@rebasepro/cli 0.25.0 → 0.26.0

package/dist/state-CYdBvnwA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state-CYdBvnwA.js","names":[],"sources":["../src/dev-db/state.ts"],"sourcesContent":["/**\n * The managed database's state file, and the rules for trusting it.\n *\n * The daemon outlives the command that started it — `rebase db push` in one\n * terminal and `rebase dev` in another have to reach the *same* PGlite, because\n * two processes opening one data directory would corrupt it. So the daemon\n * records where it is, and every command reads that record.\n *\n * A record on disk is a claim, not a fact. The process it names may have been\n * killed, the machine may have rebooted and handed the pid to something else,\n * and the port may now belong to a stranger. {@link readState} therefore only\n * parses; deciding whether a record is live is {@link isDaemonAlive}'s job, and\n * it asks the daemon rather than the operating system.\n */\n\nimport { createHash } from \"crypto\";\nimport fs from \"fs\";\nimport { DEFAULT_RESOURCE_KEY, resourceEnvSuffix } from \"@rebasepro/types\";\nimport net from \"net\";\nimport path from \"path\";\n\n/** Everything under here is generated and gitignored. */\nexport const DEV_DB_DIR = \".rebase\";\n/** PGlite's own data directory. Deleting it is what `--reset` means. */\nexport const DATA_DIR_NAME = \"pgdata\";\n/** The record the daemon writes once it is accepting connections. */\nexport const STATE_FILE_NAME = \"pglite.json\";\n/**\n * Held by whoever is currently starting a daemon.\n *\n * Without it, `rebase dev` and `rebase db push` started in the same second both\n * see no state file, both spawn, and two processes open one PGlite data\n * directory — the exact corruption the single-daemon design exists to prevent.\n * Observed as `ENOTEMPTY` during cleanup, which is the harmless way for it to\n * show up; the harmful way is a damaged database.\n */\nexport const START_LOCK_NAME = \"starting.lock\";\n/**\n * The port each managed database last listened on, by key.\n *\n * Kept apart from the state file because it has to outlive the daemon: the\n * state file is cleared on every stop, and it is what a stopped daemon's\n * successor reads to come back where the last one was. See\n * {@link chooseManagedPort}.\n */\nexport const PORTS_FILE_NAME = \"pglite-ports.json\";\n\nexport interface DaemonState {\n    /** TCP port the socket server is listening on, chosen when it started. */\n    port: number;\n    /** The daemon process. Used only as a fast negative check. */\n    pid: number;\n    /** Absolute path of the PGlite data directory this daemon has open. */\n    dataDir: string;\n    /** ISO timestamp, for diagnostics. */\n    startedAt: string;\n    /**\n     * A random token the daemon also answers with over the wire, on\n     * {@link identityPort}.\n     *\n     * Without it, \"is the daemon alive?\" degrades to \"is something listening on\n     * that port?\", which is a different question and answers yes for whatever\n     * process happened to take the port after a reboot. Rebase would then send\n     * migrations to a stranger.\n     */\n    token: string;\n    /** Loopback port that answers the identity check. */\n    identityPort: number;\n    /**\n     * The additional databases this daemon serves, by declared key.\n     *\n     * One PGlite instance each — PGlite is one database per instance, so\n     * `database(\"analytics\")` is a second data directory and a second port,\n     * not a `CREATE DATABASE`. Started on demand when a command asks for the\n     * key over the identity socket, and recorded here so `rebase status` and\n     * a reset can see them. The default database is the fields above.\n     */\n    databases?: Record<string, { port: number; dataDir: string }>;\n    /**\n     * The version of the CLI that started this daemon.\n     *\n     * The daemon outlives the command that started it, and the database proxy\n     * runs inside it — so after `rebase upgrade` the old proxy, and its bugs,\n     * kept serving until `rebase db stop` or thirty idle minutes. A daemon\n     * started before this was recorded has none; see `daemonOutdated`.\n     */\n    cliVersion?: string;\n}\n\nexport function devDbDir(projectRoot: string): string {\n    return path.join(projectRoot, DEV_DB_DIR);\n}\n\nexport function dataDir(projectRoot: string): string {\n    return path.join(devDbDir(projectRoot), DATA_DIR_NAME);\n}\n\n/**\n * The data directory for an additional declared database.\n *\n * `pgdata__analytics`: the key spelled the way its variable is, so the\n * directory beside `pgdata` and `DATABASE_URL__ANALYTICS` are visibly the\n * same thing.\n */\nexport function additionalDataDir(projectRoot: string, key: string): string {\n    return path.join(devDbDir(projectRoot), `${DATA_DIR_NAME}${resourceEnvSuffix(key).toLowerCase()}`);\n}\n\nexport function stateFile(projectRoot: string): string {\n    return path.join(devDbDir(projectRoot), STATE_FILE_NAME);\n}\n\nexport function startLockFile(projectRoot: string): string {\n    return path.join(devDbDir(projectRoot), START_LOCK_NAME);\n}\n\n/**\n * Take the start lock, or report that somebody else holds it.\n *\n * `wx` is the whole mechanism: create-if-absent is a single atomic syscall, so\n * exactly one of two racing processes can succeed no matter how close together\n * they arrive.\n *\n * A lock older than `staleAfterMs` is broken rather than waited on — the holder\n * may have been killed between creating it and starting anything, and a\n * developer should never have to know this file exists in order to unstick\n * their project.\n */\nexport function acquireStartLock(projectRoot: string, staleAfterMs: number): boolean {\n    const target = startLockFile(projectRoot);\n    fs.mkdirSync(devDbDir(projectRoot), { recursive: true });\n\n    const attempt = (): boolean => {\n        try {\n            const handle = fs.openSync(target, \"wx\");\n            fs.writeSync(handle, `${process.pid} ${new Date().toISOString()}\\n`);\n            fs.closeSync(handle);\n\n            return true;\n        } catch (error) {\n            if ((error as NodeJS.ErrnoException).code !== \"EEXIST\") throw error;\n\n            return false;\n        }\n    };\n\n    if (attempt()) return true;\n\n    try {\n        // Clamped at zero: a filesystem whose timestamp granularity rounds the\n        // mtime *up* reports a negative age for a lock created moments ago,\n        // and a negative age is below every threshold — so `staleAfterMs: 0`,\n        // which means \"break any lock\", would refuse to break one.\n        const age = Math.max(0, Date.now() - fs.statSync(target).mtimeMs);\n        if (age < staleAfterMs) return false;\n        fs.unlinkSync(target);\n    } catch {\n        // Vanished under us, which means the holder finished. Either way the\n        // next attempt is the answer.\n    }\n\n    return attempt();\n}\n\nexport function releaseStartLock(projectRoot: string): void {\n    try {\n        fs.unlinkSync(startLockFile(projectRoot));\n    } catch {\n        // Already released is the desired end state.\n    }\n}\n\n/**\n * Parse the record, or `null` for anything that is not one.\n *\n * Every failure is the same answer — absent — because every failure has the\n * same remedy: start a daemon. A corrupt state file is not worth an error\n * message to a user who never wrote it.\n */\nexport function readState(projectRoot: string): DaemonState | null {\n    let raw: string;\n    try {\n        raw = fs.readFileSync(stateFile(projectRoot), \"utf8\");\n    } catch {\n        return null;\n    }\n\n    try {\n        const parsed = JSON.parse(raw) as Partial<DaemonState>;\n        if (\n            typeof parsed.port !== \"number\" ||\n            !Number.isInteger(parsed.port) ||\n            parsed.port <= 0 ||\n            parsed.port > 65535 ||\n            typeof parsed.pid !== \"number\" ||\n            typeof parsed.dataDir !== \"string\" ||\n            typeof parsed.token !== \"string\" ||\n            parsed.token.length === 0 ||\n            typeof parsed.identityPort !== \"number\" ||\n            !Number.isInteger(parsed.identityPort) ||\n            parsed.identityPort <= 0 ||\n            parsed.identityPort > 65535\n        ) {\n            return null;\n        }\n\n        // Only well-formed entries survive: a malformed one is treated as\n        // absent, and the next ensure asks the daemon for it again.\n        const databases: Record<string, { port: number; dataDir: string }> = {};\n        if (parsed.databases && typeof parsed.databases === \"object\") {\n            for (const [key, entry] of Object.entries(parsed.databases)) {\n                if (\n                    entry && typeof entry.port === \"number\" && Number.isInteger(entry.port)\n                    && entry.port > 0 && entry.port <= 65535 && typeof entry.dataDir === \"string\"\n                ) {\n                    databases[key] = { port: entry.port, dataDir: entry.dataDir };\n                }\n            }\n        }\n\n        return {\n            port: parsed.port,\n            pid: parsed.pid,\n            dataDir: parsed.dataDir,\n            startedAt: typeof parsed.startedAt === \"string\" ? parsed.startedAt : \"\",\n            token: parsed.token,\n            identityPort: parsed.identityPort,\n            ...(Object.keys(databases).length > 0 ? { databases } : {}),\n            ...(typeof parsed.cliVersion === \"string\" && parsed.cliVersion.trim() ? { cliVersion: parsed.cliVersion.trim() } : {})\n        };\n    } catch {\n        return null;\n    }\n}\n\nexport function writeState(projectRoot: string, state: DaemonState): void {\n    fs.mkdirSync(devDbDir(projectRoot), { recursive: true });\n    // Written whole then moved, so a reader never sees half a record — commands\n    // poll this file while the daemon is starting.\n    const target = stateFile(projectRoot);\n    const temporary = `${target}.${process.pid}.tmp`;\n    fs.writeFileSync(temporary, `${JSON.stringify(state, null, 2)}\\n`, \"utf8\");\n    fs.renameSync(temporary, target);\n}\n\nexport function clearState(projectRoot: string): void {\n    try {\n        fs.unlinkSync(stateFile(projectRoot));\n    } catch {\n        // Already gone is the desired end state.\n    }\n}\n\n/** Is *some* process with this pid running? A fast, cheap negative check. */\nexport function pidRunning(pid: number): boolean {\n    try {\n        // Signal 0 performs the permission and existence checks without\n        // delivering anything.\n        process.kill(pid, 0);\n\n        return true;\n    } catch (error) {\n        // EPERM means it exists and belongs to someone else, which for our\n        // purposes is still \"running\".\n        return (error as NodeJS.ErrnoException).code === \"EPERM\";\n    }\n}\n\n/** Can a TCP connection be opened to this port on loopback? */\nexport function portAccepting(port: number, timeoutMs = 1000): Promise<boolean> {\n    return new Promise((resolve) => {\n        const socket = new net.Socket();\n        const settle = (answer: boolean) => {\n            socket.removeAllListeners();\n            socket.destroy();\n            resolve(answer);\n        };\n        socket.setTimeout(timeoutMs);\n        socket.once(\"connect\", () => settle(true));\n        socket.once(\"timeout\", () => settle(false));\n        socket.once(\"error\", () => settle(false));\n        socket.connect(port, \"127.0.0.1\");\n    });\n}\n\n/**\n * Ask a port for a free one, then hand back the number.\n *\n * Deliberately not the probe `rebase init` uses: that one has a documented\n * failure where a port is free to probe and unusable to publish. This binds on\n * loopback only, which is also where the daemon listens, so a port that binds\n * here binds there.\n */\nexport function findFreePort(): Promise<number> {\n    return new Promise((resolve, reject) => {\n        const server = net.createServer();\n        server.once(\"error\", reject);\n        server.listen(0, \"127.0.0.1\", () => {\n            const address = server.address();\n            if (address === null || typeof address === \"string\") {\n                server.close(() => reject(new Error(\"Could not determine a free port.\")));\n\n                return;\n            }\n            const { port } = address;\n            server.close(() => resolve(port));\n        });\n    });\n}\n\n/** Where a project's derived database port falls: 25432–26431. */\nconst MANAGED_PORT_FIRST = 25432;\nconst MANAGED_PORT_SPAN = 1000;\n\n/**\n * The port a project's managed database tries first when nothing is recorded:\n * derived from the project path, and for an additional database from its key\n * too, so two projects — and a project's two databases — rarely ask for the\n * same one.\n *\n * Below every ephemeral range (Linux hands out 32768 and up, macOS 49152 and\n * up), so an outgoing connection's source port never sits on it, and clear of\n * the ports `rebase dev` derives for the backend (3001–3999), the admin panel\n * (5173–5372) and the compose database (5433–5632).\n */\nexport function derivedManagedPort(projectRoot: string, key: string = DEFAULT_RESOURCE_KEY): number {\n    const seed = key === DEFAULT_RESOURCE_KEY ? path.resolve(projectRoot) : `${path.resolve(projectRoot)}\\0${key}`;\n    const digest = createHash(\"sha256\").update(seed).digest();\n    return MANAGED_PORT_FIRST + (digest.readUInt32BE(0) % MANAGED_PORT_SPAN);\n}\n\nfunction portsFile(projectRoot: string): string {\n    return path.join(devDbDir(projectRoot), PORTS_FILE_NAME);\n}\n\n/** The port each database last listened on, by key; empty when nothing is recorded or the record is unreadable. */\nfunction readRecordedPorts(projectRoot: string): Record<string, number> {\n    try {\n        const parsed: unknown = JSON.parse(fs.readFileSync(portsFile(projectRoot), \"utf8\"));\n        if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return {};\n        const ports: Record<string, number> = {};\n        for (const [key, port] of Object.entries(parsed)) {\n            if (typeof port === \"number\" && Number.isInteger(port) && port > 0 && port <= 65535) ports[key] = port;\n        }\n        return ports;\n    } catch {\n        return {};\n    }\n}\n\n/**\n * Remember where these databases listen, merged into what is recorded.\n *\n * Best effort: a `.rebase/` that cannot be written costs the next start its\n * preference, not the start itself.\n */\nexport function recordManagedPorts(projectRoot: string, ports: Record<string, number>): void {\n    try {\n        fs.mkdirSync(devDbDir(projectRoot), { recursive: true });\n        const merged = { ...readRecordedPorts(projectRoot), ...ports };\n        const target = portsFile(projectRoot);\n        const temporary = `${target}.${process.pid}.tmp`;\n        fs.writeFileSync(temporary, `${JSON.stringify(merged, null, 2)}\\n`, \"utf8\");\n        fs.renameSync(temporary, target);\n    } catch {\n        // See above.\n    }\n}\n\n/** Can a server listen on this loopback port right now? */\nexport function portBindable(port: number): Promise<boolean> {\n    return new Promise((resolve) => {\n        const server = net.createServer();\n        server.once(\"error\", () => resolve(false));\n        server.listen(port, \"127.0.0.1\", () => server.close(() => resolve(true)));\n    });\n}\n\n/**\n * The port a managed database should listen on: where it listened last time,\n * else the one derived from the project path, else any free one.\n *\n * Stable on purpose. A backend holds the URL it was started with, and a pool\n * reconnects to the same address on its own — so a database that comes back on\n * the port it had is one a running `rebase dev` recovers from without a\n * restart. It used to be whatever the operating system handed out, and a `rebase\n * db stop` followed by any command that starts it again left the backend\n * dialling a port nothing listened on, answering 503 until dev was restarted.\n *\n * @param canBind stands in for {@link portBindable} in the tests.\n */\nexport async function chooseManagedPort(\n    projectRoot: string,\n    key: string = DEFAULT_RESOURCE_KEY,\n    canBind: (port: number) => Promise<boolean> = portBindable\n): Promise<number> {\n    const candidates = [readRecordedPorts(projectRoot)[key], derivedManagedPort(projectRoot, key)];\n    for (const port of new Set(candidates.filter((candidate): candidate is number => candidate !== undefined))) {\n        if (await canBind(port)) return port;\n    }\n    return findFreePort();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,IAAa,aAAa;;AAE1B,IAAa,gBAAgB;;AAE7B,IAAa,kBAAkB;;;;;;;;;;AAU/B,IAAa,kBAAkB;;;;;;;;;AAS/B,IAAa,kBAAkB;AA4C/B,SAAgB,SAAS,aAA6B;CAClD,OAAO,KAAK,KAAK,aAAa,UAAU;AAC5C;AAEA,SAAgB,QAAQ,aAA6B;CACjD,OAAO,KAAK,KAAK,SAAS,WAAW,GAAG,aAAa;AACzD;;;;;;;;AASA,SAAgB,kBAAkB,aAAqB,KAAqB;CACxE,OAAO,KAAK,KAAK,SAAS,WAAW,GAAG,GAAG,gBAAgB,kBAAkB,GAAG,CAAC,CAAC,YAAY,GAAG;AACrG;AAEA,SAAgB,UAAU,aAA6B;CACnD,OAAO,KAAK,KAAK,SAAS,WAAW,GAAG,eAAe;AAC3D;AAEA,SAAgB,cAAc,aAA6B;CACvD,OAAO,KAAK,KAAK,SAAS,WAAW,GAAG,eAAe;AAC3D;;;;;;;;;;;;;AAcA,SAAgB,iBAAiB,aAAqB,cAA+B;CACjF,MAAM,SAAS,cAAc,WAAW;CACxC,GAAG,UAAU,SAAS,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CAEvD,MAAM,gBAAyB;EAC3B,IAAI;GACA,MAAM,SAAS,GAAG,SAAS,QAAQ,IAAI;GACvC,GAAG,UAAU,QAAQ,GAAG,QAAQ,IAAI,oBAAG,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE,GAAG;GACnE,GAAG,UAAU,MAAM;GAEnB,OAAO;EACX,SAAS,OAAO;GACZ,IAAK,MAAgC,SAAS,UAAU,MAAM;GAE9D,OAAO;EACX;CACJ;CAEA,IAAI,QAAQ,GAAG,OAAO;CAEtB,IAAI;EAMA,IADY,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,SAAS,MAAM,CAAC,CAAC,OACrD,IAAM,cAAc,OAAO;EAC/B,GAAG,WAAW,MAAM;CACxB,QAAQ,CAGR;CAEA,OAAO,QAAQ;AACnB;AAEA,SAAgB,iBAAiB,aAA2B;CACxD,IAAI;EACA,GAAG,WAAW,cAAc,WAAW,CAAC;CAC5C,QAAQ,CAER;AACJ;;;;;;;;AASA,SAAgB,UAAU,aAAyC;CAC/D,IAAI;CACJ,IAAI;EACA,MAAM,GAAG,aAAa,UAAU,WAAW,GAAG,MAAM;CACxD,QAAQ;EACJ,OAAO;CACX;CAEA,IAAI;EACA,MAAM,SAAS,KAAK,MAAM,GAAG;EAC7B,IACI,OAAO,OAAO,SAAS,YACvB,CAAC,OAAO,UAAU,OAAO,IAAI,KAC7B,OAAO,QAAQ,KACf,OAAO,OAAO,SACd,OAAO,OAAO,QAAQ,YACtB,OAAO,OAAO,YAAY,YAC1B,OAAO,OAAO,UAAU,YACxB,OAAO,MAAM,WAAW,KACxB,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,UAAU,OAAO,YAAY,KACrC,OAAO,gBAAgB,KACvB,OAAO,eAAe,OAEtB,OAAO;EAKX,MAAM,YAA+D,CAAC;EACtE,IAAI,OAAO,aAAa,OAAO,OAAO,cAAc;QAC3C,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,SAAS,GACtD,IACI,SAAS,OAAO,MAAM,SAAS,YAAY,OAAO,UAAU,MAAM,IAAI,KACnE,MAAM,OAAO,KAAK,MAAM,QAAQ,SAAS,OAAO,MAAM,YAAY,UAErE,UAAU,OAAO;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ;EAAA;EAKxE,OAAO;GACH,MAAM,OAAO;GACb,KAAK,OAAO;GACZ,SAAS,OAAO;GAChB,WAAW,OAAO,OAAO,cAAc,WAAW,OAAO,YAAY;GACrE,OAAO,OAAO;GACd,cAAc,OAAO;GACrB,GAAI,OAAO,KAAK,SAAS,CAAC,CAAC,SAAS,IAAI,EAAE,UAAU,IAAI,CAAC;GACzD,GAAI,OAAO,OAAO,eAAe,YAAY,OAAO,WAAW,KAAK,IAAI,EAAE,YAAY,OAAO,WAAW,KAAK,EAAE,IAAI,CAAC;EACxH;CACJ,QAAQ;EACJ,OAAO;CACX;AACJ;AAEA,SAAgB,WAAW,aAAqB,OAA0B;CACtE,GAAG,UAAU,SAAS,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;CAGvD,MAAM,SAAS,UAAU,WAAW;CACpC,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,IAAI;CAC3C,GAAG,cAAc,WAAW,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,EAAE,KAAK,MAAM;CACzE,GAAG,WAAW,WAAW,MAAM;AACnC;AAEA,SAAgB,WAAW,aAA2B;CAClD,IAAI;EACA,GAAG,WAAW,UAAU,WAAW,CAAC;CACxC,QAAQ,CAER;AACJ;;AAGA,SAAgB,WAAW,KAAsB;CAC7C,IAAI;EAGA,QAAQ,KAAK,KAAK,CAAC;EAEnB,OAAO;CACX,SAAS,OAAO;EAGZ,OAAQ,MAAgC,SAAS;CACrD;AACJ;;;;;;;;;AA2BA,SAAgB,eAAgC;CAC5C,OAAO,IAAI,SAAS,SAAS,WAAW;EACpC,MAAM,SAAS,IAAI,aAAa;EAChC,OAAO,KAAK,SAAS,MAAM;EAC3B,OAAO,OAAO,GAAG,mBAAmB;GAChC,MAAM,UAAU,OAAO,QAAQ;GAC/B,IAAI,YAAY,QAAQ,OAAO,YAAY,UAAU;IACjD,OAAO,YAAY,uBAAO,IAAI,MAAM,kCAAkC,CAAC,CAAC;IAExE;GACJ;GACA,MAAM,EAAE,SAAS;GACjB,OAAO,YAAY,QAAQ,IAAI,CAAC;EACpC,CAAC;CACL,CAAC;AACL;;AAGA,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB;;;;;;;;;;;;AAa1B,SAAgB,mBAAmB,aAAqB,MAAc,sBAA8B;CAChG,MAAM,OAAO,QAAQ,uBAAuB,KAAK,QAAQ,WAAW,IAAI,GAAG,KAAK,QAAQ,WAAW,EAAE,IAAI;CAEzG,OAAO,qBADQ,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OACpB,CAAA,CAAO,aAAa,CAAC,IAAI;AAC1D;AAEA,SAAS,UAAU,aAA6B;CAC5C,OAAO,KAAK,KAAK,SAAS,WAAW,GAAG,eAAe;AAC3D;;AAGA,SAAS,kBAAkB,aAA6C;CACpE,IAAI;EACA,MAAM,SAAkB,KAAK,MAAM,GAAG,aAAa,UAAU,WAAW,GAAG,MAAM,CAAC;EAClF,IAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,GAAG,OAAO,CAAC;EAC5E,MAAM,QAAgC,CAAC;EACvC,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,MAAM,GAC3C,IAAI,OAAO,SAAS,YAAY,OAAO,UAAU,IAAI,KAAK,OAAO,KAAK,QAAQ,OAAO,MAAM,OAAO;EAEtG,OAAO;CACX,QAAQ;EACJ,OAAO,CAAC;CACZ;AACJ;;;;;;;AAQA,SAAgB,mBAAmB,aAAqB,OAAqC;CACzF,IAAI;EACA,GAAG,UAAU,SAAS,WAAW,GAAG,EAAE,WAAW,KAAK,CAAC;EACvD,MAAM,SAAS;GAAE,GAAG,kBAAkB,WAAW;GAAG,GAAG;EAAM;EAC7D,MAAM,SAAS,UAAU,WAAW;EACpC,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,IAAI;EAC3C,GAAG,cAAc,WAAW,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,EAAE,KAAK,MAAM;EAC1E,GAAG,WAAW,WAAW,MAAM;CACnC,QAAQ,CAER;AACJ;;AAGA,SAAgB,aAAa,MAAgC;CACzD,OAAO,IAAI,SAAS,YAAY;EAC5B,MAAM,SAAS,IAAI,aAAa;EAChC,OAAO,KAAK,eAAe,QAAQ,KAAK,CAAC;EACzC,OAAO,OAAO,MAAM,mBAAmB,OAAO,YAAY,QAAQ,IAAI,CAAC,CAAC;CAC5E,CAAC;AACL;;;;;;;;;;;;;;AAeA,eAAsB,kBAClB,aACA,MAAc,sBACd,UAA8C,cAC/B;CACf,MAAM,aAAa,CAAC,kBAAkB,WAAW,CAAC,CAAC,MAAM,mBAAmB,aAAa,GAAG,CAAC;CAC7F,KAAK,MAAM,QAAQ,IAAI,IAAI,WAAW,QAAQ,cAAmC,cAAc,KAAA,CAAS,CAAC,GACrG,IAAI,MAAM,QAAQ,IAAI,GAAG,OAAO;CAEpC,OAAO,aAAa;AACxB"}

package/dist/static-syntax-check.d.ts

@@ -0,0 +1,64 @@
+/** One syntax error, located the way an editor wants it: 1-based line and column. */
+export interface StaticSyntaxError {
+    /** The file, relative to the directory the caller asked to show paths from. */
+    file: string;
+    line: number;
+    column: number;
+    message: string;
+    /** The offending source line, trimmed to something printable. */
+    excerpt?: string;
+}
+export interface StaticSyntaxReport {
+    /** JavaScript files plus inline scripts parsed. */
+    checked: number;
+    errors: StaticSyntaxError[];
+}
+/** How a source is run: a classic script, a module, or unknown (a `.js` file). */
+export type ScriptKind = "script" | "module" | "auto";
+interface ParseFailure {
+    line: number;
+    /** 0-based, as acorn reports it. */
+    column: number;
+    /** Offset into the source, used to pick the more informative of two parses. */
+    pos: number;
+    message: string;
+}
+/**
+ * Parse one source and return its first syntax error, or null.
+ *
+ * A `.js` file can be loaded either way — `<script src>` runs it as a classic
+ * script, `<script type="module">` or an `import` as a module — and each mode
+ * rejects code the other accepts (`import` in a script, `with` in a module).
+ * So `auto` accepts a source that parses either way, and when neither does,
+ * reports the parse that got further: that is the one that tripped over the
+ * actual mistake rather than over the choice of mode.
+ */
+export declare function findSyntaxError(source: string, kind: ScriptKind, cjs?: boolean): ParseFailure | null;
+/** An inline script found in an HTML document, positioned in that document. */
+export interface InlineScript {
+    source: string;
+    kind: "script" | "module";
+    /** 1-based line of the script body's first character. */
+    line: number;
+    /** 0-based column of that character. */
+    column: number;
+}
+/**
+ * The inline scripts of an HTML document that a browser would run as
+ * JavaScript, each with the position its body starts at.
+ *
+ * HTML comments are blanked first, keeping every newline, so a commented-out
+ * `<script>` is not checked and the line numbers of everything after it are
+ * still right.
+ */
+export declare function inlineScripts(html: string): InlineScript[];
+/**
+ * Parse every JavaScript file and inline script under `dir`.
+ *
+ * `displayRoot` is what reported paths are relative to: the project root, so
+ * an error reads `web/cloud.js:42:7` and can be opened as written.
+ */
+export declare function checkStaticSyntax(dir: string, displayRoot?: string): StaticSyntaxReport;
+/** The errors as the lines a person reads: `file:line:col  message`, then the line itself. */
+export declare function formatSyntaxErrors(errors: StaticSyntaxError[], limit?: number): string[];
+export {};

package/dist/{status-BJ26yZOo.js → status-BREvtzJm.js}

@@ -1,11 +1,10 @@
-import { d as readEnvFile, i as failAsJson, p as requireProjectRoot } from "./project-Wp2zoyeN.js";
-import { n as parseCommandArgs, r as wantsHelp } from "./args-BX0YD14a.js";
-import { d as findBackendApp, g as resolveBackendPaths, o as ManifestError, p as loadManifest } from "./manifest-DRp0UVTj.js";
-import { c as withImplicitDefaults, n as deriveOptionsFor, o as readResourceGraphFile, r as deriveResourceGraph, s as serializeResourceGraph, t as RESOURCE_GRAPH_FILENAME } from "./derive-CsoFGAnK.js";
-import { a as parseLoopbackDsn, o as probeTcp } from "./dev-preflight-unHpiYO1.js";
-import { i as managedUrl, r as findRunningDaemon } from "./daemon-CknkDjd6.js";
-import { resolveProjectDatabaseAndBranch } from "./prepare-DdnU70z8.js";
-import { describeTarget } from "./pull-C3PXduzl.js";
+import { d as readEnvFile, i as failAsJson, p as requireProjectRoot, w as wantsHelp, x as parseCommandArgs } from "./project-CasK56vN.js";
+import { d as findBackendApp, g as resolveBackendPaths, o as ManifestError, p as loadManifest } from "./manifest-BtzDy7KQ.js";
+import { c as withImplicitDefaults, n as deriveOptionsFor, o as readResourceGraphFile, r as deriveResourceGraph, s as serializeResourceGraph, t as RESOURCE_GRAPH_FILENAME } from "./derive-ae9UOoOB.js";
+import { a as parseLoopbackDsn, o as probeTcp } from "./dev-preflight-Cxv3TiD1.js";
+import { i as managedUrl, r as findRunningDaemon } from "./daemon-Cp7oNXth.js";
+import { resolveProjectDatabaseAndBranch } from "./prepare-CTw9NEkh.js";
+import { describeTarget } from "./pull-DDMpsZ5r.js";
 import chalk from "chalk";
 import fs from "fs";
 import path from "path";
@@ -428,4 +427,4 @@ async function statusCommand(rawArgs) {
 //#endregion
 export { statusCommand };
 
-//# sourceMappingURL=status-BJ26yZOo.js.map
+//# sourceMappingURL=status-BREvtzJm.js.map

package/dist/{status-BJ26yZOo.js.map → status-BREvtzJm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"status-BJ26yZOo.js","names":[],"sources":["../src/resources/status.ts","../src/commands/status.ts"],"sourcesContent":["/**\n * What a project declared, what the environment binds it to, and whether the\n * two meet.\n *\n * ## Why this exists\n *\n * Every piece of this was already knowable and none of it was visible in one\n * place. `rebase resources` lists what you declared. The environment holds the\n * variables. The resolvers decide whether a source is usable. So the question a\n * developer actually has — *\"why does uploading to `media` answer 501\"* — could\n * only be answered by knowing the suffix rule, deriving the variable name by\n * hand, and checking it against a `.env` they had to find first.\n *\n * The answer is mechanical, so it should be printed rather than taught.\n *\n * ## Why it calls the resolvers instead of re-deciding\n *\n * The verdict comes from `resolveDataSources` and `resolveStorageBackend` — the\n * same functions that run at boot. A status view that decided for itself what\n * \"configured\" means would be a second implementation of the rule, and the\n * first time it disagreed it would be reassuring a developer about a deployment\n * that is about to refuse to start.\n *\n * The variable *names* come from each kind's `envBases`, and the verdicts from\n * the resolver `@rebasepro/server` registers per kind — one object per kind,\n * held to `envBases` by `resource-env-bases.test.ts`. A kind this view has\n * never heard of is judged by whatever resolver its package registered.\n */\nimport { withImplicitDefaults } from \"./derive\";\nimport {\n    DEFAULT_RESOURCE_KEY,\n    envBasesForResource,\n    resourceEnvSuffix,\n    resourceToDataSource,\n    type ResourceDeclaration,\n    type ResourceGraph\n} from \"@rebasepro/types\";\n\n/** One environment variable a resource reads, and whether it is there. */\nexport interface ResourceBinding {\n    /** The variable this resource reads, suffix included. */\n    name: string;\n    set: boolean;\n    /**\n     * The account-scoped name consulted when `name` is unset.\n     *\n     * Only provider-level bindings have one, and only when the resource named\n     * an `account`. Shown because a developer looking at an unset\n     * `S3_ACCESS_KEY_ID__MEDIA` needs to know it is not the whole story.\n     */\n    fallback?: { name: string; set: boolean };\n}\n\n/** Whether a declared resource can actually be reached. */\nexport type ResourceState =\n    /** Bound and usable. */\n    | \"ready\"\n    /** Nothing set for it. Legal for a bucket, fatal for a database. */\n    | \"unconfigured\"\n    /** Set, and set wrongly. The deployment refuses to start. */\n    | \"broken\";\n\nexport interface ResourceStatus {\n    kind: string;\n    key: string;\n    engine: string;\n    transport: string;\n    /** Present when this resource shares another's credentials. */\n    account?: string;\n    /** True for a resource nobody declared, which exists anyway. */\n    implicit: boolean;\n    bindings: ResourceBinding[];\n    state: ResourceState;\n    /** What this means, in the terms the developer will meet it in. */\n    detail: string;\n    /** Set when a local directory stands in for this engine, in development. */\n    standsIn?: string;\n    /** What in the project reaches this resource, from the graph. */\n    usedBy?: readonly string[];\n}\n\nexport type EnvBag = Record<string, string | undefined>;\n\n/** Set, and not set to the empty string — which the resolvers treat as absent. */\nfunction isSet(env: EnvBag, name: string): boolean {\n    const value = env[name];\n    return typeof value === \"string\" && value !== \"\";\n}\n\n/**\n * The bindings one declaration reads, in the order a reader should scan them.\n *\n * A `direct`-transport resource gets none: the browser reaches it with a\n * provider SDK and the backend binds nothing for it, so listing variables would\n * invite someone to set variables that are never read.\n */\nexport function bindingsFor(\n    declaration: ResourceDeclaration,\n    env: EnvBag,\n    accountScopedBases: readonly string[]\n): ResourceBinding[] {\n    if (declaration.transport !== \"server\") return [];\n\n    const suffix = resourceEnvSuffix(declaration.key);\n    const account = typeof declaration.options.account === \"string\"\n        ? resourceEnvSuffix(declaration.options.account)\n        : undefined;\n\n    return envBasesForResource(declaration).map((base) => {\n        const name = `${base}${suffix}`;\n        const binding: ResourceBinding = { name, set: isSet(env, name) };\n\n        // Only the provider-level bindings fall back, and only for a resource\n        // that named an account. The bucket name never does — it is what\n        // distinguishes one source from another.\n        if (account !== undefined && !binding.set && accountScopedBases.includes(base)) {\n            binding.fallback = { name: `${base}${account}`, set: isSet(env, `${base}${account}`) };\n        }\n        return binding;\n    });\n}\n\n/**\n * What the managed development database covers, when a project is on it.\n *\n * `rebase init` leaves `DATABASE_URL` commented out on purpose and the managed\n * PGlite fills the vacuum — the documented first-run state. Judging that state\n * by the environment alone produced `○ (default) postgres · DATABASE_URL not\n * set` and the remedy \"set DATABASE_URL\", at the same moment `rebase db url`\n * was printing a working connection string for the same project and\n * `rebase dev` was serving from it. The status view was reading the one place\n * the answer deliberately is not.\n *\n * Resolved by the caller, because deciding it needs the project's `.env`, its\n * branch pointer and its compose file, and this module stays free of all three.\n */\nexport interface ManagedDatabaseStatus {\n    /**\n     * The daemon's connection string, or null when it is not running.\n     *\n     * Null is not an error: the managed database exists per project and starts\n     * on demand. It only means there is nothing to run the whole-set check\n     * against, and the row says so rather than implying a misconfiguration.\n     */\n    url: string | null;\n}\n\n/**\n * The compose `db` service, when a project is on Postgres in Docker.\n *\n * `rebase dev --docker` is remembered, and every command follows it with the\n * scaffold's `DATABASE_URL` still commented out — so, judged by `.env` alone,\n * this view said the default database had no connection string while `rebase\n * dev --docker` served the project from it. Unlike the managed database it\n * stands in for the default only: `dev --docker` hands the backend\n * `DATABASE_URL` and nothing else, so a second declared database still needs\n * its own variable.\n */\nexport interface DockerDatabaseStatus {\n    /** The compose service's connection string, which the runtime is given as `DATABASE_URL`. */\n    url: string;\n    /** What the default database's row says it is. */\n    detail: string;\n}\n\n/**\n * The resolver-side of status, as `@rebasepro/server` registers it per kind.\n *\n * Passed in rather than imported so this module stays testable without a\n * server, and so a kind registered by a plugin is judged by the resolver the\n * plugin brought with it rather than by a switch here.\n */\nexport interface StatusResolvers {\n    /** `resourceResolver(kind)` from `@rebasepro/server`. */\n    resolverFor: (kind: string) => {\n        accountScoped?: readonly string[];\n        resolve: (\n            declaration: ResourceDeclaration,\n            env: EnvBag,\n            context: { production: boolean; defaultBasePath: string }\n        ) => { state: \"ready\" | \"unbound\" | \"blocked\" | \"code\"; detail?: string; standsIn?: string };\n    } | undefined;\n    /** `resolveDataSources` from `@rebasepro/server`, for the whole-set check. */\n    resolveDataSources: (env: EnvBag, definitions: unknown) => unknown;\n    /** Whether the process being judged is production. Status judges for development by default. */\n    production?: boolean;\n    /**\n     * Set when this project runs on the managed development database.\n     *\n     * Absent for a project that named its own connection string, and absent in\n     * production — where an unset `DATABASE_URL` is the failure it has always\n     * been.\n     */\n    managedDatabase?: ManagedDatabaseStatus;\n    /** Set when this project runs on Postgres in Docker. Absent in production, like the managed one. */\n    dockerDatabase?: DockerDatabaseStatus;\n}\n\n/**\n * The environment plus the managed database's URL, for the whole-set check.\n *\n * A copy: the bindings a reader sees are computed against the real `.env`, so\n * nothing here can make the view claim a variable is set that is not. This is\n * only what `resolveDataSources` is handed, and it is handed it so the check\n * judges the environment the runtime would actually get rather than throwing\n * \"Data source \"(default)\" has no connection string\" about a database that is\n * running and reachable.\n */\nfunction withManagedUrls(env: EnvBag, graph: ResourceGraph, url: string): EnvBag {\n    const filled: EnvBag = { ...env };\n    const keys = [\n        DEFAULT_RESOURCE_KEY,\n        ...graph.resources.filter(r => r.kind === \"database\").map(r => r.key)\n    ];\n    for (const key of keys) {\n        const name = `DATABASE_URL${resourceEnvSuffix(key)}`;\n        if (!isSet(filled, name)) filled[name] = url;\n    }\n\n    return filled;\n}\n\n/**\n * The environment with the default database's URL filled in, when `.env` leaves it out.\n *\n * What a database's resolver is judged against. The resolver checks a source\n * alongside the default one, so a second database bound by its own\n * `DATABASE_URL__ANALYTICS` was marked ✗ with `Data source \"(default)\" has no\n * connection string` — on a project whose default the managed database or the\n * compose service provides, and whose boot worked. Judged against the\n * environment the runtime actually gets, it is judged on its own string.\n */\nfunction withDefaultUrl(env: EnvBag, url: string | null | undefined): EnvBag {\n    if (!url || isSet(env, \"DATABASE_URL\")) return env;\n\n    return { ...env, DATABASE_URL: url };\n}\n\n/**\n * Resolve every declared resource against an environment.\n *\n * Each kind's verdict comes from the resolver `@rebasepro/server` registered\n * for it — the same one boot calls — so this view cannot say \"ready\" about a\n * binding boot would refuse. A kind with no resolver is reported as such\n * rather than skipped: a resource nobody shows is one nobody remembers to\n * configure, and a kind this runtime cannot bind is exactly what boot will\n * refuse by name.\n *\n * `resolveDataSources` is then run once over the whole set, so anything it\n * would refuse across sources (a driver package it cannot resolve for a custom\n * engine) is reported rather than missed by a view that only looked per row.\n */\nexport function computeStatus(\n    graph: ResourceGraph,\n    env: EnvBag,\n    resolvers: StatusResolvers\n): { resources: ResourceStatus[]; blocked?: string } {\n    const resources: ResourceStatus[] = [];\n    const production = resolvers.production ?? false;\n    const managed = resolvers.managedDatabase;\n    const docker = resolvers.dockerDatabase;\n    /** The default database's URL as the runtime gets it, when `.env` does not name one. */\n    const devDefaultUrl = managed?.url ?? docker?.url ?? null;\n    /** Database rows the managed database answered for, so `blocked` can skip them. */\n    let managedCovered = 0;\n\n    for (const { declaration, implicit } of withImplicitDefaults(graph)) {\n        const resolver = resolvers.resolverFor(declaration.kind);\n        const bindings = bindingsFor(declaration, env, resolver?.accountScoped ?? []);\n        const base: Omit<ResourceStatus, \"state\" | \"detail\"> = {\n            kind: declaration.kind,\n            key: declaration.key,\n            engine: declaration.engine,\n            transport: declaration.transport,\n            ...(typeof declaration.options.account === \"string\"\n                ? { account: declaration.options.account }\n                : {}),\n            implicit,\n            bindings,\n            ...(declaration.usedBy && declaration.usedBy.length > 0 ? { usedBy: declaration.usedBy } : {})\n        };\n\n        if (!resolver) {\n            resources.push({\n                ...base,\n                state: \"broken\",\n                detail: `this runtime has no resolver for a \"${declaration.kind}\" — boot refuses it by name. ` +\n                    \"Upgrade @rebasepro/server, or remove the declaration.\"\n            });\n            continue;\n        }\n\n        // Answered before the resolver, because the resolver reads the\n        // environment and the whole point of the managed database is that the\n        // environment is deliberately empty. Only for a database nobody bound:\n        // a developer who set `DATABASE_URL__ANALYTICS` to a warehouse of their\n        // own has said which database that is, and the managed one fills a\n        // vacuum, never a choice.\n        if (managed && declaration.kind === \"database\" && bindings.every(b => !b.set && !b.fallback?.set)) {\n            managedCovered += 1;\n            resources.push({\n                ...base,\n                state: \"ready\",\n                detail: managed.url\n                    ? \"the managed development database (PGlite), this project only\"\n                    : \"the managed development database (PGlite), this project only — \"\n                        + \"not running; start it with `rebase dev`\"\n            });\n            continue;\n        }\n\n        // The default database on Docker: the compose service, unless `.env`\n        // names one itself.\n        if (docker && declaration.kind === \"database\" && declaration.key === DEFAULT_RESOURCE_KEY\n            && bindings.every(b => !b.set && !b.fallback?.set)) {\n            resources.push({ ...base, state: \"ready\", detail: docker.detail });\n            continue;\n        }\n\n        const judged = declaration.kind === \"database\" ? withDefaultUrl(env, devDefaultUrl) : env;\n        const verdict = resolver.resolve(declaration, judged, { production, defaultBasePath: \"uploads\" });\n        switch (verdict.state) {\n            case \"ready\":\n                resources.push({\n                    ...base,\n                    state: \"ready\",\n                    ...(verdict.standsIn ? { standsIn: verdict.standsIn } : {}),\n                    detail: verdict.detail ?? \"\"\n                });\n                break;\n            case \"code\":\n                resources.push({ ...base, state: \"ready\", detail: verdict.detail ?? \"needs no environment configuration\" });\n                break;\n            case \"unbound\":\n                resources.push({ ...base, state: \"unconfigured\", detail: verdict.detail ?? \"declared, not configured\" });\n                break;\n            case \"blocked\":\n                resources.push({\n                    ...base,\n                    // A database the environment names nothing for is the\n                    // ordinary first-run state, and reads as unconfigured; a\n                    // binding that is set and set wrongly is broken.\n                    state: implicit || bindings.every(b => !b.set && !b.fallback?.set) ? \"unconfigured\" : \"broken\",\n                    detail: verdict.detail ?? \"boot refuses this binding\"\n                });\n                break;\n        }\n    }\n\n    // Only asked when every row already looks fine. Its failures overlap with\n    // the per-resource ones, and a banner repeating a line printed two rows\n    // above teaches nothing — what it is here for is the failure no row models,\n    // such as a custom engine whose driver package cannot be resolved.\n    let blocked: string | undefined;\n    // Not run when the managed database answered for a row and is not running:\n    // there is no connection string to check the set against, and inventing one\n    // to keep the check formally \"run\" is how a green tick gets printed for\n    // work nobody did. The row says the daemon is down; that is the finding.\n    const managedSetUnknown = managedCovered > 0 && !managed?.url;\n    if (resources.every(r => r.state === \"ready\") && !managedSetUnknown) {\n        try {\n            resolvers.resolveDataSources(\n                // The managed URL for the rows it answered for, so the whole-set\n                // check judges the same environment the runtime would get.\n                managed?.url ? withManagedUrls(env, graph, managed.url) : withDefaultUrl(env, docker?.url),\n                graph.resources.filter(r => r.kind === \"database\").map(resourceToDataSource)\n            );\n        } catch (err) {\n            blocked = err instanceof Error ? err.message : String(err);\n        }\n    }\n\n    return { resources, ...(blocked !== undefined ? { blocked } : {}) };\n}\n","/**\n * `rebase status` — what this project is, and whether it can reach its things.\n *\n * The model a developer has to hold is small and was nowhere visible:\n *\n *   rebase.json           where the code is, and who runs the server\n *   config/resources.ts   what the project needs\n *   the environment       how to reach each of them\n *\n * Everything else — `rebase.resources.json`, the bundle manifest — is a\n * generated copy of the middle one, for readers that cannot run the code. A\n * developer never writes them and should not have to think about them.\n *\n * This command prints the three together, resolved. It exists because the\n * question people actually arrive with — \"why does uploading to `media` answer\n * 501\" — was answerable only by knowing the `<BASE>__<KEY>` suffix rule,\n * deriving the variable name by hand, and checking it against a `.env` they had\n * to find first. Every step of that is mechanical, so it is printed instead.\n */\nimport chalk from \"chalk\";\nimport fs from \"fs\";\nimport path from \"path\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { failAsJson, readEnvFile, requireProjectRoot } from \"../utils/project\";\nimport { findBackendApp, loadManifest, ManifestError, resolveBackendPaths } from \"../manifest\";\nimport { deriveOptionsFor, deriveResourceGraph, RESOURCE_GRAPH_FILENAME, readResourceGraphFile, serializeResourceGraph } from \"../resources/derive\";\nimport { computeStatus, type DockerDatabaseStatus, type ManagedDatabaseStatus, type ResourceStatus } from \"../resources/status\";\nimport { findRunningDaemon, managedUrl } from \"../dev-db/daemon\";\nimport { type ResolvedBranch, resolveProjectDatabaseAndBranch } from \"../dev-db/prepare\";\nimport { describeTarget } from \"../dev-db/pull\";\nimport { parseLoopbackDsn, probeTcp } from \"../utils/dev-preflight\";\nimport type { RebaseBackendAppConfig } from \"@rebasepro/types\";\n\nfunction usage(): void {\n    console.log(`\n${chalk.bold(\"rebase status\")} — what this project declares, and whether it is configured\n\n${chalk.bold(\"Usage\")}\n  rebase status                Show every resource and the variables it reads\n  rebase status --json         The same, as JSON\n\n${chalk.bold(\"Reads\")}\n  rebase.json                  which apps exist, and who owns the server process\n  <config>/resources.ts        the databases, buckets, topics and queues declared\n  backend/crons, backend/functions   the crons and functions, by filename\n  .env                         whether each one's variables are set\n`);\n}\n\nconst MARK = {\n    ready: chalk.green(\"✓\"),\n    unconfigured: chalk.yellow(\"○\"),\n    broken: chalk.red(\"✗\")\n} as const;\n\nfunction printResource(status: ResourceStatus): void {\n    const name = status.key === \"(default)\" ? chalk.bold(\"(default)\") : chalk.bold(status.key);\n    const tags = [chalk.gray(status.engine)];\n    if (status.transport !== \"server\") tags.push(chalk.yellow(status.transport));\n    if (status.account) tags.push(chalk.gray(`account:${status.account}`));\n    if (status.implicit) tags.push(chalk.gray(\"implicit\"));\n    // A stand-in is not a binding. It is shown in yellow beside a green tick:\n    // uploads work here, and the same declaration answers 501 in production\n    // until the variable is set.\n    if (status.standsIn) tags.push(chalk.yellow(`local stand-in for ${status.standsIn}`));\n\n    console.log(`  ${MARK[status.state]} ${name}  ${tags.join(\" · \")}`);\n    if (status.usedBy && status.usedBy.length > 0) {\n        console.log(`      ${chalk.gray(\"used by\")} ${chalk.gray(status.usedBy.join(\", \"))}`);\n    }\n\n    let hiddenOptional = 0;\n    for (const binding of status.bindings) {\n        if (binding.set) {\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.name)}`);\n        } else if (binding.fallback?.set) {\n            // Not a gap: the account form is the variable this bucket is\n            // actually reading, and showing only the unset per-key name would\n            // send someone to set the one they were deliberately avoiding.\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.fallback.name)} ${chalk.gray(`(shared, for ${binding.name})`)}`);\n        } else if (status.state === \"ready\") {\n            // It resolved without this one, so this one is optional — which is\n            // the resolver's answer, not a second table of required names kept\n            // here. Listing seven unset optionals under a working database is\n            // how a status view teaches people to skim past the line that\n            // matters.\n            hiddenOptional += 1;\n        } else {\n            const also = binding.fallback ? chalk.gray(` or ${binding.fallback.name}`) : \"\";\n            console.log(`      ${chalk.gray(\"·\")} ${chalk.gray(binding.name)}${also} ${chalk.gray(\"not set\")}`);\n        }\n    }\n    if (hiddenOptional > 0) {\n        console.log(chalk.gray(`      ${hiddenOptional} optional variable${hiddenOptional === 1 ? \"\" : \"s\"} not set`));\n    }\n\n    if (status.detail) {\n        const colour = status.state === \"broken\" ? chalk.red : status.state === \"unconfigured\" ? chalk.yellow : chalk.gray;\n        console.log(`      ${colour(`└ ${status.detail}`)}`);\n    }\n}\n\n/** Which database `rebase status` reports the project on, and what it hands the status view about it. */\nexport interface StatusDatabase {\n    managedDatabase?: ManagedDatabaseStatus;\n    dockerDatabase?: DockerDatabaseStatus;\n    /** The branch this checkout is on, when the database is one. */\n    branch: ResolvedBranch | null;\n    /** A switched-to branch the managed database cannot serve. */\n    ignoredBranch: string | null;\n}\n\n/**\n * Which database this project is on, decided by the same ordered rule\n * `rebase dev` and `rebase db url` use — and read from the project's `.env`,\n * not from this shell: `rebase status` asks what *this project* is on.\n *\n * Nothing is started. `status` is a question, and a question that boots a\n * 180 MB Postgres to answer itself is a different command. So a managed\n * database that is not running is reported as exactly that, rather than as a\n * project with no database; and a compose database likewise, after a probe of\n * its port.\n *\n * `envFile` is the parsed `.env`; production stands nothing in, because there\n * an unset `DATABASE_URL` is the failure it has always been.\n *\n * Exported for its tests.\n */\nexport async function statusDatabase(projectRoot: string, envFile: Record<string, string>): Promise<StatusDatabase> {\n    const { database, branch, ignoredBranch } = resolveProjectDatabaseAndBranch(projectRoot, { env: {} });\n    if (envFile.NODE_ENV === \"production\") return { branch, ignoredBranch };\n\n    if (database.kind === \"managed\") {\n        const daemon = await findRunningDaemon(projectRoot);\n        return { managedDatabase: { url: daemon ? managedUrl(daemon.port) : null }, branch, ignoredBranch };\n    }\n\n    if (database.kind === \"docker\" && database.url) {\n        const target = parseLoopbackDsn(database.url);\n        const listening = target ? await probeTcp(target.host, target.port) : true;\n        const which = branch ? `branch \"${branch.name}\" (${branch.database}) of Postgres in Docker` : \"Postgres in Docker\";\n        return {\n            dockerDatabase: {\n                url: database.url,\n                detail: which + \", as the last `rebase dev --docker` did · \" + describeTarget(database.url)\n                    + (listening ? \"\" : \" — not running; `rebase dev --docker` starts it\")\n            },\n            branch,\n            ignoredBranch\n        };\n    }\n\n    return { branch, ignoredBranch };\n}\n\nexport async function statusCommand(rawArgs: string[]): Promise<void> {\n    if (wantsHelp(rawArgs)) return usage();\n\n    const { flags } = parseCommandArgs({\n        spec: { \"--json\": Boolean },\n        rawArgs,\n        commandWords: 1,\n        command: \"status\",\n        maxPositionals: 0\n    });\n\n    const projectRoot = requireProjectRoot();\n\n    // Every exit below has a `--json` arm, because `--json` means stdout holds\n    // one JSON object on *every* exit of the command. It used to mean that for\n    // the one failure `requireProjectRoot` owns and nothing else, so a caller\n    // parsing stdout got an envelope outside a project and an empty stream\n    // inside a broken one — the case it actually has to handle.\n    const asJson = Boolean(flags[\"--json\"]);\n\n    let backend: { name: string; app: RebaseBackendAppConfig };\n    try {\n        const loaded = loadManifest(projectRoot);\n        const found = findBackendApp(loaded.manifest);\n        if (!found) {\n            if (asJson) {\n                failAsJson(\n                    \"This project declares no backend app, so it declares no resources.\",\n                    \"no_backend_app\",\n                    \"Add a backend app to rebase.json, or run `rebase apps init`.\"\n                );\n            }\n            console.error(chalk.red(\"This project declares no backend app, so it declares no resources.\"));\n            process.exitCode = 1;\n            return;\n        }\n        backend = found;\n    } catch (err) {\n        if (err instanceof ManifestError) {\n            if (asJson) {\n                failAsJson(err.message, \"manifest_invalid\", \"Fix rebase.json, then run this again.\",\n                    err.issues.map(issue => ({ path: issue.path, message: issue.message })));\n            }\n            console.error(chalk.red(err.message));\n            for (const issue of err.issues) console.error(`  ${chalk.gray(issue.path)} ${issue.message}`);\n            process.exitCode = 1;\n            return;\n        }\n        throw err;\n    }\n\n    const { name: backendName, app: backendApp } = backend;\n    const paths = resolveBackendPaths(backendApp, projectRoot);\n\n    const { graph, issues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, backendApp));\n    if (issues.length > 0) {\n        if (asJson) {\n            failAsJson(\n                `${issues.length} problem(s) in the declared resources.`,\n                \"resource_declaration_invalid\",\n                \"Fix the declarations the issues name, then run this again.\",\n                issues.map(issue => ({ path: issue.path, message: issue.message }))\n            );\n        }\n        console.error(chalk.red(`\\n✗ ${issues.length} problem(s) in the declared resources:\\n`));\n        for (const issue of issues) console.error(`  ${chalk.bold(issue.path)}  ${issue.message}`);\n        console.error(\"\");\n        process.exitCode = 1;\n        return;\n    }\n\n    // The project's own `.env`, not this process's environment: `rebase status`\n    // is asking what a deployment of THIS repository would do, and the shell a\n    // developer happens to be standing in is not that.\n    const env = readEnvFile(projectRoot);\n\n    const production = env.NODE_ENV === \"production\";\n    const { managedDatabase, dockerDatabase, branch, ignoredBranch } = await statusDatabase(projectRoot, env);\n\n    const server = await import(\"@rebasepro/server\");\n    const { resources, blocked } = computeStatus(graph, env, {\n        resolverFor: server.resourceResolver as never,\n        resolveDataSources: server.resolveDataSources as never,\n        // Judged as production when the .env says so; a stand-in local\n        // directory for an unbound bucket is only ever offered to development.\n        production,\n        ...(managedDatabase ? { managedDatabase } : {}),\n        ...(dockerDatabase ? { dockerDatabase } : {})\n    });\n\n    if (asJson) {\n        console.log(JSON.stringify({\n            backend: backendName,\n            runtime: backendApp.runtime,\n            ...(branch ? { branch: { name: branch.name, database: branch.database } } : {}),\n            resources,\n            blocked\n        }, null, 2));\n        return;\n    }\n\n    const ownership = backendApp.runtime === \"managed\"\n        ? \"Rebase's runtime boots your bundle\"\n        : \"this project builds its own image and entrypoint\";\n\n    console.log(\"\");\n    console.log(`  ${chalk.bold(backendName)}  ${chalk.gray(\"·\")}  ${chalk.cyan(backendApp.runtime)}  ${chalk.gray(ownership)}`);\n    // Named whether or not it exists, and said plainly when it does not. A\n    // project with no `resources.ts` is legal — it has one default database and\n    // one default bucket — but \"declared in <a file you do not have>\" reads as\n    // a broken install rather than as the default it is.\n    const resourcesFile = path.join(paths.config, \"resources.ts\");\n    const declaresAnything = fs.existsSync(path.join(projectRoot, resourcesFile));\n    console.log(`  ${chalk.gray(\"declared in\")}  ${chalk.gray(resourcesFile)}${\n        declaresAnything ? \"\" : chalk.gray(\"  (none — the defaults below are implicit)\")}`);\n    console.log(`  ${chalk.gray(\"configured by\")}  ${chalk.gray(\".env\")}`);\n    // Every database command in this checkout uses the branch, so the view\n    // says so: a switch made yesterday is easy to forget.\n    if (branch) {\n        console.log(`  ${chalk.gray(\"on branch\")}  ${chalk.bold(branch.name)} ${chalk.gray(`(${branch.database})`)}`\n            + chalk.gray(` — ${chalk.cyan(\"rebase db branch switch --off\")} returns to ${branch.parent ?? \"the main database\"}`));\n    } else if (ignoredBranch) {\n        console.log(`  ${chalk.yellow(\"○\")} ${chalk.gray(`switched to branch \"${ignoredBranch}\", which the managed database cannot serve — it uses the main one`)}`);\n    }\n\n    const kinds = [...new Set(resources.map(r => r.kind))];\n    for (const kind of kinds) {\n        console.log(\"\");\n        console.log(`  ${chalk.bold.underline(`${kind}s`)}`);\n        for (const status of resources.filter(r => r.kind === kind)) printResource(status);\n    }\n\n    if (blocked) {\n        console.log(\"\");\n        console.log(`  ${chalk.red(\"✗\")} ${chalk.red(blocked)}`);\n    }\n\n    // Only worth a line when it is wrong. A generated file that matches its\n    // declarations is not news, and a status view that reports its own\n    // bookkeeping as an item trains people to skim past the items that matter.\n    //\n    // Nor is one that has not been written yet: `rebase build` writes it on\n    // every build and says \"commit it\" when it changes, so a project that has\n    // never been built — every fresh scaffold — has nothing wrong with it.\n    // `rebase resources --check` is the gate that refuses a missing one.\n    const committed = readResourceGraphFile(projectRoot);\n    if (committed !== null && committed !== serializeResourceGraph(graph)) {\n        console.log(\"\");\n        console.log(`  ${chalk.yellow(\"○\")} ${RESOURCE_GRAPH_FILENAME} is stale — ${chalk.blue(\"rebase resources --write\")}`);\n        console.log(chalk.gray(\"      a host reads it to decide what to provision before it runs anything\"));\n    }\n\n    console.log(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,SAAS,MAAM,KAAa,MAAuB;CAC/C,MAAM,QAAQ,IAAI;CAClB,OAAO,OAAO,UAAU,YAAY,UAAU;AAClD;;;;;;;;AASA,SAAgB,YACZ,aACA,KACA,oBACiB;CACjB,IAAI,YAAY,cAAc,UAAU,OAAO,CAAC;CAEhD,MAAM,SAAS,kBAAkB,YAAY,GAAG;CAChD,MAAM,UAAU,OAAO,YAAY,QAAQ,YAAY,WACjD,kBAAkB,YAAY,QAAQ,OAAO,IAC7C,KAAA;CAEN,OAAO,oBAAoB,WAAW,CAAC,CAAC,KAAK,SAAS;EAClD,MAAM,OAAO,GAAG,OAAO;EACvB,MAAM,UAA2B;GAAE;GAAM,KAAK,MAAM,KAAK,IAAI;EAAE;EAK/D,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,OAAO,mBAAmB,SAAS,IAAI,GACzE,QAAQ,WAAW;GAAE,MAAM,GAAG,OAAO;GAAW,KAAK,MAAM,KAAK,GAAG,OAAO,SAAS;EAAE;EAEzF,OAAO;CACX,CAAC;AACL;;;;;;;;;;;AAwFA,SAAS,gBAAgB,KAAa,OAAsB,KAAqB;CAC7E,MAAM,SAAiB,EAAE,GAAG,IAAI;CAChC,MAAM,OAAO,CACT,sBACA,GAAG,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,KAAI,MAAK,EAAE,GAAG,CACxE;CACA,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,OAAO,eAAe,kBAAkB,GAAG;EACjD,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO,QAAQ;CAC7C;CAEA,OAAO;AACX;;;;;;;;;;;AAYA,SAAS,eAAe,KAAa,KAAwC;CACzE,IAAI,CAAC,OAAO,MAAM,KAAK,cAAc,GAAG,OAAO;CAE/C,OAAO;EAAE,GAAG;EAAK,cAAc;CAAI;AACvC;;;;;;;;;;;;;;;AAgBA,SAAgB,cACZ,OACA,KACA,WACiD;CACjD,MAAM,YAA8B,CAAC;CACrC,MAAM,aAAa,UAAU,cAAc;CAC3C,MAAM,UAAU,UAAU;CAC1B,MAAM,SAAS,UAAU;;CAEzB,MAAM,gBAAgB,SAAS,OAAO,QAAQ,OAAO;;CAErD,IAAI,iBAAiB;CAErB,KAAK,MAAM,EAAE,aAAa,cAAc,qBAAqB,KAAK,GAAG;EACjE,MAAM,WAAW,UAAU,YAAY,YAAY,IAAI;EACvD,MAAM,WAAW,YAAY,aAAa,KAAK,UAAU,iBAAiB,CAAC,CAAC;EAC5E,MAAM,OAAiD;GACnD,MAAM,YAAY;GAClB,KAAK,YAAY;GACjB,QAAQ,YAAY;GACpB,WAAW,YAAY;GACvB,GAAI,OAAO,YAAY,QAAQ,YAAY,WACrC,EAAE,SAAS,YAAY,QAAQ,QAAQ,IACvC,CAAC;GACP;GACA;GACA,GAAI,YAAY,UAAU,YAAY,OAAO,SAAS,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;EAChG;EAEA,IAAI,CAAC,UAAU;GACX,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,uCAAuC,YAAY,KAAK;GAEpE,CAAC;GACD;EACJ;EAQA,IAAI,WAAW,YAAY,SAAS,cAAc,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GAC/F,kBAAkB;GAClB,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,QAAQ,MACV,iEACA;GAEV,CAAC;GACD;EACJ;EAIA,IAAI,UAAU,YAAY,SAAS,cAAc,YAAY,QAAQ,wBAC9D,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GACpD,UAAU,KAAK;IAAE,GAAG;IAAM,OAAO;IAAS,QAAQ,OAAO;GAAO,CAAC;GACjE;EACJ;EAEA,MAAM,SAAS,YAAY,SAAS,aAAa,eAAe,KAAK,aAAa,IAAI;EACtF,MAAM,UAAU,SAAS,QAAQ,aAAa,QAAQ;GAAE;GAAY,iBAAiB;EAAU,CAAC;EAChG,QAAQ,QAAQ,OAAhB;GACI,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KACH,OAAO;KACP,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;KACzD,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAS,QAAQ,QAAQ,UAAU;IAAqC,CAAC;IAC1G;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAgB,QAAQ,QAAQ,UAAU;IAA2B,CAAC;IACvG;GACJ,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KAIH,OAAO,YAAY,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,iBAAiB;KACtF,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;EACR;CACJ;CAMA,IAAI;CAKJ,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,SAAS;CAC1D,IAAI,UAAU,OAAM,MAAK,EAAE,UAAU,OAAO,KAAK,CAAC,mBAC9C,IAAI;EACA,UAAU,mBAGN,SAAS,MAAM,gBAAgB,KAAK,OAAO,QAAQ,GAAG,IAAI,eAAe,KAAK,QAAQ,GAAG,GACzF,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAC/E;CACJ,SAAS,KAAK;EACV,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC7D;CAGJ,OAAO;EAAE;EAAW,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;CAAG;AACtE;;;;;;;;;;;;;;;;;;;;;;ACpVA,SAAS,QAAc;CACnB,QAAQ,IAAI;EACd,MAAM,KAAK,eAAe,EAAE;;EAE5B,MAAM,KAAK,OAAO,EAAE;;;;EAIpB,MAAM,KAAK,OAAO,EAAE;;;;;CAKrB;AACD;AAEA,IAAM,OAAO;CACT,OAAO,MAAM,MAAM,GAAG;CACtB,cAAc,MAAM,OAAO,GAAG;CAC9B,QAAQ,MAAM,IAAI,GAAG;AACzB;AAEA,SAAS,cAAc,QAA8B;CACjD,MAAM,OAAO,OAAO,QAAQ,cAAc,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO,GAAG;CACzF,MAAM,OAAO,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;CACvC,IAAI,OAAO,cAAc,UAAU,KAAK,KAAK,MAAM,OAAO,OAAO,SAAS,CAAC;CAC3E,IAAI,OAAO,SAAS,KAAK,KAAK,MAAM,KAAK,WAAW,OAAO,SAAS,CAAC;CACrE,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC;CAIrD,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,OAAO,sBAAsB,OAAO,UAAU,CAAC;CAEpF,QAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,GAAG;CAClE,IAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GACxC,QAAQ,IAAI,SAAS,MAAM,KAAK,SAAS,EAAE,GAAG,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC,GAAG;CAGxF,IAAI,iBAAiB;CACrB,KAAK,MAAM,WAAW,OAAO,UACzB,IAAI,QAAQ,KACR,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,GAAG;MAChE,IAAI,QAAQ,UAAU,KAIzB,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,SAAS,IAAI,EAAE,GAAG,MAAM,KAAK,gBAAgB,QAAQ,KAAK,EAAE,GAAG;MACxH,IAAI,OAAO,UAAU,SAMxB,kBAAkB;MACf;EACH,MAAM,OAAO,QAAQ,WAAW,MAAM,KAAK,OAAO,QAAQ,SAAS,MAAM,IAAI;EAC7E,QAAQ,IAAI,SAAS,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,MAAM,KAAK,SAAS,GAAG;CACtG;CAEJ,IAAI,iBAAiB,GACjB,QAAQ,IAAI,MAAM,KAAK,SAAS,eAAe,oBAAoB,mBAAmB,IAAI,KAAK,IAAI,SAAS,CAAC;CAGjH,IAAI,OAAO,QAAQ;EACf,MAAM,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,OAAO,UAAU,iBAAiB,MAAM,SAAS,MAAM;EAC9G,QAAQ,IAAI,SAAS,OAAO,KAAK,OAAO,QAAQ,GAAG;CACvD;AACJ;;;;;;;;;;;;;;;;;AA4BA,eAAsB,eAAe,aAAqB,SAA0D;CAChH,MAAM,EAAE,UAAU,QAAQ,kBAAkB,gCAAgC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;CACpG,IAAI,QAAQ,aAAa,cAAc,OAAO;EAAE;EAAQ;CAAc;CAEtE,IAAI,SAAS,SAAS,WAAW;EAC7B,MAAM,SAAS,MAAM,kBAAkB,WAAW;EAClD,OAAO;GAAE,iBAAiB,EAAE,KAAK,SAAS,WAAW,OAAO,IAAI,IAAI,KAAK;GAAG;GAAQ;EAAc;CACtG;CAEA,IAAI,SAAS,SAAS,YAAY,SAAS,KAAK;EAC5C,MAAM,SAAS,iBAAiB,SAAS,GAAG;EAC5C,MAAM,YAAY,SAAS,MAAM,SAAS,OAAO,MAAM,OAAO,IAAI,IAAI;EACtE,MAAM,QAAQ,SAAS,WAAW,OAAO,KAAK,KAAK,OAAO,SAAS,2BAA2B;EAC9F,OAAO;GACH,gBAAgB;IACZ,KAAK,SAAS;IACd,QAAQ,QAAQ,+CAA+C,eAAe,SAAS,GAAG,KACnF,YAAY,KAAK;GAC5B;GACA;GACA;EACJ;CACJ;CAEA,OAAO;EAAE;EAAQ;CAAc;AACnC;AAEA,eAAsB,cAAc,SAAkC;CAClE,IAAI,UAAU,OAAO,GAAG,OAAO,MAAM;CAErC,MAAM,EAAE,UAAU,iBAAiB;EAC/B,MAAM,EAAE,UAAU,QAAQ;EAC1B;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,cAAc,mBAAmB;CAOvC,MAAM,SAAS,QAAQ,MAAM,SAAS;CAEtC,IAAI;CACJ,IAAI;EAEA,MAAM,QAAQ,eADC,aAAa,WACC,CAAA,CAAO,QAAQ;EAC5C,IAAI,CAAC,OAAO;GACR,IAAI,QACA,WACI,sEACA,kBACA,8DACJ;GAEJ,QAAQ,MAAM,MAAM,IAAI,oEAAoE,CAAC;GAC7F,QAAQ,WAAW;GACnB;EACJ;EACA,UAAU;CACd,SAAS,KAAK;EACV,IAAI,eAAe,eAAe;GAC9B,IAAI,QACA,WAAW,IAAI,SAAS,oBAAoB,yCACxC,IAAI,OAAO,KAAI,WAAU;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,EAAE,CAAC;GAE/E,QAAQ,MAAM,MAAM,IAAI,IAAI,OAAO,CAAC;GACpC,KAAK,MAAM,SAAS,IAAI,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,GAAG,MAAM,SAAS;GAC5F,QAAQ,WAAW;GACnB;EACJ;EACA,MAAM;CACV;CAEA,MAAM,EAAE,MAAM,aAAa,KAAK,eAAe;CAC/C,MAAM,QAAQ,oBAAoB,YAAY,WAAW;CAEzD,MAAM,EAAE,OAAO,WAAW,MAAM,oBAAoB,iBAAiB,aAAa,UAAU,CAAC;CAC7F,IAAI,OAAO,SAAS,GAAG;EACnB,IAAI,QACA,WACI,GAAG,OAAO,OAAO,yCACjB,gCACA,8DACA,OAAO,KAAI,WAAU;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ,EAAE,CACtE;EAEJ,QAAQ,MAAM,MAAM,IAAI,OAAO,OAAO,OAAO,yCAAyC,CAAC;EACvF,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,SAAS;EACzF,QAAQ,MAAM,EAAE;EAChB,QAAQ,WAAW;EACnB;CACJ;CAKA,MAAM,MAAM,YAAY,WAAW;CAEnC,MAAM,aAAa,IAAI,aAAa;CACpC,MAAM,EAAE,iBAAiB,gBAAgB,QAAQ,kBAAkB,MAAM,eAAe,aAAa,GAAG;CAExG,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,EAAE,WAAW,YAAY,cAAc,OAAO,KAAK;EACrD,aAAa,OAAO;EACpB,oBAAoB,OAAO;EAG3B;EACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC7C,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;CAC/C,CAAC;CAED,IAAI,QAAQ;EACR,QAAQ,IAAI,KAAK,UAAU;GACvB,SAAS;GACT,SAAS,WAAW;GACpB,GAAI,SAAS,EAAE,QAAQ;IAAE,MAAM,OAAO;IAAM,UAAU,OAAO;GAAS,EAAE,IAAI,CAAC;GAC7E;GACA;EACJ,GAAG,MAAM,CAAC,CAAC;EACX;CACJ;CAEA,MAAM,YAAY,WAAW,YAAY,YACnC,uCACA;CAEN,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,IAAI,MAAM,KAAK,WAAW,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,GAAG;CAK3H,MAAM,gBAAgB,KAAK,KAAK,MAAM,QAAQ,cAAc;CAC5D,MAAM,mBAAmB,GAAG,WAAW,KAAK,KAAK,aAAa,aAAa,CAAC;CAC5E,QAAQ,IAAI,KAAK,MAAM,KAAK,aAAa,EAAE,IAAI,MAAM,KAAK,aAAa,IACnE,mBAAmB,KAAK,MAAM,KAAK,4CAA4C,GAAG;CACtF,QAAQ,IAAI,KAAK,MAAM,KAAK,eAAe,EAAE,IAAI,MAAM,KAAK,MAAM,GAAG;CAGrE,IAAI,QACA,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,MACnG,MAAM,KAAK,MAAM,MAAM,KAAK,+BAA+B,EAAE,cAAc,OAAO,UAAU,qBAAqB,CAAC;MACrH,IAAI,eACP,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,uBAAuB,cAAc,kEAAkE,GAAG;CAG/J,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,UAAU,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC;CACrD,KAAK,MAAM,QAAQ,OAAO;EACtB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,EAAE,GAAG;EACnD,KAAK,MAAM,UAAU,UAAU,QAAO,MAAK,EAAE,SAAS,IAAI,GAAG,cAAc,MAAM;CACrF;CAEA,IAAI,SAAS;EACT,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,GAAG;CAC3D;CAUA,MAAM,YAAY,sBAAsB,WAAW;CACnD,IAAI,cAAc,QAAQ,cAAc,uBAAuB,KAAK,GAAG;EACnE,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,wBAAwB,cAAc,MAAM,KAAK,0BAA0B,GAAG;EACpH,QAAQ,IAAI,MAAM,KAAK,2EAA2E,CAAC;CACvG;CAEA,QAAQ,IAAI,EAAE;AAClB"}
+{"version":3,"file":"status-BREvtzJm.js","names":[],"sources":["../src/resources/status.ts","../src/commands/status.ts"],"sourcesContent":["/**\n * What a project declared, what the environment binds it to, and whether the\n * two meet.\n *\n * ## Why this exists\n *\n * Every piece of this was already knowable and none of it was visible in one\n * place. `rebase resources` lists what you declared. The environment holds the\n * variables. The resolvers decide whether a source is usable. So the question a\n * developer actually has — *\"why does uploading to `media` answer 501\"* — could\n * only be answered by knowing the suffix rule, deriving the variable name by\n * hand, and checking it against a `.env` they had to find first.\n *\n * The answer is mechanical, so it should be printed rather than taught.\n *\n * ## Why it calls the resolvers instead of re-deciding\n *\n * The verdict comes from `resolveDataSources` and `resolveStorageBackend` — the\n * same functions that run at boot. A status view that decided for itself what\n * \"configured\" means would be a second implementation of the rule, and the\n * first time it disagreed it would be reassuring a developer about a deployment\n * that is about to refuse to start.\n *\n * The variable *names* come from each kind's `envBases`, and the verdicts from\n * the resolver `@rebasepro/server` registers per kind — one object per kind,\n * held to `envBases` by `resource-env-bases.test.ts`. A kind this view has\n * never heard of is judged by whatever resolver its package registered.\n */\nimport { withImplicitDefaults } from \"./derive\";\nimport {\n    DEFAULT_RESOURCE_KEY,\n    envBasesForResource,\n    resourceEnvSuffix,\n    resourceToDataSource,\n    type ResourceDeclaration,\n    type ResourceGraph\n} from \"@rebasepro/types\";\n\n/** One environment variable a resource reads, and whether it is there. */\nexport interface ResourceBinding {\n    /** The variable this resource reads, suffix included. */\n    name: string;\n    set: boolean;\n    /**\n     * The account-scoped name consulted when `name` is unset.\n     *\n     * Only provider-level bindings have one, and only when the resource named\n     * an `account`. Shown because a developer looking at an unset\n     * `S3_ACCESS_KEY_ID__MEDIA` needs to know it is not the whole story.\n     */\n    fallback?: { name: string; set: boolean };\n}\n\n/** Whether a declared resource can actually be reached. */\nexport type ResourceState =\n    /** Bound and usable. */\n    | \"ready\"\n    /** Nothing set for it. Legal for a bucket, fatal for a database. */\n    | \"unconfigured\"\n    /** Set, and set wrongly. The deployment refuses to start. */\n    | \"broken\";\n\nexport interface ResourceStatus {\n    kind: string;\n    key: string;\n    engine: string;\n    transport: string;\n    /** Present when this resource shares another's credentials. */\n    account?: string;\n    /** True for a resource nobody declared, which exists anyway. */\n    implicit: boolean;\n    bindings: ResourceBinding[];\n    state: ResourceState;\n    /** What this means, in the terms the developer will meet it in. */\n    detail: string;\n    /** Set when a local directory stands in for this engine, in development. */\n    standsIn?: string;\n    /** What in the project reaches this resource, from the graph. */\n    usedBy?: readonly string[];\n}\n\nexport type EnvBag = Record<string, string | undefined>;\n\n/** Set, and not set to the empty string — which the resolvers treat as absent. */\nfunction isSet(env: EnvBag, name: string): boolean {\n    const value = env[name];\n    return typeof value === \"string\" && value !== \"\";\n}\n\n/**\n * The bindings one declaration reads, in the order a reader should scan them.\n *\n * A `direct`-transport resource gets none: the browser reaches it with a\n * provider SDK and the backend binds nothing for it, so listing variables would\n * invite someone to set variables that are never read.\n */\nexport function bindingsFor(\n    declaration: ResourceDeclaration,\n    env: EnvBag,\n    accountScopedBases: readonly string[]\n): ResourceBinding[] {\n    if (declaration.transport !== \"server\") return [];\n\n    const suffix = resourceEnvSuffix(declaration.key);\n    const account = typeof declaration.options.account === \"string\"\n        ? resourceEnvSuffix(declaration.options.account)\n        : undefined;\n\n    return envBasesForResource(declaration).map((base) => {\n        const name = `${base}${suffix}`;\n        const binding: ResourceBinding = { name, set: isSet(env, name) };\n\n        // Only the provider-level bindings fall back, and only for a resource\n        // that named an account. The bucket name never does — it is what\n        // distinguishes one source from another.\n        if (account !== undefined && !binding.set && accountScopedBases.includes(base)) {\n            binding.fallback = { name: `${base}${account}`, set: isSet(env, `${base}${account}`) };\n        }\n        return binding;\n    });\n}\n\n/**\n * What the managed development database covers, when a project is on it.\n *\n * `rebase init` leaves `DATABASE_URL` commented out on purpose and the managed\n * PGlite fills the vacuum — the documented first-run state. Judging that state\n * by the environment alone produced `○ (default) postgres · DATABASE_URL not\n * set` and the remedy \"set DATABASE_URL\", at the same moment `rebase db url`\n * was printing a working connection string for the same project and\n * `rebase dev` was serving from it. The status view was reading the one place\n * the answer deliberately is not.\n *\n * Resolved by the caller, because deciding it needs the project's `.env`, its\n * branch pointer and its compose file, and this module stays free of all three.\n */\nexport interface ManagedDatabaseStatus {\n    /**\n     * The daemon's connection string, or null when it is not running.\n     *\n     * Null is not an error: the managed database exists per project and starts\n     * on demand. It only means there is nothing to run the whole-set check\n     * against, and the row says so rather than implying a misconfiguration.\n     */\n    url: string | null;\n}\n\n/**\n * The compose `db` service, when a project is on Postgres in Docker.\n *\n * `rebase dev --docker` is remembered, and every command follows it with the\n * scaffold's `DATABASE_URL` still commented out — so, judged by `.env` alone,\n * this view said the default database had no connection string while `rebase\n * dev --docker` served the project from it. Unlike the managed database it\n * stands in for the default only: `dev --docker` hands the backend\n * `DATABASE_URL` and nothing else, so a second declared database still needs\n * its own variable.\n */\nexport interface DockerDatabaseStatus {\n    /** The compose service's connection string, which the runtime is given as `DATABASE_URL`. */\n    url: string;\n    /** What the default database's row says it is. */\n    detail: string;\n}\n\n/**\n * The resolver-side of status, as `@rebasepro/server` registers it per kind.\n *\n * Passed in rather than imported so this module stays testable without a\n * server, and so a kind registered by a plugin is judged by the resolver the\n * plugin brought with it rather than by a switch here.\n */\nexport interface StatusResolvers {\n    /** `resourceResolver(kind)` from `@rebasepro/server`. */\n    resolverFor: (kind: string) => {\n        accountScoped?: readonly string[];\n        resolve: (\n            declaration: ResourceDeclaration,\n            env: EnvBag,\n            context: { production: boolean; defaultBasePath: string }\n        ) => { state: \"ready\" | \"unbound\" | \"blocked\" | \"code\"; detail?: string; standsIn?: string };\n    } | undefined;\n    /** `resolveDataSources` from `@rebasepro/server`, for the whole-set check. */\n    resolveDataSources: (env: EnvBag, definitions: unknown) => unknown;\n    /** Whether the process being judged is production. Status judges for development by default. */\n    production?: boolean;\n    /**\n     * Set when this project runs on the managed development database.\n     *\n     * Absent for a project that named its own connection string, and absent in\n     * production — where an unset `DATABASE_URL` is the failure it has always\n     * been.\n     */\n    managedDatabase?: ManagedDatabaseStatus;\n    /** Set when this project runs on Postgres in Docker. Absent in production, like the managed one. */\n    dockerDatabase?: DockerDatabaseStatus;\n}\n\n/**\n * The environment plus the managed database's URL, for the whole-set check.\n *\n * A copy: the bindings a reader sees are computed against the real `.env`, so\n * nothing here can make the view claim a variable is set that is not. This is\n * only what `resolveDataSources` is handed, and it is handed it so the check\n * judges the environment the runtime would actually get rather than throwing\n * \"Data source \"(default)\" has no connection string\" about a database that is\n * running and reachable.\n */\nfunction withManagedUrls(env: EnvBag, graph: ResourceGraph, url: string): EnvBag {\n    const filled: EnvBag = { ...env };\n    const keys = [\n        DEFAULT_RESOURCE_KEY,\n        ...graph.resources.filter(r => r.kind === \"database\").map(r => r.key)\n    ];\n    for (const key of keys) {\n        const name = `DATABASE_URL${resourceEnvSuffix(key)}`;\n        if (!isSet(filled, name)) filled[name] = url;\n    }\n\n    return filled;\n}\n\n/**\n * The environment with the default database's URL filled in, when `.env` leaves it out.\n *\n * What a database's resolver is judged against. The resolver checks a source\n * alongside the default one, so a second database bound by its own\n * `DATABASE_URL__ANALYTICS` was marked ✗ with `Data source \"(default)\" has no\n * connection string` — on a project whose default the managed database or the\n * compose service provides, and whose boot worked. Judged against the\n * environment the runtime actually gets, it is judged on its own string.\n */\nfunction withDefaultUrl(env: EnvBag, url: string | null | undefined): EnvBag {\n    if (!url || isSet(env, \"DATABASE_URL\")) return env;\n\n    return { ...env, DATABASE_URL: url };\n}\n\n/**\n * Resolve every declared resource against an environment.\n *\n * Each kind's verdict comes from the resolver `@rebasepro/server` registered\n * for it — the same one boot calls — so this view cannot say \"ready\" about a\n * binding boot would refuse. A kind with no resolver is reported as such\n * rather than skipped: a resource nobody shows is one nobody remembers to\n * configure, and a kind this runtime cannot bind is exactly what boot will\n * refuse by name.\n *\n * `resolveDataSources` is then run once over the whole set, so anything it\n * would refuse across sources (a driver package it cannot resolve for a custom\n * engine) is reported rather than missed by a view that only looked per row.\n */\nexport function computeStatus(\n    graph: ResourceGraph,\n    env: EnvBag,\n    resolvers: StatusResolvers\n): { resources: ResourceStatus[]; blocked?: string } {\n    const resources: ResourceStatus[] = [];\n    const production = resolvers.production ?? false;\n    const managed = resolvers.managedDatabase;\n    const docker = resolvers.dockerDatabase;\n    /** The default database's URL as the runtime gets it, when `.env` does not name one. */\n    const devDefaultUrl = managed?.url ?? docker?.url ?? null;\n    /** Database rows the managed database answered for, so `blocked` can skip them. */\n    let managedCovered = 0;\n\n    for (const { declaration, implicit } of withImplicitDefaults(graph)) {\n        const resolver = resolvers.resolverFor(declaration.kind);\n        const bindings = bindingsFor(declaration, env, resolver?.accountScoped ?? []);\n        const base: Omit<ResourceStatus, \"state\" | \"detail\"> = {\n            kind: declaration.kind,\n            key: declaration.key,\n            engine: declaration.engine,\n            transport: declaration.transport,\n            ...(typeof declaration.options.account === \"string\"\n                ? { account: declaration.options.account }\n                : {}),\n            implicit,\n            bindings,\n            ...(declaration.usedBy && declaration.usedBy.length > 0 ? { usedBy: declaration.usedBy } : {})\n        };\n\n        if (!resolver) {\n            resources.push({\n                ...base,\n                state: \"broken\",\n                detail: `this runtime has no resolver for a \"${declaration.kind}\" — boot refuses it by name. ` +\n                    \"Upgrade @rebasepro/server, or remove the declaration.\"\n            });\n            continue;\n        }\n\n        // Answered before the resolver, because the resolver reads the\n        // environment and the whole point of the managed database is that the\n        // environment is deliberately empty. Only for a database nobody bound:\n        // a developer who set `DATABASE_URL__ANALYTICS` to a warehouse of their\n        // own has said which database that is, and the managed one fills a\n        // vacuum, never a choice.\n        if (managed && declaration.kind === \"database\" && bindings.every(b => !b.set && !b.fallback?.set)) {\n            managedCovered += 1;\n            resources.push({\n                ...base,\n                state: \"ready\",\n                detail: managed.url\n                    ? \"the managed development database (PGlite), this project only\"\n                    : \"the managed development database (PGlite), this project only — \"\n                        + \"not running; start it with `rebase dev`\"\n            });\n            continue;\n        }\n\n        // The default database on Docker: the compose service, unless `.env`\n        // names one itself.\n        if (docker && declaration.kind === \"database\" && declaration.key === DEFAULT_RESOURCE_KEY\n            && bindings.every(b => !b.set && !b.fallback?.set)) {\n            resources.push({ ...base, state: \"ready\", detail: docker.detail });\n            continue;\n        }\n\n        const judged = declaration.kind === \"database\" ? withDefaultUrl(env, devDefaultUrl) : env;\n        const verdict = resolver.resolve(declaration, judged, { production, defaultBasePath: \"uploads\" });\n        switch (verdict.state) {\n            case \"ready\":\n                resources.push({\n                    ...base,\n                    state: \"ready\",\n                    ...(verdict.standsIn ? { standsIn: verdict.standsIn } : {}),\n                    detail: verdict.detail ?? \"\"\n                });\n                break;\n            case \"code\":\n                resources.push({ ...base, state: \"ready\", detail: verdict.detail ?? \"needs no environment configuration\" });\n                break;\n            case \"unbound\":\n                resources.push({ ...base, state: \"unconfigured\", detail: verdict.detail ?? \"declared, not configured\" });\n                break;\n            case \"blocked\":\n                resources.push({\n                    ...base,\n                    // A database the environment names nothing for is the\n                    // ordinary first-run state, and reads as unconfigured; a\n                    // binding that is set and set wrongly is broken.\n                    state: implicit || bindings.every(b => !b.set && !b.fallback?.set) ? \"unconfigured\" : \"broken\",\n                    detail: verdict.detail ?? \"boot refuses this binding\"\n                });\n                break;\n        }\n    }\n\n    // Only asked when every row already looks fine. Its failures overlap with\n    // the per-resource ones, and a banner repeating a line printed two rows\n    // above teaches nothing — what it is here for is the failure no row models,\n    // such as a custom engine whose driver package cannot be resolved.\n    let blocked: string | undefined;\n    // Not run when the managed database answered for a row and is not running:\n    // there is no connection string to check the set against, and inventing one\n    // to keep the check formally \"run\" is how a green tick gets printed for\n    // work nobody did. The row says the daemon is down; that is the finding.\n    const managedSetUnknown = managedCovered > 0 && !managed?.url;\n    if (resources.every(r => r.state === \"ready\") && !managedSetUnknown) {\n        try {\n            resolvers.resolveDataSources(\n                // The managed URL for the rows it answered for, so the whole-set\n                // check judges the same environment the runtime would get.\n                managed?.url ? withManagedUrls(env, graph, managed.url) : withDefaultUrl(env, docker?.url),\n                graph.resources.filter(r => r.kind === \"database\").map(resourceToDataSource)\n            );\n        } catch (err) {\n            blocked = err instanceof Error ? err.message : String(err);\n        }\n    }\n\n    return { resources, ...(blocked !== undefined ? { blocked } : {}) };\n}\n","/**\n * `rebase status` — what this project is, and whether it can reach its things.\n *\n * The model a developer has to hold is small and was nowhere visible:\n *\n *   rebase.json           where the code is, and who runs the server\n *   config/resources.ts   what the project needs\n *   the environment       how to reach each of them\n *\n * Everything else — `rebase.resources.json`, the bundle manifest — is a\n * generated copy of the middle one, for readers that cannot run the code. A\n * developer never writes them and should not have to think about them.\n *\n * This command prints the three together, resolved. It exists because the\n * question people actually arrive with — \"why does uploading to `media` answer\n * 501\" — was answerable only by knowing the `<BASE>__<KEY>` suffix rule,\n * deriving the variable name by hand, and checking it against a `.env` they had\n * to find first. Every step of that is mechanical, so it is printed instead.\n */\nimport chalk from \"chalk\";\nimport fs from \"fs\";\nimport path from \"path\";\nimport { parseCommandArgs, wantsHelp } from \"../utils/args\";\nimport { failAsJson, readEnvFile, requireProjectRoot } from \"../utils/project\";\nimport { findBackendApp, loadManifest, ManifestError, resolveBackendPaths } from \"../manifest\";\nimport { deriveOptionsFor, deriveResourceGraph, RESOURCE_GRAPH_FILENAME, readResourceGraphFile, serializeResourceGraph } from \"../resources/derive\";\nimport { computeStatus, type DockerDatabaseStatus, type ManagedDatabaseStatus, type ResourceStatus } from \"../resources/status\";\nimport { findRunningDaemon, managedUrl } from \"../dev-db/daemon\";\nimport { type ResolvedBranch, resolveProjectDatabaseAndBranch } from \"../dev-db/prepare\";\nimport { describeTarget } from \"../dev-db/pull\";\nimport { parseLoopbackDsn, probeTcp } from \"../utils/dev-preflight\";\nimport type { RebaseBackendAppConfig } from \"@rebasepro/types\";\n\nfunction usage(): void {\n    console.log(`\n${chalk.bold(\"rebase status\")} — what this project declares, and whether it is configured\n\n${chalk.bold(\"Usage\")}\n  rebase status                Show every resource and the variables it reads\n  rebase status --json         The same, as JSON\n\n${chalk.bold(\"Reads\")}\n  rebase.json                  which apps exist, and who owns the server process\n  <config>/resources.ts        the databases, buckets, topics and queues declared\n  backend/crons, backend/functions   the crons and functions, by filename\n  .env                         whether each one's variables are set\n`);\n}\n\nconst MARK = {\n    ready: chalk.green(\"✓\"),\n    unconfigured: chalk.yellow(\"○\"),\n    broken: chalk.red(\"✗\")\n} as const;\n\nfunction printResource(status: ResourceStatus): void {\n    const name = status.key === \"(default)\" ? chalk.bold(\"(default)\") : chalk.bold(status.key);\n    const tags = [chalk.gray(status.engine)];\n    if (status.transport !== \"server\") tags.push(chalk.yellow(status.transport));\n    if (status.account) tags.push(chalk.gray(`account:${status.account}`));\n    if (status.implicit) tags.push(chalk.gray(\"implicit\"));\n    // A stand-in is not a binding. It is shown in yellow beside a green tick:\n    // uploads work here, and the same declaration answers 501 in production\n    // until the variable is set.\n    if (status.standsIn) tags.push(chalk.yellow(`local stand-in for ${status.standsIn}`));\n\n    console.log(`  ${MARK[status.state]} ${name}  ${tags.join(\" · \")}`);\n    if (status.usedBy && status.usedBy.length > 0) {\n        console.log(`      ${chalk.gray(\"used by\")} ${chalk.gray(status.usedBy.join(\", \"))}`);\n    }\n\n    let hiddenOptional = 0;\n    for (const binding of status.bindings) {\n        if (binding.set) {\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.name)}`);\n        } else if (binding.fallback?.set) {\n            // Not a gap: the account form is the variable this bucket is\n            // actually reading, and showing only the unset per-key name would\n            // send someone to set the one they were deliberately avoiding.\n            console.log(`      ${chalk.green(\"✓\")} ${chalk.gray(binding.fallback.name)} ${chalk.gray(`(shared, for ${binding.name})`)}`);\n        } else if (status.state === \"ready\") {\n            // It resolved without this one, so this one is optional — which is\n            // the resolver's answer, not a second table of required names kept\n            // here. Listing seven unset optionals under a working database is\n            // how a status view teaches people to skim past the line that\n            // matters.\n            hiddenOptional += 1;\n        } else {\n            const also = binding.fallback ? chalk.gray(` or ${binding.fallback.name}`) : \"\";\n            console.log(`      ${chalk.gray(\"·\")} ${chalk.gray(binding.name)}${also} ${chalk.gray(\"not set\")}`);\n        }\n    }\n    if (hiddenOptional > 0) {\n        console.log(chalk.gray(`      ${hiddenOptional} optional variable${hiddenOptional === 1 ? \"\" : \"s\"} not set`));\n    }\n\n    if (status.detail) {\n        const colour = status.state === \"broken\" ? chalk.red : status.state === \"unconfigured\" ? chalk.yellow : chalk.gray;\n        console.log(`      ${colour(`└ ${status.detail}`)}`);\n    }\n}\n\n/** Which database `rebase status` reports the project on, and what it hands the status view about it. */\nexport interface StatusDatabase {\n    managedDatabase?: ManagedDatabaseStatus;\n    dockerDatabase?: DockerDatabaseStatus;\n    /** The branch this checkout is on, when the database is one. */\n    branch: ResolvedBranch | null;\n    /** A switched-to branch the managed database cannot serve. */\n    ignoredBranch: string | null;\n}\n\n/**\n * Which database this project is on, decided by the same ordered rule\n * `rebase dev` and `rebase db url` use — and read from the project's `.env`,\n * not from this shell: `rebase status` asks what *this project* is on.\n *\n * Nothing is started. `status` is a question, and a question that boots a\n * 180 MB Postgres to answer itself is a different command. So a managed\n * database that is not running is reported as exactly that, rather than as a\n * project with no database; and a compose database likewise, after a probe of\n * its port.\n *\n * `envFile` is the parsed `.env`; production stands nothing in, because there\n * an unset `DATABASE_URL` is the failure it has always been.\n *\n * Exported for its tests.\n */\nexport async function statusDatabase(projectRoot: string, envFile: Record<string, string>): Promise<StatusDatabase> {\n    const { database, branch, ignoredBranch } = resolveProjectDatabaseAndBranch(projectRoot, { env: {} });\n    if (envFile.NODE_ENV === \"production\") return { branch, ignoredBranch };\n\n    if (database.kind === \"managed\") {\n        const daemon = await findRunningDaemon(projectRoot);\n        return { managedDatabase: { url: daemon ? managedUrl(daemon.port) : null }, branch, ignoredBranch };\n    }\n\n    if (database.kind === \"docker\" && database.url) {\n        const target = parseLoopbackDsn(database.url);\n        const listening = target ? await probeTcp(target.host, target.port) : true;\n        const which = branch ? `branch \"${branch.name}\" (${branch.database}) of Postgres in Docker` : \"Postgres in Docker\";\n        return {\n            dockerDatabase: {\n                url: database.url,\n                detail: which + \", as the last `rebase dev --docker` did · \" + describeTarget(database.url)\n                    + (listening ? \"\" : \" — not running; `rebase dev --docker` starts it\")\n            },\n            branch,\n            ignoredBranch\n        };\n    }\n\n    return { branch, ignoredBranch };\n}\n\nexport async function statusCommand(rawArgs: string[]): Promise<void> {\n    if (wantsHelp(rawArgs)) return usage();\n\n    const { flags } = parseCommandArgs({\n        spec: { \"--json\": Boolean },\n        rawArgs,\n        commandWords: 1,\n        command: \"status\",\n        maxPositionals: 0\n    });\n\n    const projectRoot = requireProjectRoot();\n\n    // Every exit below has a `--json` arm, because `--json` means stdout holds\n    // one JSON object on *every* exit of the command. It used to mean that for\n    // the one failure `requireProjectRoot` owns and nothing else, so a caller\n    // parsing stdout got an envelope outside a project and an empty stream\n    // inside a broken one — the case it actually has to handle.\n    const asJson = Boolean(flags[\"--json\"]);\n\n    let backend: { name: string; app: RebaseBackendAppConfig };\n    try {\n        const loaded = loadManifest(projectRoot);\n        const found = findBackendApp(loaded.manifest);\n        if (!found) {\n            if (asJson) {\n                failAsJson(\n                    \"This project declares no backend app, so it declares no resources.\",\n                    \"no_backend_app\",\n                    \"Add a backend app to rebase.json, or run `rebase apps init`.\"\n                );\n            }\n            console.error(chalk.red(\"This project declares no backend app, so it declares no resources.\"));\n            process.exitCode = 1;\n            return;\n        }\n        backend = found;\n    } catch (err) {\n        if (err instanceof ManifestError) {\n            if (asJson) {\n                failAsJson(err.message, \"manifest_invalid\", \"Fix rebase.json, then run this again.\",\n                    err.issues.map(issue => ({ path: issue.path, message: issue.message })));\n            }\n            console.error(chalk.red(err.message));\n            for (const issue of err.issues) console.error(`  ${chalk.gray(issue.path)} ${issue.message}`);\n            process.exitCode = 1;\n            return;\n        }\n        throw err;\n    }\n\n    const { name: backendName, app: backendApp } = backend;\n    const paths = resolveBackendPaths(backendApp, projectRoot);\n\n    const { graph, issues } = await deriveResourceGraph(deriveOptionsFor(projectRoot, backendApp));\n    if (issues.length > 0) {\n        if (asJson) {\n            failAsJson(\n                `${issues.length} problem(s) in the declared resources.`,\n                \"resource_declaration_invalid\",\n                \"Fix the declarations the issues name, then run this again.\",\n                issues.map(issue => ({ path: issue.path, message: issue.message }))\n            );\n        }\n        console.error(chalk.red(`\\n✗ ${issues.length} problem(s) in the declared resources:\\n`));\n        for (const issue of issues) console.error(`  ${chalk.bold(issue.path)}  ${issue.message}`);\n        console.error(\"\");\n        process.exitCode = 1;\n        return;\n    }\n\n    // The project's own `.env`, not this process's environment: `rebase status`\n    // is asking what a deployment of THIS repository would do, and the shell a\n    // developer happens to be standing in is not that.\n    const env = readEnvFile(projectRoot);\n\n    const production = env.NODE_ENV === \"production\";\n    const { managedDatabase, dockerDatabase, branch, ignoredBranch } = await statusDatabase(projectRoot, env);\n\n    const server = await import(\"@rebasepro/server\");\n    const { resources, blocked } = computeStatus(graph, env, {\n        resolverFor: server.resourceResolver as never,\n        resolveDataSources: server.resolveDataSources as never,\n        // Judged as production when the .env says so; a stand-in local\n        // directory for an unbound bucket is only ever offered to development.\n        production,\n        ...(managedDatabase ? { managedDatabase } : {}),\n        ...(dockerDatabase ? { dockerDatabase } : {})\n    });\n\n    if (asJson) {\n        console.log(JSON.stringify({\n            backend: backendName,\n            runtime: backendApp.runtime,\n            ...(branch ? { branch: { name: branch.name, database: branch.database } } : {}),\n            resources,\n            blocked\n        }, null, 2));\n        return;\n    }\n\n    const ownership = backendApp.runtime === \"managed\"\n        ? \"Rebase's runtime boots your bundle\"\n        : \"this project builds its own image and entrypoint\";\n\n    console.log(\"\");\n    console.log(`  ${chalk.bold(backendName)}  ${chalk.gray(\"·\")}  ${chalk.cyan(backendApp.runtime)}  ${chalk.gray(ownership)}`);\n    // Named whether or not it exists, and said plainly when it does not. A\n    // project with no `resources.ts` is legal — it has one default database and\n    // one default bucket — but \"declared in <a file you do not have>\" reads as\n    // a broken install rather than as the default it is.\n    const resourcesFile = path.join(paths.config, \"resources.ts\");\n    const declaresAnything = fs.existsSync(path.join(projectRoot, resourcesFile));\n    console.log(`  ${chalk.gray(\"declared in\")}  ${chalk.gray(resourcesFile)}${\n        declaresAnything ? \"\" : chalk.gray(\"  (none — the defaults below are implicit)\")}`);\n    console.log(`  ${chalk.gray(\"configured by\")}  ${chalk.gray(\".env\")}`);\n    // Every database command in this checkout uses the branch, so the view\n    // says so: a switch made yesterday is easy to forget.\n    if (branch) {\n        console.log(`  ${chalk.gray(\"on branch\")}  ${chalk.bold(branch.name)} ${chalk.gray(`(${branch.database})`)}`\n            + chalk.gray(` — ${chalk.cyan(\"rebase db branch switch --off\")} returns to ${branch.parent ?? \"the main database\"}`));\n    } else if (ignoredBranch) {\n        console.log(`  ${chalk.yellow(\"○\")} ${chalk.gray(`switched to branch \"${ignoredBranch}\", which the managed database cannot serve — it uses the main one`)}`);\n    }\n\n    const kinds = [...new Set(resources.map(r => r.kind))];\n    for (const kind of kinds) {\n        console.log(\"\");\n        console.log(`  ${chalk.bold.underline(`${kind}s`)}`);\n        for (const status of resources.filter(r => r.kind === kind)) printResource(status);\n    }\n\n    if (blocked) {\n        console.log(\"\");\n        console.log(`  ${chalk.red(\"✗\")} ${chalk.red(blocked)}`);\n    }\n\n    // Only worth a line when it is wrong. A generated file that matches its\n    // declarations is not news, and a status view that reports its own\n    // bookkeeping as an item trains people to skim past the items that matter.\n    //\n    // Nor is one that has not been written yet: `rebase build` writes it on\n    // every build and says \"commit it\" when it changes, so a project that has\n    // never been built — every fresh scaffold — has nothing wrong with it.\n    // `rebase resources --check` is the gate that refuses a missing one.\n    const committed = readResourceGraphFile(projectRoot);\n    if (committed !== null && committed !== serializeResourceGraph(graph)) {\n        console.log(\"\");\n        console.log(`  ${chalk.yellow(\"○\")} ${RESOURCE_GRAPH_FILENAME} is stale — ${chalk.blue(\"rebase resources --write\")}`);\n        console.log(chalk.gray(\"      a host reads it to decide what to provision before it runs anything\"));\n    }\n\n    console.log(\"\");\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoFA,SAAS,MAAM,KAAa,MAAuB;CAC/C,MAAM,QAAQ,IAAI;CAClB,OAAO,OAAO,UAAU,YAAY,UAAU;AAClD;;;;;;;;AASA,SAAgB,YACZ,aACA,KACA,oBACiB;CACjB,IAAI,YAAY,cAAc,UAAU,OAAO,CAAC;CAEhD,MAAM,SAAS,kBAAkB,YAAY,GAAG;CAChD,MAAM,UAAU,OAAO,YAAY,QAAQ,YAAY,WACjD,kBAAkB,YAAY,QAAQ,OAAO,IAC7C,KAAA;CAEN,OAAO,oBAAoB,WAAW,CAAC,CAAC,KAAK,SAAS;EAClD,MAAM,OAAO,GAAG,OAAO;EACvB,MAAM,UAA2B;GAAE;GAAM,KAAK,MAAM,KAAK,IAAI;EAAE;EAK/D,IAAI,YAAY,KAAA,KAAa,CAAC,QAAQ,OAAO,mBAAmB,SAAS,IAAI,GACzE,QAAQ,WAAW;GAAE,MAAM,GAAG,OAAO;GAAW,KAAK,MAAM,KAAK,GAAG,OAAO,SAAS;EAAE;EAEzF,OAAO;CACX,CAAC;AACL;;;;;;;;;;;AAwFA,SAAS,gBAAgB,KAAa,OAAsB,KAAqB;CAC7E,MAAM,SAAiB,EAAE,GAAG,IAAI;CAChC,MAAM,OAAO,CACT,sBACA,GAAG,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,KAAI,MAAK,EAAE,GAAG,CACxE;CACA,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,OAAO,eAAe,kBAAkB,GAAG;EACjD,IAAI,CAAC,MAAM,QAAQ,IAAI,GAAG,OAAO,QAAQ;CAC7C;CAEA,OAAO;AACX;;;;;;;;;;;AAYA,SAAS,eAAe,KAAa,KAAwC;CACzE,IAAI,CAAC,OAAO,MAAM,KAAK,cAAc,GAAG,OAAO;CAE/C,OAAO;EAAE,GAAG;EAAK,cAAc;CAAI;AACvC;;;;;;;;;;;;;;;AAgBA,SAAgB,cACZ,OACA,KACA,WACiD;CACjD,MAAM,YAA8B,CAAC;CACrC,MAAM,aAAa,UAAU,cAAc;CAC3C,MAAM,UAAU,UAAU;CAC1B,MAAM,SAAS,UAAU;;CAEzB,MAAM,gBAAgB,SAAS,OAAO,QAAQ,OAAO;;CAErD,IAAI,iBAAiB;CAErB,KAAK,MAAM,EAAE,aAAa,cAAc,qBAAqB,KAAK,GAAG;EACjE,MAAM,WAAW,UAAU,YAAY,YAAY,IAAI;EACvD,MAAM,WAAW,YAAY,aAAa,KAAK,UAAU,iBAAiB,CAAC,CAAC;EAC5E,MAAM,OAAiD;GACnD,MAAM,YAAY;GAClB,KAAK,YAAY;GACjB,QAAQ,YAAY;GACpB,WAAW,YAAY;GACvB,GAAI,OAAO,YAAY,QAAQ,YAAY,WACrC,EAAE,SAAS,YAAY,QAAQ,QAAQ,IACvC,CAAC;GACP;GACA;GACA,GAAI,YAAY,UAAU,YAAY,OAAO,SAAS,IAAI,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;EAChG;EAEA,IAAI,CAAC,UAAU;GACX,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,uCAAuC,YAAY,KAAK;GAEpE,CAAC;GACD;EACJ;EAQA,IAAI,WAAW,YAAY,SAAS,cAAc,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GAC/F,kBAAkB;GAClB,UAAU,KAAK;IACX,GAAG;IACH,OAAO;IACP,QAAQ,QAAQ,MACV,iEACA;GAEV,CAAC;GACD;EACJ;EAIA,IAAI,UAAU,YAAY,SAAS,cAAc,YAAY,QAAQ,wBAC9D,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,GAAG;GACpD,UAAU,KAAK;IAAE,GAAG;IAAM,OAAO;IAAS,QAAQ,OAAO;GAAO,CAAC;GACjE;EACJ;EAEA,MAAM,SAAS,YAAY,SAAS,aAAa,eAAe,KAAK,aAAa,IAAI;EACtF,MAAM,UAAU,SAAS,QAAQ,aAAa,QAAQ;GAAE;GAAY,iBAAiB;EAAU,CAAC;EAChG,QAAQ,QAAQ,OAAhB;GACI,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KACH,OAAO;KACP,GAAI,QAAQ,WAAW,EAAE,UAAU,QAAQ,SAAS,IAAI,CAAC;KACzD,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAS,QAAQ,QAAQ,UAAU;IAAqC,CAAC;IAC1G;GACJ,KAAK;IACD,UAAU,KAAK;KAAE,GAAG;KAAM,OAAO;KAAgB,QAAQ,QAAQ,UAAU;IAA2B,CAAC;IACvG;GACJ,KAAK;IACD,UAAU,KAAK;KACX,GAAG;KAIH,OAAO,YAAY,SAAS,OAAM,MAAK,CAAC,EAAE,OAAO,CAAC,EAAE,UAAU,GAAG,IAAI,iBAAiB;KACtF,QAAQ,QAAQ,UAAU;IAC9B,CAAC;IACD;EACR;CACJ;CAMA,IAAI;CAKJ,MAAM,oBAAoB,iBAAiB,KAAK,CAAC,SAAS;CAC1D,IAAI,UAAU,OAAM,MAAK,EAAE,UAAU,OAAO,KAAK,CAAC,mBAC9C,IAAI;EACA,UAAU,mBAGN,SAAS,MAAM,gBAAgB,KAAK,OAAO,QAAQ,GAAG,IAAI,eAAe,KAAK,QAAQ,GAAG,GACzF,MAAM,UAAU,QAAO,MAAK,EAAE,SAAS,UAAU,CAAC,CAAC,IAAI,oBAAoB,CAC/E;CACJ,SAAS,KAAK;EACV,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC7D;CAGJ,OAAO;EAAE;EAAW,GAAI,YAAY,KAAA,IAAY,EAAE,QAAQ,IAAI,CAAC;CAAG;AACtE;;;;;;;;;;;;;;;;;;;;;;ACpVA,SAAS,QAAc;CACnB,QAAQ,IAAI;EACd,MAAM,KAAK,eAAe,EAAE;;EAE5B,MAAM,KAAK,OAAO,EAAE;;;;EAIpB,MAAM,KAAK,OAAO,EAAE;;;;;CAKrB;AACD;AAEA,IAAM,OAAO;CACT,OAAO,MAAM,MAAM,GAAG;CACtB,cAAc,MAAM,OAAO,GAAG;CAC9B,QAAQ,MAAM,IAAI,GAAG;AACzB;AAEA,SAAS,cAAc,QAA8B;CACjD,MAAM,OAAO,OAAO,QAAQ,cAAc,MAAM,KAAK,WAAW,IAAI,MAAM,KAAK,OAAO,GAAG;CACzF,MAAM,OAAO,CAAC,MAAM,KAAK,OAAO,MAAM,CAAC;CACvC,IAAI,OAAO,cAAc,UAAU,KAAK,KAAK,MAAM,OAAO,OAAO,SAAS,CAAC;CAC3E,IAAI,OAAO,SAAS,KAAK,KAAK,MAAM,KAAK,WAAW,OAAO,SAAS,CAAC;CACrE,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC;CAIrD,IAAI,OAAO,UAAU,KAAK,KAAK,MAAM,OAAO,sBAAsB,OAAO,UAAU,CAAC;CAEpF,QAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,GAAG,KAAK,IAAI,KAAK,KAAK,KAAK,GAAG;CAClE,IAAI,OAAO,UAAU,OAAO,OAAO,SAAS,GACxC,QAAQ,IAAI,SAAS,MAAM,KAAK,SAAS,EAAE,GAAG,MAAM,KAAK,OAAO,OAAO,KAAK,IAAI,CAAC,GAAG;CAGxF,IAAI,iBAAiB;CACrB,KAAK,MAAM,WAAW,OAAO,UACzB,IAAI,QAAQ,KACR,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,GAAG;MAChE,IAAI,QAAQ,UAAU,KAIzB,QAAQ,IAAI,SAAS,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,SAAS,IAAI,EAAE,GAAG,MAAM,KAAK,gBAAgB,QAAQ,KAAK,EAAE,GAAG;MACxH,IAAI,OAAO,UAAU,SAMxB,kBAAkB;MACf;EACH,MAAM,OAAO,QAAQ,WAAW,MAAM,KAAK,OAAO,QAAQ,SAAS,MAAM,IAAI;EAC7E,QAAQ,IAAI,SAAS,MAAM,KAAK,GAAG,EAAE,GAAG,MAAM,KAAK,QAAQ,IAAI,IAAI,KAAK,GAAG,MAAM,KAAK,SAAS,GAAG;CACtG;CAEJ,IAAI,iBAAiB,GACjB,QAAQ,IAAI,MAAM,KAAK,SAAS,eAAe,oBAAoB,mBAAmB,IAAI,KAAK,IAAI,SAAS,CAAC;CAGjH,IAAI,OAAO,QAAQ;EACf,MAAM,SAAS,OAAO,UAAU,WAAW,MAAM,MAAM,OAAO,UAAU,iBAAiB,MAAM,SAAS,MAAM;EAC9G,QAAQ,IAAI,SAAS,OAAO,KAAK,OAAO,QAAQ,GAAG;CACvD;AACJ;;;;;;;;;;;;;;;;;AA4BA,eAAsB,eAAe,aAAqB,SAA0D;CAChH,MAAM,EAAE,UAAU,QAAQ,kBAAkB,gCAAgC,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;CACpG,IAAI,QAAQ,aAAa,cAAc,OAAO;EAAE;EAAQ;CAAc;CAEtE,IAAI,SAAS,SAAS,WAAW;EAC7B,MAAM,SAAS,MAAM,kBAAkB,WAAW;EAClD,OAAO;GAAE,iBAAiB,EAAE,KAAK,SAAS,WAAW,OAAO,IAAI,IAAI,KAAK;GAAG;GAAQ;EAAc;CACtG;CAEA,IAAI,SAAS,SAAS,YAAY,SAAS,KAAK;EAC5C,MAAM,SAAS,iBAAiB,SAAS,GAAG;EAC5C,MAAM,YAAY,SAAS,MAAM,SAAS,OAAO,MAAM,OAAO,IAAI,IAAI;EACtE,MAAM,QAAQ,SAAS,WAAW,OAAO,KAAK,KAAK,OAAO,SAAS,2BAA2B;EAC9F,OAAO;GACH,gBAAgB;IACZ,KAAK,SAAS;IACd,QAAQ,QAAQ,+CAA+C,eAAe,SAAS,GAAG,KACnF,YAAY,KAAK;GAC5B;GACA;GACA;EACJ;CACJ;CAEA,OAAO;EAAE;EAAQ;CAAc;AACnC;AAEA,eAAsB,cAAc,SAAkC;CAClE,IAAI,UAAU,OAAO,GAAG,OAAO,MAAM;CAErC,MAAM,EAAE,UAAU,iBAAiB;EAC/B,MAAM,EAAE,UAAU,QAAQ;EAC1B;EACA,cAAc;EACd,SAAS;EACT,gBAAgB;CACpB,CAAC;CAED,MAAM,cAAc,mBAAmB;CAOvC,MAAM,SAAS,QAAQ,MAAM,SAAS;CAEtC,IAAI;CACJ,IAAI;EAEA,MAAM,QAAQ,eADC,aAAa,WACC,CAAA,CAAO,QAAQ;EAC5C,IAAI,CAAC,OAAO;GACR,IAAI,QACA,WACI,sEACA,kBACA,8DACJ;GAEJ,QAAQ,MAAM,MAAM,IAAI,oEAAoE,CAAC;GAC7F,QAAQ,WAAW;GACnB;EACJ;EACA,UAAU;CACd,SAAS,KAAK;EACV,IAAI,eAAe,eAAe;GAC9B,IAAI,QACA,WAAW,IAAI,SAAS,oBAAoB,yCACxC,IAAI,OAAO,KAAI,WAAU;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,EAAE,CAAC;GAE/E,QAAQ,MAAM,MAAM,IAAI,IAAI,OAAO,CAAC;GACpC,KAAK,MAAM,SAAS,IAAI,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,GAAG,MAAM,SAAS;GAC5F,QAAQ,WAAW;GACnB;EACJ;EACA,MAAM;CACV;CAEA,MAAM,EAAE,MAAM,aAAa,KAAK,eAAe;CAC/C,MAAM,QAAQ,oBAAoB,YAAY,WAAW;CAEzD,MAAM,EAAE,OAAO,WAAW,MAAM,oBAAoB,iBAAiB,aAAa,UAAU,CAAC;CAC7F,IAAI,OAAO,SAAS,GAAG;EACnB,IAAI,QACA,WACI,GAAG,OAAO,OAAO,yCACjB,gCACA,8DACA,OAAO,KAAI,WAAU;GAAE,MAAM,MAAM;GAAM,SAAS,MAAM;EAAQ,EAAE,CACtE;EAEJ,QAAQ,MAAM,MAAM,IAAI,OAAO,OAAO,OAAO,yCAAyC,CAAC;EACvF,KAAK,MAAM,SAAS,QAAQ,QAAQ,MAAM,KAAK,MAAM,KAAK,MAAM,IAAI,EAAE,IAAI,MAAM,SAAS;EACzF,QAAQ,MAAM,EAAE;EAChB,QAAQ,WAAW;EACnB;CACJ;CAKA,MAAM,MAAM,YAAY,WAAW;CAEnC,MAAM,aAAa,IAAI,aAAa;CACpC,MAAM,EAAE,iBAAiB,gBAAgB,QAAQ,kBAAkB,MAAM,eAAe,aAAa,GAAG;CAExG,MAAM,SAAS,MAAM,OAAO;CAC5B,MAAM,EAAE,WAAW,YAAY,cAAc,OAAO,KAAK;EACrD,aAAa,OAAO;EACpB,oBAAoB,OAAO;EAG3B;EACA,GAAI,kBAAkB,EAAE,gBAAgB,IAAI,CAAC;EAC7C,GAAI,iBAAiB,EAAE,eAAe,IAAI,CAAC;CAC/C,CAAC;CAED,IAAI,QAAQ;EACR,QAAQ,IAAI,KAAK,UAAU;GACvB,SAAS;GACT,SAAS,WAAW;GACpB,GAAI,SAAS,EAAE,QAAQ;IAAE,MAAM,OAAO;IAAM,UAAU,OAAO;GAAS,EAAE,IAAI,CAAC;GAC7E;GACA;EACJ,GAAG,MAAM,CAAC,CAAC;EACX;CACJ;CAEA,MAAM,YAAY,WAAW,YAAY,YACnC,uCACA;CAEN,QAAQ,IAAI,EAAE;CACd,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,GAAG,EAAE,IAAI,MAAM,KAAK,WAAW,OAAO,EAAE,IAAI,MAAM,KAAK,SAAS,GAAG;CAK3H,MAAM,gBAAgB,KAAK,KAAK,MAAM,QAAQ,cAAc;CAC5D,MAAM,mBAAmB,GAAG,WAAW,KAAK,KAAK,aAAa,aAAa,CAAC;CAC5E,QAAQ,IAAI,KAAK,MAAM,KAAK,aAAa,EAAE,IAAI,MAAM,KAAK,aAAa,IACnE,mBAAmB,KAAK,MAAM,KAAK,4CAA4C,GAAG;CACtF,QAAQ,IAAI,KAAK,MAAM,KAAK,eAAe,EAAE,IAAI,MAAM,KAAK,MAAM,GAAG;CAGrE,IAAI,QACA,QAAQ,IAAI,KAAK,MAAM,KAAK,WAAW,EAAE,IAAI,MAAM,KAAK,OAAO,IAAI,EAAE,GAAG,MAAM,KAAK,IAAI,OAAO,SAAS,EAAE,MACnG,MAAM,KAAK,MAAM,MAAM,KAAK,+BAA+B,EAAE,cAAc,OAAO,UAAU,qBAAqB,CAAC;MACrH,IAAI,eACP,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,KAAK,uBAAuB,cAAc,kEAAkE,GAAG;CAG/J,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,UAAU,KAAI,MAAK,EAAE,IAAI,CAAC,CAAC;CACrD,KAAK,MAAM,QAAQ,OAAO;EACtB,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,KAAK,UAAU,GAAG,KAAK,EAAE,GAAG;EACnD,KAAK,MAAM,UAAU,UAAU,QAAO,MAAK,EAAE,SAAS,IAAI,GAAG,cAAc,MAAM;CACrF;CAEA,IAAI,SAAS;EACT,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,IAAI,OAAO,GAAG;CAC3D;CAUA,MAAM,YAAY,sBAAsB,WAAW;CACnD,IAAI,cAAc,QAAQ,cAAc,uBAAuB,KAAK,GAAG;EACnE,QAAQ,IAAI,EAAE;EACd,QAAQ,IAAI,KAAK,MAAM,OAAO,GAAG,EAAE,GAAG,wBAAwB,cAAc,MAAM,KAAK,0BAA0B,GAAG;EACpH,QAAQ,IAAI,MAAM,KAAK,2EAA2E,CAAC;CACvG;CAEA,QAAQ,IAAI,EAAE;AAClB"}

package/dist/{storage-DKPUBTWG.js → storage-DtOXGflp.js}

@@ -1,7 +1,6 @@
-import { d as readEnvFile, p as requireProjectRoot } from "./project-Wp2zoyeN.js";
-import { a as unknownCommand, n as parseCommandArgs, r as wantsHelp, t as UsageError } from "./args-BX0YD14a.js";
+import { E as unknownCommand, b as UsageError, d as readEnvFile, p as requireProjectRoot, w as wantsHelp, x as parseCommandArgs } from "./project-CasK56vN.js";
 import { t as cliUserAgent } from "./version-Buyyo1ut.js";
-import { describeFailure, requireBackendUrl } from "./api-keys-Tm7zvAPe.js";
+import { describeFailure, requireBackendUrl } from "./api-keys-CyJ26KEJ.js";
 import chalk from "chalk";
 import { RebaseApiError } from "@rebasepro/client";
 import readline from "node:readline/promises";
@@ -35,6 +34,8 @@ var MOVE_FLAGS = {
 	"--delete-source": Boolean,
 	"--json": Boolean
 };
+/** How often a running scan is asked about. A setting so the tests need not wait. */
+var orphanScanPolling = { intervalMs: 1e3 };
 /** The project's backend, holding the service key — the `admin` role, every scope. */
 function connect() {
 	const projectRoot = requireProjectRoot();
@@ -133,6 +134,93 @@ async function confirm(question) {
 		prompt.close();
 	}
 }
+var sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Whether an error is a backend without the route asked for, as opposed to a source it does not serve. */
+var isMissingRoute = (error) => error instanceof RebaseApiError && error.status === 404 && error.code !== "UNKNOWN_STORAGE_SOURCE" && error.code !== "STORAGE_SCAN_NOT_FOUND";
+/** One line of a running scan's progress, rewritten in place on a terminal. */
+function progressLine(text, quiet) {
+	if (!quiet && process.stdout.isTTY) process.stdout.write(`\r\x1b[2K  ${text}`);
+}
+function endProgressLine(quiet) {
+	if (!quiet && process.stdout.isTTY) process.stdout.write("\n");
+}
+/** Ask for a scan's record until `done` says so, printing its progress. */
+async function pollScan(backend, id, sourceQuery, done, describe, quiet) {
+	let noted = false;
+	for (;;) {
+		let state;
+		try {
+			state = await backend.request("GET", `/orphans/scans/${encodeURIComponent(id)}${sourceQuery}`);
+		} catch (error) {
+			endProgressLine(quiet);
+			fail("Failed to read the scan's progress", error, backend.baseUrl);
+		}
+		if (done(state)) {
+			endProgressLine(quiet);
+			return state;
+		}
+		progressLine(describe(state), quiet);
+		const note = state.note ?? state.deletion?.note;
+		if (note && !noted && !quiet) {
+			noted = true;
+			endProgressLine(quiet);
+			console.log(chalk.yellow(`  ${note}`));
+		}
+		await sleep(orphanScanPolling.intervalMs);
+	}
+}
+/**
+* Scan for orphans: started on the backend and asked about until it is done,
+* so a scan longer than any request timeout still finishes. A backend from
+* before scans ran in the background is asked the old way, in one request.
+*/
+async function scanForOrphans(backend, query, sourceQuery, quiet) {
+	let started;
+	try {
+		started = await backend.request("POST", `/orphans/scans?${query}`);
+	} catch (error) {
+		if (!isMissingRoute(error)) fail("Failed to start a storage scan", error, backend.baseUrl);
+		try {
+			return { report: await backend.request("GET", `/orphans?${query}`) };
+		} catch (legacyError) {
+			fail("Failed to scan storage", legacyError, backend.baseUrl);
+		}
+	}
+	if (!quiet && started.runner === "in-process") console.log(chalk.gray("  This backend runs no job queue, so the scan runs inside the server process, in the background. A restart of that process stops it."));
+	const finished = await pollScan(backend, started.id, sourceQuery, (state) => state.status === "completed" || state.status === "failed", (state) => state.status === "queued" ? "Waiting for the scan to start…" : `Scanning "${state.storageId}": ${state.progress.filesScanned} file(s) listed, ${state.progress.rowsScanned} row(s) read, ${state.progress.collectionsScanned}/${state.progress.collectionsTotal} collection(s)` + (state.progress.unscanned.length > 0 ? `, ${state.progress.unscanned.length} unreadable` : "") + "…", quiet);
+	if (finished.status === "failed" || !finished.result) {
+		console.error(chalk.red(`✗ The scan failed: ${finished.error ?? "no reason was recorded"}`));
+		process.exit(1);
+	}
+	return {
+		report: {
+			storageId: finished.storageId,
+			...finished.result
+		},
+		scanId: finished.id
+	};
+}
+/** Delete a completed scan's orphans, in the background, and wait for it. */
+async function deleteFromScan(backend, scanId, sourceQuery, quiet) {
+	const deleteQuery = new URLSearchParams(sourceQuery.replace(/^\?/, ""));
+	deleteQuery.set("scan", scanId);
+	try {
+		await backend.request("DELETE", `/orphans?${deleteQuery}`);
+	} catch (error) {
+		fail("Failed to delete unused files", error, backend.baseUrl);
+	}
+	const deletion = (await pollScan(backend, scanId, sourceQuery, (state) => state.deletion?.status === "completed" || state.deletion?.status === "failed", (state) => {
+		const progress = state.deletion?.progress;
+		if (!progress || state.deletion?.status === "queued") return "Waiting for the delete to start…";
+		return progress.phase === "deleting" ? `Deleting: ${progress.deleted} of ${progress.candidates} file(s)…` : `Checking every row again before deleting: ${progress.rowsScanned} row(s) read, ${progress.collectionsScanned}/${progress.collectionsTotal} collection(s)…`;
+	}, quiet)).deletion;
+	return {
+		deleted: deletion.result?.deleted ?? [],
+		failed: deletion.result?.failed ?? [],
+		kept: deletion.result?.kept ?? [],
+		...deletion.status === "failed" ? { error: deletion.error ?? "no reason was recorded" } : {}
+	};
+}
 async function orphans(rawArgs) {
 	const { flags } = parseCommandArgs({
 		spec: ORPHANS_FLAGS,
@@ -145,16 +233,16 @@ async function orphans(rawArgs) {
 	if (!Number.isFinite(olderThan) || olderThan < 0) throw new UsageError("--older-than takes a number of hours, 0 or more.");
 	const query = new URLSearchParams({ olderThanHours: String(olderThan) });
 	if (flags["--source"]) query.set("storageId", flags["--source"]);
+	const sourceQuery = flags["--source"] ? `?${new URLSearchParams({ storageId: flags["--source"] })}` : "";
+	const quiet = flags["--json"] === true;
 	const backend = connect();
-	let report;
-	try {
-		report = await backend.request("GET", `/orphans?${query}`);
-	} catch (error) {
-		fail("Failed to scan storage", error, backend.baseUrl);
-	}
+	const { report, scanId } = await scanForOrphans(backend, query, sourceQuery, quiet);
 	if (!flags["--delete"]) {
 		if (flags["--json"]) {
-			console.log(JSON.stringify(report, null, 2));
+			console.log(JSON.stringify({
+				...report,
+				...scanId ? { scanId } : {}
+			}, null, 2));
 			return;
 		}
 		console.log("");
@@ -184,18 +272,25 @@ async function orphans(rawArgs) {
 		}
 	}
 	let result;
-	try {
+	if (scanId) result = await deleteFromScan(backend, scanId, sourceQuery, quiet);
+	else try {
 		result = await backend.request("DELETE", `/orphans?${query}`);
 	} catch (error) {
 		fail("Failed to delete unused files", error, backend.baseUrl);
 	}
-	if (flags["--json"]) console.log(JSON.stringify(result, null, 2));
+	if (flags["--json"]) console.log(JSON.stringify({
+		storageId: report.storageId,
+		...result,
+		recent: report.recent
+	}, null, 2));
 	else {
+		if (result.error) console.error(chalk.red(`  ✗ ${result.error}`));
 		console.log(chalk.green(`  ✓ Deleted ${result.deleted.length} file(s).`));
+		for (const kept of result.kept ?? []) console.log(chalk.yellow(`  Kept ${kept.key}: ${kept.reason}`));
 		for (const failure of result.failed) console.error(chalk.red(`  ✗ ${failure.key}: ${failure.error}`));
 		console.log("");
 	}
-	if (result.failed.length > 0) process.exitCode = 1;
+	if (result.failed.length > 0 || result.error) process.exitCode = 1;
 }
 async function move(rawArgs) {
 	const { flags } = parseCommandArgs({
@@ -238,17 +333,60 @@ async function move(rawArgs) {
 		if (!flags["--json"] && process.stdout.isTTY) process.stdout.write(`\r  ${counts.copied} copied, ${counts.exists} already there, ${counts.failed} failed…`);
 		cursor = page.cursor;
 	} while (cursor);
+	const verified = await listLeftBehind(backend, {
+		from,
+		to,
+		prefix: flags["--prefix"],
+		deleteSource: flags["--delete-source"] === true
+	}, flags["--json"] === true);
+	const reported = new Set(failures.map((failure) => failure.key));
+	const leftBehind = verified?.filter((entry) => !reported.has(entry.key)) ?? [];
 	if (flags["--json"]) console.log(JSON.stringify({
 		...counts,
-		failures
+		failures,
+		verified: verified !== void 0,
+		notMoved: verified ?? []
 	}, null, 2));
 	else {
 		if (process.stdout.isTTY) process.stdout.write("\n");
 		console.log(chalk.green(`  ✓ ${counts.copied} copied, ${counts.exists} already there${flags["--delete-source"] ? `, ${counts.deleted} deleted from the source` : ""}.`));
 		for (const failure of failures) console.error(chalk.red(`  ✗ ${failure.key}: ${failure.error ?? "failed"}`));
+		if (verified === void 0) console.log(chalk.gray("  This backend cannot list the source again (it needs a backend newer than 0.25.1), so the CLI did not check for files the move left behind."));
+		else if (leftBehind.length > 0) {
+			console.error(chalk.red(`  ✗ Listed again, the source holds ${leftBehind.length} more file(s) the move did not report: ${leftBehind.length} file(s) were not moved.`));
+			for (const entry of leftBehind) console.error(chalk.red(`    ${entry.key}: ${entry.reason}`));
+			console.error(chalk.gray("  Run the same move again to pick them up."));
+		}
 		if (counts.copied + counts.exists > 0 && !flags["--delete-source"]) console.log(chalk.gray("  The source keeps its copies. Point the property at the new source, then run again with --delete-source."));
 	}
-	if (failures.length > 0) process.exitCode = 1;
+	if (failures.length > 0 || leftBehind.length > 0) process.exitCode = 1;
+}
+/**
+* Every file under the moved folder the move did not move, read by the
+* backend's `/move/verify` — or `undefined` from a backend without it.
+*/
+async function listLeftBehind(backend, request, quiet) {
+	const notMoved = [];
+	let cursor;
+	let checked = 0;
+	do {
+		let page;
+		try {
+			page = await backend.request("POST", "/move/verify", {
+				...request,
+				...cursor ? { cursor } : {},
+				limit: 500
+			});
+		} catch (error) {
+			if (error instanceof RebaseApiError && error.status === 404 && error.code !== "UNKNOWN_STORAGE_SOURCE") return void 0;
+			fail("Failed to list the source again after the move", error, backend.baseUrl);
+		}
+		checked += page.checked;
+		notMoved.push(...page.notMoved);
+		if (!quiet && process.stdout.isTTY) process.stdout.write(`\r  Checking the source again: ${checked} file(s) listed…`);
+		cursor = page.cursor;
+	} while (cursor);
+	return notMoved;
 }
 async function storageCommand(subcommand, rawArgs) {
 	if (!subcommand || subcommand === "--help" || wantsHelp(rawArgs)) {
@@ -297,10 +435,15 @@ ${chalk.green.bold("Notes")}
   panel uploads a file before the row that names it is saved. Files your own
   tables name, outside collections, are not seen: check before deleting.
 
+  The scan runs on the backend in the background — a ${chalk.blue("storage.orphans")} job
+  on the job queue, or inside the server process when there is none — and the
+  CLI shows its progress until it is done. ${chalk.blue("--delete")} deletes from that scan
+  only; the backend reads every row again and asks for each file again first.
+
   Both read ${chalk.blue("REBASE_SERVICE_KEY")} from .env and need the backend running.
 `);
 }
 //#endregion
 export { STORAGE_SUBCOMMANDS, storageCommand };
 
-//# sourceMappingURL=storage-DKPUBTWG.js.map
+//# sourceMappingURL=storage-DtOXGflp.js.map