { resources, blocked } = computeStatus(graph, env, {\n        resolverFor: server.resourceResolver as never,\n        resolveDataSources: server.resolveDataSources as never,\n        // Judged as production when the .env says so; a stand-in local\n        // directory for an unbound bucket is only ever offered to development.\n        production,\n        ...(managedDatabase ? { managedDatabase } : {}),\n        ...(dockerDatabase ? { dockerDatabase } : {})\n    });\n\n    if (asJson) {\n        console.log(JSON.stringify({\n            backend: backendName,\n            runtime: backendApp.runtime,\n            ...(branch ? { branch: { name: branch.name, database: branch.database } } : {}),\n            resources,\n            blocked\n        }, null, 2));\n        return;\n    }\n\n    const ownership = backendApp.runtime === \"managed\"\n        ? \"Rebase's runtime boots your bundle\"\n        : \"this project builds its own image and entrypoint\";\n\n    console.log(\"\");\n    console.log(`  ${chalk.bold(backendName)}  ${chalk.gray(\"·\")}  ${chalk.cyan(backendApp.runtime)}  ${chalk.gray(ownership)}`);\n    // Named whether or not it exists, and said plainly when it does not. A\n    // project with no `resources.ts` is legal — it has one default database and\n    // one default bucket — but \"declared in <a file you do not have>\" reads as\n    // a broken install rather than as the default it is.\n    const resourcesFile = path.join(paths.config, \"resources.ts\");\n    const declaresAnything = fs.existsSync(path.join(projectRoot, resourcesFile));\n    console.log(`  ${chalk.gray(\"declared in\")}  ${chalk.gray(resourcesFile)}${\n        declaresAnything ? \"\" : chalk.gray(\"  (none — the defaults below are implicit)\")}`);\n    console.log(`  ${chalk.gray(\"configured by\")}  ${chalk.gray(\".env\")}`);\n    // Every database command in this checkout uses the branch, so the view\n    // says so: a switch made yesterday is easy to forget.\n    if (branch) {\n        console.log(`  ${chalk.gray(\"on branch\")}  ${chalk.bold(branch.name)} ${chalk.gray(`(${branch.database})`)}`\n            + chalk.gray(` — ${chalk.cyan(\"rebase db branch switch --off\")} returns to ${branch.parent ?? \"the main database\"}`));\n    } else if (ignoredBranch) {\n        console.log(`  ${chalk.yellow(\"○\")} ${chalk.gray(`switched to branch \"${ignoredBranch}\", which the managed database cannot serve — it uses the main one`)}`);\n    }\n\n    const kinds = [...new Set(resources.map(r => r.kind))];\n    for (const kind of kinds) {\n        console.log(\"\");\n        console.log(`  ${chalk.bold.underline(`${kind}s`)}`);\n        for (const status of resources.filter(r => r.kind === kind)) printResource(status);\n    }\n\n    if (blocked) {\n        console.log(\"\");\n        console.log(`  ${chalk.red(\"✗\")} ${chalk.red(blocked)}`);\n    }\n\n    // Only worth a line when it is wrong. A generated file that matches its\n    // declarations is not news, and a status view that reports its own\n    // bookkeeping as an item trains people to skim past the items that matter.\n    const committed = readResourceGraphFile(projectRoot);\n    const expected = serializeResourceGraph(graph);\n    if (committed !== expected && !(committed === null && graph.resources.length === 0)) {\n        console.log(\"\");\n        console.log(`  ${chalk.yellow(\"○\")} ${RESOURCE_GRAPH_FILENAME} is ${committed === null ? \"missing\" : \"stale\"} — ${chalk.blue(\"rebase resources --write\")}`);\n        console.log(chalk.gray(\"      a host reads it to decide what to provision before it runs anything\"));\n    }\n\n    console.log(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,SAAS,MAAM,KAAa,MAAuB;CAC/C,MAAM,QAAQ,IAAI;CAClB,OAAO,OAAO,UAAU,YAAY,UAAU;AAClD;;;;;;;;AASA,SAAgB,YACZ,aACA,KACA,oBACiB;CACjB,IAAI,YAAY,cAAc,UAAU,OAAO,CAAC;CAEhD,MAAM,SAAS,kBAAkB,YAAY,GAAG;CAChD,MAAM,UAAU,OAAO,YAAY,QAAQ,YAAY,WACjD,kBAAkB,YAAY,QAAQ,OAAO,IAC7C,KAAA;CAEN,OAAO,oBAAoB,WAAW,CAAC,CAAC,KAAK,SAAS;EAClD,MAAM,OAAO,GAAG,OAAO;EACvB,MAAM,UAA2B;GAAE;GAAM,KAAK,MAAM,KAAK,IAAI;EAAE;EAK/D,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,OAAO,mBAAmB,SAAS,IAAI,GACzE,QAAQ,WAAW;GAAE,MAAM,GAAG,OAAO;GAAW,KAAK,MAAM,KAAK,GAAG,OAAO,SAAS;EAAE;EAEzF,OAAO;CACX,CAAC;AACL;;;;;;;;;;;AAwFA,SAAS,gBAAgB,KAAa,OAAsB,KAAqB;CAC7E,MAAM,SAAiB,EAAE,GAAG,IAAI;CAChC,MAAM,OAAO,CACT,sBACA,GAAG,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,KAAI,MAAK,EAAE,GAAG,CACxE;CACA,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,OAAO,eAAe,kBAAkB,GAAG;EACjD,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO,QAAQ;CAC7C;CAEA,OAAO;AACX;;;;;;;;;;;AAYA,SAAS,eAAe,KAAa,KAAwC;CACzE,IAAI,CAAC,OAAO,MAAM,KAAK,cAAc,GAAG,OAAO;CAE/C,OAAO;EAAE,GAAG;EAAK,cAAc;CAAI;AACvC;;;;;;;;;;;;;;;AAgBA,SAAgB,cACZ,OACA,KACA,WACiD;CACjD,MAAM,YAA8B,CAAC;CACrC,MAAM,aAAa,UAAU,cAAc;CAC3C,MAAM,UAAU,UAAU;CAC1B,MAAM,SAAS,UAAU;;CAEzB,MAAM,gBAAgB,SAAS,OAAO,QAAQ,OAAO;;CAErD,IAAI,iBAAiB;CAErB,KAAK,MAAM,EAAE,aAAa,cAAc,qBAAqB,KAAK,GAAG;EACjE,MAAM,WAAW,UAAU,YAAY,YAAY,IAAI;EACvD,MAAM,WAAW,YAAY,aAAa,KAAK,UAAU,iBAAiB,CAAC,CAAC;EAC5E,MAAM,OAAiD;GACnD,MAAM,YAAY;GAClB,KAAK,YAAY;GACjB,QAAQ,YAAY;GACpB,WAAW,YAAY;GACvB,GAAI,OAAO,YAAY,QAAQ,YAAY,WACrC,EAAE,SAAS,YAAY,QAAQ,QAAQ,IACvC,CAAC;GACP;GACA;GACA,GAAI,YAAY,UAAU,YAAY,OAAO,SAAS,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;EAChG;EAEA,IAAI,CAAC,UAAU;GACX,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,uCAAuC,YAAY,KAAK;GAEpE,CAAC;GACD;EACJ;EAQA,IAAI,WAAW,YAAY,SAAS,cAAc,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GAC/F,kBAAkB;GAClB,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,QAAQ,MACV,iEACA;GAEV,CAAC;GACD;EACJ;EAIA,IAAI,UAAU,YAAY,SAAS,cAAc,YAAY,QAAQ,wBAC9D,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GACpD,UAAU,KAAK;IAAE,GAAG;IAAM,OAAO;IAAS,QAAQ,OAAO;GAAO,CAAC;GACjE;EACJ;EAEA,MAAM,SAAS,YAAY,SAAS,aAAa,eAAe,KAAK,aAAa,IAAI;EACtF,MAAM,UAAU,SAAS,QAAQ,aAAa,QAAQ;GAAE;GAAY,iBAAiB;EAAU,CAAC;EAChG,QAAQ,QAAQ,OAAhB;GACI,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KACH,OAAO;KACP,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;KACzD,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAS,QAAQ,QAAQ,UAAU;IAAqC,CAAC;IAC1G;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAgB,QAAQ,QAAQ,UAAU;IAA2B,CAAC;IACvG;GACJ,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KAIH,OAAO,YAAY,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,iBAAiB;KACtF,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;EACR;CACJ;CAMA,IAAI;CAKJ,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,SAAS;CAC1D,IAAI,UAAU,OAAM,MAAK,EAAE,UAAU,OAAO,KAAK,CAAC,mBAC9C,IAAI;EACA,UAAU,mBAGN,SAAS,MAAM,gBAAgB,KAAK,OAAO,QAAQ,GAAG,IAAI,eAAe,KAAK,QAAQ,GAAG,GACzF,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAC/E;CACJ,SAAS,KAAK;EACV,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC7D;CAGJ,OAAO;EAAE;EAAW,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;CAAG;AACtE;;;;;;;;;;;;;;;;;;;;;;ACpVA,SAAS,QAAc;CACnB,QAAQ,IAAI;EACd,MAAM,KAAK,eAAe,EAAE;;EAE5B,MAAM,KAAK,OAAO,EAAE;;;;EAIpB,MAAM,KAAK,OAAO,EAAE;;;;;CAKrB;AACD;AAEA,IAAM,OAAO;CACT,OAAO,MAAM,MAAM,GAAG;CACtB,cAAc,MAAM,OAAO,GAAG;CAC9B,QAAQ,MAAM,IAAI,GAAG;AACzB;AAEA,SAAS,cAAc,QAA8B;CACjD,MAAM,OAAO,OAAO,QAAQ,cAAc,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO,GAAG;CACzF,MAAM,OAAO,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;CACvC,IAAI,OAAO,cAAc,UAAU,KAAK,KAAK,MAAM,OAAO,OAAO,SAAS,CAAC;CAC3E,IAAI,OAAO,SAAS,KAAK,KAAK,MAAM,KAAK,WAAW,OAAO,SAAS,CAAC;CACrE,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC;CAIrD,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,OAAO,sBAAsB,OAAO,UAAU,CAAC;CAEpF,QAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,GAAG;CAClE,IAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GACxC,QAAQ,IAAI,SAAS,MAAM,KAAK,SAAS,EAAE,GAAG,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC,GAAG;CAGxF,IAAI,iBAAiB;CACrB,KAAK,MAAM,WAAW,OAAO,UACzB,IAAI,QAAQ,KACR,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,GAAG;MAChE,IAAI,QAAQ,UAAU,KAIzB,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,SAAS,IAAI,EAAE,GAAG,MAAM,KAAK,gBAAgB,QAAQ,KAAK,EAAE,GAAG;MACxH,IAAI,OAAO,UAAU,SAMxB,kBAAkB;MACf;EACH,MAAM,OAAO,QAAQ,WAAW,MAAM,KAAK,OAAO,QAAQ,SAAS,MAAM,IAAI;EAC7E,QAAQ,IAAI,SAAS,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,MAAM,KAAK,SAAS,GAAG;CACtG;CAEJ,IAAI,iBAAiB,GACjB,QAAQ,IAAI,MAAM,KAAK,SAAS,eAAe,oBAAoB,mBAAmB,IAAI,KAAK,IAAI,SAAS,CAAC;CAGjH,IAAI,OAAO,QAAQ;EACf,MAAM,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,OAAO,UAAU,iBAAiB,MAAM,SAAS,MAAM;EAC9G,QAAQ,IAAI,SAAS,OAAO,KAAK,OAAO,QAAQ,GAAG;CACvD;AACJ;;;;;;;;;;;;;;;;;AA4BA,eAAsB,eAAe,aAAqB,SAA0D;CAChH,MAAM,EAAE,UAAU,QAAQ,kBAAkB,gCAAgC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;CACpG,IAAI,QAAQ,aAAa,cAAc,OAAO;EAAE;EAAQ;CAAc;CAEtE,IAAI,SAAS,SAAS,WAAW;EAC7B,MAAM,SAAS,MAAM,kBAAkB,WAAW;EAClD,OAAO;GAAE,iBAAiB,EAAE,KAAK,SAAS,WAAW,OAAO,IAAI,IAAI,KAAK;GAAG;GAAQ;EAAc;CACtG;CAEA,IAAI,SAAS,SAAS,YAAY,SAAS,KAAK;EAC5C,MAAM,SAAS,iBAAiB,SAAS,GAAG;EAC5C,MAAM,YAAY,SAAS,MAAM,SAAS,OAAO,MAAM,OAAO,IAAI,IAAI;EACtE,MAAM,QAAQ,SAAS,WAAW,OAAO,KAAK,KAAK,OAAO,SAAS,2BAA2B;EAC9F,OAAO;GACH,gBAAgB;IACZ,KAAK,SAAS;IACd,QAAQ,QAAQ,2CAA2C,eAAe,SAAS,GAAG,KAC/E,YAAY,KAAK;GAC5B;GACA;GACA;EACJ;CACJ;CAEA,OAAO;EAAE;EAAQ;CAAc;AACnC;AAEA,eAAsB,cAAc,SAAkC;CAClE,IAAI,UAAU,OAAO,GAAG,OAAO,MAAM;CAErC,MAAM,EAAE,UAAU,iBAAiB;EAC/B,MAAM,EAAE,UAAU,QAAQ;EAC1B;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,cAAc,mBAAmB;CAOvC,MAAM,SAAS,QAAQ,MAAM,SAAS;CAEtC,IAAI;CACJ,IAAI;EAEA,MAAM,QAAQ,eADC,aAAa,WACC,CAAA,CAAO,QAAQ;EAC5C,IAAI,CAAC,OAAO;GACR,IAAI,QACA,WACI,sEACA,kBACA,8DACJ;GAEJ,QAAQ,MAAM,MAAM,IAAI,oEAAoE,CAAC;GAC7F,QAAQ,WAAW;GACnB;EACJ;EACA,UAAU;CACd,SAAS,KAAK;EACV,IAAI,eAAe,eAAe;GAC9B,IAAI,QACA,WAAW,IAAI,SAAS,oBAAoB,yCACxC,IAAI,OAAO,KAAI,WAAU;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,EAAE,CAAC;GAE/E,QAAQ,MAAM,MAAM,IAAI,IAAI,OAAO,CAAC;GACpC,KAAK,MAAM,SAAS,IAAI,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,GAAG,MAAM,SAAS;GAC5F,QAAQ,WAAW;GACnB;EACJ;EACA,MAAM;CACV;CAEA,MAAM,EAAE,MAAM,aAAa,KAAK,eAAe;CAC/C,MAAM,QAAQ,oBAAoB,YAAY,WAAW;CAEzD,MAAM,EAAE,OAAO,WAAW,MAAM,oBAAoB,iBAAiB,aAAa,UAAU,CAAC;CAC7F,IAAI,OAAO,SAAS,GAAG;EACnB,IAAI,QACA,WACI,GAAG,OAAO,OAAO,yCACjB,gCACA,8DACA,OAAO,KAAI,WAAU;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ,EAAE,CACtE;EAEJ,QAAQ,MAAM,MAAM,IAAI,OAAO,OAAO,OAAO,yCAAyC,CAAC;EACvF,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,SAAS;EACzF,QAAQ,MAAM,EAAE;EAChB,QAAQ,WAAW;EACnB;CACJ;CAKA,MAAM,MAAM,YAAY,WAAW;CAEnC,MAAM,aAAa,IAAI,aAAa;CACpC,MAAM,EAAE,iBAAiB,gBAAgB,QAAQ,kBAAkB,MAAM,eAAe,aAAa,GAAG;CAExG,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,EAAE,WAAW,YAAY,cAAc,OAAO,KAAK;EACrD,aAAa,OAAO;EACpB,oBAAoB,OAAO;EAG3B;EACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC7C,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;CAC/C,CAAC;CAED,IAAI,QAAQ;EACR,QAAQ,IAAI,KAAK,UAAU;GACvB,SAAS;GACT,SAAS,WAAW;GACpB,GAAI,SAAS,EAAE,QAAQ;IAAE,MAAM,OAAO;IAAM,UAAU,OAAO;GAAS,EAAE,IAAI,CAAC;GAC7E;GACA;EACJ,GAAG,MAAM,CAAC,CAAC;EACX;CACJ;CAEA,MAAM,YAAY,WAAW,YAAY,YACnC,uCACA;CAEN,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,IAAI,MAAM,KAAK,WAAW,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,GAAG;CAK3H,MAAM,gBAAgB,KAAK,KAAK,MAAM,QAAQ,cAAc;CAC5D,MAAM,mBAAmB,GAAG,WAAW,KAAK,KAAK,aAAa,aAAa,CAAC;CAC5E,QAAQ,IAAI,KAAK,MAAM,KAAK,aAAa,EAAE,IAAI,MAAM,KAAK,aAAa,IACnE,mBAAmB,KAAK,MAAM,KAAK,4CAA4C,GAAG;CACtF,QAAQ,IAAI,KAAK,MAAM,KAAK,eAAe,EAAE,IAAI,MAAM,KAAK,MAAM,GAAG;CAGrE,IAAI,QACA,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,MACnG,MAAM,KAAK,MAAM,MAAM,KAAK,+BAA+B,EAAE,cAAc,OAAO,UAAU,qBAAqB,CAAC;MACrH,IAAI,eACP,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,uBAAuB,cAAc,kEAAkE,GAAG;CAG/J,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,UAAU,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC;CACrD,KAAK,MAAM,QAAQ,OAAO;EACtB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,EAAE,GAAG;EACnD,KAAK,MAAM,UAAU,UAAU,QAAO,MAAK,EAAE,SAAS,IAAI,GAAG,cAAc,MAAM;CACrF;CAEA,IAAI,SAAS;EACT,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,GAAG;CAC3D;CAKA,MAAM,YAAY,sBAAsB,WAAW;CAEnD,IAAI,cADa,uBAAuB,KACtB,KAAY,EAAE,cAAc,QAAQ,MAAM,UAAU,WAAW,IAAI;EACjF,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,wBAAwB,MAAM,cAAc,OAAO,YAAY,QAAQ,KAAK,MAAM,KAAK,0BAA0B,GAAG;EAC1J,QAAQ,IAAI,MAAM,KAAK,2EAA2E,CAAC;CACvG;CAEA,QAAQ,IAAI,EAAE;AAClB"}
+{"version":3,"file":"status-BJ26yZOo.js","names":[],"sources":["../src/resources/status.ts","../src/commands/status.ts"],"sourcesContent":["/**\n * What a project declared, what the environment binds it to, and whether the\n * two meet.\n *\n * ## Why this exists\n *\n * Every piece of this was already knowable and none of it was visible in one\n * place. `rebase resources` lists what you declared. The environment holds the\n * variables. The resolvers decide whether a source is usable. So the question a\n * developer actually has — *\"why does uploading to `media` answer 501\"* — could\n * only be answered by knowing the suffix rule, deriving the variable name by\n * hand, and checking it against a `.env` they had to find first.\n *\n * The answer is mechanical, so it should be printed rather than taught.\n *\n * ## Why it calls the resolvers instead of re-deciding\n *\n * The verdict comes from `resolveDataSources` and `resolveStorageBackend` — the\n * same functions that run at boot. A status view that decided for itself what\n * \"configured\" means would be a second implementation of the rule, and the\n * first time it disagreed it would be reassuring a developer about a deployment\n * that is about to refuse to start.\n *\n * The variable *names* come from each kind's `envBases`, and the verdicts from\n * the resolver `@rebasepro/server` registers per kind — one object per kind,\n * held to `envBases` by `resource-env-bases.test.ts`. A kind this view has\n * never heard of is judged by whatever resolver its package registered.\n */\nimport { withImplicitDefaults } from \"./derive\";\nimport {\n    DEFAULT_RESOURCE_KEY,\n    envBasesForResource,\n    resourceEnvSuffix,\n    resourceToDataSource,\n    type ResourceDeclaration,\n    type ResourceGraph\n} from \"@rebasepro/types\";\n\n/** One environment variable a resource reads, and whether it is there. */\nexport interface ResourceBinding {\n    /** The variable this resource reads, suffix included. */\n    name: string;\n    set: boolean;\n    /**\n     * The account-scoped name consulted when `name` is unset.\n     *\n     * Only provider-level bindings have one, and only when the resource named\n     * an `account`. Shown because a developer looking at an unset\n     * `S3_ACCESS_KEY_ID__MEDIA` needs to know it is not the whole story.\n     */\n    fallback?: { name: string; set: boolean };\n}\n\n/** Whether a declared resource can actually be reached. */\nexport type ResourceState =\n    /** Bound and usable. */\n    | \"ready\"\n    /** Nothing set for it. Legal for a bucket, fatal for a database. */\n    | \"unconfigured\"\n    /** Set, and set wrongly. The deployment refuses to start. */\n    | \"broken\";\n\nexport interface ResourceStatus {\n    kind: string;\n    key: string;\n    engine: string;\n    transport: string;\n    /** Present when this resource shares another's credentials. */\n    account?: string;\n    /** True for a resource nobody declared, which exists anyway. */\n    implicit: boolean;\n    bindings: ResourceBinding[];\n    state: ResourceState;\n    /** What this means, in the terms the developer will meet it in. */\n    detail: string;\n    /** Set when a local directory stands in for this engine, in development. */\n    standsIn?: string;\n    /** What in the project reaches this resource, from the graph. */\n    usedBy?: readonly string[];\n}\n\nexport type EnvBag = Record<string, string | undefined>;\n\n/** Set, and not set to the empty string — which the resolvers treat as absent. */\nfunction isSet(env: EnvBag, name: string): boolean {\n    const value = env[name];\n    return typeof value === \"string\" && value !== \"\";\n}\n\n/**\n * The bindings one declaration reads, in the order a reader should scan them.\n *\n * A `direct`-transport resource gets none: the browser reaches it with a\n * provider SDK and the backend binds nothing for it, so listing variables would\n * invite someone to set variables that are never read.\n */\nexport function bindingsFor(\n    declaration: ResourceDeclaration,\n    env: EnvBag,\n    accountScopedBases: readonly string[]\n): ResourceBinding[] {\n    if (declaration.transport !== \"server\") return [];\n\n    const suffix = resourceEnvSuffix(declaration.key);\n    const account = typeof declaration.options.account === \"string\"\n        ? resourceEnvSuffix(declaration.options.account)\n        : undefined;\n\n    return envBasesForResource(declaration).map((base) => {\n        const name = `${base}${suffix}`;\n        const binding: ResourceBinding = { name, set: isSet(env, name) };\n\n        // Only the provider-level bindings fall back, and only for a resource\n        // that named an account. The bucket name never does — it is what\n        // distinguishes one source from another.\n        if (account !== undefined && !binding.set && accountScopedBases.includes(base)) {\n            binding.fallback = { name: `${base}${account}`, set: isSet(env, `${base}${account}`) };\n        }\n        return binding;\n    });\n}\n\n/**\n * What the managed development database covers, when a project is on it.\n *\n * `rebase init` leaves `DATABASE_URL` commented out on purpose and the managed\n * PGlite fills the vacuum — the documented first-run state. Judging that state\n * by the environment alone produced `○ (default) postgres · DATABASE_URL not\n * set` and the remedy \"set DATABASE_URL\", at the same moment `rebase db url`\n * was printing a working connection string for the same project and\n * `rebase dev` was serving from it. The status view was reading the one place\n * the answer deliberately is not.\n *\n * Resolved by the caller, because deciding it needs the project's `.env`, its\n * branch pointer and its compose file, and this module stays free of all three.\n */\nexport interface ManagedDatabaseStatus {\n    /**\n     * The daemon's connection string, or null when it is not running.\n     *\n     * Null is not an error: the managed database exists per project and starts\n     * on demand. It only means there is nothing to run the whole-set check\n     * against, and the row says so rather than implying a misconfiguration.\n     */\n    url: string | null;\n}\n\n/**\n * The compose `db` service, when a project is on Postgres in Docker.\n *\n * `rebase dev --docker` is remembered, and every command follows it with the\n * scaffold's `DATABASE_URL` still commented out — so, judged by `.env` alone,\n * this view said the default database had no connection string while `rebase\n * dev --docker` served the project from it. Unlike the managed database it\n * stands in for the default only: `dev --docker` hands the backend\n * `DATABASE_URL` and nothing else, so a second declared database still needs\n * its own variable.\n */\nexport interface DockerDatabaseStatus {\n    /** The compose service's connection string, which the runtime is given as `DATABASE_URL`. */\n    url: string;\n    /** What the default database's row says it is. */\n    detail: string;\n}\n\n/**\n * The resolver-side of status, as `@rebasepro/server` registers it per kind.\n *\n * Passed in rather than imported so this module stays testable without a\n * server, and so a kind registered by a plugin is judged by the resolver the\n * plugin brought with it rather than by a switch here.\n */\nexport interface StatusResolvers {\n    /** `resourceResolver(kind)` from `@rebasepro/server`. */\n    resolverFor: (kind: string) => {\n        accountScoped?: readonly string[];\n        resolve: (\n            declaration: ResourceDeclaration,\n            env: EnvBag,\n            context: { production: boolean; defaultBasePath: string }\n        ) => { state: \"ready\" | \"unbound\" | \"blocked\" | \"code\"; detail?: string; standsIn?: string };\n    } | undefined;\n    /** `resolveDataSources` from `@rebasepro/server`, for the whole-set check. */\n    resolveDataSources: (env: EnvBag, definitions: unknown) => unknown;\n    /** Whether the process being judged is production. Status judges for development by default. */\n    production?: boolean;\n    /**\n     * Set when this project runs on the managed development database.\n     *\n     * Absent for a project that named its own connection string, and absent in\n     * production — where an unset `DATABASE_URL` is the failure it has always\n     * been.\n     */\n    managedDatabase?: ManagedDatabaseStatus;\n    /** Set when this project runs on Postgres in Docker. Absent in production, like the managed one. */\n    dockerDatabase?: DockerDatabaseStatus;\n}\n\n/**\n * The environment plus the managed database's URL, for the whole-set check.\n *\n * A copy: the bindings a reader sees are computed against the real `.env`, so\n * nothing here can make the view claim a variable is set that is not. This is\n * only what `resolveDataSources` is handed, and it is handed it so the check\n * judges the environment the runtime would actually get rather than throwing\n * \"Data source \"(default)\" has no connection string\" about a database that is\n * running and reachable.\n */\nfunction withManagedUrls(env: EnvBag, graph: ResourceGraph, url: string): EnvBag {\n    const filled: EnvBag = { ...env };\n    const keys = [\n        DEFAULT_RESOURCE_KEY,\n        ...graph.resources.filter(r => r.kind === \"database\").map(r => r.key)\n    ];\n    for (const key of keys) {\n        const name = `DATABASE_URL${resourceEnvSuffix(key)}`;\n        if (!isSet(filled, name)) filled[name] = url;\n    }\n\n    return filled;\n}\n\n/**\n * The environment with the default database's URL filled in, when `.env` leaves it out.\n *\n * What a database's resolver is judged against. The resolver checks a source\n * alongside the default one, so a second database bound by its own\n * `DATABASE_URL__ANALYTICS` was marked ✗ with `Data source \"(default)\" has no\n * connection string` — on a project whose default the managed database or the\n * compose service provides, and whose boot worked. Judged against the\n * environment the runtime actually gets, it is judged on its own string.\n */\nfunction withDefaultUrl(env: EnvBag, url: string | null | undefined): EnvBag {\n    if (!url || isSet(env, \"DATABASE_URL\")) return env;\n\n    return { ...env, DATABASE_URL: url };\n}\n\n/**\n * Resolve every declared resource against an environment.\n *\n * Each kind's verdict comes from the resolver `@rebasepro/server` registered\n * for it — the same one boot calls — so this view cannot say \"ready\" about a\n * binding boot would refuse. A kind with no resolver is reported as such\n * rather than skipped: a resource nobody shows is one nobody remembers to\n * configure, and a kind this runtime cannot bind is exactly what boot will\n * refuse by name.\n *\n * `resolveDataSources` is then run once over the whole set, so anything it\n * would refuse across sources (a driver package it cannot resolve for a custom\n * engine) is reported rather than missed by a view that only looked per row.\n */\nexport function computeStatus(\n    graph: ResourceGraph,\n    env: EnvBag,\n    resolvers: StatusResolvers\n): { resources: ResourceStatus[]; blocked?: string } {\n    const resources: ResourceStatus[] = [];\n    const production = resolvers.production ?? false;\n    const managed = resolvers.managedDatabase;\n    const docker = resolvers.dockerDatabase;\n    /** The default database's URL as the runtime gets it, when `.env` does not name one. */\n    const devDefaultUrl = managed?.url ?? docker?.url ?? null;\n    /** Database rows the managed database answered for, so `blocked` can skip them. */\n    let managedCovered = 0;\n\n    for (const { declaration, implicit } of withImplicitDefaults(graph)) {\n        const resolver = resolvers.resolverFor(declaration.kind);\n        const bindings = bindingsFor(declaration, env, resolver?.accountScoped ?? []);\n        const base: Omit<ResourceStatus, \"state\" | \"detail\"> = {\n            kind: declaration.kind,\n            key: declaration.key,\n            engine: declaration.engine,\n            transport: declaration.transport,\n            ...(typeof declaration.options.account === \"string\"\n                ? { account: declaration.options.account }\n                : {}),\n            implicit,\n            bindings,\n            ...(declaration.usedBy && declaration.usedBy.length > 0 ? { usedBy: declaration.usedBy } : {})\n        };\n\n        if (!resolver) {\n            resources.push({\n                ...base,\n                state: \"broken\",\n                detail: `this runtime has no resolver for a \"${declaration.kind}\" — boot refuses it by name. ` +\n                    \"Upgrade @rebasepro/server, or remove the declaration.\"\n            });\n            continue;\n        }\n\n        // Answered before the resolver, because the resolver reads the\n        // environment and the whole point of the managed database is that the\n        // environment is deliberately empty. Only for a database nobody bound:\n        // a developer who set `DATABASE_URL__ANALYTICS` to a warehouse of their\n        // own has said which database that is, and the managed one fills a\n        // vacuum, never a choice.\n        if (managed && declaration.kind === \"database\" && bindings.every(b => !b.set && !b.fallback?.set)) {\n            managedCovered += 1;\n            resources.push({\n                ...base,\n                state: \"ready\",\n                detail: managed.url\n                    ? \"the managed development database (PGlite), this project only\"\n                    : \"the managed development database (PGlite), this project only — \"\n                        + \"not running; start it with `rebase dev`\"\n            });\n            continue;\n        }\n\n        // The default database on Docker: the compose service, unless `.env`\n        // names one itself.\n        if (docker && declaration.kind === \"database\" && declaration.key === DEFAULT_RESOURCE_KEY\n            && bindings.every(b => !b.set && !b.fallback?.set)) {\n            resources.push({ ...base, state: \"ready\", detail: docker.detail });\n            continue;\n        }\n\n        const judged = declaration.kind === \"database\" ? withDefaultUrl(env, devDefaultUrl) : env;\n        const verdict = resolver.resolve(declaration, judged, { production, defaultBasePath: \"uploads\" });\n        switch (verdict.state) {\n            case \"ready\":\n                resources.push({\n                    ...base,\n                    state: \"ready\",\n                    ...(verdict.standsIn ? { standsIn: verdict.standsIn } : {}),\n                    detail: verdict.detail ?? \"\"\n                });\n                break;\n            case \"code\":\n                resources.push({ ...base, state: \"ready\", detail: verdict.detail ?? \"needs no environment configuration\" });\n                break;\n            case \"unbound\":\n                resources.push({ ...base, state: \"unconfigured\", detail: verdict.detail ?? \"declared, not configured\" });\n                break;\n            case \"blocked\":\n                resources.push({\n                    ...base,\n                    // A database the environment names nothing for is the\n                    // ordinary first-run state, and reads as unconfigured; a\n                    // binding that is set and set wrongly is broken.\n                    state: implicit || bindings.every(b => !b.set && !b.fallback?.set) ? \"unconfigured\" : \"broken\",\n                    detail: verdict.detail ?? \"boot refuses this binding\"\n                });\n                break;\n        }\n    }\n\n    // Only asked when every row already looks fine. Its failures overlap with\n    // the per-resource ones, and a banner repeating a line printed two rows\n    // above teaches nothing — what it is here for is the failure no row models,\n    // such as a custom engine whose driver package cannot be resolved.\n    let blocked: string | undefined;\n    // Not run when the managed database answered for a row and is not running:\n    // there is no connection string to check the set against, and inventing one\n    // to keep the check formally \"run\" is how a green tick gets printed for\n    // work nobody did. The row says the daemon is down; that is the finding.\n    const managedSetUnknown = managedCovered > 0 && !managed?.url;\n    if (resources.every(r => r.state === \"ready\") && !managedSetUnknown) {\n        try {\n            resolvers.resolveDataSources(\n                // The managed URL for the rows it answered for, so the whole-set\n                // check judges the same environment the runtime would get.\n                managed?.url ? withManagedUrls(env, graph, managed.url) : withDefaultUrl(env, docker?.url),\n                graph.resources.filter(r => r.kind === \"database\").map(resourceToDataSource)\n            );\n        } catch (err) {\n            blocked = err instanceof Error ? err.message : String(err);\n        }\n    }\n\n    return { resources, ...(blocked !== undefined ? { blocked } : {}) };\n}\n","/**\n * `rebase status` — what this project is, and whether it can reach its things.\n *\n * The model a developer has to hold is small and was nowhere visible:\n *\n *   rebase.json           where the code is, and who runs the server\n *   config/resources.ts   what the project needs\n *   the environment       how to reach each of them\n *\n * Everything else — `rebase.resources.json`, the bundle manifest — is a\n * generated copy of the middle one, for readers that cannot run the code. A\n * developer never writes them and should not have to think about them.\n *\n * This command prints the three together, resolved. It exists because the\n * question people actually arrive with — \"why does uploading to `media` answer\n * 501\" — was answerable only by knowing the `<BASE>__<KEY>` suffix rule,\n * deriving the variable name by hand, and checking it against a `.env` they had\n * to find first. Every step of that is mechanical, so it is printed instead.\n */\nimport chalk from \"chalk\";\nimport fs from \"fs\";\nimport path from \"path\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { failAsJson, readEnvFile, requireProjectRoot } from \"../utils/project\";\nimport { findBackendApp, loadManifest, ManifestError, resolveBackendPaths } from \"../manifest\";\nimport { deriveOptionsFor, deriveResourceGraph, RESOURCE_GRAPH_FILENAME, readResourceGraphFile, serializeResourceGraph } from \"../resources/derive\";\nimport { computeStatus, type DockerDatabaseStatus, type ManagedDatabaseStatus, type ResourceStatus } from \"../resources/status\";\nimport { findRunningDaemon, managedUrl } from \"../dev-db/daemon\";\nimport { type ResolvedBranch, resolveProjectDatabaseAndBranch } from \"../dev-db/prepare\";\nimport { describeTarget } from \"../dev-db/pull\";\nimport { parseLoopbackDsn, probeTcp } from \"../utils/dev-preflight\";\nimport type { RebaseBackendAppConfig } from \"@rebasepro/types\";\n\nfunction usage(): void {\n    console.log(`\n${chalk.bold(\"rebase status\")} — what this project declares, and whether it is configured\n\n${chalk.bold(\"Usage\")}\n  rebase status                Show every resource and the variables it reads\n  rebase status --json         The same, as JSON\n\n${chalk.bold(\"Reads\")}\n  rebase.json                  which apps exist, and who owns the server process\n  <config>/resources.ts        the databases, buckets, topics and queues declared\n  backend/crons, backend/functions   the crons and functions, by filename\n  .env                         whether each one's variables are set\n`);\n}\n\nconst MARK = {\n    ready: chalk.green(\"✓\"),\n    unconfigured: chalk.yellow(\"○\"),\n    broken: chalk.red(\"✗\")\n} as const;\n\nfunction printResource(status: ResourceStatus): void {\n    const name = status.key === \"(default)\" ? chalk.bold(\"(default)\") : chalk.bold(status.key);\n    const tags = [chalk.gray(status.engine)];\n    if (status.transport !== \"server\") tags.push(chalk.yellow(status.transport));\n    if (status.account) tags.push(chalk.gray(`account:${status.account}`));\n    if (status.implicit) tags.push(chalk.gray(\"implicit\"));\n    // A stand-in is not a binding. It is shown in yellow beside a green tick:\n    // uploads work here, and the same declaration answers 501 in production\n    // until the variable is set.\n    if (status.standsIn) tags.push(chalk.yellow(`local stand-in for ${status.standsIn}`));\n\n    console.log(`  ${MARK[status.state]} ${name}  ${tags.join(\" · \")}`);\n    if (status.usedBy && status.usedBy.length > 0) {\n        console.log(`      ${chalk.gray(\"used by\")} ${chalk.gray(status.usedBy.join(\", \"))}`);\n    }\n\n    let hiddenOptional = 0;\n    for (const binding of status.bindings) {\n        if (binding.set) {\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.name)}`);\n        } else if (binding.fallback?.set) {\n            // Not a gap: the account form is the variable this bucket is\n            // actually reading, and showing only the unset per-key name would\n            // send someone to set the one they were deliberately avoiding.\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.fallback.name)} ${chalk.gray(`(shared, for ${binding.name})`)}`);\n        } else if (status.state === \"ready\") {\n            // It resolved without this one, so this one is optional — which is\n            // the resolver's answer, not a second table of required names kept\n            // here. Listing seven unset optionals under a working database is\n            // how a status view teaches people to skim past the line that\n            // matters.\n            hiddenOptional += 1;\n        } else {\n            const also = binding.fallback ? chalk.gray(` or ${binding.fallback.name}`) : \"\";\n            console.log(`      ${chalk.gray(\"·\")} ${chalk.gray(binding.name)}${also} ${chalk.gray(\"not set\")}`);\n        }\n    }\n    if (hiddenOptional > 0) {\n        console.log(chalk.gray(`      ${hiddenOptional} optional variable${hiddenOptional === 1 ? \"\" : \"s\"} not set`));\n    }\n\n    if (status.detail) {\n        const colour = status.state === \"broken\" ? chalk.red : status.state === \"unconfigured\" ? chalk.yellow : chalk.gray;\n        console.log(`      ${colour(`└ ${status.detail}`)}`);\n    }\n}\n\n/** Which database `rebase status` reports the project on, and what it hands the status view about it. */\nexport interface StatusDatabase {\n    managedDatabase?: ManagedDatabaseStatus;\n    dockerDatabase?: DockerDatabaseStatus;\n    /** The branch this checkout is on, when the database is one. */\n    branch: ResolvedBranch | null;\n    /** A switched-to branch the managed database cannot serve. */\n    ignoredBranch: string | null;\n}\n\n/**\n * Which database this project is on, decided by the same ordered rule\n * `rebase dev` and `rebase db url` use — and read from the project's `.env`,\n * not from this shell: `rebase status` asks what *this project* is on.\n *\n * Nothing is started. `status` is a question, and a question that boots a\n * 180 MB Postgres to answer itself is a different command. So a managed\n * database that is not running is reported as exactly that, rather than as a\n * project with no database; and a compose database likewise, after a probe of\n * its port.\n *\n * `envFile` is the parsed `.env`; production stands nothing in, because there\n * an unset `DATABASE_URL` is the failure it has always been.\n *\n * Exported for its tests.\n */\nexport async function statusDatabase(projectRoot: string, envFile: Record<string, string>): Promise<StatusDatabase> {\n    const { database, branch, ignoredBranch } = resolveProjectDatabaseAndBranch(projectRoot, { env: {} });\n    if (envFile.NODE_ENV === \"production\") return { branch, ignoredBranch };\n\n    if (database.kind === \"managed\") {\n        const daemon = await findRunningDaemon(projectRoot);\n        return { managedDatabase: { url: daemon ? managedUrl(daemon.port) : null }, branch, ignoredBranch };\n    }\n\n    if (database.kind === \"docker\" && database.url) {\n        const target = parseLoopbackDsn(database.url);\n        const listening = target ? await probeTcp(target.host, target.port) : true;\n        const which = branch ? `branch \"${branch.name}\" (${branch.database}) of Postgres in Docker` : \"Postgres in Docker\";\n        return {\n            dockerDatabase: {\n                url: database.url,\n                detail: which + \", as the last `rebase dev --docker` did · \" + describeTarget(database.url)\n                    + (listening ? \"\" : \" — not running; `rebase dev --docker` starts it\")\n            },\n            branch,\n            ignoredBranch\n        };\n    }\n\n    return { branch, ignoredBranch };\n}\n\nexport async function statusCommand(rawArgs: string[]): Promise<void> {\n    if (wantsHelp(rawArgs)) return usage();\n\n    const { flags } = parseCommandArgs({\n        spec: { \"--json\": Boolean },\n        rawArgs,\n        commandWords: 1,\n        command: \"status\",\n        maxPositionals: 0\n    });\n\n    const projectRoot = requireProjectRoot();\n\n    // Every exit below has a `--json` arm, because `--json` means stdout holds\n    // one JSON object on *every* exit of the command. It used to mean that for\n    // the one failure `requireProjectRoot` owns and nothing else, so a caller\n    // parsing stdout got an envelope outside a project and an empty stream\n    // inside a broken one — the case it actually has to handle.\n    const asJson = Boolean(flags[\"--json\"]);\n\n    let backend: { name: string; app: RebaseBackendAppConfig };\n    try {\n        const loaded = loadManifest(projectRoot);\n        const found = findBackendApp(loaded.manifest);\n        if (!found) {\n            if (asJson) {\n                failAsJson(\n                    \"This project declares no backend app, so it declares no resources.\",\n                    \"no_backend_app\",\n                    \"Add a backend app to rebase.json, or run `rebase apps init`.\"\n                );\n            }\n            console.error(chalk.red(\"This project declares no backend app, so it declares no resources.\"));\n            process.exitCode = 1;\n            return;\n        }\n        backend = found;\n    } catch (err) {\n        if (err instanceof ManifestError) {\n            if (asJson) {\n                failAsJson(err.message, \"manifest_invalid\", \"Fix rebase.json, then run this again.\",\n                    err.issues.map(issue => ({ path: issue.path, message: issue.message })));\n            }\n            console.error(chalk.red(err.message));\n            for (const issue of err.issues) console.error(`  ${chalk.gray(issue.path)} ${issue.message}`);\n            process.exitCode = 1;\n            return;\n        }\n        throw err;\n    }\n\n    const { name: backendName, app: backendApp } = backend;\n    const paths = resolveBackendPaths(backendApp, projectRoot);\n\n    const { graph, issues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, backendApp));\n    if (issues.length > 0) {\n        if (asJson) {\n            failAsJson(\n                `${issues.length} problem(s) in the declared resources.`,\n                \"resource_declaration_invalid\",\n                \"Fix the declarations the issues name, then run this again.\",\n                issues.map(issue => ({ path: issue.path, message: issue.message }))\n            );\n        }\n        console.error(chalk.red(`\\n✗ ${issues.length} problem(s) in the declared resources:\\n`));\n        for (const issue of issues) console.error(`  ${chalk.bold(issue.path)}  ${issue.message}`);\n        console.error(\"\");\n        process.exitCode = 1;\n        return;\n    }\n\n    // The project's own `.env`, not this process's environment: `rebase status`\n    // is asking what a deployment of THIS repository would do, and the shell a\n    // developer happens to be standing in is not that.\n    const env = readEnvFile(projectRoot);\n\n    const production = env.NODE_ENV === \"production\";\n    const { managedDatabase, dockerDatabase, branch, ignoredBranch } = await statusDatabase(projectRoot, env);\n\n    const server = await import(\"@rebasepro/server\");\n    const { resources, blocked } = computeStatus(graph, env, {\n        resolverFor: server.resourceResolver as never,\n        resolveDataSources: server.resolveDataSources as never,\n        // Judged as production when the .env says so; a stand-in local\n        // directory for an unbound bucket is only ever offered to development.\n        production,\n        ...(managedDatabase ? { managedDatabase } : {}),\n        ...(dockerDatabase ? { dockerDatabase } : {})\n    });\n\n    if (asJson) {\n        console.log(JSON.stringify({\n            backend: backendName,\n            runtime: backendApp.runtime,\n            ...(branch ? { branch: { name: branch.name, database: branch.database } } : {}),\n            resources,\n            blocked\n        }, null, 2));\n        return;\n    }\n\n    const ownership = backendApp.runtime === \"managed\"\n        ? \"Rebase's runtime boots your bundle\"\n        : \"this project builds its own image and entrypoint\";\n\n    console.log(\"\");\n    console.log(`  ${chalk.bold(backendName)}  ${chalk.gray(\"·\")}  ${chalk.cyan(backendApp.runtime)}  ${chalk.gray(ownership)}`);\n    // Named whether or not it exists, and said plainly when it does not. A\n    // project with no `resources.ts` is legal — it has one default database and\n    // one default bucket — but \"declared in <a file you do not have>\" reads as\n    // a broken install rather than as the default it is.\n    const resourcesFile = path.join(paths.config, \"resources.ts\");\n    const declaresAnything = fs.existsSync(path.join(projectRoot, resourcesFile));\n    console.log(`  ${chalk.gray(\"declared in\")}  ${chalk.gray(resourcesFile)}${\n        declaresAnything ? \"\" : chalk.gray(\"  (none — the defaults below are implicit)\")}`);\n    console.log(`  ${chalk.gray(\"configured by\")}  ${chalk.gray(\".env\")}`);\n    // Every database command in this checkout uses the branch, so the view\n    // says so: a switch made yesterday is easy to forget.\n    if (branch) {\n        console.log(`  ${chalk.gray(\"on branch\")}  ${chalk.bold(branch.name)} ${chalk.gray(`(${branch.database})`)}`\n            + chalk.gray(` — ${chalk.cyan(\"rebase db branch switch --off\")} returns to ${branch.parent ?? \"the main database\"}`));\n    } else if (ignoredBranch) {\n        console.log(`  ${chalk.yellow(\"○\")} ${chalk.gray(`switched to branch \"${ignoredBranch}\", which the managed database cannot serve — it uses the main one`)}`);\n    }\n\n    const kinds = [...new Set(resources.map(r => r.kind))];\n    for (const kind of kinds) {\n        console.log(\"\");\n        console.log(`  ${chalk.bold.underline(`${kind}s`)}`);\n        for (const status of resources.filter(r => r.kind === kind)) printResource(status);\n    }\n\n    if (blocked) {\n        console.log(\"\");\n        console.log(`  ${chalk.red(\"✗\")} ${chalk.red(blocked)}`);\n    }\n\n    // Only worth a line when it is wrong. A generated file that matches its\n    // declarations is not news, and a status view that reports its own\n    // bookkeeping as an item trains people to skim past the items that matter.\n    //\n    // Nor is one that has not been written yet: `rebase build` writes it on\n    // every build and says \"commit it\" when it changes, so a project that has\n    // never been built — every fresh scaffold — has nothing wrong with it.\n    // `rebase resources --check` is the gate that refuses a missing one.\n    const committed = readResourceGraphFile(projectRoot);\n    if (committed !== null && committed !== serializeResourceGraph(graph)) {\n        console.log(\"\");\n        console.log(`  ${chalk.yellow(\"○\")} ${RESOURCE_GRAPH_FILENAME} is stale — ${chalk.blue(\"rebase resources --write\")}`);\n        console.log(chalk.gray(\"      a host reads it to decide what to provision before it runs anything\"));\n    }\n\n    console.log(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,SAAS,MAAM,KAAa,MAAuB;CAC/C,MAAM,QAAQ,IAAI;CAClB,OAAO,OAAO,UAAU,YAAY,UAAU;AAClD;;;;;;;;AASA,SAAgB,YACZ,aACA,KACA,oBACiB;CACjB,IAAI,YAAY,cAAc,UAAU,OAAO,CAAC;CAEhD,MAAM,SAAS,kBAAkB,YAAY,GAAG;CAChD,MAAM,UAAU,OAAO,YAAY,QAAQ,YAAY,WACjD,kBAAkB,YAAY,QAAQ,OAAO,IAC7C,KAAA;CAEN,OAAO,oBAAoB,WAAW,CAAC,CAAC,KAAK,SAAS;EAClD,MAAM,OAAO,GAAG,OAAO;EACvB,MAAM,UAA2B;GAAE;GAAM,KAAK,MAAM,KAAK,IAAI;EAAE;EAK/D,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,OAAO,mBAAmB,SAAS,IAAI,GACzE,QAAQ,WAAW;GAAE,MAAM,GAAG,OAAO;GAAW,KAAK,MAAM,KAAK,GAAG,OAAO,SAAS;EAAE;EAEzF,OAAO;CACX,CAAC;AACL;;;;;;;;;;;AAwFA,SAAS,gBAAgB,KAAa,OAAsB,KAAqB;CAC7E,MAAM,SAAiB,EAAE,GAAG,IAAI;CAChC,MAAM,OAAO,CACT,sBACA,GAAG,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,KAAI,MAAK,EAAE,GAAG,CACxE;CACA,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,OAAO,eAAe,kBAAkB,GAAG;EACjD,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO,QAAQ;CAC7C;CAEA,OAAO;AACX;;;;;;;;;;;AAYA,SAAS,eAAe,KAAa,KAAwC;CACzE,IAAI,CAAC,OAAO,MAAM,KAAK,cAAc,GAAG,OAAO;CAE/C,OAAO;EAAE,GAAG;EAAK,cAAc;CAAI;AACvC;;;;;;;;;;;;;;;AAgBA,SAAgB,cACZ,OACA,KACA,WACiD;CACjD,MAAM,YAA8B,CAAC;CACrC,MAAM,aAAa,UAAU,cAAc;CAC3C,MAAM,UAAU,UAAU;CAC1B,MAAM,SAAS,UAAU;;CAEzB,MAAM,gBAAgB,SAAS,OAAO,QAAQ,OAAO;;CAErD,IAAI,iBAAiB;CAErB,KAAK,MAAM,EAAE,aAAa,cAAc,qBAAqB,KAAK,GAAG;EACjE,MAAM,WAAW,UAAU,YAAY,YAAY,IAAI;EACvD,MAAM,WAAW,YAAY,aAAa,KAAK,UAAU,iBAAiB,CAAC,CAAC;EAC5E,MAAM,OAAiD;GACnD,MAAM,YAAY;GAClB,KAAK,YAAY;GACjB,QAAQ,YAAY;GACpB,WAAW,YAAY;GACvB,GAAI,OAAO,YAAY,QAAQ,YAAY,WACrC,EAAE,SAAS,YAAY,QAAQ,QAAQ,IACvC,CAAC;GACP;GACA;GACA,GAAI,YAAY,UAAU,YAAY,OAAO,SAAS,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;EAChG;EAEA,IAAI,CAAC,UAAU;GACX,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,uCAAuC,YAAY,KAAK;GAEpE,CAAC;GACD;EACJ;EAQA,IAAI,WAAW,YAAY,SAAS,cAAc,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GAC/F,kBAAkB;GAClB,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,QAAQ,MACV,iEACA;GAEV,CAAC;GACD;EACJ;EAIA,IAAI,UAAU,YAAY,SAAS,cAAc,YAAY,QAAQ,wBAC9D,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GACpD,UAAU,KAAK;IAAE,GAAG;IAAM,OAAO;IAAS,QAAQ,OAAO;GAAO,CAAC;GACjE;EACJ;EAEA,MAAM,SAAS,YAAY,SAAS,aAAa,eAAe,KAAK,aAAa,IAAI;EACtF,MAAM,UAAU,SAAS,QAAQ,aAAa,QAAQ;GAAE;GAAY,iBAAiB;EAAU,CAAC;EAChG,QAAQ,QAAQ,OAAhB;GACI,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KACH,OAAO;KACP,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;KACzD,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAS,QAAQ,QAAQ,UAAU;IAAqC,CAAC;IAC1G;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAgB,QAAQ,QAAQ,UAAU;IAA2B,CAAC;IACvG;GACJ,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KAIH,OAAO,YAAY,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,iBAAiB;KACtF,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;EACR;CACJ;CAMA,IAAI;CAKJ,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,SAAS;CAC1D,IAAI,UAAU,OAAM,MAAK,EAAE,UAAU,OAAO,KAAK,CAAC,mBAC9C,IAAI;EACA,UAAU,mBAGN,SAAS,MAAM,gBAAgB,KAAK,OAAO,QAAQ,GAAG,IAAI,eAAe,KAAK,QAAQ,GAAG,GACzF,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAC/E;CACJ,SAAS,KAAK;EACV,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC7D;CAGJ,OAAO;EAAE;EAAW,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;CAAG;AACtE;;;;;;;;;;;;;;;;;;;;;;ACpVA,SAAS,QAAc;CACnB,QAAQ,IAAI;EACd,MAAM,KAAK,eAAe,EAAE;;EAE5B,MAAM,KAAK,OAAO,EAAE;;;;EAIpB,MAAM,KAAK,OAAO,EAAE;;;;;CAKrB;AACD;AAEA,IAAM,OAAO;CACT,OAAO,MAAM,MAAM,GAAG;CACtB,cAAc,MAAM,OAAO,GAAG;CAC9B,QAAQ,MAAM,IAAI,GAAG;AACzB;AAEA,SAAS,cAAc,QAA8B;CACjD,MAAM,OAAO,OAAO,QAAQ,cAAc,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO,GAAG;CACzF,MAAM,OAAO,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;CACvC,IAAI,OAAO,cAAc,UAAU,KAAK,KAAK,MAAM,OAAO,OAAO,SAAS,CAAC;CAC3E,IAAI,OAAO,SAAS,KAAK,KAAK,MAAM,KAAK,WAAW,OAAO,SAAS,CAAC;CACrE,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC;CAIrD,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,OAAO,sBAAsB,OAAO,UAAU,CAAC;CAEpF,QAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,GAAG;CAClE,IAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GACxC,QAAQ,IAAI,SAAS,MAAM,KAAK,SAAS,EAAE,GAAG,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC,GAAG;CAGxF,IAAI,iBAAiB;CACrB,KAAK,MAAM,WAAW,OAAO,UACzB,IAAI,QAAQ,KACR,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,GAAG;MAChE,IAAI,QAAQ,UAAU,KAIzB,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,SAAS,IAAI,EAAE,GAAG,MAAM,KAAK,gBAAgB,QAAQ,KAAK,EAAE,GAAG;MACxH,IAAI,OAAO,UAAU,SAMxB,kBAAkB;MACf;EACH,MAAM,OAAO,QAAQ,WAAW,MAAM,KAAK,OAAO,QAAQ,SAAS,MAAM,IAAI;EAC7E,QAAQ,IAAI,SAAS,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,MAAM,KAAK,SAAS,GAAG;CACtG;CAEJ,IAAI,iBAAiB,GACjB,QAAQ,IAAI,MAAM,KAAK,SAAS,eAAe,oBAAoB,mBAAmB,IAAI,KAAK,IAAI,SAAS,CAAC;CAGjH,IAAI,OAAO,QAAQ;EACf,MAAM,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,OAAO,UAAU,iBAAiB,MAAM,SAAS,MAAM;EAC9G,QAAQ,IAAI,SAAS,OAAO,KAAK,OAAO,QAAQ,GAAG;CACvD;AACJ;;;;;;;;;;;;;;;;;AA4BA,eAAsB,eAAe,aAAqB,SAA0D;CAChH,MAAM,EAAE,UAAU,QAAQ,kBAAkB,gCAAgC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;CACpG,IAAI,QAAQ,aAAa,cAAc,OAAO;EAAE;EAAQ;CAAc;CAEtE,IAAI,SAAS,SAAS,WAAW;EAC7B,MAAM,SAAS,MAAM,kBAAkB,WAAW;EAClD,OAAO;GAAE,iBAAiB,EAAE,KAAK,SAAS,WAAW,OAAO,IAAI,IAAI,KAAK;GAAG;GAAQ;EAAc;CACtG;CAEA,IAAI,SAAS,SAAS,YAAY,SAAS,KAAK;EAC5C,MAAM,SAAS,iBAAiB,SAAS,GAAG;EAC5C,MAAM,YAAY,SAAS,MAAM,SAAS,OAAO,MAAM,OAAO,IAAI,IAAI;EACtE,MAAM,QAAQ,SAAS,WAAW,OAAO,KAAK,KAAK,OAAO,SAAS,2BAA2B;EAC9F,OAAO;GACH,gBAAgB;IACZ,KAAK,SAAS;IACd,QAAQ,QAAQ,+CAA+C,eAAe,SAAS,GAAG,KACnF,YAAY,KAAK;GAC5B;GACA;GACA;EACJ;CACJ;CAEA,OAAO;EAAE;EAAQ;CAAc;AACnC;AAEA,eAAsB,cAAc,SAAkC;CAClE,IAAI,UAAU,OAAO,GAAG,OAAO,MAAM;CAErC,MAAM,EAAE,UAAU,iBAAiB;EAC/B,MAAM,EAAE,UAAU,QAAQ;EAC1B;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,cAAc,mBAAmB;CAOvC,MAAM,SAAS,QAAQ,MAAM,SAAS;CAEtC,IAAI;CACJ,IAAI;EAEA,MAAM,QAAQ,eADC,aAAa,WACC,CAAA,CAAO,QAAQ;EAC5C,IAAI,CAAC,OAAO;GACR,IAAI,QACA,WACI,sEACA,kBACA,8DACJ;GAEJ,QAAQ,MAAM,MAAM,IAAI,oEAAoE,CAAC;GAC7F,QAAQ,WAAW;GACnB;EACJ;EACA,UAAU;CACd,SAAS,KAAK;EACV,IAAI,eAAe,eAAe;GAC9B,IAAI,QACA,WAAW,IAAI,SAAS,oBAAoB,yCACxC,IAAI,OAAO,KAAI,WAAU;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,EAAE,CAAC;GAE/E,QAAQ,MAAM,MAAM,IAAI,IAAI,OAAO,CAAC;GACpC,KAAK,MAAM,SAAS,IAAI,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,GAAG,MAAM,SAAS;GAC5F,QAAQ,WAAW;GACnB;EACJ;EACA,MAAM;CACV;CAEA,MAAM,EAAE,MAAM,aAAa,KAAK,eAAe;CAC/C,MAAM,QAAQ,oBAAoB,YAAY,WAAW;CAEzD,MAAM,EAAE,OAAO,WAAW,MAAM,oBAAoB,iBAAiB,aAAa,UAAU,CAAC;CAC7F,IAAI,OAAO,SAAS,GAAG;EACnB,IAAI,QACA,WACI,GAAG,OAAO,OAAO,yCACjB,gCACA,8DACA,OAAO,KAAI,WAAU;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ,EAAE,CACtE;EAEJ,QAAQ,MAAM,MAAM,IAAI,OAAO,OAAO,OAAO,yCAAyC,CAAC;EACvF,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,SAAS;EACzF,QAAQ,MAAM,EAAE;EAChB,QAAQ,WAAW;EACnB;CACJ;CAKA,MAAM,MAAM,YAAY,WAAW;CAEnC,MAAM,aAAa,IAAI,aAAa;CACpC,MAAM,EAAE,iBAAiB,gBAAgB,QAAQ,kBAAkB,MAAM,eAAe,aAAa,GAAG;CAExG,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,EAAE,WAAW,YAAY,cAAc,OAAO,KAAK;EACrD,aAAa,OAAO;EACpB,oBAAoB,OAAO;EAG3B;EACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC7C,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;CAC/C,CAAC;CAED,IAAI,QAAQ;EACR,QAAQ,IAAI,KAAK,UAAU;GACvB,SAAS;GACT,SAAS,WAAW;GACpB,GAAI,SAAS,EAAE,QAAQ;IAAE,MAAM,OAAO;IAAM,UAAU,OAAO;GAAS,EAAE,IAAI,CAAC;GAC7E;GACA;EACJ,GAAG,MAAM,CAAC,CAAC;EACX;CACJ;CAEA,MAAM,YAAY,WAAW,YAAY,YACnC,uCACA;CAEN,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,IAAI,MAAM,KAAK,WAAW,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,GAAG;CAK3H,MAAM,gBAAgB,KAAK,KAAK,MAAM,QAAQ,cAAc;CAC5D,MAAM,mBAAmB,GAAG,WAAW,KAAK,KAAK,aAAa,aAAa,CAAC;CAC5E,QAAQ,IAAI,KAAK,MAAM,KAAK,aAAa,EAAE,IAAI,MAAM,KAAK,aAAa,IACnE,mBAAmB,KAAK,MAAM,KAAK,4CAA4C,GAAG;CACtF,QAAQ,IAAI,KAAK,MAAM,KAAK,eAAe,EAAE,IAAI,MAAM,KAAK,MAAM,GAAG;CAGrE,IAAI,QACA,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,MACnG,MAAM,KAAK,MAAM,MAAM,KAAK,+BAA+B,EAAE,cAAc,OAAO,UAAU,qBAAqB,CAAC;MACrH,IAAI,eACP,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,uBAAuB,cAAc,kEAAkE,GAAG;CAG/J,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,UAAU,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC;CACrD,KAAK,MAAM,QAAQ,OAAO;EACtB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,EAAE,GAAG;EACnD,KAAK,MAAM,UAAU,UAAU,QAAO,MAAK,EAAE,SAAS,IAAI,GAAG,cAAc,MAAM;CACrF;CAEA,IAAI,SAAS;EACT,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,GAAG;CAC3D;CAUA,MAAM,YAAY,sBAAsB,WAAW;CACnD,IAAI,cAAc,QAAQ,cAAc,uBAAuB,KAAK,GAAG;EACnE,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,wBAAwB,cAAc,MAAM,KAAK,0BAA0B,GAAG;EACpH,QAAQ,IAAI,MAAM,KAAK,2EAA2E,CAAC;CACvG;CAEA,QAAQ,IAAI,EAAE;AAClB"}

package/dist/{storage-CtB8polS.js → storage-DKPUBTWG.js}

@@ -1,7 +1,7 @@
 import { d as readEnvFile, p as requireProjectRoot } from "./project-Wp2zoyeN.js";
-import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-CcBphFdj.js";
+import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-BX0YD14a.js";
 import { t as cliUserAgent } from "./version-Buyyo1ut.js";
-import { describeFailure, requireBackendUrl } from "./api-keys-Bc4FJKYp.js";
+import { describeFailure, requireBackendUrl } from "./api-keys-Tm7zvAPe.js";
 import chalk from "chalk";
 import { RebaseApiError } from "@rebasepro/client";
 import readline from "node:readline/promises";
@@ -303,4 +303,4 @@ ${chalk.green.bold("Notes")}
 //#endregion
 export { STORAGE_SUBCOMMANDS, storageCommand };
 
-//# sourceMappingURL=storage-CtB8polS.js.map
+//# sourceMappingURL=storage-DKPUBTWG.js.map

package/dist/{storage-CtB8polS.js.map → storage-DKPUBTWG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"storage-CtB8polS.js","names":[],"sources":["../src/commands/storage.ts"],"sourcesContent":["/**\n * CLI command: rebase storage <action>\n *\n * Whole-store maintenance through the running backend's `/api/admin/storage`,\n * authenticated with the service key from `.env`.\n *\n * Subcommands:\n *   orphans — Stored files no row names; `--delete` deletes them\n *   move    — Copy a folder of files to another storage source, same keys\n */\nimport chalk from \"chalk\";\nimport readline from \"node:readline/promises\";\nimport { RebaseApiError } from \"@rebasepro/client\";\nimport { requireProjectRoot, readEnvFile } from \"../utils/project\";\nimport { parseCommandArgs, UsageError, wantsHelp } from \"../utils/args\";\nimport { unknownCommand } from \"../utils/unknown-command\";\nimport { cliUserAgent } from \"../utils/version\";\nimport { describeFailure, requireBackendUrl } from \"./api-keys\";\n\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const STORAGE_SUBCOMMANDS = [\"orphans\", \"move\"] as const;\n\n/** The flags `rebase storage orphans` takes. */\nexport const ORPHANS_FLAGS = {\n    \"--source\": String,\n    \"--older-than\": Number,\n    \"--delete\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\",\n    \"--json\": Boolean\n} as const;\n\n/** The flags `rebase storage move` takes. */\nexport const MOVE_FLAGS = {\n    \"--from\": String,\n    \"--to\": String,\n    \"--prefix\": String,\n    \"--delete-source\": Boolean,\n    \"--json\": Boolean\n} as const;\n\n/** One stored object, as the backend lists it. */\ninterface StoredObjectEntry {\n    key: string;\n    size?: number;\n    updated?: string;\n}\n\n/** What `GET /admin/storage/orphans` answers. */\nexport interface OrphanReport {\n    storageId: string;\n    objects: number;\n    orphans: StoredObjectEntry[];\n    recent: number;\n    scanned: string[];\n    unscanned: { collection: string; reason: string }[];\n}\n\ninterface MovedObject {\n    key: string;\n    outcome: \"copied\" | \"exists\" | \"failed\";\n    deleted?: boolean;\n    error?: string;\n}\n\ninterface Backend {\n    baseUrl: string;\n    request<T>(method: string, path: string, body?: unknown): Promise<T>;\n}\n\n/** The project's backend, holding the service key — the `admin` role, every scope. */\nfunction connect(): Backend {\n    const projectRoot = requireProjectRoot();\n    const env = readEnvFile(projectRoot);\n    const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;\n    if (!serviceKey) {\n        console.error(chalk.red(\"✗ REBASE_SERVICE_KEY not found in .env — required for storage maintenance.\"));\n        process.exit(1);\n    }\n    // Only an address this project recorded or the developer named: the\n    // request carries the service key. See `resolveBackendAddress`.\n    const baseUrl = requireBackendUrl(env, projectRoot).replace(/\\/+$/, \"\");\n    return {\n        baseUrl,\n        async request<T>(method: string, path: string, body?: unknown): Promise<T> {\n            let response: Response;\n            try {\n                response = await fetch(`${baseUrl}/api/admin/storage${path}`, {\n                    method,\n                    headers: {\n                        \"Authorization\": `Bearer ${serviceKey}`,\n                        \"Accept\": \"application/json\",\n                        \"User-Agent\": cliUserAgent(),\n                        ...(body === undefined ? {} : { \"Content-Type\": \"application/json\" })\n                    },\n                    ...(body === undefined ? {} : { body: JSON.stringify(body) })\n                });\n            } catch (error: unknown) {\n                throw new RebaseApiError(error instanceof Error ? error.message : String(error), { status: 0, code: \"NETWORK_ERROR\" });\n            }\n            const answer: unknown = await response.json().catch(() => undefined);\n            if (!response.ok) {\n                const error = answer && typeof answer === \"object\" && \"error\" in answer && answer.error && typeof answer.error === \"object\"\n                    ? answer.error as { message?: unknown; code?: unknown; details?: unknown }\n                    : undefined;\n                throw new RebaseApiError(\n                    typeof error?.message === \"string\" ? error.message : `The server answered ${response.status}.`,\n                    { status: response.status, code: typeof error?.code === \"string\" ? error.code : undefined, details: error?.details }\n                );\n            }\n            return (answer as { data: T }).data;\n        }\n    };\n}\n\nfunction fail(action: string, error: unknown, baseUrl: string): never {\n    for (const line of describeFailure(action, error, baseUrl)) {\n        console.error(line.startsWith(\"✗\") ? chalk.red(line) : chalk.gray(line));\n    }\n    if (error instanceof RebaseApiError && error.status === 404 && error.code !== \"UNKNOWN_STORAGE_SOURCE\") {\n        console.error(chalk.gray(\"  This backend has no storage maintenance routes: they arrived in 0.25, and need storage configured.\"));\n    }\n    process.exit(1);\n}\n\n/** Bytes, as a person reads them. */\nexport function formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    const units = [\"KB\", \"MB\", \"GB\", \"TB\"];\n    let value = bytes / 1024;\n    let unit = 0;\n    while (value >= 1024 && unit < units.length - 1) {\n        value /= 1024;\n        unit++;\n    }\n    return `${value.toFixed(value < 10 ? 1 : 0)} ${units[unit]}`;\n}\n\n/**\n * The lines that describe an orphan scan. Exported so its tests can read them\n * without a server.\n */\nexport function describeOrphanReport(report: OrphanReport, olderThanHours: number): string[] {\n    const lines: string[] = [];\n    const bytes = report.orphans.reduce((sum, orphan) => sum + (orphan.size ?? 0), 0);\n    lines.push(`  ${report.objects} file(s) in source \"${report.storageId}\", ${report.scanned.length} collection(s) read.`);\n    if (report.orphans.length === 0) {\n        lines.push(\"  No file older than \" + `${olderThanHours}h is unused.`);\n    } else {\n        lines.push(`  ${report.orphans.length} file(s) no row names, ${formatBytes(bytes)}:`);\n        for (const orphan of report.orphans) {\n            lines.push(`    ${orphan.key}${orphan.size !== undefined ? `  ${formatBytes(orphan.size)}` : \"\"}${orphan.updated ? `  ${orphan.updated}` : \"\"}`);\n        }\n    }\n    if (report.recent > 0) {\n        const one = report.recent === 1;\n        const more = report.orphans.length > 0 ? \"more \" : \"\";\n        lines.push(`  ${report.recent} ${more}unused ${one ? \"file is\" : \"files are\"} left out: ` +\n            `${one ? \"it is\" : \"they are\"} newer than ${olderThanHours}h, or ${one ? \"its\" : \"their\"} age is unknown, ` +\n            \"and an upload can be saved before the row that names it.\");\n    }\n    for (const entry of report.unscanned) {\n        lines.push(`  ⚠ ${entry.collection} could not be read (${entry.reason}): a file only it names is listed above.`);\n    }\n    return lines;\n}\n\nasync function confirm(question: string): Promise<boolean> {\n    const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        return /^y(es)?$/i.test((await prompt.question(question)).trim());\n    } finally {\n        prompt.close();\n    }\n}\n\nasync function orphans(rawArgs: string[]): Promise<void> {\n    const { flags } = parseCommandArgs({ spec: ORPHANS_FLAGS, rawArgs, commandWords: 2, command: \"storage orphans\", maxPositionals: 0 });\n    const olderThan = flags[\"--older-than\"] ?? 24;\n    if (!Number.isFinite(olderThan) || olderThan < 0) {\n        throw new UsageError(\"--older-than takes a number of hours, 0 or more.\");\n    }\n    const query = new URLSearchParams({ olderThanHours: String(olderThan) });\n    if (flags[\"--source\"]) query.set(\"storageId\", flags[\"--source\"]);\n    const backend = connect();\n\n    let report: OrphanReport;\n    try {\n        report = await backend.request<OrphanReport>(\"GET\", `/orphans?${query}`);\n    } catch (error: unknown) {\n        fail(\"Failed to scan storage\", error, backend.baseUrl);\n    }\n\n    if (!flags[\"--delete\"]) {\n        if (flags[\"--json\"]) {\n            console.log(JSON.stringify(report, null, 2));\n            return;\n        }\n        console.log(\"\");\n        for (const line of describeOrphanReport(report, olderThan)) console.log(line);\n        if (report.orphans.length > 0) {\n            console.log(\"\");\n            console.log(chalk.gray(\"  Nothing was deleted. Run again with --delete to delete them.\"));\n        }\n        console.log(\"\");\n        return;\n    }\n\n    if (!flags[\"--json\"]) {\n        console.log(\"\");\n        for (const line of describeOrphanReport(report, olderThan)) console.log(line);\n        console.log(\"\");\n    }\n    if (report.orphans.length === 0) return;\n    if (report.unscanned.length > 0) {\n        console.error(chalk.red(\"✗ Not deleting: some collections could not be read, so a file they name would look unused.\"));\n        process.exit(1);\n    }\n    if (!flags[\"--yes\"]) {\n        if (!process.stdin.isTTY) {\n            throw new UsageError(\"--delete deletes files for good; pass --yes to confirm when there is no terminal to ask.\");\n        }\n        if (!await confirm(`  Delete these ${report.orphans.length} file(s) for good? [y/N] `)) {\n            console.log(chalk.gray(\"  Nothing was deleted.\"));\n            return;\n        }\n    }\n\n    let result: { deleted: string[]; failed: { key: string; error: string }[] };\n    try {\n        // The server finds them again before it deletes: a file a row has\n        // named since the list was printed is not deleted.\n        result = await backend.request(\"DELETE\", `/orphans?${query}`);\n    } catch (error: unknown) {\n        fail(\"Failed to delete unused files\", error, backend.baseUrl);\n    }\n    if (flags[\"--json\"]) {\n        console.log(JSON.stringify(result, null, 2));\n    } else {\n        console.log(chalk.green(`  ✓ Deleted ${result.deleted.length} file(s).`));\n        for (const failure of result.failed) console.error(chalk.red(`  ✗ ${failure.key}: ${failure.error}`));\n        console.log(\"\");\n    }\n    if (result.failed.length > 0) process.exitCode = 1;\n}\n\nasync function move(rawArgs: string[]): Promise<void> {\n    const { flags } = parseCommandArgs({ spec: MOVE_FLAGS, rawArgs, commandWords: 2, command: \"storage move\", maxPositionals: 0 });\n    const from = flags[\"--from\"];\n    const to = flags[\"--to\"];\n    if (!from && !to) {\n        throw new UsageError(\"Name the sources: --from <source> --to <source>. The default source is \\\"(default)\\\", and either may be left out for it.\");\n    }\n    const backend = connect();\n    const counts = { copied: 0, exists: 0, failed: 0, deleted: 0 };\n    const failures: MovedObject[] = [];\n    let cursor: string | undefined;\n    do {\n        let page: { moved: MovedObject[]; cursor?: string };\n        try {\n            page = await backend.request(\"POST\", \"/move\", {\n                from,\n                to,\n                prefix: flags[\"--prefix\"],\n                cursor,\n                deleteSource: flags[\"--delete-source\"] === true\n            });\n        } catch (error: unknown) {\n            fail(\"Failed to move files\", error, backend.baseUrl);\n        }\n        for (const object of page.moved) {\n            counts[object.outcome]++;\n            if (object.deleted) counts.deleted++;\n            if (object.outcome === \"failed\") failures.push(object);\n        }\n        if (!flags[\"--json\"] && process.stdout.isTTY) {\n            process.stdout.write(`\\r  ${counts.copied} copied, ${counts.exists} already there, ${counts.failed} failed…`);\n        }\n        cursor = page.cursor;\n    } while (cursor);\n\n    if (flags[\"--json\"]) {\n        console.log(JSON.stringify({ ...counts, failures }, null, 2));\n    } else {\n        if (process.stdout.isTTY) process.stdout.write(\"\\n\");\n        console.log(chalk.green(`  ✓ ${counts.copied} copied, ${counts.exists} already there` +\n            `${flags[\"--delete-source\"] ? `, ${counts.deleted} deleted from the source` : \"\"}.`));\n        for (const failure of failures) console.error(chalk.red(`  ✗ ${failure.key}: ${failure.error ?? \"failed\"}`));\n        if (counts.copied + counts.exists > 0 && !flags[\"--delete-source\"]) {\n            console.log(chalk.gray(\"  The source keeps its copies. Point the property at the new source, then run again with --delete-source.\"));\n        }\n    }\n    if (failures.length > 0) process.exitCode = 1;\n}\n\nexport async function storageCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    if (!subcommand || subcommand === \"--help\" || wantsHelp(rawArgs)) {\n        printStorageHelp();\n        return;\n    }\n    switch (subcommand) {\n        case \"orphans\":\n            await orphans(rawArgs);\n            break;\n        case \"move\":\n            await move(rawArgs);\n            break;\n        default:\n            unknownCommand(subcommand, STORAGE_SUBCOMMANDS, \"storage\");\n    }\n}\n\nfunction printStorageHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase storage\")} — Maintain stored files, through the running backend\n\n${chalk.green.bold(\"Usage\")}\n  rebase storage ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.blue.bold(\"orphans\")}           List the stored files no row names\n  ${chalk.blue.bold(\"move\")}              Copy a folder of files to another storage source, same keys\n\n${chalk.green.bold(\"orphans Options\")}\n  ${chalk.blue(\"--source\")}          Storage source key ${chalk.gray(\"(default: the default source)\")}\n  ${chalk.blue(\"--older-than\")}      Hours a file must be old to count ${chalk.gray(\"(default: 24)\")}\n  ${chalk.blue(\"--delete\")}          Delete them, after asking\n  ${chalk.blue(\"--yes, -y\")}         Do not ask ${chalk.gray(\"(required with --delete when there is no terminal)\")}\n  ${chalk.blue(\"--json\")}            Print the report as JSON\n\n${chalk.green.bold(\"move Options\")}\n  ${chalk.blue(\"--from\")}            Source to copy from ${chalk.gray(\"(default: the default source)\")}\n  ${chalk.blue(\"--to\")}              Source to copy to ${chalk.gray(\"(default: the default source)\")}\n  ${chalk.blue(\"--prefix\")}          Folder to copy ${chalk.gray(\"(default: everything)\")}\n  ${chalk.blue(\"--delete-source\")}   Delete each file from the source once the target holds it\n  ${chalk.blue(\"--json\")}            Print the counts as JSON\n\n${chalk.green.bold(\"Notes\")}\n  A file is unused when no string in any row of any collection names it —\n  a key, a URL, a ${chalk.blue(\"rebase-storage:\")} reference in text — whatever property\n  or source holds it. Files newer than ${chalk.blue(\"--older-than\")} are left out: the admin\n  panel uploads a file before the row that names it is saved. Files your own\n  tables name, outside collections, are not seen: check before deleting.\n\n  Both read ${chalk.blue(\"REBASE_SERVICE_KEY\")} from .env and need the backend running.\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,IAAa,sBAAsB,CAAC,WAAW,MAAM;;AAGrD,IAAa,gBAAgB;CACzB,YAAY;CACZ,gBAAgB;CAChB,YAAY;CACZ,SAAS;CACT,MAAM;CACN,UAAU;AACd;;AAGA,IAAa,aAAa;CACtB,UAAU;CACV,QAAQ;CACR,YAAY;CACZ,mBAAmB;CACnB,UAAU;AACd;;AAgCA,SAAS,UAAmB;CACxB,MAAM,cAAc,mBAAmB;CACvC,MAAM,MAAM,YAAY,WAAW;CACnC,MAAM,aAAa,IAAI,eAAe,IAAI;CAC1C,IAAI,CAAC,YAAY;EACb,QAAQ,MAAM,MAAM,IAAI,4EAA4E,CAAC;EACrG,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,UAAU,kBAAkB,KAAK,WAAW,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACtE,OAAO;EACH;EACA,MAAM,QAAW,QAAgB,MAAc,MAA4B;GACvE,IAAI;GACJ,IAAI;IACA,WAAW,MAAM,MAAM,GAAG,QAAQ,oBAAoB,QAAQ;KAC1D;KACA,SAAS;MACL,iBAAiB,UAAU;MAC3B,UAAU;MACV,cAAc,aAAa;MAC3B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACvE;KACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;IAC/D,CAAC;GACL,SAAS,OAAgB;IACrB,MAAM,IAAI,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;KAAE,QAAQ;KAAG,MAAM;IAAgB,CAAC;GACzH;GACA,MAAM,SAAkB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;GACnE,IAAI,CAAC,SAAS,IAAI;IACd,MAAM,QAAQ,UAAU,OAAO,WAAW,YAAY,WAAW,UAAU,OAAO,SAAS,OAAO,OAAO,UAAU,WAC7G,OAAO,QACP,KAAA;IACN,MAAM,IAAI,eACN,OAAO,OAAO,YAAY,WAAW,MAAM,UAAU,uBAAuB,SAAS,OAAO,IAC5F;KAAE,QAAQ,SAAS;KAAQ,MAAM,OAAO,OAAO,SAAS,WAAW,MAAM,OAAO,KAAA;KAAW,SAAS,OAAO;IAAQ,CACvH;GACJ;GACA,OAAQ,OAAuB;EACnC;CACJ;AACJ;AAEA,SAAS,KAAK,QAAgB,OAAgB,SAAwB;CAClE,KAAK,MAAM,QAAQ,gBAAgB,QAAQ,OAAO,OAAO,GACrD,QAAQ,MAAM,KAAK,WAAW,GAAG,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;CAE3E,IAAI,iBAAiB,kBAAkB,MAAM,WAAW,OAAO,MAAM,SAAS,0BAC1E,QAAQ,MAAM,MAAM,KAAK,sGAAsG,CAAC;CAEpI,QAAQ,KAAK,CAAC;AAClB;;AAGA,SAAgB,YAAY,OAAuB;CAC/C,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,MAAM,QAAQ;EAAC;EAAM;EAAM;EAAM;CAAI;CACrC,IAAI,QAAQ,QAAQ;CACpB,IAAI,OAAO;CACX,OAAO,SAAS,QAAQ,OAAO,MAAM,SAAS,GAAG;EAC7C,SAAS;EACT;CACJ;CACA,OAAO,GAAG,MAAM,QAAQ,QAAQ,KAAK,IAAI,CAAC,EAAE,GAAG,MAAM;AACzD;;;;;AAMA,SAAgB,qBAAqB,QAAsB,gBAAkC;CACzF,MAAM,QAAkB,CAAC;CACzB,MAAM,QAAQ,OAAO,QAAQ,QAAQ,KAAK,WAAW,OAAO,OAAO,QAAQ,IAAI,CAAC;CAChF,MAAM,KAAK,KAAK,OAAO,QAAQ,sBAAsB,OAAO,UAAU,KAAK,OAAO,QAAQ,OAAO,qBAAqB;CACtH,IAAI,OAAO,QAAQ,WAAW,GAC1B,MAAM,KAAK,wBAA6B,eAAe,aAAa;MACjE;EACH,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,yBAAyB,YAAY,KAAK,EAAE,EAAE;EACpF,KAAK,MAAM,UAAU,OAAO,SACxB,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,SAAS,KAAA,IAAY,KAAK,YAAY,OAAO,IAAI,MAAM,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY,IAAI;CAEvJ;CACA,IAAI,OAAO,SAAS,GAAG;EACnB,MAAM,MAAM,OAAO,WAAW;EAC9B,MAAM,OAAO,OAAO,QAAQ,SAAS,IAAI,UAAU;EACnD,MAAM,KAAK,KAAK,OAAO,OAAO,GAAG,KAAK,SAAS,MAAM,YAAY,YAAY,aACtE,MAAM,UAAU,WAAW,cAAc,eAAe,QAAQ,MAAM,QAAQ,QAAQ,0EAC/B;CAClE;CACA,KAAK,MAAM,SAAS,OAAO,WACvB,MAAM,KAAK,OAAO,MAAM,WAAW,sBAAsB,MAAM,OAAO,yCAAyC;CAEnH,OAAO;AACX;AAEA,eAAe,QAAQ,UAAoC;CACvD,MAAM,SAAS,SAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACxF,IAAI;EACA,OAAO,YAAY,MAAM,MAAM,OAAO,SAAS,QAAQ,EAAA,CAAG,KAAK,CAAC;CACpE,UAAU;EACN,OAAO,MAAM;CACjB;AACJ;AAEA,eAAe,QAAQ,SAAkC;CACrD,MAAM,EAAE,UAAU,iBAAiB;EAAE,MAAM;EAAe;EAAS,cAAc;EAAG,SAAS;EAAmB,gBAAgB;CAAE,CAAC;CACnI,MAAM,YAAY,MAAM,mBAAmB;CAC3C,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,GAC3C,MAAM,IAAI,WAAW,kDAAkD;CAE3E,MAAM,QAAQ,IAAI,gBAAgB,EAAE,gBAAgB,OAAO,SAAS,EAAE,CAAC;CACvE,IAAI,MAAM,aAAa,MAAM,IAAI,aAAa,MAAM,WAAW;CAC/D,MAAM,UAAU,QAAQ;CAExB,IAAI;CACJ,IAAI;EACA,SAAS,MAAM,QAAQ,QAAsB,OAAO,YAAY,OAAO;CAC3E,SAAS,OAAgB;EACrB,KAAK,0BAA0B,OAAO,QAAQ,OAAO;CACzD;CAEA,IAAI,CAAC,MAAM,aAAa;EACpB,IAAI,MAAM,WAAW;GACjB,QAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;GAC3C;EACJ;EACA,QAAQ,IAAI,EAAE;EACd,KAAK,MAAM,QAAQ,qBAAqB,QAAQ,SAAS,GAAG,QAAQ,IAAI,IAAI;EAC5E,IAAI,OAAO,QAAQ,SAAS,GAAG;GAC3B,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,MAAM,KAAK,gEAAgE,CAAC;EAC5F;EACA,QAAQ,IAAI,EAAE;EACd;CACJ;CAEA,IAAI,CAAC,MAAM,WAAW;EAClB,QAAQ,IAAI,EAAE;EACd,KAAK,MAAM,QAAQ,qBAAqB,QAAQ,SAAS,GAAG,QAAQ,IAAI,IAAI;EAC5E,QAAQ,IAAI,EAAE;CAClB;CACA,IAAI,OAAO,QAAQ,WAAW,GAAG;CACjC,IAAI,OAAO,UAAU,SAAS,GAAG;EAC7B,QAAQ,MAAM,MAAM,IAAI,4FAA4F,CAAC;EACrH,QAAQ,KAAK,CAAC;CAClB;CACA,IAAI,CAAC,MAAM,UAAU;EACjB,IAAI,CAAC,QAAQ,MAAM,OACf,MAAM,IAAI,WAAW,0FAA0F;EAEnH,IAAI,CAAC,MAAM,QAAQ,kBAAkB,OAAO,QAAQ,OAAO,0BAA0B,GAAG;GACpF,QAAQ,IAAI,MAAM,KAAK,wBAAwB,CAAC;GAChD;EACJ;CACJ;CAEA,IAAI;CACJ,IAAI;EAGA,SAAS,MAAM,QAAQ,QAAQ,UAAU,YAAY,OAAO;CAChE,SAAS,OAAgB;EACrB,KAAK,iCAAiC,OAAO,QAAQ,OAAO;CAChE;CACA,IAAI,MAAM,WACN,QAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;MACxC;EACH,QAAQ,IAAI,MAAM,MAAM,eAAe,OAAO,QAAQ,OAAO,UAAU,CAAC;EACxE,KAAK,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,MAAM,IAAI,OAAO,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAC;EACpG,QAAQ,IAAI,EAAE;CAClB;CACA,IAAI,OAAO,OAAO,SAAS,GAAG,QAAQ,WAAW;AACrD;AAEA,eAAe,KAAK,SAAkC;CAClD,MAAM,EAAE,UAAU,iBAAiB;EAAE,MAAM;EAAY;EAAS,cAAc;EAAG,SAAS;EAAgB,gBAAgB;CAAE,CAAC;CAC7H,MAAM,OAAO,MAAM;CACnB,MAAM,KAAK,MAAM;CACjB,IAAI,CAAC,QAAQ,CAAC,IACV,MAAM,IAAI,WAAW,0HAA0H;CAEnJ,MAAM,UAAU,QAAQ;CACxB,MAAM,SAAS;EAAE,QAAQ;EAAG,QAAQ;EAAG,QAAQ;EAAG,SAAS;CAAE;CAC7D,MAAM,WAA0B,CAAC;CACjC,IAAI;CACJ,GAAG;EACC,IAAI;EACJ,IAAI;GACA,OAAO,MAAM,QAAQ,QAAQ,QAAQ,SAAS;IAC1C;IACA;IACA,QAAQ,MAAM;IACd;IACA,cAAc,MAAM,uBAAuB;GAC/C,CAAC;EACL,SAAS,OAAgB;GACrB,KAAK,wBAAwB,OAAO,QAAQ,OAAO;EACvD;EACA,KAAK,MAAM,UAAU,KAAK,OAAO;GAC7B,OAAO,OAAO,QAAQ;GACtB,IAAI,OAAO,SAAS,OAAO;GAC3B,IAAI,OAAO,YAAY,UAAU,SAAS,KAAK,MAAM;EACzD;EACA,IAAI,CAAC,MAAM,aAAa,QAAQ,OAAO,OACnC,QAAQ,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO,kBAAkB,OAAO,OAAO,SAAS;EAEhH,SAAS,KAAK;CAClB,SAAS;CAET,IAAI,MAAM,WACN,QAAQ,IAAI,KAAK,UAAU;EAAE,GAAG;EAAQ;CAAS,GAAG,MAAM,CAAC,CAAC;MACzD;EACH,IAAI,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI;EACnD,QAAQ,IAAI,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO,gBAC/D,MAAM,qBAAqB,KAAK,OAAO,QAAQ,4BAA4B,GAAG,EAAE,CAAC;EACxF,KAAK,MAAM,WAAW,UAAU,QAAQ,MAAM,MAAM,IAAI,OAAO,QAAQ,IAAI,IAAI,QAAQ,SAAS,UAAU,CAAC;EAC3G,IAAI,OAAO,SAAS,OAAO,SAAS,KAAK,CAAC,MAAM,oBAC5C,QAAQ,IAAI,MAAM,KAAK,2GAA2G,CAAC;CAE3I;CACA,IAAI,SAAS,SAAS,GAAG,QAAQ,WAAW;AAChD;AAEA,eAAsB,eAAe,YAAgC,SAAkC;CACnG,IAAI,CAAC,cAAc,eAAe,YAAY,UAAU,OAAO,GAAG;EAC9D,iBAAiB;EACjB;CACJ;CACA,QAAQ,YAAR;EACI,KAAK;GACD,MAAM,QAAQ,OAAO;GACrB;EACJ,KAAK;GACD,MAAM,KAAK,OAAO;GAClB;EACJ,SACI,eAAe,YAAY,qBAAqB,SAAS;CACjE;AACJ;AAEA,SAAS,mBAAyB;CAC9B,QAAQ,IAAI;EACd,MAAM,KAAK,gBAAgB,EAAE;;EAE7B,MAAM,MAAM,KAAK,OAAO,EAAE;mBACT,MAAM,KAAK,WAAW,EAAE;;EAEzC,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,KAAK,SAAS,EAAE;IAC3B,MAAM,KAAK,KAAK,MAAM,EAAE;;EAE1B,MAAM,MAAM,KAAK,iBAAiB,EAAE;IAClC,MAAM,KAAK,UAAU,EAAE,+BAA+B,MAAM,KAAK,+BAA+B,EAAE;IAClG,MAAM,KAAK,cAAc,EAAE,0CAA0C,MAAM,KAAK,eAAe,EAAE;IACjG,MAAM,KAAK,UAAU,EAAE;IACvB,MAAM,KAAK,WAAW,EAAE,sBAAsB,MAAM,KAAK,oDAAoD,EAAE;IAC/G,MAAM,KAAK,QAAQ,EAAE;;EAEvB,MAAM,MAAM,KAAK,cAAc,EAAE;IAC/B,MAAM,KAAK,QAAQ,EAAE,kCAAkC,MAAM,KAAK,+BAA+B,EAAE;IACnG,MAAM,KAAK,MAAM,EAAE,kCAAkC,MAAM,KAAK,+BAA+B,EAAE;IACjG,MAAM,KAAK,UAAU,EAAE,2BAA2B,MAAM,KAAK,uBAAuB,EAAE;IACtF,MAAM,KAAK,iBAAiB,EAAE;IAC9B,MAAM,KAAK,QAAQ,EAAE;;EAEvB,MAAM,MAAM,KAAK,OAAO,EAAE;;oBAER,MAAM,KAAK,iBAAiB,EAAE;yCACT,MAAM,KAAK,cAAc,EAAE;;;;cAItD,MAAM,KAAK,oBAAoB,EAAE;CAC9C;AACD"}
+{"version":3,"file":"storage-DKPUBTWG.js","names":[],"sources":["../src/commands/storage.ts"],"sourcesContent":["/**\n * CLI command: rebase storage <action>\n *\n * Whole-store maintenance through the running backend's `/api/admin/storage`,\n * authenticated with the service key from `.env`.\n *\n * Subcommands:\n *   orphans — Stored files no row names; `--delete` deletes them\n *   move    — Copy a folder of files to another storage source, same keys\n */\nimport chalk from \"chalk\";\nimport readline from \"node:readline/promises\";\nimport { RebaseApiError } from \"@rebasepro/client\";\nimport { requireProjectRoot, readEnvFile } from \"../utils/project\";\nimport { parseCommandArgs, UsageError, wantsHelp } from \"../utils/args\";\nimport { unknownCommand } from \"../utils/unknown-command\";\nimport { cliUserAgent } from \"../utils/version\";\nimport { describeFailure, requireBackendUrl } from \"./api-keys\";\n\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const STORAGE_SUBCOMMANDS = [\"orphans\", \"move\"] as const;\n\n/** The flags `rebase storage orphans` takes. */\nexport const ORPHANS_FLAGS = {\n    \"--source\": String,\n    \"--older-than\": Number,\n    \"--delete\": Boolean,\n    \"--yes\": Boolean,\n    \"-y\": \"--yes\",\n    \"--json\": Boolean\n} as const;\n\n/** The flags `rebase storage move` takes. */\nexport const MOVE_FLAGS = {\n    \"--from\": String,\n    \"--to\": String,\n    \"--prefix\": String,\n    \"--delete-source\": Boolean,\n    \"--json\": Boolean\n} as const;\n\n/** One stored object, as the backend lists it. */\ninterface StoredObjectEntry {\n    key: string;\n    size?: number;\n    updated?: string;\n}\n\n/** What `GET /admin/storage/orphans` answers. */\nexport interface OrphanReport {\n    storageId: string;\n    objects: number;\n    orphans: StoredObjectEntry[];\n    recent: number;\n    scanned: string[];\n    unscanned: { collection: string; reason: string }[];\n}\n\ninterface MovedObject {\n    key: string;\n    outcome: \"copied\" | \"exists\" | \"failed\";\n    deleted?: boolean;\n    error?: string;\n}\n\ninterface Backend {\n    baseUrl: string;\n    request<T>(method: string, path: string, body?: unknown): Promise<T>;\n}\n\n/** The project's backend, holding the service key — the `admin` role, every scope. */\nfunction connect(): Backend {\n    const projectRoot = requireProjectRoot();\n    const env = readEnvFile(projectRoot);\n    const serviceKey = env.SERVICE_KEY || env.REBASE_SERVICE_KEY;\n    if (!serviceKey) {\n        console.error(chalk.red(\"✗ REBASE_SERVICE_KEY not found in .env — required for storage maintenance.\"));\n        process.exit(1);\n    }\n    // Only an address this project recorded or the developer named: the\n    // request carries the service key. See `resolveBackendAddress`.\n    const baseUrl = requireBackendUrl(env, projectRoot).replace(/\\/+$/, \"\");\n    return {\n        baseUrl,\n        async request<T>(method: string, path: string, body?: unknown): Promise<T> {\n            let response: Response;\n            try {\n                response = await fetch(`${baseUrl}/api/admin/storage${path}`, {\n                    method,\n                    headers: {\n                        \"Authorization\": `Bearer ${serviceKey}`,\n                        \"Accept\": \"application/json\",\n                        \"User-Agent\": cliUserAgent(),\n                        ...(body === undefined ? {} : { \"Content-Type\": \"application/json\" })\n                    },\n                    ...(body === undefined ? {} : { body: JSON.stringify(body) })\n                });\n            } catch (error: unknown) {\n                throw new RebaseApiError(error instanceof Error ? error.message : String(error), { status: 0, code: \"NETWORK_ERROR\" });\n            }\n            const answer: unknown = await response.json().catch(() => undefined);\n            if (!response.ok) {\n                const error = answer && typeof answer === \"object\" && \"error\" in answer && answer.error && typeof answer.error === \"object\"\n                    ? answer.error as { message?: unknown; code?: unknown; details?: unknown }\n                    : undefined;\n                throw new RebaseApiError(\n                    typeof error?.message === \"string\" ? error.message : `The server answered ${response.status}.`,\n                    { status: response.status, code: typeof error?.code === \"string\" ? error.code : undefined, details: error?.details }\n                );\n            }\n            return (answer as { data: T }).data;\n        }\n    };\n}\n\nfunction fail(action: string, error: unknown, baseUrl: string): never {\n    for (const line of describeFailure(action, error, baseUrl)) {\n        console.error(line.startsWith(\"✗\") ? chalk.red(line) : chalk.gray(line));\n    }\n    if (error instanceof RebaseApiError && error.status === 404 && error.code !== \"UNKNOWN_STORAGE_SOURCE\") {\n        console.error(chalk.gray(\"  This backend has no storage maintenance routes: they arrived in 0.25, and need storage configured.\"));\n    }\n    process.exit(1);\n}\n\n/** Bytes, as a person reads them. */\nexport function formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    const units = [\"KB\", \"MB\", \"GB\", \"TB\"];\n    let value = bytes / 1024;\n    let unit = 0;\n    while (value >= 1024 && unit < units.length - 1) {\n        value /= 1024;\n        unit++;\n    }\n    return `${value.toFixed(value < 10 ? 1 : 0)} ${units[unit]}`;\n}\n\n/**\n * The lines that describe an orphan scan. Exported so its tests can read them\n * without a server.\n */\nexport function describeOrphanReport(report: OrphanReport, olderThanHours: number): string[] {\n    const lines: string[] = [];\n    const bytes = report.orphans.reduce((sum, orphan) => sum + (orphan.size ?? 0), 0);\n    lines.push(`  ${report.objects} file(s) in source \"${report.storageId}\", ${report.scanned.length} collection(s) read.`);\n    if (report.orphans.length === 0) {\n        lines.push(\"  No file older than \" + `${olderThanHours}h is unused.`);\n    } else {\n        lines.push(`  ${report.orphans.length} file(s) no row names, ${formatBytes(bytes)}:`);\n        for (const orphan of report.orphans) {\n            lines.push(`    ${orphan.key}${orphan.size !== undefined ? `  ${formatBytes(orphan.size)}` : \"\"}${orphan.updated ? `  ${orphan.updated}` : \"\"}`);\n        }\n    }\n    if (report.recent > 0) {\n        const one = report.recent === 1;\n        const more = report.orphans.length > 0 ? \"more \" : \"\";\n        lines.push(`  ${report.recent} ${more}unused ${one ? \"file is\" : \"files are\"} left out: ` +\n            `${one ? \"it is\" : \"they are\"} newer than ${olderThanHours}h, or ${one ? \"its\" : \"their\"} age is unknown, ` +\n            \"and an upload can be saved before the row that names it.\");\n    }\n    for (const entry of report.unscanned) {\n        lines.push(`  ⚠ ${entry.collection} could not be read (${entry.reason}): a file only it names is listed above.`);\n    }\n    return lines;\n}\n\nasync function confirm(question: string): Promise<boolean> {\n    const prompt = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        return /^y(es)?$/i.test((await prompt.question(question)).trim());\n    } finally {\n        prompt.close();\n    }\n}\n\nasync function orphans(rawArgs: string[]): Promise<void> {\n    const { flags } = parseCommandArgs({ spec: ORPHANS_FLAGS, rawArgs, commandWords: 2, command: \"storage orphans\", maxPositionals: 0 });\n    const olderThan = flags[\"--older-than\"] ?? 24;\n    if (!Number.isFinite(olderThan) || olderThan < 0) {\n        throw new UsageError(\"--older-than takes a number of hours, 0 or more.\");\n    }\n    const query = new URLSearchParams({ olderThanHours: String(olderThan) });\n    if (flags[\"--source\"]) query.set(\"storageId\", flags[\"--source\"]);\n    const backend = connect();\n\n    let report: OrphanReport;\n    try {\n        report = await backend.request<OrphanReport>(\"GET\", `/orphans?${query}`);\n    } catch (error: unknown) {\n        fail(\"Failed to scan storage\", error, backend.baseUrl);\n    }\n\n    if (!flags[\"--delete\"]) {\n        if (flags[\"--json\"]) {\n            console.log(JSON.stringify(report, null, 2));\n            return;\n        }\n        console.log(\"\");\n        for (const line of describeOrphanReport(report, olderThan)) console.log(line);\n        if (report.orphans.length > 0) {\n            console.log(\"\");\n            console.log(chalk.gray(\"  Nothing was deleted. Run again with --delete to delete them.\"));\n        }\n        console.log(\"\");\n        return;\n    }\n\n    if (!flags[\"--json\"]) {\n        console.log(\"\");\n        for (const line of describeOrphanReport(report, olderThan)) console.log(line);\n        console.log(\"\");\n    }\n    if (report.orphans.length === 0) return;\n    if (report.unscanned.length > 0) {\n        console.error(chalk.red(\"✗ Not deleting: some collections could not be read, so a file they name would look unused.\"));\n        process.exit(1);\n    }\n    if (!flags[\"--yes\"]) {\n        if (!process.stdin.isTTY) {\n            throw new UsageError(\"--delete deletes files for good; pass --yes to confirm when there is no terminal to ask.\");\n        }\n        if (!await confirm(`  Delete these ${report.orphans.length} file(s) for good? [y/N] `)) {\n            console.log(chalk.gray(\"  Nothing was deleted.\"));\n            return;\n        }\n    }\n\n    let result: { deleted: string[]; failed: { key: string; error: string }[] };\n    try {\n        // The server finds them again before it deletes: a file a row has\n        // named since the list was printed is not deleted.\n        result = await backend.request(\"DELETE\", `/orphans?${query}`);\n    } catch (error: unknown) {\n        fail(\"Failed to delete unused files\", error, backend.baseUrl);\n    }\n    if (flags[\"--json\"]) {\n        console.log(JSON.stringify(result, null, 2));\n    } else {\n        console.log(chalk.green(`  ✓ Deleted ${result.deleted.length} file(s).`));\n        for (const failure of result.failed) console.error(chalk.red(`  ✗ ${failure.key}: ${failure.error}`));\n        console.log(\"\");\n    }\n    if (result.failed.length > 0) process.exitCode = 1;\n}\n\nasync function move(rawArgs: string[]): Promise<void> {\n    const { flags } = parseCommandArgs({ spec: MOVE_FLAGS, rawArgs, commandWords: 2, command: \"storage move\", maxPositionals: 0 });\n    const from = flags[\"--from\"];\n    const to = flags[\"--to\"];\n    if (!from && !to) {\n        throw new UsageError(\"Name the sources: --from <source> --to <source>. The default source is \\\"(default)\\\", and either may be left out for it.\");\n    }\n    const backend = connect();\n    const counts = { copied: 0, exists: 0, failed: 0, deleted: 0 };\n    const failures: MovedObject[] = [];\n    let cursor: string | undefined;\n    do {\n        let page: { moved: MovedObject[]; cursor?: string };\n        try {\n            page = await backend.request(\"POST\", \"/move\", {\n                from,\n                to,\n                prefix: flags[\"--prefix\"],\n                cursor,\n                deleteSource: flags[\"--delete-source\"] === true\n            });\n        } catch (error: unknown) {\n            fail(\"Failed to move files\", error, backend.baseUrl);\n        }\n        for (const object of page.moved) {\n            counts[object.outcome]++;\n            if (object.deleted) counts.deleted++;\n            if (object.outcome === \"failed\") failures.push(object);\n        }\n        if (!flags[\"--json\"] && process.stdout.isTTY) {\n            process.stdout.write(`\\r  ${counts.copied} copied, ${counts.exists} already there, ${counts.failed} failed…`);\n        }\n        cursor = page.cursor;\n    } while (cursor);\n\n    if (flags[\"--json\"]) {\n        console.log(JSON.stringify({ ...counts, failures }, null, 2));\n    } else {\n        if (process.stdout.isTTY) process.stdout.write(\"\\n\");\n        console.log(chalk.green(`  ✓ ${counts.copied} copied, ${counts.exists} already there` +\n            `${flags[\"--delete-source\"] ? `, ${counts.deleted} deleted from the source` : \"\"}.`));\n        for (const failure of failures) console.error(chalk.red(`  ✗ ${failure.key}: ${failure.error ?? \"failed\"}`));\n        if (counts.copied + counts.exists > 0 && !flags[\"--delete-source\"]) {\n            console.log(chalk.gray(\"  The source keeps its copies. Point the property at the new source, then run again with --delete-source.\"));\n        }\n    }\n    if (failures.length > 0) process.exitCode = 1;\n}\n\nexport async function storageCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    if (!subcommand || subcommand === \"--help\" || wantsHelp(rawArgs)) {\n        printStorageHelp();\n        return;\n    }\n    switch (subcommand) {\n        case \"orphans\":\n            await orphans(rawArgs);\n            break;\n        case \"move\":\n            await move(rawArgs);\n            break;\n        default:\n            unknownCommand(subcommand, STORAGE_SUBCOMMANDS, \"storage\");\n    }\n}\n\nfunction printStorageHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase storage\")} — Maintain stored files, through the running backend\n\n${chalk.green.bold(\"Usage\")}\n  rebase storage ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.blue.bold(\"orphans\")}           List the stored files no row names\n  ${chalk.blue.bold(\"move\")}              Copy a folder of files to another storage source, same keys\n\n${chalk.green.bold(\"orphans Options\")}\n  ${chalk.blue(\"--source\")}          Storage source key ${chalk.gray(\"(default: the default source)\")}\n  ${chalk.blue(\"--older-than\")}      Hours a file must be old to count ${chalk.gray(\"(default: 24)\")}\n  ${chalk.blue(\"--delete\")}          Delete them, after asking\n  ${chalk.blue(\"--yes, -y\")}         Do not ask ${chalk.gray(\"(required with --delete when there is no terminal)\")}\n  ${chalk.blue(\"--json\")}            Print the report as JSON\n\n${chalk.green.bold(\"move Options\")}\n  ${chalk.blue(\"--from\")}            Source to copy from ${chalk.gray(\"(default: the default source)\")}\n  ${chalk.blue(\"--to\")}              Source to copy to ${chalk.gray(\"(default: the default source)\")}\n  ${chalk.blue(\"--prefix\")}          Folder to copy ${chalk.gray(\"(default: everything)\")}\n  ${chalk.blue(\"--delete-source\")}   Delete each file from the source once the target holds it\n  ${chalk.blue(\"--json\")}            Print the counts as JSON\n\n${chalk.green.bold(\"Notes\")}\n  A file is unused when no string in any row of any collection names it —\n  a key, a URL, a ${chalk.blue(\"rebase-storage:\")} reference in text — whatever property\n  or source holds it. Files newer than ${chalk.blue(\"--older-than\")} are left out: the admin\n  panel uploads a file before the row that names it is saved. Files your own\n  tables name, outside collections, are not seen: check before deleting.\n\n  Both read ${chalk.blue(\"REBASE_SERVICE_KEY\")} from .env and need the backend running.\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoBA,IAAa,sBAAsB,CAAC,WAAW,MAAM;;AAGrD,IAAa,gBAAgB;CACzB,YAAY;CACZ,gBAAgB;CAChB,YAAY;CACZ,SAAS;CACT,MAAM;CACN,UAAU;AACd;;AAGA,IAAa,aAAa;CACtB,UAAU;CACV,QAAQ;CACR,YAAY;CACZ,mBAAmB;CACnB,UAAU;AACd;;AAgCA,SAAS,UAAmB;CACxB,MAAM,cAAc,mBAAmB;CACvC,MAAM,MAAM,YAAY,WAAW;CACnC,MAAM,aAAa,IAAI,eAAe,IAAI;CAC1C,IAAI,CAAC,YAAY;EACb,QAAQ,MAAM,MAAM,IAAI,4EAA4E,CAAC;EACrG,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,UAAU,kBAAkB,KAAK,WAAW,CAAC,CAAC,QAAQ,QAAQ,EAAE;CACtE,OAAO;EACH;EACA,MAAM,QAAW,QAAgB,MAAc,MAA4B;GACvE,IAAI;GACJ,IAAI;IACA,WAAW,MAAM,MAAM,GAAG,QAAQ,oBAAoB,QAAQ;KAC1D;KACA,SAAS;MACL,iBAAiB,UAAU;MAC3B,UAAU;MACV,cAAc,aAAa;MAC3B,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;KACvE;KACA,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;IAC/D,CAAC;GACL,SAAS,OAAgB;IACrB,MAAM,IAAI,eAAe,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,GAAG;KAAE,QAAQ;KAAG,MAAM;IAAgB,CAAC;GACzH;GACA,MAAM,SAAkB,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;GACnE,IAAI,CAAC,SAAS,IAAI;IACd,MAAM,QAAQ,UAAU,OAAO,WAAW,YAAY,WAAW,UAAU,OAAO,SAAS,OAAO,OAAO,UAAU,WAC7G,OAAO,QACP,KAAA;IACN,MAAM,IAAI,eACN,OAAO,OAAO,YAAY,WAAW,MAAM,UAAU,uBAAuB,SAAS,OAAO,IAC5F;KAAE,QAAQ,SAAS;KAAQ,MAAM,OAAO,OAAO,SAAS,WAAW,MAAM,OAAO,KAAA;KAAW,SAAS,OAAO;IAAQ,CACvH;GACJ;GACA,OAAQ,OAAuB;EACnC;CACJ;AACJ;AAEA,SAAS,KAAK,QAAgB,OAAgB,SAAwB;CAClE,KAAK,MAAM,QAAQ,gBAAgB,QAAQ,OAAO,OAAO,GACrD,QAAQ,MAAM,KAAK,WAAW,GAAG,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,KAAK,IAAI,CAAC;CAE3E,IAAI,iBAAiB,kBAAkB,MAAM,WAAW,OAAO,MAAM,SAAS,0BAC1E,QAAQ,MAAM,MAAM,KAAK,sGAAsG,CAAC;CAEpI,QAAQ,KAAK,CAAC;AAClB;;AAGA,SAAgB,YAAY,OAAuB;CAC/C,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,MAAM,QAAQ;EAAC;EAAM;EAAM;EAAM;CAAI;CACrC,IAAI,QAAQ,QAAQ;CACpB,IAAI,OAAO;CACX,OAAO,SAAS,QAAQ,OAAO,MAAM,SAAS,GAAG;EAC7C,SAAS;EACT;CACJ;CACA,OAAO,GAAG,MAAM,QAAQ,QAAQ,KAAK,IAAI,CAAC,EAAE,GAAG,MAAM;AACzD;;;;;AAMA,SAAgB,qBAAqB,QAAsB,gBAAkC;CACzF,MAAM,QAAkB,CAAC;CACzB,MAAM,QAAQ,OAAO,QAAQ,QAAQ,KAAK,WAAW,OAAO,OAAO,QAAQ,IAAI,CAAC;CAChF,MAAM,KAAK,KAAK,OAAO,QAAQ,sBAAsB,OAAO,UAAU,KAAK,OAAO,QAAQ,OAAO,qBAAqB;CACtH,IAAI,OAAO,QAAQ,WAAW,GAC1B,MAAM,KAAK,wBAA6B,eAAe,aAAa;MACjE;EACH,MAAM,KAAK,KAAK,OAAO,QAAQ,OAAO,yBAAyB,YAAY,KAAK,EAAE,EAAE;EACpF,KAAK,MAAM,UAAU,OAAO,SACxB,MAAM,KAAK,OAAO,OAAO,MAAM,OAAO,SAAS,KAAA,IAAY,KAAK,YAAY,OAAO,IAAI,MAAM,KAAK,OAAO,UAAU,KAAK,OAAO,YAAY,IAAI;CAEvJ;CACA,IAAI,OAAO,SAAS,GAAG;EACnB,MAAM,MAAM,OAAO,WAAW;EAC9B,MAAM,OAAO,OAAO,QAAQ,SAAS,IAAI,UAAU;EACnD,MAAM,KAAK,KAAK,OAAO,OAAO,GAAG,KAAK,SAAS,MAAM,YAAY,YAAY,aACtE,MAAM,UAAU,WAAW,cAAc,eAAe,QAAQ,MAAM,QAAQ,QAAQ,0EAC/B;CAClE;CACA,KAAK,MAAM,SAAS,OAAO,WACvB,MAAM,KAAK,OAAO,MAAM,WAAW,sBAAsB,MAAM,OAAO,yCAAyC;CAEnH,OAAO;AACX;AAEA,eAAe,QAAQ,UAAoC;CACvD,MAAM,SAAS,SAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACxF,IAAI;EACA,OAAO,YAAY,MAAM,MAAM,OAAO,SAAS,QAAQ,EAAA,CAAG,KAAK,CAAC;CACpE,UAAU;EACN,OAAO,MAAM;CACjB;AACJ;AAEA,eAAe,QAAQ,SAAkC;CACrD,MAAM,EAAE,UAAU,iBAAiB;EAAE,MAAM;EAAe;EAAS,cAAc;EAAG,SAAS;EAAmB,gBAAgB;CAAE,CAAC;CACnI,MAAM,YAAY,MAAM,mBAAmB;CAC3C,IAAI,CAAC,OAAO,SAAS,SAAS,KAAK,YAAY,GAC3C,MAAM,IAAI,WAAW,kDAAkD;CAE3E,MAAM,QAAQ,IAAI,gBAAgB,EAAE,gBAAgB,OAAO,SAAS,EAAE,CAAC;CACvE,IAAI,MAAM,aAAa,MAAM,IAAI,aAAa,MAAM,WAAW;CAC/D,MAAM,UAAU,QAAQ;CAExB,IAAI;CACJ,IAAI;EACA,SAAS,MAAM,QAAQ,QAAsB,OAAO,YAAY,OAAO;CAC3E,SAAS,OAAgB;EACrB,KAAK,0BAA0B,OAAO,QAAQ,OAAO;CACzD;CAEA,IAAI,CAAC,MAAM,aAAa;EACpB,IAAI,MAAM,WAAW;GACjB,QAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;GAC3C;EACJ;EACA,QAAQ,IAAI,EAAE;EACd,KAAK,MAAM,QAAQ,qBAAqB,QAAQ,SAAS,GAAG,QAAQ,IAAI,IAAI;EAC5E,IAAI,OAAO,QAAQ,SAAS,GAAG;GAC3B,QAAQ,IAAI,EAAE;GACd,QAAQ,IAAI,MAAM,KAAK,gEAAgE,CAAC;EAC5F;EACA,QAAQ,IAAI,EAAE;EACd;CACJ;CAEA,IAAI,CAAC,MAAM,WAAW;EAClB,QAAQ,IAAI,EAAE;EACd,KAAK,MAAM,QAAQ,qBAAqB,QAAQ,SAAS,GAAG,QAAQ,IAAI,IAAI;EAC5E,QAAQ,IAAI,EAAE;CAClB;CACA,IAAI,OAAO,QAAQ,WAAW,GAAG;CACjC,IAAI,OAAO,UAAU,SAAS,GAAG;EAC7B,QAAQ,MAAM,MAAM,IAAI,4FAA4F,CAAC;EACrH,QAAQ,KAAK,CAAC;CAClB;CACA,IAAI,CAAC,MAAM,UAAU;EACjB,IAAI,CAAC,QAAQ,MAAM,OACf,MAAM,IAAI,WAAW,0FAA0F;EAEnH,IAAI,CAAC,MAAM,QAAQ,kBAAkB,OAAO,QAAQ,OAAO,0BAA0B,GAAG;GACpF,QAAQ,IAAI,MAAM,KAAK,wBAAwB,CAAC;GAChD;EACJ;CACJ;CAEA,IAAI;CACJ,IAAI;EAGA,SAAS,MAAM,QAAQ,QAAQ,UAAU,YAAY,OAAO;CAChE,SAAS,OAAgB;EACrB,KAAK,iCAAiC,OAAO,QAAQ,OAAO;CAChE;CACA,IAAI,MAAM,WACN,QAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;MACxC;EACH,QAAQ,IAAI,MAAM,MAAM,eAAe,OAAO,QAAQ,OAAO,UAAU,CAAC;EACxE,KAAK,MAAM,WAAW,OAAO,QAAQ,QAAQ,MAAM,MAAM,IAAI,OAAO,QAAQ,IAAI,IAAI,QAAQ,OAAO,CAAC;EACpG,QAAQ,IAAI,EAAE;CAClB;CACA,IAAI,OAAO,OAAO,SAAS,GAAG,QAAQ,WAAW;AACrD;AAEA,eAAe,KAAK,SAAkC;CAClD,MAAM,EAAE,UAAU,iBAAiB;EAAE,MAAM;EAAY;EAAS,cAAc;EAAG,SAAS;EAAgB,gBAAgB;CAAE,CAAC;CAC7H,MAAM,OAAO,MAAM;CACnB,MAAM,KAAK,MAAM;CACjB,IAAI,CAAC,QAAQ,CAAC,IACV,MAAM,IAAI,WAAW,0HAA0H;CAEnJ,MAAM,UAAU,QAAQ;CACxB,MAAM,SAAS;EAAE,QAAQ;EAAG,QAAQ;EAAG,QAAQ;EAAG,SAAS;CAAE;CAC7D,MAAM,WAA0B,CAAC;CACjC,IAAI;CACJ,GAAG;EACC,IAAI;EACJ,IAAI;GACA,OAAO,MAAM,QAAQ,QAAQ,QAAQ,SAAS;IAC1C;IACA;IACA,QAAQ,MAAM;IACd;IACA,cAAc,MAAM,uBAAuB;GAC/C,CAAC;EACL,SAAS,OAAgB;GACrB,KAAK,wBAAwB,OAAO,QAAQ,OAAO;EACvD;EACA,KAAK,MAAM,UAAU,KAAK,OAAO;GAC7B,OAAO,OAAO,QAAQ;GACtB,IAAI,OAAO,SAAS,OAAO;GAC3B,IAAI,OAAO,YAAY,UAAU,SAAS,KAAK,MAAM;EACzD;EACA,IAAI,CAAC,MAAM,aAAa,QAAQ,OAAO,OACnC,QAAQ,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO,kBAAkB,OAAO,OAAO,SAAS;EAEhH,SAAS,KAAK;CAClB,SAAS;CAET,IAAI,MAAM,WACN,QAAQ,IAAI,KAAK,UAAU;EAAE,GAAG;EAAQ;CAAS,GAAG,MAAM,CAAC,CAAC;MACzD;EACH,IAAI,QAAQ,OAAO,OAAO,QAAQ,OAAO,MAAM,IAAI;EACnD,QAAQ,IAAI,MAAM,MAAM,OAAO,OAAO,OAAO,WAAW,OAAO,OAAO,gBAC/D,MAAM,qBAAqB,KAAK,OAAO,QAAQ,4BAA4B,GAAG,EAAE,CAAC;EACxF,KAAK,MAAM,WAAW,UAAU,QAAQ,MAAM,MAAM,IAAI,OAAO,QAAQ,IAAI,IAAI,QAAQ,SAAS,UAAU,CAAC;EAC3G,IAAI,OAAO,SAAS,OAAO,SAAS,KAAK,CAAC,MAAM,oBAC5C,QAAQ,IAAI,MAAM,KAAK,2GAA2G,CAAC;CAE3I;CACA,IAAI,SAAS,SAAS,GAAG,QAAQ,WAAW;AAChD;AAEA,eAAsB,eAAe,YAAgC,SAAkC;CACnG,IAAI,CAAC,cAAc,eAAe,YAAY,UAAU,OAAO,GAAG;EAC9D,iBAAiB;EACjB;CACJ;CACA,QAAQ,YAAR;EACI,KAAK;GACD,MAAM,QAAQ,OAAO;GACrB;EACJ,KAAK;GACD,MAAM,KAAK,OAAO;GAClB;EACJ,SACI,eAAe,YAAY,qBAAqB,SAAS;CACjE;AACJ;AAEA,SAAS,mBAAyB;CAC9B,QAAQ,IAAI;EACd,MAAM,KAAK,gBAAgB,EAAE;;EAE7B,MAAM,MAAM,KAAK,OAAO,EAAE;mBACT,MAAM,KAAK,WAAW,EAAE;;EAEzC,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,KAAK,SAAS,EAAE;IAC3B,MAAM,KAAK,KAAK,MAAM,EAAE;;EAE1B,MAAM,MAAM,KAAK,iBAAiB,EAAE;IAClC,MAAM,KAAK,UAAU,EAAE,+BAA+B,MAAM,KAAK,+BAA+B,EAAE;IAClG,MAAM,KAAK,cAAc,EAAE,0CAA0C,MAAM,KAAK,eAAe,EAAE;IACjG,MAAM,KAAK,UAAU,EAAE;IACvB,MAAM,KAAK,WAAW,EAAE,sBAAsB,MAAM,KAAK,oDAAoD,EAAE;IAC/G,MAAM,KAAK,QAAQ,EAAE;;EAEvB,MAAM,MAAM,KAAK,cAAc,EAAE;IAC/B,MAAM,KAAK,QAAQ,EAAE,kCAAkC,MAAM,KAAK,+BAA+B,EAAE;IACnG,MAAM,KAAK,MAAM,EAAE,kCAAkC,MAAM,KAAK,+BAA+B,EAAE;IACjG,MAAM,KAAK,UAAU,EAAE,2BAA2B,MAAM,KAAK,uBAAuB,EAAE;IACtF,MAAM,KAAK,iBAAiB,EAAE;IAC9B,MAAM,KAAK,QAAQ,EAAE;;EAEvB,MAAM,MAAM,KAAK,OAAO,EAAE;;oBAER,MAAM,KAAK,iBAAiB,EAAE;yCACT,MAAM,KAAK,cAAc,EAAE;;;;cAItD,MAAM,KAAK,oBAAoB,EAAE;CAC9C;AACD"}

package/dist/{telemetry-BYmPU-Ji.js → telemetry-m9czTNGR.js}

@@ -1,5 +1,5 @@
 import { a as setConsent, d as configPath, f as readConfig, r as previewEvent, s as readProjectPolicy, t as endpoint } from "./telemetry-EMFRVRQi.js";
-import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp } from "./args-CcBphFdj.js";
+import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp } from "./args-BX0YD14a.js";
 import { r as renderPreview, t as describeState } from "./consent-ClRHmcxf.js";
 import chalk from "chalk";
 //#region src/commands/telemetry.ts
@@ -125,4 +125,4 @@ ${chalk.gray("URLs, hostnames, error messages, stack traces, or exact record cou
 //#endregion
 export { TELEMETRY_SUBCOMMANDS, telemetryCommand };
 
-//# sourceMappingURL=telemetry-BYmPU-Ji.js.map
+//# sourceMappingURL=telemetry-m9czTNGR.js.map

package/dist/{telemetry-BYmPU-Ji.js.map → telemetry-m9czTNGR.js.map}

@@ -1 +1 @@
-{"version":3,"file":"telemetry-BYmPU-Ji.js","names":[],"sources":["../src/commands/telemetry.ts"],"sourcesContent":["import chalk from \"chalk\";\n\nimport { describeState, renderPreview } from \"../telemetry/consent\";\nimport { configPath, endpoint, previewEvent, readConfig, readProjectPolicy, setConsent } from \"../telemetry\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { unknownCommand } from \"../utils/unknown-command\";\n\n/**\n * `rebase telemetry` — the command that makes the rest of it inspectable.\n *\n * The whole subsystem asks for trust it cannot otherwise earn, and the cheapest\n * way to earn it is to stop describing the payload and print it. `show` runs\n * the same builder the sender uses, so what appears here is what would go, not\n * a documentation comment that quietly fell out of date two releases ago.\n */\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const TELEMETRY_SUBCOMMANDS = [\"status\", \"show\", \"enable\", \"disable\"] as const;\n\nexport async function telemetryCommand(rawArgs: string[]): Promise<void> {\n    // Checked before parsing, because `--help` is answered by the dispatcher\n    // and never by a handler. It used to be checked after a `filter(a =>\n    // !a.startsWith(\"-\"))` that stripped every flag off the line, so `rebase\n    // telemetry --help` reached `case undefined` and printed the status page.\n    if (wantsHelp(rawArgs)) {\n        printHelp();\n        return;\n    }\n\n    // Strictly, like every other family. That `filter` was not \"be lenient\": it\n    // deleted every `-`-prefixed token before dispatch, so `rebase telemetry\n    // --frobnicate` printed the status page and exited 0, and a mistyped\n    // `--disable` looked exactly like asking for the status. `parseCommandArgs`\n    // is the CLI's one rule for an undeclared flag, and the comment at the top\n    // of `utils/args.ts` is why: guessing that an unknown flag was meant as\n    // something else is the unsafe branch.\n    const { positionals } = parseCommandArgs({\n        spec: {},\n        rawArgs,\n        commandWords: 1,\n        command: \"telemetry\",\n        maxPositionals: 1\n    });\n    const subcommand = positionals[0];\n\n    switch (subcommand) {\n        case \"status\":\n        case undefined:\n            printStatus();\n            return;\n        case \"show\":\n            printPayload();\n            return;\n        case \"enable\":\n            if (!setConsent(true)) {\n                console.error(chalk.red(`Could not write ${configPath()} — sharing was not enabled.`));\n                process.exitCode = 1;\n                return;\n            }\n            console.log(chalk.green(\"Anonymous usage sharing enabled.\"));\n            console.log(chalk.gray(`Inspect what gets sent with ${chalk.cyan(\"rebase telemetry show\")}.`));\n            return;\n        case \"disable\":\n            if (!setConsent(false)) {\n                // The failure direction that matters. Someone turning sharing\n                // off must never be left believing it worked — so this is loud,\n                // non-zero, and points at the switch that needs no disk.\n                console.error(chalk.red(`Could not write ${configPath()} — sharing is still ON.`));\n                console.error(chalk.yellow(`Set ${chalk.cyan(\"REBASE_TELEMETRY_DISABLED=1\")} in your environment instead; it needs no file.`));\n                process.exitCode = 1;\n                return;\n            }\n            console.log(chalk.gray(\"Anonymous usage sharing disabled. Nothing further will be sent.\"));\n            return;\n        default:\n            // Printing the help and setting exit 1 said nothing about *why*:\n            // the page that came back looked like the page `rebase telemetry\n            // --help` prints, and the only difference was an exit code nobody\n            // reads at a prompt.\n            unknownCommand(subcommand, TELEMETRY_SUBCOMMANDS, \"telemetry\");\n    }\n}\n\nfunction printStatus(): void {\n    console.log(\"\");\n    console.log(`  Status:   ${describeState()}`);\n    if (readProjectPolicy() === \"ignored_opt_in\") {\n        // Said out loud rather than silently ignored: a maintainer who wrote\n        // `\"telemetry\": true` believes they turned something on, and leaving\n        // them to believe it is worse than refusing.\n        console.log(\"\");\n        console.log(chalk.yellow(\"  Note: this project's rebase.json sets \\\"telemetry\\\": true, which is ignored.\"));\n        console.log(chalk.gray(\"        A committed file cannot consent on behalf of everyone who clones it.\"));\n        console.log(chalk.gray(`        Only \"telemetry\": false is honoured there. Use ${chalk.cyan(\"rebase telemetry enable\")}.`));\n    }\n    console.log(`  Endpoint: ${chalk.gray(endpoint())}`);\n    console.log(`  Config:   ${chalk.gray(configPath())}`);\n    console.log(\"\");\n    console.log(chalk.gray(`  ${chalk.cyan(\"rebase telemetry show\")} prints the exact payload.`));\n    console.log(\"\");\n}\n\nfunction printPayload(): void {\n    const config = readConfig();\n    if (config.enabled !== true) {\n        // Deliberately still prints one. The consent prompt points here so the\n        // question can stay short, and someone deciding whether to say yes is\n        // exactly the person who most needs to see the payload — telling them\n        // to enable sharing first, in order to find out what sharing sends,\n        // is the wrong way round.\n        console.log(\"\");\n        console.log(`  ${describeState()}`);\n        console.log(\"\");\n        console.log(chalk.gray(\"  Nothing is being sent. This is what WOULD be sent if you said yes:\"));\n        console.log(\"\");\n        console.log(renderPreview(\"cli.dev\", { first_run: false }).split(\"\\n\").map((l) => \"  \" + l).join(\"\\n\"));\n        console.log(\"\");\n        console.log(chalk.gray(`  Start sharing with ${chalk.cyan(\"rebase telemetry enable\")}.`));\n        console.log(\"\");\n        return;\n    }\n\n    // A representative event rather than a synthetic one: `cli.dev` is the\n    // event that fires most often, so it is the one worth being sure about.\n    const event = previewEvent(\"cli.dev\", { first_run: false }, process.cwd());\n    console.log(\"\");\n    console.log(chalk.gray(\"  Sent to \") + chalk.gray(endpoint()) + chalk.gray(\", for example:\"));\n    console.log(\"\");\n    console.log(JSON.stringify(event, null, 2).split(\"\\n\").map((l) => \"  \" + l).join(\"\\n\"));\n    console.log(\"\");\n    console.log(chalk.gray(\"  Both ids are random. Neither is derived from your machine, your\"));\n    console.log(chalk.gray(\"  hostname, your project name or anything you have typed.\"));\n    console.log(\"\");\n}\n\nfunction printHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase telemetry\")} — anonymous usage sharing (off until you say yes; ${chalk.cyan(\"rebase init\")} asks)\n\n${chalk.bold(\"Commands\")}\n  ${chalk.blue(\"status\")}     Whether anything is being shared, and why ${chalk.gray(\"(default)\")}\n  ${chalk.blue(\"show\")}       Print the exact payload that would be sent\n  ${chalk.blue(\"enable\")}     Start sharing\n  ${chalk.blue(\"disable\")}    Stop sharing, permanently\n\n${chalk.bold(\"Project policy\")}\n  ${chalk.blue('\"telemetry\": false')} in ${chalk.blue(\"rebase.json\")} disables sharing for everyone who\n  clones the repository, overriding each developer's own choice.\n  ${chalk.gray('\"telemetry\": true is ignored — a committed file cannot consent for others.')}\n\n${chalk.bold(\"Environment\")}\n  ${chalk.blue(\"DO_NOT_TRACK\")}                 Set to disable, across every tool that honours it\n  ${chalk.blue(\"REBASE_TELEMETRY_DISABLED\")}    Set to disable Rebase specifically\n  ${chalk.blue(\"REBASE_TELEMETRY_ENDPOINT\")}    Send elsewhere — your own collector, for instance\n\n${chalk.gray(\"Never shared: project names, paths, collection or table names, database\")}\n${chalk.gray(\"URLs, hostnames, error messages, stack traces, or exact record counts.\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,IAAa,wBAAwB;CAAC;CAAU;CAAQ;CAAU;AAAS;AAE3E,eAAsB,iBAAiB,SAAkC;CAKrE,IAAI,UAAU,OAAO,GAAG;EACpB,UAAU;EACV;CACJ;CASA,MAAM,EAAE,gBAAgB,iBAAiB;EACrC,MAAM,CAAC;EACP;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CACD,MAAM,aAAa,YAAY;CAE/B,QAAQ,YAAR;EACI,KAAK;EACL,KAAK,KAAA;GACD,YAAY;GACZ;EACJ,KAAK;GACD,aAAa;GACb;EACJ,KAAK;GACD,IAAI,CAAC,WAAW,IAAI,GAAG;IACnB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,WAAW,EAAE,4BAA4B,CAAC;IACrF,QAAQ,WAAW;IACnB;GACJ;GACA,QAAQ,IAAI,MAAM,MAAM,kCAAkC,CAAC;GAC3D,QAAQ,IAAI,MAAM,KAAK,+BAA+B,MAAM,KAAK,uBAAuB,EAAE,EAAE,CAAC;GAC7F;EACJ,KAAK;GACD,IAAI,CAAC,WAAW,KAAK,GAAG;IAIpB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,WAAW,EAAE,wBAAwB,CAAC;IACjF,QAAQ,MAAM,MAAM,OAAO,OAAO,MAAM,KAAK,6BAA6B,EAAE,gDAAgD,CAAC;IAC7H,QAAQ,WAAW;IACnB;GACJ;GACA,QAAQ,IAAI,MAAM,KAAK,iEAAiE,CAAC;GACzF;EACJ,SAKI,eAAe,YAAY,uBAAuB,WAAW;CACrE;AACJ;AAEA,SAAS,cAAoB;CACzB,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,eAAe,cAAc,GAAG;CAC5C,IAAI,kBAAkB,MAAM,kBAAkB;EAI1C,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,OAAO,gFAAgF,CAAC;EAC1G,QAAQ,IAAI,MAAM,KAAK,8EAA8E,CAAC;EACtG,QAAQ,IAAI,MAAM,KAAK,0DAA0D,MAAM,KAAK,yBAAyB,EAAE,EAAE,CAAC;CAC9H;CACA,QAAQ,IAAI,eAAe,MAAM,KAAK,SAAS,CAAC,GAAG;CACnD,QAAQ,IAAI,eAAe,MAAM,KAAK,WAAW,CAAC,GAAG;CACrD,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,KAAK,uBAAuB,EAAE,2BAA2B,CAAC;CAC5F,QAAQ,IAAI,EAAE;AAClB;AAEA,SAAS,eAAqB;CAE1B,IADe,WACX,CAAA,CAAO,YAAY,MAAM;EAMzB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,cAAc,GAAG;EAClC,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,sEAAsE,CAAC;EAC9F,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,cAAc,WAAW,EAAE,WAAW,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;EACtG,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,wBAAwB,MAAM,KAAK,yBAAyB,EAAE,EAAE,CAAC;EACxF,QAAQ,IAAI,EAAE;EACd;CACJ;CAIA,MAAM,QAAQ,aAAa,WAAW,EAAE,WAAW,MAAM,GAAG,QAAQ,IAAI,CAAC;CACzE,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,MAAM,KAAK,gBAAgB,CAAC;CAC5F,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;CACtF,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,mEAAmE,CAAC;CAC3F,QAAQ,IAAI,MAAM,KAAK,2DAA2D,CAAC;CACnF,QAAQ,IAAI,EAAE;AAClB;AAEA,SAAS,YAAkB;CACvB,QAAQ,IAAI;EACd,MAAM,KAAK,kBAAkB,EAAE,qDAAqD,MAAM,KAAK,aAAa,EAAE;;EAE9G,MAAM,KAAK,UAAU,EAAE;IACrB,MAAM,KAAK,QAAQ,EAAE,iDAAiD,MAAM,KAAK,WAAW,EAAE;IAC9F,MAAM,KAAK,MAAM,EAAE;IACnB,MAAM,KAAK,QAAQ,EAAE;IACrB,MAAM,KAAK,SAAS,EAAE;;EAExB,MAAM,KAAK,gBAAgB,EAAE;IAC3B,MAAM,KAAK,sBAAoB,EAAE,MAAM,MAAM,KAAK,aAAa,EAAE;;IAEjE,MAAM,KAAK,8EAA4E,EAAE;;EAE3F,MAAM,KAAK,aAAa,EAAE;IACxB,MAAM,KAAK,cAAc,EAAE;IAC3B,MAAM,KAAK,2BAA2B,EAAE;IACxC,MAAM,KAAK,2BAA2B,EAAE;;EAE1C,MAAM,KAAK,yEAAyE,EAAE;EACtF,MAAM,KAAK,wEAAwE,EAAE;CACtF;AACD"}
+{"version":3,"file":"telemetry-m9czTNGR.js","names":[],"sources":["../src/commands/telemetry.ts"],"sourcesContent":["import chalk from \"chalk\";\n\nimport { describeState, renderPreview } from \"../telemetry/consent\";\nimport { configPath, endpoint, previewEvent, readConfig, readProjectPolicy, setConsent } from \"../telemetry\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { unknownCommand } from \"../utils/unknown-command\";\n\n/**\n * `rebase telemetry` — the command that makes the rest of it inspectable.\n *\n * The whole subsystem asks for trust it cannot otherwise earn, and the cheapest\n * way to earn it is to stop describing the payload and print it. `show` runs\n * the same builder the sender uses, so what appears here is what would go, not\n * a documentation comment that quietly fell out of date two releases ago.\n */\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const TELEMETRY_SUBCOMMANDS = [\"status\", \"show\", \"enable\", \"disable\"] as const;\n\nexport async function telemetryCommand(rawArgs: string[]): Promise<void> {\n    // Checked before parsing, because `--help` is answered by the dispatcher\n    // and never by a handler. It used to be checked after a `filter(a =>\n    // !a.startsWith(\"-\"))` that stripped every flag off the line, so `rebase\n    // telemetry --help` reached `case undefined` and printed the status page.\n    if (wantsHelp(rawArgs)) {\n        printHelp();\n        return;\n    }\n\n    // Strictly, like every other family. That `filter` was not \"be lenient\": it\n    // deleted every `-`-prefixed token before dispatch, so `rebase telemetry\n    // --frobnicate` printed the status page and exited 0, and a mistyped\n    // `--disable` looked exactly like asking for the status. `parseCommandArgs`\n    // is the CLI's one rule for an undeclared flag, and the comment at the top\n    // of `utils/args.ts` is why: guessing that an unknown flag was meant as\n    // something else is the unsafe branch.\n    const { positionals } = parseCommandArgs({\n        spec: {},\n        rawArgs,\n        commandWords: 1,\n        command: \"telemetry\",\n        maxPositionals: 1\n    });\n    const subcommand = positionals[0];\n\n    switch (subcommand) {\n        case \"status\":\n        case undefined:\n            printStatus();\n            return;\n        case \"show\":\n            printPayload();\n            return;\n        case \"enable\":\n            if (!setConsent(true)) {\n                console.error(chalk.red(`Could not write ${configPath()} — sharing was not enabled.`));\n                process.exitCode = 1;\n                return;\n            }\n            console.log(chalk.green(\"Anonymous usage sharing enabled.\"));\n            console.log(chalk.gray(`Inspect what gets sent with ${chalk.cyan(\"rebase telemetry show\")}.`));\n            return;\n        case \"disable\":\n            if (!setConsent(false)) {\n                // The failure direction that matters. Someone turning sharing\n                // off must never be left believing it worked — so this is loud,\n                // non-zero, and points at the switch that needs no disk.\n                console.error(chalk.red(`Could not write ${configPath()} — sharing is still ON.`));\n                console.error(chalk.yellow(`Set ${chalk.cyan(\"REBASE_TELEMETRY_DISABLED=1\")} in your environment instead; it needs no file.`));\n                process.exitCode = 1;\n                return;\n            }\n            console.log(chalk.gray(\"Anonymous usage sharing disabled. Nothing further will be sent.\"));\n            return;\n        default:\n            // Printing the help and setting exit 1 said nothing about *why*:\n            // the page that came back looked like the page `rebase telemetry\n            // --help` prints, and the only difference was an exit code nobody\n            // reads at a prompt.\n            unknownCommand(subcommand, TELEMETRY_SUBCOMMANDS, \"telemetry\");\n    }\n}\n\nfunction printStatus(): void {\n    console.log(\"\");\n    console.log(`  Status:   ${describeState()}`);\n    if (readProjectPolicy() === \"ignored_opt_in\") {\n        // Said out loud rather than silently ignored: a maintainer who wrote\n        // `\"telemetry\": true` believes they turned something on, and leaving\n        // them to believe it is worse than refusing.\n        console.log(\"\");\n        console.log(chalk.yellow(\"  Note: this project's rebase.json sets \\\"telemetry\\\": true, which is ignored.\"));\n        console.log(chalk.gray(\"        A committed file cannot consent on behalf of everyone who clones it.\"));\n        console.log(chalk.gray(`        Only \"telemetry\": false is honoured there. Use ${chalk.cyan(\"rebase telemetry enable\")}.`));\n    }\n    console.log(`  Endpoint: ${chalk.gray(endpoint())}`);\n    console.log(`  Config:   ${chalk.gray(configPath())}`);\n    console.log(\"\");\n    console.log(chalk.gray(`  ${chalk.cyan(\"rebase telemetry show\")} prints the exact payload.`));\n    console.log(\"\");\n}\n\nfunction printPayload(): void {\n    const config = readConfig();\n    if (config.enabled !== true) {\n        // Deliberately still prints one. The consent prompt points here so the\n        // question can stay short, and someone deciding whether to say yes is\n        // exactly the person who most needs to see the payload — telling them\n        // to enable sharing first, in order to find out what sharing sends,\n        // is the wrong way round.\n        console.log(\"\");\n        console.log(`  ${describeState()}`);\n        console.log(\"\");\n        console.log(chalk.gray(\"  Nothing is being sent. This is what WOULD be sent if you said yes:\"));\n        console.log(\"\");\n        console.log(renderPreview(\"cli.dev\", { first_run: false }).split(\"\\n\").map((l) => \"  \" + l).join(\"\\n\"));\n        console.log(\"\");\n        console.log(chalk.gray(`  Start sharing with ${chalk.cyan(\"rebase telemetry enable\")}.`));\n        console.log(\"\");\n        return;\n    }\n\n    // A representative event rather than a synthetic one: `cli.dev` is the\n    // event that fires most often, so it is the one worth being sure about.\n    const event = previewEvent(\"cli.dev\", { first_run: false }, process.cwd());\n    console.log(\"\");\n    console.log(chalk.gray(\"  Sent to \") + chalk.gray(endpoint()) + chalk.gray(\", for example:\"));\n    console.log(\"\");\n    console.log(JSON.stringify(event, null, 2).split(\"\\n\").map((l) => \"  \" + l).join(\"\\n\"));\n    console.log(\"\");\n    console.log(chalk.gray(\"  Both ids are random. Neither is derived from your machine, your\"));\n    console.log(chalk.gray(\"  hostname, your project name or anything you have typed.\"));\n    console.log(\"\");\n}\n\nfunction printHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase telemetry\")} — anonymous usage sharing (off until you say yes; ${chalk.cyan(\"rebase init\")} asks)\n\n${chalk.bold(\"Commands\")}\n  ${chalk.blue(\"status\")}     Whether anything is being shared, and why ${chalk.gray(\"(default)\")}\n  ${chalk.blue(\"show\")}       Print the exact payload that would be sent\n  ${chalk.blue(\"enable\")}     Start sharing\n  ${chalk.blue(\"disable\")}    Stop sharing, permanently\n\n${chalk.bold(\"Project policy\")}\n  ${chalk.blue('\"telemetry\": false')} in ${chalk.blue(\"rebase.json\")} disables sharing for everyone who\n  clones the repository, overriding each developer's own choice.\n  ${chalk.gray('\"telemetry\": true is ignored — a committed file cannot consent for others.')}\n\n${chalk.bold(\"Environment\")}\n  ${chalk.blue(\"DO_NOT_TRACK\")}                 Set to disable, across every tool that honours it\n  ${chalk.blue(\"REBASE_TELEMETRY_DISABLED\")}    Set to disable Rebase specifically\n  ${chalk.blue(\"REBASE_TELEMETRY_ENDPOINT\")}    Send elsewhere — your own collector, for instance\n\n${chalk.gray(\"Never shared: project names, paths, collection or table names, database\")}\n${chalk.gray(\"URLs, hostnames, error messages, stack traces, or exact record counts.\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;AAgBA,IAAa,wBAAwB;CAAC;CAAU;CAAQ;CAAU;AAAS;AAE3E,eAAsB,iBAAiB,SAAkC;CAKrE,IAAI,UAAU,OAAO,GAAG;EACpB,UAAU;EACV;CACJ;CASA,MAAM,EAAE,gBAAgB,iBAAiB;EACrC,MAAM,CAAC;EACP;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CACD,MAAM,aAAa,YAAY;CAE/B,QAAQ,YAAR;EACI,KAAK;EACL,KAAK,KAAA;GACD,YAAY;GACZ;EACJ,KAAK;GACD,aAAa;GACb;EACJ,KAAK;GACD,IAAI,CAAC,WAAW,IAAI,GAAG;IACnB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,WAAW,EAAE,4BAA4B,CAAC;IACrF,QAAQ,WAAW;IACnB;GACJ;GACA,QAAQ,IAAI,MAAM,MAAM,kCAAkC,CAAC;GAC3D,QAAQ,IAAI,MAAM,KAAK,+BAA+B,MAAM,KAAK,uBAAuB,EAAE,EAAE,CAAC;GAC7F;EACJ,KAAK;GACD,IAAI,CAAC,WAAW,KAAK,GAAG;IAIpB,QAAQ,MAAM,MAAM,IAAI,mBAAmB,WAAW,EAAE,wBAAwB,CAAC;IACjF,QAAQ,MAAM,MAAM,OAAO,OAAO,MAAM,KAAK,6BAA6B,EAAE,gDAAgD,CAAC;IAC7H,QAAQ,WAAW;IACnB;GACJ;GACA,QAAQ,IAAI,MAAM,KAAK,iEAAiE,CAAC;GACzF;EACJ,SAKI,eAAe,YAAY,uBAAuB,WAAW;CACrE;AACJ;AAEA,SAAS,cAAoB;CACzB,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,eAAe,cAAc,GAAG;CAC5C,IAAI,kBAAkB,MAAM,kBAAkB;EAI1C,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,OAAO,gFAAgF,CAAC;EAC1G,QAAQ,IAAI,MAAM,KAAK,8EAA8E,CAAC;EACtG,QAAQ,IAAI,MAAM,KAAK,0DAA0D,MAAM,KAAK,yBAAyB,EAAE,EAAE,CAAC;CAC9H;CACA,QAAQ,IAAI,eAAe,MAAM,KAAK,SAAS,CAAC,GAAG;CACnD,QAAQ,IAAI,eAAe,MAAM,KAAK,WAAW,CAAC,GAAG;CACrD,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,KAAK,uBAAuB,EAAE,2BAA2B,CAAC;CAC5F,QAAQ,IAAI,EAAE;AAClB;AAEA,SAAS,eAAqB;CAE1B,IADe,WACX,CAAA,CAAO,YAAY,MAAM;EAMzB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,cAAc,GAAG;EAClC,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,sEAAsE,CAAC;EAC9F,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,cAAc,WAAW,EAAE,WAAW,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;EACtG,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,wBAAwB,MAAM,KAAK,yBAAyB,EAAE,EAAE,CAAC;EACxF,QAAQ,IAAI,EAAE;EACd;CACJ;CAIA,MAAM,QAAQ,aAAa,WAAW,EAAE,WAAW,MAAM,GAAG,QAAQ,IAAI,CAAC;CACzE,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,YAAY,IAAI,MAAM,KAAK,SAAS,CAAC,IAAI,MAAM,KAAK,gBAAgB,CAAC;CAC5F,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,MAAM,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;CACtF,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,MAAM,KAAK,mEAAmE,CAAC;CAC3F,QAAQ,IAAI,MAAM,KAAK,2DAA2D,CAAC;CACnF,QAAQ,IAAI,EAAE;AAClB;AAEA,SAAS,YAAkB;CACvB,QAAQ,IAAI;EACd,MAAM,KAAK,kBAAkB,EAAE,qDAAqD,MAAM,KAAK,aAAa,EAAE;;EAE9G,MAAM,KAAK,UAAU,EAAE;IACrB,MAAM,KAAK,QAAQ,EAAE,iDAAiD,MAAM,KAAK,WAAW,EAAE;IAC9F,MAAM,KAAK,MAAM,EAAE;IACnB,MAAM,KAAK,QAAQ,EAAE;IACrB,MAAM,KAAK,SAAS,EAAE;;EAExB,MAAM,KAAK,gBAAgB,EAAE;IAC3B,MAAM,KAAK,sBAAoB,EAAE,MAAM,MAAM,KAAK,aAAa,EAAE;;IAEjE,MAAM,KAAK,8EAA4E,EAAE;;EAE3F,MAAM,KAAK,aAAa,EAAE;IACxB,MAAM,KAAK,cAAc,EAAE;IAC3B,MAAM,KAAK,2BAA2B,EAAE;IACxC,MAAM,KAAK,2BAA2B,EAAE;;EAE1C,MAAM,KAAK,yEAAyE,EAAE;EACtF,MAAM,KAAK,wEAAwE,EAAE;CACtF;AACD"}

package/dist/{upgrade-DbuKX9lv.js → upgrade-DjihWuZL.js}

@@ -1,6 +1,6 @@
 import { n as getPMCommands } from "./package-manager-DSEOwTqM.js";
 import { i as failAsJson, p as requireProjectRoot } from "./project-Wp2zoyeN.js";
-import { n as parseCommandArgs, r as wantsHelp } from "./args-CcBphFdj.js";
+import { n as parseCommandArgs, r as wantsHelp } from "./args-BX0YD14a.js";
 import { o as ManifestError, p as loadManifest } from "./manifest-DRp0UVTj.js";
 import chalk from "chalk";
 import fs from "fs";
@@ -1258,7 +1258,8 @@ async function upgradeCommand(rawArgs, io = defaultIo) {
 		dryRun,
 		wrote,
 		installed,
-		installLine
+		installLine,
+		wouldRefuse: dryRun ? downgradeRefusal : null
 	});
 }
 /** Changes grouped by file, then what was left alone and why, then overrides. */
@@ -1318,7 +1319,7 @@ function printOutcome(plan, outcome) {
 		return;
 	}
 	if (outcome.dryRun) {
-		console.log(chalk.gray(moved === 0 ? `  Nothing to change: this project is already on ${plan.target}.` : "  Dry run — nothing was written. Run it without --dry-run to apply."));
+		console.log(chalk.gray(moved === 0 ? `  Nothing to change: this project is already on ${plan.target}.` : outcome.wouldRefuse ? `  Dry run — nothing was written, and a real run refuses it. ${outcome.wouldRefuse.hint}` : "  Dry run — nothing was written. Run it without --dry-run to apply."));
 		console.log("");
 		return;
 	}
@@ -1336,4 +1337,4 @@ function printOutcome(plan, outcome) {
 //#endregion
 export { upgradeCommand };
 
-//# sourceMappingURL=upgrade-DbuKX9lv.js.map
+//# sourceMappingURL=upgrade-DjihWuZL.js.map