@rebasepro/cli 0.25.0-canary.ge06257e → 0.25.0

package/dist/{args-CcBphFdj.js → args-BX0YD14a.js}

@@ -1,5 +1,19 @@
 import chalk from "chalk";
 import arg from "arg";
+//#region src/utils/redact.ts
+/**
+* Connection-string passwords, replaced before a line is printed.
+*
+* A refusal that repeats what was typed repeats a password with it, and these
+* lines land in terminals, CI logs and issues. `user:***@` is the form every
+* other message uses: the driver's `redactConnectionPasswords` in
+* `@rebasepro/server-postgres`, which its entry does not export, and this
+* mirrors. Covers the user-info password and a `password=` parameter.
+*/
+function redactConnectionPasswords(text) {
+	return text.replace(/(\b[a-z][a-z0-9+.-]*:\/\/[^\s/?#@'"]*):[^\s/?#'"]*@/gi, "$1:***@").replace(/(\bpassword\s*=\s*)('[^']*'|[^\s&'"]+)/gi, "$1***");
+}
+//#endregion
 //#region src/utils/unknown-command.ts
 /**
 * What every command family says when it does not recognise a subcommand.
@@ -156,16 +170,37 @@ var GLOBAL_COMMAND_FLAGS = {
 	"-h": "--help"
 };
 /**
-* The declared long flag an undeclared one was probably meant to be, from
-* `arg`'s `unknown or unexpected option: --form`: one edit or one swap away
-* (`--from`), the way the driver's flag check and `db backup` answer a typo.
+* The declared long flag an undeclared one was probably meant to be: one edit
+* or one swap away (`--form` → `--from`), or an abbreviation of exactly one
+* (`--anon` → `--anonymize`).
 */
-function closestDeclaredFlag(argMessage, declared) {
-	const typed = /option: (--[^\s=]+)/.exec(argMessage)?.[1];
-	if (!typed) return void 0;
+function closestDeclaredFlag(typed, declared) {
+	if (!typed.startsWith("--")) return void 0;
 	const near = suggestCommand(typed.slice(2), declared.filter((flag) => flag.startsWith("--")).map((flag) => flag.slice(2)));
 	return near ? `--${near}` : void 0;
 }
+/** Past this many, a refusal names the help page rather than listing every flag. */
+var LISTED_FLAGS_MAX = 8;
+/**
+* The sentence an undeclared flag is refused with — the one `db backup`,
+* `db restore` and `db branch` say, so one CLI answers a typo one way:
+*
+*     `rebase db pull` has no option --anonymise — did you mean --anonymize?
+*     Nothing was run. See `rebase db pull --help`.
+*
+* With nothing close it lists what the command takes, when that list is short
+* enough to read.
+*
+* Exported for the commands that refuse a flag outside `parseCommandArgs`.
+*/
+function unknownOptionMessage(command, typed, spec) {
+	const near = closestDeclaredFlag(typed, Object.keys({
+		...GLOBAL_COMMAND_FLAGS,
+		...spec
+	}));
+	const own = Object.keys(spec).filter((flag) => flag.startsWith("--") && !(flag in GLOBAL_COMMAND_FLAGS));
+	return `\`rebase ${command}\` has no option ${typed}${near ? ` — did you mean ${near}?` : own.length === 0 ? " — it takes no options." : own.length <= LISTED_FLAGS_MAX ? ` — it takes ${own.join(", ")}.` : "."} Nothing was run. See \`rebase ${command} --help\`.`;
+}
 /** Did the line ask for help? Answered before dispatch, never by a handler. */
 function wantsHelp(rawArgs) {
 	return rawArgs.includes("--help") || rawArgs.includes("-h");
@@ -213,18 +248,12 @@ function parseCommandArgs({ spec, rawArgs, commandWords, command, maxPositionals
 			...spec
 		}, { argv: rawArgs.slice(2) });
 	} catch (err) {
-		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") {
-			const near = closestDeclaredFlag(err.message, Object.keys({
-				...GLOBAL_COMMAND_FLAGS,
-				...spec
-			}));
-			throw new UsageError(`${err.message}${near ? ` (did you mean ${near}?)` : ""} — run \`rebase ${command} --help\` for the options it takes.`);
-		}
+		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new UsageError(unknownOptionMessage(command, (/option: (\S+)$/.exec(err.message)?.[1] ?? err.message).split("=")[0], spec));
 		throw err;
 	}
 	const positionals = parsed._.slice(commandWords);
 	for (const value of positionals) if (value.startsWith("-")) throw new UsageError(`\`${value}\` looks like an option, not a value — pass it with an explicit flag (\`rebase ${command} --help\`).`);
-	if (maxPositionals !== void 0 && positionals.length > maxPositionals) throw new UsageError(`rebase ${command} takes ${maxPositionals} argument${maxPositionals === 1 ? "" : "s"}, got ${positionals.length}: ${positionals.join(" ")}`);
+	if (maxPositionals !== void 0 && positionals.length > maxPositionals) throw new UsageError(`rebase ${command} takes ${maxPositionals} argument${maxPositionals === 1 ? "" : "s"}, got ${positionals.length}: ${redactConnectionPasswords(positionals.join(" "))}`);
 	return {
 		flags: parsed,
 		positionals,
@@ -232,6 +261,6 @@ function parseCommandArgs({ spec, rawArgs, commandWords, command, maxPositionals
 	};
 }
 //#endregion
-export { unknownCommand as a, suggestCommand as i, parseCommandArgs as n, unknownCommandMessage as o, wantsHelp as r, UsageError as t };
+export { unknownCommand as a, suggestCommand as i, parseCommandArgs as n, unknownCommandMessage as o, wantsHelp as r, redactConnectionPasswords as s, UsageError as t };
 
-//# sourceMappingURL=args-CcBphFdj.js.map
+//# sourceMappingURL=args-BX0YD14a.js.map

package/dist/args-BX0YD14a.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"args-BX0YD14a.js","names":[],"sources":["../src/utils/redact.ts","../src/utils/unknown-command.ts","../src/utils/args.ts"],"sourcesContent":["/**\n * Connection-string passwords, replaced before a line is printed.\n *\n * A refusal that repeats what was typed repeats a password with it, and these\n * lines land in terminals, CI logs and issues. `user:***@` is the form every\n * other message uses: the driver's `redactConnectionPasswords` in\n * `@rebasepro/server-postgres`, which its entry does not export, and this\n * mirrors. Covers the user-info password and a `password=` parameter.\n */\nexport function redactConnectionPasswords(text: string): string {\n    return text\n        .replace(/(\\b[a-z][a-z0-9+.-]*:\\/\\/[^\\s/?#@'\"]*):[^\\s/?#'\"]*@/gi, \"$1:***@\")\n        .replace(/(\\bpassword\\s*=\\s*)('[^']*'|[^\\s&'\"]+)/gi, \"$1***\");\n}\n","/**\n * What every command family says when it does not recognise a subcommand.\n *\n * Six families each did it differently, and the differences were not stylistic:\n *\n *   rebase statsu       \"Unknown command: statsu\" + the whole top-level help\n *   rebase auth foo     \"Unknown auth command: foo\" + the whole auth help\n *   rebase apps foo     \"Unknown subcommand: foo\"   — which command's?\n *   rebase skills foo   \"Unknown skills subcommand: foo\" + the whole help\n *   rebase telemetry x  the help, silently, with exit code 1 and no error line\n *   rebase cloud debug x both a JSON error *and* the human one, in JSON mode\n *\n * Dumping a screen of help after an error is the wrong shape: the one line that\n * says what happened scrolls off the top, and in a CI log it is buried in\n * forty. None of them offered the correction, which for a typo is the entire\n * answer — `statsu` is one transposition from `status`.\n *\n * So: one line, the near-miss when there is one, and where to read the rest.\n */\nimport chalk from \"chalk\";\n\n/**\n * Damerau–Levenshtein distance, capped by the caller.\n *\n * The transposition is the reason this is not plain Levenshtein: `statsu` for\n * `status` and `craete` for `create` are the two most common typing errors\n * there are, and both are distance 2 without it — the same as two unrelated\n * edits, which is too far to suggest anything at all.\n */\nfunction editDistance(a: string, b: string): number {\n    const rows = a.length + 1;\n    const cols = b.length + 1;\n    const d: number[][] = Array.from({ length: rows }, () => new Array<number>(cols).fill(0));\n\n    for (let i = 0; i < rows; i++) d[i][0] = i;\n    for (let j = 0; j < cols; j++) d[0][j] = j;\n\n    for (let i = 1; i < rows; i++) {\n        for (let j = 1; j < cols; j++) {\n            const cost = a[i - 1] === b[j - 1] ? 0 : 1;\n            d[i][j] = Math.min(\n                d[i - 1][j] + 1,\n                d[i][j - 1] + 1,\n                d[i - 1][j - 1] + cost\n            );\n            if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) {\n                d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);\n            }\n        }\n    }\n    return d[a.length][b.length];\n}\n\n/**\n * The one command the user probably meant, or nothing.\n *\n * Tight on purpose. A suggestion that is wrong is worse than none: it sends\n * someone to read the help for a command that was never the answer, and on a\n * family like `db` — where `push` and `pull` are one edit apart — a loose\n * threshold would confidently propose the destructive neighbour of what they\n * typed. So: one edit for a short word, two for a long one, and a prefix match\n * always counts (`rebase cloud dep` for `deploy`).\n */\nexport function suggestCommand(typed: string, known: readonly string[]): string | undefined {\n    const word = typed.toLowerCase();\n    if (!word) return undefined;\n\n    // An abbreviation, but only when it names exactly one command. \"res\" is a\n    // prefix of both `reset` and `restore`, and picking whichever comes first\n    // in the list would be a coin toss dressed up as an answer.\n    if (word.length >= 3) {\n        const prefixed = known.filter(name => name.toLowerCase().startsWith(word));\n        if (prefixed.length === 1) return prefixed[0];\n    }\n\n    const budget = word.length <= 4 ? 1 : 2;\n    let best: { name: string; distance: number } | undefined;\n\n    for (const candidate of known) {\n        const distance = editDistance(word, candidate.toLowerCase());\n        if (distance > budget) continue;\n        if (!best || distance < best.distance) best = { name: candidate, distance };\n    }\n\n    return best?.name;\n}\n\n/**\n * The family command a word names exactly, as `<family> <command>`, or nothing.\n *\n * `rebase deploy` is `rebase cloud deploy`: the word is a whole command one\n * level down. Exact only — a near miss there is a guess about both the family\n * and the command.\n */\nfunction familyCommand(typed: string, families: Readonly<Record<string, readonly string[]>>): string | undefined {\n    const word = typed.toLowerCase();\n    for (const [family, commands] of Object.entries(families)) {\n        const match = commands.find(name => name.toLowerCase() === word);\n        if (match) return `${family} ${match}`;\n    }\n    return undefined;\n}\n\n/**\n * The line itself, without printing it — so callers that must answer in JSON\n * (the cloud family, whose `fail()` writes a machine-readable envelope) use the\n * same words as the ones that print.\n *\n * `family` is empty for the top level: `rebase --help`, not `rebase  --help`.\n * `families` are the command families below this level, by name, whose\n * commands a word may be one of.\n */\nexport function unknownCommandMessage(\n    typed: string | undefined,\n    known: readonly string[],\n    family = \"\",\n    families: Readonly<Record<string, readonly string[]>> = {}\n): string {\n    const what = family ? `${family} command` : \"command\";\n    const suggestion = typed ? suggestCommand(typed, known) ?? familyCommand(typed, families) : undefined;\n    const help = family ? `rebase ${family} --help` : \"rebase --help\";\n\n    return suggestion\n        ? `Unknown ${what} \"${typed}\" — did you mean \\`${suggestion}\\`? Run \\`${help}\\` for the rest.`\n        : `Unknown ${what} \"${typed ?? \"\"}\". Run \\`${help}\\` for the ones there are.`;\n}\n\n/**\n * Print the line to stderr and exit 1.\n *\n * stderr, not stdout: a mistyped command is a failure, and the families with a\n * `--json` mode guarantee that stdout holds only their envelope.\n */\nexport function unknownCommand(\n    typed: string | undefined,\n    known: readonly string[],\n    family = \"\",\n    families: Readonly<Record<string, readonly string[]>> = {}\n): never {\n    console.error(chalk.red(`✗ ${unknownCommandMessage(typed, known, family, families)}`));\n    process.exit(1);\n}\n","/**\n * Argument parsing for the commands that take positional arguments.\n *\n * Every command in the small group used to parse its own line the same way:\n * `arg(spec, { argv: rawArgs.slice(4), permissive: true })`, then read `_[0]`\n * and `_[1]`. Both halves of that are wrong in a way that costs data.\n *\n *  - **`permissive: true` turns an unknown flag into a positional.** `arg`\n *    pushes an undeclared flag into `_` as a bare token, so `_[1]` is whatever\n *    came second on the line, flag or not. `rebase auth reset-password\n *    bob@example.com --debug` set Bob's password to the literal `--debug` — and\n *    `--debug` is what `bin/rebase.js` prints after *every* failure as the thing\n *    to re-run with, so the single most likely next keystroke after a failed\n *    reset was the one that reset the account to a two-word string.\n *  - **`slice(4)` assumes the command words are at fixed indices.** They are\n *    not: a flag before the command shifts everything, so `rebase --debug auth\n *    reset-password bob@example.com NewPass1!` read the email as\n *    `reset-password` and the password as `bob@example.com`.\n *\n * So: parse the *whole* line — `rawArgs` is `process.argv` — against a spec\n * strictly, with no permissive mode. `arg` then consumes every flag wherever it\n * appears and rejects the ones nobody declared, which leaves `_` holding the\n * command words followed by the real positionals, in order and at a known\n * offset. An unrecognised flag becomes an error naming the command's help,\n * which is the only safe answer: the alternative is guessing that it was meant\n * as a value.\n *\n * `commands/cloud/index.ts` resolves its positionals against its own spec for\n * the same reason; this is that idea for the commands whose positionals are\n * credentials rather than resource names.\n */\nimport arg from \"arg\";\n\nimport { redactConnectionPasswords } from \"./redact\";\nimport { suggestCommand } from \"./unknown-command\";\n\n/**\n * Flags accepted on top of whatever a command declares.\n *\n * `--debug` is read by `bin/rebase.js` off `process.argv` and never by a\n * command, but it has to be *declared* somewhere or strict parsing rejects the\n * exact flag the CLI tells people to add. `--help`/`-h` are answered by each\n * command's dispatcher before any work happens.\n */\nexport const GLOBAL_COMMAND_FLAGS = {\n    \"--debug\": Boolean,\n    \"--help\": Boolean,\n    \"-h\": \"--help\"\n} as const;\n\n/**\n * The declared long flag an undeclared one was probably meant to be: one edit\n * or one swap away (`--form` → `--from`), or an abbreviation of exactly one\n * (`--anon` → `--anonymize`).\n */\nfunction closestDeclaredFlag(typed: string, declared: readonly string[]): string | undefined {\n    if (!typed.startsWith(\"--\")) return undefined;\n    const near = suggestCommand(typed.slice(2), declared.filter(flag => flag.startsWith(\"--\")).map(flag => flag.slice(2)));\n    return near ? `--${near}` : undefined;\n}\n\n/** Past this many, a refusal names the help page rather than listing every flag. */\nconst LISTED_FLAGS_MAX = 8;\n\n/**\n * The sentence an undeclared flag is refused with — the one `db backup`,\n * `db restore` and `db branch` say, so one CLI answers a typo one way:\n *\n *     `rebase db pull` has no option --anonymise — did you mean --anonymize?\n *     Nothing was run. See `rebase db pull --help`.\n *\n * With nothing close it lists what the command takes, when that list is short\n * enough to read.\n *\n * Exported for the commands that refuse a flag outside `parseCommandArgs`.\n */\nexport function unknownOptionMessage(command: string, typed: string, spec: Readonly<Record<string, unknown>>): string {\n    const declared = Object.keys({ ...GLOBAL_COMMAND_FLAGS, ...spec });\n    const near = closestDeclaredFlag(typed, declared);\n    const own = Object.keys(spec).filter(flag => flag.startsWith(\"--\") && !(flag in GLOBAL_COMMAND_FLAGS));\n    const takes = near\n        ? ` — did you mean ${near}?`\n        : own.length === 0\n            ? \" — it takes no options.\"\n            : own.length <= LISTED_FLAGS_MAX ? ` — it takes ${own.join(\", \")}.` : \".\";\n\n    return `\\`rebase ${command}\\` has no option ${typed}${takes} Nothing was run. See \\`rebase ${command} --help\\`.`;\n}\n\nexport interface ParsedCommand<S extends arg.Spec> {\n    /** The declared flags, as `arg` resolved them. */\n    flags: arg.Result<S>;\n    /** What is left after the command words — never a flag. */\n    positionals: string[];\n    /** `--help` or `-h` appeared anywhere on the line. */\n    help: boolean;\n}\n\n/** Did the line ask for help? Answered before dispatch, never by a handler. */\nexport function wantsHelp(rawArgs: string[]): boolean {\n    return rawArgs.includes(\"--help\") || rawArgs.includes(\"-h\");\n}\n\n/**\n * The command line was wrong — nothing ran, and there is no stack to want.\n *\n * `bin/rebase.js` ends every failure with \"Re-run with --debug for the stack\n * trace.\", which is right when something broke inside a command and absurd for\n * a typo: the stack points at `arg` and this file, neither of which the person\n * who mistyped `--ouput` has any interest in. Worse, `--debug` is a flag, so\n * the suggested next command is *another* command line — and the one thing we\n * have just established is that the command line is what went wrong.\n *\n * Marked with a property rather than left to `instanceof`, because the reader\n * is `bin/rebase.js`: it imports the bundle, so the class object it would test\n * against is not the one this file compiled to.\n */\nexport class UsageError extends Error {\n    readonly isUsageError = true;\n\n    constructor(message: string) {\n        super(message);\n        this.name = \"UsageError\";\n    }\n}\n\n/**\n * Resolve a command's flags and positionals from the full `process.argv`.\n *\n * `commandWords` is how many words name the command itself — 2 for\n * `auth reset-password`, 1 for `start` — and is applied to the *parsed*\n * positionals rather than to `argv`, so a flag placed before the command no\n * longer shifts them.\n *\n * `command` names the command in error messages, e.g. `auth reset-password`.\n *\n * Throws on an unknown flag, on a positional that looks like a flag, and on\n * more positionals than the command takes. `bin/rebase.js` turns each into a\n * one-line `✗ …` and exit 1.\n */\nexport function parseCommandArgs<S extends arg.Spec>({\n    spec,\n    rawArgs,\n    commandWords,\n    command,\n    maxPositionals\n}: {\n    spec: S;\n    rawArgs: string[];\n    commandWords: number;\n    command: string;\n    maxPositionals?: number;\n}): ParsedCommand<S> {\n    let parsed: arg.Result<S> & { \"--help\"?: boolean };\n    try {\n        const merged = {\n            ...GLOBAL_COMMAND_FLAGS,\n            ...spec\n        };\n        parsed = arg(merged, { argv: rawArgs.slice(2) }) as arg.Result<S> & { \"--help\"?: boolean };\n    } catch (err) {\n        if (err instanceof Error && (err as arg.ArgError).code === \"ARG_UNKNOWN_OPTION\") {\n            // arg's wording: `unknown or unexpected option: --form`.\n            const typed = /option: (\\S+)$/.exec(err.message)?.[1] ?? err.message;\n            throw new UsageError(unknownOptionMessage(command, typed.split(\"=\")[0], spec));\n        }\n        throw err;\n    }\n\n    const positionals = parsed._.slice(commandWords);\n\n    for (const value of positionals) {\n        // Only reachable past a `--` separator or for a bare `-`, since anything\n        // else beginning with `-` was either declared or already rejected above.\n        // Still refused rather than accepted: a value that looks like a flag is\n        // as likely to be a typo as an argument, and one of these positions is a\n        // password.\n        if (value.startsWith(\"-\")) {\n            throw new UsageError(\n                `\\`${value}\\` looks like an option, not a value — pass it with an explicit flag ` +\n                `(\\`rebase ${command} --help\\`).`\n            );\n        }\n    }\n\n    if (maxPositionals !== undefined && positionals.length > maxPositionals) {\n        // Redacted: a connection string passed where a flag's value belongs\n        // (`rebase db pull \"$PROD\"`) is still a password.\n        throw new UsageError(\n            `rebase ${command} takes ${maxPositionals} argument${maxPositionals === 1 ? \"\" : \"s\"}, ` +\n            `got ${positionals.length}: ${redactConnectionPasswords(positionals.join(\" \"))}`\n        );\n    }\n\n    return {\n        flags: parsed,\n        positionals,\n        help: Boolean(parsed[\"--help\"])\n    };\n}\n"],"mappings":";;;;;;;;;;;;AASA,SAAgB,0BAA0B,MAAsB;CAC5D,OAAO,KACF,QAAQ,yDAAyD,SAAS,CAAC,CAC3E,QAAQ,4CAA4C,OAAO;AACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACgBA,SAAS,aAAa,GAAW,GAAmB;CAChD,MAAM,OAAO,EAAE,SAAS;CACxB,MAAM,OAAO,EAAE,SAAS;CACxB,MAAM,IAAgB,MAAM,KAAK,EAAE,QAAQ,KAAK,SAAS,IAAI,MAAc,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;CAExF,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC,KAAK;CACzC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC,KAAK;CAEzC,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KACtB,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,KAAK;EAC3B,MAAM,OAAO,EAAE,IAAI,OAAO,EAAE,IAAI,KAAK,IAAI;EACzC,EAAE,EAAE,CAAC,KAAK,KAAK,IACX,EAAE,IAAI,EAAE,CAAC,KAAK,GACd,EAAE,EAAE,CAAC,IAAI,KAAK,GACd,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,IACtB;EACA,IAAI,IAAI,KAAK,IAAI,KAAK,EAAE,IAAI,OAAO,EAAE,IAAI,MAAM,EAAE,IAAI,OAAO,EAAE,IAAI,IAC9D,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,KAAK,CAAC;CAEvD;CAEJ,OAAO,EAAE,EAAE,OAAO,CAAC,EAAE;AACzB;;;;;;;;;;;AAYA,SAAgB,eAAe,OAAe,OAA8C;CACxF,MAAM,OAAO,MAAM,YAAY;CAC/B,IAAI,CAAC,MAAM,OAAO,KAAA;CAKlB,IAAI,KAAK,UAAU,GAAG;EAClB,MAAM,WAAW,MAAM,QAAO,SAAQ,KAAK,YAAY,CAAC,CAAC,WAAW,IAAI,CAAC;EACzE,IAAI,SAAS,WAAW,GAAG,OAAO,SAAS;CAC/C;CAEA,MAAM,SAAS,KAAK,UAAU,IAAI,IAAI;CACtC,IAAI;CAEJ,KAAK,MAAM,aAAa,OAAO;EAC3B,MAAM,WAAW,aAAa,MAAM,UAAU,YAAY,CAAC;EAC3D,IAAI,WAAW,QAAQ;EACvB,IAAI,CAAC,QAAQ,WAAW,KAAK,UAAU,OAAO;GAAE,MAAM;GAAW;EAAS;CAC9E;CAEA,OAAO,MAAM;AACjB;;;;;;;;AASA,SAAS,cAAc,OAAe,UAA2E;CAC7G,MAAM,OAAO,MAAM,YAAY;CAC/B,KAAK,MAAM,CAAC,QAAQ,aAAa,OAAO,QAAQ,QAAQ,GAAG;EACvD,MAAM,QAAQ,SAAS,MAAK,SAAQ,KAAK,YAAY,MAAM,IAAI;EAC/D,IAAI,OAAO,OAAO,GAAG,OAAO,GAAG;CACnC;AAEJ;;;;;;;;;;AAWA,SAAgB,sBACZ,OACA,OACA,SAAS,IACT,WAAwD,CAAC,GACnD;CACN,MAAM,OAAO,SAAS,GAAG,OAAO,YAAY;CAC5C,MAAM,aAAa,QAAQ,eAAe,OAAO,KAAK,KAAK,cAAc,OAAO,QAAQ,IAAI,KAAA;CAC5F,MAAM,OAAO,SAAS,UAAU,OAAO,WAAW;CAElD,OAAO,aACD,WAAW,KAAK,IAAI,MAAM,qBAAqB,WAAW,YAAY,KAAK,oBAC3E,WAAW,KAAK,IAAI,SAAS,GAAG,WAAW,KAAK;AAC1D;;;;;;;AAQA,SAAgB,eACZ,OACA,OACA,SAAS,IACT,WAAwD,CAAC,GACpD;CACL,QAAQ,MAAM,MAAM,IAAI,KAAK,sBAAsB,OAAO,OAAO,QAAQ,QAAQ,GAAG,CAAC;CACrF,QAAQ,KAAK,CAAC;AAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACjGA,IAAa,uBAAuB;CAChC,WAAW;CACX,UAAU;CACV,MAAM;AACV;;;;;;AAOA,SAAS,oBAAoB,OAAe,UAAiD;CACzF,IAAI,CAAC,MAAM,WAAW,IAAI,GAAG,OAAO,KAAA;CACpC,MAAM,OAAO,eAAe,MAAM,MAAM,CAAC,GAAG,SAAS,QAAO,SAAQ,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,KAAI,SAAQ,KAAK,MAAM,CAAC,CAAC,CAAC;CACrH,OAAO,OAAO,KAAK,SAAS,KAAA;AAChC;;AAGA,IAAM,mBAAmB;;;;;;;;;;;;;AAczB,SAAgB,qBAAqB,SAAiB,OAAe,MAAiD;CAElH,MAAM,OAAO,oBAAoB,OADhB,OAAO,KAAK;EAAE,GAAG;EAAsB,GAAG;CAAK,CACxB,CAAQ;CAChD,MAAM,MAAM,OAAO,KAAK,IAAI,CAAC,CAAC,QAAO,SAAQ,KAAK,WAAW,IAAI,KAAK,EAAE,QAAQ,qBAAqB;CAOrG,OAAO,YAAY,QAAQ,mBAAmB,QANhC,OACR,mBAAmB,KAAK,KACxB,IAAI,WAAW,IACX,4BACA,IAAI,UAAU,mBAAmB,eAAe,IAAI,KAAK,IAAI,EAAE,KAAK,IAElB,iCAAiC,QAAQ;AACzG;;AAYA,SAAgB,UAAU,SAA4B;CAClD,OAAO,QAAQ,SAAS,QAAQ,KAAK,QAAQ,SAAS,IAAI;AAC9D;;;;;;;;;;;;;;;AAgBA,IAAa,aAAb,cAAgC,MAAM;CAClC,eAAwB;CAExB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;;;;;;;AAgBA,SAAgB,iBAAqC,EACjD,MACA,SACA,cACA,SACA,kBAOiB;CACjB,IAAI;CACJ,IAAI;EAKA,SAAS,IAAI;GAHT,GAAG;GACH,GAAG;EAEM,GAAQ,EAAE,MAAM,QAAQ,MAAM,CAAC,EAAE,CAAC;CACnD,SAAS,KAAK;EACV,IAAI,eAAe,SAAU,IAAqB,SAAS,sBAGvD,MAAM,IAAI,WAAW,qBAAqB,UAD5B,iBAAiB,KAAK,IAAI,OAAO,CAAC,GAAG,MAAM,IAAI,QACV,CAAM,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;EAEjF,MAAM;CACV;CAEA,MAAM,cAAc,OAAO,EAAE,MAAM,YAAY;CAE/C,KAAK,MAAM,SAAS,aAMhB,IAAI,MAAM,WAAW,GAAG,GACpB,MAAM,IAAI,WACN,KAAK,MAAM,iFACE,QAAQ,YACzB;CAIR,IAAI,mBAAmB,KAAA,KAAa,YAAY,SAAS,gBAGrD,MAAM,IAAI,WACN,UAAU,QAAQ,SAAS,eAAe,WAAW,mBAAmB,IAAI,KAAK,IAAI,QAC9E,YAAY,OAAO,IAAI,0BAA0B,YAAY,KAAK,GAAG,CAAC,GACjF;CAGJ,OAAO;EACH,OAAO;EACP;EACA,MAAM,QAAQ,OAAO,SAAS;CAClC;AACJ"}

package/dist/{atlas-dev-database-DeK3Sa4h.js → atlas-dev-database-OWtqnG7W.js}

@@ -1,6 +1,6 @@
 import { s as findFreePort } from "./state-CCB-FAQ9.js";
 import { i as managedUrl } from "./daemon-CknkDjd6.js";
-import { loadExtensions } from "./daemon-entry-C6pxdily.js";
+import { loadExtensions } from "./daemon-entry-CbLRrgzy.js";
 //#region src/dev-db/atlas-dev-database.ts
 /**
 * A second, throwaway PGlite for Atlas to plan against.
@@ -59,4 +59,4 @@ async function startAtlasDevDatabase() {
 //#endregion
 export { startAtlasDevDatabase };
 
-//# sourceMappingURL=atlas-dev-database-DeK3Sa4h.js.map
+//# sourceMappingURL=atlas-dev-database-OWtqnG7W.js.map

package/dist/{atlas-dev-database-DeK3Sa4h.js.map → atlas-dev-database-OWtqnG7W.js.map}

@@ -1 +1 @@
-{"version":3,"file":"atlas-dev-database-DeK3Sa4h.js","names":[],"sources":["../src/dev-db/atlas-dev-database.ts"],"sourcesContent":["/**\n * A second, throwaway PGlite for Atlas to plan against.\n *\n * Atlas computes a schema change by replaying the desired schema into an\n * **empty** database and diffing. On a real server the driver makes one as\n * `<db>_dev_diff`; PGlite serves exactly one database, so that `CREATE\n * DATABASE` succeeds and creates nothing, and `rebase db push`, `generate` and\n * `migrate` were refused on the managed database outright — which left it with\n * no way to drop, rename or narrow a column: boot only ever adds.\n *\n * So the command that needs one starts one: in memory, in this process, for\n * as long as the command runs. It shares nothing with the managed database's\n * daemon (a separate instance, no data directory, a port of its own), so the\n * project's data is never the thing Atlas fills and clears, and nothing is\n * left behind — not a directory, not a process.\n *\n * Measured with Atlas 1.2.3 against PGlite 0.5.6: `schema apply` with this as\n * `--dev-url` plans and applies a DROP COLUMN and a `varchar(200)` →\n * `varchar(50)` narrowing on a PGlite target, and the dev database is empty\n * again afterwards, so one instance serves every Atlas call of a command.\n *\n * It runs on this process's event loop. The driver runs as a child process,\n * which is what keeps the loop free to serve it; a synchronous wait on that\n * child would hang Atlas.\n */\n\nimport { loadExtensions } from \"./daemon-entry\";\nimport { MANAGED_SERVER_MAX_CONNECTIONS } from \"./constraints\";\nimport { managedUrl } from \"./daemon\";\nimport { findFreePort } from \"./state\";\n\nexport interface AtlasDevDatabase {\n    /** Connection string for Atlas's `--dev-url`. */\n    url: string;\n    /** Stop serving and drop the instance. Safe to call twice. */\n    stop(): Promise<void>;\n}\n\nexport async function startAtlasDevDatabase(): Promise<AtlasDevDatabase> {\n    const { PGlite } = (await import(\"@electric-sql/pglite\")) as {\n        PGlite: { create(options: unknown): Promise<unknown> };\n    };\n    const { PGLiteSocketServer } = (await import(\"@electric-sql/pglite-socket\")) as {\n        PGLiteSocketServer: new (options: unknown) => { start(): Promise<void>; stop(): Promise<void> };\n    };\n\n    // The same extension bundles as the managed database: a schema that\n    // creates `pg_trgm` or `vector` must replay here exactly as it applies\n    // there, or Atlas fails on the replay rather than the apply.\n    const extensions = await loadExtensions();\n    // No `dataDir`: in memory, gone with the process.\n    const db = (await PGlite.create({ extensions })) as { close(): Promise<void> };\n    const port = await findFreePort();\n    const server = new PGLiteSocketServer({\n        db,\n        port,\n        host: \"127.0.0.1\",\n        maxConnections: MANAGED_SERVER_MAX_CONNECTIONS\n    });\n    try {\n        await server.start();\n    } catch (err) {\n        await db.close().catch(() => undefined);\n        throw err;\n    }\n\n    let stopped = false;\n    return {\n        url: managedUrl(port),\n        async stop() {\n            if (stopped) return;\n            stopped = true;\n            await server.stop().catch(() => undefined);\n            await db.close().catch(() => undefined);\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,eAAsB,wBAAmD;CACrE,MAAM,EAAE,WAAY,MAAM,OAAO;CAGjC,MAAM,EAAE,uBAAwB,MAAM,OAAO;CAO7C,MAAM,aAAa,MAAM,eAAe;CAExC,MAAM,KAAM,MAAM,OAAO,OAAO,EAAE,WAAW,CAAC;CAC9C,MAAM,OAAO,MAAM,aAAa;CAChC,MAAM,SAAS,IAAI,mBAAmB;EAClC;EACA;EACA,MAAM;EACN,gBAAA;CACJ,CAAC;CACD,IAAI;EACA,MAAM,OAAO,MAAM;CACvB,SAAS,KAAK;EACV,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EACtC,MAAM;CACV;CAEA,IAAI,UAAU;CACd,OAAO;EACH,KAAK,WAAW,IAAI;EACpB,MAAM,OAAO;GACT,IAAI,SAAS;GACb,UAAU;GACV,MAAM,OAAO,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;GACzC,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1C;CACJ;AACJ"}
+{"version":3,"file":"atlas-dev-database-OWtqnG7W.js","names":[],"sources":["../src/dev-db/atlas-dev-database.ts"],"sourcesContent":["/**\n * A second, throwaway PGlite for Atlas to plan against.\n *\n * Atlas computes a schema change by replaying the desired schema into an\n * **empty** database and diffing. On a real server the driver makes one as\n * `<db>_dev_diff`; PGlite serves exactly one database, so that `CREATE\n * DATABASE` succeeds and creates nothing, and `rebase db push`, `generate` and\n * `migrate` were refused on the managed database outright — which left it with\n * no way to drop, rename or narrow a column: boot only ever adds.\n *\n * So the command that needs one starts one: in memory, in this process, for\n * as long as the command runs. It shares nothing with the managed database's\n * daemon (a separate instance, no data directory, a port of its own), so the\n * project's data is never the thing Atlas fills and clears, and nothing is\n * left behind — not a directory, not a process.\n *\n * Measured with Atlas 1.2.3 against PGlite 0.5.6: `schema apply` with this as\n * `--dev-url` plans and applies a DROP COLUMN and a `varchar(200)` →\n * `varchar(50)` narrowing on a PGlite target, and the dev database is empty\n * again afterwards, so one instance serves every Atlas call of a command.\n *\n * It runs on this process's event loop. The driver runs as a child process,\n * which is what keeps the loop free to serve it; a synchronous wait on that\n * child would hang Atlas.\n */\n\nimport { loadExtensions } from \"./daemon-entry\";\nimport { MANAGED_SERVER_MAX_CONNECTIONS } from \"./constraints\";\nimport { managedUrl } from \"./daemon\";\nimport { findFreePort } from \"./state\";\n\nexport interface AtlasDevDatabase {\n    /** Connection string for Atlas's `--dev-url`. */\n    url: string;\n    /** Stop serving and drop the instance. Safe to call twice. */\n    stop(): Promise<void>;\n}\n\nexport async function startAtlasDevDatabase(): Promise<AtlasDevDatabase> {\n    const { PGlite } = (await import(\"@electric-sql/pglite\")) as {\n        PGlite: { create(options: unknown): Promise<unknown> };\n    };\n    const { PGLiteSocketServer } = (await import(\"@electric-sql/pglite-socket\")) as {\n        PGLiteSocketServer: new (options: unknown) => { start(): Promise<void>; stop(): Promise<void> };\n    };\n\n    // The same extension bundles as the managed database: a schema that\n    // creates `pg_trgm` or `vector` must replay here exactly as it applies\n    // there, or Atlas fails on the replay rather than the apply.\n    const extensions = await loadExtensions();\n    // No `dataDir`: in memory, gone with the process.\n    const db = (await PGlite.create({ extensions })) as { close(): Promise<void> };\n    const port = await findFreePort();\n    const server = new PGLiteSocketServer({\n        db,\n        port,\n        host: \"127.0.0.1\",\n        maxConnections: MANAGED_SERVER_MAX_CONNECTIONS\n    });\n    try {\n        await server.start();\n    } catch (err) {\n        await db.close().catch(() => undefined);\n        throw err;\n    }\n\n    let stopped = false;\n    return {\n        url: managedUrl(port),\n        async stop() {\n            if (stopped) return;\n            stopped = true;\n            await server.stop().catch(() => undefined);\n            await db.close().catch(() => undefined);\n        }\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,eAAsB,wBAAmD;CACrE,MAAM,EAAE,WAAY,MAAM,OAAO;CAGjC,MAAM,EAAE,uBAAwB,MAAM,OAAO;CAO7C,MAAM,aAAa,MAAM,eAAe;CAExC,MAAM,KAAM,MAAM,OAAO,OAAO,EAAE,WAAW,CAAC;CAC9C,MAAM,OAAO,MAAM,aAAa;CAChC,MAAM,SAAS,IAAI,mBAAmB;EAClC;EACA;EACA,MAAM;EACN,gBAAA;CACJ,CAAC;CACD,IAAI;EACA,MAAM,OAAO,MAAM;CACvB,SAAS,KAAK;EACV,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EACtC,MAAM;CACV;CAEA,IAAI,UAAU;CACd,OAAO;EACH,KAAK,WAAW,IAAI;EACpB,MAAM,OAAO;GACT,IAAI,SAAS;GACb,UAAU;GACV,MAAM,OAAO,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;GACzC,MAAM,GAAG,MAAM,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1C;CACJ;AACJ"}

package/dist/{auth-BL7bNQVu.js → auth-Vl2hFKXP.js}

@@ -1,10 +1,11 @@
 import { d as readEnvFile, f as requireBackendDir, g as resolveTsx, o as findEnvFile, p as requireProjectRoot, r as exitDependenciesNotInstalled } from "./project-Wp2zoyeN.js";
-import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp } from "./args-CcBphFdj.js";
-import { resolveBackendAddress } from "./api-keys-Bc4FJKYp.js";
+import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp, s as redactConnectionPasswords } from "./args-BX0YD14a.js";
+import { resolveBackendAddress } from "./api-keys-Tm7zvAPe.js";
 import chalk from "chalk";
 import fs from "fs";
 import path from "path";
 import { spawn } from "child_process";
+import { parseEnvBoolean } from "@rebasepro/types";
 import { randomBytes } from "node:crypto";
 //#region src/commands/auth.ts
 /**
@@ -213,16 +214,34 @@ async function resetPassword(rawArgs) {
 	const backendDir = requireBackendDir(projectRoot);
 	const tsxBin = resolveTsx(projectRoot);
 	if (!tsxBin) exitDependenciesNotInstalled(projectRoot);
+	let prepared;
+	try {
+		const { ensureDockerDatabase } = await import("./db-CRNpA5mH.js");
+		await ensureDockerDatabase(projectRoot, rawArgs);
+		const { prepareDatabaseEnv } = await import("./prepare-DdnU70z8.js");
+		prepared = await prepareDatabaseEnv(projectRoot, { onProgress: (message) => console.log(chalk.gray(`  ${message}`)) });
+	} catch (err) {
+		console.error(chalk.red("✗ Direct database update failed."));
+		console.error(err instanceof Error ? err.message : String(err));
+		process.exit(1);
+	}
+	const { databaseUrlOf } = await import("./db-CRNpA5mH.js");
+	const url = databaseUrlOf(prepared, readEnvFile(projectRoot));
+	if (url) {
+		const failure = await databaseOpenFailure(url, prepared.database.source);
+		if (failure) {
+			for (const line of failure) console.error(line);
+			process.exit(1);
+		}
+	}
 	try {
 		const env = { ...process.env };
 		if (envFile) env.DOTENV_CONFIG_PATH = envFile;
 		env.REBASE_RESET_EMAIL = email;
 		env.REBASE_RESET_PASSWORD = newPassword;
 		env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, ".env");
-		const { prepareDatabaseEnv } = await import("./prepare-C1iaiTC4.js");
-		const prepared = await prepareDatabaseEnv(projectRoot, { onProgress: (message) => console.log(chalk.gray(`  ${message}`)) });
 		Object.assign(env, prepared.env);
-		const scriptContent = resetPasswordScript(wasGenerated);
+		const scriptContent = resetPasswordScript(wasGenerated, parseEnvBoolean(process.env.REBASE_DEBUG) === true);
 		const tmpScriptPath = path.join(backendDir, ".tmp-reset-password.ts");
 		fs.writeFileSync(tmpScriptPath, scriptContent, "utf-8");
 		console.log("");
@@ -262,6 +281,36 @@ async function resetPassword(rawArgs) {
 	}
 }
 /**
+* Why the database the fallback would reset in cannot be opened, as the lines
+* to print — or null when it opens.
+*
+* A stopped database, refused credentials and a database name the server does
+* not have get the boxed banner the other commands print; anything else is one
+* sentence. Either way the password was not reset and no script was written.
+*/
+async function databaseOpenFailure(url, source) {
+	const { Client } = await import("pg");
+	const client = new Client({
+		connectionString: url,
+		connectionTimeoutMillis: 1e4
+	});
+	client.on("error", () => void 0);
+	try {
+		await client.connect();
+		await client.query("SELECT 1");
+		return null;
+	} catch (error) {
+		const { connectionErrorText, connectionFailureBanner, connectionRefusedFixes } = await import("./connection-banner-DbLJzWf4.js").then((n) => n.r);
+		const consequence = "The password was not reset.";
+		return connectionFailureBanner(url, error, {
+			consequence,
+			fixes: connectionRefusedFixes(source)
+		}) ?? [chalk.red(`✗ Could not open the database: ${redactConnectionPasswords(connectionErrorText(error))}`), chalk.gray(`  ${consequence}`)];
+	} finally {
+		await client.end().catch(() => void 0);
+	}
+}
+/**
 * The script the direct-database fallback runs under the project's own tsx, so
 * it resolves the project's `@rebasepro/server-postgres` and schema.
 *
@@ -273,11 +322,12 @@ async function resetPassword(rawArgs) {
 * attacker's refresh token minting access tokens did not recover anything.
 *
 * It exits 0 only when a row was updated: a missing user and a thrown error are
-* both exit 1. `echoPassword` prints the new password, for a generated one.
+* both exit 1. `echoPassword` prints the new password, for a generated one;
+* `showStack` prints a failure's stack rather than its sentence (`--debug`).
 *
 * Exported so its tests can run it.
 */
-function resetPasswordScript(echoPassword) {
+function resetPasswordScript(echoPassword, showStack = false) {
 	return `
 import { createPostgresDatabaseConnection } from "@rebasepro/server-postgres";
 import { hashPassword } from "@rebasepro/server";
@@ -329,6 +379,16 @@ async function resetPassword() {
 
     const client = await pool.connect();
     try {
+        // A database nothing has booted against — or a managed one \`db reset\`
+        // emptied — has no users table, and so no account to reset. Said as
+        // that, not as pg's \`relation … does not exist\`.
+        const usersTable = await client.query("SELECT to_regclass($1) IS NOT NULL AS present", [users]);
+        if (!usersTable.rows[0]?.present) {
+            console.error("✗ " + users + " does not exist in this database, so it holds no account to reset.");
+            console.error("  Nothing was changed. \`rebase dev\` creates it the first time it boots against this database.");
+            process.exit(1);
+        }
+
         await client.query("BEGIN");
         const updated = await client.query(
             "UPDATE " + users + " SET " + passwordColumn + " = $1 WHERE " + emailColumn + " = $2 " +
@@ -375,9 +435,16 @@ async function resetPassword() {
 }
 
 // A thrown error is a failed reset, and exits like one — a refused connection
-// that exits 0 reads as a reset to anything checking the exit code.
+// that exits 0 reads as a reset to anything checking the exit code. Said as a
+// sentence: the stack is the script's own, and only --debug asks for it.
+const describe = (error: unknown): string => {
+    if (error instanceof AggregateError && !error.message && error.errors.length > 0) return describe(error.errors[0]);
+    const message = error instanceof Error ? error.message : String(error);
+    const code = error && typeof error === "object" && "code" in error && typeof error.code === "string" ? error.code : "";
+    return code && !message.includes(code) ? message + " (" + code + ")" : message;
+};
 resetPassword().catch((error) => {
-    console.error(error);
+    ${showStack ? "console.error(error);" : "console.error(\"✗ The password was not reset: \" + describe(error));"}
     process.exit(1);
 });
 `;
@@ -404,4 +471,4 @@ ${chalk.green.bold("Examples")}
 //#endregion
 export { AUTH_SUBCOMMANDS, authCommand };
 
-//# sourceMappingURL=auth-BL7bNQVu.js.map
+//# sourceMappingURL=auth-Vl2hFKXP.js.map

package/dist/auth-Vl2hFKXP.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-Vl2hFKXP.js","names":[],"sources":["../src/commands/auth.ts"],"sourcesContent":["/**\n * CLI command: rebase auth <action>\n *\n * Subcommands:\n *   reset-password — Reset a user's password\n */\nimport chalk from \"chalk\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport { spawn } from \"child_process\";\nimport { randomBytes } from \"node:crypto\";\nimport {\n    requireProjectRoot,\n    requireBackendDir,\n    findEnvFile,\n    readEnvFile,\n    resolveTsx,\n    exitDependenciesNotInstalled\n} from \"../utils/project\";\nimport { parseEnvBoolean } from \"@rebasepro/types\";\nimport { unknownCommand } from \"../utils/unknown-command\";\nimport { redactConnectionPasswords } from \"../utils/redact\";\nimport type { PreparedDatabase } from \"../dev-db/prepare\";\nimport type { DevDatabaseSource } from \"../dev-db/resolve\";\n\n/** The backend was reached and refused: not a reason to fall back to the database. */\nclass ApiAnswered extends Error {}\n\n/** Everything the switch below dispatches, for the did-you-mean. */\nexport const AUTH_SUBCOMMANDS = [\"reset-password\"] as const;\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { resolveBackendAddress } from \"./api-keys\";\n\n/** A user as the admin API returns it, reduced to what this command needs. */\nexport interface ResolvedUser {\n    id: string;\n    email: string;\n}\n\n/**\n * Pick the user with exactly this email out of a search response.\n *\n * `/api/admin/users?search=` is an `ILIKE '%…%'` over email **or display\n * name**, ordered by role count descending. This used to take row `[0]` and\n * reset it, then print the email it had been *given* as confirmation — so two\n * ordinary situations ended in a successful-looking reset of somebody else's\n * account:\n *\n *   - a substring collision: `bob@example.com` also matches\n *     `robert.bob@example.com`;\n *   - a display name, which is user-controlled and accepted up to 255\n *     characters with no constraint on its content, containing an address\n *     belonging to someone else.\n *\n * The ordering makes it worse rather than better — `array_length(roles) DESC\n * NULLS LAST` puts the most privileged match first, so the account most likely\n * to be reset by mistake is an admin's.\n *\n * Returns `undefined` when nothing matched exactly, which the caller reports\n * rather than falling through to a guess. The direct-database fallback below\n * has always matched with `eq(usersTable.email, email)`; this is the same\n * definition, so the command no longer resets different accounts depending on\n * whether the backend happened to be running.\n */\nexport function selectUserForEmail(payload: unknown, email: string): ResolvedUser | undefined {\n    const wanted = email.trim().toLowerCase();\n    if (!wanted) return undefined;\n\n    const rows: unknown[] = Array.isArray(payload)\n        ? payload\n        : (payload && typeof payload === \"object\" && Array.isArray((payload as { users?: unknown }).users)\n            ? (payload as { users: unknown[] }).users\n            : []);\n\n    for (const row of rows) {\n        if (!row || typeof row !== \"object\") continue;\n        const record = row as Record<string, unknown>;\n        const rowEmail = typeof record.email === \"string\" ? record.email.trim().toLowerCase() : undefined;\n        if (!rowEmail || rowEmail !== wanted) continue;\n\n        const id = typeof record.id === \"string\"\n            ? record.id\n            : (typeof record.uid === \"string\" ? record.uid : undefined);\n        if (!id) continue;\n\n        return { id, email: record.email as string };\n    }\n\n    return undefined;\n}\n\nexport async function authCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    // `--help` is answered here and never reaches a handler. `cli.ts` only\n    // rewrites the subcommand to `\"--help\"` when no subcommand was named, so\n    // `rebase auth reset-password --help` used to *run the reset*: `--help`\n    // became the email, the backend was contacted, `.tmp-reset-password.ts` was\n    // written into the user's `backend/`, and a database UPDATE ran for a user\n    // named `--help`. A flag whose whole job is to print text cannot be allowed\n    // to reach code that writes.\n    if (!subcommand || subcommand === \"--help\" || wantsHelp(rawArgs)) {\n        printAuthHelp();\n        return;\n    }\n\n    switch (subcommand) {\n        case \"reset-password\":\n            await resetPassword(rawArgs);\n            break;\n        default:\n            unknownCommand(subcommand, AUTH_SUBCOMMANDS, \"auth\");\n    }\n}\n\n/**\n * The flags `rebase auth reset-password` takes.\n *\n * `-p` was advertised in this command's own help and never declared here, so\n * `arg` — running permissively — pushed it into the positionals and the value\n * *after* it shifted out of reach: anyone following the help set the account's\n * password to the two-character string `-p`. Declared now, and `auth.test.ts`\n * asserts that the help and this spec list the same aliases.\n */\nexport const RESET_PASSWORD_FLAGS = {\n    \"--email\": String,\n    \"--password\": String,\n    \"-e\": \"--email\",\n    \"-p\": \"--password\"\n} as const;\n\n/**\n * Which account, and which password, this invocation names.\n *\n * Both may still be absent — the caller reports a missing email — but neither\n * can be a flag. `parseCommandArgs` parses the whole line strictly, so an\n * undeclared flag is an error rather than a positional. That is what stops\n * `rebase auth reset-password bob@example.com --debug` from setting Bob's\n * password to `--debug`, which is the flag the CLI itself prints after every\n * failure as the thing to re-run with.\n *\n * Exported so its tests can drive the real parser rather than a copy of it.\n */\nexport function resolveResetPasswordArgs(rawArgs: string[]): {\n    email?: string;\n    password?: string;\n} {\n    const { flags, positionals } = parseCommandArgs({\n        spec: RESET_PASSWORD_FLAGS,\n        rawArgs,\n        commandWords: 2,\n        command: \"auth reset-password\",\n        maxPositionals: 2\n    });\n\n    // Both spellings are supported: `<email> [password]` and `--email/--password`.\n    return {\n        email: flags[\"--email\"] || positionals[0],\n        password: flags[\"--password\"] || positionals[1]\n    };\n}\n\n/**\n * A password for a reset that was not given one.\n *\n * This used to be a constant, and `--help` printed it as the default. Reset is\n * the documented way back into an account nobody can sign in to — an admin,\n * usually — so the recovery path set every such account to a fixed string that\n * ships inside a public repository and a published npm package, and left it\n * there until somebody remembered to change it.\n *\n * base64url of 18 random bytes: 24 characters, ~144 bits, no shell-quoting\n * hazard, and nothing that reads like a placeholder somebody might keep.\n */\nexport function generatePassword(): string {\n    return randomBytes(18).toString(\"base64url\");\n}\n\n/**\n * What a refusing backend said, from its `{ error: { message, code } }` body.\n *\n * The body used to be printed as it came, so a weak password read\n * `{\"error\":{\"message\":\"…\",\"code\":\"…\"}}`. A body that is not the envelope is\n * still shown, since it is the only account of the refusal there is.\n */\nasync function refusalReason(response: Response): Promise<string> {\n    const text = await response.text().catch(() => \"\");\n    try {\n        const parsed: unknown = JSON.parse(text);\n        const error = parsed && typeof parsed === \"object\" && \"error\" in parsed ? parsed.error : undefined;\n        if (error && typeof error === \"object\" && \"message\" in error && typeof error.message === \"string\") {\n            const code = \"code\" in error && typeof error.code === \"string\" ? ` (${error.code})` : \"\";\n            return `${error.message}${code}`;\n        }\n    } catch {\n        // Not JSON: the text is the answer.\n    }\n    return text.trim() || `${response.status} ${response.statusText}`.trim();\n}\n\nasync function resetPassword(rawArgs: string[]): Promise<void> {\n    const { email, password: providedPassword } = resolveResetPasswordArgs(rawArgs);\n    // Generated once, so both reset paths set and report the same thing.\n    const wasGenerated = !providedPassword;\n    const newPassword = providedPassword || generatePassword();\n\n    if (!email) {\n        console.error(chalk.red(\"✗ Email is required.\"));\n        console.log(\"\");\n        console.log(chalk.gray(\"  Usage: rebase auth reset-password <email> [new-password]\"));\n        console.log(chalk.gray(\"         rebase auth reset-password --email user@example.com --password NewPass123!\"));\n        process.exit(1);\n    }\n\n    const projectRoot = requireProjectRoot();\n\n    // 1. Try API-first reset\n    // Was a single-key regex, which did not match `export REBASE_SERVICE_KEY=…`\n    // and kept a trailing `# comment` in the value. The command then fell\n    // through to the direct-database path as though no key were configured.\n    const envFile = findEnvFile(projectRoot);\n    const envServiceKey: string | undefined = readEnvFile(projectRoot).REBASE_SERVICE_KEY;\n\n    let serviceKey = process.env.REBASE_SERVICE_KEY || envServiceKey;\n\n    const statePath = path.join(projectRoot, \".rebase\", \"state.json\");\n    if (fs.existsSync(statePath)) {\n        try {\n            const state = JSON.parse(fs.readFileSync(statePath, \"utf8\")) as Record<string, unknown>;\n            if (state && typeof state === \"object\" && typeof state.serviceKey === \"string\" && !serviceKey) {\n                serviceKey = state.serviceKey;\n            }\n        } catch {\n            // Ignore\n        }\n    }\n\n    // Where the service key may go: a REBASE_BASE_URL the developer named, or\n    // this project's backend while the pid that recorded it is alive — see\n    // `resolveBackendAddress`. `.rebase/state.json`'s address on its own, and\n    // `.rebase-dev-url`, outlive a killed `rebase dev`, and the port they name\n    // may be another server's by now. With neither, the reset goes to the\n    // database directly.\n    const baseUrl = resolveBackendAddress(readEnvFile(projectRoot), projectRoot).url;\n\n    if (baseUrl && serviceKey) {\n        console.log(\"Trying API-first reset via running backend...\");\n        try {\n            const finalPass = newPassword;\n            const cleanBaseUrl = baseUrl.replace(/\\/+$/, \"\");\n            // Not `limit=1`: the search is fuzzy and ordered by role count, so\n            // the exact match is not necessarily first — asking for one row can\n            // make it unreachable. Ask for a page, then match exactly.\n            const searchUrl = `${cleanBaseUrl}/api/admin/users?search=${encodeURIComponent(email)}&limit=50`;\n            const searchRes = await fetch(searchUrl, {\n                headers: {\n                    \"Authorization\": `Bearer ${serviceKey}`,\n                    \"Accept\": \"application/json\"\n                }\n            });\n            if (!searchRes.ok) {\n                throw new ApiAnswered(`Failed to list users: ${searchRes.status} ${searchRes.statusText}`);\n            }\n            const searchData = await searchRes.json() as unknown;\n            if (!searchData || typeof searchData !== \"object\") {\n                throw new Error(\"Invalid response format from user search API.\");\n            }\n\n            const matched = selectUserForEmail(searchData, email);\n            if (!matched) {\n                throw new ApiAnswered(`No user has the email ${email}.`);\n            }\n\n            const resetUrl = `${cleanBaseUrl}/api/admin/users/${matched.id}/reset-password`;\n            const resetRes = await fetch(resetUrl, {\n                method: \"POST\",\n                headers: {\n                    \"Authorization\": `Bearer ${serviceKey}`,\n                    \"Content-Type\": \"application/json\",\n                    \"Accept\": \"application/json\"\n                },\n                body: JSON.stringify({ password: finalPass })\n            });\n\n            if (!resetRes.ok) {\n                throw new ApiAnswered(`Password reset refused: ${await refusalReason(resetRes)}`);\n            }\n\n            console.log(\"API reset successful.\");\n            console.log(chalk.bold(\"  🔑 Rebase Auth — Reset Password (via API)\"));\n            console.log(\"\");\n            // The address as stored, not as typed — they differ in case often\n            // enough that echoing the input hides which account was touched.\n            console.log(`  ${chalk.gray(\"Email:\")} ${matched.email}`);\n            // Echoed only when we invented it. A password the operator typed\n            // is already theirs; printing it again only adds scrollback.\n            console.log(`  ${chalk.gray(\"Password:\")} ${wasGenerated ? finalPass : \"*\".repeat(finalPass.length)}`);\n            console.log(\"\");\n            return;\n        } catch (err) {\n            const errMsg = err instanceof Error ? err.message : String(err);\n            // The backend answered and said no — a password too weak, a user\n            // it does not have. That answer stands: writing the hash straight\n            // into the database instead skipped the strength rule it had just\n            // applied, and ended no sessions. Only a backend that could not be\n            // reached is a reason to go round it.\n            if (err instanceof ApiAnswered) {\n                console.error(chalk.red(`✗ ${errMsg}`));\n                process.exitCode = 1;\n                return;\n            }\n            console.warn(chalk.yellow(\"API reset failed, falling back to direct database update...\"));\n            console.warn(chalk.gray(`  Details: ${errMsg}`));\n        }\n    }\n\n    // 2. Direct-DB Fallback\n    const backendDir = requireBackendDir(projectRoot);\n    const tsxBin = resolveTsx(projectRoot);\n\n    if (!tsxBin) {\n        exitDependenciesNotInstalled(projectRoot);\n    }\n\n    // The database the `db` family would use, resolved — and, for a remembered\n    // compose container that is stopped, started — the same way. A stock\n    // scaffold leaves DATABASE_URL commented out and runs on the managed\n    // database, which only exists in a child's environment when something puts\n    // it there — without this the script connected with libpq's defaults,\n    // localhost:5432 as the OS user. An external DATABASE_URL adds nothing\n    // here: the child already reads it.\n    let prepared: PreparedDatabase;\n    try {\n        const { ensureDockerDatabase } = await import(\"./db\");\n        await ensureDockerDatabase(projectRoot, rawArgs);\n        const { prepareDatabaseEnv } = await import(\"../dev-db/prepare\");\n        prepared = await prepareDatabaseEnv(projectRoot, {\n            onProgress: (message) => console.log(chalk.gray(`  ${message}`))\n        });\n    } catch (err) {\n        console.error(chalk.red(\"✗ Direct database update failed.\"));\n        console.error(err instanceof Error ? err.message : String(err));\n        process.exit(1);\n    }\n\n    // Opened here first, so a database that does not answer gets the banner\n    // every other command prints — not the script's raw error and stack — and\n    // no script is written for it.\n    const { databaseUrlOf } = await import(\"./db\");\n    const url = databaseUrlOf(prepared, readEnvFile(projectRoot));\n    if (url) {\n        const failure = await databaseOpenFailure(url, prepared.database.source);\n        if (failure) {\n            for (const line of failure) console.error(line);\n            process.exit(1);\n        }\n    }\n\n    try {\n        const env: Record<string, string> = { ...process.env as Record<string, string> };\n        if (envFile) {\n            env.DOTENV_CONFIG_PATH = envFile;\n        }\n        env.REBASE_RESET_EMAIL = email;\n        env.REBASE_RESET_PASSWORD = newPassword;\n        env.REBASE_ENV_FILE_PATH = envFile || path.join(projectRoot, \".env\");\n        Object.assign(env, prepared.env);\n\n        const scriptContent = resetPasswordScript(wasGenerated, parseEnvBoolean(process.env.REBASE_DEBUG) === true);\n\n        const tmpScriptPath = path.join(backendDir, \".tmp-reset-password.ts\");\n        fs.writeFileSync(tmpScriptPath, scriptContent, \"utf-8\");\n\n        console.log(\"\");\n        console.log(chalk.bold(\"  🔑 Rebase Auth — Reset Password (Direct DB Fallback)\"));\n        console.log(\"\");\n        console.log(`  ${chalk.gray(\"Email:\")} ${email}`);\n        console.log(`  ${chalk.gray(\"Database:\")} ${prepared.description}`);\n        if (!wasGenerated) {\n            console.log(`  ${chalk.gray(\"Password:\")} ${\"*\".repeat(newPassword.length)}`);\n        }\n        console.log(\"\");\n\n        const child = spawn(tsxBin, [tmpScriptPath], {\n            cwd: backendDir,\n            stdio: \"inherit\",\n            env\n        });\n\n        // The script is written into the user's backend directory, so every\n        // exit has to remove it. Without an `error` handler a failed spawn\n        // raises an unhandled event, the process dies before `close`, and\n        // `.tmp-reset-password.ts` is left behind to be committed.\n        const cleanup = () => {\n            try { fs.unlinkSync(tmpScriptPath); } catch { /* already gone */ }\n        };\n\n        return new Promise((resolve) => {\n            child.on(\"error\", (err) => {\n                cleanup();\n                console.error(chalk.red(\"✗ Could not run the reset script.\"));\n                console.error(chalk.gray(`  ${err.message}`));\n                process.exit(1);\n            });\n            child.on(\"close\", (code) => {\n                cleanup();\n                if (code !== 0) {\n                    process.exit(code ?? 1);\n                }\n                resolve();\n            });\n        });\n    } catch (err) {\n        console.error(chalk.red(\"✗ Direct database update failed.\"));\n        console.error(err instanceof Error ? err.message : String(err));\n        process.exit(1);\n    }\n}\n\n/**\n * Why the database the fallback would reset in cannot be opened, as the lines\n * to print — or null when it opens.\n *\n * A stopped database, refused credentials and a database name the server does\n * not have get the boxed banner the other commands print; anything else is one\n * sentence. Either way the password was not reset and no script was written.\n */\nasync function databaseOpenFailure(url: string, source: DevDatabaseSource): Promise<string[] | null> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: url, connectionTimeoutMillis: 10_000 });\n    client.on(\"error\", () => undefined);\n    try {\n        await client.connect();\n        await client.query(\"SELECT 1\");\n        return null;\n    } catch (error) {\n        const { connectionErrorText, connectionFailureBanner, connectionRefusedFixes } =\n            await import(\"../dev-db/connection-banner\");\n        const consequence = \"The password was not reset.\";\n        return connectionFailureBanner(url, error, { consequence, fixes: connectionRefusedFixes(source) }) ?? [\n            chalk.red(`✗ Could not open the database: ${redactConnectionPasswords(connectionErrorText(error))}`),\n            chalk.gray(`  ${consequence}`)\n        ];\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n}\n\n/**\n * The script the direct-database fallback runs under the project's own tsx, so\n * it resolves the project's `@rebasepro/server-postgres` and schema.\n *\n * It ends the account's sessions in the transaction that sets the password,\n * as every door through the API does (`replaceUserPassword`): the refresh\n * tokens and outstanding reset links go, and `tokens_valid_after` voids the\n * access tokens already handed out. An operator resetting a phished account\n * with the backend down is the case this exists for, and a reset that left the\n * attacker's refresh token minting access tokens did not recover anything.\n *\n * It exits 0 only when a row was updated: a missing user and a thrown error are\n * both exit 1. `echoPassword` prints the new password, for a generated one;\n * `showStack` prints a failure's stack rather than its sentence (`--debug`).\n *\n * Exported so its tests can run it.\n */\nexport function resetPasswordScript(echoPassword: boolean, showStack = false): string {\n    return `\nimport { createPostgresDatabaseConnection } from \"@rebasepro/server-postgres\";\nimport { hashPassword } from \"@rebasepro/server\";\nimport { getTableConfig } from \"drizzle-orm/pg-core\";\nimport * as dotenv from \"dotenv\";\nimport path from \"path\";\nimport fs from \"fs\";\n\ndotenv.config({ path: process.env.REBASE_ENV_FILE_PATH, quiet: true });\n\n// Lowercased, as every address is stored (\\`normalizeEmail\\`): matched as\n// typed, \"Ops@Acme.test\" found no row.\nconst email = process.env.REBASE_RESET_EMAIL!.trim().toLowerCase();\nconst newPassword = process.env.REBASE_RESET_PASSWORD!;\n\nconst quote = (identifier: string) => '\"' + identifier.replace(/\"/g, '\"\"') + '\"';\n\nasync function resetPassword() {\n    const { pool } = createPostgresDatabaseConnection(process.env.DATABASE_URL!);\n    const hash = await hashPassword(newPassword);\n\n    let usersTable;\n    try {\n        const schemaPath = path.resolve(\"./src/schema.generated.ts\");\n        if (fs.existsSync(schemaPath)) {\n            const schema = await import(\"file://\" + schemaPath);\n            usersTable = schema.users || schema.tables?.users;\n        }\n    } catch (e) {\n        // ignore and fallback\n    }\n\n    if (!usersTable) {\n        const pgServer = await import(\"@rebasepro/server-postgres\");\n        usersTable = pgServer.users;\n    }\n\n    // The physical names, from the table object: the collection may map its\n    // properties to other columns, and the statements below are plain SQL.\n    const { name: tableName, schema: tableSchema } = getTableConfig(usersTable);\n    const usersSchema = tableSchema || \"public\";\n    const users = quote(usersSchema) + \".\" + quote(tableName);\n    const idColumn = quote(usersTable.id.name);\n    const emailColumn = quote(usersTable.email.name);\n    const passwordColumn = quote((usersTable.passwordHash ?? usersTable.password_hash).name);\n    // Where \\`ensureAuthTablesExist\\` puts the tables that hang off the users\n    // table: beside it, or in \\`rebase\\` when it lives in \\`public\\`.\n    const authSchema = usersSchema === \"public\" ? \"rebase\" : usersSchema;\n\n    const client = await pool.connect();\n    try {\n        // A database nothing has booted against — or a managed one \\`db reset\\`\n        // emptied — has no users table, and so no account to reset. Said as\n        // that, not as pg's \\`relation … does not exist\\`.\n        const usersTable = await client.query(\"SELECT to_regclass($1) IS NOT NULL AS present\", [users]);\n        if (!usersTable.rows[0]?.present) {\n            console.error(\"✗ \" + users + \" does not exist in this database, so it holds no account to reset.\");\n            console.error(\"  Nothing was changed. \\`rebase dev\\` creates it the first time it boots against this database.\");\n            process.exit(1);\n        }\n\n        await client.query(\"BEGIN\");\n        const updated = await client.query(\n            \"UPDATE \" + users + \" SET \" + passwordColumn + \" = $1 WHERE \" + emailColumn + \" = $2 \" +\n            \"RETURNING \" + idColumn + \" AS id, \" + emailColumn + \" AS email\",\n            [hash, email]\n        );\n        if (updated.rows.length === 0) {\n            await client.query(\"ROLLBACK\");\n            // Nothing was updated, so nothing was reset. Exiting 0 here reported\n            // success for a no-op, which is what a script would have believed.\n            console.error(\"✗ User not found: \" + email);\n            process.exit(1);\n        }\n        const uid = updated.rows[0].id;\n\n        // A table or column the server has not created yet (it never booted\n        // against this database) holds no session to end.\n        const watermark = await client.query(\n            \"SELECT 1 FROM information_schema.columns WHERE table_schema = $1 AND table_name = $2 AND column_name = 'tokens_valid_after'\",\n            [usersSchema, tableName]\n        );\n        if (watermark.rows.length > 0) {\n            await client.query(\"UPDATE \" + users + \" SET tokens_valid_after = NOW() WHERE \" + idColumn + \" = $1\", [uid]);\n        }\n        for (const table of [\"refresh_tokens\", \"password_reset_tokens\"]) {\n            const qualified = quote(authSchema) + \".\" + quote(table);\n            const present = await client.query(\"SELECT to_regclass($1) IS NOT NULL AS present\", [qualified]);\n            if (present.rows[0]?.present) {\n                await client.query(\"DELETE FROM \" + qualified + \" WHERE uid = $1\", [uid]);\n            }\n        }\n        await client.query(\"COMMIT\");\n\n        console.log(\"✅ Password reset for: \" + updated.rows[0].email);\n        console.log(\"   Every session of this account has ended.\");\n        ${echoPassword ? 'console.log(\"   Password: \" + newPassword);' : \"\"}\n        process.exit(0);\n    } catch (error) {\n        await client.query(\"ROLLBACK\").catch(() => undefined);\n        throw error;\n    } finally {\n        client.release();\n    }\n}\n\n// A thrown error is a failed reset, and exits like one — a refused connection\n// that exits 0 reads as a reset to anything checking the exit code. Said as a\n// sentence: the stack is the script's own, and only --debug asks for it.\nconst describe = (error: unknown): string => {\n    if (error instanceof AggregateError && !error.message && error.errors.length > 0) return describe(error.errors[0]);\n    const message = error instanceof Error ? error.message : String(error);\n    const code = error && typeof error === \"object\" && \"code\" in error && typeof error.code === \"string\" ? error.code : \"\";\n    return code && !message.includes(code) ? message + \" (\" + code + \")\" : message;\n};\nresetPassword().catch((error) => {\n    ${showStack ? \"console.error(error);\" : \"console.error(\\\"✗ The password was not reset: \\\" + describe(error));\"}\n    process.exit(1);\n});\n`;\n}\n\nfunction printAuthHelp() {\n    console.log(`\n${chalk.bold(\"rebase auth\")} — Authentication management commands\n\n${chalk.green.bold(\"Usage\")}\n  rebase auth ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.blue.bold(\"reset-password\")}    Reset a user's password\n\n${chalk.green.bold(\"reset-password Options\")}\n  ${chalk.blue(\"--email, -e\")}        User's email address\n  ${chalk.blue(\"--password, -p\")}     New password (default: one is generated and printed)\n\n${chalk.green.bold(\"Examples\")}\n  rebase auth reset-password user@example.com\n  rebase auth reset-password --email user@example.com --password MyNewPass!\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA0BA,IAAM,cAAN,cAA0B,MAAM,CAAC;;AAGjC,IAAa,mBAAmB,CAAC,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;AAmCjD,SAAgB,mBAAmB,SAAkB,OAAyC;CAC1F,MAAM,SAAS,MAAM,KAAK,CAAC,CAAC,YAAY;CACxC,IAAI,CAAC,QAAQ,OAAO,KAAA;CAEpB,MAAM,OAAkB,MAAM,QAAQ,OAAO,IACvC,UACC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAS,QAAgC,KAAK,IAC1F,QAAiC,QAClC,CAAC;CAEX,KAAK,MAAM,OAAO,MAAM;EACpB,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;EACrC,MAAM,SAAS;EACf,MAAM,WAAW,OAAO,OAAO,UAAU,WAAW,OAAO,MAAM,KAAK,CAAC,CAAC,YAAY,IAAI,KAAA;EACxF,IAAI,CAAC,YAAY,aAAa,QAAQ;EAEtC,MAAM,KAAK,OAAO,OAAO,OAAO,WAC1B,OAAO,KACN,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,KAAA;EACrD,IAAI,CAAC,IAAI;EAET,OAAO;GAAE;GAAI,OAAO,OAAO;EAAgB;CAC/C;AAGJ;AAEA,eAAsB,YAAY,YAAgC,SAAkC;CAQhG,IAAI,CAAC,cAAc,eAAe,YAAY,UAAU,OAAO,GAAG;EAC9D,cAAc;EACd;CACJ;CAEA,QAAQ,YAAR;EACI,KAAK;GACD,MAAM,cAAc,OAAO;GAC3B;EACJ,SACI,eAAe,YAAY,kBAAkB,MAAM;CAC3D;AACJ;;;;;;;;;;AAWA,IAAa,uBAAuB;CAChC,WAAW;CACX,cAAc;CACd,MAAM;CACN,MAAM;AACV;;;;;;;;;;;;;AAcA,SAAgB,yBAAyB,SAGvC;CACE,MAAM,EAAE,OAAO,gBAAgB,iBAAiB;EAC5C,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAGD,OAAO;EACH,OAAO,MAAM,cAAc,YAAY;EACvC,UAAU,MAAM,iBAAiB,YAAY;CACjD;AACJ;;;;;;;;;;;;;AAcA,SAAgB,mBAA2B;CACvC,OAAO,YAAY,EAAE,CAAC,CAAC,SAAS,WAAW;AAC/C;;;;;;;;AASA,eAAe,cAAc,UAAqC;CAC9D,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;CACjD,IAAI;EACA,MAAM,SAAkB,KAAK,MAAM,IAAI;EACvC,MAAM,QAAQ,UAAU,OAAO,WAAW,YAAY,WAAW,SAAS,OAAO,QAAQ,KAAA;EACzF,IAAI,SAAS,OAAO,UAAU,YAAY,aAAa,SAAS,OAAO,MAAM,YAAY,UAAU;GAC/F,MAAM,OAAO,UAAU,SAAS,OAAO,MAAM,SAAS,WAAW,KAAK,MAAM,KAAK,KAAK;GACtF,OAAO,GAAG,MAAM,UAAU;EAC9B;CACJ,QAAQ,CAER;CACA,OAAO,KAAK,KAAK,KAAK,GAAG,SAAS,OAAO,GAAG,SAAS,aAAa,KAAK;AAC3E;AAEA,eAAe,cAAc,SAAkC;CAC3D,MAAM,EAAE,OAAO,UAAU,qBAAqB,yBAAyB,OAAO;CAE9E,MAAM,eAAe,CAAC;CACtB,MAAM,cAAc,oBAAoB,iBAAiB;CAEzD,IAAI,CAAC,OAAO;EACR,QAAQ,MAAM,MAAM,IAAI,sBAAsB,CAAC;EAC/C,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,4DAA4D,CAAC;EACpF,QAAQ,IAAI,MAAM,KAAK,qFAAqF,CAAC;EAC7G,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,cAAc,mBAAmB;CAMvC,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,gBAAoC,YAAY,WAAW,CAAC,CAAC;CAEnE,IAAI,aAAa,QAAQ,IAAI,sBAAsB;CAEnD,MAAM,YAAY,KAAK,KAAK,aAAa,WAAW,YAAY;CAChE,IAAI,GAAG,WAAW,SAAS,GACvB,IAAI;EACA,MAAM,QAAQ,KAAK,MAAM,GAAG,aAAa,WAAW,MAAM,CAAC;EAC3D,IAAI,SAAS,OAAO,UAAU,YAAY,OAAO,MAAM,eAAe,YAAY,CAAC,YAC/E,aAAa,MAAM;CAE3B,QAAQ,CAER;CASJ,MAAM,UAAU,sBAAsB,YAAY,WAAW,GAAG,WAAW,CAAC,CAAC;CAE7E,IAAI,WAAW,YAAY;EACvB,QAAQ,IAAI,+CAA+C;EAC3D,IAAI;GACA,MAAM,YAAY;GAClB,MAAM,eAAe,QAAQ,QAAQ,QAAQ,EAAE;GAI/C,MAAM,YAAY,GAAG,aAAa,0BAA0B,mBAAmB,KAAK,EAAE;GACtF,MAAM,YAAY,MAAM,MAAM,WAAW,EACrC,SAAS;IACL,iBAAiB,UAAU;IAC3B,UAAU;GACd,EACJ,CAAC;GACD,IAAI,CAAC,UAAU,IACX,MAAM,IAAI,YAAY,yBAAyB,UAAU,OAAO,GAAG,UAAU,YAAY;GAE7F,MAAM,aAAa,MAAM,UAAU,KAAK;GACxC,IAAI,CAAC,cAAc,OAAO,eAAe,UACrC,MAAM,IAAI,MAAM,+CAA+C;GAGnE,MAAM,UAAU,mBAAmB,YAAY,KAAK;GACpD,IAAI,CAAC,SACD,MAAM,IAAI,YAAY,yBAAyB,MAAM,EAAE;GAG3D,MAAM,WAAW,GAAG,aAAa,mBAAmB,QAAQ,GAAG;GAC/D,MAAM,WAAW,MAAM,MAAM,UAAU;IACnC,QAAQ;IACR,SAAS;KACL,iBAAiB,UAAU;KAC3B,gBAAgB;KAChB,UAAU;IACd;IACA,MAAM,KAAK,UAAU,EAAE,UAAU,UAAU,CAAC;GAChD,CAAC;GAED,IAAI,CAAC,SAAS,IACV,MAAM,IAAI,YAAY,2BAA2B,MAAM,cAAc,QAAQ,GAAG;GAGpF,QAAQ,IAAI,uBAAuB;GACnC,QAAQ,IAAI,MAAM,KAAK,6CAA6C,CAAC;GACrE,QAAQ,IAAI,EAAE;GAGd,QAAQ,IAAI,KAAK,MAAM,KAAK,QAAQ,EAAE,GAAG,QAAQ,OAAO;GAGxD,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,GAAG,eAAe,YAAY,IAAI,OAAO,UAAU,MAAM,GAAG;GACrG,QAAQ,IAAI,EAAE;GACd;EACJ,SAAS,KAAK;GACV,MAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;GAM9D,IAAI,eAAe,aAAa;IAC5B,QAAQ,MAAM,MAAM,IAAI,KAAK,QAAQ,CAAC;IACtC,QAAQ,WAAW;IACnB;GACJ;GACA,QAAQ,KAAK,MAAM,OAAO,6DAA6D,CAAC;GACxF,QAAQ,KAAK,MAAM,KAAK,cAAc,QAAQ,CAAC;EACnD;CACJ;CAGA,MAAM,aAAa,kBAAkB,WAAW;CAChD,MAAM,SAAS,WAAW,WAAW;CAErC,IAAI,CAAC,QACD,6BAA6B,WAAW;CAU5C,IAAI;CACJ,IAAI;EACA,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,MAAM,qBAAqB,aAAa,OAAO;EAC/C,MAAM,EAAE,uBAAuB,MAAM,OAAO;EAC5C,WAAW,MAAM,mBAAmB,aAAa,EAC7C,aAAa,YAAY,QAAQ,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC,EACnE,CAAC;CACL,SAAS,KAAK;EACV,QAAQ,MAAM,MAAM,IAAI,kCAAkC,CAAC;EAC3D,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9D,QAAQ,KAAK,CAAC;CAClB;CAKA,MAAM,EAAE,kBAAkB,MAAM,OAAO;CACvC,MAAM,MAAM,cAAc,UAAU,YAAY,WAAW,CAAC;CAC5D,IAAI,KAAK;EACL,MAAM,UAAU,MAAM,oBAAoB,KAAK,SAAS,SAAS,MAAM;EACvE,IAAI,SAAS;GACT,KAAK,MAAM,QAAQ,SAAS,QAAQ,MAAM,IAAI;GAC9C,QAAQ,KAAK,CAAC;EAClB;CACJ;CAEA,IAAI;EACA,MAAM,MAA8B,EAAE,GAAG,QAAQ,IAA8B;EAC/E,IAAI,SACA,IAAI,qBAAqB;EAE7B,IAAI,qBAAqB;EACzB,IAAI,wBAAwB;EAC5B,IAAI,uBAAuB,WAAW,KAAK,KAAK,aAAa,MAAM;EACnE,OAAO,OAAO,KAAK,SAAS,GAAG;EAE/B,MAAM,gBAAgB,oBAAoB,cAAc,gBAAgB,QAAQ,IAAI,YAAY,MAAM,IAAI;EAE1G,MAAM,gBAAgB,KAAK,KAAK,YAAY,wBAAwB;EACpE,GAAG,cAAc,eAAe,eAAe,OAAO;EAEtD,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,MAAM,KAAK,wDAAwD,CAAC;EAChF,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,KAAK,QAAQ,EAAE,GAAG,OAAO;EAChD,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,GAAG,SAAS,aAAa;EAClE,IAAI,CAAC,cACD,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,GAAG,IAAI,OAAO,YAAY,MAAM,GAAG;EAEhF,QAAQ,IAAI,EAAE;EAEd,MAAM,QAAQ,MAAM,QAAQ,CAAC,aAAa,GAAG;GACzC,KAAK;GACL,OAAO;GACP;EACJ,CAAC;EAMD,MAAM,gBAAgB;GAClB,IAAI;IAAE,GAAG,WAAW,aAAa;GAAG,QAAQ,CAAqB;EACrE;EAEA,OAAO,IAAI,SAAS,YAAY;GAC5B,MAAM,GAAG,UAAU,QAAQ;IACvB,QAAQ;IACR,QAAQ,MAAM,MAAM,IAAI,mCAAmC,CAAC;IAC5D,QAAQ,MAAM,MAAM,KAAK,KAAK,IAAI,SAAS,CAAC;IAC5C,QAAQ,KAAK,CAAC;GAClB,CAAC;GACD,MAAM,GAAG,UAAU,SAAS;IACxB,QAAQ;IACR,IAAI,SAAS,GACT,QAAQ,KAAK,QAAQ,CAAC;IAE1B,QAAQ;GACZ,CAAC;EACL,CAAC;CACL,SAAS,KAAK;EACV,QAAQ,MAAM,MAAM,IAAI,kCAAkC,CAAC;EAC3D,QAAQ,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;EAC9D,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;AAUA,eAAe,oBAAoB,KAAa,QAAqD;CACjG,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO;EAAE,kBAAkB;EAAK,yBAAyB;CAAO,CAAC;CACpF,OAAO,GAAG,eAAe,KAAA,CAAS;CAClC,IAAI;EACA,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,MAAM,UAAU;EAC7B,OAAO;CACX,SAAS,OAAO;EACZ,MAAM,EAAE,qBAAqB,yBAAyB,2BAClD,MAAM,OAAO,kCAAA,CAAA,MAAA,MAAA,EAAA,CAAA;EACjB,MAAM,cAAc;EACpB,OAAO,wBAAwB,KAAK,OAAO;GAAE;GAAa,OAAO,uBAAuB,MAAM;EAAE,CAAC,KAAK,CAClG,MAAM,IAAI,kCAAkC,0BAA0B,oBAAoB,KAAK,CAAC,GAAG,GACnG,MAAM,KAAK,KAAK,aAAa,CACjC;CACJ,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACJ;;;;;;;;;;;;;;;;;;AAmBA,SAAgB,oBAAoB,cAAuB,YAAY,OAAe;CAClF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAgGD,eAAe,kDAAgD,GAAG;;;;;;;;;;;;;;;;;;;;MAoBtE,YAAY,0BAA0B,uEAAuE;;;;AAInH;AAEA,SAAS,gBAAgB;CACrB,QAAQ,IAAI;EACd,MAAM,KAAK,aAAa,EAAE;;EAE1B,MAAM,MAAM,KAAK,OAAO,EAAE;gBACZ,MAAM,KAAK,WAAW,EAAE;;EAEtC,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,KAAK,gBAAgB,EAAE;;EAEpC,MAAM,MAAM,KAAK,wBAAwB,EAAE;IACzC,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,gBAAgB,EAAE;;EAE/B,MAAM,MAAM,KAAK,UAAU,EAAE;;;CAG9B;AACD"}

package/dist/{branch-pointer-DTQNLFtb.js → branch-pointer-9DnwkFJJ.js}

@@ -1,2 +1,2 @@
-import { c as branchDatabaseName, d as clearActiveBranch, f as databaseNameOf, m as writeActiveBranch, p as readActiveBranch } from "./prepare-C1iaiTC4.js";
+import { c as branchDatabaseName, d as clearActiveBranch, f as databaseNameOf, m as writeActiveBranch, p as readActiveBranch } from "./prepare-DdnU70z8.js";
 export { branchDatabaseName, clearActiveBranch, databaseNameOf, readActiveBranch, writeActiveBranch };

package/dist/{build-h_7Re-67.js → build-BBgT8EJZ.js}

@@ -1,12 +1,12 @@
 import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { n as getPMCommands, t as detectPackageManager } from "./package-manager-DSEOwTqM.js";
 import { p as requireProjectRoot } from "./project-Wp2zoyeN.js";
-import { n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-CcBphFdj.js";
+import { n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-BX0YD14a.js";
 import { n as cliVersion } from "./version-Buyyo1ut.js";
 import { c as buildableApps, d as findBackendApp, f as formatAppAddress, o as ManifestError, p as loadManifest, v as staticAppAddress } from "./manifest-DRp0UVTj.js";
-import { b as toolStdio, o as buildBundle, p as detectFrameworkDepDrift, s as buildStaticBundle, t as DEFAULT_BUNDLE_DIR } from "./bundle-CqURVN-K.js";
-import { i as staticBuildEnv, n as foldFrontendIntoBundle, t as assertBuiltForPath } from "./fold-static-BC9CYicw.js";
-import { l as writeResourceGraphFile, n as deriveOptionsFor, r as deriveResourceGraph, t as RESOURCE_GRAPH_FILENAME } from "./derive-Dl0z2OWi.js";
+import { b as toolStdio, o as buildBundle, p as detectFrameworkDepDrift, s as buildStaticBundle, t as DEFAULT_BUNDLE_DIR } from "./bundle-DtCCCr4w.js";
+import { i as staticBuildEnv, n as foldFrontendIntoBundle, t as assertBuiltForPath } from "./fold-static-hDHtDfTq.js";
+import { l as writeResourceGraphFile, n as deriveOptionsFor, r as deriveResourceGraph, t as RESOURCE_GRAPH_FILENAME } from "./derive-CsoFGAnK.js";
 import chalk from "chalk";
 import fs from "fs";
 import path from "path";
@@ -333,4 +333,4 @@ async function runWorkspaceBuilds(projectRoot) {
 //#endregion
 export { build_exports as n, buildAssetApp as t };
 
-//# sourceMappingURL=build-h_7Re-67.js.map
+//# sourceMappingURL=build-BBgT8EJZ.js.map

package/dist/{build-h_7Re-67.js.map → build-BBgT8EJZ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"build-h_7Re-67.js","names":[],"sources":["../src/commands/build.ts"],"sourcesContent":["/**\n * CLI command: rebase build [app...]\n *\n * Builds the apps a repository declares in `rebase.json`.\n *\n * For a `backend` app this produces a **bundle** — compiled collections,\n * functions and schema plus a manifest — which is the artifact the runtime\n * loads. For `static` and bundled `admin` apps it runs the declared build\n * command and reports where the output landed.\n *\n * A project with no manifest, or one whose backend has been ejected to its own\n * entrypoint, falls back to the previous behaviour: run every workspace's own\n * `build` script. Nothing that built before stops building.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { execa } from \"execa\";\nimport type { RebaseAppConfig, RebaseStaticAppConfig } from \"@rebasepro/types\";\nimport { requireProjectRoot } from \"../utils/project\";\nimport { parseCommandArgs, UsageError, wantsHelp } from \"../utils/args\";\nimport { detectPackageManager, getPMCommands } from \"../utils/package-manager\";\nimport { cliVersion } from \"../utils/version\";\nimport { toolStdio } from \"../utils/tool-stdio\";\nimport {\n    buildableApps,\n    findBackendApp,\n    formatAppAddress,\n    loadManifest,\n    ManifestError,\n    resolveBackendPaths,\n    staticAppAddress\n} from \"../manifest\";\nimport {\n    buildBundle,\n    buildStaticBundle,\n    detectFrameworkDepDrift,\n    DEFAULT_BUNDLE_DIR,\n    VENDOR_SIZE_WARN_BYTES\n} from \"../bundle\";\nimport { assertBuiltForPath, foldFrontendIntoBundle, staticBuildEnv } from \"../fold-static\";\nimport { deriveOptionsFor, deriveResourceGraph, RESOURCE_GRAPH_FILENAME, writeResourceGraphFile } from \"../resources/derive\";\n\nfunction printHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase build\")} — build the apps declared in rebase.json\n\n${chalk.bold(\"Usage\")}\n  rebase build [app...]        Build the named apps (default: all)\n\n${chalk.bold(\"Options\")}\n  --output, --out <dir>        Bundle output directory (default: ${DEFAULT_BUNDLE_DIR});\n                               one app at a time\n  --skip-type-check            Compile without type checking (faster; use for iteration only)\n  --skip-schema                Do not regenerate the database schema from collections\n  --no-static                  Do not fold the frontend into the backend bundle (each\n                               static app still gets its own bundle)\n  --skip-static-build          Fold the frontend as already built, without running its\n                               build command — for CI that built it in an earlier step\n  --no-vendor                  Do not install dependencies into the bundle (they\n                               install on every pod start instead, ~40-60s slower)\n  --vendor                     Install them whatever the tree's size — for a\n                               deploy that builds from source and never uploads it\n  --workspace                  Run every workspace's own build script instead\n  -h, --help                   Show this help\n\n${chalk.bold(\"Examples\")}\n  rebase build                 Build every app in this repository\n  rebase build backend         Build only the backend bundle\n  rebase build web             Build only the \"web\" static app\n`.trim());\n}\n\n/**\n * The two commands that turn a custom-runtime app into an image.\n *\n * Exported for the test, because the failure this replaced was in the printed\n * text and nowhere else. It said:\n *\n *     docker build -f backend/Dockerfile .\n *\n * for every custom backend, and the `.` was a guess — `context` was validated,\n * stored on the config, and read by nothing. For the reference project that\n * guess is wrong: `app/backend/Dockerfile` opens by copying `pnpm-lock.yaml`\n * and `pnpm-workspace.yaml`, which live at the monorepo root, so the command\n * `rebase build` handed you died on its first instruction. The deploy that\n * actually works, `infra/cloudbuild.yaml`, has always said\n * `-f app/backend/Dockerfile .` from the root.\n *\n * `dockerfile` is relative to `rebase.json`; `context` is too, and may point\n * above it. Docker resolves `-f` against the working directory, not the\n * context, so the path has to be re-expressed against wherever the command\n * runs — which is what the old line never did and is the whole reason it\n * could not be right for both.\n */\nexport function dockerBuildHint(\n    projectRoot: string,\n    name: string,\n    app: { dockerfile?: string; context?: string }\n): string[] {\n    const dockerfile = app.dockerfile ?? \"Dockerfile\";\n    const context = app.context ?? \".\";\n    const contextDir = path.resolve(projectRoot, context);\n    const fromContext = path.relative(contextDir, path.resolve(projectRoot, dockerfile));\n\n    const build = `${chalk.cyan(`npm run build --workspace ${name}`)}`;\n\n    // A Dockerfile outside its own context is legal to `docker build` but means\n    // nothing it copies is reachable, so there is no command to offer. Say what\n    // is wrong instead of printing one that cannot work.\n    if (fromContext.startsWith(\"..\")) {\n        return [\n            chalk.dim(`    ${build}`),\n            chalk.yellow(`    ⚠ ${dockerfile} is outside the build context (${context}) — nothing it COPYs is reachable.`),\n            chalk.dim(`      Widen \"context\" in rebase.json, or move the Dockerfile inside it.`)\n        ];\n    }\n\n    const docker = chalk.cyan(`docker build -f ${fromContext} .`);\n    return context === \".\"\n        ? [chalk.dim(`    ${build}  then  ${docker}`)]\n        : [chalk.dim(`    ${build}`), chalk.dim(`    ${chalk.cyan(`cd ${context}`)} && ${docker}`)];\n}\n\nexport async function buildCommand(rawArgs: string[] = []): Promise<void> {\n    if (wantsHelp(rawArgs)) {\n        printHelp();\n        return;\n    }\n\n    const { flags: args, positionals: requested } = parseCommandArgs({\n        spec: {\n            \"--output\": String,\n            // `--out` kept as an accepted alias. `generate-sdk` has always\n            // spelled this `--output`, and two names for one concept across one\n            // CLI is a thing you have to remember rather than know. `--output`\n            // is canonical now; `--out` still works so no script breaks.\n            \"--out\": \"--output\",\n            \"--skip-type-check\": Boolean,\n            /* Do not install the declared dependencies into the bundle. The\n               bundle still works — it installs them at boot, as every bundle did\n               before vendoring existed — so this is for a build that must not\n               shell out to npm, not for a smaller artifact. */\n            \"--no-vendor\": Boolean,\n            /* Keep the installed tree whatever its size. The size ceiling\n               protects an upload that a source-built deploy never performs, so\n               that path needs a way to say so. */\n            \"--vendor\": Boolean,\n            \"--skip-schema\": Boolean,\n            /* Do not fold the frontend into the backend bundle. For a project\n               that publishes its frontend elsewhere and does not want the assets\n               travelling with its API. */\n            \"--no-static\": Boolean,\n            /* Fold assets that are already built, without re-running the app's\n               build command — for a CI job that built the frontend in an earlier\n               step. */\n            \"--skip-static-build\": Boolean,\n            \"--workspace\": Boolean\n        },\n        rawArgs,\n        commandWords: 1,\n        command: \"build\"\n    });\n\n    const projectRoot = requireProjectRoot();\n\n    if (args[\"--workspace\"]) {\n        await runWorkspaceBuilds(projectRoot);\n        return;\n    }\n\n    let loaded;\n    try {\n        loaded = loadManifest(projectRoot);\n    } catch (err) {\n        if (err instanceof ManifestError) {\n            console.error(chalk.red(`✗ ${err.message}`));\n            for (const issue of err.issues) {\n                console.error(chalk.red(`    ${issue.path ? `${issue.path}: ` : \"\"}${issue.message}`));\n            }\n            process.exit(1);\n        }\n        throw err;\n    }\n\n    const { manifest, source } = loaded;\n\n    let targets = buildableApps(manifest);\n    if (requested.length > 0) {\n        const known = new Set(targets.map(t => t.name));\n        const unknown = requested.filter(name => !known.has(name));\n        if (unknown.length > 0) {\n            console.error(chalk.red(`✗ Unknown app(s): ${unknown.join(\", \")}`));\n            console.error(chalk.dim(`  This repository declares: ${targets.map(t => t.name).join(\", \") || \"(none)\"}`));\n            process.exit(1);\n        }\n        targets = targets.filter(t => requested.includes(t.name));\n    }\n\n    if (targets.length === 0) {\n        console.log(chalk.yellow(\"No buildable apps declared. Nothing to do.\"));\n        return;\n    }\n\n    // An ejected backend owns its own build; the workspace scripts are the only\n    // thing that knows how to run it.\n    const backend = findBackendApp(manifest);\n    if (!backend && source === \"synthesized\") {\n        console.log(chalk.dim(\"No rebase.json found — building workspace packages.\\n\"));\n        await runWorkspaceBuilds(projectRoot);\n        return;\n    }\n\n    // `--output` names one bundle directory, resolved from where it was typed.\n    // It is refused for a build that produces several bundles rather than\n    // handed to each: every bundle build empties its directory first, so the\n    // last app built deleted the others' and the build still reported success.\n    const output = args[\"--output\"] ? path.resolve(process.cwd(), args[\"--output\"]) : undefined;\n    const bundled = targets.filter(({ app }) =>\n        (app.type === \"backend\" && app.runtime !== \"custom\") ||\n        (app.type === \"static\" && Boolean(app.build) && Boolean(app.output)));\n    if (output && bundled.length > 1) {\n        throw new UsageError(\n            `--output names one bundle directory, and this build produces ${bundled.length}: ` +\n            `${bundled.map(t => t.name).join(\", \")}. Build one app into it: ` +\n            `rebase build ${bundled[0].name} --output ${args[\"--output\"]}`\n        );\n    }\n\n    console.log(`${chalk.bold(\"Rebase\")} — building ${targets.length} app(s)\\n`);\n\n    // Each static app is built once per run, whichever consumer gets to it\n    // first: folding into the backend bundle, or its own static bundle.\n    const builtApps = new Set<string>();\n\n    for (const { name, app } of targets) {\n        console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));\n\n        if (app.type === \"backend\" && app.runtime === \"custom\") {\n            // An ejected backend's artifact is an IMAGE, not a bundle. Building\n            // one anyway produced a `dist-bundle/` the project never deploys,\n            // which is worse than doing nothing: it looks like the thing that\n            // ships. The workspace's own `build` script compiles this app, and\n            // the Dockerfile turns it into the image.\n            console.log(chalk.dim(\"  custom runtime — this project builds its own image, not a bundle\"));\n            for (const line of dockerBuildHint(projectRoot, name, app)) console.log(line);\n            console.log(\"\");\n            continue;\n        }\n\n        if (app.type === \"backend\") {\n            // Derived per backend app, because each has its own config\n            // directory. Issues are fatal here rather than reported: a bundle\n            // whose manifest is missing a bucket the code declares would deploy\n            // into a tenant with nothing provisioned for it, and the first sign\n            // would be uploads failing in production.\n            const { graph: resourceGraph, issues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, app));\n            if (issues.length > 0) {\n                console.error(chalk.red(`\\n  ✗ ${issues.length} problem(s) in the declared resources:\\n`));\n                for (const issue of issues) console.error(`    ${chalk.bold(issue.path)}  ${issue.message}`);\n                console.error(\"\");\n                process.exitCode = 1;\n                return;\n            }\n            // Written alongside the bundle so the repository records what this\n            // project needs. `rebase resources --check` is what keeps it honest.\n            // Committed, so a change to it is said: the first build of a\n            // scaffold otherwise left it untracked with no word on what it is.\n            if (writeResourceGraphFile(projectRoot, resourceGraph).changed) {\n                console.log(chalk.dim(`  ${RESOURCE_GRAPH_FILENAME} updated — commit it: it records what this project needs from a host`));\n            }\n\n            /* The framework pins, read before the build and reported after it.\n               Ranges no single version satisfies are refused by `buildBundle`\n               itself, before it builds anything, for every command that builds\n               a bundle. */\n            const drift = detectFrameworkDepDrift(projectRoot, cliVersion());\n\n            const result = await buildBundle({\n                projectRoot,\n                appName: name,\n                app,\n                outDir: output,\n                runtimeRange: manifest.rebase,\n                resources: resourceGraph,\n                skipTypeCheck: args[\"--skip-type-check\"],\n                skipSchema: args[\"--skip-schema\"],\n                vendor: args[\"--no-vendor\"] ? false : (args[\"--vendor\"] ? true : undefined)\n            });\n            const rel = path.relative(projectRoot, result.outDir);\n            console.log(chalk.green(`  ✓ bundle → ${rel}/`));\n            // A headless build has no schema version — the API is introspected\n            // from the live database at boot — and interpolating it anyway left\n            // the summary ending in a dangling `schema `, which reads as a value\n            // that failed to render rather than one that does not exist.\n            const schemaVersion = result.manifest.schemaVersion;\n            console.log(chalk.dim(\n                `    ${result.collectionCount} collection(s)${schemaVersion ? `, schema ${schemaVersion}` : \"\"}`\n            ));\n            /* Say what the bundle's cold start will be, at the one moment\n               anyone is listening.\n\n               A vendored bundle starts in about five seconds; one that installs\n               at boot takes forty to sixty, on EVERY pod start — an eviction, a\n               node failure, an OOM, a runtime rollout. That is not a build\n               detail, it is what each of those events costs in downtime, and it\n               is invisible until an incident unless it is said here. */\n            if (result.vendor.vendored) {\n                console.log(chalk.dim(`    dependencies installed into the bundle (${result.vendor.target?.os}/${result.vendor.target?.cpu})`));\n                if ((result.vendor.bytes ?? 0) > VENDOR_SIZE_WARN_BYTES) {\n                    const mb = Math.round((result.vendor.bytes ?? 0) / (1024 * 1024));\n                    /* The limit is on the *compressed* upload and this is the\n                       tree on disk, so a number above 100 does not mean the\n                       upload fails — but \"201 MB, close to the 100 MB limit\"\n                       reads as nonsense and got ignored for exactly that\n                       reason. Say which quantity is which. */\n                    console.log(chalk.yellow(\n                        `    ⚠ the installed tree is ${mb} MB on disk — enough to risk the control plane's 100 MB ` +\n                        \"limit on the compressed upload\"));\n                    console.log(chalk.dim(\"      Shrink the declared dependencies, or rebuild with --no-vendor.\"));\n                }\n            } else if (Object.keys(result.manifest.deps.declared).length === 0) {\n                // Nothing to install is not a degraded state — this bundle\n                // already starts as fast as a vendored one. Warning here would\n                // train people to ignore the warning that matters.\n                console.log(chalk.dim(\"    no dependencies to install — nothing to bundle\"));\n            } else {\n                console.log(chalk.yellow(`    ⚠ dependencies not bundled: ${result.vendor.skipped}`));\n                console.log(chalk.dim(\"      They install on every pod start instead, which is ~40-60s of cold start.\"));\n            }\n\n            if (result.manifest.hooks.native) {\n                const names = (result.manifest.hooks.nativeModules ?? []).map(m => m.name).join(\", \");\n                console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));\n                console.log(chalk.dim(\"      These cannot run on the managed runtime. See `rebase doctor`.\"));\n            }\n\n            /* Framework pins older than this CLI.\n\n               Warned here because this is the only moment anyone can be told.\n               Locally every `@rebasepro/*` resolves through pnpm's workspace and\n               `link:` overrides to the checkout, so the version strings in\n               package.json are never exercised — the project runs fine on a\n               developer's machine while declaring something years old. Those\n               strings are first honoured when the runtime npm-installs them in\n               the cloud, and by then the symptom is a tenant that boots and then\n               misbehaves against its database.\n\n               A warning rather than a hard failure: the CLI cannot know that a\n               newer package has actually been published, and refusing to build\n               over a guess would be worse than saying it out loud. (`drift` was\n               read before the build, above.) */\n            if (drift.behind.length > 0) {\n                console.log(chalk.yellow(`    ⚠ framework dependencies older than this CLI (${cliVersion()}):`));\n                for (const dep of drift.behind) {\n                    console.log(chalk.dim(`      ${dep.name}@${dep.range}  (${dep.file})`));\n                }\n                console.log(chalk.dim(\"      The image supplies the server, but your bundle supplies the database\"));\n                console.log(chalk.dim(\"      driver — a newer runtime does not update it.\"));\n                console.log(chalk.dim(`      Run \\`${upgradeToThisCli()}\\`, then rebuild.`));\n            } else if (drift.disagreeing.length > 0) {\n                console.log(chalk.yellow(`    ⚠ mixed @rebasepro versions declared: ${drift.disagreeing.join(\", \")}`));\n                console.log(chalk.dim(\"      These are published together and expect to run together.\"));\n                console.log(chalk.dim(`      Run \\`${upgradeToThisCli()}\\` to pin them alike, then rebuild.`));\n            }\n\n            /* Fold the project's static apps into the backend bundle, so ONE\n               runtime serves the site at `/`, the admin at `/admin` and the API\n               at `/api` — the shape the scaffolded template produces and the\n               shape a custom container already had.\n\n               Without this, moving a project to the managed runtime silently\n               removed its website: the API answered perfectly and every page\n               404'd, because the managed pod runs the backend bundle and nothing\n               else. Parity with the container being replaced is the only honest\n               baseline for calling managed a drop-in.\n\n               `--no-static` opts out, for a project that publishes its frontend\n               somewhere else and does not want the assets in its bundle. */\n            if (!args[\"--no-static\"]) {\n                const folded = await foldFrontendIntoBundle({\n                    projectRoot,\n                    manifest,\n                    bundleDir: result.outDir,\n                    skipBuild: args[\"--skip-static-build\"] === true,\n                    builtApps,\n                    log: (m) => console.log(m)\n                }).catch((err: unknown) => {\n                    console.error(chalk.red(`    ✗ ${err instanceof Error ? err.message : String(err)}`));\n                    process.exit(1);\n                });\n                for (const outcome of folded ?? []) {\n                    console.log(\n                        chalk.green(`    ✓ ${outcome.appName} folded in`) +\n                        chalk.dim(` (${outcome.fileCount} file(s) → served at ${formatAppAddress(outcome)})`)\n                    );\n                }\n            }\n        } else if (app.type === \"static\") {\n            await buildAssetApp(projectRoot, name, app, manifest.rebase, output, { builtApps }).catch((err: unknown) => {\n                console.error(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n                process.exit(1);\n            });\n        }\n\n        console.log(\"\");\n    }\n\n    console.log(chalk.green(\"✓ Build complete.\"));\n}\n\n/**\n * Build a static app and package it into a static bundle.\n *\n * Runs the app's own build command, checks it produced the declared output, then\n * packages that output into a `static`-kind bundle — the same deployable shape as\n * a backend bundle, so a frontend or admin app deploys through the identical\n * path and runs on the identical image, just serving files instead of an API.\n *\n * Throws when the build fails or produces nothing usable, so the caller answers\n * in its own way: `rebase build` with a red line, `rebase cloud deploy --json`\n * with its JSON error.\n */\nexport async function buildAssetApp(\n    projectRoot: string,\n    name: string,\n    app: RebaseAppConfig,\n    runtimeRange: string,\n    outOverride?: string,\n    /**\n     * `quietStdout`: every line, the build command's included, goes to stderr. See `toolStdio`.\n     * `builtApps`: the static apps already built in this run (see `FoldOptions.builtApps`).\n     */\n    options: { quietStdout?: boolean; builtApps?: Set<string> } = {}\n): Promise<string | undefined> {\n    const asset = app as RebaseStaticAppConfig;\n    // The path part is what the app is built for and mounted at; the hostname,\n    // when `path` names one, only travels in the bundle.\n    const address = staticAppAddress(name, asset);\n    const basePath = address.path;\n    const say = (line: string): void => {\n        if (options.quietStdout) console.error(line);\n        else console.log(line);\n    };\n\n    if (!asset.build) {\n        say(chalk.dim(\"  no build command declared — skipping\"));\n        return undefined;\n    }\n\n    if (options.builtApps?.has(name)) {\n        say(chalk.dim(\"  built once already in this run — packaging that output\"));\n    } else {\n        try {\n            await execa(asset.build, {\n                cwd: projectRoot,\n                stdio: toolStdio(options.quietStdout),\n                shell: true,\n                env: staticBuildEnv(basePath, name)\n            });\n        } catch {\n            throw new Error(`build command failed for \"${name}\"`);\n        }\n        options.builtApps?.add(name);\n    }\n\n    if (!asset.output) {\n        say(chalk.yellow(\"  no output directory declared — built, but nothing to bundle\"));\n        return undefined;\n    }\n\n    const outputPath = path.join(projectRoot, asset.output);\n    if (!fs.existsSync(outputPath)) {\n        // The command exited 0 but produced nothing where the manifest says it\n        // should. Bundling that would ship an empty site.\n        throw new Error(`declared output \"${asset.output}\" does not exist after building`);\n    }\n\n    // The assets were built for `basePath`; refusing here is the difference\n    // between a build error and a blank page nobody can diagnose.\n    const indexHtml = path.join(outputPath, \"index.html\");\n    if (fs.existsSync(indexHtml)) {\n        assertBuiltForPath(fs.readFileSync(indexHtml, \"utf8\"), basePath, name);\n    }\n\n    // Per-app bundle directory, so a project's several static apps do not clobber\n    // one another or the backend's `dist-bundle`.\n    const outDir = outOverride\n        ? path.resolve(process.cwd(), outOverride)\n        : path.join(projectRoot, `dist-bundle-${name}`);\n    const result = buildStaticBundle({\n        projectRoot,\n        appName: name,\n        assetsDir: outputPath,\n        outDir,\n        runtimeRange,\n        path: basePath,\n        host: address.host,\n        spa: asset.spa ?? true,\n        cms: asset.cms\n    });\n    const rel = path.relative(projectRoot, result.outDir);\n    say(\n        chalk.green(`  ✓ static bundle → ${rel}/`) +\n        chalk.dim(` (${result.fileCount} file(s) → served at ${formatAppAddress(address)})`)\n    );\n    return result.outDir;\n}\n\n/**\n * The `rebase upgrade` line the drift warnings print.\n *\n * Aimed at this CLI's own version, because that is what the warning measured\n * against: \"older than this CLI\" is answered by moving to exactly this CLI, not\n * to whatever `latest` happens to be — which, on a canary, is older still.\n */\nfunction upgradeToThisCli(): string {\n    const version = cliVersion();\n    return version === \"unknown\" ? \"rebase upgrade\" : `rebase upgrade --to ${version}`;\n}\n\n/** The pre-manifest behaviour: build every workspace package. */\nasync function runWorkspaceBuilds(projectRoot: string): Promise<void> {\n    const pm = detectPackageManager(projectRoot);\n    const cmds = getPMCommands(pm);\n    const buildCmd = cmds.runAll(\"build\");\n\n    console.log(`${chalk.bold(\"Rebase\")} — Building all workspaces with ${chalk.cyan(pm)}...\\n`);\n\n    try {\n        await execa(buildCmd[0], buildCmd.slice(1), {\n            cwd: projectRoot,\n            stdio: \"inherit\"\n        });\n    } catch {\n        console.error(chalk.red(\"\\n✗ Build failed.\"));\n        process.exit(1);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,SAAS,YAAkB;CACvB,QAAQ,IAAI;EACd,MAAM,KAAK,cAAc,EAAE;;EAE3B,MAAM,KAAK,OAAO,EAAE;;;EAGpB,MAAM,KAAK,SAAS,EAAE;mEAC2C,mBAAmB;;;;;;;;;;;;;;;EAepF,MAAM,KAAK,UAAU,EAAE;;;;EAIvB,KAAK,CAAC;AACR;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,gBACZ,aACA,MACA,KACQ;CACR,MAAM,aAAa,IAAI,cAAc;CACrC,MAAM,UAAU,IAAI,WAAW;CAC/B,MAAM,aAAa,KAAK,QAAQ,aAAa,OAAO;CACpD,MAAM,cAAc,KAAK,SAAS,YAAY,KAAK,QAAQ,aAAa,UAAU,CAAC;CAEnF,MAAM,QAAQ,GAAG,MAAM,KAAK,6BAA6B,MAAM;CAK/D,IAAI,YAAY,WAAW,IAAI,GAC3B,OAAO;EACH,MAAM,IAAI,OAAO,OAAO;EACxB,MAAM,OAAO,SAAS,WAAW,iCAAiC,QAAQ,mCAAmC;EAC7G,MAAM,IAAI,yEAAyE;CACvF;CAGJ,MAAM,SAAS,MAAM,KAAK,mBAAmB,YAAY,GAAG;CAC5D,OAAO,YAAY,MACb,CAAC,MAAM,IAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,IAC3C,CAAC,MAAM,IAAI,OAAO,OAAO,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,MAAM,SAAS,EAAE,MAAM,QAAQ,CAAC;AAClG;AAEA,eAAsB,aAAa,UAAoB,CAAC,GAAkB;CACtE,IAAI,UAAU,OAAO,GAAG;EACpB,UAAU;EACV;CACJ;CAEA,MAAM,EAAE,OAAO,MAAM,aAAa,cAAc,iBAAiB;EAC7D,MAAM;GACF,YAAY;GAKZ,SAAS;GACT,qBAAqB;GAKrB,eAAe;GAIf,YAAY;GACZ,iBAAiB;GAIjB,eAAe;GAIf,uBAAuB;GACvB,eAAe;EACnB;EACA;EACA,cAAc;EACd,SAAS;CACb,CAAC;CAED,MAAM,cAAc,mBAAmB;CAEvC,IAAI,KAAK,gBAAgB;EACrB,MAAM,mBAAmB,WAAW;EACpC;CACJ;CAEA,IAAI;CACJ,IAAI;EACA,SAAS,aAAa,WAAW;CACrC,SAAS,KAAK;EACV,IAAI,eAAe,eAAe;GAC9B,QAAQ,MAAM,MAAM,IAAI,KAAK,IAAI,SAAS,CAAC;GAC3C,KAAK,MAAM,SAAS,IAAI,QACpB,QAAQ,MAAM,MAAM,IAAI,OAAO,MAAM,OAAO,GAAG,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,CAAC;GAEzF,QAAQ,KAAK,CAAC;EAClB;EACA,MAAM;CACV;CAEA,MAAM,EAAE,UAAU,WAAW;CAE7B,IAAI,UAAU,cAAc,QAAQ;CACpC,IAAI,UAAU,SAAS,GAAG;EACtB,MAAM,QAAQ,IAAI,IAAI,QAAQ,KAAI,MAAK,EAAE,IAAI,CAAC;EAC9C,MAAM,UAAU,UAAU,QAAO,SAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;EACzD,IAAI,QAAQ,SAAS,GAAG;GACpB,QAAQ,MAAM,MAAM,IAAI,qBAAqB,QAAQ,KAAK,IAAI,GAAG,CAAC;GAClE,QAAQ,MAAM,MAAM,IAAI,+BAA+B,QAAQ,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,UAAU,CAAC;GACzG,QAAQ,KAAK,CAAC;EAClB;EACA,UAAU,QAAQ,QAAO,MAAK,UAAU,SAAS,EAAE,IAAI,CAAC;CAC5D;CAEA,IAAI,QAAQ,WAAW,GAAG;EACtB,QAAQ,IAAI,MAAM,OAAO,4CAA4C,CAAC;EACtE;CACJ;CAKA,IAAI,CADY,eAAe,QAC1B,KAAW,WAAW,eAAe;EACtC,QAAQ,IAAI,MAAM,IAAI,uDAAuD,CAAC;EAC9E,MAAM,mBAAmB,WAAW;EACpC;CACJ;CAMA,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ,QAAQ,IAAI,GAAG,KAAK,WAAW,IAAI,KAAA;CAClF,MAAM,UAAU,QAAQ,QAAQ,EAAE,UAC7B,IAAI,SAAS,aAAa,IAAI,YAAY,YAC1C,IAAI,SAAS,YAAY,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAE;CACxE,IAAI,UAAU,QAAQ,SAAS,GAC3B,MAAM,IAAI,WACN,gEAAgE,QAAQ,OAAO,IAC5E,QAAQ,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,wCACvB,QAAQ,EAAE,CAAC,KAAK,YAAY,KAAK,aACrD;CAGJ,QAAQ,IAAI,GAAG,MAAM,KAAK,QAAQ,EAAE,cAAc,QAAQ,OAAO,UAAU;CAI3E,MAAM,4BAAY,IAAI,IAAY;CAElC,KAAK,MAAM,EAAE,MAAM,SAAS,SAAS;EACjC,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;EAEjE,IAAI,IAAI,SAAS,aAAa,IAAI,YAAY,UAAU;GAMpD,QAAQ,IAAI,MAAM,IAAI,oEAAoE,CAAC;GAC3F,KAAK,MAAM,QAAQ,gBAAgB,aAAa,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI;GAC5E,QAAQ,IAAI,EAAE;GACd;EACJ;EAEA,IAAI,IAAI,SAAS,WAAW;GAMxB,MAAM,EAAE,OAAO,eAAe,WAAW,MAAM,oBAAoB,iBAAiB,aAAa,GAAG,CAAC;GACrG,IAAI,OAAO,SAAS,GAAG;IACnB,QAAQ,MAAM,MAAM,IAAI,SAAS,OAAO,OAAO,yCAAyC,CAAC;IACzF,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,SAAS;IAC3F,QAAQ,MAAM,EAAE;IAChB,QAAQ,WAAW;IACnB;GACJ;GAKA,IAAI,uBAAuB,aAAa,aAAa,CAAC,CAAC,SACnD,QAAQ,IAAI,MAAM,IAAI,KAAK,wBAAwB,qEAAqE,CAAC;GAO7H,MAAM,QAAQ,wBAAwB,aAAa,WAAW,CAAC;GAE/D,MAAM,SAAS,MAAM,YAAY;IAC7B;IACA,SAAS;IACT;IACA,QAAQ;IACR,cAAc,SAAS;IACvB,WAAW;IACX,eAAe,KAAK;IACpB,YAAY,KAAK;IACjB,QAAQ,KAAK,iBAAiB,QAAS,KAAK,cAAc,OAAO,KAAA;GACrE,CAAC;GACD,MAAM,MAAM,KAAK,SAAS,aAAa,OAAO,MAAM;GACpD,QAAQ,IAAI,MAAM,MAAM,gBAAgB,IAAI,EAAE,CAAC;GAK/C,MAAM,gBAAgB,OAAO,SAAS;GACtC,QAAQ,IAAI,MAAM,IACd,OAAO,OAAO,gBAAgB,gBAAgB,gBAAgB,YAAY,kBAAkB,IAChG,CAAC;GASD,IAAI,OAAO,OAAO,UAAU;IACxB,QAAQ,IAAI,MAAM,IAAI,+CAA+C,OAAO,OAAO,QAAQ,GAAG,GAAG,OAAO,OAAO,QAAQ,IAAI,EAAE,CAAC;IAC9H,KAAK,OAAO,OAAO,SAAS,KAAA,WAA6B;KACrD,MAAM,KAAK,KAAK,OAAO,OAAO,OAAO,SAAS,MAAM,OAAO,KAAK;KAMhE,QAAQ,IAAI,MAAM,OACd,+BAA+B,GAAG,uFACF,CAAC;KACrC,QAAQ,IAAI,MAAM,IAAI,sEAAsE,CAAC;IACjG;GACJ,OAAO,IAAI,OAAO,KAAK,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,WAAW,GAI7D,QAAQ,IAAI,MAAM,IAAI,oDAAoD,CAAC;QACxE;IACH,QAAQ,IAAI,MAAM,OAAO,mCAAmC,OAAO,OAAO,SAAS,CAAC;IACpF,QAAQ,IAAI,MAAM,IAAI,gFAAgF,CAAC;GAC3G;GAEA,IAAI,OAAO,SAAS,MAAM,QAAQ;IAC9B,MAAM,SAAS,OAAO,SAAS,MAAM,iBAAiB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;IACpF,QAAQ,IAAI,MAAM,OAAO,uCAAuC,OAAO,CAAC;IACxE,QAAQ,IAAI,MAAM,IAAI,qEAAqE,CAAC;GAChG;GAiBA,IAAI,MAAM,OAAO,SAAS,GAAG;IACzB,QAAQ,IAAI,MAAM,OAAO,qDAAqD,WAAW,EAAE,GAAG,CAAC;IAC/F,KAAK,MAAM,OAAO,MAAM,QACpB,QAAQ,IAAI,MAAM,IAAI,SAAS,IAAI,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;IAE1E,QAAQ,IAAI,MAAM,IAAI,4EAA4E,CAAC;IACnG,QAAQ,IAAI,MAAM,IAAI,oDAAoD,CAAC;IAC3E,QAAQ,IAAI,MAAM,IAAI,eAAe,iBAAiB,EAAE,kBAAkB,CAAC;GAC/E,OAAO,IAAI,MAAM,YAAY,SAAS,GAAG;IACrC,QAAQ,IAAI,MAAM,OAAO,6CAA6C,MAAM,YAAY,KAAK,IAAI,GAAG,CAAC;IACrG,QAAQ,IAAI,MAAM,IAAI,gEAAgE,CAAC;IACvF,QAAQ,IAAI,MAAM,IAAI,eAAe,iBAAiB,EAAE,oCAAoC,CAAC;GACjG;GAeA,IAAI,CAAC,KAAK,gBAAgB;IACtB,MAAM,SAAS,MAAM,uBAAuB;KACxC;KACA;KACA,WAAW,OAAO;KAClB,WAAW,KAAK,2BAA2B;KAC3C;KACA,MAAM,MAAM,QAAQ,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC,OAAO,QAAiB;KACvB,QAAQ,MAAM,MAAM,IAAI,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;KACpF,QAAQ,KAAK,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,WAAW,UAAU,CAAC,GAC7B,QAAQ,IACJ,MAAM,MAAM,SAAS,QAAQ,QAAQ,WAAW,IAChD,MAAM,IAAI,KAAK,QAAQ,UAAU,uBAAuB,iBAAiB,OAAO,EAAE,EAAE,CACxF;GAER;EACJ,OAAO,IAAI,IAAI,SAAS,UACpB,MAAM,cAAc,aAAa,MAAM,KAAK,SAAS,QAAQ,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,QAAiB;GACxG,QAAQ,MAAM,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;GAClF,QAAQ,KAAK,CAAC;EAClB,CAAC;EAGL,QAAQ,IAAI,EAAE;CAClB;CAEA,QAAQ,IAAI,MAAM,MAAM,mBAAmB,CAAC;AAChD;;;;;;;;;;;;;AAcA,eAAsB,cAClB,aACA,MACA,KACA,cACA,aAKA,UAA8D,CAAC,GACpC;CAC3B,MAAM,QAAQ;CAGd,MAAM,UAAU,iBAAiB,MAAM,KAAK;CAC5C,MAAM,WAAW,QAAQ;CACzB,MAAM,OAAO,SAAuB;EAChC,IAAI,QAAQ,aAAa,QAAQ,MAAM,IAAI;OACtC,QAAQ,IAAI,IAAI;CACzB;CAEA,IAAI,CAAC,MAAM,OAAO;EACd,IAAI,MAAM,IAAI,wCAAwC,CAAC;EACvD;CACJ;CAEA,IAAI,QAAQ,WAAW,IAAI,IAAI,GAC3B,IAAI,MAAM,IAAI,0DAA0D,CAAC;MACtE;EACH,IAAI;GACA,MAAM,MAAM,MAAM,OAAO;IACrB,KAAK;IACL,OAAO,UAAU,QAAQ,WAAW;IACpC,OAAO;IACP,KAAK,eAAe,UAAU,IAAI;GACtC,CAAC;EACL,QAAQ;GACJ,MAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;EACxD;EACA,QAAQ,WAAW,IAAI,IAAI;CAC/B;CAEA,IAAI,CAAC,MAAM,QAAQ;EACf,IAAI,MAAM,OAAO,+DAA+D,CAAC;EACjF;CACJ;CAEA,MAAM,aAAa,KAAK,KAAK,aAAa,MAAM,MAAM;CACtD,IAAI,CAAC,GAAG,WAAW,UAAU,GAGzB,MAAM,IAAI,MAAM,oBAAoB,MAAM,OAAO,gCAAgC;CAKrF,MAAM,YAAY,KAAK,KAAK,YAAY,YAAY;CACpD,IAAI,GAAG,WAAW,SAAS,GACvB,mBAAmB,GAAG,aAAa,WAAW,MAAM,GAAG,UAAU,IAAI;CAQzE,MAAM,SAAS,kBAAkB;EAC7B;EACA,SAAS;EACT,WAAW;EACX,QAPW,cACT,KAAK,QAAQ,QAAQ,IAAI,GAAG,WAAW,IACvC,KAAK,KAAK,aAAa,eAAe,MAAM;EAM9C;EACA,MAAM;EACN,MAAM,QAAQ;EACd,KAAK,MAAM,OAAO;EAClB,KAAK,MAAM;CACf,CAAC;CACD,MAAM,MAAM,KAAK,SAAS,aAAa,OAAO,MAAM;CACpD,IACI,MAAM,MAAM,uBAAuB,IAAI,EAAE,IACzC,MAAM,IAAI,KAAK,OAAO,UAAU,uBAAuB,iBAAiB,OAAO,EAAE,EAAE,CACvF;CACA,OAAO,OAAO;AAClB;;;;;;;;AASA,SAAS,mBAA2B;CAChC,MAAM,UAAU,WAAW;CAC3B,OAAO,YAAY,YAAY,mBAAmB,uBAAuB;AAC7E;;AAGA,eAAe,mBAAmB,aAAoC;CAClE,MAAM,KAAK,qBAAqB,WAAW;CAE3C,MAAM,WADO,cAAc,EACV,CAAA,CAAK,OAAO,OAAO;CAEpC,QAAQ,IAAI,GAAG,MAAM,KAAK,QAAQ,EAAE,kCAAkC,MAAM,KAAK,EAAE,EAAE,MAAM;CAE3F,IAAI;EACA,MAAM,MAAM,SAAS,IAAI,SAAS,MAAM,CAAC,GAAG;GACxC,KAAK;GACL,OAAO;EACX,CAAC;CACL,QAAQ;EACJ,QAAQ,MAAM,MAAM,IAAI,mBAAmB,CAAC;EAC5C,QAAQ,KAAK,CAAC;CAClB;AACJ"}
+{"version":3,"file":"build-BBgT8EJZ.js","names":[],"sources":["../src/commands/build.ts"],"sourcesContent":["/**\n * CLI command: rebase build [app...]\n *\n * Builds the apps a repository declares in `rebase.json`.\n *\n * For a `backend` app this produces a **bundle** — compiled collections,\n * functions and schema plus a manifest — which is the artifact the runtime\n * loads. For `static` and bundled `admin` apps it runs the declared build\n * command and reports where the output landed.\n *\n * A project with no manifest, or one whose backend has been ejected to its own\n * entrypoint, falls back to the previous behaviour: run every workspace's own\n * `build` script. Nothing that built before stops building.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport chalk from \"chalk\";\nimport { execa } from \"execa\";\nimport type { RebaseAppConfig, RebaseStaticAppConfig } from \"@rebasepro/types\";\nimport { requireProjectRoot } from \"../utils/project\";\nimport { parseCommandArgs, UsageError, wantsHelp } from \"../utils/args\";\nimport { detectPackageManager, getPMCommands } from \"../utils/package-manager\";\nimport { cliVersion } from \"../utils/version\";\nimport { toolStdio } from \"../utils/tool-stdio\";\nimport {\n    buildableApps,\n    findBackendApp,\n    formatAppAddress,\n    loadManifest,\n    ManifestError,\n    resolveBackendPaths,\n    staticAppAddress\n} from \"../manifest\";\nimport {\n    buildBundle,\n    buildStaticBundle,\n    detectFrameworkDepDrift,\n    DEFAULT_BUNDLE_DIR,\n    VENDOR_SIZE_WARN_BYTES\n} from \"../bundle\";\nimport { assertBuiltForPath, foldFrontendIntoBundle, staticBuildEnv } from \"../fold-static\";\nimport { deriveOptionsFor, deriveResourceGraph, RESOURCE_GRAPH_FILENAME, writeResourceGraphFile } from \"../resources/derive\";\n\nfunction printHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase build\")} — build the apps declared in rebase.json\n\n${chalk.bold(\"Usage\")}\n  rebase build [app...]        Build the named apps (default: all)\n\n${chalk.bold(\"Options\")}\n  --output, --out <dir>        Bundle output directory (default: ${DEFAULT_BUNDLE_DIR});\n                               one app at a time\n  --skip-type-check            Compile without type checking (faster; use for iteration only)\n  --skip-schema                Do not regenerate the database schema from collections\n  --no-static                  Do not fold the frontend into the backend bundle (each\n                               static app still gets its own bundle)\n  --skip-static-build          Fold the frontend as already built, without running its\n                               build command — for CI that built it in an earlier step\n  --no-vendor                  Do not install dependencies into the bundle (they\n                               install on every pod start instead, ~40-60s slower)\n  --vendor                     Install them whatever the tree's size — for a\n                               deploy that builds from source and never uploads it\n  --workspace                  Run every workspace's own build script instead\n  -h, --help                   Show this help\n\n${chalk.bold(\"Examples\")}\n  rebase build                 Build every app in this repository\n  rebase build backend         Build only the backend bundle\n  rebase build web             Build only the \"web\" static app\n`.trim());\n}\n\n/**\n * The two commands that turn a custom-runtime app into an image.\n *\n * Exported for the test, because the failure this replaced was in the printed\n * text and nowhere else. It said:\n *\n *     docker build -f backend/Dockerfile .\n *\n * for every custom backend, and the `.` was a guess — `context` was validated,\n * stored on the config, and read by nothing. For the reference project that\n * guess is wrong: `app/backend/Dockerfile` opens by copying `pnpm-lock.yaml`\n * and `pnpm-workspace.yaml`, which live at the monorepo root, so the command\n * `rebase build` handed you died on its first instruction. The deploy that\n * actually works, `infra/cloudbuild.yaml`, has always said\n * `-f app/backend/Dockerfile .` from the root.\n *\n * `dockerfile` is relative to `rebase.json`; `context` is too, and may point\n * above it. Docker resolves `-f` against the working directory, not the\n * context, so the path has to be re-expressed against wherever the command\n * runs — which is what the old line never did and is the whole reason it\n * could not be right for both.\n */\nexport function dockerBuildHint(\n    projectRoot: string,\n    name: string,\n    app: { dockerfile?: string; context?: string }\n): string[] {\n    const dockerfile = app.dockerfile ?? \"Dockerfile\";\n    const context = app.context ?? \".\";\n    const contextDir = path.resolve(projectRoot, context);\n    const fromContext = path.relative(contextDir, path.resolve(projectRoot, dockerfile));\n\n    const build = `${chalk.cyan(`npm run build --workspace ${name}`)}`;\n\n    // A Dockerfile outside its own context is legal to `docker build` but means\n    // nothing it copies is reachable, so there is no command to offer. Say what\n    // is wrong instead of printing one that cannot work.\n    if (fromContext.startsWith(\"..\")) {\n        return [\n            chalk.dim(`    ${build}`),\n            chalk.yellow(`    ⚠ ${dockerfile} is outside the build context (${context}) — nothing it COPYs is reachable.`),\n            chalk.dim(`      Widen \"context\" in rebase.json, or move the Dockerfile inside it.`)\n        ];\n    }\n\n    const docker = chalk.cyan(`docker build -f ${fromContext} .`);\n    return context === \".\"\n        ? [chalk.dim(`    ${build}  then  ${docker}`)]\n        : [chalk.dim(`    ${build}`), chalk.dim(`    ${chalk.cyan(`cd ${context}`)} && ${docker}`)];\n}\n\nexport async function buildCommand(rawArgs: string[] = []): Promise<void> {\n    if (wantsHelp(rawArgs)) {\n        printHelp();\n        return;\n    }\n\n    const { flags: args, positionals: requested } = parseCommandArgs({\n        spec: {\n            \"--output\": String,\n            // `--out` kept as an accepted alias. `generate-sdk` has always\n            // spelled this `--output`, and two names for one concept across one\n            // CLI is a thing you have to remember rather than know. `--output`\n            // is canonical now; `--out` still works so no script breaks.\n            \"--out\": \"--output\",\n            \"--skip-type-check\": Boolean,\n            /* Do not install the declared dependencies into the bundle. The\n               bundle still works — it installs them at boot, as every bundle did\n               before vendoring existed — so this is for a build that must not\n               shell out to npm, not for a smaller artifact. */\n            \"--no-vendor\": Boolean,\n            /* Keep the installed tree whatever its size. The size ceiling\n               protects an upload that a source-built deploy never performs, so\n               that path needs a way to say so. */\n            \"--vendor\": Boolean,\n            \"--skip-schema\": Boolean,\n            /* Do not fold the frontend into the backend bundle. For a project\n               that publishes its frontend elsewhere and does not want the assets\n               travelling with its API. */\n            \"--no-static\": Boolean,\n            /* Fold assets that are already built, without re-running the app's\n               build command — for a CI job that built the frontend in an earlier\n               step. */\n            \"--skip-static-build\": Boolean,\n            \"--workspace\": Boolean\n        },\n        rawArgs,\n        commandWords: 1,\n        command: \"build\"\n    });\n\n    const projectRoot = requireProjectRoot();\n\n    if (args[\"--workspace\"]) {\n        await runWorkspaceBuilds(projectRoot);\n        return;\n    }\n\n    let loaded;\n    try {\n        loaded = loadManifest(projectRoot);\n    } catch (err) {\n        if (err instanceof ManifestError) {\n            console.error(chalk.red(`✗ ${err.message}`));\n            for (const issue of err.issues) {\n                console.error(chalk.red(`    ${issue.path ? `${issue.path}: ` : \"\"}${issue.message}`));\n            }\n            process.exit(1);\n        }\n        throw err;\n    }\n\n    const { manifest, source } = loaded;\n\n    let targets = buildableApps(manifest);\n    if (requested.length > 0) {\n        const known = new Set(targets.map(t => t.name));\n        const unknown = requested.filter(name => !known.has(name));\n        if (unknown.length > 0) {\n            console.error(chalk.red(`✗ Unknown app(s): ${unknown.join(\", \")}`));\n            console.error(chalk.dim(`  This repository declares: ${targets.map(t => t.name).join(\", \") || \"(none)\"}`));\n            process.exit(1);\n        }\n        targets = targets.filter(t => requested.includes(t.name));\n    }\n\n    if (targets.length === 0) {\n        console.log(chalk.yellow(\"No buildable apps declared. Nothing to do.\"));\n        return;\n    }\n\n    // An ejected backend owns its own build; the workspace scripts are the only\n    // thing that knows how to run it.\n    const backend = findBackendApp(manifest);\n    if (!backend && source === \"synthesized\") {\n        console.log(chalk.dim(\"No rebase.json found — building workspace packages.\\n\"));\n        await runWorkspaceBuilds(projectRoot);\n        return;\n    }\n\n    // `--output` names one bundle directory, resolved from where it was typed.\n    // It is refused for a build that produces several bundles rather than\n    // handed to each: every bundle build empties its directory first, so the\n    // last app built deleted the others' and the build still reported success.\n    const output = args[\"--output\"] ? path.resolve(process.cwd(), args[\"--output\"]) : undefined;\n    const bundled = targets.filter(({ app }) =>\n        (app.type === \"backend\" && app.runtime !== \"custom\") ||\n        (app.type === \"static\" && Boolean(app.build) && Boolean(app.output)));\n    if (output && bundled.length > 1) {\n        throw new UsageError(\n            `--output names one bundle directory, and this build produces ${bundled.length}: ` +\n            `${bundled.map(t => t.name).join(\", \")}. Build one app into it: ` +\n            `rebase build ${bundled[0].name} --output ${args[\"--output\"]}`\n        );\n    }\n\n    console.log(`${chalk.bold(\"Rebase\")} — building ${targets.length} app(s)\\n`);\n\n    // Each static app is built once per run, whichever consumer gets to it\n    // first: folding into the backend bundle, or its own static bundle.\n    const builtApps = new Set<string>();\n\n    for (const { name, app } of targets) {\n        console.log(chalk.cyan(`▸ ${name}`) + chalk.dim(` (${app.type})`));\n\n        if (app.type === \"backend\" && app.runtime === \"custom\") {\n            // An ejected backend's artifact is an IMAGE, not a bundle. Building\n            // one anyway produced a `dist-bundle/` the project never deploys,\n            // which is worse than doing nothing: it looks like the thing that\n            // ships. The workspace's own `build` script compiles this app, and\n            // the Dockerfile turns it into the image.\n            console.log(chalk.dim(\"  custom runtime — this project builds its own image, not a bundle\"));\n            for (const line of dockerBuildHint(projectRoot, name, app)) console.log(line);\n            console.log(\"\");\n            continue;\n        }\n\n        if (app.type === \"backend\") {\n            // Derived per backend app, because each has its own config\n            // directory. Issues are fatal here rather than reported: a bundle\n            // whose manifest is missing a bucket the code declares would deploy\n            // into a tenant with nothing provisioned for it, and the first sign\n            // would be uploads failing in production.\n            const { graph: resourceGraph, issues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, app));\n            if (issues.length > 0) {\n                console.error(chalk.red(`\\n  ✗ ${issues.length} problem(s) in the declared resources:\\n`));\n                for (const issue of issues) console.error(`    ${chalk.bold(issue.path)}  ${issue.message}`);\n                console.error(\"\");\n                process.exitCode = 1;\n                return;\n            }\n            // Written alongside the bundle so the repository records what this\n            // project needs. `rebase resources --check` is what keeps it honest.\n            // Committed, so a change to it is said: the first build of a\n            // scaffold otherwise left it untracked with no word on what it is.\n            if (writeResourceGraphFile(projectRoot, resourceGraph).changed) {\n                console.log(chalk.dim(`  ${RESOURCE_GRAPH_FILENAME} updated — commit it: it records what this project needs from a host`));\n            }\n\n            /* The framework pins, read before the build and reported after it.\n               Ranges no single version satisfies are refused by `buildBundle`\n               itself, before it builds anything, for every command that builds\n               a bundle. */\n            const drift = detectFrameworkDepDrift(projectRoot, cliVersion());\n\n            const result = await buildBundle({\n                projectRoot,\n                appName: name,\n                app,\n                outDir: output,\n                runtimeRange: manifest.rebase,\n                resources: resourceGraph,\n                skipTypeCheck: args[\"--skip-type-check\"],\n                skipSchema: args[\"--skip-schema\"],\n                vendor: args[\"--no-vendor\"] ? false : (args[\"--vendor\"] ? true : undefined)\n            });\n            const rel = path.relative(projectRoot, result.outDir);\n            console.log(chalk.green(`  ✓ bundle → ${rel}/`));\n            // A headless build has no schema version — the API is introspected\n            // from the live database at boot — and interpolating it anyway left\n            // the summary ending in a dangling `schema `, which reads as a value\n            // that failed to render rather than one that does not exist.\n            const schemaVersion = result.manifest.schemaVersion;\n            console.log(chalk.dim(\n                `    ${result.collectionCount} collection(s)${schemaVersion ? `, schema ${schemaVersion}` : \"\"}`\n            ));\n            /* Say what the bundle's cold start will be, at the one moment\n               anyone is listening.\n\n               A vendored bundle starts in about five seconds; one that installs\n               at boot takes forty to sixty, on EVERY pod start — an eviction, a\n               node failure, an OOM, a runtime rollout. That is not a build\n               detail, it is what each of those events costs in downtime, and it\n               is invisible until an incident unless it is said here. */\n            if (result.vendor.vendored) {\n                console.log(chalk.dim(`    dependencies installed into the bundle (${result.vendor.target?.os}/${result.vendor.target?.cpu})`));\n                if ((result.vendor.bytes ?? 0) > VENDOR_SIZE_WARN_BYTES) {\n                    const mb = Math.round((result.vendor.bytes ?? 0) / (1024 * 1024));\n                    /* The limit is on the *compressed* upload and this is the\n                       tree on disk, so a number above 100 does not mean the\n                       upload fails — but \"201 MB, close to the 100 MB limit\"\n                       reads as nonsense and got ignored for exactly that\n                       reason. Say which quantity is which. */\n                    console.log(chalk.yellow(\n                        `    ⚠ the installed tree is ${mb} MB on disk — enough to risk the control plane's 100 MB ` +\n                        \"limit on the compressed upload\"));\n                    console.log(chalk.dim(\"      Shrink the declared dependencies, or rebuild with --no-vendor.\"));\n                }\n            } else if (Object.keys(result.manifest.deps.declared).length === 0) {\n                // Nothing to install is not a degraded state — this bundle\n                // already starts as fast as a vendored one. Warning here would\n                // train people to ignore the warning that matters.\n                console.log(chalk.dim(\"    no dependencies to install — nothing to bundle\"));\n            } else {\n                console.log(chalk.yellow(`    ⚠ dependencies not bundled: ${result.vendor.skipped}`));\n                console.log(chalk.dim(\"      They install on every pod start instead, which is ~40-60s of cold start.\"));\n            }\n\n            if (result.manifest.hooks.native) {\n                const names = (result.manifest.hooks.nativeModules ?? []).map(m => m.name).join(\", \");\n                console.log(chalk.yellow(`    ⚠ native dependencies detected: ${names}`));\n                console.log(chalk.dim(\"      These cannot run on the managed runtime. See `rebase doctor`.\"));\n            }\n\n            /* Framework pins older than this CLI.\n\n               Warned here because this is the only moment anyone can be told.\n               Locally every `@rebasepro/*` resolves through pnpm's workspace and\n               `link:` overrides to the checkout, so the version strings in\n               package.json are never exercised — the project runs fine on a\n               developer's machine while declaring something years old. Those\n               strings are first honoured when the runtime npm-installs them in\n               the cloud, and by then the symptom is a tenant that boots and then\n               misbehaves against its database.\n\n               A warning rather than a hard failure: the CLI cannot know that a\n               newer package has actually been published, and refusing to build\n               over a guess would be worse than saying it out loud. (`drift` was\n               read before the build, above.) */\n            if (drift.behind.length > 0) {\n                console.log(chalk.yellow(`    ⚠ framework dependencies older than this CLI (${cliVersion()}):`));\n                for (const dep of drift.behind) {\n                    console.log(chalk.dim(`      ${dep.name}@${dep.range}  (${dep.file})`));\n                }\n                console.log(chalk.dim(\"      The image supplies the server, but your bundle supplies the database\"));\n                console.log(chalk.dim(\"      driver — a newer runtime does not update it.\"));\n                console.log(chalk.dim(`      Run \\`${upgradeToThisCli()}\\`, then rebuild.`));\n            } else if (drift.disagreeing.length > 0) {\n                console.log(chalk.yellow(`    ⚠ mixed @rebasepro versions declared: ${drift.disagreeing.join(\", \")}`));\n                console.log(chalk.dim(\"      These are published together and expect to run together.\"));\n                console.log(chalk.dim(`      Run \\`${upgradeToThisCli()}\\` to pin them alike, then rebuild.`));\n            }\n\n            /* Fold the project's static apps into the backend bundle, so ONE\n               runtime serves the site at `/`, the admin at `/admin` and the API\n               at `/api` — the shape the scaffolded template produces and the\n               shape a custom container already had.\n\n               Without this, moving a project to the managed runtime silently\n               removed its website: the API answered perfectly and every page\n               404'd, because the managed pod runs the backend bundle and nothing\n               else. Parity with the container being replaced is the only honest\n               baseline for calling managed a drop-in.\n\n               `--no-static` opts out, for a project that publishes its frontend\n               somewhere else and does not want the assets in its bundle. */\n            if (!args[\"--no-static\"]) {\n                const folded = await foldFrontendIntoBundle({\n                    projectRoot,\n                    manifest,\n                    bundleDir: result.outDir,\n                    skipBuild: args[\"--skip-static-build\"] === true,\n                    builtApps,\n                    log: (m) => console.log(m)\n                }).catch((err: unknown) => {\n                    console.error(chalk.red(`    ✗ ${err instanceof Error ? err.message : String(err)}`));\n                    process.exit(1);\n                });\n                for (const outcome of folded ?? []) {\n                    console.log(\n                        chalk.green(`    ✓ ${outcome.appName} folded in`) +\n                        chalk.dim(` (${outcome.fileCount} file(s) → served at ${formatAppAddress(outcome)})`)\n                    );\n                }\n            }\n        } else if (app.type === \"static\") {\n            await buildAssetApp(projectRoot, name, app, manifest.rebase, output, { builtApps }).catch((err: unknown) => {\n                console.error(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n                process.exit(1);\n            });\n        }\n\n        console.log(\"\");\n    }\n\n    console.log(chalk.green(\"✓ Build complete.\"));\n}\n\n/**\n * Build a static app and package it into a static bundle.\n *\n * Runs the app's own build command, checks it produced the declared output, then\n * packages that output into a `static`-kind bundle — the same deployable shape as\n * a backend bundle, so a frontend or admin app deploys through the identical\n * path and runs on the identical image, just serving files instead of an API.\n *\n * Throws when the build fails or produces nothing usable, so the caller answers\n * in its own way: `rebase build` with a red line, `rebase cloud deploy --json`\n * with its JSON error.\n */\nexport async function buildAssetApp(\n    projectRoot: string,\n    name: string,\n    app: RebaseAppConfig,\n    runtimeRange: string,\n    outOverride?: string,\n    /**\n     * `quietStdout`: every line, the build command's included, goes to stderr. See `toolStdio`.\n     * `builtApps`: the static apps already built in this run (see `FoldOptions.builtApps`).\n     */\n    options: { quietStdout?: boolean; builtApps?: Set<string> } = {}\n): Promise<string | undefined> {\n    const asset = app as RebaseStaticAppConfig;\n    // The path part is what the app is built for and mounted at; the hostname,\n    // when `path` names one, only travels in the bundle.\n    const address = staticAppAddress(name, asset);\n    const basePath = address.path;\n    const say = (line: string): void => {\n        if (options.quietStdout) console.error(line);\n        else console.log(line);\n    };\n\n    if (!asset.build) {\n        say(chalk.dim(\"  no build command declared — skipping\"));\n        return undefined;\n    }\n\n    if (options.builtApps?.has(name)) {\n        say(chalk.dim(\"  built once already in this run — packaging that output\"));\n    } else {\n        try {\n            await execa(asset.build, {\n                cwd: projectRoot,\n                stdio: toolStdio(options.quietStdout),\n                shell: true,\n                env: staticBuildEnv(basePath, name)\n            });\n        } catch {\n            throw new Error(`build command failed for \"${name}\"`);\n        }\n        options.builtApps?.add(name);\n    }\n\n    if (!asset.output) {\n        say(chalk.yellow(\"  no output directory declared — built, but nothing to bundle\"));\n        return undefined;\n    }\n\n    const outputPath = path.join(projectRoot, asset.output);\n    if (!fs.existsSync(outputPath)) {\n        // The command exited 0 but produced nothing where the manifest says it\n        // should. Bundling that would ship an empty site.\n        throw new Error(`declared output \"${asset.output}\" does not exist after building`);\n    }\n\n    // The assets were built for `basePath`; refusing here is the difference\n    // between a build error and a blank page nobody can diagnose.\n    const indexHtml = path.join(outputPath, \"index.html\");\n    if (fs.existsSync(indexHtml)) {\n        assertBuiltForPath(fs.readFileSync(indexHtml, \"utf8\"), basePath, name);\n    }\n\n    // Per-app bundle directory, so a project's several static apps do not clobber\n    // one another or the backend's `dist-bundle`.\n    const outDir = outOverride\n        ? path.resolve(process.cwd(), outOverride)\n        : path.join(projectRoot, `dist-bundle-${name}`);\n    const result = buildStaticBundle({\n        projectRoot,\n        appName: name,\n        assetsDir: outputPath,\n        outDir,\n        runtimeRange,\n        path: basePath,\n        host: address.host,\n        spa: asset.spa ?? true,\n        cms: asset.cms\n    });\n    const rel = path.relative(projectRoot, result.outDir);\n    say(\n        chalk.green(`  ✓ static bundle → ${rel}/`) +\n        chalk.dim(` (${result.fileCount} file(s) → served at ${formatAppAddress(address)})`)\n    );\n    return result.outDir;\n}\n\n/**\n * The `rebase upgrade` line the drift warnings print.\n *\n * Aimed at this CLI's own version, because that is what the warning measured\n * against: \"older than this CLI\" is answered by moving to exactly this CLI, not\n * to whatever `latest` happens to be — which, on a canary, is older still.\n */\nfunction upgradeToThisCli(): string {\n    const version = cliVersion();\n    return version === \"unknown\" ? \"rebase upgrade\" : `rebase upgrade --to ${version}`;\n}\n\n/** The pre-manifest behaviour: build every workspace package. */\nasync function runWorkspaceBuilds(projectRoot: string): Promise<void> {\n    const pm = detectPackageManager(projectRoot);\n    const cmds = getPMCommands(pm);\n    const buildCmd = cmds.runAll(\"build\");\n\n    console.log(`${chalk.bold(\"Rebase\")} — Building all workspaces with ${chalk.cyan(pm)}...\\n`);\n\n    try {\n        await execa(buildCmd[0], buildCmd.slice(1), {\n            cwd: projectRoot,\n            stdio: \"inherit\"\n        });\n    } catch {\n        console.error(chalk.red(\"\\n✗ Build failed.\"));\n        process.exit(1);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,SAAS,YAAkB;CACvB,QAAQ,IAAI;EACd,MAAM,KAAK,cAAc,EAAE;;EAE3B,MAAM,KAAK,OAAO,EAAE;;;EAGpB,MAAM,KAAK,SAAS,EAAE;mEAC2C,mBAAmB;;;;;;;;;;;;;;;EAepF,MAAM,KAAK,UAAU,EAAE;;;;EAIvB,KAAK,CAAC;AACR;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,gBACZ,aACA,MACA,KACQ;CACR,MAAM,aAAa,IAAI,cAAc;CACrC,MAAM,UAAU,IAAI,WAAW;CAC/B,MAAM,aAAa,KAAK,QAAQ,aAAa,OAAO;CACpD,MAAM,cAAc,KAAK,SAAS,YAAY,KAAK,QAAQ,aAAa,UAAU,CAAC;CAEnF,MAAM,QAAQ,GAAG,MAAM,KAAK,6BAA6B,MAAM;CAK/D,IAAI,YAAY,WAAW,IAAI,GAC3B,OAAO;EACH,MAAM,IAAI,OAAO,OAAO;EACxB,MAAM,OAAO,SAAS,WAAW,iCAAiC,QAAQ,mCAAmC;EAC7G,MAAM,IAAI,yEAAyE;CACvF;CAGJ,MAAM,SAAS,MAAM,KAAK,mBAAmB,YAAY,GAAG;CAC5D,OAAO,YAAY,MACb,CAAC,MAAM,IAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,IAC3C,CAAC,MAAM,IAAI,OAAO,OAAO,GAAG,MAAM,IAAI,OAAO,MAAM,KAAK,MAAM,SAAS,EAAE,MAAM,QAAQ,CAAC;AAClG;AAEA,eAAsB,aAAa,UAAoB,CAAC,GAAkB;CACtE,IAAI,UAAU,OAAO,GAAG;EACpB,UAAU;EACV;CACJ;CAEA,MAAM,EAAE,OAAO,MAAM,aAAa,cAAc,iBAAiB;EAC7D,MAAM;GACF,YAAY;GAKZ,SAAS;GACT,qBAAqB;GAKrB,eAAe;GAIf,YAAY;GACZ,iBAAiB;GAIjB,eAAe;GAIf,uBAAuB;GACvB,eAAe;EACnB;EACA;EACA,cAAc;EACd,SAAS;CACb,CAAC;CAED,MAAM,cAAc,mBAAmB;CAEvC,IAAI,KAAK,gBAAgB;EACrB,MAAM,mBAAmB,WAAW;EACpC;CACJ;CAEA,IAAI;CACJ,IAAI;EACA,SAAS,aAAa,WAAW;CACrC,SAAS,KAAK;EACV,IAAI,eAAe,eAAe;GAC9B,QAAQ,MAAM,MAAM,IAAI,KAAK,IAAI,SAAS,CAAC;GAC3C,KAAK,MAAM,SAAS,IAAI,QACpB,QAAQ,MAAM,MAAM,IAAI,OAAO,MAAM,OAAO,GAAG,MAAM,KAAK,MAAM,KAAK,MAAM,SAAS,CAAC;GAEzF,QAAQ,KAAK,CAAC;EAClB;EACA,MAAM;CACV;CAEA,MAAM,EAAE,UAAU,WAAW;CAE7B,IAAI,UAAU,cAAc,QAAQ;CACpC,IAAI,UAAU,SAAS,GAAG;EACtB,MAAM,QAAQ,IAAI,IAAI,QAAQ,KAAI,MAAK,EAAE,IAAI,CAAC;EAC9C,MAAM,UAAU,UAAU,QAAO,SAAQ,CAAC,MAAM,IAAI,IAAI,CAAC;EACzD,IAAI,QAAQ,SAAS,GAAG;GACpB,QAAQ,MAAM,MAAM,IAAI,qBAAqB,QAAQ,KAAK,IAAI,GAAG,CAAC;GAClE,QAAQ,MAAM,MAAM,IAAI,+BAA+B,QAAQ,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,KAAK,UAAU,CAAC;GACzG,QAAQ,KAAK,CAAC;EAClB;EACA,UAAU,QAAQ,QAAO,MAAK,UAAU,SAAS,EAAE,IAAI,CAAC;CAC5D;CAEA,IAAI,QAAQ,WAAW,GAAG;EACtB,QAAQ,IAAI,MAAM,OAAO,4CAA4C,CAAC;EACtE;CACJ;CAKA,IAAI,CADY,eAAe,QAC1B,KAAW,WAAW,eAAe;EACtC,QAAQ,IAAI,MAAM,IAAI,uDAAuD,CAAC;EAC9E,MAAM,mBAAmB,WAAW;EACpC;CACJ;CAMA,MAAM,SAAS,KAAK,cAAc,KAAK,QAAQ,QAAQ,IAAI,GAAG,KAAK,WAAW,IAAI,KAAA;CAClF,MAAM,UAAU,QAAQ,QAAQ,EAAE,UAC7B,IAAI,SAAS,aAAa,IAAI,YAAY,YAC1C,IAAI,SAAS,YAAY,QAAQ,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAE;CACxE,IAAI,UAAU,QAAQ,SAAS,GAC3B,MAAM,IAAI,WACN,gEAAgE,QAAQ,OAAO,IAC5E,QAAQ,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,wCACvB,QAAQ,EAAE,CAAC,KAAK,YAAY,KAAK,aACrD;CAGJ,QAAQ,IAAI,GAAG,MAAM,KAAK,QAAQ,EAAE,cAAc,QAAQ,OAAO,UAAU;CAI3E,MAAM,4BAAY,IAAI,IAAY;CAElC,KAAK,MAAM,EAAE,MAAM,SAAS,SAAS;EACjC,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC;EAEjE,IAAI,IAAI,SAAS,aAAa,IAAI,YAAY,UAAU;GAMpD,QAAQ,IAAI,MAAM,IAAI,oEAAoE,CAAC;GAC3F,KAAK,MAAM,QAAQ,gBAAgB,aAAa,MAAM,GAAG,GAAG,QAAQ,IAAI,IAAI;GAC5E,QAAQ,IAAI,EAAE;GACd;EACJ;EAEA,IAAI,IAAI,SAAS,WAAW;GAMxB,MAAM,EAAE,OAAO,eAAe,WAAW,MAAM,oBAAoB,iBAAiB,aAAa,GAAG,CAAC;GACrG,IAAI,OAAO,SAAS,GAAG;IACnB,QAAQ,MAAM,MAAM,IAAI,SAAS,OAAO,OAAO,yCAAyC,CAAC;IACzF,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,OAAO,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,SAAS;IAC3F,QAAQ,MAAM,EAAE;IAChB,QAAQ,WAAW;IACnB;GACJ;GAKA,IAAI,uBAAuB,aAAa,aAAa,CAAC,CAAC,SACnD,QAAQ,IAAI,MAAM,IAAI,KAAK,wBAAwB,qEAAqE,CAAC;GAO7H,MAAM,QAAQ,wBAAwB,aAAa,WAAW,CAAC;GAE/D,MAAM,SAAS,MAAM,YAAY;IAC7B;IACA,SAAS;IACT;IACA,QAAQ;IACR,cAAc,SAAS;IACvB,WAAW;IACX,eAAe,KAAK;IACpB,YAAY,KAAK;IACjB,QAAQ,KAAK,iBAAiB,QAAS,KAAK,cAAc,OAAO,KAAA;GACrE,CAAC;GACD,MAAM,MAAM,KAAK,SAAS,aAAa,OAAO,MAAM;GACpD,QAAQ,IAAI,MAAM,MAAM,gBAAgB,IAAI,EAAE,CAAC;GAK/C,MAAM,gBAAgB,OAAO,SAAS;GACtC,QAAQ,IAAI,MAAM,IACd,OAAO,OAAO,gBAAgB,gBAAgB,gBAAgB,YAAY,kBAAkB,IAChG,CAAC;GASD,IAAI,OAAO,OAAO,UAAU;IACxB,QAAQ,IAAI,MAAM,IAAI,+CAA+C,OAAO,OAAO,QAAQ,GAAG,GAAG,OAAO,OAAO,QAAQ,IAAI,EAAE,CAAC;IAC9H,KAAK,OAAO,OAAO,SAAS,KAAA,WAA6B;KACrD,MAAM,KAAK,KAAK,OAAO,OAAO,OAAO,SAAS,MAAM,OAAO,KAAK;KAMhE,QAAQ,IAAI,MAAM,OACd,+BAA+B,GAAG,uFACF,CAAC;KACrC,QAAQ,IAAI,MAAM,IAAI,sEAAsE,CAAC;IACjG;GACJ,OAAO,IAAI,OAAO,KAAK,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,WAAW,GAI7D,QAAQ,IAAI,MAAM,IAAI,oDAAoD,CAAC;QACxE;IACH,QAAQ,IAAI,MAAM,OAAO,mCAAmC,OAAO,OAAO,SAAS,CAAC;IACpF,QAAQ,IAAI,MAAM,IAAI,gFAAgF,CAAC;GAC3G;GAEA,IAAI,OAAO,SAAS,MAAM,QAAQ;IAC9B,MAAM,SAAS,OAAO,SAAS,MAAM,iBAAiB,CAAC,EAAA,CAAG,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;IACpF,QAAQ,IAAI,MAAM,OAAO,uCAAuC,OAAO,CAAC;IACxE,QAAQ,IAAI,MAAM,IAAI,qEAAqE,CAAC;GAChG;GAiBA,IAAI,MAAM,OAAO,SAAS,GAAG;IACzB,QAAQ,IAAI,MAAM,OAAO,qDAAqD,WAAW,EAAE,GAAG,CAAC;IAC/F,KAAK,MAAM,OAAO,MAAM,QACpB,QAAQ,IAAI,MAAM,IAAI,SAAS,IAAI,KAAK,GAAG,IAAI,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;IAE1E,QAAQ,IAAI,MAAM,IAAI,4EAA4E,CAAC;IACnG,QAAQ,IAAI,MAAM,IAAI,oDAAoD,CAAC;IAC3E,QAAQ,IAAI,MAAM,IAAI,eAAe,iBAAiB,EAAE,kBAAkB,CAAC;GAC/E,OAAO,IAAI,MAAM,YAAY,SAAS,GAAG;IACrC,QAAQ,IAAI,MAAM,OAAO,6CAA6C,MAAM,YAAY,KAAK,IAAI,GAAG,CAAC;IACrG,QAAQ,IAAI,MAAM,IAAI,gEAAgE,CAAC;IACvF,QAAQ,IAAI,MAAM,IAAI,eAAe,iBAAiB,EAAE,oCAAoC,CAAC;GACjG;GAeA,IAAI,CAAC,KAAK,gBAAgB;IACtB,MAAM,SAAS,MAAM,uBAAuB;KACxC;KACA;KACA,WAAW,OAAO;KAClB,WAAW,KAAK,2BAA2B;KAC3C;KACA,MAAM,MAAM,QAAQ,IAAI,CAAC;IAC7B,CAAC,CAAC,CAAC,OAAO,QAAiB;KACvB,QAAQ,MAAM,MAAM,IAAI,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;KACpF,QAAQ,KAAK,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,WAAW,UAAU,CAAC,GAC7B,QAAQ,IACJ,MAAM,MAAM,SAAS,QAAQ,QAAQ,WAAW,IAChD,MAAM,IAAI,KAAK,QAAQ,UAAU,uBAAuB,iBAAiB,OAAO,EAAE,EAAE,CACxF;GAER;EACJ,OAAO,IAAI,IAAI,SAAS,UACpB,MAAM,cAAc,aAAa,MAAM,KAAK,SAAS,QAAQ,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,QAAiB;GACxG,QAAQ,MAAM,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;GAClF,QAAQ,KAAK,CAAC;EAClB,CAAC;EAGL,QAAQ,IAAI,EAAE;CAClB;CAEA,QAAQ,IAAI,MAAM,MAAM,mBAAmB,CAAC;AAChD;;;;;;;;;;;;;AAcA,eAAsB,cAClB,aACA,MACA,KACA,cACA,aAKA,UAA8D,CAAC,GACpC;CAC3B,MAAM,QAAQ;CAGd,MAAM,UAAU,iBAAiB,MAAM,KAAK;CAC5C,MAAM,WAAW,QAAQ;CACzB,MAAM,OAAO,SAAuB;EAChC,IAAI,QAAQ,aAAa,QAAQ,MAAM,IAAI;OACtC,QAAQ,IAAI,IAAI;CACzB;CAEA,IAAI,CAAC,MAAM,OAAO;EACd,IAAI,MAAM,IAAI,wCAAwC,CAAC;EACvD;CACJ;CAEA,IAAI,QAAQ,WAAW,IAAI,IAAI,GAC3B,IAAI,MAAM,IAAI,0DAA0D,CAAC;MACtE;EACH,IAAI;GACA,MAAM,MAAM,MAAM,OAAO;IACrB,KAAK;IACL,OAAO,UAAU,QAAQ,WAAW;IACpC,OAAO;IACP,KAAK,eAAe,UAAU,IAAI;GACtC,CAAC;EACL,QAAQ;GACJ,MAAM,IAAI,MAAM,6BAA6B,KAAK,EAAE;EACxD;EACA,QAAQ,WAAW,IAAI,IAAI;CAC/B;CAEA,IAAI,CAAC,MAAM,QAAQ;EACf,IAAI,MAAM,OAAO,+DAA+D,CAAC;EACjF;CACJ;CAEA,MAAM,aAAa,KAAK,KAAK,aAAa,MAAM,MAAM;CACtD,IAAI,CAAC,GAAG,WAAW,UAAU,GAGzB,MAAM,IAAI,MAAM,oBAAoB,MAAM,OAAO,gCAAgC;CAKrF,MAAM,YAAY,KAAK,KAAK,YAAY,YAAY;CACpD,IAAI,GAAG,WAAW,SAAS,GACvB,mBAAmB,GAAG,aAAa,WAAW,MAAM,GAAG,UAAU,IAAI;CAQzE,MAAM,SAAS,kBAAkB;EAC7B;EACA,SAAS;EACT,WAAW;EACX,QAPW,cACT,KAAK,QAAQ,QAAQ,IAAI,GAAG,WAAW,IACvC,KAAK,KAAK,aAAa,eAAe,MAAM;EAM9C;EACA,MAAM;EACN,MAAM,QAAQ;EACd,KAAK,MAAM,OAAO;EAClB,KAAK,MAAM;CACf,CAAC;CACD,MAAM,MAAM,KAAK,SAAS,aAAa,OAAO,MAAM;CACpD,IACI,MAAM,MAAM,uBAAuB,IAAI,EAAE,IACzC,MAAM,IAAI,KAAK,OAAO,UAAU,uBAAuB,iBAAiB,OAAO,EAAE,EAAE,CACvF;CACA,OAAO,OAAO;AAClB;;;;;;;;AASA,SAAS,mBAA2B;CAChC,MAAM,UAAU,WAAW;CAC3B,OAAO,YAAY,YAAY,mBAAmB,uBAAuB;AAC7E;;AAGA,eAAe,mBAAmB,aAAoC;CAClE,MAAM,KAAK,qBAAqB,WAAW;CAE3C,MAAM,WADO,cAAc,EACV,CAAA,CAAK,OAAO,OAAO;CAEpC,QAAQ,IAAI,GAAG,MAAM,KAAK,QAAQ,EAAE,kCAAkC,MAAM,KAAK,EAAE,EAAE,MAAM;CAE3F,IAAI;EACA,MAAM,MAAM,SAAS,IAAI,SAAS,MAAM,CAAC,GAAG;GACxC,KAAK;GACL,OAAO;EACX,CAAC;CACL,QAAQ;EACJ,QAAQ,MAAM,MAAM,IAAI,mBAAmB,CAAC;EAC5C,QAAQ,KAAK,CAAC;CAClB;AACJ"}