@rebasepro/cli 0.25.0-canary.ge06257e → 0.25.1

package/dist/project-g4K6kV1t.js

@@ -0,0 +1,701 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
+import { n as getPMCommands, t as detectPackageManager } from "./package-manager-DSEOwTqM.js";
+import chalk from "chalk";
+import arg from "arg";
+import fs from "fs";
+import path from "path";
+import { pathToFileURL } from "url";
+import { createRequire } from "module";
+import { execSync } from "child_process";
+import dotenv from "dotenv";
+//#region src/utils/redact.ts
+/**
+* Connection-string passwords, replaced before a line is printed.
+*
+* A refusal that repeats what was typed repeats a password with it, and these
+* lines land in terminals, CI logs and issues. `user:***@` is the form every
+* other message uses: the driver's `redactConnectionPasswords` in
+* `@rebasepro/server-postgres`, which its entry does not export, and this
+* mirrors. Covers the user-info password and a `password=` parameter.
+*/
+function redactConnectionPasswords(text) {
+	return text.replace(/(\b[a-z][a-z0-9+.-]*:\/\/[^\s/?#@'"]*):[^\s/?#'"]*@/gi, "$1:***@").replace(/(\bpassword\s*=\s*)('[^']*'|[^\s&'"]+)/gi, "$1***");
+}
+//#endregion
+//#region src/utils/unknown-command.ts
+/**
+* What every command family says when it does not recognise a subcommand.
+*
+* Six families each did it differently, and the differences were not stylistic:
+*
+*   rebase statsu       "Unknown command: statsu" + the whole top-level help
+*   rebase auth foo     "Unknown auth command: foo" + the whole auth help
+*   rebase apps foo     "Unknown subcommand: foo"   — which command's?
+*   rebase skills foo   "Unknown skills subcommand: foo" + the whole help
+*   rebase telemetry x  the help, silently, with exit code 1 and no error line
+*   rebase cloud debug x both a JSON error *and* the human one, in JSON mode
+*
+* Dumping a screen of help after an error is the wrong shape: the one line that
+* says what happened scrolls off the top, and in a CI log it is buried in
+* forty. None of them offered the correction, which for a typo is the entire
+* answer — `statsu` is one transposition from `status`.
+*
+* So: one line, the near-miss when there is one, and where to read the rest.
+*/
+/**
+* Damerau–Levenshtein distance, capped by the caller.
+*
+* The transposition is the reason this is not plain Levenshtein: `statsu` for
+* `status` and `craete` for `create` are the two most common typing errors
+* there are, and both are distance 2 without it — the same as two unrelated
+* edits, which is too far to suggest anything at all.
+*/
+function editDistance(a, b) {
+	const rows = a.length + 1;
+	const cols = b.length + 1;
+	const d = Array.from({ length: rows }, () => new Array(cols).fill(0));
+	for (let i = 0; i < rows; i++) d[i][0] = i;
+	for (let j = 0; j < cols; j++) d[0][j] = j;
+	for (let i = 1; i < rows; i++) for (let j = 1; j < cols; j++) {
+		const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+		d[i][j] = Math.min(d[i - 1][j] + 1, d[i][j - 1] + 1, d[i - 1][j - 1] + cost);
+		if (i > 1 && j > 1 && a[i - 1] === b[j - 2] && a[i - 2] === b[j - 1]) d[i][j] = Math.min(d[i][j], d[i - 2][j - 2] + 1);
+	}
+	return d[a.length][b.length];
+}
+/**
+* The one command the user probably meant, or nothing.
+*
+* Tight on purpose. A suggestion that is wrong is worse than none: it sends
+* someone to read the help for a command that was never the answer, and on a
+* family like `db` — where `push` and `pull` are one edit apart — a loose
+* threshold would confidently propose the destructive neighbour of what they
+* typed. So: one edit for a short word, two for a long one, and a prefix match
+* always counts (`rebase cloud dep` for `deploy`).
+*/
+function suggestCommand(typed, known) {
+	const word = typed.toLowerCase();
+	if (!word) return void 0;
+	if (word.length >= 3) {
+		const prefixed = known.filter((name) => name.toLowerCase().startsWith(word));
+		if (prefixed.length === 1) return prefixed[0];
+	}
+	const budget = word.length <= 4 ? 1 : 2;
+	let best;
+	for (const candidate of known) {
+		const distance = editDistance(word, candidate.toLowerCase());
+		if (distance > budget) continue;
+		if (!best || distance < best.distance) best = {
+			name: candidate,
+			distance
+		};
+	}
+	return best?.name;
+}
+/**
+* The family command a word names exactly, as `<family> <command>`, or nothing.
+*
+* `rebase deploy` is `rebase cloud deploy`: the word is a whole command one
+* level down. Exact only — a near miss there is a guess about both the family
+* and the command.
+*/
+function familyCommand(typed, families) {
+	const word = typed.toLowerCase();
+	for (const [family, commands] of Object.entries(families)) {
+		const match = commands.find((name) => name.toLowerCase() === word);
+		if (match) return `${family} ${match}`;
+	}
+}
+/**
+* The line itself, without printing it — so callers that must answer in JSON
+* (the cloud family, whose `fail()` writes a machine-readable envelope) use the
+* same words as the ones that print.
+*
+* `family` is empty for the top level: `rebase --help`, not `rebase  --help`.
+* `families` are the command families below this level, by name, whose
+* commands a word may be one of.
+*
+* The typed word is repeated with any connection-string password masked: a URL
+* pasted where the command goes (`rebase db "postgres://u:pw@h/db"`) is a
+* word like any other here, and this line lands in terminals and CI logs.
+*/
+function unknownCommandMessage(typed, known, family = "", families = {}) {
+	const what = family ? `${family} command` : "command";
+	const suggestion = typed ? suggestCommand(typed, known) ?? familyCommand(typed, families) : void 0;
+	const help = family ? `rebase ${family} --help` : "rebase --help";
+	const shown = redactConnectionPasswords(typed ?? "");
+	return suggestion ? `Unknown ${what} "${shown}" — did you mean \`${suggestion}\`? Run \`${help}\` for the rest.` : `Unknown ${what} "${shown}". Run \`${help}\` for the ones there are.`;
+}
+/**
+* Print the line to stderr and exit 1.
+*
+* stderr, not stdout: a mistyped command is a failure, and the families with a
+* `--json` mode guarantee that stdout holds only their envelope.
+*/
+function unknownCommand(typed, known, family = "", families = {}) {
+	console.error(chalk.red(`✗ ${unknownCommandMessage(typed, known, family, families)}`));
+	process.exit(1);
+}
+//#endregion
+//#region src/utils/args.ts
+/**
+* Argument parsing for the commands that take positional arguments.
+*
+* Every command in the small group used to parse its own line the same way:
+* `arg(spec, { argv: rawArgs.slice(4), permissive: true })`, then read `_[0]`
+* and `_[1]`. Both halves of that are wrong in a way that costs data.
+*
+*  - **`permissive: true` turns an unknown flag into a positional.** `arg`
+*    pushes an undeclared flag into `_` as a bare token, so `_[1]` is whatever
+*    came second on the line, flag or not. `rebase auth reset-password
+*    bob@example.com --debug` set Bob's password to the literal `--debug` — and
+*    `--debug` is what `bin/rebase.js` prints after *every* failure as the thing
+*    to re-run with, so the single most likely next keystroke after a failed
+*    reset was the one that reset the account to a two-word string.
+*  - **`slice(4)` assumes the command words are at fixed indices.** They are
+*    not: a flag before the command shifts everything, so `rebase --debug auth
+*    reset-password bob@example.com NewPass1!` read the email as
+*    `reset-password` and the password as `bob@example.com`.
+*
+* So: parse the *whole* line — `rawArgs` is `process.argv` — against a spec
+* strictly, with no permissive mode. `arg` then consumes every flag wherever it
+* appears and rejects the ones nobody declared, which leaves `_` holding the
+* command words followed by the real positionals, in order and at a known
+* offset. An unrecognised flag becomes an error naming the command's help,
+* which is the only safe answer: the alternative is guessing that it was meant
+* as a value.
+*
+* `commands/cloud/index.ts` resolves its positionals against its own spec for
+* the same reason; this is that idea for the commands whose positionals are
+* credentials rather than resource names.
+*/
+/**
+* Flags accepted on top of whatever a command declares.
+*
+* `--debug` is read by `bin/rebase.js` off `process.argv` and never by a
+* command, but it has to be *declared* somewhere or strict parsing rejects the
+* exact flag the CLI tells people to add. `--help`/`-h` are answered by each
+* command's dispatcher before any work happens.
+*/
+var GLOBAL_COMMAND_FLAGS = {
+	"--debug": Boolean,
+	"--help": Boolean,
+	"-h": "--help"
+};
+/**
+* The declared long flag an undeclared one was probably meant to be: one edit
+* or one swap away (`--form` → `--from`), or an abbreviation of exactly one
+* (`--anon` → `--anonymize`).
+*/
+function closestDeclaredFlag(typed, declared) {
+	if (!typed.startsWith("--")) return void 0;
+	const near = suggestCommand(typed.slice(2), declared.filter((flag) => flag.startsWith("--")).map((flag) => flag.slice(2)));
+	return near ? `--${near}` : void 0;
+}
+/** Past this many, a refusal names the help page rather than listing every flag. */
+var LISTED_FLAGS_MAX = 8;
+/**
+* The sentence an undeclared flag is refused with — the one `db backup`,
+* `db restore` and `db branch` say, so one CLI answers a typo one way:
+*
+*     `rebase db pull` has no option --anonymise — did you mean --anonymize?
+*     Nothing was run. See `rebase db pull --help`.
+*
+* With nothing close it lists what the command takes, when that list is short
+* enough to read.
+*
+* `typed` is the argument as `arg` refused it, and only its flag part is
+* repeated: a value given inline (`--fro=postgres://u:pw@h/db`) is not. One
+* argument holding a flag and its value, quoted together, is named as that,
+* and what it quotes is password-masked: `"--fro postgres://u:pw@h/db"` was
+* refused with the whole URL, password included, in the middle of a garbled
+* sentence.
+*
+* Exported for the commands that refuse a flag outside `parseCommandArgs`.
+*/
+function unknownOptionMessage(command, typed, spec) {
+	const declared = Object.keys({
+		...GLOBAL_COMMAND_FLAGS,
+		...spec
+	});
+	const name = typed.split(/[=\s]/)[0];
+	const near = closestDeclaredFlag(name, declared);
+	const tail = ` Nothing was run. See \`rebase ${command} --help\`.`;
+	if (/\s/.test(typed.trim())) {
+		const flag = declared.includes(name) ? name : near;
+		const how = flag ? ` Write them as two arguments, ${flag} <value>, or as ${flag}=<value>.` : " Write a flag and its value as two arguments.";
+		return `\`rebase ${command}\` has no option "${redactConnectionPasswords(typed)}": that is a flag and a value in one argument, quoted together.${how}${tail}`;
+	}
+	const own = Object.keys(spec).filter((flag) => flag.startsWith("--") && !(flag in GLOBAL_COMMAND_FLAGS));
+	return `\`rebase ${command}\` has no option ${name}${near ? ` — did you mean ${near}?` : own.length === 0 ? " — it takes no options." : own.length <= LISTED_FLAGS_MAX ? ` — it takes ${own.join(", ")}.` : "."}${tail}`;
+}
+/** What a flag resolves to, through its alias (`"-y": "--yes"`). */
+function handlerOf(spec, flag) {
+	const declared = spec[flag];
+	return typeof declared === "string" ? spec[declared] : declared;
+}
+/** A flag that takes no value: on when given, off when left out. */
+function isSwitch(handler) {
+	return handler === Boolean || Array.isArray(handler) && handler[0] === Boolean;
+}
+/** The values a switch reads as on, and as off, after its `=`. */
+var SWITCH_ON = /^(?:true|1)$/i;
+var SWITCH_OFF = /^(?:false|0)$/i;
+/**
+* A line with every `--switch=value` resolved: `=true` or `=1` is the switch
+* alone, `=false` or `=0` drops it, and any other value is refused.
+*
+* `arg` drops the value of a flag that takes none and turns the flag on, so
+* `--anonymize=false` anonymized and `--yes=false` answered yes. `=true` kept
+* working by that same accident, and scripts write it, so the two readings a
+* value can have are honoured and nothing else is guessed at. Past `--` every
+* word is a positional, so nothing there is read.
+*
+* @throws UsageError naming the switch and the values it takes.
+*/
+function resolveSwitchValues(spec, argv, command) {
+	const resolved = [];
+	for (let index = 0; index < argv.length; index += 1) {
+		const word = argv[index];
+		if (word === "--") {
+			resolved.push(...argv.slice(index));
+			break;
+		}
+		const flag = word.startsWith("--") && word.includes("=") ? word.slice(0, word.indexOf("=")) : null;
+		if (flag === null || !isSwitch(handlerOf(spec, flag))) {
+			resolved.push(word);
+			continue;
+		}
+		const value = word.slice(flag.length + 1);
+		if (SWITCH_ON.test(value)) resolved.push(flag);
+		else if (!SWITCH_OFF.test(value)) throw new UsageError(switchValueMessage(command, flag, word));
+	}
+	return resolved;
+}
+/**
+* Whether a switch is on in a line read by hand: given alone, or as `=true`
+* or `=1`, before any `--`. The reading {@link resolveSwitchValues} gives the
+* parsed flags, for the code that looks at `rawArgs` itself.
+*/
+function switchOn(rawArgs, flag) {
+	for (const word of rawArgs) {
+		if (word === "--") return false;
+		if (word === flag) return true;
+		if (word.startsWith(`${flag}=`) && SWITCH_ON.test(word.slice(flag.length + 1))) return true;
+	}
+	return false;
+}
+/** The sentence a switch given a value it cannot read is refused with. */
+function switchValueMessage(command, flag, typed) {
+	return `\`rebase ${command}\` cannot read ${redactConnectionPasswords(typed)}: ${flag} is a switch, and after its = it takes true or 1 to turn it on, false or 0 to turn it off. Nothing was run. See \`rebase ${command} --help\`.`;
+}
+/** Did the line ask for help? Answered before dispatch, never by a handler. */
+function wantsHelp(rawArgs) {
+	return rawArgs.includes("--help") || rawArgs.includes("-h");
+}
+/**
+* The command line was wrong — nothing ran, and there is no stack to want.
+*
+* `bin/rebase.js` ends every failure with "Re-run with --debug for the stack
+* trace.", which is right when something broke inside a command and absurd for
+* a typo: the stack points at `arg` and this file, neither of which the person
+* who mistyped `--ouput` has any interest in. Worse, `--debug` is a flag, so
+* the suggested next command is *another* command line — and the one thing we
+* have just established is that the command line is what went wrong.
+*
+* Marked with a property rather than left to `instanceof`, because the reader
+* is `bin/rebase.js`: it imports the bundle, so the class object it would test
+* against is not the one this file compiled to.
+*/
+var UsageError = class extends Error {
+	isUsageError = true;
+	constructor(message) {
+		super(message);
+		this.name = "UsageError";
+	}
+};
+/**
+* Resolve a command's flags and positionals from the full `process.argv`.
+*
+* `commandWords` is how many words name the command itself — 2 for
+* `auth reset-password`, 1 for `start` — and is applied to the *parsed*
+* positionals rather than to `argv`, so a flag placed before the command no
+* longer shifts them.
+*
+* `command` names the command in error messages, e.g. `auth reset-password`.
+*
+* Throws on an unknown flag, on a switch given a value other than true,
+* false, 1 or 0 (`--yes=maybe`), on a positional that looks like a flag, and
+* on more positionals than the command takes. `bin/rebase.js` turns each into
+* a one-line `✗ …` and exit 1.
+*/
+function parseCommandArgs({ spec, rawArgs, commandWords, command, maxPositionals }) {
+	let parsed;
+	const merged = {
+		...GLOBAL_COMMAND_FLAGS,
+		...spec
+	};
+	const argv = resolveSwitchValues(merged, rawArgs.slice(2), command);
+	try {
+		parsed = arg(merged, { argv });
+	} catch (err) {
+		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") {
+			const named = /option: ([\s\S]+)$/.exec(err.message)?.[1] ?? "";
+			throw new UsageError(unknownOptionMessage(command, rawArgs.slice(2).find((word) => word === named || word.startsWith(`${named}=`)) ?? named, spec));
+		}
+		throw err;
+	}
+	const positionals = parsed._.slice(commandWords);
+	for (const value of positionals) if (value.startsWith("-")) throw new UsageError(`\`${redactConnectionPasswords(value)}\` looks like an option, not a value — pass it with an explicit flag (\`rebase ${command} --help\`).`);
+	if (maxPositionals !== void 0 && positionals.length > maxPositionals) throw new UsageError(`rebase ${command} takes ${maxPositionals} argument${maxPositionals === 1 ? "" : "s"}, got ${positionals.length}: ${redactConnectionPasswords(positionals.join(" "))}`);
+	return {
+		flags: parsed,
+		positionals,
+		help: Boolean(parsed["--help"])
+	};
+}
+//#endregion
+//#region src/utils/project.ts
+/**
+* Project discovery utilities for the Rebase CLI.
+*
+* These helpers locate the project root, backend directory, .env file,
+* and local binaries — used by all CLI command modules.
+*/
+var project_exports = /* @__PURE__ */ __exportAll({
+	MANIFEST_FILENAME: () => MANIFEST_FILENAME,
+	dependenciesNotInstalled: () => dependenciesNotInstalled,
+	exitDependenciesNotInstalled: () => exitDependenciesNotInstalled,
+	failAsJson: () => failAsJson,
+	findBackendDir: () => findBackendDir,
+	findEnvFile: () => findEnvFile,
+	findFrontendDir: () => findFrontendDir,
+	findProjectRoot: () => findProjectRoot,
+	getActiveBackendPlugin: () => getActiveBackendPlugin,
+	readEnvFile: () => readEnvFile,
+	requireBackendDir: () => requireBackendDir,
+	requireProjectRoot: () => requireProjectRoot,
+	resolveLocalBin: () => resolveLocalBin,
+	resolvePluginCliScript: () => resolvePluginCliScript,
+	resolveTsx: () => resolveTsx,
+	resolveTsxLoader: () => resolveTsxLoader,
+	validateTsxInstallation: () => validateTsxInstallation,
+	wantsJsonOutput: () => wantsJsonOutput
+});
+/** The authored project manifest. Its presence alone marks a project root. */
+var MANIFEST_FILENAME = "rebase.json";
+/**
+* Walk up from `startDir` to find the Rebase project root.
+*
+* A directory is the root when it holds a `rebase.json`, or when it holds a
+* `package.json` that either lists `backend` as a workspace or sits beside both
+* `backend/` and `config/`.
+*
+* `rebase.json` is checked first and needs no `package.json` beside it, because
+* the conventions below all describe a repository that *contains the backend*.
+* A repository holding only a frontend — the normal shape once a project's apps
+* live in separate repositories — matches none of them, so without this the
+* tooling could not run there at all.
+*/
+function findProjectRoot(startDir = process.cwd()) {
+	let dir = path.resolve(startDir);
+	const root = path.parse(dir).root;
+	while (dir !== root) {
+		if (fs.existsSync(path.join(dir, "rebase.json"))) return dir;
+		const pkgPath = path.join(dir, "package.json");
+		if (fs.existsSync(pkgPath)) {
+			try {
+				const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+				if (pkg.workspaces && Array.isArray(pkg.workspaces)) {
+					if (pkg.workspaces.some((w) => w === "backend")) return dir;
+				}
+			} catch {}
+			if (fs.existsSync(path.join(dir, "backend")) && fs.existsSync(path.join(dir, "config"))) return dir;
+		}
+		dir = path.dirname(dir);
+	}
+	return null;
+}
+/**
+* Locate the backend directory within the project root.
+*/
+function findBackendDir(projectRoot) {
+	const backendDir = path.join(projectRoot, "backend");
+	return fs.existsSync(backendDir) ? backendDir : null;
+}
+/**
+* Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.
+*/
+function getActiveBackendPlugin(backendDir) {
+	const pkgPath = path.join(backendDir, "package.json");
+	if (!fs.existsSync(pkgPath)) return null;
+	try {
+		const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+		const deps = {
+			...pkg.dependencies,
+			...pkg.devDependencies
+		};
+		const candidates = Object.keys(deps).filter((dep) => dep.startsWith("@rebasepro/server-") && dep !== "@rebasepro/server");
+		if (candidates.length === 0) return null;
+		if (candidates.includes("@rebasepro/server-postgres")) return "@rebasepro/server-postgres";
+		for (const candidate of candidates) if (resolvePluginCliScript(backendDir, candidate)) return candidate;
+		return candidates[0];
+	} catch {}
+	return null;
+}
+/**
+* Resolve the active plugin's CLI script.
+*/
+function resolvePluginCliScript(backendDir, pluginName) {
+	const candidates = [];
+	let dir = path.resolve(backendDir);
+	const fsRoot = path.parse(dir).root;
+	while (dir !== fsRoot) {
+		candidates.push(path.join(dir, "node_modules", pluginName, "src", "cli.ts"), path.join(dir, "node_modules", pluginName, "dist", "cli.js"));
+		dir = path.dirname(dir);
+	}
+	candidates.push(path.resolve(backendDir, "..", "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"), path.resolve(backendDir, "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"), path.resolve(backendDir, "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"));
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	return null;
+}
+/**
+* Locate the frontend directory within the project root.
+*/
+function findFrontendDir(projectRoot) {
+	const frontendDir = path.join(projectRoot, "frontend");
+	return fs.existsSync(frontendDir) ? frontendDir : null;
+}
+/**
+* Find the .env file. Checks the project root first, then backend.
+*/
+function findEnvFile(projectRoot) {
+	const candidates = [path.join(projectRoot, ".env"), path.join(projectRoot, "backend", ".env")];
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	return null;
+}
+/**
+* Read the project's `.env` into a plain object.
+*
+* One reader, because there were four: `dotenv` in `start`, a hand-rolled
+* `indexOf("=")` loop in `api-keys`, a single-key regex in `auth`, and its own
+* splitting in `cloud env`. `dotenv` is a declared dependency of this package,
+* so the other three existed for no reason and disagreed with the correct one
+* on the two things people actually write in a `.env`:
+*
+*   - `export KEY=value`, which the hand-rolled parser keyed as
+*     `export KEY` — so the command reported the key as unset while it was
+*     right there in the file;
+*   - `KEY=value # comment`, whose comment travelled into the value and then
+*     into an `Authorization` header, coming back as a 401 with nothing
+*     pointing at the cause.
+*
+* Returns `{}` when the project has no `.env`, so callers can treat "absent"
+* and "empty" alike.
+*/
+function readEnvFile(projectRoot) {
+	const envFile = findEnvFile(projectRoot);
+	if (!envFile || !fs.existsSync(envFile)) return {};
+	try {
+		return dotenv.parse(fs.readFileSync(envFile, "utf-8"));
+	} catch {
+		return {};
+	}
+}
+/**
+* Resolve a binary from the project's node_modules/.bin.
+* Checks backend, root, parent monorepo root, then falls back to PATH.
+*/
+function resolveLocalBin(projectRoot, binName) {
+	const candidates = [path.join(projectRoot, "backend", "node_modules", ".bin", binName), path.join(projectRoot, "node_modules", ".bin", binName)];
+	let parent = path.dirname(projectRoot);
+	const rootDir = path.parse(parent).root;
+	while (parent !== rootDir) {
+		candidates.push(path.join(parent, "node_modules", ".bin", binName));
+		parent = path.dirname(parent);
+	}
+	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
+	try {
+		const globalPath = execSync(`which ${binName}`, { encoding: "utf-8" }).trim();
+		if (globalPath && fs.existsSync(globalPath)) return globalPath;
+	} catch {}
+	return null;
+}
+/**
+* Resolve the tsx binary. Checks backend node_modules first, then root.
+*/
+function resolveTsx(projectRoot) {
+	return resolveLocalBin(projectRoot, "tsx");
+}
+/**
+* tsx's loader, as the URL `node --import` takes, or null when none resolves.
+*
+* For running a TypeScript entry in one Node process. The `tsx` binary is a
+* relay — pnpm's `.bin/tsx` shell shim, then tsx's CLI in one Node, which
+* spawns a second Node with this same loader to run the script — so spawning
+* through it costs a shell and a Node start (~50–100 ms) on every hop, and
+* `rebase dev` pays a hop on every start and every collection save.
+*
+* Resolved the way Node resolves the package, from the project first — the
+* backend, where a scaffold declares tsx, then the root and everything above it
+* — so the tsx used is the one {@link resolveTsx} would have found; then from
+* this package, as the repository's own tests resolve `tsx/cli`. A URL rather
+* than a path: a Windows path is not a valid `--import` specifier.
+*/
+function resolveTsxLoader(projectRoot) {
+	const bases = [
+		path.join(projectRoot, "backend", "noop.js"),
+		path.join(projectRoot, "noop.js"),
+		import.meta.url
+	];
+	for (const base of bases) try {
+		return pathToFileURL(createRequire(base).resolve("tsx")).href;
+	} catch {}
+	return null;
+}
+/**
+* Validate that a resolved tsx binary actually has an intact installation.
+*
+* `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
+* exists. If the pnpm content-addressable store was cleaned or a previous
+* install was interrupted, the symlink can exist while critical files inside
+* the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
+* confusing MODULE_NOT_FOUND error at runtime.
+*
+* This function follows the symlink, walks up to find the tsx package root
+* (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
+* is present. Returns `null` when the installation looks healthy, or an
+* error description string when it appears corrupted.
+*/
+function validateTsxInstallation(tsxBinPath) {
+	try {
+		const realPath = fs.realpathSync(tsxBinPath);
+		let dir = path.dirname(realPath);
+		const fsRoot = path.parse(dir).root;
+		for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {
+			const pkgPath = path.join(dir, "package.json");
+			if (fs.existsSync(pkgPath)) try {
+				if (JSON.parse(fs.readFileSync(pkgPath, "utf-8")).name === "tsx") {
+					const preflightPath = path.join(dir, "dist", "preflight.cjs");
+					if (!fs.existsSync(preflightPath)) return `tsx package at ${dir} is missing dist/preflight.cjs`;
+					return null;
+				}
+			} catch {}
+			dir = path.dirname(dir);
+		}
+		return null;
+	} catch (err) {
+		return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;
+	}
+}
+/**
+* The one sentence a command says when the project's dependencies are missing.
+*
+* Six commands each had their own wording for the same state, and none of them
+* named the remedy:
+*
+*   ✗ Could not find CLI entry point for @rebasepro/server-postgres.
+*   ✗ Could not find tsx binary.
+*   ✗ Could not find tsx binary for backend.
+*
+* All three mean "you have not installed yet" — `getActiveBackendPlugin` has
+* already read the driver out of `backend/package.json` by the time the first
+* one fires, so the package is declared and simply not on disk, and `tsx` is a
+* devDependency of every scaffold. But they read as *Rebase* being broken, and
+* they name an internal path or a binary the developer never asked for rather
+* than the command that fixes it. That is the whole of the failure someone sees
+* on a fresh clone, where `node_modules/` is the one thing a checkout does not
+* carry.
+*
+* So: one sentence, naming the package manager this project uses and the
+* directory to run it in — the working directory is usually neither.
+*/
+function dependenciesNotInstalled(projectRoot) {
+	return `Dependencies are not installed — run \`${getPMCommands(detectPackageManager(projectRoot)).install.join(" ")}\` in ${projectRoot}`;
+}
+/**
+* Print {@link dependenciesNotInstalled} and exit 1.
+*
+* For the five commands that report and stop. `db.ts` throws instead, because
+* its caller adds the `✗` and the exit itself.
+*/
+function exitDependenciesNotInstalled(projectRoot) {
+	console.error(chalk.red(`✗ ${dependenciesNotInstalled(projectRoot)}`));
+	process.exit(1);
+}
+/**
+* The refusal envelope, for a caller that asked for JSON.
+*
+* Same shape as the cloud family's `fail()` — `{ error: { message, code, hint } }`
+* — because there is one CLI and a caller should not have to know which half of
+* it answered. `code` is what a caller branches on and is never absent; the
+* cloud family's reasoning about that applies here unchanged. `issues` carries
+* the per-problem detail a human reader gets as a bullet list, because a
+* refusal that says "2 problem(s)" and does not say which two is not
+* machine-readable in any useful sense.
+*
+* On **stdout**, like every other `--json` result: the contract those commands
+* make is that stdout holds one JSON value, and a caller that pipes stdout to a
+* parser must get a parseable refusal rather than an empty stream and a
+* human sentence it never sees. That contract used to hold for exactly one
+* failure of each command — the one that goes through `requireProjectRoot` —
+* while every other exit of the *same* command wrote human text to stderr and
+* left stdout empty. So `rebase status --json` was parseable outside a project
+* and unparseable inside a broken one, which is the case a caller actually has
+* to handle.
+*
+* The flag is read off `process.argv` because the failure happens inside a
+* helper the command calls before it has parsed anything. Coarse — a literal
+* `--json` as some other flag's value would count — and worth it: the failure
+* mode of being coarse is a JSON error where a human one was wanted, and the
+* failure mode of not doing it is an unparseable stream.
+*/
+function failAsJson(message, code, hint, issues) {
+	const error = {
+		message,
+		code
+	};
+	if (hint !== void 0) error.hint = hint;
+	if (issues !== void 0) error.issues = issues;
+	console.log(JSON.stringify({ error }, null, 2));
+	process.exit(1);
+}
+/**
+* Did the command line ask for machine-readable output? Read as the parser
+* reads a switch: `--json`, `--json=true` and `--json=1` ask for it,
+* `--json=false` and `--json=0` do not.
+*/
+function wantsJsonOutput(argv = process.argv) {
+	return switchOn(argv, "--json");
+}
+/**
+* Require the project root or exit with a helpful error.
+*/
+function requireProjectRoot() {
+	const root = findProjectRoot();
+	if (!root) {
+		if (wantsJsonOutput()) failAsJson("Could not find a Rebase project root.", "no_project_root", `Looked in this directory and every parent for a ${MANIFEST_FILENAME}, a package.json with a "backend" workspace, or a backend/ next to a config/.`);
+		console.error(chalk.red("✗ Could not find a Rebase project root."));
+		console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));
+		console.error(chalk.gray("  a package.json with a \"backend\" workspace, or a backend/ next to a config/."));
+		console.error(chalk.gray("  Run this from inside a project, or create one with `rebase init`."));
+		process.exit(1);
+	}
+	return root;
+}
+/**
+* Require the backend directory or exit with a helpful error.
+*/
+function requireBackendDir(projectRoot) {
+	const backendDir = findBackendDir(projectRoot);
+	if (!backendDir) {
+		if (wantsJsonOutput()) failAsJson("Could not find a backend/ directory.", "no_backend_dir", `Expected at: ${path.join(projectRoot, "backend")}`);
+		console.error(chalk.red("✗ Could not find a backend/ directory."));
+		console.error(chalk.gray(`  Expected at: ${path.join(projectRoot, "backend")}`));
+		process.exit(1);
+	}
+	return backendDir;
+}
+//#endregion
+export { wantsHelp as C, redactConnectionPasswords as D, unknownCommandMessage as E, switchOn as S, unknownCommand as T, resolveTsxLoader as _, findBackendDir as a, parseCommandArgs as b, findProjectRoot as c, readEnvFile as d, requireBackendDir as f, resolveTsx as g, resolvePluginCliScript as h, failAsJson as i, getActiveBackendPlugin as l, resolveLocalBin as m, dependenciesNotInstalled as n, findEnvFile as o, requireProjectRoot as p, exitDependenciesNotInstalled as r, findFrontendDir as s, MANIFEST_FILENAME as t, project_exports as u, validateTsxInstallation as v, suggestCommand as w, resolveSwitchValues as x, UsageError as y };
+
+//# sourceMappingURL=project-g4K6kV1t.js.map