@rebasepro/cli 0.25.0-canary.ge06257e → 0.25.0

package/dist/commands/api-keys.d.ts

@@ -41,6 +41,8 @@ export declare function resolveBackendAddress(env: Record<string, string>, proje
  * Exits before any request is made: the refusal is the point.
  */
 export declare function requireBackendUrl(env: Record<string, string>, projectRoot: string): string;
+/** Where a service key is read from: the name a scaffold writes, or the older one. */
+type ServiceKeyVariable = "REBASE_SERVICE_KEY" | "SERVICE_KEY";
 /**
  * What to print when a request fails: the server's error code and message,
  * which is what says why — `SCOPE_EXCEEDS_CREATOR`, `INVALID_SCOPES`,
@@ -48,7 +50,7 @@ export declare function requireBackendUrl(env: Record<string, string>, projectRo
  *
  * Exported so its tests can read the lines without a server.
  */
-export declare function describeFailure(action: string, error: unknown, baseUrl: string): string[];
+export declare function describeFailure(action: string, error: unknown, baseUrl: string, keyVariable?: ServiceKeyVariable): string[];
 export declare function apiKeysCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void>;
 /**
  * The lines that describe one key: what it is, what it may do and whom it
@@ -153,3 +155,4 @@ export declare const SCOPES_LIST_FLAGS: {};
  * Exported so its tests can read the lines without a server.
  */
 export declare function describeScopes(scopes: readonly ScopeSummary[], held: readonly string[]): string[];
+export {};

package/dist/commands/auth.d.ts

@@ -88,8 +88,9 @@ export declare function generatePassword(): string;
  * attacker's refresh token minting access tokens did not recover anything.
  *
  * It exits 0 only when a row was updated: a missing user and a thrown error are
- * both exit 1. `echoPassword` prints the new password, for a generated one.
+ * both exit 1. `echoPassword` prints the new password, for a generated one;
+ * `showStack` prints a failure's stack rather than its sentence (`--debug`).
  *
  * Exported so its tests can run it.
  */
-export declare function resetPasswordScript(echoPassword: boolean): string;
+export declare function resetPasswordScript(echoPassword: boolean, showStack?: boolean): string;

package/dist/connection-banner-DbLJzWf4.js

@@ -0,0 +1,128 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+//#region src/dev-db/connection-banner.ts
+var connection_banner_exports = /* @__PURE__ */ __exportAll({
+	banner: () => banner,
+	connectionErrorText: () => connectionErrorText,
+	connectionFailureBanner: () => connectionFailureBanner,
+	connectionRefusedFixes: () => connectionRefusedFixes,
+	hostOf: () => hostOf
+});
+var RULE = "━".repeat(60);
+/** The banner, as lines: a title, what the driver or tool said, then the body. */
+function banner(title, said, body) {
+	return [
+		"",
+		RULE,
+		`  ❌  ${title}`,
+		RULE,
+		"",
+		...said ? [`  ${said}`, ""] : [],
+		...body.map((line) => `  ${line}`),
+		"",
+		RULE
+	];
+}
+/** `host:port` of a connection string, for a message: never the string, which carries the password. */
+function hostOf(connectionString) {
+	try {
+		const url = new URL(connectionString);
+		return `${url.hostname || "localhost"}:${url.port || "5432"}`;
+	} catch {
+		return "(unparseable connection string)";
+	}
+}
+/**
+* A connection error's own sentence. A refused connection on a dual-stack
+* host is an `AggregateError` with an empty message, and its sentence —
+* `connect ECONNREFUSED 127.0.0.1:5432` — is in the attempts it holds.
+*/
+function connectionErrorText(error) {
+	if (error instanceof AggregateError && error.errors.length > 0 && !error.message) return connectionErrorText(error.errors[0]);
+	return error instanceof Error && error.message ? error.message : String(error);
+}
+/** The `code` a `pg` or `net` error carries, looking inside an `AggregateError`'s attempts. */
+function codeOf(error) {
+	if (error instanceof AggregateError && error.errors.length > 0) for (const inner of error.errors) {
+		const code = codeOf(inner);
+		if (code) return code;
+	}
+	if (error && typeof error === "object" && "code" in error && typeof error.code === "string") return error.code;
+}
+/** A server that is not there, or not reachable from here. */
+var UNREACHABLE = /* @__PURE__ */ new Set([
+	"ECONNREFUSED",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"ETIMEDOUT",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ECONNRESET"
+]);
+/**
+* What to print when opening `url` failed with `error`: the banner, in the
+* case it is — the server not answering, credentials refused, a database
+* closed to new connections, or a database of that name not there — or `null`
+* when it is none of those four.
+*
+* `consequence` is the line saying what did not happen ("The password was not
+* reset."); `fixes` is what to do about a server that does not answer, which
+* depends on what named the database.
+*/
+function connectionFailureBanner(url, error, options) {
+	const code = codeOf(error);
+	const text = connectionErrorText(error);
+	const said = `The driver said: ${text}${code && !text.includes(code) ? ` (${code})` : ""}`;
+	const host = hostOf(url);
+	if (code && UNREACHABLE.has(code) || /timeout expired|Connection terminated due to connection timeout/i.test(text)) return banner(`Cannot connect to PostgreSQL at ${host}`, said, [
+		"The database server is not running or is not accepting connections.",
+		options.consequence,
+		"",
+		...options.fixes.map((fix) => `  • ${fix}`)
+	]);
+	if (code === "28P01" || code === "28000") {
+		let user = "unknown";
+		try {
+			user = decodeURIComponent(new URL(url).username) || "unknown";
+		} catch {}
+		return banner(`Authentication failed for user "${user}" at ${host}`, said, ["PostgreSQL rejected the credentials in the connection string.", options.consequence]);
+	}
+	const closed = /database "(.+)" is not currently accepting connections/.exec(text)?.[1];
+	if (closed) return banner(`Database "${closed}" at ${host} is closed to new connections`, said, [
+		"It is set to refuse every new connection (ALLOW_CONNECTIONS false).",
+		"`rebase db branch create --force` closes its source for the copy, and one",
+		"stopped before it finished (a closed terminal, a kill) leaves it closed.",
+		options.consequence,
+		"",
+		"Nothing in it is lost. Open it again with:",
+		"  rebase db branch list      (every rebase db branch command opens it first)",
+		"or run this, connected to the server's postgres database:",
+		`  ALTER DATABASE "${closed.replace(/"/g, "\"\"")}" ALLOW_CONNECTIONS true;`
+	]);
+	if (code === "3D000") {
+		let database = "(default)";
+		try {
+			database = decodeURIComponent(new URL(url).pathname.replace(/^\//, "")) || database;
+		} catch {}
+		return banner(`Database "${database}" does not exist at ${host}`, said, ["The server answered, and has no database of that name.", options.consequence]);
+	}
+	return null;
+}
+/**
+* What to do about a database that does not answer, for what named it — the
+* list the driver's banner gives for the same `REBASE_DATABASE_SOURCE`.
+*/
+function connectionRefusedFixes(source) {
+	switch (source) {
+		case "flag": return ["Check the URL passed with --database-url, and that its server is running"];
+		case "environment": return ["Check DATABASE_URL in this shell's environment, and that its server is running"];
+		case "env-file": return ["Check DATABASE_URL in .env, and that its server is running"];
+		case "branch": return ["The branch's database is on the server DATABASE_URL names: start that server", "Or leave the branch: rebase db branch switch --off"];
+		case "docker":
+		case "last-dev": return ["docker compose up -d db          (the project's Postgres in Docker)"];
+		case "managed": return ["Restart the managed development database: rebase db stop, then run the command again"];
+	}
+}
+//#endregion
+export { hostOf as i, connectionErrorText as n, connection_banner_exports as r, banner as t };
+
+//# sourceMappingURL=connection-banner-DbLJzWf4.js.map

package/dist/connection-banner-DbLJzWf4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connection-banner-DbLJzWf4.js","names":[],"sources":["../src/dev-db/connection-banner.ts"],"sourcesContent":["/**\n * The boxed banner the database commands print when a connection fails.\n *\n *     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n *       ❌  Cannot connect to PostgreSQL at 127.0.0.1:5508\n *     ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n *\n *       The driver said: connect ECONNREFUSED 127.0.0.1:5508\n *       …\n *\n * The driver prints it for the commands it runs (`cli-errors.ts` in\n * `@rebasepro/server-postgres`, which its entry does not export); this is the\n * same box for the commands the CLI answers in its own process — `db pull`\n * and `auth reset-password`'s database fallback — as plain lines for the\n * caller to print. Never with the connection string in it: it carries the\n * password.\n */\nimport type { DevDatabaseSource } from \"./resolve\";\n\nconst RULE = \"━\".repeat(60);\n\n/** The banner, as lines: a title, what the driver or tool said, then the body. */\nexport function banner(title: string, said: string | null, body: readonly string[]): string[] {\n    return [\"\", RULE, `  ❌  ${title}`, RULE, \"\", ...(said ? [`  ${said}`, \"\"] : []), ...body.map(line => `  ${line}`), \"\", RULE];\n}\n\n/** `host:port` of a connection string, for a message: never the string, which carries the password. */\nexport function hostOf(connectionString: string): string {\n    try {\n        const url = new URL(connectionString);\n\n        return `${url.hostname || \"localhost\"}:${url.port || \"5432\"}`;\n    } catch {\n        return \"(unparseable connection string)\";\n    }\n}\n\n/**\n * A connection error's own sentence. A refused connection on a dual-stack\n * host is an `AggregateError` with an empty message, and its sentence —\n * `connect ECONNREFUSED 127.0.0.1:5432` — is in the attempts it holds.\n */\nexport function connectionErrorText(error: unknown): string {\n    if (error instanceof AggregateError && error.errors.length > 0 && !error.message) {\n        return connectionErrorText(error.errors[0]);\n    }\n\n    return error instanceof Error && error.message ? error.message : String(error);\n}\n\n/** The `code` a `pg` or `net` error carries, looking inside an `AggregateError`'s attempts. */\nfunction codeOf(error: unknown): string | undefined {\n    if (error instanceof AggregateError && error.errors.length > 0) {\n        for (const inner of error.errors) {\n            const code = codeOf(inner);\n            if (code) return code;\n        }\n    }\n    if (error && typeof error === \"object\" && \"code\" in error && typeof error.code === \"string\") return error.code;\n\n    return undefined;\n}\n\n/** A server that is not there, or not reachable from here. */\nconst UNREACHABLE = new Set([\"ECONNREFUSED\", \"ENOTFOUND\", \"EAI_AGAIN\", \"ETIMEDOUT\", \"EHOSTUNREACH\", \"ENETUNREACH\", \"ECONNRESET\"]);\n\n/**\n * What to print when opening `url` failed with `error`: the banner, in the\n * case it is — the server not answering, credentials refused, a database\n * closed to new connections, or a database of that name not there — or `null`\n * when it is none of those four.\n *\n * `consequence` is the line saying what did not happen (\"The password was not\n * reset.\"); `fixes` is what to do about a server that does not answer, which\n * depends on what named the database.\n */\nexport function connectionFailureBanner(\n    url: string,\n    error: unknown,\n    options: { consequence: string; fixes: readonly string[] }\n): string[] | null {\n    const code = codeOf(error);\n    const text = connectionErrorText(error);\n    const said = `The driver said: ${text}${code && !text.includes(code) ? ` (${code})` : \"\"}`;\n    const host = hostOf(url);\n\n    if ((code && UNREACHABLE.has(code)) || /timeout expired|Connection terminated due to connection timeout/i.test(text)) {\n        return banner(`Cannot connect to PostgreSQL at ${host}`, said, [\n            \"The database server is not running or is not accepting connections.\",\n            options.consequence,\n            \"\",\n            ...options.fixes.map(fix => `  • ${fix}`)\n        ]);\n    }\n    if (code === \"28P01\" || code === \"28000\") {\n        let user = \"unknown\";\n        try {\n            user = decodeURIComponent(new URL(url).username) || \"unknown\";\n        } catch { /* named as unknown */ }\n        return banner(`Authentication failed for user \"${user}\" at ${host}`, said, [\n            \"PostgreSQL rejected the credentials in the connection string.\",\n            options.consequence\n        ]);\n    }\n    // 55000 covers more than this, so the sentence is matched — as the driver's banner does.\n    const closed = /database \"(.+)\" is not currently accepting connections/.exec(text)?.[1];\n    if (closed) {\n        return banner(`Database \"${closed}\" at ${host} is closed to new connections`, said, [\n            \"It is set to refuse every new connection (ALLOW_CONNECTIONS false).\",\n            \"`rebase db branch create --force` closes its source for the copy, and one\",\n            \"stopped before it finished (a closed terminal, a kill) leaves it closed.\",\n            options.consequence,\n            \"\",\n            \"Nothing in it is lost. Open it again with:\",\n            \"  rebase db branch list      (every rebase db branch command opens it first)\",\n            \"or run this, connected to the server's postgres database:\",\n            `  ALTER DATABASE \"${closed.replace(/\"/g, '\"\"')}\" ALLOW_CONNECTIONS true;`\n        ]);\n    }\n    if (code === \"3D000\") {\n        let database = \"(default)\";\n        try {\n            database = decodeURIComponent(new URL(url).pathname.replace(/^\\//, \"\")) || database;\n        } catch { /* named as the default */ }\n        return banner(`Database \"${database}\" does not exist at ${host}`, said, [\n            \"The server answered, and has no database of that name.\",\n            options.consequence\n        ]);\n    }\n\n    return null;\n}\n\n/**\n * What to do about a database that does not answer, for what named it — the\n * list the driver's banner gives for the same `REBASE_DATABASE_SOURCE`.\n */\nexport function connectionRefusedFixes(source: DevDatabaseSource): string[] {\n    switch (source) {\n        case \"flag\": return [\"Check the URL passed with --database-url, and that its server is running\"];\n        case \"environment\": return [\"Check DATABASE_URL in this shell's environment, and that its server is running\"];\n        case \"env-file\": return [\"Check DATABASE_URL in .env, and that its server is running\"];\n        case \"branch\": return [\n            \"The branch's database is on the server DATABASE_URL names: start that server\",\n            \"Or leave the branch: rebase db branch switch --off\"\n        ];\n        case \"docker\":\n        case \"last-dev\": return [\"docker compose up -d db          (the project's Postgres in Docker)\"];\n        case \"managed\": return [\"Restart the managed development database: rebase db stop, then run the command again\"];\n    }\n}\n"],"mappings":";;;;;;;;;AAmBA,IAAM,OAAO,IAAI,OAAO,EAAE;;AAG1B,SAAgB,OAAO,OAAe,MAAqB,MAAmC;CAC1F,OAAO;EAAC;EAAI;EAAM,QAAQ;EAAS;EAAM;EAAI,GAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,IAAI,CAAC;EAAI,GAAG,KAAK,KAAI,SAAQ,KAAK,MAAM;EAAG;EAAI;CAAI;AAC/H;;AAGA,SAAgB,OAAO,kBAAkC;CACrD,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EAEpC,OAAO,GAAG,IAAI,YAAY,YAAY,GAAG,IAAI,QAAQ;CACzD,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;AAOA,SAAgB,oBAAoB,OAAwB;CACxD,IAAI,iBAAiB,kBAAkB,MAAM,OAAO,SAAS,KAAK,CAAC,MAAM,SACrE,OAAO,oBAAoB,MAAM,OAAO,EAAE;CAG9C,OAAO,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU,OAAO,KAAK;AACjF;;AAGA,SAAS,OAAO,OAAoC;CAChD,IAAI,iBAAiB,kBAAkB,MAAM,OAAO,SAAS,GACzD,KAAK,MAAM,SAAS,MAAM,QAAQ;EAC9B,MAAM,OAAO,OAAO,KAAK;EACzB,IAAI,MAAM,OAAO;CACrB;CAEJ,IAAI,SAAS,OAAO,UAAU,YAAY,UAAU,SAAS,OAAO,MAAM,SAAS,UAAU,OAAO,MAAM;AAG9G;;AAGA,IAAM,8BAAc,IAAI,IAAI;CAAC;CAAgB;CAAa;CAAa;CAAa;CAAgB;CAAe;AAAY,CAAC;;;;;;;;;;;AAYhI,SAAgB,wBACZ,KACA,OACA,SACe;CACf,MAAM,OAAO,OAAO,KAAK;CACzB,MAAM,OAAO,oBAAoB,KAAK;CACtC,MAAM,OAAO,oBAAoB,OAAO,QAAQ,CAAC,KAAK,SAAS,IAAI,IAAI,KAAK,KAAK,KAAK;CACtF,MAAM,OAAO,OAAO,GAAG;CAEvB,IAAK,QAAQ,YAAY,IAAI,IAAI,KAAM,mEAAmE,KAAK,IAAI,GAC/G,OAAO,OAAO,mCAAmC,QAAQ,MAAM;EAC3D;EACA,QAAQ;EACR;EACA,GAAG,QAAQ,MAAM,KAAI,QAAO,OAAO,KAAK;CAC5C,CAAC;CAEL,IAAI,SAAS,WAAW,SAAS,SAAS;EACtC,IAAI,OAAO;EACX,IAAI;GACA,OAAO,mBAAmB,IAAI,IAAI,GAAG,CAAC,CAAC,QAAQ,KAAK;EACxD,QAAQ,CAAyB;EACjC,OAAO,OAAO,mCAAmC,KAAK,OAAO,QAAQ,MAAM,CACvE,iEACA,QAAQ,WACZ,CAAC;CACL;CAEA,MAAM,SAAS,yDAAyD,KAAK,IAAI,CAAC,GAAG;CACrF,IAAI,QACA,OAAO,OAAO,aAAa,OAAO,OAAO,KAAK,gCAAgC,MAAM;EAChF;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA;EACA;EACA,qBAAqB,OAAO,QAAQ,MAAM,MAAI,EAAE;CACpD,CAAC;CAEL,IAAI,SAAS,SAAS;EAClB,IAAI,WAAW;EACf,IAAI;GACA,WAAW,mBAAmB,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,QAAQ,OAAO,EAAE,CAAC,KAAK;EAC/E,QAAQ,CAA6B;EACrC,OAAO,OAAO,aAAa,SAAS,sBAAsB,QAAQ,MAAM,CACpE,0DACA,QAAQ,WACZ,CAAC;CACL;CAEA,OAAO;AACX;;;;;AAMA,SAAgB,uBAAuB,QAAqC;CACxE,QAAQ,QAAR;EACI,KAAK,QAAQ,OAAO,CAAC,0EAA0E;EAC/F,KAAK,eAAe,OAAO,CAAC,gFAAgF;EAC5G,KAAK,YAAY,OAAO,CAAC,4DAA4D;EACrF,KAAK,UAAU,OAAO,CAClB,gFACA,oDACJ;EACA,KAAK;EACL,KAAK,YAAY,OAAO,CAAC,qEAAqE;EAC9F,KAAK,WAAW,OAAO,CAAC,sFAAsF;CAClH;AACJ"}

package/dist/{console-Dw3HLdUs.js → console-CEGm0XNc.js}

@@ -1,7 +1,7 @@
-import { n as parseCommandArgs, r as wantsHelp } from "./args-CcBphFdj.js";
+import { n as parseCommandArgs, r as wantsHelp } from "./args-BX0YD14a.js";
 import { r as refuseMissingCollectionsPath, t as COLLECTIONS_FLAG_HELP } from "./path-flags-BFgG9V6y.js";
-import { DEV_DATABASE_KIND_ENV, managedNotices, prepareDatabaseEnv } from "./prepare-C1iaiTC4.js";
-import { absolutizeLocalPathArgs, ensureDockerDatabase, n as argsFromCommand, resolveDriverCli, spawnDriverCli, t as reportSpawnFailure } from "./db-Dkn9XhT-.js";
+import { DEV_DATABASE_KIND_ENV, managedNotices, prepareDatabaseEnv } from "./prepare-DdnU70z8.js";
+import { absolutizeLocalPathArgs, ensureDockerDatabase, n as argsFromCommand, resolveDriverCli, spawnDriverCli, t as reportSpawnFailure } from "./db-CRNpA5mH.js";
 import chalk from "chalk";
 import path from "path";
 //#region src/commands/console.ts
@@ -100,4 +100,4 @@ async function consoleCommand(rawArgs) {
 //#endregion
 export { consoleCommand };
 
-//# sourceMappingURL=console-Dw3HLdUs.js.map
+//# sourceMappingURL=console-CEGm0XNc.js.map

package/dist/{console-Dw3HLdUs.js.map → console-CEGm0XNc.js.map}

@@ -1 +1 @@
-{"version":3,"file":"console-Dw3HLdUs.js","names":[],"sources":["../src/commands/console.ts"],"sourcesContent":["/**\n * CLI command: rebase console\n *\n * A Node REPL with the project open — `rebase` (what `openRebase` from\n * `@rebasepro/server-postgres` returns: `dataAsAdmin`, `sql`, `withAuth`) and\n * `collections` in scope — or, with `--eval`, one piece of code run and its\n * result printed as JSON.\n *\n * Resolved like `rebase db push`: the same project and `.env`, the same\n * database (the managed one started if that is what the project uses), the\n * same `--collections` loader — the driver's, spawned in `backend/`. Opening\n * the database changes nothing in it.\n */\nimport chalk from \"chalk\";\nimport path from \"path\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { argsFromCommand } from \"../utils/command-words\";\nimport { COLLECTIONS_FLAG_HELP, refuseMissingCollectionsPath } from \"../utils/path-flags\";\nimport { reportSpawnFailure } from \"../utils/spawn-error\";\nimport { DEV_DATABASE_KIND_ENV, managedNotices, prepareDatabaseEnv } from \"../dev-db/prepare\";\nimport { absolutizeLocalPathArgs, ensureDockerDatabase, resolveDriverCli, spawnDriverCli } from \"./db\";\n\nexport const CONSOLE_FLAGS = {\n    \"--eval\": String,\n    \"-e\": \"--eval\",\n    \"--collections\": String,\n    \"-c\": \"--collections\",\n    \"--database-url\": String,\n    \"--docker\": Boolean\n} as const;\n\n/** What each long flag above does, for the Options block. */\nconst CONSOLE_FLAG_HELP: Record<string, string> = {\n    \"--eval\": \"Run this code instead of the REPL, print its awaited result as JSON, and exit 1 if it throws\",\n    \"--collections\": COLLECTIONS_FLAG_HELP,\n    \"--database-url\": \"Open this database instead of the project's\",\n    \"--docker\": \"Use the database from docker compose, starting it if needed\"\n};\n\n/** Where the REPL keeps its history: the project's own `.rebase/`, which the scaffold ignores. */\nexport function consoleHistoryPath(projectRoot: string): string {\n    return path.join(projectRoot, \".rebase\", \"console_history\");\n}\n\nfunction flagLabel(flag: string): string {\n    const aliases = Object.entries(CONSOLE_FLAGS)\n        .filter(([, target]) => target === flag)\n        .map(([alias]) => alias);\n    return [flag, ...aliases].join(\", \");\n}\n\nexport function printConsoleHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase console\")} — Explore the project's data from a REPL\n\n${chalk.green.bold(\"Usage\")}\n  rebase console [options]\n\n${chalk.green.bold(\"Options\")}\n${Object.keys(CONSOLE_FLAG_HELP)\n        .map(flag => `  ${chalk.blue(flagLabel(flag).padEnd(22))} ${CONSOLE_FLAG_HELP[flag]}`)\n        .join(\"\\n\")}\n\nIn scope:\n  rebase        dataAsAdmin, sql(query, { params }), withAuth(user) → { data }, close()\n  collections   the project's collections\n\nTop-level await works. Opening the database changes nothing in it: no table,\nrole or trigger is created. withAuth runs as the user under row-level security.\n\n${chalk.green.bold(\"Examples\")}\n  rebase console\n  rebase console -e \"rebase.dataAsAdmin.posts.find({ limit: 5 })\"\n  rebase console -e \"(await rebase.withAuth({ uid: 'u1', roles: ['user'] })).data.posts.find()\"\n  rebase console -e \"rebase.sql('select count(*) from posts')\"\n`);\n}\n\nexport async function consoleCommand(rawArgs: string[]): Promise<void> {\n    if (wantsHelp(rawArgs)) {\n        printConsoleHelp();\n        return;\n    }\n\n    // Strictly, before the line is relayed: the driver would otherwise be the\n    // first to see a mistyped flag, after a database had been started for it.\n    const { flags } = parseCommandArgs({\n        spec: CONSOLE_FLAGS,\n        rawArgs,\n        commandWords: 1,\n        command: \"console\",\n        maxPositionals: 0\n    });\n\n    const resolved = await resolveDriverCli();\n    const { projectRoot, backendDir } = resolved;\n    refuseMissingCollectionsPath(rawArgs, process.cwd(), backendDir, \"console\");\n    await ensureDockerDatabase(projectRoot, rawArgs);\n\n    // With --eval, stdout is the result and nothing else, so it can be piped\n    // into `jq`; piped into the REPL, it is the REPL's answers. Either way what\n    // the database resolution has to say goes to stderr.\n    const say = flags[\"--eval\"] === undefined && process.stdin.isTTY\n        ? (line: string) => console.log(chalk.gray(`  ${line}`))\n        : (line: string) => console.error(chalk.gray(`  ${line}`));\n    const prepared = await prepareDatabaseEnv(projectRoot, {\n        flagUrl: flags[\"--database-url\"] ?? null,\n        flagDocker: flags[\"--docker\"] === true,\n        onProgress: say\n    });\n    Object.assign(resolved.env, prepared.env);\n    // The database this run resolved, flags included, so the driver words a\n    // failure to open it for that one — a managed database that has no free\n    // connection is not \"is your Postgres running?\".\n    resolved.env[DEV_DATABASE_KIND_ENV] = prepared.database.kind;\n    for (const line of managedNotices(prepared)) say(line);\n\n    const childArgs = [\n        ...absolutizeLocalPathArgs(argsFromCommand(rawArgs, \"console\"), process.cwd()),\n        `--history=${consoleHistoryPath(projectRoot)}`\n    ];\n\n    try {\n        await spawnDriverCli(resolved, childArgs);\n    } catch (error) {\n        // A child that exited non-zero has already said why, on the terminal it\n        // shares — an `--eval` that threw, a database that refused.\n        reportSpawnFailure(error);\n        process.exit(1);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,IAAa,gBAAgB;CACzB,UAAU;CACV,MAAM;CACN,iBAAiB;CACjB,MAAM;CACN,kBAAkB;CAClB,YAAY;AAChB;;AAGA,IAAM,oBAA4C;CAC9C,UAAU;CACV,iBAAiB;CACjB,kBAAkB;CAClB,YAAY;AAChB;;AAGA,SAAgB,mBAAmB,aAA6B;CAC5D,OAAO,KAAK,KAAK,aAAa,WAAW,iBAAiB;AAC9D;AAEA,SAAS,UAAU,MAAsB;CAIrC,OAAO,CAAC,MAAM,GAHE,OAAO,QAAQ,aAAa,CAAC,CACxC,QAAQ,GAAG,YAAY,WAAW,IAAI,CAAC,CACvC,KAAK,CAAC,WAAW,KACL,CAAO,CAAC,CAAC,KAAK,IAAI;AACvC;AAEA,SAAgB,mBAAyB;CACrC,QAAQ,IAAI;EACd,MAAM,KAAK,gBAAgB,EAAE;;EAE7B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;EAC5B,OAAO,KAAK,iBAAiB,CAAC,CACvB,KAAI,SAAQ,KAAK,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,kBAAkB,OAAO,CAAC,CACrF,KAAK,IAAI,EAAE;;;;;;;;;EASlB,MAAM,MAAM,KAAK,UAAU,EAAE;;;;;CAK9B;AACD;AAEA,eAAsB,eAAe,SAAkC;CACnE,IAAI,UAAU,OAAO,GAAG;EACpB,iBAAiB;EACjB;CACJ;CAIA,MAAM,EAAE,UAAU,iBAAiB;EAC/B,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,WAAW,MAAM,iBAAiB;CACxC,MAAM,EAAE,aAAa,eAAe;CACpC,6BAA6B,SAAS,QAAQ,IAAI,GAAG,YAAY,SAAS;CAC1E,MAAM,qBAAqB,aAAa,OAAO;CAK/C,MAAM,MAAM,MAAM,cAAc,KAAA,KAAa,QAAQ,MAAM,SACpD,SAAiB,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC,KACpD,SAAiB,QAAQ,MAAM,MAAM,KAAK,KAAK,MAAM,CAAC;CAC7D,MAAM,WAAW,MAAM,mBAAmB,aAAa;EACnD,SAAS,MAAM,qBAAqB;EACpC,YAAY,MAAM,gBAAgB;EAClC,YAAY;CAChB,CAAC;CACD,OAAO,OAAO,SAAS,KAAK,SAAS,GAAG;CAIxC,SAAS,IAAI,yBAAyB,SAAS,SAAS;CACxD,KAAK,MAAM,QAAQ,eAAe,QAAQ,GAAG,IAAI,IAAI;CAErD,MAAM,YAAY,CACd,GAAG,wBAAwB,gBAAgB,SAAS,SAAS,GAAG,QAAQ,IAAI,CAAC,GAC7E,aAAa,mBAAmB,WAAW,GAC/C;CAEA,IAAI;EACA,MAAM,eAAe,UAAU,SAAS;CAC5C,SAAS,OAAO;EAGZ,mBAAmB,KAAK;EACxB,QAAQ,KAAK,CAAC;CAClB;AACJ"}
+{"version":3,"file":"console-CEGm0XNc.js","names":[],"sources":["../src/commands/console.ts"],"sourcesContent":["/**\n * CLI command: rebase console\n *\n * A Node REPL with the project open — `rebase` (what `openRebase` from\n * `@rebasepro/server-postgres` returns: `dataAsAdmin`, `sql`, `withAuth`) and\n * `collections` in scope — or, with `--eval`, one piece of code run and its\n * result printed as JSON.\n *\n * Resolved like `rebase db push`: the same project and `.env`, the same\n * database (the managed one started if that is what the project uses), the\n * same `--collections` loader — the driver's, spawned in `backend/`. Opening\n * the database changes nothing in it.\n */\nimport chalk from \"chalk\";\nimport path from \"path\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { argsFromCommand } from \"../utils/command-words\";\nimport { COLLECTIONS_FLAG_HELP, refuseMissingCollectionsPath } from \"../utils/path-flags\";\nimport { reportSpawnFailure } from \"../utils/spawn-error\";\nimport { DEV_DATABASE_KIND_ENV, managedNotices, prepareDatabaseEnv } from \"../dev-db/prepare\";\nimport { absolutizeLocalPathArgs, ensureDockerDatabase, resolveDriverCli, spawnDriverCli } from \"./db\";\n\nexport const CONSOLE_FLAGS = {\n    \"--eval\": String,\n    \"-e\": \"--eval\",\n    \"--collections\": String,\n    \"-c\": \"--collections\",\n    \"--database-url\": String,\n    \"--docker\": Boolean\n} as const;\n\n/** What each long flag above does, for the Options block. */\nconst CONSOLE_FLAG_HELP: Record<string, string> = {\n    \"--eval\": \"Run this code instead of the REPL, print its awaited result as JSON, and exit 1 if it throws\",\n    \"--collections\": COLLECTIONS_FLAG_HELP,\n    \"--database-url\": \"Open this database instead of the project's\",\n    \"--docker\": \"Use the database from docker compose, starting it if needed\"\n};\n\n/** Where the REPL keeps its history: the project's own `.rebase/`, which the scaffold ignores. */\nexport function consoleHistoryPath(projectRoot: string): string {\n    return path.join(projectRoot, \".rebase\", \"console_history\");\n}\n\nfunction flagLabel(flag: string): string {\n    const aliases = Object.entries(CONSOLE_FLAGS)\n        .filter(([, target]) => target === flag)\n        .map(([alias]) => alias);\n    return [flag, ...aliases].join(\", \");\n}\n\nexport function printConsoleHelp(): void {\n    console.log(`\n${chalk.bold(\"rebase console\")} — Explore the project's data from a REPL\n\n${chalk.green.bold(\"Usage\")}\n  rebase console [options]\n\n${chalk.green.bold(\"Options\")}\n${Object.keys(CONSOLE_FLAG_HELP)\n        .map(flag => `  ${chalk.blue(flagLabel(flag).padEnd(22))} ${CONSOLE_FLAG_HELP[flag]}`)\n        .join(\"\\n\")}\n\nIn scope:\n  rebase        dataAsAdmin, sql(query, { params }), withAuth(user) → { data }, close()\n  collections   the project's collections\n\nTop-level await works. Opening the database changes nothing in it: no table,\nrole or trigger is created. withAuth runs as the user under row-level security.\n\n${chalk.green.bold(\"Examples\")}\n  rebase console\n  rebase console -e \"rebase.dataAsAdmin.posts.find({ limit: 5 })\"\n  rebase console -e \"(await rebase.withAuth({ uid: 'u1', roles: ['user'] })).data.posts.find()\"\n  rebase console -e \"rebase.sql('select count(*) from posts')\"\n`);\n}\n\nexport async function consoleCommand(rawArgs: string[]): Promise<void> {\n    if (wantsHelp(rawArgs)) {\n        printConsoleHelp();\n        return;\n    }\n\n    // Strictly, before the line is relayed: the driver would otherwise be the\n    // first to see a mistyped flag, after a database had been started for it.\n    const { flags } = parseCommandArgs({\n        spec: CONSOLE_FLAGS,\n        rawArgs,\n        commandWords: 1,\n        command: \"console\",\n        maxPositionals: 0\n    });\n\n    const resolved = await resolveDriverCli();\n    const { projectRoot, backendDir } = resolved;\n    refuseMissingCollectionsPath(rawArgs, process.cwd(), backendDir, \"console\");\n    await ensureDockerDatabase(projectRoot, rawArgs);\n\n    // With --eval, stdout is the result and nothing else, so it can be piped\n    // into `jq`; piped into the REPL, it is the REPL's answers. Either way what\n    // the database resolution has to say goes to stderr.\n    const say = flags[\"--eval\"] === undefined && process.stdin.isTTY\n        ? (line: string) => console.log(chalk.gray(`  ${line}`))\n        : (line: string) => console.error(chalk.gray(`  ${line}`));\n    const prepared = await prepareDatabaseEnv(projectRoot, {\n        flagUrl: flags[\"--database-url\"] ?? null,\n        flagDocker: flags[\"--docker\"] === true,\n        onProgress: say\n    });\n    Object.assign(resolved.env, prepared.env);\n    // The database this run resolved, flags included, so the driver words a\n    // failure to open it for that one — a managed database that has no free\n    // connection is not \"is your Postgres running?\".\n    resolved.env[DEV_DATABASE_KIND_ENV] = prepared.database.kind;\n    for (const line of managedNotices(prepared)) say(line);\n\n    const childArgs = [\n        ...absolutizeLocalPathArgs(argsFromCommand(rawArgs, \"console\"), process.cwd()),\n        `--history=${consoleHistoryPath(projectRoot)}`\n    ];\n\n    try {\n        await spawnDriverCli(resolved, childArgs);\n    } catch (error) {\n        // A child that exited non-zero has already said why, on the terminal it\n        // shares — an `--eval` that threw, a database that refused.\n        reportSpawnFailure(error);\n        process.exit(1);\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAsBA,IAAa,gBAAgB;CACzB,UAAU;CACV,MAAM;CACN,iBAAiB;CACjB,MAAM;CACN,kBAAkB;CAClB,YAAY;AAChB;;AAGA,IAAM,oBAA4C;CAC9C,UAAU;CACV,iBAAiB;CACjB,kBAAkB;CAClB,YAAY;AAChB;;AAGA,SAAgB,mBAAmB,aAA6B;CAC5D,OAAO,KAAK,KAAK,aAAa,WAAW,iBAAiB;AAC9D;AAEA,SAAS,UAAU,MAAsB;CAIrC,OAAO,CAAC,MAAM,GAHE,OAAO,QAAQ,aAAa,CAAC,CACxC,QAAQ,GAAG,YAAY,WAAW,IAAI,CAAC,CACvC,KAAK,CAAC,WAAW,KACL,CAAO,CAAC,CAAC,KAAK,IAAI;AACvC;AAEA,SAAgB,mBAAyB;CACrC,QAAQ,IAAI;EACd,MAAM,KAAK,gBAAgB,EAAE;;EAE7B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;EAC5B,OAAO,KAAK,iBAAiB,CAAC,CACvB,KAAI,SAAQ,KAAK,MAAM,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,kBAAkB,OAAO,CAAC,CACrF,KAAK,IAAI,EAAE;;;;;;;;;EASlB,MAAM,MAAM,KAAK,UAAU,EAAE;;;;;CAK9B;AACD;AAEA,eAAsB,eAAe,SAAkC;CACnE,IAAI,UAAU,OAAO,GAAG;EACpB,iBAAiB;EACjB;CACJ;CAIA,MAAM,EAAE,UAAU,iBAAiB;EAC/B,MAAM;EACN;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,WAAW,MAAM,iBAAiB;CACxC,MAAM,EAAE,aAAa,eAAe;CACpC,6BAA6B,SAAS,QAAQ,IAAI,GAAG,YAAY,SAAS;CAC1E,MAAM,qBAAqB,aAAa,OAAO;CAK/C,MAAM,MAAM,MAAM,cAAc,KAAA,KAAa,QAAQ,MAAM,SACpD,SAAiB,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC,KACpD,SAAiB,QAAQ,MAAM,MAAM,KAAK,KAAK,MAAM,CAAC;CAC7D,MAAM,WAAW,MAAM,mBAAmB,aAAa;EACnD,SAAS,MAAM,qBAAqB;EACpC,YAAY,MAAM,gBAAgB;EAClC,YAAY;CAChB,CAAC;CACD,OAAO,OAAO,SAAS,KAAK,SAAS,GAAG;CAIxC,SAAS,IAAI,yBAAyB,SAAS,SAAS;CACxD,KAAK,MAAM,QAAQ,eAAe,QAAQ,GAAG,IAAI,IAAI;CAErD,MAAM,YAAY,CACd,GAAG,wBAAwB,gBAAgB,SAAS,SAAS,GAAG,QAAQ,IAAI,CAAC,GAC7E,aAAa,mBAAmB,WAAW,GAC/C;CAEA,IAAI;EACA,MAAM,eAAe,UAAU,SAAS;CAC5C,SAAS,OAAO;EAGZ,mBAAmB,KAAK;EACxB,QAAQ,KAAK,CAAC;CAClB;AACJ"}

package/dist/{context-BM-oOMNX.js → context-CyflUrKg.js}

@@ -1,5 +1,5 @@
 import { c as findProjectRoot } from "./project-Wp2zoyeN.js";
-import { n as parseCommandArgs } from "./args-CcBphFdj.js";
+import { n as parseCommandArgs } from "./args-BX0YD14a.js";
 import { t as cliUserAgent } from "./version-Buyyo1ut.js";
 import chalk from "chalk";
 import arg from "arg";
@@ -1231,4 +1231,4 @@ function requireCloudRow(row, what) {
 //#endregion
 export { projectHost as A, requireProject as B, lookupProjectId as C, parseCloudArgs as D, openUrl as E, reportError as F, resolveProjectRef as G, requireSessionClient as H, requireClient as I, setCurrentContext as J, resolveTimeoutMs as K, requireCloudRow as L, readLink as M, refuseDirectLink as N, printGroupHelp as O, removeLink as P, wantsRawError as Q, requireInteractive as R, keyValues as S, noteBlank as T, resolveCloudTarget as U, requireProjectRef as V, resolveCloudUrl as W, warn as X, success as Y, writeLink as Z, freshAccessToken as _, cloudRow as a, isJsonMode as b, confirmDestructive as c, emit as d, emitHelp as f, fetchTenantBaseDomain as g, fetchDeployTargets as h, billingAccountIdOf as i, projectLinkPath as j, printJson as k, createCloudClient as l, fail as m, GLOBAL_HELP_FLAGS as n, cloudRows as o, envToken as p, setContextOrg as q, TOKEN_ENV as r, colorStatus as s, GLOBAL_CLOUD_FLAGS as t, displayProjectRef as u, getContextOrg as v, note as w, isKnownControlPlane as x, initOutputMode as y, requireKnownAction as z };
 
-//# sourceMappingURL=context-BM-oOMNX.js.map
+//# sourceMappingURL=context-CyflUrKg.js.map