@rebasepro/cli 0.25.0 → 0.26.0

package/dist/path-flags-BFgG9V6y.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"path-flags-BFgG9V6y.js","names":[],"sources":["../src/utils/path-flags.ts"],"sourcesContent":["/**\n * Where a path typed on a `rebase` command line resolves: one rule, one sentence.\n *\n * The driver CLI runs with `cwd: backend/` — that is where it and its\n * dependencies resolve from — while people type commands from the project root\n * (or anywhere else in it). So every relative path on the line is resolved by\n * the CLI, from the directory the command was run in, before the driver is\n * handed a different one (`absolutizeLocalPathArgs` in `commands/db.ts`).\n * `generate-sdk` and `db backup --out` already worked that way; `--collections`\n * was resolved from `backend/` and was the odd one out.\n *\n * The sentence below is printed by every help page that takes `--collections`,\n * and by the refusal when the path is not there, so the rule is stated in one\n * set of words wherever a reader meets it.\n */\nimport fs from \"fs\";\nimport path from \"path\";\nimport chalk from \"chalk\";\n\n/** The rule, as every help page and error states it. */\nexport const COLLECTIONS_PATH_RULE = \"relative paths are resolved from where you run the command\";\n\n/** The `--collections` line of a help page. */\nexport const COLLECTIONS_FLAG_HELP = `Collections directory (default: config/collections); ${COLLECTIONS_PATH_RULE}`;\n\n/** The flags that carry a collections path, in every spelling the driver accepts. */\nconst COLLECTIONS_FLAGS = [\"--collections\", \"-c\"];\n\n/** The `--collections` value on a line, as typed, or `null` when there is none. */\nfunction typedCollectionsPath(args: readonly string[]): string | null {\n    for (let i = 0; i < args.length; i++) {\n        const token = args[i];\n        const eq = token.indexOf(\"=\");\n        if (eq > 0 && COLLECTIONS_FLAGS.includes(token.slice(0, eq))) return token.slice(eq + 1) || null;\n        if (COLLECTIONS_FLAGS.includes(token)) {\n            const value = args[i + 1];\n            return value && !value.startsWith(\"-\") ? value : null;\n        }\n    }\n    return null;\n}\n\n/**\n * What a refusal over a missing `--collections` path spared, by what the command\n * would have done with it. Only a schema writer drops tables; a console or a\n * doctor run over nothing does something else wrong, and says so.\n */\nconst MISSING_COLLECTIONS_CONSEQUENCE = {\n    schema: [\n        \"Nothing was generated and nothing was applied — a schema generated from a\",\n        \"directory that is not there is an empty one, and applying it would drop\",\n        \"every table it does not describe.\"\n    ],\n    console: [\n        \"Nothing was started — a console over a directory that is not there would\",\n        \"load none of this project's collections.\"\n    ],\n    doctor: [\n        \"Nothing was checked — a directory that is not there has no collections, so\",\n        \"every collection check would pass over it.\"\n    ]\n} as const;\n\n/** What a command does with its `--collections` path. */\nexport type CollectionsPathUse = keyof typeof MISSING_COLLECTIONS_CONSEQUENCE;\n\n/**\n * The refusal for a `--collections` path that does not exist, or `null`.\n *\n * Checked by the CLI, in the reader's terms, before the driver is spawned: the\n * driver's own check runs in `backend/` and can only describe the path it was\n * handed. A generator pointed at a directory that is not there writes an empty\n * schema, and a push of an empty schema drops every table — so nothing runs.\n *\n * Scripts written for the old rule (`--collections ../config/collections`,\n * run from the root) land here, and the message says exactly what to change.\n */\nexport function missingCollectionsPath(\n    args: readonly string[],\n    cwd: string,\n    backendDir: string,\n    use: CollectionsPathUse = \"schema\"\n): string[] | null {\n    const typed = typedCollectionsPath(args);\n    if (typed === null) return null;\n    const resolved = path.resolve(cwd, typed);\n    if (fs.existsSync(resolved)) return null;\n\n    const lines = [\n        chalk.red(`✗ Collections path not found: \"${typed}\"`),\n        chalk.gray(`    Resolved to: ${resolved}`),\n        chalk.gray(`    (${COLLECTIONS_PATH_RULE}: ${cwd})`)\n    ];\n    const fromBackend = path.resolve(backendDir, typed);\n    if (!path.isAbsolute(typed) && fs.existsSync(fromBackend)) {\n        lines.push(\n            \"\",\n            chalk.yellow(`  From backend/ it would be ${fromBackend} — the driver used to resolve paths from there.`),\n            chalk.yellow(`  Leave the flag out (config/collections is the default), or write it from here: ${path.relative(cwd, fromBackend) || \".\"}`)\n        );\n    }\n    lines.push(\"\", ...MISSING_COLLECTIONS_CONSEQUENCE[use].map(line => chalk.gray(`  ${line}`)));\n    return lines;\n}\n\n/** Print {@link missingCollectionsPath}'s refusal and exit 1, or return. */\nexport function refuseMissingCollectionsPath(\n    args: readonly string[],\n    cwd: string,\n    backendDir: string,\n    use: CollectionsPathUse = \"schema\"\n): void {\n    const lines = missingCollectionsPath(args, cwd, backendDir, use);\n    if (!lines) return;\n    console.error(\"\");\n    for (const line of lines) console.error(line);\n    console.error(\"\");\n    process.exit(1);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAoBA,IAAa,wBAAwB;;AAGrC,IAAa,wBAAwB,wDAAwD;;AAG7F,IAAM,oBAAoB,CAAC,iBAAiB,IAAI;;AAGhD,SAAS,qBAAqB,MAAwC;CAClE,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;EAClC,MAAM,QAAQ,KAAK;EACnB,MAAM,KAAK,MAAM,QAAQ,GAAG;EAC5B,IAAI,KAAK,KAAK,kBAAkB,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,MAAM,MAAM,KAAK,CAAC,KAAK;EAC5F,IAAI,kBAAkB,SAAS,KAAK,GAAG;GACnC,MAAM,QAAQ,KAAK,IAAI;GACvB,OAAO,SAAS,CAAC,MAAM,WAAW,GAAG,IAAI,QAAQ;EACrD;CACJ;CACA,OAAO;AACX;;;;;;AAOA,IAAM,kCAAkC;CACpC,QAAQ;EACJ;EACA;EACA;CACJ;CACA,SAAS,CACL,4EACA,0CACJ;CACA,QAAQ,CACJ,8EACA,4CACJ;AACJ;;;;;;;;;;;;AAgBA,SAAgB,uBACZ,MACA,KACA,YACA,MAA0B,UACX;CACf,MAAM,QAAQ,qBAAqB,IAAI;CACvC,IAAI,UAAU,MAAM,OAAO;CAC3B,MAAM,WAAW,KAAK,QAAQ,KAAK,KAAK;CACxC,IAAI,GAAG,WAAW,QAAQ,GAAG,OAAO;CAEpC,MAAM,QAAQ;EACV,MAAM,IAAI,kCAAkC,MAAM,EAAE;EACpD,MAAM,KAAK,oBAAoB,UAAU;EACzC,MAAM,KAAK,QAAQ,sBAAsB,IAAI,IAAI,EAAE;CACvD;CACA,MAAM,cAAc,KAAK,QAAQ,YAAY,KAAK;CAClD,IAAI,CAAC,KAAK,WAAW,KAAK,KAAK,GAAG,WAAW,WAAW,GACpD,MAAM,KACF,IACA,MAAM,OAAO,+BAA+B,YAAY,gDAAgD,GACxG,MAAM,OAAO,oFAAoF,KAAK,SAAS,KAAK,WAAW,KAAK,KAAK,CAC7I;CAEJ,MAAM,KAAK,IAAI,GAAG,gCAAgC,IAAI,CAAC,KAAI,SAAQ,MAAM,KAAK,KAAK,MAAM,CAAC,CAAC;CAC3F,OAAO;AACX;;AAGA,SAAgB,6BACZ,MACA,KACA,YACA,MAA0B,UACtB;CACJ,MAAM,QAAQ,uBAAuB,MAAM,KAAK,YAAY,GAAG;CAC/D,IAAI,CAAC,OAAO;CACZ,QAAQ,MAAM,EAAE;CAChB,KAAK,MAAM,QAAQ,OAAO,QAAQ,MAAM,IAAI;CAC5C,QAAQ,MAAM,EAAE;CAChB,QAAQ,KAAK,CAAC;AAClB"}

package/dist/project-Wp2zoyeN.js

@@ -1,349 +0,0 @@
-import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
-import { n as getPMCommands, t as detectPackageManager } from "./package-manager-DSEOwTqM.js";
-import chalk from "chalk";
-import fs from "fs";
-import path from "path";
-import { pathToFileURL } from "url";
-import { createRequire } from "module";
-import { execSync } from "child_process";
-import dotenv from "dotenv";
-//#region src/utils/project.ts
-/**
-* Project discovery utilities for the Rebase CLI.
-*
-* These helpers locate the project root, backend directory, .env file,
-* and local binaries — used by all CLI command modules.
-*/
-var project_exports = /* @__PURE__ */ __exportAll({
-	MANIFEST_FILENAME: () => MANIFEST_FILENAME,
-	dependenciesNotInstalled: () => dependenciesNotInstalled,
-	exitDependenciesNotInstalled: () => exitDependenciesNotInstalled,
-	failAsJson: () => failAsJson,
-	findBackendDir: () => findBackendDir,
-	findEnvFile: () => findEnvFile,
-	findFrontendDir: () => findFrontendDir,
-	findProjectRoot: () => findProjectRoot,
-	getActiveBackendPlugin: () => getActiveBackendPlugin,
-	readEnvFile: () => readEnvFile,
-	requireBackendDir: () => requireBackendDir,
-	requireProjectRoot: () => requireProjectRoot,
-	resolveLocalBin: () => resolveLocalBin,
-	resolvePluginCliScript: () => resolvePluginCliScript,
-	resolveTsx: () => resolveTsx,
-	resolveTsxLoader: () => resolveTsxLoader,
-	validateTsxInstallation: () => validateTsxInstallation,
-	wantsJsonOutput: () => wantsJsonOutput
-});
-/** The authored project manifest. Its presence alone marks a project root. */
-var MANIFEST_FILENAME = "rebase.json";
-/**
-* Walk up from `startDir` to find the Rebase project root.
-*
-* A directory is the root when it holds a `rebase.json`, or when it holds a
-* `package.json` that either lists `backend` as a workspace or sits beside both
-* `backend/` and `config/`.
-*
-* `rebase.json` is checked first and needs no `package.json` beside it, because
-* the conventions below all describe a repository that *contains the backend*.
-* A repository holding only a frontend — the normal shape once a project's apps
-* live in separate repositories — matches none of them, so without this the
-* tooling could not run there at all.
-*/
-function findProjectRoot(startDir = process.cwd()) {
-	let dir = path.resolve(startDir);
-	const root = path.parse(dir).root;
-	while (dir !== root) {
-		if (fs.existsSync(path.join(dir, "rebase.json"))) return dir;
-		const pkgPath = path.join(dir, "package.json");
-		if (fs.existsSync(pkgPath)) {
-			try {
-				const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-				if (pkg.workspaces && Array.isArray(pkg.workspaces)) {
-					if (pkg.workspaces.some((w) => w === "backend")) return dir;
-				}
-			} catch {}
-			if (fs.existsSync(path.join(dir, "backend")) && fs.existsSync(path.join(dir, "config"))) return dir;
-		}
-		dir = path.dirname(dir);
-	}
-	return null;
-}
-/**
-* Locate the backend directory within the project root.
-*/
-function findBackendDir(projectRoot) {
-	const backendDir = path.join(projectRoot, "backend");
-	return fs.existsSync(backendDir) ? backendDir : null;
-}
-/**
-* Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.
-*/
-function getActiveBackendPlugin(backendDir) {
-	const pkgPath = path.join(backendDir, "package.json");
-	if (!fs.existsSync(pkgPath)) return null;
-	try {
-		const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
-		const deps = {
-			...pkg.dependencies,
-			...pkg.devDependencies
-		};
-		const candidates = Object.keys(deps).filter((dep) => dep.startsWith("@rebasepro/server-") && dep !== "@rebasepro/server");
-		if (candidates.length === 0) return null;
-		if (candidates.includes("@rebasepro/server-postgres")) return "@rebasepro/server-postgres";
-		for (const candidate of candidates) if (resolvePluginCliScript(backendDir, candidate)) return candidate;
-		return candidates[0];
-	} catch {}
-	return null;
-}
-/**
-* Resolve the active plugin's CLI script.
-*/
-function resolvePluginCliScript(backendDir, pluginName) {
-	const candidates = [];
-	let dir = path.resolve(backendDir);
-	const fsRoot = path.parse(dir).root;
-	while (dir !== fsRoot) {
-		candidates.push(path.join(dir, "node_modules", pluginName, "src", "cli.ts"), path.join(dir, "node_modules", pluginName, "dist", "cli.js"));
-		dir = path.dirname(dir);
-	}
-	candidates.push(path.resolve(backendDir, "..", "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"), path.resolve(backendDir, "..", "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"), path.resolve(backendDir, "..", "packages", pluginName.replace("@rebasepro/", ""), "src", "cli.ts"));
-	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
-	return null;
-}
-/**
-* Locate the frontend directory within the project root.
-*/
-function findFrontendDir(projectRoot) {
-	const frontendDir = path.join(projectRoot, "frontend");
-	return fs.existsSync(frontendDir) ? frontendDir : null;
-}
-/**
-* Find the .env file. Checks the project root first, then backend.
-*/
-function findEnvFile(projectRoot) {
-	const candidates = [path.join(projectRoot, ".env"), path.join(projectRoot, "backend", ".env")];
-	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
-	return null;
-}
-/**
-* Read the project's `.env` into a plain object.
-*
-* One reader, because there were four: `dotenv` in `start`, a hand-rolled
-* `indexOf("=")` loop in `api-keys`, a single-key regex in `auth`, and its own
-* splitting in `cloud env`. `dotenv` is a declared dependency of this package,
-* so the other three existed for no reason and disagreed with the correct one
-* on the two things people actually write in a `.env`:
-*
-*   - `export KEY=value`, which the hand-rolled parser keyed as
-*     `export KEY` — so the command reported the key as unset while it was
-*     right there in the file;
-*   - `KEY=value # comment`, whose comment travelled into the value and then
-*     into an `Authorization` header, coming back as a 401 with nothing
-*     pointing at the cause.
-*
-* Returns `{}` when the project has no `.env`, so callers can treat "absent"
-* and "empty" alike.
-*/
-function readEnvFile(projectRoot) {
-	const envFile = findEnvFile(projectRoot);
-	if (!envFile || !fs.existsSync(envFile)) return {};
-	try {
-		return dotenv.parse(fs.readFileSync(envFile, "utf-8"));
-	} catch {
-		return {};
-	}
-}
-/**
-* Resolve a binary from the project's node_modules/.bin.
-* Checks backend, root, parent monorepo root, then falls back to PATH.
-*/
-function resolveLocalBin(projectRoot, binName) {
-	const candidates = [path.join(projectRoot, "backend", "node_modules", ".bin", binName), path.join(projectRoot, "node_modules", ".bin", binName)];
-	let parent = path.dirname(projectRoot);
-	const rootDir = path.parse(parent).root;
-	while (parent !== rootDir) {
-		candidates.push(path.join(parent, "node_modules", ".bin", binName));
-		parent = path.dirname(parent);
-	}
-	for (const candidate of candidates) if (fs.existsSync(candidate)) return candidate;
-	try {
-		const globalPath = execSync(`which ${binName}`, { encoding: "utf-8" }).trim();
-		if (globalPath && fs.existsSync(globalPath)) return globalPath;
-	} catch {}
-	return null;
-}
-/**
-* Resolve the tsx binary. Checks backend node_modules first, then root.
-*/
-function resolveTsx(projectRoot) {
-	return resolveLocalBin(projectRoot, "tsx");
-}
-/**
-* tsx's loader, as the URL `node --import` takes, or null when none resolves.
-*
-* For running a TypeScript entry in one Node process. The `tsx` binary is a
-* relay — pnpm's `.bin/tsx` shell shim, then tsx's CLI in one Node, which
-* spawns a second Node with this same loader to run the script — so spawning
-* through it costs a shell and a Node start (~50–100 ms) on every hop, and
-* `rebase dev` pays a hop on every start and every collection save.
-*
-* Resolved the way Node resolves the package, from the project first — the
-* backend, where a scaffold declares tsx, then the root and everything above it
-* — so the tsx used is the one {@link resolveTsx} would have found; then from
-* this package, as the repository's own tests resolve `tsx/cli`. A URL rather
-* than a path: a Windows path is not a valid `--import` specifier.
-*/
-function resolveTsxLoader(projectRoot) {
-	const bases = [
-		path.join(projectRoot, "backend", "noop.js"),
-		path.join(projectRoot, "noop.js"),
-		import.meta.url
-	];
-	for (const base of bases) try {
-		return pathToFileURL(createRequire(base).resolve("tsx")).href;
-	} catch {}
-	return null;
-}
-/**
-* Validate that a resolved tsx binary actually has an intact installation.
-*
-* `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)
-* exists. If the pnpm content-addressable store was cleaned or a previous
-* install was interrupted, the symlink can exist while critical files inside
-* the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a
-* confusing MODULE_NOT_FOUND error at runtime.
-*
-* This function follows the symlink, walks up to find the tsx package root
-* (`package.json` with `name: "tsx"`), and verifies that `dist/preflight.cjs`
-* is present. Returns `null` when the installation looks healthy, or an
-* error description string when it appears corrupted.
-*/
-function validateTsxInstallation(tsxBinPath) {
-	try {
-		const realPath = fs.realpathSync(tsxBinPath);
-		let dir = path.dirname(realPath);
-		const fsRoot = path.parse(dir).root;
-		for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {
-			const pkgPath = path.join(dir, "package.json");
-			if (fs.existsSync(pkgPath)) try {
-				if (JSON.parse(fs.readFileSync(pkgPath, "utf-8")).name === "tsx") {
-					const preflightPath = path.join(dir, "dist", "preflight.cjs");
-					if (!fs.existsSync(preflightPath)) return `tsx package at ${dir} is missing dist/preflight.cjs`;
-					return null;
-				}
-			} catch {}
-			dir = path.dirname(dir);
-		}
-		return null;
-	} catch (err) {
-		return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;
-	}
-}
-/**
-* The one sentence a command says when the project's dependencies are missing.
-*
-* Six commands each had their own wording for the same state, and none of them
-* named the remedy:
-*
-*   ✗ Could not find CLI entry point for @rebasepro/server-postgres.
-*   ✗ Could not find tsx binary.
-*   ✗ Could not find tsx binary for backend.
-*
-* All three mean "you have not installed yet" — `getActiveBackendPlugin` has
-* already read the driver out of `backend/package.json` by the time the first
-* one fires, so the package is declared and simply not on disk, and `tsx` is a
-* devDependency of every scaffold. But they read as *Rebase* being broken, and
-* they name an internal path or a binary the developer never asked for rather
-* than the command that fixes it. That is the whole of the failure someone sees
-* on a fresh clone, where `node_modules/` is the one thing a checkout does not
-* carry.
-*
-* So: one sentence, naming the package manager this project uses and the
-* directory to run it in — the working directory is usually neither.
-*/
-function dependenciesNotInstalled(projectRoot) {
-	return `Dependencies are not installed — run \`${getPMCommands(detectPackageManager(projectRoot)).install.join(" ")}\` in ${projectRoot}`;
-}
-/**
-* Print {@link dependenciesNotInstalled} and exit 1.
-*
-* For the five commands that report and stop. `db.ts` throws instead, because
-* its caller adds the `✗` and the exit itself.
-*/
-function exitDependenciesNotInstalled(projectRoot) {
-	console.error(chalk.red(`✗ ${dependenciesNotInstalled(projectRoot)}`));
-	process.exit(1);
-}
-/**
-* The refusal envelope, for a caller that asked for JSON.
-*
-* Same shape as the cloud family's `fail()` — `{ error: { message, code, hint } }`
-* — because there is one CLI and a caller should not have to know which half of
-* it answered. `code` is what a caller branches on and is never absent; the
-* cloud family's reasoning about that applies here unchanged. `issues` carries
-* the per-problem detail a human reader gets as a bullet list, because a
-* refusal that says "2 problem(s)" and does not say which two is not
-* machine-readable in any useful sense.
-*
-* On **stdout**, like every other `--json` result: the contract those commands
-* make is that stdout holds one JSON value, and a caller that pipes stdout to a
-* parser must get a parseable refusal rather than an empty stream and a
-* human sentence it never sees. That contract used to hold for exactly one
-* failure of each command — the one that goes through `requireProjectRoot` —
-* while every other exit of the *same* command wrote human text to stderr and
-* left stdout empty. So `rebase status --json` was parseable outside a project
-* and unparseable inside a broken one, which is the case a caller actually has
-* to handle.
-*
-* The flag is read off `process.argv` because the failure happens inside a
-* helper the command calls before it has parsed anything. Coarse — a literal
-* `--json` as some other flag's value would count — and worth it: the failure
-* mode of being coarse is a JSON error where a human one was wanted, and the
-* failure mode of not doing it is an unparseable stream.
-*/
-function failAsJson(message, code, hint, issues) {
-	const error = {
-		message,
-		code
-	};
-	if (hint !== void 0) error.hint = hint;
-	if (issues !== void 0) error.issues = issues;
-	console.log(JSON.stringify({ error }, null, 2));
-	process.exit(1);
-}
-/** Did the command line ask for machine-readable output? */
-function wantsJsonOutput(argv = process.argv) {
-	return argv.includes("--json");
-}
-/**
-* Require the project root or exit with a helpful error.
-*/
-function requireProjectRoot() {
-	const root = findProjectRoot();
-	if (!root) {
-		if (wantsJsonOutput()) failAsJson("Could not find a Rebase project root.", "no_project_root", `Looked in this directory and every parent for a ${MANIFEST_FILENAME}, a package.json with a "backend" workspace, or a backend/ next to a config/.`);
-		console.error(chalk.red("✗ Could not find a Rebase project root."));
-		console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));
-		console.error(chalk.gray("  a package.json with a \"backend\" workspace, or a backend/ next to a config/."));
-		console.error(chalk.gray("  Run this from inside a project, or create one with `rebase init`."));
-		process.exit(1);
-	}
-	return root;
-}
-/**
-* Require the backend directory or exit with a helpful error.
-*/
-function requireBackendDir(projectRoot) {
-	const backendDir = findBackendDir(projectRoot);
-	if (!backendDir) {
-		if (wantsJsonOutput()) failAsJson("Could not find a backend/ directory.", "no_backend_dir", `Expected at: ${path.join(projectRoot, "backend")}`);
-		console.error(chalk.red("✗ Could not find a backend/ directory."));
-		console.error(chalk.gray(`  Expected at: ${path.join(projectRoot, "backend")}`));
-		process.exit(1);
-	}
-	return backendDir;
-}
-//#endregion
-export { resolveTsxLoader as _, findBackendDir as a, findProjectRoot as c, readEnvFile as d, requireBackendDir as f, resolveTsx as g, resolvePluginCliScript as h, failAsJson as i, getActiveBackendPlugin as l, resolveLocalBin as m, dependenciesNotInstalled as n, findEnvFile as o, requireProjectRoot as p, exitDependenciesNotInstalled as r, findFrontendDir as s, MANIFEST_FILENAME as t, project_exports as u, validateTsxInstallation as v };
-
-//# sourceMappingURL=project-Wp2zoyeN.js.map

package/dist/project-Wp2zoyeN.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"project-Wp2zoyeN.js","names":[],"sources":["../src/utils/project.ts"],"sourcesContent":["/**\n * Project discovery utilities for the Rebase CLI.\n *\n * These helpers locate the project root, backend directory, .env file,\n * and local binaries — used by all CLI command modules.\n */\nimport fs from \"fs\";\nimport { createRequire } from \"module\";\nimport path from \"path\";\nimport { pathToFileURL } from \"url\";\nimport { execSync } from \"child_process\";\nimport dotenv from \"dotenv\";\nimport chalk from \"chalk\";\nimport { detectPackageManager, getPMCommands } from \"./package-manager\";\n\n/** The authored project manifest. Its presence alone marks a project root. */\nexport const MANIFEST_FILENAME = \"rebase.json\";\n\n/**\n * Walk up from `startDir` to find the Rebase project root.\n *\n * A directory is the root when it holds a `rebase.json`, or when it holds a\n * `package.json` that either lists `backend` as a workspace or sits beside both\n * `backend/` and `config/`.\n *\n * `rebase.json` is checked first and needs no `package.json` beside it, because\n * the conventions below all describe a repository that *contains the backend*.\n * A repository holding only a frontend — the normal shape once a project's apps\n * live in separate repositories — matches none of them, so without this the\n * tooling could not run there at all.\n */\nexport function findProjectRoot(startDir: string = process.cwd()): string | null {\n    let dir = path.resolve(startDir);\n    const root = path.parse(dir).root;\n\n    while (dir !== root) {\n        if (fs.existsSync(path.join(dir, MANIFEST_FILENAME))) {\n            return dir;\n        }\n\n        const pkgPath = path.join(dir, \"package.json\");\n\n        if (fs.existsSync(pkgPath)) {\n            try {\n                const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n                // Check for workspace-based project (monorepo root)\n                if (pkg.workspaces && Array.isArray(pkg.workspaces)) {\n                    const hasBackend = pkg.workspaces.some((w: string) =>\n                        w === \"backend\"\n                    );\n                    if (hasBackend) return dir;\n                }\n            } catch {\n                // ignore parse errors\n            }\n\n            // Check for sibling backend directory\n            if (fs.existsSync(path.join(dir, \"backend\")) && fs.existsSync(path.join(dir, \"config\"))) {\n                return dir;\n            }\n        }\n\n        dir = path.dirname(dir);\n    }\n\n    return null;\n}\n\n/**\n * Locate the backend directory within the project root.\n */\nexport function findBackendDir(projectRoot: string): string | null {\n    const backendDir = path.join(projectRoot, \"backend\");\n    return fs.existsSync(backendDir) ? backendDir : null;\n}\n\n/**\n * Detect the active backend plugin (e.g. @rebasepro/server-postgres) from the backend's package.json.\n */\nexport function getActiveBackendPlugin(backendDir: string): string | null {\n    const pkgPath = path.join(backendDir, \"package.json\");\n    if (!fs.existsSync(pkgPath)) return null;\n\n    try {\n        const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n        const deps = { ...pkg.dependencies,\n...pkg.devDependencies };\n\n        // Collect all @rebasepro/server-* driver plugins (exclude server itself)\n        const candidates = Object.keys(deps).filter(\n            dep => dep.startsWith(\"@rebasepro/server-\") && dep !== \"@rebasepro/server\"\n        );\n\n        if (candidates.length === 0) return null;\n\n        // Prefer server-postgres — it's the primary supported driver\n        if (candidates.includes(\"@rebasepro/server-postgres\")) {\n            return \"@rebasepro/server-postgres\";\n        }\n\n        // Fallback: return the first candidate that actually has a CLI entry point\n        for (const candidate of candidates) {\n            if (resolvePluginCliScript(backendDir, candidate)) {\n                return candidate;\n            }\n        }\n\n        // Last resort: return whatever we found\n        return candidates[0];\n    } catch {\n        // Ignore parse errors\n    }\n    return null;\n}\n\n/**\n * Resolve the active plugin's CLI script.\n */\nexport function resolvePluginCliScript(backendDir: string, pluginName: string): string | null {\n    const candidates: string[] = [];\n\n    // Walk up from the backend dir: pnpm links the plugin into\n    // backend/node_modules, while npm workspaces hoist it to the project (or an\n    // enclosing monorepo) root.\n    let dir = path.resolve(backendDir);\n    const fsRoot = path.parse(dir).root;\n    while (dir !== fsRoot) {\n        candidates.push(\n            path.join(dir, \"node_modules\", pluginName, \"src\", \"cli.ts\"),\n            path.join(dir, \"node_modules\", pluginName, \"dist\", \"cli.js\")\n        );\n        dir = path.dirname(dir);\n    }\n\n    candidates.push(\n        // For monorepo dev mode:\n        path.resolve(backendDir, \"..\", \"..\", \"..\", \"packages\", pluginName.replace(\"@rebasepro/\", \"\"), \"src\", \"cli.ts\"),\n        path.resolve(backendDir, \"..\", \"..\", \"packages\", pluginName.replace(\"@rebasepro/\", \"\"), \"src\", \"cli.ts\"),\n        path.resolve(backendDir, \"..\", \"packages\", pluginName.replace(\"@rebasepro/\", \"\"), \"src\", \"cli.ts\")\n    );\n\n    for (const candidate of candidates) {\n        if (fs.existsSync(candidate)) return candidate;\n    }\n    return null;\n}\n\n/**\n * Locate the frontend directory within the project root.\n */\nexport function findFrontendDir(projectRoot: string): string | null {\n    const frontendDir = path.join(projectRoot, \"frontend\");\n    return fs.existsSync(frontendDir) ? frontendDir : null;\n}\n\n/**\n * Find the .env file. Checks the project root first, then backend.\n */\nexport function findEnvFile(projectRoot: string): string | null {\n    const candidates = [\n        path.join(projectRoot, \".env\"),\n        path.join(projectRoot, \"backend\", \".env\")\n    ];\n\n    for (const candidate of candidates) {\n        if (fs.existsSync(candidate)) return candidate;\n    }\n\n    return null;\n}\n\n/**\n * Read the project's `.env` into a plain object.\n *\n * One reader, because there were four: `dotenv` in `start`, a hand-rolled\n * `indexOf(\"=\")` loop in `api-keys`, a single-key regex in `auth`, and its own\n * splitting in `cloud env`. `dotenv` is a declared dependency of this package,\n * so the other three existed for no reason and disagreed with the correct one\n * on the two things people actually write in a `.env`:\n *\n *   - `export KEY=value`, which the hand-rolled parser keyed as\n *     `export KEY` — so the command reported the key as unset while it was\n *     right there in the file;\n *   - `KEY=value # comment`, whose comment travelled into the value and then\n *     into an `Authorization` header, coming back as a 401 with nothing\n *     pointing at the cause.\n *\n * Returns `{}` when the project has no `.env`, so callers can treat \"absent\"\n * and \"empty\" alike.\n */\nexport function readEnvFile(projectRoot: string): Record<string, string> {\n    const envFile = findEnvFile(projectRoot);\n    if (!envFile || !fs.existsSync(envFile)) return {};\n    try {\n        return dotenv.parse(fs.readFileSync(envFile, \"utf-8\"));\n    } catch {\n        // An unreadable or malformed file is not worth failing a command over;\n        // the caller reports the missing value it was looking for.\n        return {};\n    }\n}\n\n/**\n * Resolve a binary from the project's node_modules/.bin.\n * Checks backend, root, parent monorepo root, then falls back to PATH.\n */\nexport function resolveLocalBin(projectRoot: string, binName: string): string | null {\n    const candidates = [\n        path.join(projectRoot, \"backend\", \"node_modules\", \".bin\", binName),\n        path.join(projectRoot, \"node_modules\", \".bin\", binName)\n    ];\n\n    // Also check parent directories (for monorepo setups where app/ is nested)\n    let parent = path.dirname(projectRoot);\n    const rootDir = path.parse(parent).root;\n    while (parent !== rootDir) {\n        candidates.push(path.join(parent, \"node_modules\", \".bin\", binName));\n        parent = path.dirname(parent);\n    }\n\n    for (const candidate of candidates) {\n        if (fs.existsSync(candidate)) return candidate;\n    }\n\n    // Fall back to globally installed binary via which\n    try {\n        const globalPath = execSync(`which ${binName}`, { encoding: \"utf-8\" }).trim();\n        if (globalPath && fs.existsSync(globalPath)) return globalPath;\n    } catch {\n        // not found globally\n    }\n\n    return null;\n}\n\n/**\n * Resolve the tsx binary. Checks backend node_modules first, then root.\n */\nexport function resolveTsx(projectRoot: string): string | null {\n    return resolveLocalBin(projectRoot, \"tsx\");\n}\n\n/**\n * tsx's loader, as the URL `node --import` takes, or null when none resolves.\n *\n * For running a TypeScript entry in one Node process. The `tsx` binary is a\n * relay — pnpm's `.bin/tsx` shell shim, then tsx's CLI in one Node, which\n * spawns a second Node with this same loader to run the script — so spawning\n * through it costs a shell and a Node start (~50–100 ms) on every hop, and\n * `rebase dev` pays a hop on every start and every collection save.\n *\n * Resolved the way Node resolves the package, from the project first — the\n * backend, where a scaffold declares tsx, then the root and everything above it\n * — so the tsx used is the one {@link resolveTsx} would have found; then from\n * this package, as the repository's own tests resolve `tsx/cli`. A URL rather\n * than a path: a Windows path is not a valid `--import` specifier.\n */\nexport function resolveTsxLoader(projectRoot: string): string | null {\n    const bases = [\n        path.join(projectRoot, \"backend\", \"noop.js\"),\n        path.join(projectRoot, \"noop.js\"),\n        import.meta.url\n    ];\n    for (const base of bases) {\n        try {\n            return pathToFileURL(createRequire(base).resolve(\"tsx\")).href;\n        } catch {\n            // Not resolvable from here; try the next base.\n        }\n    }\n    return null;\n}\n\n/**\n * Validate that a resolved tsx binary actually has an intact installation.\n *\n * `resolveLocalBin` only checks whether `node_modules/.bin/tsx` (a symlink)\n * exists. If the pnpm content-addressable store was cleaned or a previous\n * install was interrupted, the symlink can exist while critical files inside\n * the tsx package (e.g. `dist/preflight.cjs`) are missing — causing a\n * confusing MODULE_NOT_FOUND error at runtime.\n *\n * This function follows the symlink, walks up to find the tsx package root\n * (`package.json` with `name: \"tsx\"`), and verifies that `dist/preflight.cjs`\n * is present. Returns `null` when the installation looks healthy, or an\n * error description string when it appears corrupted.\n */\nexport function validateTsxInstallation(tsxBinPath: string): string | null {\n    try {\n        // Follow the symlink chain to the real tsx entry script\n        const realPath = fs.realpathSync(tsxBinPath);\n\n        // Walk up from the real binary to locate the tsx package root\n        let dir = path.dirname(realPath);\n        const fsRoot = path.parse(dir).root;\n        for (let depth = 0; depth < 10 && dir !== fsRoot; depth++) {\n            const pkgPath = path.join(dir, \"package.json\");\n            if (fs.existsSync(pkgPath)) {\n                try {\n                    const pkg = JSON.parse(fs.readFileSync(pkgPath, \"utf-8\"));\n                    if (pkg.name === \"tsx\") {\n                        // Found the tsx package root — verify critical preload file\n                        const preflightPath = path.join(dir, \"dist\", \"preflight.cjs\");\n                        if (!fs.existsSync(preflightPath)) {\n                            return `tsx package at ${dir} is missing dist/preflight.cjs`;\n                        }\n                        return null; // Installation looks healthy\n                    }\n                } catch {\n                    // Malformed package.json — keep walking\n                }\n            }\n            dir = path.dirname(dir);\n        }\n\n        // Could not determine tsx root — don't block, assume valid\n        return null;\n    } catch (err) {\n        // realpathSync throws if the symlink target is completely gone\n        return `tsx binary symlink is broken: ${err instanceof Error ? err.message : String(err)}`;\n    }\n}\n\n/**\n * The one sentence a command says when the project's dependencies are missing.\n *\n * Six commands each had their own wording for the same state, and none of them\n * named the remedy:\n *\n *   ✗ Could not find CLI entry point for @rebasepro/server-postgres.\n *   ✗ Could not find tsx binary.\n *   ✗ Could not find tsx binary for backend.\n *\n * All three mean \"you have not installed yet\" — `getActiveBackendPlugin` has\n * already read the driver out of `backend/package.json` by the time the first\n * one fires, so the package is declared and simply not on disk, and `tsx` is a\n * devDependency of every scaffold. But they read as *Rebase* being broken, and\n * they name an internal path or a binary the developer never asked for rather\n * than the command that fixes it. That is the whole of the failure someone sees\n * on a fresh clone, where `node_modules/` is the one thing a checkout does not\n * carry.\n *\n * So: one sentence, naming the package manager this project uses and the\n * directory to run it in — the working directory is usually neither.\n */\nexport function dependenciesNotInstalled(projectRoot: string): string {\n    const install = getPMCommands(detectPackageManager(projectRoot)).install.join(\" \");\n    return `Dependencies are not installed — run \\`${install}\\` in ${projectRoot}`;\n}\n\n/**\n * Print {@link dependenciesNotInstalled} and exit 1.\n *\n * For the five commands that report and stop. `db.ts` throws instead, because\n * its caller adds the `✗` and the exit itself.\n */\nexport function exitDependenciesNotInstalled(projectRoot: string): never {\n    console.error(chalk.red(`✗ ${dependenciesNotInstalled(projectRoot)}`));\n    process.exit(1);\n}\n\n/** One problem inside a refusal, when the command found several. */\nexport interface JsonFailureIssue {\n    /** Where it is — a config path, a manifest key, a file. */\n    path?: string;\n    message: string;\n}\n\n/**\n * The refusal envelope, for a caller that asked for JSON.\n *\n * Same shape as the cloud family's `fail()` — `{ error: { message, code, hint } }`\n * — because there is one CLI and a caller should not have to know which half of\n * it answered. `code` is what a caller branches on and is never absent; the\n * cloud family's reasoning about that applies here unchanged. `issues` carries\n * the per-problem detail a human reader gets as a bullet list, because a\n * refusal that says \"2 problem(s)\" and does not say which two is not\n * machine-readable in any useful sense.\n *\n * On **stdout**, like every other `--json` result: the contract those commands\n * make is that stdout holds one JSON value, and a caller that pipes stdout to a\n * parser must get a parseable refusal rather than an empty stream and a\n * human sentence it never sees. That contract used to hold for exactly one\n * failure of each command — the one that goes through `requireProjectRoot` —\n * while every other exit of the *same* command wrote human text to stderr and\n * left stdout empty. So `rebase status --json` was parseable outside a project\n * and unparseable inside a broken one, which is the case a caller actually has\n * to handle.\n *\n * The flag is read off `process.argv` because the failure happens inside a\n * helper the command calls before it has parsed anything. Coarse — a literal\n * `--json` as some other flag's value would count — and worth it: the failure\n * mode of being coarse is a JSON error where a human one was wanted, and the\n * failure mode of not doing it is an unparseable stream.\n */\nexport function failAsJson(\n    message: string,\n    code: string,\n    hint?: string,\n    issues?: JsonFailureIssue[]\n): never {\n    const error: Record<string, unknown> = { message, code };\n    if (hint !== undefined) error.hint = hint;\n    if (issues !== undefined) error.issues = issues;\n    console.log(JSON.stringify({ error }, null, 2));\n    process.exit(1);\n}\n\n/** Did the command line ask for machine-readable output? */\nexport function wantsJsonOutput(argv: readonly string[] = process.argv): boolean {\n    return argv.includes(\"--json\");\n}\n\n/**\n * Require the project root or exit with a helpful error.\n */\nexport function requireProjectRoot(): string {\n    const root = findProjectRoot();\n    if (!root) {\n        if (wantsJsonOutput()) {\n            // `rebase status --json` outside a project wrote four grey lines to\n            // stderr and nothing at all to stdout, so the agent or CI step that\n            // asked for JSON got an empty parse and no reason.\n            failAsJson(\n                \"Could not find a Rebase project root.\",\n                \"no_project_root\",\n                `Looked in this directory and every parent for a ${MANIFEST_FILENAME}, `\n                + \"a package.json with a \\\"backend\\\" workspace, or a backend/ next to a config/.\"\n            );\n        }\n        // Name what is actually looked for, in the order `findProjectRoot`\n        // looks for it. The old wording (\"backend/, frontend/, and config/\")\n        // described neither the manifest — which is the primary marker and the\n        // only one `rebase init` writes — nor a `--headless` project, which has\n        // no frontend at all and would read this as \"you are in the wrong\n        // place\" while standing in the right one.\n        console.error(chalk.red(\"✗ Could not find a Rebase project root.\"));\n        console.error(chalk.gray(`  Looked in this directory and every parent for a ${MANIFEST_FILENAME},`));\n        console.error(chalk.gray(\"  a package.json with a \\\"backend\\\" workspace, or a backend/ next to a config/.\"));\n        console.error(chalk.gray(\"  Run this from inside a project, or create one with `rebase init`.\"));\n        process.exit(1);\n    }\n    return root;\n}\n\n/**\n * Require the backend directory or exit with a helpful error.\n */\nexport function requireBackendDir(projectRoot: string): string {\n    const backendDir = findBackendDir(projectRoot);\n    if (!backendDir) {\n        if (wantsJsonOutput()) {\n            failAsJson(\n                \"Could not find a backend/ directory.\",\n                \"no_backend_dir\",\n                `Expected at: ${path.join(projectRoot, \"backend\")}`\n            );\n        }\n        console.error(chalk.red(\"✗ Could not find a backend/ directory.\"));\n        console.error(chalk.gray(`  Expected at: ${path.join(projectRoot, \"backend\")}`));\n        process.exit(1);\n    }\n    return backendDir;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgBA,IAAa,oBAAoB;;;;;;;;;;;;;;AAejC,SAAgB,gBAAgB,WAAmB,QAAQ,IAAI,GAAkB;CAC7E,IAAI,MAAM,KAAK,QAAQ,QAAQ;CAC/B,MAAM,OAAO,KAAK,MAAM,GAAG,CAAC,CAAC;CAE7B,OAAO,QAAQ,MAAM;EACjB,IAAI,GAAG,WAAW,KAAK,KAAK,KAAA,aAAsB,CAAC,GAC/C,OAAO;EAGX,MAAM,UAAU,KAAK,KAAK,KAAK,cAAc;EAE7C,IAAI,GAAG,WAAW,OAAO,GAAG;GACxB,IAAI;IACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;IAExD,IAAI,IAAI,cAAc,MAAM,QAAQ,IAAI,UAAU;SAC3B,IAAI,WAAW,MAAM,MACpC,MAAM,SAEN,GAAY,OAAO;IAAA;GAE/B,QAAQ,CAER;GAGA,IAAI,GAAG,WAAW,KAAK,KAAK,KAAK,SAAS,CAAC,KAAK,GAAG,WAAW,KAAK,KAAK,KAAK,QAAQ,CAAC,GAClF,OAAO;EAEf;EAEA,MAAM,KAAK,QAAQ,GAAG;CAC1B;CAEA,OAAO;AACX;;;;AAKA,SAAgB,eAAe,aAAoC;CAC/D,MAAM,aAAa,KAAK,KAAK,aAAa,SAAS;CACnD,OAAO,GAAG,WAAW,UAAU,IAAI,aAAa;AACpD;;;;AAKA,SAAgB,uBAAuB,YAAmC;CACtE,MAAM,UAAU,KAAK,KAAK,YAAY,cAAc;CACpD,IAAI,CAAC,GAAG,WAAW,OAAO,GAAG,OAAO;CAEpC,IAAI;EACA,MAAM,MAAM,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;EACxD,MAAM,OAAO;GAAE,GAAG,IAAI;GAC9B,GAAG,IAAI;EAAgB;EAGf,MAAM,aAAa,OAAO,KAAK,IAAI,CAAC,CAAC,QACjC,QAAO,IAAI,WAAW,oBAAoB,KAAK,QAAQ,mBAC3D;EAEA,IAAI,WAAW,WAAW,GAAG,OAAO;EAGpC,IAAI,WAAW,SAAS,4BAA4B,GAChD,OAAO;EAIX,KAAK,MAAM,aAAa,YACpB,IAAI,uBAAuB,YAAY,SAAS,GAC5C,OAAO;EAKf,OAAO,WAAW;CACtB,QAAQ,CAER;CACA,OAAO;AACX;;;;AAKA,SAAgB,uBAAuB,YAAoB,YAAmC;CAC1F,MAAM,aAAuB,CAAC;CAK9B,IAAI,MAAM,KAAK,QAAQ,UAAU;CACjC,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;CAC/B,OAAO,QAAQ,QAAQ;EACnB,WAAW,KACP,KAAK,KAAK,KAAK,gBAAgB,YAAY,OAAO,QAAQ,GAC1D,KAAK,KAAK,KAAK,gBAAgB,YAAY,QAAQ,QAAQ,CAC/D;EACA,MAAM,KAAK,QAAQ,GAAG;CAC1B;CAEA,WAAW,KAEP,KAAK,QAAQ,YAAY,MAAM,MAAM,MAAM,YAAY,WAAW,QAAQ,eAAe,EAAE,GAAG,OAAO,QAAQ,GAC7G,KAAK,QAAQ,YAAY,MAAM,MAAM,YAAY,WAAW,QAAQ,eAAe,EAAE,GAAG,OAAO,QAAQ,GACvG,KAAK,QAAQ,YAAY,MAAM,YAAY,WAAW,QAAQ,eAAe,EAAE,GAAG,OAAO,QAAQ,CACrG;CAEA,KAAK,MAAM,aAAa,YACpB,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CAEzC,OAAO;AACX;;;;AAKA,SAAgB,gBAAgB,aAAoC;CAChE,MAAM,cAAc,KAAK,KAAK,aAAa,UAAU;CACrD,OAAO,GAAG,WAAW,WAAW,IAAI,cAAc;AACtD;;;;AAKA,SAAgB,YAAY,aAAoC;CAC5D,MAAM,aAAa,CACf,KAAK,KAAK,aAAa,MAAM,GAC7B,KAAK,KAAK,aAAa,WAAW,MAAM,CAC5C;CAEA,KAAK,MAAM,aAAa,YACpB,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CAGzC,OAAO;AACX;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,YAAY,aAA6C;CACrE,MAAM,UAAU,YAAY,WAAW;CACvC,IAAI,CAAC,WAAW,CAAC,GAAG,WAAW,OAAO,GAAG,OAAO,CAAC;CACjD,IAAI;EACA,OAAO,OAAO,MAAM,GAAG,aAAa,SAAS,OAAO,CAAC;CACzD,QAAQ;EAGJ,OAAO,CAAC;CACZ;AACJ;;;;;AAMA,SAAgB,gBAAgB,aAAqB,SAAgC;CACjF,MAAM,aAAa,CACf,KAAK,KAAK,aAAa,WAAW,gBAAgB,QAAQ,OAAO,GACjE,KAAK,KAAK,aAAa,gBAAgB,QAAQ,OAAO,CAC1D;CAGA,IAAI,SAAS,KAAK,QAAQ,WAAW;CACrC,MAAM,UAAU,KAAK,MAAM,MAAM,CAAC,CAAC;CACnC,OAAO,WAAW,SAAS;EACvB,WAAW,KAAK,KAAK,KAAK,QAAQ,gBAAgB,QAAQ,OAAO,CAAC;EAClE,SAAS,KAAK,QAAQ,MAAM;CAChC;CAEA,KAAK,MAAM,aAAa,YACpB,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CAIzC,IAAI;EACA,MAAM,aAAa,SAAS,SAAS,WAAW,EAAE,UAAU,QAAQ,CAAC,CAAC,CAAC,KAAK;EAC5E,IAAI,cAAc,GAAG,WAAW,UAAU,GAAG,OAAO;CACxD,QAAQ,CAER;CAEA,OAAO;AACX;;;;AAKA,SAAgB,WAAW,aAAoC;CAC3D,OAAO,gBAAgB,aAAa,KAAK;AAC7C;;;;;;;;;;;;;;;;AAiBA,SAAgB,iBAAiB,aAAoC;CACjE,MAAM,QAAQ;EACV,KAAK,KAAK,aAAa,WAAW,SAAS;EAC3C,KAAK,KAAK,aAAa,SAAS;EAChC,OAAO,KAAK;CAChB;CACA,KAAK,MAAM,QAAQ,OACf,IAAI;EACA,OAAO,cAAc,cAAc,IAAI,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC;CAC7D,QAAQ,CAER;CAEJ,OAAO;AACX;;;;;;;;;;;;;;;AAgBA,SAAgB,wBAAwB,YAAmC;CACvE,IAAI;EAEA,MAAM,WAAW,GAAG,aAAa,UAAU;EAG3C,IAAI,MAAM,KAAK,QAAQ,QAAQ;EAC/B,MAAM,SAAS,KAAK,MAAM,GAAG,CAAC,CAAC;EAC/B,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,QAAQ,SAAS;GACvD,MAAM,UAAU,KAAK,KAAK,KAAK,cAAc;GAC7C,IAAI,GAAG,WAAW,OAAO,GACrB,IAAI;IAEA,IADY,KAAK,MAAM,GAAG,aAAa,SAAS,OAAO,CACnD,CAAA,CAAI,SAAS,OAAO;KAEpB,MAAM,gBAAgB,KAAK,KAAK,KAAK,QAAQ,eAAe;KAC5D,IAAI,CAAC,GAAG,WAAW,aAAa,GAC5B,OAAO,kBAAkB,IAAI;KAEjC,OAAO;IACX;GACJ,QAAQ,CAER;GAEJ,MAAM,KAAK,QAAQ,GAAG;EAC1B;EAGA,OAAO;CACX,SAAS,KAAK;EAEV,OAAO,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;CAC3F;AACJ;;;;;;;;;;;;;;;;;;;;;;;AAwBA,SAAgB,yBAAyB,aAA6B;CAElE,OAAO,0CADS,cAAc,qBAAqB,WAAW,CAAC,CAAC,CAAC,QAAQ,KAAK,GAC7B,EAAQ,QAAQ;AACrE;;;;;;;AAQA,SAAgB,6BAA6B,aAA4B;CACrE,QAAQ,MAAM,MAAM,IAAI,KAAK,yBAAyB,WAAW,GAAG,CAAC;CACrE,QAAQ,KAAK,CAAC;AAClB;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoCA,SAAgB,WACZ,SACA,MACA,MACA,QACK;CACL,MAAM,QAAiC;EAAE;EAAS;CAAK;CACvD,IAAI,SAAS,KAAA,GAAW,MAAM,OAAO;CACrC,IAAI,WAAW,KAAA,GAAW,MAAM,SAAS;CACzC,QAAQ,IAAI,KAAK,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CAC9C,QAAQ,KAAK,CAAC;AAClB;;AAGA,SAAgB,gBAAgB,OAA0B,QAAQ,MAAe;CAC7E,OAAO,KAAK,SAAS,QAAQ;AACjC;;;;AAKA,SAAgB,qBAA6B;CACzC,MAAM,OAAO,gBAAgB;CAC7B,IAAI,CAAC,MAAM;EACP,IAAI,gBAAgB,GAIhB,WACI,yCACA,mBACA,mDAAmD,kBAAkB,8EAEzE;EAQJ,QAAQ,MAAM,MAAM,IAAI,yCAAyC,CAAC;EAClE,QAAQ,MAAM,MAAM,KAAK,qDAAqD,kBAAkB,EAAE,CAAC;EACnG,QAAQ,MAAM,MAAM,KAAK,iFAAiF,CAAC;EAC3G,QAAQ,MAAM,MAAM,KAAK,qEAAqE,CAAC;EAC/F,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;;;;AAKA,SAAgB,kBAAkB,aAA6B;CAC3D,MAAM,aAAa,eAAe,WAAW;CAC7C,IAAI,CAAC,YAAY;EACb,IAAI,gBAAgB,GAChB,WACI,wCACA,kBACA,gBAAgB,KAAK,KAAK,aAAa,SAAS,GACpD;EAEJ,QAAQ,MAAM,MAAM,IAAI,wCAAwC,CAAC;EACjE,QAAQ,MAAM,MAAM,KAAK,kBAAkB,KAAK,KAAK,aAAa,SAAS,GAAG,CAAC;EAC/E,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX"}

package/dist/pull-C3PXduzl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"pull-C3PXduzl.js","names":[],"sources":["../src/dev-db/pull.ts"],"sourcesContent":["/**\n * `rebase db pull` — copy a database's contents into local development.\n *\n * The common case is production into local, and the reason it exists is that\n * the alternative is worse: without it people hand-roll a `pg_dump | psql` and\n * get the flags wrong in ways that either fail loudly at 2am or, more often,\n * quietly restore half a schema.\n *\n * Three things this command insists on, because copying a production database\n * onto a laptop is a data-protection event whether or not anyone calls it one:\n *\n * 1. **It says what it is about to do, in full, before doing it** — which\n *    database it will read, which one it will overwrite, and where the data will\n *    come to rest on disk. The target path matters: people forget that\n *    `.rebase/pgdata` is a directory their backup software may be indexing.\n *\n * 2. **It refuses to run unattended without being told to.** The target is\n *    destroyed, so a mistyped `--from` with no confirmation would take the\n *    developer's working database with it.\n *\n * 3. **It will not write to a remote database.** The target is always the local\n *    development database; there is no flag that makes this push. A tool that\n *    can copy in both directions eventually copies in the wrong one.\n *\n * Anonymization is opt-in (`--anonymize`), which is a deliberate choice and not\n * an obviously safe one — the flag nobody types is the flag nobody gets. It is\n * a best-effort pass over columns whose *names* look like personal data, and\n * {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in\n * a column called `notes`, and this file says so rather than implying a\n * guarantee it cannot keep.\n *\n * What it does guarantee is that it never half-happens: {@link anonymizeCopy}\n * runs the pass in one transaction, and when the pass fails it empties the\n * tables it would have rewritten rather than leave their real values behind.\n */\n\nimport { execa } from \"execa\";\nimport fs from \"fs\";\nimport type { Client } from \"pg\";\n\nimport { banner, connectionErrorText, hostOf } from \"./connection-banner\";\nimport { PGLITE_EXTENSIONS } from \"./constraints\";\n\n/**\n * How one kind of personal-looking column is overwritten.\n *\n * Two forms, because a constant is the most readable replacement and is wrong\n * for exactly one kind of column: a unique one. Every `token_hash` becoming\n * `'REDACTED'` is what `UNIQUE(token_hash)` refused on the second row of\n * `rebase.refresh_tokens` — so on any project where someone had signed in twice.\n */\nexport interface AnonymizeRule {\n    pattern: RegExp;\n    /**\n     * Only on tables whose name matches, when set. For a column name that is\n     * personal on one table and not on another: a user's `name` is a person's,\n     * a tag's is not.\n     */\n    tables?: RegExp;\n    /** The value for a column no unique index covers, or null to always use the unique form. */\n    value: string | null;\n    /** The unique form is `prefix` + random hex + `suffix`, cut to fit the column. */\n    prefix: string;\n    suffix: string;\n}\n\n/**\n * Tables whose rows are people, by name: `rebase.users` and the usual spellings\n * of a project's own. Singular or plural.\n */\nconst PERSON_TABLES = /^(users?|user_profiles?|profiles?|people|persons?|members?|customers?|contacts?|employees?)$/i;\n\n/**\n * Column-name patterns the anonymizer overwrites.\n *\n * Names, not contents: inspecting values would be slower, and would still miss\n * the same things. This is a reasonable-effort measure for making a local copy\n * less dangerous, and it is not a compliance control.\n */\nexport const ANONYMIZE_PATTERNS: readonly AnonymizeRule[] = [\n    // Emails are unique in practice even where nothing enforces it, so they\n    // always get a value of their own.\n    { pattern: /^(.*_)?e?mail(_.*)?$/i, value: null, prefix: \"user-\", suffix: \"@example.invalid\" },\n    { pattern: /^(.*_)?(phone|mobile|tel|telephone)(_.*)?$/i, value: \"+10000000000\", prefix: \"+1-\", suffix: \"\" },\n    // `display_name` is how `rebase.users` holds every user's name.\n    {\n        pattern: /^(.*_)?(display_name|first_name|last_name|full_name|middle_name|family_name|surname|given_name)(_.*)?$/i,\n        value: \"Redacted\",\n        prefix: \"Redacted-\",\n        suffix: \"\"\n    },\n    // A bare `name` is a person's only on a table of people.\n    { pattern: /^name$/i, tables: PERSON_TABLES, value: \"Redacted\", prefix: \"Redacted-\", suffix: \"\" },\n    { pattern: /^(.*_)?(address|street|postcode|zip|zipcode)(_.*)?$/i, value: \"Redacted\", prefix: \"Redacted-\", suffix: \"\" },\n    { pattern: /^(.*_)?(ssn|tax_id|national_id|passport)(_.*)?$/i, value: \"REDACTED\", prefix: \"REDACTED-\", suffix: \"\" },\n    { pattern: /^(.*_)?(password|password_hash|secret|token|api_key|access_token|refresh_token)(_.*)?$/i, value: \"REDACTED\", prefix: \"REDACTED-\", suffix: \"\" },\n    { pattern: /^(.*_)?(ip|ip_address|user_agent)(_.*)?$/i, value: \"REDACTED\", prefix: \"REDACTED-\", suffix: \"\" }\n];\n\n/** The rule that overwrites this column, if any. Without a table, a table-bound rule never applies. */\nfunction ruleFor(columnName: string, table?: string): AnonymizeRule | undefined {\n    return ANONYMIZE_PATTERNS.find((rule) =>\n        rule.pattern.test(columnName) && (!rule.tables || (table !== undefined && rule.tables.test(table))));\n}\n\nexport function shouldAnonymize(columnName: string, table?: string): boolean {\n    return ruleFor(columnName, table) !== undefined;\n}\n\n/** A text-ish column the anonymizer can overwrite without a type error. */\nexport interface ColumnRef {\n    schema: string;\n    table: string;\n    column: string;\n    dataType: string;\n    /** `character_maximum_length`: null or absent for an unbounded type. */\n    maxLength?: number | null;\n    /** Covered by a unique index — a primary key, a UNIQUE constraint, or a unique expression index. */\n    unique?: boolean;\n}\n\n/** Random hex of this length, per row. `gen_random_uuid()` is core since PostgreSQL 13. */\nfunction randomHex(length: number): string {\n    return `left(replace(gen_random_uuid()::text, '-', ''), ${length})`;\n}\n\nfunction sqlLiteral(value: string): string {\n    return `'${value.replace(/'/g, \"''\")}'`;\n}\n\n/**\n * Fewest random hex digits a unique replacement keeps. Twelve is 16^12 values:\n * a collision needs millions of rows, where eight would need tens of thousands.\n */\nconst MIN_UNIQUE_HEX = 12;\n\n/**\n * The SQL expression that overwrites one column, or null when no rule names it.\n *\n * Unique per row when an index makes the column unique, and always cut to the\n * column's declared length — `zip char(5)` refused `'Redacted'` outright, and a\n * failed statement now empties the tables rather than skip one. To fit a short\n * unique column the prefix goes first, then the suffix, and the random part is\n * kept to at least {@link MIN_UNIQUE_HEX} digits while there is room for them.\n * A NULL stays NULL: an empty optional field is not personal data.\n */\nexport function replacementFor(column: ColumnRef): string | null {\n    const rule = ruleFor(column.column, column.table);\n    if (!rule) return null;\n    const limit = typeof column.maxLength === \"number\" && column.maxLength > 0 ? column.maxLength : null;\n\n    let value: string;\n    if (rule.value !== null && !column.unique) {\n        value = sqlLiteral(limit === null ? rule.value : rule.value.slice(0, limit));\n    } else {\n        const shapes = [[rule.prefix, rule.suffix], [\"\", rule.suffix], [\"\", \"\"]];\n        const fitting = shapes.find(([prefix, suffix]) =>\n            limit === null || limit - prefix.length - suffix.length >= MIN_UNIQUE_HEX);\n        const [prefix, suffix] = fitting ?? [\"\", \"\"];\n        const hex = Math.min(32, limit === null ? 32 : limit - prefix.length - suffix.length);\n        value = `concat(${sqlLiteral(prefix)}, ${randomHex(Math.max(1, hex))}, ${sqlLiteral(suffix)})`;\n    }\n\n    const name = quoteIdentifier(column.column);\n    return `CASE WHEN ${name} IS NULL THEN NULL ELSE ${value} END`;\n}\n\n/** A double-quoted identifier, with any `\"` in it doubled — a table called `order` or `a\"b` still works. */\nexport function quoteIdentifier(name: string): string {\n    return `\"${name.replace(/\"/g, '\"\"')}\"`;\n}\n\n/**\n * Anonymizable columns: name looks personal, and the type can hold the\n * replacement.\n *\n * The type check is what stops this generating `UPDATE … SET user_id =\n * 'Redacted'` for an integer column called `user_id_email_seq` and failing the\n * whole pass on a technicality.\n */\nexport function anonymizableColumns(columns: readonly ColumnRef[]): ColumnRef[] {\n    const textual = new Set([\"text\", \"character varying\", \"varchar\", \"character\", \"char\", \"citext\"]);\n\n    return columns.filter((column) =>\n        shouldAnonymize(column.column, column.table) && textual.has(column.dataType.toLowerCase()));\n}\n\n/** `\"schema\".\"table\"` for each table the pass rewrites, sorted. */\nexport function anonymizedTables(columns: readonly ColumnRef[]): string[] {\n    return [...new Set(anonymizableColumns(columns).map((column) =>\n        `${quoteIdentifier(column.schema)}.${quoteIdentifier(column.table)}`))].sort();\n}\n\n/** `UPDATE` statements for one anonymization pass, in a stable order. */\nexport function anonymizeStatements(columns: readonly ColumnRef[]): string[] {\n    const byTable = new Map<string, ColumnRef[]>();\n    for (const column of anonymizableColumns(columns)) {\n        const key = `${quoteIdentifier(column.schema)}.${quoteIdentifier(column.table)}`;\n        byTable.set(key, [...(byTable.get(key) ?? []), column]);\n    }\n\n    return [...byTable.entries()]\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([table, cols]) => {\n            const assignments = [...cols]\n                .sort((a, b) => a.column.localeCompare(b.column))\n                .map((column) => `${quoteIdentifier(column.column)} = ${replacementFor(column)}`)\n                .join(\", \");\n\n            return `UPDATE ${table} SET ${assignments};`;\n        });\n}\n\n/**\n * Every column the pass could overwrite, with what decides how.\n *\n * Base tables only — a view has an `email` column too, and is not something to\n * UPDATE. Generated columns are skipped for the same reason: `email_domain\n * GENERATED ALWAYS AS (…)` matches by name and refuses any value but DEFAULT,\n * and it follows the column it is generated from anyway. An extension type such\n * as `citext` reports `USER-DEFINED`, so its own name is what is compared.\n *\n * `unique` comes from the indexes, through `pg_depend` as well as `indkey`: a\n * unique index on `lower(email)` names no column in `indkey`, and is exactly\n * what a constant replacement would violate.\n */\nexport const ANONYMIZE_COLUMNS_SQL = `\nWITH unique_columns AS (\n    SELECT DISTINCT i.indrelid AS relid, a.attname AS column_name\n      FROM pg_index i\n      JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum > 0 AND NOT a.attisdropped\n     WHERE i.indisunique\n       AND (a.attnum = ANY (i.indkey)\n            OR EXISTS (SELECT 1 FROM pg_depend d\n                        WHERE d.classid = 'pg_class'::regclass AND d.objid = i.indexrelid\n                          AND d.refclassid = 'pg_class'::regclass AND d.refobjid = i.indrelid\n                          AND d.refobjsubid = a.attnum))\n)\nSELECT c.table_schema AS \"schema\",\n       c.table_name AS \"table\",\n       c.column_name AS \"column\",\n       CASE WHEN c.data_type = 'USER-DEFINED' THEN c.udt_name ELSE c.data_type END AS \"dataType\",\n       c.character_maximum_length AS \"maxLength\",\n       (u.column_name IS NOT NULL) AS \"unique\"\n  FROM information_schema.columns c\n  JOIN information_schema.tables t ON t.table_schema = c.table_schema AND t.table_name = c.table_name\n  LEFT JOIN unique_columns u\n         ON u.relid = format('%I.%I', c.table_schema, c.table_name)::regclass AND u.column_name = c.column_name\n WHERE t.table_type = 'BASE TABLE'\n   AND c.is_generated = 'NEVER'\n   AND c.table_schema NOT IN ('pg_catalog', 'information_schema')`;\n\n/** How {@link anonymizeCopy} ended. */\nexport type AnonymizeOutcome =\n    | { ok: true; tables: string[] }\n    | {\n        ok: false;\n        /** Why the pass failed. Nothing it wrote was kept. */\n        error: string;\n        /** The tables emptied instead, so none of their real values are left. */\n        emptied: string[];\n        /** Why they could not be emptied, when they could not: the copy then holds real data. */\n        emptyError: string | null;\n    };\n\nfunction errorText(error: unknown): string {\n    return error instanceof Error && error.message ? error.message : String(error);\n}\n\n/**\n * Overwrite the personal-looking columns of a restored copy, all or nothing.\n *\n * One transaction, so a failure part-way leaves no table half done — the old\n * pass ran its UPDATEs one by one, so a failure on `rebase.refresh_tokens` left\n * `public.authors` anonymized and `rebase.users` holding every real email.\n *\n * A rollback alone would be worse than that, though: it puts back the real\n * value of every column, in a copy the developer asked to be anonymized. So on\n * failure the tables the pass would have rewritten are emptied (`TRUNCATE …\n * CASCADE`, which takes the rows that reference them too), and the outcome\n * says which — or, if even that failed, says the copy holds real data, so the\n * caller can say it louder.\n *\n * `row_security = off` makes a role that RLS would filter fail the pass instead\n * of rewriting only the rows its policies show it, which looked like success.\n */\nexport async function anonymizeCopy(client: Client): Promise<AnonymizeOutcome> {\n    let listed = false;\n    let tables: string[] = [];\n    try {\n        const { rows } = await client.query<ColumnRef>(ANONYMIZE_COLUMNS_SQL);\n        tables = anonymizedTables(rows);\n        listed = true;\n        await client.query(\"BEGIN\");\n        await client.query(\"SET LOCAL row_security = off\");\n        for (const statement of anonymizeStatements(rows)) await client.query(statement);\n        await client.query(\"COMMIT\");\n\n        return { ok: true, tables };\n    } catch (error) {\n        const reason = errorText(error);\n        await client.query(\"ROLLBACK\").catch(() => undefined);\n        if (!listed) {\n            return { ok: false, error: reason, emptied: [], emptyError: \"the tables to empty could not be listed\" };\n        }\n        if (tables.length === 0) return { ok: false, error: reason, emptied: [], emptyError: null };\n        try {\n            await client.query(`TRUNCATE TABLE ${tables.join(\", \")} CASCADE`);\n\n            return { ok: false, error: reason, emptied: tables, emptyError: null };\n        } catch (emptyError) {\n            return { ok: false, error: reason, emptied: [], emptyError: errorText(emptyError) };\n        }\n    }\n}\n\n/**\n * Schemas the restored copy needs the app role provisioned on.\n *\n * `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives\n * with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no\n * privileges behind them. Measured on a 30-table project: 68 policies restored,\n * 14 tables with RLS on, and **0** grants to `rebase_user` — where the source\n * had 60. Reading one table as the role Rebase serves every request through:\n *\n *     source:  6\n *     copy:    ERROR: permission denied for table leads\n *\n * The dump flags are right and stay: without `--no-owner`/`--no-privileges`\n * every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails\n * against roles that do not exist on a laptop, and buries the real output. The\n * repair belongs after the restore, and belongs to `ensureAppRole` — the same\n * routine boot and `rebase db push` call — rather than to a second list of\n * grants written here.\n *\n * Which schemas: every non-system schema the restored database actually has.\n * Boot knows its `managedSchemas` from the collections; a restore knows only\n * what arrived, and a source may carry schemas this project does not declare.\n * `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to\n * grant on and PostgreSQL would refuse anyway.\n */\nexport function provisionableSchemas(rows: readonly { schema: string }[]): string[] {\n    const skip = (name: string) => name === \"information_schema\" || name.startsWith(\"pg_\");\n\n    return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();\n}\n\n/** Host and database of a connection string, with no credentials in it. */\nexport function describeTarget(connectionString: string): string {\n    try {\n        const url = new URL(connectionString);\n        const database = url.pathname.replace(/^\\//, \"\") || \"(default)\";\n\n        return `${url.hostname}${url.port ? `:${url.port}` : \"\"}/${database}`;\n    } catch {\n        // Never echo the raw string: it carries a password, and this line is\n        // printed to a terminal people paste into issues.\n        return \"(unparseable connection string)\";\n    }\n}\n\n/**\n * What the local database runs on.\n *\n * `pglite` is the managed development database: one PGlite session behind a\n * socket server. Two things a restore relies on are not there. The server runs\n * each protocol message on its own, so the `CopyData` that follows a `COPY …\n * FROM stdin` never reaches the backend waiting for it: the COPY fails on\n * \"unexpected EOF\", and the session stops answering anyone until the daemon\n * is killed. And every connection shares that one session, so what pg_restore\n * `SET`s for itself stays set for everyone after it disconnects.\n */\nexport type PullTargetEngine = \"postgres\" | \"pglite\";\n\nexport interface PullPlan {\n    /** Where the data comes from. */\n    source: string;\n    /** Where it lands. Always local. */\n    target: string;\n    anonymize: boolean;\n    /** Schemas to copy. Empty means every non-system schema. */\n    schemas: string[];\n    /**\n     * What the target runs on, which decides how the dump carries its rows.\n     * Absent means `postgres`. {@link dumpSource} reads it off the target.\n     */\n    targetEngine?: PullTargetEngine;\n}\n\n/**\n * Rows per `INSERT` in a dump for the managed database.\n *\n * One per statement restored 100k rows in 8s; a hundred took 0.8s. A hundred\n * 512KB rows, a 100MB statement, still went in.\n */\nconst ROWS_PER_INSERT = 100;\n\n/**\n * `pg_dump` arguments for the source.\n *\n * `--no-owner` and `--no-acl` because the roles on a production server do not\n * exist locally, and without them every `ALTER … OWNER TO` in the dump fails and\n * buries the real output in noise. `--format=custom` so `pg_restore` can be told\n * to continue past errors selectively rather than all-or-nothing.\n *\n * For the managed database the rows travel as `INSERT`s, which PGlite takes\n * like any other statement, instead of `COPY` data, which it cannot take at\n * all — see {@link PullTargetEngine}. The copy is the same; only how the rows\n * are written in the dump differs.\n */\nexport function dumpArgs(plan: PullPlan): string[] {\n    const args = [\"--format=custom\", \"--no-owner\", \"--no-acl\", \"--no-privileges\"];\n    if (plan.targetEngine === \"pglite\") args.push(`--rows-per-insert=${ROWS_PER_INSERT}`);\n    for (const schema of plan.schemas) args.push(\"--schema\", schema);\n    args.push(\"--dbname\", splitPassword(plan.source).connectionString);\n\n    return args;\n}\n\n/** The environment `pg_dump` runs with: the source's password, if it has one. */\nexport function dumpEnv(plan: PullPlan): Record<string, string> {\n    return passwordEnv(plan.source);\n}\n\n/** The environment `pg_restore` runs with: the target's password, if it has one. */\nexport function restoreEnv(plan: PullPlan): Record<string, string> {\n    return passwordEnv(plan.target);\n}\n\nfunction passwordEnv(connectionString: string): Record<string, string> {\n    const { password } = splitPassword(connectionString);\n    return password === null ? {} : { PGPASSWORD: password };\n}\n\n/**\n * A libpq connection string without its password, and the password.\n *\n * The password goes in `PGPASSWORD`, never on a command line, where every\n * process listing can read it and every failure prints it back (execa's error\n * repeats the command). The same rule `db backup` follows; this mirrors\n * `splitPassword` in `@rebasepro/server-postgres`'s connection-string utils,\n * which is not exported. Covers the user-info password and a `password=`\n * parameter; anything that does not parse as a postgres URL is left alone.\n */\nfunction splitPassword(connectionString: string): { connectionString: string; password: string | null } {\n    let url: URL;\n    try {\n        url = new URL(connectionString);\n    } catch {\n        return { connectionString, password: null };\n    }\n    if (url.protocol !== \"postgres:\" && url.protocol !== \"postgresql:\") return { connectionString, password: null };\n\n    const fromUserInfo = url.password ? decodePercent(url.password) : null;\n    const fromParameter = url.searchParams.get(\"password\");\n    if (fromUserInfo === null && fromParameter === null) return { connectionString, password: null };\n\n    url.password = \"\";\n    if (fromParameter !== null) {\n        url.searchParams.delete(\"password\");\n        // By hand: URLSearchParams writes a space as `+`, which libpq reads literally.\n        url.search = Array.from(url.searchParams.entries())\n            .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n            .join(\"&\");\n    }\n    return { connectionString: url.toString(), password: fromUserInfo ?? fromParameter };\n}\n\nfunction decodePercent(value: string): string {\n    try {\n        return decodeURIComponent(value);\n    } catch {\n        return value;\n    }\n}\n\n/**\n * `pg_restore` arguments for the target.\n *\n * It restores into schemas {@link restoreCopy} has already emptied, so\n * `--clean --if-exists` drops nothing that is there; it stays for whatever a\n * dump holds outside them — an extension, say — which would otherwise fail as\n * already existing. `--no-owner` for the same reason as the dump.\n */\nexport function restoreArgs(plan: PullPlan, dumpFile: string): string[] {\n    return [\"--clean\", \"--if-exists\", \"--no-owner\", \"--no-privileges\", \"--dbname\", splitPassword(plan.target).connectionString, dumpFile];\n}\n\n/**\n * Is this PostgreSQL client tool on PATH, and what version? Both are checked\n * before anything destructive: discovering `pg_restore` is missing after the\n * dump has been taken — or after `--clean` has emptied the target — is the\n * worst possible ordering.\n */\nexport async function findPgTool(tool: \"pg_dump\" | \"pg_restore\"): Promise<string | null> {\n    try {\n        const { stdout } = await execa(tool, [\"--version\"]);\n\n        return stdout.trim();\n    } catch {\n        return null;\n    }\n}\n\n/** PGlite names itself in `version()`: `PostgreSQL 18.3 (PGlite 0.5.6) on wasm32-…`. */\nfunction engineOf(version: string): PullTargetEngine {\n    return /\\bPGlite\\b/i.test(version) ? \"pglite\" : \"postgres\";\n}\n\nconst NOTHING_CHANGED = \"Nothing was changed: the local database is as it was.\";\n\n/** What the target database runs on, or why it could not be asked. */\nasync function readTargetEngine(target: string): Promise<{ engine: PullTargetEngine } | { error: unknown }> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: target, connectionTimeoutMillis: 10_000 });\n    client.on(\"error\", () => undefined);\n    try {\n        await client.connect();\n        const { rows } = await client.query<{ version: string }>(\"SELECT version() AS version\");\n\n        return { engine: engineOf(rows[0]?.version ?? \"\") };\n    } catch (error) {\n        return { error };\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n}\n\n/** How {@link dumpSource} ended. */\nexport type DumpOutcome =\n    | {\n        ok: true;\n        /** The plan the dump was taken for, with its target's engine read: what {@link restoreCopy} takes. */\n        plan: PullPlan;\n    }\n    | {\n        ok: false;\n        /** What failed and what to do, as plain lines for the caller to print. Nothing was changed. */\n        lines: string[];\n    };\n\n/**\n * `pg_dump` the source into `dumpFile`, in the form the target can restore.\n *\n * It asks the target what it runs on first — the managed database cannot take\n * `COPY` data, see {@link PullTargetEngine} — which also finds a local\n * database that is not there before anything is read from the source.\n *\n * pg_dump's stderr is kept rather than shown as it arrives, so a failure is\n * reported once, in the reader's terms: an unreachable source, or credentials\n * it refused, get the banner every database command prints for a connection\n * that failed, and anything else is pg_dump's own words with a line saying\n * nothing was changed. A dump that succeeds with warnings still shows them.\n * A dump that fails leaves no file behind.\n */\nexport async function dumpSource(plan: PullPlan, dumpFile: string): Promise<DumpOutcome> {\n    try {\n        const outcome = await dumpInto(plan, dumpFile);\n        if (!outcome.ok) fs.rmSync(dumpFile, { force: true });\n\n        return outcome;\n    } catch (error) {\n        fs.rmSync(dumpFile, { force: true });\n        throw error;\n    }\n}\n\nasync function dumpInto(plan: PullPlan, dumpFile: string): Promise<DumpOutcome> {\n    let targetEngine = plan.targetEngine;\n    if (!targetEngine) {\n        const read = await readTargetEngine(plan.target);\n        if (\"error\" in read) {\n            return {\n                ok: false,\n                lines: banner(`Cannot connect to PostgreSQL at ${hostOf(plan.target)}`,\n                    `The driver said: ${connectionErrorText(read.error)}`, [\n                        \"That is the local database the pull would replace, and nothing\",\n                        \"was read from the source.\",\n                        \"Start it — `rebase dev` starts the managed one, `rebase dev --docker`\",\n                        \"Postgres in Docker — or check DATABASE_URL in .env, then pull again.\"\n                    ])\n            };\n        }\n        targetEngine = read.engine;\n    }\n\n    const planned: PullPlan = { ...plan, targetEngine };\n    const run = await execa(\"pg_dump\", [...dumpArgs(planned), \"--file\", dumpFile], {\n        env: dumpEnv(planned),\n        stdin: \"ignore\",\n        stdout: \"inherit\",\n        stderr: \"pipe\",\n        reject: false\n    });\n    if (run.exitCode === 0) {\n        if (run.stderr.trim()) process.stderr.write(`${run.stderr.trimEnd()}\\n`);\n\n        return { ok: true, plan: planned };\n    }\n\n    return { ok: false, lines: describeDumpFailure(plan.source, run) };\n}\n\n/**\n * Why `pg_dump` could not read the source, as plain lines for the caller to\n * print. The dump is taken before anything local is touched, so every one of\n * them ends the same way: nothing was changed.\n */\nexport function describeDumpFailure(source: string, run: RestoreRun): string[] {\n    if (run.signal) return [`✗ pg_dump was stopped by ${run.signal} before it finished.`, NOTHING_CHANGED];\n    if (run.exitCode === undefined) {\n        return [\n            `✗ pg_dump could not be started (${run.code ?? \"unknown error\"}).`,\n            NOTHING_CHANGED,\n            \"Check that the PostgreSQL client tools are installed (`pg_dump --version`).\"\n        ];\n    }\n\n    const stderr = (run.stderr ?? \"\").trim();\n    const host = hostOf(source);\n    const error = /pg_dump: error: (.+)/.exec(stderr)?.[1]?.trim() ?? null;\n    const said = error ? `pg_dump said: ${error}` : null;\n\n    if (/could not translate host name|could not connect to server|connection to server .* failed: (?:Connection refused|timeout expired|No route to host|Network is unreachable|Operation timed out|Host is down)/i.test(stderr)) {\n        return banner(`Cannot connect to PostgreSQL at ${host}`, said, [\n            \"That is the database --from names, which the pull reads.\",\n            NOTHING_CHANGED,\n            \"Check the host and port in --from, and that this machine can reach\",\n            \"that server: a VPN, an allow-list, or an SSH tunnel.\"\n        ]);\n    }\n    if (/password authentication failed|no pg_hba\\.conf entry|role \"[^\"]+\" does not exist/i.test(stderr)) {\n        let user = \"unknown\";\n        try {\n            user = decodePercent(new URL(source).username) || \"unknown\";\n        } catch { /* named as unknown */ }\n        return banner(`Authentication failed for user \"${user}\" at ${host}`, said, [\n            \"PostgreSQL rejected the credentials --from carries.\",\n            NOTHING_CHANGED,\n            \"Check the user and password in --from.\"\n        ]);\n    }\n    // The server answered and has no database of that name: a typo in\n    // --from, usually, or a database not created yet.\n    const missing = /database \"([^\"]+)\" does not exist/i.exec(stderr)?.[1];\n    if (missing) {\n        return banner(`Database \"${missing}\" does not exist at ${host}`, said, [\n            \"That is the database --from names, which the pull reads.\",\n            NOTHING_CHANGED,\n            \"Check the database name in --from.\"\n        ]);\n    }\n\n    const versions = /server version mismatch/i.test(stderr)\n        ? [\"pg_dump is older than the server: install client tools at least as new as it (`brew install libpq`).\"]\n        : [];\n    return [\n        ...(stderr ? stderr.split(\"\\n\") : []),\n        `✗ pg_dump could not dump ${describeTarget(source)} (exit code ${run.exitCode}).`,\n        NOTHING_CHANGED,\n        ...versions\n    ];\n}\n\n/** The fields of a finished `pg_restore` (or `pg_dump`) run that decide {@link restoreOutcome}. */\nexport interface RestoreRun {\n    exitCode?: number;\n    signal?: string;\n    /** A spawn failure's code — `ENOENT` when the binary vanished. */\n    code?: string;\n    stderr?: string;\n}\n\n/** What a `pg_restore` run says about the copy. */\nexport interface RestoreRunOutcome {\n    /** Whether anything can have arrived — what decides whether an anonymization pass has data to redact. */\n    started: boolean;\n    /** Null when the copy is complete. */\n    failure: string | null;\n    /**\n     * What to do about the failure. \"Pull again\" only where a second pull is\n     * what finishes the job: everything else repeats until its cause is fixed.\n     */\n    advice: string | null;\n}\n\n/**\n * What a finished `pg_restore` says about the copy.\n *\n * The target was emptied before anything was written, so every way this can\n * end short of exit 0 leaves a partial or empty local database, and none of\n * them may be reported as a copy. A non-zero exit is pg_restore saying it\n * skipped statements — \"errors ignored on restore: N\" — and whatever those\n * statements created (a table, its rows, an RLS policy) is missing locally.\n *\n * Restoring into an emptied database, those errors come from what the source\n * holds that this Postgres cannot create — an extension it does not have, a\n * feature of a newer server — and a second pull meets them again. So the\n * advice names that, rather than \"pull again\", which sent people in a loop.\n * On the managed database an extension cannot be installed at all, so the\n * advice there is Postgres in Docker.\n */\nexport function restoreOutcome(run: RestoreRun, engine: PullTargetEngine = \"postgres\"): RestoreRunOutcome {\n    if (run.signal) {\n        return {\n            started: true,\n            failure: `pg_restore was stopped by ${run.signal} before it finished.`,\n            advice: \"It was interrupted, not refused: pull again to finish the copy.\"\n        };\n    }\n    if (run.exitCode === undefined) {\n        return {\n            started: false,\n            failure: `pg_restore could not be started (${run.code ?? \"unknown error\"}).`,\n            advice: \"Check that the PostgreSQL client tools are installed (`pg_restore --version`), then pull again.\"\n        };\n    }\n    if (run.exitCode === 0) return { started: true, failure: null, advice: null };\n\n    const ignored = /errors ignored on restore: (\\d+)/.exec(run.stderr ?? \"\");\n    const repeats = engine === \"pglite\"\n        ? \"Pulling again repeats these errors until what they name is fixed — most often an extension the \"\n            + `source uses that the managed database does not have (it has ${PGLITE_EXTENSIONS.map(extension => extension.name).join(\", \")}). `\n            + \"Pull into Postgres in Docker instead (`rebase db pull --docker`), or pull only the schemas that do \"\n            + \"not need it (--schema).\"\n        : \"Pulling again repeats these errors until what they name is fixed — most often an extension \"\n            + \"the source uses that this Postgres does not have installed. Install it here, or pull only the schemas \"\n            + \"that do not need it (--schema).\";\n\n    return {\n        started: true,\n        failure: ignored\n            ? `pg_restore could not restore ${ignored[1]} object(s) — the errors are above.`\n            : `pg_restore exited with code ${run.exitCode} — the errors are above.`,\n        advice: repeats\n    };\n}\n\n/** How {@link restoreCopy} ended. */\nexport interface RestoreOutcome extends RestoreRunOutcome {\n    /** Whether the local database was emptied first. False means it is exactly as it was. */\n    cleared: boolean;\n}\n\n/**\n * The local schemas a pull empties before it restores: every one of the local\n * database's own for a whole-database pull, and those it copies for a\n * `--schema` pull. `pg_catalog`, `information_schema` and the `pg_*` internals\n * never — see {@link provisionableSchemas}.\n */\nexport function schemasToClear(present: readonly { schema: string }[], planned: readonly string[]): string[] {\n    const local = provisionableSchemas(present);\n\n    return planned.length === 0 ? local : local.filter((schema) => planned.includes(schema));\n}\n\n/**\n * The statements that empty those schemas, in one transaction.\n *\n * `CASCADE`, which `pg_restore --clean` never uses: a table the source lacks —\n * `rebase.atlas_schema_revisions` from `rebase db migrate`, a collection added\n * locally that references a pulled table — is exactly what blocked its plain\n * `DROP SCHEMA` and `DROP TABLE`. `public` is put back empty, with the access\n * every role has to it by default, because a dump does not create a default\n * `public` and every table in it would otherwise have nowhere to go.\n */\nexport function clearStatements(schemas: readonly string[]): string[] {\n    const statements = schemas.map((schema) => `DROP SCHEMA IF EXISTS ${quoteIdentifier(schema)} CASCADE`);\n    if (schemas.includes(\"public\")) statements.push(\"CREATE SCHEMA public\", \"GRANT USAGE ON SCHEMA public TO PUBLIC\");\n\n    return statements;\n}\n\n/**\n * How long emptying the local database waits for a lock before giving up.\n *\n * A `rebase dev` serving from the database holds connections, and one inside\n * a transaction would otherwise make the pull hang without a word.\n */\nconst CLEAR_LOCK_TIMEOUT = \"15s\";\n\n/** Why emptying the local database failed, in the reader's terms, and what fixes it. */\nfunction clearFailure(error: unknown): RestoreOutcome {\n    const code = typeof error === \"object\" && error !== null && \"code\" in error ? String(error.code) : \"\";\n    const reason = errorText(error);\n    const advice = code === \"55P03\"\n        ? \"Something holds a lock on it — usually `rebase dev` serving from it. Stop that, then pull again.\"\n        : code === \"42501\"\n            ? \"This connection may not drop those schemas. Connect as the role that owns them — the one \"\n                + \"that created them — and pull with that.\"\n            : \"Fix what the error names; pulling again before that repeats it.\";\n\n    return {\n        cleared: false,\n        started: false,\n        failure: `Could not empty the local database before restoring: ${reason}`,\n        advice\n    };\n}\n\n/**\n * Replace the local database's contents with a dump: empty the schemas it\n * holds, then `pg_restore` into them.\n *\n * Only ever `plan.target`, the local development database the command\n * resolved — the pull's one destination, which no flag can change. Emptying it\n * is one transaction: if any schema cannot be dropped, none is, nothing is\n * restored, and the database is as it was.\n *\n * On the managed database the dump must be one {@link dumpSource} took for it,\n * with its rows as INSERTs: a COPY would leave the daemon answering nobody, so\n * one is refused before anything is emptied. And afterwards its one session —\n * every connection's — is given back its own settings: pg_restore leaves\n * `search_path` empty and `row_security` off behind it, which a running\n * `rebase dev` would otherwise query under.\n */\nexport async function restoreCopy(plan: PullPlan, dumpFile: string): Promise<RestoreOutcome> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: plan.target });\n    client.on(\"error\", () => undefined);\n    let engine: PullTargetEngine;\n    try {\n        await client.connect();\n        engine = engineOf((await client.query<{ version: string }>(\"SELECT version() AS version\")).rows[0]?.version ?? \"\");\n        if (engine === \"pglite\" && plan.targetEngine !== \"pglite\") {\n            return {\n                cleared: false,\n                started: false,\n                failure: \"The managed development database cannot take this dump: its rows are COPY data, which PGlite's socket server cannot receive.\",\n                advice: \"Pull into Postgres in Docker instead: `rebase db pull --docker`.\"\n            };\n        }\n        const { rows } = await client.query<{ schema: string }>(\"SELECT nspname AS \\\"schema\\\" FROM pg_namespace\");\n        await client.query(\"BEGIN\");\n        await client.query(`SET LOCAL lock_timeout = '${CLEAR_LOCK_TIMEOUT}'`);\n        for (const statement of clearStatements(schemasToClear(rows, plan.schemas))) await client.query(statement);\n        await client.query(\"COMMIT\");\n    } catch (error) {\n        await client.query(\"ROLLBACK\").catch(() => undefined);\n        return clearFailure(error);\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n\n    // stderr is shown as it arrives and kept, for the count in its summary\n    // line. Not rejected: every way this ends is judged by `restoreOutcome`.\n    const run = await execa(\"pg_restore\", restoreArgs(plan, dumpFile), {\n        env: restoreEnv(plan),\n        stdin: \"ignore\",\n        stdout: \"inherit\",\n        stderr: [\"pipe\", \"inherit\"],\n        reject: false\n    });\n\n    if (engine === \"pglite\") await resetSharedSession(plan.target);\n\n    return { cleared: true, ...restoreOutcome(run, engine) };\n}\n\n/**\n * Put the managed database's one session back to its own settings.\n *\n * `RESET ALL` and `DEALLOCATE ALL`, not `DISCARD ALL`: the session is every\n * connection's, and `DISCARD` would also drop the `LISTEN` a running\n * `rebase dev`'s realtime holds on it. The same pair the backup service runs\n * after its tools (`resetSharedSession` in server-postgres' backup-service). Best effort: a daemon that cannot take this cannot take the\n * re-grant that follows either, and that step reports it.\n */\nasync function resetSharedSession(target: string): Promise<void> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString: target, connectionTimeoutMillis: 10_000, query_timeout: 15_000 });\n    client.on(\"error\", () => undefined);\n    try {\n        await client.connect();\n        await client.query(\"RESET ALL\");\n        await client.query(\"DEALLOCATE ALL\");\n    } catch {\n        // Reported by the next step that connects; see above.\n    } finally {\n        await client.end().catch(() => undefined);\n    }\n}\n\n/**\n * The lines that report a failed restore: what failed, what state the local\n * database is in now, and what to do. Plain text, for the caller to colour.\n */\nexport function describeRestoreFailure(outcome: RestoreOutcome, source: string): string[] {\n    const state = outcome.started\n        ? `The local database holds an incomplete copy of ${source}.`\n        : outcome.cleared\n            ? \"The local database was emptied, and nothing was restored into it.\"\n            : \"Nothing was restored, and the local database is as it was.\";\n\n    return [outcome.failure ?? \"The restore did not complete.\", state, ...(outcome.advice ? [outcome.advice] : [])];\n}\n"],"mappings":";;;;;;;;;;;AA+EA,IAAa,qBAA+C;CAGxD;EAAE,SAAS;EAAyB,OAAO;EAAM,QAAQ;EAAS,QAAQ;CAAmB;CAC7F;EAAE,SAAS;EAA+C,OAAO;EAAgB,QAAQ;EAAO,QAAQ;CAAG;CAE3G;EACI,SAAS;EACT,OAAO;EACP,QAAQ;EACR,QAAQ;CACZ;CAEA;EAAE,SAAS;EAAW,QAAQ;EAAe,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CAChG;EAAE,SAAS;EAAwD,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CACtH;EAAE,SAAS;EAAoD,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CAClH;EAAE,SAAS;EAA2F,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CACzJ;EAAE,SAAS;EAA6C,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;AAC/G;;AAGA,SAAS,QAAQ,YAAoB,OAA2C;CAC5E,OAAO,mBAAmB,MAAM,SAC5B,KAAK,QAAQ,KAAK,UAAU,MAAM,CAAC,KAAK,UAAW,UAAU,KAAA,KAAa,KAAK,OAAO,KAAK,KAAK,EAAG;AAC3G;AAEA,SAAgB,gBAAgB,YAAoB,OAAyB;CACzE,OAAO,QAAQ,YAAY,KAAK,MAAM,KAAA;AAC1C;;AAeA,SAAS,UAAU,QAAwB;CACvC,OAAO,mDAAmD,OAAO;AACrE;AAEA,SAAS,WAAW,OAAuB;CACvC,OAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AACzC;;;;;AAMA,IAAM,iBAAiB;;;;;;;;;;;AAYvB,SAAgB,eAAe,QAAkC;CAC7D,MAAM,OAAO,QAAQ,OAAO,QAAQ,OAAO,KAAK;CAChD,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,QAAQ,OAAO,OAAO,cAAc,YAAY,OAAO,YAAY,IAAI,OAAO,YAAY;CAEhG,IAAI;CACJ,IAAI,KAAK,UAAU,QAAQ,CAAC,OAAO,QAC/B,QAAQ,WAAW,UAAU,OAAO,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,KAAK,CAAC;MACxE;EAIH,MAAM,CAAC,QAAQ,UAFC;GADA,CAAC,KAAK,QAAQ,KAAK,MAAM;GAAG,CAAC,IAAI,KAAK,MAAM;GAAG,CAAC,IAAI,EAAE;EACtD,CAAA,CAAO,MAAM,CAAC,QAAQ,YAClC,UAAU,QAAQ,QAAQ,OAAO,SAAS,OAAO,UAAU,cACtC,KAAW,CAAC,IAAI,EAAE;EAC3C,MAAM,MAAM,KAAK,IAAI,IAAI,UAAU,OAAO,KAAK,QAAQ,OAAO,SAAS,OAAO,MAAM;EACpF,QAAQ,UAAU,WAAW,MAAM,EAAE,IAAI,UAAU,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,WAAW,MAAM,EAAE;CAChG;CAGA,OAAO,aADM,gBAAgB,OAAO,MAChB,EAAK,0BAA0B,MAAM;AAC7D;;AAGA,SAAgB,gBAAgB,MAAsB;CAClD,OAAO,IAAI,KAAK,QAAQ,MAAM,MAAI,EAAE;AACxC;;;;;;;;;AAUA,SAAgB,oBAAoB,SAA4C;CAC5E,MAAM,0BAAU,IAAI,IAAI;EAAC;EAAQ;EAAqB;EAAW;EAAa;EAAQ;CAAQ,CAAC;CAE/F,OAAO,QAAQ,QAAQ,WACnB,gBAAgB,OAAO,QAAQ,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,YAAY,CAAC,CAAC;AAClG;;AAGA,SAAgB,iBAAiB,SAAyC;CACtE,OAAO,CAAC,GAAG,IAAI,IAAI,oBAAoB,OAAO,CAAC,CAAC,KAAK,WACjD,GAAG,gBAAgB,OAAO,MAAM,EAAE,GAAG,gBAAgB,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK;AACrF;;AAGA,SAAgB,oBAAoB,SAAyC;CACzE,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC/C,MAAM,MAAM,GAAG,gBAAgB,OAAO,MAAM,EAAE,GAAG,gBAAgB,OAAO,KAAK;EAC7E,QAAQ,IAAI,KAAK,CAAC,GAAI,QAAQ,IAAI,GAAG,KAAK,CAAC,GAAI,MAAM,CAAC;CAC1D;CAEA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,OAAO,UAAU;EAMpB,OAAO,UAAU,MAAM,OALH,CAAC,GAAG,IAAI,CAAC,CACxB,MAAM,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC,CAAC,CAChD,KAAK,WAAW,GAAG,gBAAgB,OAAO,MAAM,EAAE,KAAK,eAAe,MAAM,GAAG,CAAC,CAChF,KAAK,IAEoB,EAAY;CAC9C,CAAC;AACT;;;;;;;;;;;;;;AAeA,IAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;AAuCrC,SAAS,UAAU,OAAwB;CACvC,OAAO,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU,OAAO,KAAK;AACjF;;;;;;;;;;;;;;;;;;AAmBA,eAAsB,cAAc,QAA2C;CAC3E,IAAI,SAAS;CACb,IAAI,SAAmB,CAAC;CACxB,IAAI;EACA,MAAM,EAAE,SAAS,MAAM,OAAO,MAAiB,qBAAqB;EACpE,SAAS,iBAAiB,IAAI;EAC9B,SAAS;EACT,MAAM,OAAO,MAAM,OAAO;EAC1B,MAAM,OAAO,MAAM,8BAA8B;EACjD,KAAK,MAAM,aAAa,oBAAoB,IAAI,GAAG,MAAM,OAAO,MAAM,SAAS;EAC/E,MAAM,OAAO,MAAM,QAAQ;EAE3B,OAAO;GAAE,IAAI;GAAM;EAAO;CAC9B,SAAS,OAAO;EACZ,MAAM,SAAS,UAAU,KAAK;EAC9B,MAAM,OAAO,MAAM,UAAU,CAAC,CAAC,YAAY,KAAA,CAAS;EACpD,IAAI,CAAC,QACD,OAAO;GAAE,IAAI;GAAO,OAAO;GAAQ,SAAS,CAAC;GAAG,YAAY;EAA0C;EAE1G,IAAI,OAAO,WAAW,GAAG,OAAO;GAAE,IAAI;GAAO,OAAO;GAAQ,SAAS,CAAC;GAAG,YAAY;EAAK;EAC1F,IAAI;GACA,MAAM,OAAO,MAAM,kBAAkB,OAAO,KAAK,IAAI,EAAE,SAAS;GAEhE,OAAO;IAAE,IAAI;IAAO,OAAO;IAAQ,SAAS;IAAQ,YAAY;GAAK;EACzE,SAAS,YAAY;GACjB,OAAO;IAAE,IAAI;IAAO,OAAO;IAAQ,SAAS,CAAC;IAAG,YAAY,UAAU,UAAU;GAAE;EACtF;CACJ;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,MAA+C;CAChF,MAAM,QAAQ,SAAiB,SAAS,wBAAwB,KAAK,WAAW,KAAK;CAErF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;AAC1F;;AAGA,SAAgB,eAAe,kBAAkC;CAC7D,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,MAAM,WAAW,IAAI,SAAS,QAAQ,OAAO,EAAE,KAAK;EAEpD,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,GAAG;CAC/D,QAAQ;EAGJ,OAAO;CACX;AACJ;;;;;;;AAoCA,IAAM,kBAAkB;;;;;;;;;;;;;;AAexB,SAAgB,SAAS,MAA0B;CAC/C,MAAM,OAAO;EAAC;EAAmB;EAAc;EAAY;CAAiB;CAC5E,IAAI,KAAK,iBAAiB,UAAU,KAAK,KAAK,qBAAqB,iBAAiB;CACpF,KAAK,MAAM,UAAU,KAAK,SAAS,KAAK,KAAK,YAAY,MAAM;CAC/D,KAAK,KAAK,YAAY,cAAc,KAAK,MAAM,CAAC,CAAC,gBAAgB;CAEjE,OAAO;AACX;;AAGA,SAAgB,QAAQ,MAAwC;CAC5D,OAAO,YAAY,KAAK,MAAM;AAClC;;AAGA,SAAgB,WAAW,MAAwC;CAC/D,OAAO,YAAY,KAAK,MAAM;AAClC;AAEA,SAAS,YAAY,kBAAkD;CACnE,MAAM,EAAE,aAAa,cAAc,gBAAgB;CACnD,OAAO,aAAa,OAAO,CAAC,IAAI,EAAE,YAAY,SAAS;AAC3D;;;;;;;;;;;AAYA,SAAS,cAAc,kBAAiF;CACpG,IAAI;CACJ,IAAI;EACA,MAAM,IAAI,IAAI,gBAAgB;CAClC,QAAQ;EACJ,OAAO;GAAE;GAAkB,UAAU;EAAK;CAC9C;CACA,IAAI,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,OAAO;EAAE;EAAkB,UAAU;CAAK;CAE9G,MAAM,eAAe,IAAI,WAAW,cAAc,IAAI,QAAQ,IAAI;CAClE,MAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU;CACrD,IAAI,iBAAiB,QAAQ,kBAAkB,MAAM,OAAO;EAAE;EAAkB,UAAU;CAAK;CAE/F,IAAI,WAAW;CACf,IAAI,kBAAkB,MAAM;EACxB,IAAI,aAAa,OAAO,UAAU;EAElC,IAAI,SAAS,MAAM,KAAK,IAAI,aAAa,QAAQ,CAAC,CAAC,CAC9C,KAAK,CAAC,KAAK,WAAW,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,KAAK,GAAG,CAAC,CAChF,KAAK,GAAG;CACjB;CACA,OAAO;EAAE,kBAAkB,IAAI,SAAS;EAAG,UAAU,gBAAgB;CAAc;AACvF;AAEA,SAAS,cAAc,OAAuB;CAC1C,IAAI;EACA,OAAO,mBAAmB,KAAK;CACnC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;AAUA,SAAgB,YAAY,MAAgB,UAA4B;CACpE,OAAO;EAAC;EAAW;EAAe;EAAc;EAAmB;EAAY,cAAc,KAAK,MAAM,CAAC,CAAC;EAAkB;CAAQ;AACxI;;;;;;;AAQA,eAAsB,WAAW,MAAwD;CACrF,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,MAAM,CAAC,WAAW,CAAC;EAElD,OAAO,OAAO,KAAK;CACvB,QAAQ;EACJ,OAAO;CACX;AACJ;;AAGA,SAAS,SAAS,SAAmC;CACjD,OAAO,cAAc,KAAK,OAAO,IAAI,WAAW;AACpD;AAEA,IAAM,kBAAkB;;AAGxB,eAAe,iBAAiB,QAA4E;CACxG,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO;EAAE,kBAAkB;EAAQ,yBAAyB;CAAO,CAAC;CACvF,OAAO,GAAG,eAAe,KAAA,CAAS;CAClC,IAAI;EACA,MAAM,OAAO,QAAQ;EACrB,MAAM,EAAE,SAAS,MAAM,OAAO,MAA2B,6BAA6B;EAEtF,OAAO,EAAE,QAAQ,SAAS,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE;CACtD,SAAS,OAAO;EACZ,OAAO,EAAE,MAAM;CACnB,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACJ;;;;;;;;;;;;;;;AA6BA,eAAsB,WAAW,MAAgB,UAAwC;CACrF,IAAI;EACA,MAAM,UAAU,MAAM,SAAS,MAAM,QAAQ;EAC7C,IAAI,CAAC,QAAQ,IAAI,GAAG,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;EAEpD,OAAO;CACX,SAAS,OAAO;EACZ,GAAG,OAAO,UAAU,EAAE,OAAO,KAAK,CAAC;EACnC,MAAM;CACV;AACJ;AAEA,eAAe,SAAS,MAAgB,UAAwC;CAC5E,IAAI,eAAe,KAAK;CACxB,IAAI,CAAC,cAAc;EACf,MAAM,OAAO,MAAM,iBAAiB,KAAK,MAAM;EAC/C,IAAI,WAAW,MACX,OAAO;GACH,IAAI;GACJ,OAAO,OAAO,mCAAmC,OAAO,KAAK,MAAM,KAC/D,oBAAoB,oBAAoB,KAAK,KAAK,KAAK;IACnD;IACA;IACA;IACA;GACJ,CAAC;EACT;EAEJ,eAAe,KAAK;CACxB;CAEA,MAAM,UAAoB;EAAE,GAAG;EAAM;CAAa;CAClD,MAAM,MAAM,MAAM,MAAM,WAAW;EAAC,GAAG,SAAS,OAAO;EAAG;EAAU;CAAQ,GAAG;EAC3E,KAAK,QAAQ,OAAO;EACpB,OAAO;EACP,QAAQ;EACR,QAAQ;EACR,QAAQ;CACZ,CAAC;CACD,IAAI,IAAI,aAAa,GAAG;EACpB,IAAI,IAAI,OAAO,KAAK,GAAG,QAAQ,OAAO,MAAM,GAAG,IAAI,OAAO,QAAQ,EAAE,GAAG;EAEvE,OAAO;GAAE,IAAI;GAAM,MAAM;EAAQ;CACrC;CAEA,OAAO;EAAE,IAAI;EAAO,OAAO,oBAAoB,KAAK,QAAQ,GAAG;CAAE;AACrE;;;;;;AAOA,SAAgB,oBAAoB,QAAgB,KAA2B;CAC3E,IAAI,IAAI,QAAQ,OAAO,CAAC,4BAA4B,IAAI,OAAO,uBAAuB,eAAe;CACrG,IAAI,IAAI,aAAa,KAAA,GACjB,OAAO;EACH,mCAAmC,IAAI,QAAQ,gBAAgB;EAC/D;EACA;CACJ;CAGJ,MAAM,UAAU,IAAI,UAAU,GAAA,CAAI,KAAK;CACvC,MAAM,OAAO,OAAO,MAAM;CAC1B,MAAM,QAAQ,uBAAuB,KAAK,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,KAAK;CAClE,MAAM,OAAO,QAAQ,iBAAiB,UAAU;CAEhD,IAAI,6MAA6M,KAAK,MAAM,GACxN,OAAO,OAAO,mCAAmC,QAAQ,MAAM;EAC3D;EACA;EACA;EACA;CACJ,CAAC;CAEL,IAAI,oFAAoF,KAAK,MAAM,GAAG;EAClG,IAAI,OAAO;EACX,IAAI;GACA,OAAO,cAAc,IAAI,IAAI,MAAM,CAAC,CAAC,QAAQ,KAAK;EACtD,QAAQ,CAAyB;EACjC,OAAO,OAAO,mCAAmC,KAAK,OAAO,QAAQ,MAAM;GACvE;GACA;GACA;EACJ,CAAC;CACL;CAGA,MAAM,UAAU,qCAAqC,KAAK,MAAM,CAAC,GAAG;CACpE,IAAI,SACA,OAAO,OAAO,aAAa,QAAQ,sBAAsB,QAAQ,MAAM;EACnE;EACA;EACA;CACJ,CAAC;CAGL,MAAM,WAAW,2BAA2B,KAAK,MAAM,IACjD,CAAC,sGAAsG,IACvG,CAAC;CACP,OAAO;EACH,GAAI,SAAS,OAAO,MAAM,IAAI,IAAI,CAAC;EACnC,4BAA4B,eAAe,MAAM,EAAE,cAAc,IAAI,SAAS;EAC9E;EACA,GAAG;CACP;AACJ;;;;;;;;;;;;;;;;;AAwCA,SAAgB,eAAe,KAAiB,SAA2B,YAA+B;CACtG,IAAI,IAAI,QACJ,OAAO;EACH,SAAS;EACT,SAAS,6BAA6B,IAAI,OAAO;EACjD,QAAQ;CACZ;CAEJ,IAAI,IAAI,aAAa,KAAA,GACjB,OAAO;EACH,SAAS;EACT,SAAS,oCAAoC,IAAI,QAAQ,gBAAgB;EACzE,QAAQ;CACZ;CAEJ,IAAI,IAAI,aAAa,GAAG,OAAO;EAAE,SAAS;EAAM,SAAS;EAAM,QAAQ;CAAK;CAE5E,MAAM,UAAU,mCAAmC,KAAK,IAAI,UAAU,EAAE;CACxE,MAAM,UAAU,WAAW,WACrB,8JACmE,kBAAkB,KAAI,cAAa,UAAU,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,mIAGjI;CAIN,OAAO;EACH,SAAS;EACT,SAAS,UACH,gCAAgC,QAAQ,GAAG,sCAC3C,+BAA+B,IAAI,SAAS;EAClD,QAAQ;CACZ;AACJ;;;;;;;AAcA,SAAgB,eAAe,SAAwC,SAAsC;CACzG,MAAM,QAAQ,qBAAqB,OAAO;CAE1C,OAAO,QAAQ,WAAW,IAAI,QAAQ,MAAM,QAAQ,WAAW,QAAQ,SAAS,MAAM,CAAC;AAC3F;;;;;;;;;;;AAYA,SAAgB,gBAAgB,SAAsC;CAClE,MAAM,aAAa,QAAQ,KAAK,WAAW,yBAAyB,gBAAgB,MAAM,EAAE,SAAS;CACrG,IAAI,QAAQ,SAAS,QAAQ,GAAG,WAAW,KAAK,wBAAwB,wCAAwC;CAEhH,OAAO;AACX;;;;;;;AAQA,IAAM,qBAAqB;;AAG3B,SAAS,aAAa,OAAgC;CAClD,MAAM,OAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,UAAU,QAAQ,OAAO,MAAM,IAAI,IAAI;CACnG,MAAM,SAAS,UAAU,KAAK;CAC9B,MAAM,SAAS,SAAS,UAClB,qGACA,SAAS,UACL,qIAEA;CAEV,OAAO;EACH,SAAS;EACT,SAAS;EACT,SAAS,wDAAwD;EACjE;CACJ;AACJ;;;;;;;;;;;;;;;;;AAkBA,eAAsB,YAAY,MAAgB,UAA2C;CACzF,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,KAAK,OAAO,CAAC;CAC3D,OAAO,GAAG,eAAe,KAAA,CAAS;CAClC,IAAI;CACJ,IAAI;EACA,MAAM,OAAO,QAAQ;EACrB,SAAS,UAAU,MAAM,OAAO,MAA2B,6BAA6B,EAAA,CAAG,KAAK,EAAE,EAAE,WAAW,EAAE;EACjH,IAAI,WAAW,YAAY,KAAK,iBAAiB,UAC7C,OAAO;GACH,SAAS;GACT,SAAS;GACT,SAAS;GACT,QAAQ;EACZ;EAEJ,MAAM,EAAE,SAAS,MAAM,OAAO,MAA0B,gDAAgD;EACxG,MAAM,OAAO,MAAM,OAAO;EAC1B,MAAM,OAAO,MAAM,6BAA6B,mBAAmB,EAAE;EACrE,KAAK,MAAM,aAAa,gBAAgB,eAAe,MAAM,KAAK,OAAO,CAAC,GAAG,MAAM,OAAO,MAAM,SAAS;EACzG,MAAM,OAAO,MAAM,QAAQ;CAC/B,SAAS,OAAO;EACZ,MAAM,OAAO,MAAM,UAAU,CAAC,CAAC,YAAY,KAAA,CAAS;EACpD,OAAO,aAAa,KAAK;CAC7B,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;CAIA,MAAM,MAAM,MAAM,MAAM,cAAc,YAAY,MAAM,QAAQ,GAAG;EAC/D,KAAK,WAAW,IAAI;EACpB,OAAO;EACP,QAAQ;EACR,QAAQ,CAAC,QAAQ,SAAS;EAC1B,QAAQ;CACZ,CAAC;CAED,IAAI,WAAW,UAAU,MAAM,mBAAmB,KAAK,MAAM;CAE7D,OAAO;EAAE,SAAS;EAAM,GAAG,eAAe,KAAK,MAAM;CAAE;AAC3D;;;;;;;;;;AAWA,eAAe,mBAAmB,QAA+B;CAC7D,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO;EAAE,kBAAkB;EAAQ,yBAAyB;EAAQ,eAAe;CAAO,CAAC;CAC9G,OAAO,GAAG,eAAe,KAAA,CAAS;CAClC,IAAI;EACA,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,MAAM,WAAW;EAC9B,MAAM,OAAO,MAAM,gBAAgB;CACvC,QAAQ,CAER,UAAU;EACN,MAAM,OAAO,IAAI,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5C;AACJ;;;;;AAMA,SAAgB,uBAAuB,SAAyB,QAA0B;CACtF,MAAM,QAAQ,QAAQ,UAChB,kDAAkD,OAAO,KACzD,QAAQ,UACJ,sEACA;CAEV,OAAO;EAAC,QAAQ,WAAW;EAAiC;EAAO,GAAI,QAAQ,SAAS,CAAC,QAAQ,MAAM,IAAI,CAAC;CAAE;AAClH"}

package/dist/resolve-CNQjsatH.js

@@ -1,2 +0,0 @@
-import { r as resolveDevDatabase } from "./prepare-DdnU70z8.js";
-export { resolveDevDatabase };

package/dist/schema-B0-p6T1O.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"schema-B0-p6T1O.js","names":[],"sources":["../src/commands/schema.ts"],"sourcesContent":["/**\n * CLI command: rebase schema <action>\n */\nimport arg from \"arg\";\nimport chalk from \"chalk\";\nimport { ensureDockerDatabase, spawnDriverCli } from \"./db\";\nimport {\n    requireProjectRoot,\n    requireBackendDir,\n    getActiveBackendPlugin,\n    resolvePluginCliScript,\n    resolveTsx,\n    findEnvFile,\n    exitDependenciesNotInstalled\n} from \"../utils/project\";\nimport { recordEvent } from \"../telemetry\";\nimport { wantsHelp } from \"../utils/args\";\nimport { reportSpawnFailure } from \"../utils/spawn-error\";\nimport { argsFromCommand } from \"../utils/command-words\";\nimport { unknownCommand } from \"../utils/unknown-command\";\nimport { DEV_DATABASE_KIND_ENV, devDatabaseKind, managedNotices, prepareDatabaseEnv } from \"../dev-db/prepare\";\nimport { absolutizeLocalPathArgs } from \"./db\";\nimport { COLLECTIONS_FLAG_HELP, refuseMissingCollectionsPath } from \"../utils/path-flags\";\n\n/**\n * The line handed to the driver, its paths resolved from where the command was\n * run (the driver runs in `backend/`). `--schema` is left alone: on\n * `introspect` it names a Postgres schema, not a file.\n */\nexport function schemaDriverArgs(rawArgs: string[], cwd: string): string[] {\n    return absolutizeLocalPathArgs(argsFromCommand(rawArgs, \"schema\"), cwd, [\"--collections\", \"-c\", \"--output\", \"-o\", \"--out\"]);\n}\n\nexport async function schemaCommand(subcommand: string | undefined, rawArgs: string[]): Promise<void> {\n    // `--help` is answered here, before `requireProjectRoot` and before the\n    // driver is spawned — the same shape `db.ts` already uses, and for the same\n    // reason.\n    //\n    // `cli.ts` rewrites the subcommand to `\"--help\"` only when the user named\n    // none, so `rebase schema --help` was covered and `rebase schema generate\n    // --help` was not: the flag travelled into `rawArgs.slice(2)` and reached\n    // the driver, whose own `schemaCommand` has no `--help` case. It *ran the\n    // generator* — overwriting `src/schema.generated.ts` — for a flag whose\n    // entire job is to print text. Worse, the first thing it hit outside a\n    // project was `requireProjectRoot`, so `rebase schema introspect --help` in\n    // an empty directory exited 1 with \"Could not find a Rebase project root\":\n    // help you cannot read until you already have a project is help for nobody.\n    if (!subcommand || subcommand === \"--help\" || wantsHelp(rawArgs)) {\n        printSchemaHelp(subcommand === \"--help\" ? undefined : subcommand);\n        return;\n    }\n\n    // A typo is answered here, in the same words every other family uses.\n    //\n    // It used to travel to the driver, which said the bare line `Unknown schema\n    // command.` — no list, no pointer, no did-you-mean, for a family with three\n    // subcommands. The set comes from the help table, so what a typo is measured\n    // against and what `--help` prints cannot drift apart.\n    if (!SCHEMA_ACTION_HELP[subcommand]) {\n        unknownCommand(subcommand, Object.keys(SCHEMA_ACTION_HELP), \"schema\");\n    }\n\n    const projectRoot = requireProjectRoot();\n\n    // Fire-and-forget, and a no-op unless the developer opted in. Never awaited:\n    // the command is what the user is waiting for, and a slow collector must not\n    // sit in front of it.\n    void recordEvent(\"cli.schema\", { subcommand: subcommand ?? \"none\" }, { projectRoot });\n    const backendDir = requireBackendDir(projectRoot);\n\n    const activePlugin = getActiveBackendPlugin(backendDir);\n    if (!activePlugin) {\n        console.error(chalk.red(\"✗ Could not detect an active database plugin.\"));\n        console.error(chalk.gray(\"  Make sure a package like @rebasepro/server-postgres is installed in backend/package.json.\"));\n        process.exit(1);\n    }\n\n    const pluginCli = resolvePluginCliScript(backendDir, activePlugin);\n    if (!pluginCli) {\n        exitDependenciesNotInstalled(projectRoot);\n    }\n\n    // Set up environment with DOTENV_CONFIG_PATH\n    const envFile = findEnvFile(projectRoot);\n    const env: Record<string, string> = { ...process.env as Record<string, string> };\n    if (envFile) {\n        env.DOTENV_CONFIG_PATH = envFile;\n    }\n    // Which database this project is on, so the driver's closing line does not\n    // recommend a command that database refuses. A pure decision — nothing is\n    // started, which matters here above all: `schema generate` reads collection\n    // files and writes one file, and booting a database to run it would be a\n    // side effect nobody asked for.\n    env[DEV_DATABASE_KIND_ENV] = devDatabaseKind(projectRoot) ?? \"\";\n\n    refuseMissingCollectionsPath(rawArgs, process.cwd(), backendDir);\n\n    // `introspect` is the one schema command that reads a database, and it\n    // reads the project's — resolved the way every `db` command resolves it,\n    // started if that is what it takes. It used to pass `.env` and nothing\n    // else, so on the managed database or after `rebase dev --docker` (with\n    // the scaffold's DATABASE_URL commented out, on purpose) it said\n    // \"DATABASE_URL is not set\", and `--docker` and `--database-url` passed the\n    // flag check only to be ignored.\n    if (subcommand === \"introspect\") {\n        const flags = arg(\n            { \"--database-url\": String, \"--docker\": Boolean },\n            { argv: rawArgs.slice(2), permissive: true }\n        );\n        await ensureDockerDatabase(projectRoot, rawArgs);\n        const prepared = await prepareDatabaseEnv(projectRoot, {\n            flagUrl: flags[\"--database-url\"] ?? null,\n            flagDocker: flags[\"--docker\"] === true,\n            onProgress: (message) => console.log(chalk.gray(`  ${message}`))\n        });\n        Object.assign(env, prepared.env);\n        env[DEV_DATABASE_KIND_ENV] = prepared.database.kind;\n        for (const line of managedNotices(prepared)) console.log(chalk.gray(`  ${line}`));\n    }\n\n    try {\n        // The one spawn, shared with `db`. This file used to carry its own copy\n        // of the tsx-or-node decision; three copies of that rule existed and two\n        // were fixed while the third went on spawning plain node.\n        await spawnDriverCli(\n            { projectRoot, backendDir, pluginCli, env },\n            schemaDriverArgs(rawArgs, process.cwd())\n        );\n    } catch (error) {\n        // A child that ran and exited non-zero already printed its diagnostics\n        // through inherited stdio; a child that never started (ENOENT on tsx,\n        // EACCES on the script) printed nothing at all, and this used to exit 1\n        // in silence.\n        reportSpawnFailure(error);\n        process.exit(1);\n    }\n}\n\n/** One page per subcommand, so `rebase schema <action> --help` says something. */\nconst SCHEMA_ACTION_HELP: Record<string, { usage: string; summary: string; notes?: string[] }> = {\n    generate: {\n        usage: \"rebase schema generate [--collections <dir>] [--output <file>] [--watch]\",\n        summary: \"Generate the Drizzle schema from the collection definitions.\",\n        notes: [\"--watch regenerates on every change to a collection file.\"]\n    },\n    introspect: {\n        usage: \"rebase schema introspect [--collections <dir>] [--output <dir>] [--schema <name>] [--force] [--data-inference | --no-data-inference]\",\n        summary: \"Read an existing database and write Rebase collection definitions from it.\",\n        notes: [\n            \"--force overwrites collection files that are already there.\",\n            \"--data-inference samples up to 100 rows per table to detect formats, constraints and UI settings; \"\n                + \"--no-data-inference reads the structure only. Without either it asks, and without a terminal \"\n                + \"it reads the structure only.\",\n            \"Reads this project's database, the one `rebase db url` prints: --database-url <url> names another; \"\n                + \"--docker uses the compose one, starting it if needed.\"\n        ]\n    },\n    stale: {\n        usage: \"rebase schema stale [--collections <dir>] [--output <file>] [--fix]\",\n        summary: \"Report generated schema files that no longer match the collections.\",\n        notes: [\"--fix regenerates them instead of only reporting.\"]\n    }\n};\n\n/** Every subcommand the family dispatches — the help table's keys. */\nexport const SCHEMA_SUBCOMMANDS = Object.keys(SCHEMA_ACTION_HELP);\n\nfunction printSchemaHelp(action?: string) {\n    const entry = action ? SCHEMA_ACTION_HELP[action] : undefined;\n    if (entry) {\n        console.log(`\n${chalk.bold(`rebase schema ${action}`)}\n\n  ${entry.summary}\n\n${chalk.green.bold(\"Usage\")}\n  ${chalk.blue(entry.usage)}\n${entry.notes?.length ? `\\n${chalk.green.bold(\"Notes\")}\\n${entry.notes.map(n => `  ${chalk.gray(`• ${n}`)}`).join(\"\\n\")}\\n` : \"\"}\n${chalk.gray(\"Run `rebase schema --help` for every subcommand.\")}\n`);\n        return;\n    }\n\n    console.log(`\n${chalk.bold(\"rebase schema\")} — Schema management commands\n\n${chalk.green.bold(\"Usage\")}\n  rebase schema ${chalk.blue(\"<command>\")} [options]\n\n${chalk.green.bold(\"Commands\")}\n  ${chalk.gray(\"(Commands are provided by your active database driver plugin)\")}\n  ${chalk.blue.bold(\"generate\")}    Generate Schema from collection definitions\n  ${chalk.blue.bold(\"introspect\")}  Introspect an existing database to generate collection definitions\n  ${chalk.blue.bold(\"stale\")}       Report generated schema files that no longer match the collections\n\n${chalk.green.bold(\"generate Options\")}\n  ${chalk.blue(\"--collections, -c\")}  ${COLLECTIONS_FLAG_HELP}\n  ${chalk.blue(\"--output, -o\")}       Output path for generated schema\n  ${chalk.blue(\"--watch, -w\")}        Watch for changes and regenerate automatically\n\n${chalk.green.bold(\"introspect Options\")}\n  ${chalk.blue(\"--output, -o\")}       Output directory for generated collection files\n  ${chalk.blue(\"--schema\")}           Postgres schema to read (default: public)\n  ${chalk.blue(\"--force, -f\")}        Overwrite collection files that already exist\n  ${chalk.blue(\"--database-url\")}     Read this database instead of the project's own\n  ${chalk.blue(\"--docker\")}           Read the compose database, starting it if needed\n  ${chalk.blue(\"--data-inference\")}   Sample rows to detect formats and constraints ${chalk.gray(\"(asked when omitted)\")}\n  ${chalk.blue(\"--no-data-inference\")} Read the structure only, without asking\n\n${chalk.green.bold(\"stale Options\")}\n  ${chalk.blue(\"--fix\")}              Regenerate the stale files instead of only reporting them\n`);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AA6BA,SAAgB,iBAAiB,SAAmB,KAAuB;CACvE,OAAO,wBAAwB,gBAAgB,SAAS,QAAQ,GAAG,KAAK;EAAC;EAAiB;EAAM;EAAY;EAAM;CAAO,CAAC;AAC9H;AAEA,eAAsB,cAAc,YAAgC,SAAkC;CAclG,IAAI,CAAC,cAAc,eAAe,YAAY,UAAU,OAAO,GAAG;EAC9D,gBAAgB,eAAe,WAAW,KAAA,IAAY,UAAU;EAChE;CACJ;CAQA,IAAI,CAAC,mBAAmB,aACpB,eAAe,YAAY,OAAO,KAAK,kBAAkB,GAAG,QAAQ;CAGxE,MAAM,cAAc,mBAAmB;CAKvC,YAAiB,cAAc,EAAE,YAAY,cAAc,OAAO,GAAG,EAAE,YAAY,CAAC;CACpF,MAAM,aAAa,kBAAkB,WAAW;CAEhD,MAAM,eAAe,uBAAuB,UAAU;CACtD,IAAI,CAAC,cAAc;EACf,QAAQ,MAAM,MAAM,IAAI,+CAA+C,CAAC;EACxE,QAAQ,MAAM,MAAM,KAAK,6FAA6F,CAAC;EACvH,QAAQ,KAAK,CAAC;CAClB;CAEA,MAAM,YAAY,uBAAuB,YAAY,YAAY;CACjE,IAAI,CAAC,WACD,6BAA6B,WAAW;CAI5C,MAAM,UAAU,YAAY,WAAW;CACvC,MAAM,MAA8B,EAAE,GAAG,QAAQ,IAA8B;CAC/E,IAAI,SACA,IAAI,qBAAqB;CAO7B,IAAI,yBAAyB,gBAAgB,WAAW,KAAK;CAE7D,6BAA6B,SAAS,QAAQ,IAAI,GAAG,UAAU;CAS/D,IAAI,eAAe,cAAc;EAC7B,MAAM,QAAQ,IACV;GAAE,kBAAkB;GAAQ,YAAY;EAAQ,GAChD;GAAE,MAAM,QAAQ,MAAM,CAAC;GAAG,YAAY;EAAK,CAC/C;EACA,MAAM,qBAAqB,aAAa,OAAO;EAC/C,MAAM,WAAW,MAAM,mBAAmB,aAAa;GACnD,SAAS,MAAM,qBAAqB;GACpC,YAAY,MAAM,gBAAgB;GAClC,aAAa,YAAY,QAAQ,IAAI,MAAM,KAAK,KAAK,SAAS,CAAC;EACnE,CAAC;EACD,OAAO,OAAO,KAAK,SAAS,GAAG;EAC/B,IAAI,yBAAyB,SAAS,SAAS;EAC/C,KAAK,MAAM,QAAQ,eAAe,QAAQ,GAAG,QAAQ,IAAI,MAAM,KAAK,KAAK,MAAM,CAAC;CACpF;CAEA,IAAI;EAIA,MAAM,eACF;GAAE;GAAa;GAAY;GAAW;EAAI,GAC1C,iBAAiB,SAAS,QAAQ,IAAI,CAAC,CAC3C;CACJ,SAAS,OAAO;EAKZ,mBAAmB,KAAK;EACxB,QAAQ,KAAK,CAAC;CAClB;AACJ;;AAGA,IAAM,qBAA2F;CAC7F,UAAU;EACN,OAAO;EACP,SAAS;EACT,OAAO,CAAC,2DAA2D;CACvE;CACA,YAAY;EACR,OAAO;EACP,SAAS;EACT,OAAO;GACH;GACA;GAGA;EAEJ;CACJ;CACA,OAAO;EACH,OAAO;EACP,SAAS;EACT,OAAO,CAAC,mDAAmD;CAC/D;AACJ;;AAGA,IAAa,qBAAqB,OAAO,KAAK,kBAAkB;AAEhE,SAAS,gBAAgB,QAAiB;CACtC,MAAM,QAAQ,SAAS,mBAAmB,UAAU,KAAA;CACpD,IAAI,OAAO;EACP,QAAQ,IAAI;EAClB,MAAM,KAAK,iBAAiB,QAAQ,EAAE;;IAEpC,MAAM,QAAQ;;EAEhB,MAAM,MAAM,KAAK,OAAO,EAAE;IACxB,MAAM,KAAK,MAAM,KAAK,EAAE;EAC1B,MAAM,OAAO,SAAS,KAAK,MAAM,MAAM,KAAK,OAAO,EAAE,IAAI,MAAM,MAAM,KAAI,MAAK,KAAK,MAAM,KAAK,KAAK,GAAG,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,MAAM,GAAG;EAC/H,MAAM,KAAK,kDAAkD,EAAE;CAChE;EACO;CACJ;CAEA,QAAQ,IAAI;EACd,MAAM,KAAK,eAAe,EAAE;;EAE5B,MAAM,MAAM,KAAK,OAAO,EAAE;kBACV,MAAM,KAAK,WAAW,EAAE;;EAExC,MAAM,MAAM,KAAK,UAAU,EAAE;IAC3B,MAAM,KAAK,+DAA+D,EAAE;IAC5E,MAAM,KAAK,KAAK,UAAU,EAAE;IAC5B,MAAM,KAAK,KAAK,YAAY,EAAE;IAC9B,MAAM,KAAK,KAAK,OAAO,EAAE;;EAE3B,MAAM,MAAM,KAAK,kBAAkB,EAAE;IACnC,MAAM,KAAK,mBAAmB,EAAE,IAAI,sBAAsB;IAC1D,MAAM,KAAK,cAAc,EAAE;IAC3B,MAAM,KAAK,aAAa,EAAE;;EAE5B,MAAM,MAAM,KAAK,oBAAoB,EAAE;IACrC,MAAM,KAAK,cAAc,EAAE;IAC3B,MAAM,KAAK,UAAU,EAAE;IACvB,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,gBAAgB,EAAE;IAC7B,MAAM,KAAK,UAAU,EAAE;IACvB,MAAM,KAAK,kBAAkB,EAAE,mDAAmD,MAAM,KAAK,sBAAsB,EAAE;IACrH,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,eAAe,EAAE;IAChC,MAAM,KAAK,OAAO,EAAE;CACvB;AACD"}