npm - @turbobase/cli - Versions diffs - 1.6.4 → 1.6.5 - Mend

@turbobase/cli 1.6.4 → 1.6.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (3) hide show

package/dist/turbobase-standalone.mjs +2 -2
package/dist/turbobase.js +2 -2
package/package.json +1 -1

package/dist/turbobase-standalone.mjs CHANGED Viewed

@@ -3574,7 +3574,7 @@ ${o.map(eR).join(`
 `))}async function ib(t,e,r=mo){let n=[...new Set(t.map(a=>a.trim()).filter(Boolean))];n.length===0&&x("name at least one skill slug. `turbobase skills list` shows them.");let o=await go(e,r);if(!await ca(`Publish ${n.length} skill(s)?`,"Yes \u2014 publish them","their text is injected into every matching turn from now on",e))return;let i;try{i=await ae("publishing",()=>o.skillsPublish(n))}catch(a){se(a,"skills:publish","publish a skill"),x(`publish failed: ${a instanceof Error?a.message:String(a)}`)}_(g.green(`published ${i.published.length} skill(s) \u2014 live now.`)),i.unknown.length>0&&(q(g.yellow(`no such skill: ${i.unknown.join(", ")}`)),process.exitCode=1),q(g.dim(`release v${i.version.version_no} \xB7 undo with: turbobase skills unpublish ${i.published.join(" ")}`))}async function ab(t,e,r=mo){let n=[...new Set(t.map(a=>a.trim()).filter(Boolean))];n.length===0&&x("name at least one skill slug. `turbobase skills list` shows them.");let o=await go(e,r);if(!await ca(`Move ${n.length} skill(s) back to draft?`,"Yes \u2014 unpublish them","they stop being injected immediately; the text and its history are kept",e))return;let i;try{i=await ae("unpublishing",()=>o.skillsUnpublish(n))}catch(a){se(a,"skills:publish","unpublish a skill"),x(`unpublish failed: ${a instanceof Error?a.message:String(a)}`)}_(g.green(`unpublished ${i.unpublished.length} skill(s) \u2014 retracted now.`)),q(g.dim(`release v${i.version.version_no} \xB7 re-publish with: turbobase skills publish ${i.unpublished.join(" ")}`)),i.unknown.length>0&&(q(g.yellow(`no such skill: ${i.unknown.join(", ")}`)),process.exitCode=1)}async function cb(t,e,r=mo){let n=Number(t);(!Number.isInteger(n)||n<1)&&x(`--version must be a release number (got '${t}'). \`turbobase skills releases\` lists them.`);let o=await go(e,r);if(await ca(`Roll the skills back to release v${n}?`,"Yes \u2014 restore that release","content only: a skill an operator has since unpublished stays off",e))try{let i=await ae("rolling back",()=>o.skillsRollback(n));_(g.green(`rolled back to v${i.version.version_no}.`))}catch(i){se(i,"skills:publish","roll back a skills release"),x(`rollback failed: ${i instanceof Error?i.message:String(i)}`)}}async function lb(t,e=mo){let r=await go(t,e),n;try{n=await ae("reading the releases",()=>r.skillsReleases())}catch(o){se(o,"skills:publish","read the skills releases"),x(`could not read the releases: ${o instanceof Error?o.message:String(o)}`)}if(n.items.length===0){q("no releases yet.");return}for(let o of n.items){let s=o.is_current?g.green("*"):" ",i=o.release_note?` \u2014 ${o.release_note}`:"";_(`${s} v${o.version_no}  ${o.skill_count} skill(s)  ${g.dim(o.published_at)}${o.published_by?g.dim(` by ${o.published_by}`):""}${g.dim(i)}`)}}async function ub(t,e,r=mo){let n=[...new Set((t??[]).map(l=>l.trim()).filter(Boolean))];n.length===0&&x("name at least one skill to delete. `turbobase skills list` shows the slugs.");let o=await go(e,r);if(!await ca(n.length===1?`Delete the skill '${n[0]}'?`:`Delete ${n.length} skills?
   ${n.join(`
   `)}`,"Yes \u2014 delete them","permanent: the rows and their text are removed. Prior releases keep their own copy.",e))return;let i=[],a=[];for(let l of n)try{i.push(await ae(`deleting ${l}`,()=>o.skillsDelete(l)))}catch(u){if(u instanceof pe&&u.status===404){a.push(l);continue}i.length>0&&q(g.dim(`deleted before the error: ${i.map(p=>p.slug).join(", ")}`)),se(u,"skills:publish","delete a skill"),x(`delete failed on '${l}': ${u instanceof Error?u.message:String(u)}`)}i.length>0&&_(g.green(`deleted ${i.length} skill(s).`));let c=i.filter(l=>l.wasPublished).map(l=>l.slug);c.length>0&&q(g.yellow(`Published until now, so no longer injected: ${c.join(", ")}`)),a.length>0&&(q(g.yellow(`no such skill: ${a.join(", ")}`)),process.exitCode=1)}import{promises as db}from"node:fs";import{join as ER,relative as RR,resolve as PR,sep as AR}from"node:path";var IR=new Set(["node_modules","dist","build","coverage",".git",".claude",".turbobase",".next",".svelte-kit",".vercel",".cache"]),OR=new Set([".mcp.json",".env"]);function CR(t){return OR.has(t)||t.startsWith(".env.")&&t!==".env.example"}function NR(t){return Buffer.compare(Buffer.from(t.toString("utf8"),"utf8"),t)===0}function zR(t){return t.includes(0)}async function pb(t){let e=PR(t),r={},n=[],o=[],s=[];async function i(a){let c=await db.readdir(a,{withFileTypes:!0});for(let l of c){let u=ER(a,l.name);if(IR.has(l.name))continue;if(l.isDirectory()){await i(u);continue}if(!l.isFile())continue;let p=RR(e,u).split(AR).join("/");if(CR(l.name)){o.push(p);continue}let w=await db.readFile(u);if(!NR(w)){n.push(p);continue}zR(w)&&s.push(p),r[p]=w.toString("utf8")}}return await i(e),{files:r,skipped:n,secrets:o,unstorable:s}}import{randomBytes as jR}from"node:crypto";var LR="/_tb/app-assets",DR=16,UR=/^[0-9a-f]{32}$/;function hb(){return jR(DR).toString("hex")}function MR(t){return UR.test(t)}function fb(t){if(!MR(t))throw new Error(`not a build id: ${t}`);return`${LR}/${t}/`}var mb=7;import la from"node:fs/promises";import fs from"node:path";var hu={esbuild:"0.28.1","isolated-vm":"6.1.2"},fu="@turbobase/isolated-vm-prebuilds";function mu(t,e){return`${t}-${e}`}function gu(t=process.versions){return`abi${t.modules}`}var gb=["darwin-x64","win32-arm64"];async function yb(t){let e=t.platform??process.platform,r=t.arch??process.arch,n=mu(e,r),o=fs.join(t.home,"node_modules"),s=fs.join(o,...fu.split("/"),"prebuilds",n),i=fs.join(o,"isolated-vm","prebuilds",n),a;try{a=await la.readdir(s)}catch{return[]}let c=[];await la.mkdir(i,{recursive:!0});for(let l of a){if(!l.endsWith(".node"))continue;let u=fs.join(i,l);try{await la.copyFile(fs.join(s,l),u,la.constants?.COPYFILE_EXCL??1),c.push(l)}catch{}}return c}import{homedir as qR}from"node:os";import{join as bb}from"node:path";import{promises as yu}from"node:fs";function vb(){let t=process.env.TURBOBASE_HOME??bb(qR(),".turbobase");return{dir:t,file:bb(t,"sandboxes.json")}}var ZR={s:1e3,m:6e4,h:36e5,d:864e5};function BR(t){let e=/^\s*(\d+)\s*([smhd])\s*$/.exec(t);if(!e)throw new Error(`invalid --ttl '${t}': expected <number><unit> where unit is s|m|h|d (e.g. 72h, 30m, 7d).`);let r=Number(e[1]);if(!Number.isFinite(r)||r<=0)throw new Error(`invalid --ttl '${t}': duration must be a positive integer.`);return r*ZR[e[2]]}function FR(t,e=Date.now()){return new Date(e+BR(t)).toISOString()}function HR(t,e=Date.now()){let r=Date.parse(t);return Number.isNaN(r)?!0:r<=e}function VR(t){let e=/^\s*(\d+(?:\.\d+)?)\s*%?\s*$/.exec(t);if(!e)throw new Error(`invalid --sample '${t}': expected a percent like 2% (or a bare number).`);let r=Number(e[1]);if(!Number.isFinite(r)||r<0||r>100)throw new Error(`invalid --sample '${t}': percent must be between 0 and 100.`);return r/100}function KR(t,e){if(e>=1)return[...t];if(e<=0||t.length===0)return[];let r=Math.max(1,Math.round(1/e)),n=[];for(let o=0;o<t.length;o+=r)n.push(t[o]);return n}var WR="[REDACTED]",ms=class extends Error{constructor(e){super(e),this.name="SandboxDataCopyUnavailableError"}},bu=class extends Error{table;column;constructor(e,r,n){super(`Refusing to copy ${e}.${r} into a sandbox: ${n}. A sandbox must never hold un-redacted PII \u2014 classify the column 'safe' (non-PII) or let redaction mask it, then retry.`),this.name="UnredactedPiiError",this.table=e,this.column=r}};function GR(t,e,r){let n={};for(let[o,s]of Object.entries(e)){let i=r[o];if(i===void 0)throw new bu(t,o,"column has no PII classification (unknown = unsafe)");i==="pii"?n[o]=s==null?s:WR:n[o]=s}return n}function JR(t,e,r){return e.map(n=>GR(t,n,r))}var wb=new Set(["localhost","127.0.0.1","::1","0.0.0.0"]),YR=["oraclecloud.com","us-ashburn-1","amazonaws.com","rds.","supabase.co","turbobase.app","turbobase.io"];function XR(t){let e=t.trim();try{let o=new URL(e);if(o.hostname)return o.hostname.toLowerCase()}catch{}let r=e.replace(/^[a-z]+:\/\//i,""),n=(r.split("/")[0]??r).split("@").pop()??r;return(n.split(":")[0]??n).toLowerCase()}function wu(t){if(!t||!t.trim())throw new Error("local-only guard: empty database target \u2014 refusing to proceed.");let e=t.toLowerCase();for(let n of YR)if(e.includes(n))throw new Error(`local-only guard: target '${t}' looks like a cloud/prod context (matched '${n}'). \`turbobase sandbox create\` is LOCAL-ONLY and will never touch a cloud database.`);let r=XR(t);if(!wb.has(r))throw new Error(`local-only guard: target host '${r}' is not a recognised local Postgres (${[...wb].join(", ")}). \`turbobase sandbox create\` is LOCAL-ONLY.`)}function QR(t,e=eP){return`sbx-${t.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,24)||"tenant"}-${e()}`}function eP(){return Math.floor(Math.random()*16777215).toString(16).padStart(6,"0")}function tP(t){return`turbobase_${t.replace(/[^a-z0-9]+/gi,"_").toLowerCase()}`}function rP(t,e){return`${(e??process.env.TURBOBASE_SANDBOX_BASE_URL??"http://localhost:5173").replace(/\/+$/,"")}/?sandbox=${encodeURIComponent(t)}`}async function vu(){let{file:t}=vb();try{let e=await yu.readFile(t,"utf8"),r=JSON.parse(e);return Array.isArray(r)?r:[]}catch(e){if(e.code==="ENOENT")return[];throw e}}async function _b(t){let{dir:e,file:r}=vb();await yu.mkdir(e,{recursive:!0}),await yu.writeFile(r,`${JSON.stringify(t,null,2)}
-`,{mode:384})}async function nP(t){let e=await vu();e.push(t),await _b(e)}async function xb(t){let e=await vu(),r=e.findIndex(o=>o.name===t);if(r===-1)return null;let[n]=e.splice(r,1);return await _b(e),n??null}async function ua(){return vu()}function _u(t,e=Date.now()){let r=[],n=[];for(let o of t)HR(o.expiresAt,e)?n.push(o):r.push(o);return{active:r,expired:n}}async function kb(t,e){wu(t.target());let r=t.dataCopyUnavailable?.();if(r)throw new ms(r);let n=VR(e.sample),o=e.now??Date.now(),s=(e.nameGen??(l=>QR(l)))(e.fromTenant),i=tP(s);await t.createDatabase(i),await t.replayMigrations(i);let a=await t.readSourceTables(e.fromTenant);for(let l of a){let u=KR(l.rows,n),p=JR(l.table,u,l.classification);p.length>0&&await t.copyRows(i,l.table,p)}let c={name:s,fromTenant:e.fromTenant,database:i,createdAt:new Date(o).toISOString(),expiresAt:FR(e.ttl,o),sampleFraction:n,url:rP(s,e.baseUrl)};return await nP(c),c}async function $b(t,e){wu(t.target());let n=(await ua()).find(o=>o.name===e);return n?(await t.dropDatabase(n.database),await xb(e),n):null}async function xu(t,e=Date.now()){wu(t.target());let r=await ua(),{expired:n}=_u(r,e),o=[];for(let s of n){try{await t.dropDatabase(s.database)}catch{continue}await xb(s.name),o.push(s)}return o}var gs={pat:{prefix:"tb_pat_",defaultScopes:["extensions:deploy"],allowedScopes:["extensions:deploy","catalog:read","mcp:authoring","analyzer:run","releases:write","solutions:write","skills:publish","docs:publish"],defaultTtlDays:90,mintable:!0,label:"Personal access token"},catalog:{prefix:"tb_cat_",defaultScopes:["catalog:read"],allowedScopes:["catalog:read"],defaultTtlDays:null,mintable:!0,label:"AI / catalog token"}},yZ=Object.keys(gs).filter(t=>gs[t].mintable);var vZ=gs.pat.prefix,oP=Object.entries(gs).map(([t,e])=>[e.prefix,t]),sP=/^[A-Za-z0-9_-]{20,}$/;function iP(t){if(typeof t!="string")return null;for(let[e,r]of oP)if(t.startsWith(e)&&sP.test(t.slice(e.length)))return r;return null}function Sb(t){return iP(t)==="pat"}os();var aP=8e3,cP={revoked:"the instance REVOKED this token \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",expired:"this token has EXPIRED \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",unknown:"this instance has never seen this token \u2014 it was deleted, or it belongs to a DIFFERENT instance; check the base-url before minting a new PAT",suspended:"the user this token belongs to is SUSPENDED \u2014 an instance administrator has to restore the account; a new token will not help",malformed:"the stored credential is not shaped like a Turbobase PAT (tb_pat_\u2026) \u2014 sign in again",missing:"no token reached the instance \u2014 sign in again",transient:"the instance could not verify the token right now (a storage error, not a decision about the token) \u2014 retry"};function lP(t){return cP[t]??`the instance rejected this token (${t}) \u2014 run \`turbobase auth login\` to store a fresh PAT`}async function uP(t,e,r=fetch){let n;try{n=await r(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(aP)})}catch(s){return{state:"unreachable",detail:s instanceof Error?s.message:String(s)}}if(n.status===200||n.status===403)return{state:"accepted"};if(n.status===401){let s=await n.json().catch(()=>null);return{state:"rejected",reason:typeof s?.reason=="string"&&s.reason?s.reason:"unknown"}}return(n.headers.get("content-type")??"").includes("application/json")?{state:"accepted"}:{state:"unreachable",detail:`HTTP ${n.status} \u2014 this host does not serve the /v1 API`}}function Tb(t){return t.state==="accepted"?tt()?g.green("accepted"):"accepted":t.state==="rejected"?tt()?g.red(`rejected \xB7 ${t.reason}`):`rejected \xB7 ${t.reason}`:tt()?g.yellow("unreachable"):"unreachable"}async function Eb(t={},e=fetch){let r=await $r(),{file:n}=Zi();if(r.length===0){_("not signed in. Run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),q(g.dim(`no sign-ins stored in ${n}.`));return}let o=await Yt(),s=await Promise.all(r.map(async i=>({baseUrl:i.baseUrl,active:!!o&&i.baseUrl===o.baseUrl,updatedAt:i.updatedAt,check:t.probe===!1?{state:"accepted"}:await uP(i.baseUrl,i.token,e)})));if(t.probe===!1)for(let i of s)_(`${i.active?"* ":"  "}${i.baseUrl}  (updated ${i.updatedAt})`);else if(tt())_(Xt(s.map(i=>[i.active?g.green("*"):" ",g.bold(i.baseUrl),Tb(i.check),g.dim(i.updatedAt)]),{head:["","instance","token","updated"]}));else for(let i of s)_(`${i.active?"* ":"  "}${i.baseUrl}  ${Tb(i.check)}  (updated ${i.updatedAt})`);q(g.dim(`tokens read from ${n}`));for(let i of s)i.check.state==="rejected"?(q(g.red(`${i.baseUrl}: ${lP(i.check.reason)}.`)),q(g.dim("  then re-run `turbobase project init` \u2014 .mcp.json holds its own copy of the token, and until it is rewritten the authoring MCP tools stay absent from your session."))):i.check.state==="unreachable"&&q(g.yellow(`${i.baseUrl}: could not reach the instance (${i.check.detail}).`));o||q("no active default \u2014 run `turbobase auth use <base-url>` or pass --base-url.")}async function ND(t){let e=await $r();e.length===0&&x("no stored sign-ins \u2014 run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),ft()||x("this command needs an explicit <base-url> in a non-interactive shell.");try{return await mt(t,e.map(r=>({value:r.baseUrl,label:r.baseUrl,description:`updated ${r.updatedAt}`})))}catch{x("cancelled.")}}async function zD(t,e){let r;try{r=await fetch(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(8e3)})}catch(o){return{ok:!1,kind:"unreachable",detail:o instanceof Error?o.message:String(o)}}let n=(r.headers.get("content-type")??"").includes("application/json");return r.status===200||r.status===403?{ok:!0}:r.status===401?{ok:!1,kind:"bad-token",detail:`HTTP ${r.status}`}:n?{ok:!0}:{ok:!1,kind:"wrong-host",detail:`HTTP ${r.status}`}}function jD(t){q(""),q("Sharing is ON. Two things reach the Turbobase product team from this instance:"),q("  \xB7 anonymized pattern cards from your proposals, solutions and INSTANCE-LEARNINGS.md \u2014"),q("    a pattern label, a record class, a fix shape, an outcome. No scripts, values or ids."),q("  \xB7 redacted prose from your projects\u2019 TURBOBASE-FEEDBACK.md \u2014 the findings you write"),q("    about OUR platform, with instance name, user names and ids masked before they leave."),q(`Turn it off: ${t}/admin/settings \u2192 Telemetry \u2192 "Share learnings and platform feedback".`),q("")}async function LD(t,e,r){let n=await Mg({baseUrl:t,token:e}),o=(await $r()).length-1;if(_(`signed in to ${n.baseUrl} \u2014 now the active instance`+(o>0?` (${o} other${o===1?"":"s"} stored; commands default here).`:".")),jD(n.baseUrl),!r)return;let s=await zD(n.baseUrl,e);s.ok||(s.kind==="wrong-host"?(q(`warning: ${n.baseUrl} did not respond to the Turbobase API (/v1) \u2014 got ${s.detail}.`),q("  In local dev the Turbobase API is on :4100, not the app dev-server port (e.g. :5173)."),q("  The token is stored, but commands will fail against this base-url until it points at the API.")):s.kind==="bad-token"?q(`warning: ${n.baseUrl} rejected the token (401) \u2014 the PAT may be stale, revoked, or for a different instance.`):q(`warning: could not reach ${n.baseUrl} to verify the token (${s.detail}). Stored anyway.`))}async function DD(t){let e=await cs(t),r=iu(e);if(!r){let n=/\bdefineConduit\s*[<(]/.test(e);x(n?`could not parse id/on/from.source/from.recordType from ${t} \u2014 is it a defineConduit({...}) file?`:`could not parse id/recordType/event from ${t} \u2014 is it a defineHook({...}) file?`)}return{...r,sourceCode:e}}async function Ko(t,e,r,n){try{return await ye.access(t),"skipped"}catch{}return await ye.mkdir(Vo(t),{recursive:!0}),await ye.writeFile(t,e,{mode:n??(r?493:420)}),n!==void 0&&await ye.chmod(t,n),"wrote"}async function ES(t,e){if(RS(t)!==".gitignore")return Ko(t,e.content,e.executable,e.mode);let r=await ye.readFile(t,"utf8").catch(()=>null);if(r===null)return Ko(t,e.content,e.executable,e.mode);let n=_y(r);return n===null?"skipped":(await ye.writeFile(t,n,"utf8"),"merged")}function Dm(t){if(t!==void 0){if(t==="junit"||t==="json")return t;x(`unknown --reporter '${t}' (expected 'junit' or 'json').`)}}function nl(t){process.exit(t)}function UD(t){return{name:"turbobase ext test",cases:t.map(r=>{if(r.pass)return{name:r.name,status:"passed"};let n=r.error?"error":r.rejection?.code??"mismatch",o=r.error?`error: ${r.error}`:r.observed!==r.expected?`expected ${r.expected}, observed ${r.observed}`+(r.rejection?` (rejected: ${r.rejection.code??"rejected"}${r.rejection.message?` \u2014 ${r.rejection.message}`:""})`:""):`rejected: ${r.rejection?.code??"rejected"}${r.rejection?.message?` \u2014 ${r.rejection.message}`:""}`;return{name:r.name,status:"failed",detail:o,type:n}})}}function MD(t,e){let r=e.warnings.length===0?[{name:`${t} (${e.kind})`,status:"passed"}]:e.warnings.map(n=>({name:`${t}: ${n.rule}`,status:"failed",type:n.rule,detail:`${n.message} \u2192 fix: ${n.fix}`}));return{name:`turbobase ext lint ${t}`,cases:r}}function qD(t){let e=[];if(t.error)return e.push({name:`replay ${t.fixtureName}`,status:"failed",type:"error",detail:t.error}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e};for(let r of t.guards)e.push(r.status==="failed"?{name:`guard: ${r.name}`,status:"failed",type:r.name,detail:r.detail}:{name:`guard: ${r.name}`,status:"passed",detail:r.status==="skipped-offline"?`skipped-offline: ${r.detail}`:void 0});return t.whenPassed&&t.applyBranch&&e.push({name:`apply-branch: ${t.applyBranch}`,status:"passed",detail:`${t.masterAction??""} (${t.wouldWriteBindings.length} binding(s) would be written)`.trim()}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e}}function Fm({includeInternal:t=!0}={}){let e=new lg;e.name("turbobase").description("Build apps, author extensions, and drive your Turbobase instance.").version("1.6.4").option("--no-color","Disable ANSI colour + animations (also honoured via NO_COLOR / non-TTY)."),e.addHelpText("beforeAll",d=>d.command.parent?"":`${eu()}
+`,{mode:384})}async function nP(t){let e=await vu();e.push(t),await _b(e)}async function xb(t){let e=await vu(),r=e.findIndex(o=>o.name===t);if(r===-1)return null;let[n]=e.splice(r,1);return await _b(e),n??null}async function ua(){return vu()}function _u(t,e=Date.now()){let r=[],n=[];for(let o of t)HR(o.expiresAt,e)?n.push(o):r.push(o);return{active:r,expired:n}}async function kb(t,e){wu(t.target());let r=t.dataCopyUnavailable?.();if(r)throw new ms(r);let n=VR(e.sample),o=e.now??Date.now(),s=(e.nameGen??(l=>QR(l)))(e.fromTenant),i=tP(s);await t.createDatabase(i),await t.replayMigrations(i);let a=await t.readSourceTables(e.fromTenant);for(let l of a){let u=KR(l.rows,n),p=JR(l.table,u,l.classification);p.length>0&&await t.copyRows(i,l.table,p)}let c={name:s,fromTenant:e.fromTenant,database:i,createdAt:new Date(o).toISOString(),expiresAt:FR(e.ttl,o),sampleFraction:n,url:rP(s,e.baseUrl)};return await nP(c),c}async function $b(t,e){wu(t.target());let n=(await ua()).find(o=>o.name===e);return n?(await t.dropDatabase(n.database),await xb(e),n):null}async function xu(t,e=Date.now()){wu(t.target());let r=await ua(),{expired:n}=_u(r,e),o=[];for(let s of n){try{await t.dropDatabase(s.database)}catch{continue}await xb(s.name),o.push(s)}return o}var gs={pat:{prefix:"tb_pat_",defaultScopes:["extensions:deploy"],allowedScopes:["extensions:deploy","catalog:read","mcp:authoring","analyzer:run","releases:write","solutions:write","skills:publish","docs:publish"],defaultTtlDays:90,mintable:!0,label:"Personal access token"},catalog:{prefix:"tb_cat_",defaultScopes:["catalog:read"],allowedScopes:["catalog:read"],defaultTtlDays:null,mintable:!0,label:"AI / catalog token"}},yZ=Object.keys(gs).filter(t=>gs[t].mintable);var vZ=gs.pat.prefix,oP=Object.entries(gs).map(([t,e])=>[e.prefix,t]),sP=/^[A-Za-z0-9_-]{20,}$/;function iP(t){if(typeof t!="string")return null;for(let[e,r]of oP)if(t.startsWith(e)&&sP.test(t.slice(e.length)))return r;return null}function Sb(t){return iP(t)==="pat"}os();var aP=8e3,cP={revoked:"the instance REVOKED this token \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",expired:"this token has EXPIRED \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",unknown:"this instance has never seen this token \u2014 it was deleted, or it belongs to a DIFFERENT instance; check the base-url before minting a new PAT",suspended:"the user this token belongs to is SUSPENDED \u2014 an instance administrator has to restore the account; a new token will not help",malformed:"the stored credential is not shaped like a Turbobase PAT (tb_pat_\u2026) \u2014 sign in again",missing:"no token reached the instance \u2014 sign in again",transient:"the instance could not verify the token right now (a storage error, not a decision about the token) \u2014 retry"};function lP(t){return cP[t]??`the instance rejected this token (${t}) \u2014 run \`turbobase auth login\` to store a fresh PAT`}async function uP(t,e,r=fetch){let n;try{n=await r(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(aP)})}catch(s){return{state:"unreachable",detail:s instanceof Error?s.message:String(s)}}if(n.status===200||n.status===403)return{state:"accepted"};if(n.status===401){let s=await n.json().catch(()=>null);return{state:"rejected",reason:typeof s?.reason=="string"&&s.reason?s.reason:"unknown"}}return(n.headers.get("content-type")??"").includes("application/json")?{state:"accepted"}:{state:"unreachable",detail:`HTTP ${n.status} \u2014 this host does not serve the /v1 API`}}function Tb(t){return t.state==="accepted"?tt()?g.green("accepted"):"accepted":t.state==="rejected"?tt()?g.red(`rejected \xB7 ${t.reason}`):`rejected \xB7 ${t.reason}`:tt()?g.yellow("unreachable"):"unreachable"}async function Eb(t={},e=fetch){let r=await $r(),{file:n}=Zi();if(r.length===0){_("not signed in. Run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),q(g.dim(`no sign-ins stored in ${n}.`));return}let o=await Yt(),s=await Promise.all(r.map(async i=>({baseUrl:i.baseUrl,active:!!o&&i.baseUrl===o.baseUrl,updatedAt:i.updatedAt,check:t.probe===!1?{state:"accepted"}:await uP(i.baseUrl,i.token,e)})));if(t.probe===!1)for(let i of s)_(`${i.active?"* ":"  "}${i.baseUrl}  (updated ${i.updatedAt})`);else if(tt())_(Xt(s.map(i=>[i.active?g.green("*"):" ",g.bold(i.baseUrl),Tb(i.check),g.dim(i.updatedAt)]),{head:["","instance","token","updated"]}));else for(let i of s)_(`${i.active?"* ":"  "}${i.baseUrl}  ${Tb(i.check)}  (updated ${i.updatedAt})`);q(g.dim(`tokens read from ${n}`));for(let i of s)i.check.state==="rejected"?(q(g.red(`${i.baseUrl}: ${lP(i.check.reason)}.`)),q(g.dim("  then re-run `turbobase project init` \u2014 .mcp.json holds its own copy of the token, and until it is rewritten the authoring MCP tools stay absent from your session."))):i.check.state==="unreachable"&&q(g.yellow(`${i.baseUrl}: could not reach the instance (${i.check.detail}).`));o||q("no active default \u2014 run `turbobase auth use <base-url>` or pass --base-url.")}async function ND(t){let e=await $r();e.length===0&&x("no stored sign-ins \u2014 run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),ft()||x("this command needs an explicit <base-url> in a non-interactive shell.");try{return await mt(t,e.map(r=>({value:r.baseUrl,label:r.baseUrl,description:`updated ${r.updatedAt}`})))}catch{x("cancelled.")}}async function zD(t,e){let r;try{r=await fetch(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(8e3)})}catch(o){return{ok:!1,kind:"unreachable",detail:o instanceof Error?o.message:String(o)}}let n=(r.headers.get("content-type")??"").includes("application/json");return r.status===200||r.status===403?{ok:!0}:r.status===401?{ok:!1,kind:"bad-token",detail:`HTTP ${r.status}`}:n?{ok:!0}:{ok:!1,kind:"wrong-host",detail:`HTTP ${r.status}`}}function jD(t){q(""),q("Sharing is ON. Two things reach the Turbobase product team from this instance:"),q("  \xB7 anonymized pattern cards from your proposals, solutions and INSTANCE-LEARNINGS.md \u2014"),q("    a pattern label, a record class, a fix shape, an outcome. No scripts, values or ids."),q("  \xB7 redacted prose from your projects\u2019 TURBOBASE-FEEDBACK.md \u2014 the findings you write"),q("    about OUR platform, with instance name, user names and ids masked before they leave."),q(`Turn it off: ${t}/admin/settings \u2192 Telemetry \u2192 "Share learnings and platform feedback".`),q("")}async function LD(t,e,r){let n=await Mg({baseUrl:t,token:e}),o=(await $r()).length-1;if(_(`signed in to ${n.baseUrl} \u2014 now the active instance`+(o>0?` (${o} other${o===1?"":"s"} stored; commands default here).`:".")),jD(n.baseUrl),!r)return;let s=await zD(n.baseUrl,e);s.ok||(s.kind==="wrong-host"?(q(`warning: ${n.baseUrl} did not respond to the Turbobase API (/v1) \u2014 got ${s.detail}.`),q("  In local dev the Turbobase API is on :4100, not the app dev-server port (e.g. :5173)."),q("  The token is stored, but commands will fail against this base-url until it points at the API.")):s.kind==="bad-token"?q(`warning: ${n.baseUrl} rejected the token (401) \u2014 the PAT may be stale, revoked, or for a different instance.`):q(`warning: could not reach ${n.baseUrl} to verify the token (${s.detail}). Stored anyway.`))}async function DD(t){let e=await cs(t),r=iu(e);if(!r){let n=/\bdefineConduit\s*[<(]/.test(e);x(n?`could not parse id/on/from.source/from.recordType from ${t} \u2014 is it a defineConduit({...}) file?`:`could not parse id/recordType/event from ${t} \u2014 is it a defineHook({...}) file?`)}return{...r,sourceCode:e}}async function Ko(t,e,r,n){try{return await ye.access(t),"skipped"}catch{}return await ye.mkdir(Vo(t),{recursive:!0}),await ye.writeFile(t,e,{mode:n??(r?493:420)}),n!==void 0&&await ye.chmod(t,n),"wrote"}async function ES(t,e){if(RS(t)!==".gitignore")return Ko(t,e.content,e.executable,e.mode);let r=await ye.readFile(t,"utf8").catch(()=>null);if(r===null)return Ko(t,e.content,e.executable,e.mode);let n=_y(r);return n===null?"skipped":(await ye.writeFile(t,n,"utf8"),"merged")}function Dm(t){if(t!==void 0){if(t==="junit"||t==="json")return t;x(`unknown --reporter '${t}' (expected 'junit' or 'json').`)}}function nl(t){process.exit(t)}function UD(t){return{name:"turbobase ext test",cases:t.map(r=>{if(r.pass)return{name:r.name,status:"passed"};let n=r.error?"error":r.rejection?.code??"mismatch",o=r.error?`error: ${r.error}`:r.observed!==r.expected?`expected ${r.expected}, observed ${r.observed}`+(r.rejection?` (rejected: ${r.rejection.code??"rejected"}${r.rejection.message?` \u2014 ${r.rejection.message}`:""})`:""):`rejected: ${r.rejection?.code??"rejected"}${r.rejection?.message?` \u2014 ${r.rejection.message}`:""}`;return{name:r.name,status:"failed",detail:o,type:n}})}}function MD(t,e){let r=e.warnings.length===0?[{name:`${t} (${e.kind})`,status:"passed"}]:e.warnings.map(n=>({name:`${t}: ${n.rule}`,status:"failed",type:n.rule,detail:`${n.message} \u2192 fix: ${n.fix}`}));return{name:`turbobase ext lint ${t}`,cases:r}}function qD(t){let e=[];if(t.error)return e.push({name:`replay ${t.fixtureName}`,status:"failed",type:"error",detail:t.error}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e};for(let r of t.guards)e.push(r.status==="failed"?{name:`guard: ${r.name}`,status:"failed",type:r.name,detail:r.detail}:{name:`guard: ${r.name}`,status:"passed",detail:r.status==="skipped-offline"?`skipped-offline: ${r.detail}`:void 0});return t.whenPassed&&t.applyBranch&&e.push({name:`apply-branch: ${t.applyBranch}`,status:"passed",detail:`${t.masterAction??""} (${t.wouldWriteBindings.length} binding(s) would be written)`.trim()}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e}}function Fm({includeInternal:t=!0}={}){let e=new lg;e.name("turbobase").description("Build apps, author extensions, and drive your Turbobase instance.").version("1.6.5").option("--no-color","Disable ANSI colour + animations (also honoured via NO_COLOR / non-TTY)."),e.addHelpText("beforeAll",d=>d.command.parent?"":`${eu()}
 `),e.hook("preAction",(d,f)=>{Cy(e.opts(),f.opts())});let r=e.command("auth").description("Sign in to an instance and manage stored credentials."),n=e.command("project").description("Set up the local project and the files an agent session reads."),o=e.command("ext").description("Author, test, ship, and observe extensions \u2014 hooks and conduits."),s=e.command("kb").description("Write into the instance's knowledge base."),i=e.command("skills").description("Write standing rules into the instance's agent skills.");r.command("login").description("Sign in to an instance by pasting a personal access token (PAT), stored in ~/.turbobase/credentials.").requiredOption("--base-url <url>","Instance base URL, e.g. https://acme.turbobase.app").option("--token <tb_pat_\u2026>","The PAT to store. Mint one in your app under Settings \u203A Access tokens.").option("--no-verify","Skip the post-login connectivity/token probe.").action(async d=>{let f=Lt(d.baseUrl);d.token||x(`auth login needs --token. Mint a PAT in your Turbobase app (Settings \u203A Access tokens), then:
   ${ds} auth login --base-url ${f} --token tb_pat_\u2026`),Sb(d.token)||x("--token does not look like a Turbobase PAT (tb_pat_\u2026)."),await LD(f,d.token,d.verify)}),r.command("status").description("Show every stored sign-in, where its token was read from, and whether the instance still accepts it.").option("--no-probe","List the stored sign-ins without asking each instance about its token.").action(async d=>Eb({probe:d.probe})),r.command("use [base-url]").description("Make an already-stored instance the active default (omit the arg to pick interactively).").action(async d=>{let f=d??await ND("Pick the active instance:"),v=await Bi(f);if(!v){let T=await $r();x(`no stored sign-in for ${Lt(f)}.`+(T.length?` Stored: ${T.map(k=>k.baseUrl).join(", ")}.`:"")+` Run \`turbobase auth login --base-url ${Lt(f)} --token tb_pat_\u2026\`.`)}_(`active instance \u2192 ${v.baseUrl}.`)}),r.command("logout").description("Remove a stored sign-in (defaults to the active instance).").option("--base-url <url>","Which instance to remove (defaults to the active/single one).").option("--all","Remove every stored sign-in.").action(async d=>{if(d.all){let T=await $r();for(let k of T)await Bl(k.baseUrl);_(`removed ${T.length} stored sign-in${T.length===1?"":"s"}.`);return}let f=await Bl(d.baseUrl);f||x(d.baseUrl?`no stored sign-in for ${Lt(d.baseUrl)}.`:"nothing to sign out of (or ambiguous \u2014 pass --base-url / --all).");let v=await Yt();_(`signed out of ${f}.`+(v?` Active instance \u2192 ${v.baseUrl}.`:""))}),n.command("types").description("Generate types.ts from the signed-in instance's catalog.").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("-o, --out <file>","Output file","types.ts").option("--records-only","Emit only record-shape interfaces (skip the OpenAPI half).").action(async d=>{let{baseUrl:f,token:v}=await ne(d.baseUrl),T;try{T=await En({baseUrl:f,token:v,recordsOnly:d.recordsOnly})}catch(y){let S=y instanceof Error?y.message:String(y);if(!d.recordsOnly&&/openapi\.json failed \(401/.test(S)){q("types-gen: /v1/catalog/openapi.json needs a browser session \u2014 emitting record shapes only. The record shapes are the half apps generate against; for the OpenAPI half, run it from a signed-in browser session.");try{T=await En({baseUrl:f,token:v,recordsOnly:!0})}catch(R){x(`types generation failed: ${R instanceof Error?R.message:String(R)}`)}}else x(`types generation failed: ${S}`)}let k=xe(process.cwd(),d.out);await ye.writeFile(k,T,"utf8"),_(`wrote ${k} (${T.split(`
 `).length} lines).`)}),jy(n),n.command("grounding").description("Write the instance's grounding brief (source primer + record anatomy + KB retrieval) to a file for agent sessions.").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--records <list>","Comma-separated record types to focus, e.g. purchaseOrder,itemReceipt.").option("--query <text>","Retrieval question for the knowledge base (e.g. what the app is about).").option("-o, --out <file>","Output file","INSTANCE.md").action(async d=>{let{baseUrl:f,token:v}=await ne(d.baseUrl),T=new URLSearchParams;d.records&&T.set("records",d.records),d.query&&T.set("query",d.query);let k=T.toString(),y=await fetch(`${f}/v1/catalog/grounding${k?`?${k}`:""}`,{headers:{Authorization:`Bearer ${v}`,Accept:"application/json"}});y.ok||x(`grounding fetch failed: GET /v1/catalog/grounding \u2192 ${y.status}`);let R=((await y.json()).markdown??"").trim(),C=xe(process.cwd(),d.out),N=d.records?` records=${d.records}`:"",j=`<!-- GENERATED by \`turbobase project grounding\` against ${f}${N} \u2014 do not edit; re-run to refresh. -->
@@ -3604,7 +3604,7 @@ samples init: ${R} written, ${C} skipped.`)});let It=e.command("guardrails").des
 `+g.dim("create one with `turbobase guardrails create <name> --source <s> --record <r>`"));_(Xt(k.map(Wo),{head:xi})),_(g.dim("  first match wins; lower PRIO is evaluated first."))}),It.command("create <name>").description("Create a rule gating PG\u2192source writes that match it.").option("--source <system>","Adapter id to scope to, or '*' for every source.","*").option("--record <type>","Record type to scope to, or '*' for every record.","*").option("--op <glob>","Raw op glob, when gating something other than a record write.").option("--target <glob>","Row address glob, e.g. 'salesOrder.12345'.").option("--actor <glob>","Only match this caller, e.g. 'agent:*' to gate AI writes but not human ones.").option("--decision <d>","allow | allow_with_audit | require_confirm | deny.","deny").option("--priority <n>","Lower is evaluated first (default 100).",d=>Number(d)).option("--when <expr>","Row predicate, e.g. 'total gt 10000'. Omit to match every row.").option("--reason <text>","Why this rule exists \u2014 shown to a blocked writer and in `list`.").option("--disabled","Create the rule parked, so it takes effect only when activated.").option("--confirm-freeze-all","Required for an unconditional deny across '*'/'*'.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{let{baseUrl:v,token:T}=await ne(f.baseUrl),k=new X({baseUrl:v,token:T}),y;try{y=await k.guardrailCreate({name:d,source:f.source,record:f.record,decision:f.decision,...f.op?{op:f.op}:{},...f.target?{target:f.target}:{},...f.actor?{actor:f.actor}:{},...Number.isFinite(f.priority)?{priority:Number(f.priority)}:{},...f.when?{when:f.when}:{},...f.reason?{reason:f.reason}:{},...f.disabled?{enabled:!1}:{},...f.confirmFreezeAll?{confirmFreezeAll:!0}:{}})}catch(S){se(S,"extensions:deploy","create a guardrail"),x(`create guardrail failed: ${S instanceof Error?S.message:String(S)}`)}_(`${g.green("\u2713")} guardrail ${g.bold(y.name??y.id)} created${y.status==="active"?"":g.dim(` (${y.status} \u2014 activate it to take effect)`)}`),_(g.dim(`  ${y.decision} ${y.source}/${y.record??y.op}${y.actor?` actor=${y.actor}`:""}${y.when?` where ${y.when}`:""} @prio ${y.priority}`)),_(g.dim(`  verify with: turbobase guardrails test --source ${y.source==="*"?"<source>":y.source} --record <record>`))}),It.command("edit <name>").description("Change a rule \u2014 its decision, priority, predicate or reason.").option("--decision <d>","allow | allow_with_audit | require_confirm | deny.").option("--priority <n>","Lower is evaluated first.",d=>Number(d)).option("--when <expr>","New row predicate. Pass '' to match every row.").option("--reason <text>","Why this rule exists.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{f.decision===void 0&&f.priority===void 0&&f.when===void 0&&f.reason===void 0&&x("edit: nothing to change \u2014 pass --decision, --priority, --when or --reason.");let{baseUrl:v,token:T}=await ne(f.baseUrl),k=new X({baseUrl:v,token:T}),y;try{y=await k.guardrailUpdate(d,{...f.decision!==void 0?{decision:f.decision}:{},...Number.isFinite(f.priority)?{priority:Number(f.priority)}:{},...f.when!==void 0?{when:f.when}:{},...f.reason!==void 0?{reason:f.reason}:{}})}catch(S){se(S,"extensions:deploy","edit a guardrail"),x(`edit guardrail failed: ${S instanceof Error?S.message:String(S)}`)}_(`${g.green("\u2713")} guardrail ${g.bold(y.name??y.id)} updated`),_(g.dim(`  ${y.decision} ${y.source}/${y.record??y.op}${y.when?` where ${y.when}`:""} @prio ${y.priority}`))});for(let[d,f,v]of[["activate","active","activated"],["deactivate","inactive","deactivated"]])It.command(`${d} <name>`).description(f==="active"?"Arm a parked or proposed rule.":"Park a rule without deleting it \u2014 the reversible move mid-rollout.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(T,k)=>{let{baseUrl:y,token:S}=await ne(k.baseUrl),R=new X({baseUrl:y,token:S});try{await R.guardrailUpdate(T,{status:f})}catch(C){se(C,"extensions:deploy",`${d} a guardrail`),x(`${d} guardrail failed: ${C instanceof Error?C.message:String(C)}`)}_(`${g.green("\u2713")} guardrail ${g.bold(T)} ${v}`),f==="inactive"&&_(g.dim("  writes it was gating now fall through to the other rules."))});It.command("delete <name>").description("Remove a rule. Prefer `deactivate` if you may want it back.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{let{baseUrl:v,token:T}=await ne(f.baseUrl),k=new X({baseUrl:v,token:T});try{await k.guardrailDelete(d)}catch(y){se(y,"extensions:deploy","delete a guardrail"),x(`delete guardrail failed: ${y instanceof Error?y.message:String(y)}`)}_(`${g.green("\u2713")} guardrail ${g.bold(d)} deleted`)}),It.command("posture [mode]").description("Show or set the GLOBAL default. 'allow' = deny-list (unmatched writes allowed, carve with deny rules). 'deny' = allow-list (unmatched writes denied, open with allow rules).").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{let{baseUrl:v,token:T}=await ne(f.baseUrl),k=new X({baseUrl:v,token:T}),y=C=>C==="deny"?"deny-by-default (allow-list)":"allow-by-default (deny-list)";if(d===void 0){let C;try{C=await k.guardrailPostureGet()}catch(N){se(N,"extensions:deploy","read the guardrail posture"),x(`read posture failed: ${N instanceof Error?N.message:String(N)}`)}_(`guardrail posture: ${g.bold(y(C.mode))}`),_(g.dim(C.mode==="deny"?"  Unmatched writes are DENIED. Open records with `guardrails create <name> --decision allow`.":"  Unmatched writes are allowed-with-audit. Freeze records with `guardrails create <name> --decision deny`."));return}let S=d.trim().toLowerCase();S!=="allow"&&S!=="deny"&&x("posture must be 'allow' or 'deny'.");let R;try{R=await k.guardrailPostureSet(S)}catch(C){se(C,"extensions:deploy","set the guardrail posture"),x(`set posture failed: ${C instanceof Error?C.message:String(C)}`)}_(`${g.green("\u2713")} guardrail posture set to ${g.bold(y(R.mode))}`),R.mode==="deny"&&_(g.dim("  Every record with no active ALLOW rule is now frozen for write-back. Verify with `guardrails test --source <s> --record <r>`."))}),It.command("test").description("What happens to this write? Runs the real evaluator; writes nothing.").requiredOption("--source <system>","Adapter id the write targets.").requiredOption("--record <type>","Record type the write targets.").option("--actor <actor>","Caller to simulate, e.g. 'agent:ai' or 'user:<id>'.").option("--external-id <id>","Source-side row id, for target-scoped rules.").option("--fields <json>","A candidate row as JSON, so `when` predicates can be decided.").option("--op <op>","Write op: 'delete' tests <record>.delete; omitted tests <record>.write.").option("--phase <phase>","boundary | cdc | worker | adapter. Defaults to worker (the last gate).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--json","Emit raw JSON.").action(async d=>{let f;if(d.fields)try{f=JSON.parse(d.fields)}catch(R){x(`--fields must be valid JSON: ${R instanceof Error?R.message:String(R)}`)}let{baseUrl:v,token:T}=await ne(d.baseUrl),k=new X({baseUrl:v,token:T}),y;try{y=await k.guardrailTest({source:d.source,record:d.record,...d.actor?{actor:d.actor}:{},...d.externalId?{externalId:d.externalId}:{},...f?{fields:f}:{},...d.op?{op:d.op}:{},...d.phase?{phase:d.phase}:{}})}catch(R){se(R,"extensions:deploy","test guardrails"),x(`guardrails test failed: ${R instanceof Error?R.message:String(R)}`)}if(d.json)return _(JSON.stringify(y,null,2));let S=`${d.source}/${y.op??d.record}`;y.degraded?(_(`${g.red("\u2717")} ${S} \u2014 guardrail policy is UNREADABLE; writes fail closed`),_(g.dim(`  ${y.reason}`))):y.allowed?_(`${g.green("\u2713")} ${S} \u2014 ${y.decision}`+(y.blockedBy?g.dim(` (rule ${y.blockedBy})`):g.dim(" (no rule matched)"))):(_(`${g.red("\u2717")} ${S} \u2014 ${y.decision} by ${g.bold(y.blockedBy??"?")} at the ${y.phase} gate`),y.message&&_(g.dim(`  ${y.message}`))),y.decision==="require_confirm"&&_(g.yellow("  this write is HELD for operator approval, not refused.")),y.allowed||(process.exitCode=1)});let jr=e.command("tables").description("Author custom tables on your instance (create, evolve, inspect)."),Wn=(d,f={})=>{let v=`${g.bold(d.table)}  ${g.dim(d.displayName)}`;_(d.exists===!1?`${v}  ${g.dim("(new)")}`:v);for(let T of d.fields){let k=[T.required?"required":null].filter(Boolean).join(", "),y=f.showClaimants&&T.claimedBy?.length?`  ${g.dim(`\u2190 ${T.claimedBy.join(", ")}`)}`:"";_(`  ${T.column.padEnd(28)} ${T.type}${k?` (${k})`:""}${y}`)}f.showClaimants&&d.claimants.length>1&&_(g.dim(`  claimed by ${d.claimants.join(", ")}`))};function ki(d){if(d instanceof pe&&d.status===409){let f=d.body;f?.error==="table_conflict"&&f.message&&(q(f.message),process.exit(1))}x(`tables: ${d instanceof Error?d.message:String(d)}`)}let Hm=async d=>{let f=At(xe(process.cwd(),d),"public","turbobase.json"),v=await ye.readFile(f,"utf8").catch(()=>null);if(v===null)return null;let T;try{T=JSON.parse(v)}catch(y){x(`${f} is not valid JSON: ${y instanceof Error?y.message:String(y)}`)}let k=T.tables;return k===void 0?{tables:[],manifestPath:f}:(Array.isArray(k)||x(`${f}: "tables" must be an array.`),{tables:k,manifestPath:f})};jr.command("list").description("List the custom tables on your instance and who claims each one.").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--json","Emit raw JSON instead of a table.").action(async d=>{let{baseUrl:f,token:v}=await ne(d.baseUrl),T=new X({baseUrl:f,token:v}),k;try{k=await T.tablesList()}catch(y){se(y,"extensions:deploy","list tables"),x(`list tables failed: ${y instanceof Error?y.message:String(y)}`)}if(d.json)return _(JSON.stringify(k,null,2));if(k.length===0)return _("no custom tables yet \u2014 create one with `turbobase tables create <slug>`.");_(Xt(k.map(y=>[y.table,y.displayName,String(y.fields.length),y.status,y.claimedBy.join(", ")||"\u2014"]),{head:["TABLE","NAME","FIELDS","STATUS","CLAIMED BY"]}))}),jr.command("plan").description("Preview what this project's declared tables would do. Writes nothing; exits 1 on a conflict.").argument("[dir]","Project directory holding public/turbobase.json (default ./).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--as <claimant>","Claim as `cli` or `app:<slug>` (default: the app slug in .turbobase, else cli).").action(async(d,f)=>{let v=await Hm(d??".");if(v||x(`no public/turbobase.json under ${xe(process.cwd(),d??".")}.`),v.tables.length===0)return _(`${v.manifestPath} declares no tables \u2014 nothing to plan.`);let{baseUrl:T,token:k}=await ne(f.baseUrl),y=new X({baseUrl:T,token:k}),S;try{S=await ae("planning tables",()=>y.tablesPlan({claimedBy:f.as,tables:v.tables}))}catch(R){se(R,"extensions:deploy","plan tables"),ki(R)}_(`claiming as ${g.bold(S.claimedBy)}`);for(let R of S.tables)Wn(R,{showClaimants:!0});_(""),_(g.dim("nothing was applied \u2014 run `turbobase tables apply` (or deploy the app) to make it so."))}),jr.command("apply").description("Apply this project's declared tables to the instance.").argument("[dir]","Project directory holding public/turbobase.json (default ./).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--as <claimant>","Claim as `cli` or `app:<slug>` (default: cli).").action(async(d,f)=>{let v=await Hm(d??".");if(v||x(`no public/turbobase.json under ${xe(process.cwd(),d??".")}.`),v.tables.length===0)return _(`${v.manifestPath} declares no tables \u2014 nothing to apply.`);let{baseUrl:T,token:k}=await ne(f.baseUrl),y=new X({baseUrl:T,token:k}),S;try{S=await ae("applying tables",()=>y.tablesApply({claimedBy:f.as,tables:v.tables}))}catch(R){se(R,"extensions:deploy","apply tables"),ki(R)}for(let R of S.tables)Wn(R,{showClaimants:!0});_(`applied ${S.tables.length} table${S.tables.length===1?"":"s"} as ${S.claimedBy}.`)}),jr.command("create").description('Create a single table without a manifest (the CLI twin of "New custom table").').argument("<slug>","Table slug; the physical table is cr_<slug>.").requiredOption("-f, --field <name:type>","Field as name:type[:required] \u2014 text|number|date|bool|select. Repeatable.",(d,f)=>[...f??[],d],[]).option("--name <displayName>","Human label for the table (defaults to the slug).").option("--restrict-to-owner","Non-admins see only rows they created.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{let v=f.field.map(R=>{let[C,N,j]=R.split(":");return(!C||!N)&&x(`--field "${R}" must be name:type[:required] (e.g. title:text:required).`),j!==void 0&&j!=="required"&&x(`--field "${R}": the third part may only be "required".`),{name:C,type:N,...j==="required"?{required:!0}:{}}}),{baseUrl:T,token:k}=await ne(f.baseUrl),y=new X({baseUrl:T,token:k}),S;try{S=await ae(`creating cr_${d}`,()=>y.tablesApply({tables:[{slug:d,displayName:f.name??d,fields:v,...f.restrictToOwner?{rowLevelOwner:!0}:{}}]}))}catch(R){se(R,"extensions:deploy","create a table"),ki(R)}for(let R of S.tables)Wn(R);_(""),_(g.dim("grant access under Settings \u203A Users, or in the Records page permissions matrix."))}),jr.command("drop").description("Drop a table and everything in it. Irreversible.").argument("<slug>","Table slug (without the cr_ prefix).").requiredOption("--confirm <slug>","Type the EXACT slug to confirm (fail-closed).").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{f.confirm!==d&&x(`drop refused: --confirm "${f.confirm}" does not match "${d}".`);let{baseUrl:v,token:T}=await ne(f.baseUrl),k=new X({baseUrl:v,token:T}),y;try{y=await ae(`dropping cr_${d}`,()=>k.tablesDrop(d,f.confirm))}catch(S){se(S,"extensions:deploy","drop a table"),x(`drop failed: ${S instanceof Error?S.message:String(S)}`)}if(!y.removed)return _(`no table named "${d}" on this instance \u2014 nothing dropped.`);_(`dropped ${y.table} and every row in it.`)});let sl=e.command("sandbox").description("Ephemeral local authoring sandboxes.");sl.command("create").description("Stand up a fresh local sandbox seeded with a sampled+redacted slice of an instance.").requiredOption("--from <instance>","Source instance to clone the data slice from.").option("--ttl <duration>","Time-to-live before reaping (e.g. 72h, 30m, 7d).","72h").option("--sample <pct>","Percent of each table to copy (e.g. 2%).","2%").option("--base-url <url>","Local base URL the sandbox is reachable at.").action(async d=>{process.env.TURBOBASE_SANDBOX="1";let f=Mm(),v;try{v=await kb(f,{fromTenant:d.from,ttl:d.ttl,sample:d.sample,baseUrl:d.baseUrl})}catch(T){T instanceof ms&&x(T.message),x(`sandbox create failed: ${T instanceof Error?T.message:String(T)}`)}_(`sandbox ${v.name} ready.`),_(`  source:  ${v.fromTenant} (sampled ${Math.round(v.sampleFraction*100)}%, redacted)`),_(`  url:     ${v.url}`),_(`  expires: ${v.expiresAt}`)}),sl.command("destroy").argument("<name>","The sandbox name to tear down.").description("Drop a sandbox database and remove it from the registry.").action(async d=>{let f=Mm();await xu(f).catch(()=>[]);let v;try{v=await $b(f,d)}catch(T){x(`sandbox destroy failed: ${T instanceof Error?T.message:String(T)}`)}v||x(`no sandbox named '${d}'.`),_(`destroyed sandbox ${v.name} (dropped ${v.database}).`)}),sl.command("list").description("List active sandboxes with TTL/expiry; reaps any past their TTL.").action(async()=>{let d=Mm(),f=await xu(d).catch(()=>[]),v=await ua(),{active:T}=_u(v);if(T.length===0)_("no active sandboxes.");else{for(let k of T)_(`  ${k.name}  from=${k.fromTenant}  expires=${k.expiresAt}  ${k.url}`);_(`
 ${T.length} active sandbox(es).`)}f.length>0&&_(`(reaped ${f.length} expired sandbox(es).)`)}),o.command("export").description("Pull the live instance into turbobase/bundle.json (adopt an instance into a repo).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--out <dir>","Directory to write the bundle into.",Qi).action(async d=>{let{baseUrl:f,token:v}=await ne(d.baseUrl),T=new X({baseUrl:f,token:v}),k;try{k=await ae("exporting instance config",()=>T.configExport())}catch(R){R instanceof pe&&(R.status===401||R.status===403)&&x("ext export forbidden \u2014 the stored PAT lacks extensions:deploy. Re-run `turbobase auth login`."),x(`ext export failed: ${R instanceof Error?R.message:String(R)}`)}let y=typeof k.serialized=="string"?k.serialized:`${JSON.stringify(k.manifest??k,null,2)}
 `,S=xe(process.cwd(),d.out,us);await ye.mkdir(Vo(S),{recursive:!0}),await ye.writeFile(S,y,"utf8"),_(`wrote ${d.out}/${us} (${y.split(`
-`).length} lines).`)});let Vm=o.command("extras").description("Manage the optional native packages `ext test` and `ext replay` need."),PS=[{name:"esbuild",needs:"compiling an extension (`test`, `replay`)"},{name:"isolated-vm",needs:"executing an extension in the sandbox (`test`, `replay`)"}],Km=()=>process.env.TURBOBASE_HOME?.trim()||At(CD(),".turbobase"),AS=()=>"1.6.4",$i=async()=>Promise.all(PS.map(async d=>{try{return await import(d.name),{...d,present:!0}}catch{return{...d,present:!1}}}));Vm.command("status").description("Report which optional native packages are installed.").action(async()=>{let d=await $i();for(let f of d)_(`${f.present?He.success("installed"):He.warn("missing")}  ${g.bold(f.name)} \u2014 ${f.needs}`);d.some(f=>!f.present)&&_(`
+`).length} lines).`)});let Vm=o.command("extras").description("Manage the optional native packages `ext test` and `ext replay` need."),PS=[{name:"esbuild",needs:"compiling an extension (`test`, `replay`)"},{name:"isolated-vm",needs:"executing an extension in the sandbox (`test`, `replay`)"}],Km=()=>process.env.TURBOBASE_HOME?.trim()||At(CD(),".turbobase"),AS=()=>"1.6.5",$i=async()=>Promise.all(PS.map(async d=>{try{return await import(d.name),{...d,present:!0}}catch{return{...d,present:!1}}}));Vm.command("status").description("Report which optional native packages are installed.").action(async()=>{let d=await $i();for(let f of d)_(`${f.present?He.success("installed"):He.warn("missing")}  ${g.bold(f.name)} \u2014 ${f.needs}`);d.some(f=>!f.present)&&_(`
 run \`${ds} ext extras install\` to fetch them into ${Km()}.`)}),Vm.command("install").description("Install the optional native packages into $TURBOBASE_HOME (needs npm).").action(async()=>{let d=await $i();if(d.every(C=>C.present)){_(He.success("extras already installed \u2014 nothing to do."));return}let f=Km();await ye.mkdir(f,{recursive:!0});let v=d.filter(C=>!C.present).map(C=>C.name),T=mu(process.platform,process.arch),k=async(C,N)=>{let{code:j,stderr:K}=await _i("npm",["install","--prefix",f,"--no-audit","--no-fund",...C]);j!==0&&x(`extras install failed while installing ${N} (npm exited ${j}).
 ${K.trim()}
 These are native packages \u2014 they need npm and a working toolchain. Everything except \`test\` and \`replay\` works without them.`)},y=v.filter(C=>C!=="isolated-vm");if(y.length>0){let C=y.map(N=>`${N}@${hu[N]??"latest"}`);_(`installing ${C.join(", ")} \u2192 ${f}/node_modules \u2026`),await k(C,y.join(", "))}if(v.includes("isolated-vm")){let C=`isolated-vm@${hu["isolated-vm"]}`;if(_(`installing ${C} \u2192 ${f}/node_modules \u2026`),await k(["--ignore-scripts",C],"isolated-vm"),gb.includes(T)){let j=`${fu}@${AS()}`;_(`fetching ${j} (no upstream binary for ${T}) \u2026`);let{code:K}=await _i("npm",["install","--prefix",f,"--no-audit","--no-fund","--ignore-scripts",j]);K!==0&&_(He.warn(`could not fetch ${j} \u2014 falling back to a source build.`))}let N=await yb({home:f});N.length>0&&_(`  ${He.success("prebuilt")} ${N.join(", ")} \u2192 isolated-vm/prebuilds/${T}`)}let S=await $i(),R=S.filter(C=>!C.present).map(C=>C.name);if(R.includes("isolated-vm")){_(He.warn(`no prebuilt isolated-vm for ${T} / Node ${process.versions.node} (${gu()}) \u2014 building from source. This needs Python and a C++ toolchain, and takes a few minutes.`));let{code:C}=await _i("npm",["rebuild","--prefix",f,"isolated-vm"]);C===0&&(S=await $i(),R=S.filter(N=>!N.present).map(N=>N.name))}R.length>0&&x(`npm succeeded but ${R.join(", ")} still will not load \u2014 no prebuilt binary for ${T} / Node ${process.versions.node} (${gu()}), and the source build did not produce one either. Everything except \`test\` and \`replay\` works without them.`),_(He.success("extras installed \u2014 `turbobase ext test` and `turbobase ext replay` are ready."))});let Gn=e.command("release").description("Ship a release to your instance: deploy | status | rollback | list.");return Gn.command("deploy").description("Enqueue a server-side release deploy. UPLOADS the SDF project src/ from the checkout (the producer swap) when present; else a solution-only live-fetch deploy. An approved target requires --approved-by.").requiredOption("--target <mode>","Deploy posture: auto (apply now) | approved (needs a recorded approval).").option("--solution <id>","The solution id the release delivers (omit for an upload-only deploy).").option("--project <dir>","SDF project dir whose src/ is uploaded (default: cwd).").option("--git-repo <repo>","Git provenance LINK: source repo (default $GITHUB_REPOSITORY or `git remote get-url origin`).").option("--git-ref <ref>","Git provenance LINK: ref/branch/tag (default $GITHUB_REF).").option("--ref <committish>","Git provenance: the ref/branch/tag/sha the upload was built from; resolved to a commit sha via `git rev-parse` (default $GITHUB_SHA or HEAD).").option("--pr-url <url>","Git provenance LINK: the PR this deploy came from (default $PR_URL).").option("--approved-by <email>","Record the approval (REQUIRED for --target approved).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--follow","Poll the release deploy to completion (exit non-zero on failure).").option("--interval-ms <ms>","Poll interval for --follow (default 2000).").action(async d=>{let f=d.target==="approved"?"approved":d.target==="auto"?"auto":null;f||x(`--target must be 'auto' or 'approved' (got '${d.target}').`);let v=await KD(xe(process.cwd(),d.project??".")),T=Object.keys(v).length;!d.solution&&T===0&&x("release deploy needs --solution <id> (live-fetch) or an SDF project (a src/ dir under --project, default cwd) to upload.");let y=(d.ref?await qm(["rev-parse",d.ref])??d.ref:null)??process.env.GITHUB_SHA??await qm(["rev-parse","HEAD"]),S=d.gitRepo??process.env.GITHUB_REPOSITORY??await qm(["remote","get-url","origin"]),R=d.gitRef??process.env.GITHUB_REF??null,C=d.prUrl??process.env.PR_URL??null,{baseUrl:N,token:j}=await ne(d.baseUrl),K=new X({baseUrl:N,token:j}),M;try{M=await K.releaseDeploy({solutionId:d.solution??null,target:f,approvedBy:d.approvedBy??null,files:T>0?v:null,gitRepo:S,gitRef:R,gitSha:y,prUrl:C})}catch(te){se(te,"releases:write","release deploy"),te instanceof pe&&te.status===404&&x("solution_not_found \u2014 no solution with that id."),x(`release deploy failed: ${te instanceof Error?te.message:String(te)}`)}_(`release ${M.releaseId} enqueued \u2192 taskId=${M.taskId} (target=${f}`+(T>0?`, uploaded ${T} bundle file(s)`:", live-fetch")+")."),d.follow&&await cu(()=>K.releaseStatus(M.releaseId),`release ${M.releaseId}`,d.intervalMs)}),Gn.command("pull").argument("<id>","The release id").description("Write the SDF project a FAILED release built into <dir>: owned/ (yours, editable) and context/ (the rest of the bundle, read-only). Edit owned/, then `release push`.").requiredOption("--dir <path>","Directory to write the project into (created if absent).").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,f)=>{let{baseUrl:v,token:T}=await ne(f.baseUrl),k=new X({baseUrl:v,token:T}),y;try{y=await k.releaseFiles(d)}catch(C){C instanceof pe&&C.status===404&&x(`release ${d} not found.`),C instanceof pe&&C.status===409&&x(`no built project was retained for release ${d}. Files are kept for a FAILED attempt only \u2014 a shipped bundle is recoverable from the account.`),se(C,"releases:write","pull a release"),x(`release pull failed: ${C instanceof Error?C.message:String(C)}`)}let S=xe(process.cwd(),f.dir),R=0;for(let[C,N]of[["owned",y.owned],["context",y.context]])for(let[j,K]of Object.entries(N)){let M=At(S,C,j);await ye.mkdir(Vo(M),{recursive:!0}),await ye.writeFile(M,K,"utf8"),R++}await ye.writeFile(At(S,".turbobase-release.json"),JSON.stringify({releaseId:y.releaseId,version:y.version,contentDigest:y.contentDigest},null,2),"utf8"),_(`pulled release ${y.releaseId} (${y.status}) \u2192 ${S}

package/dist/turbobase.js CHANGED Viewed

@@ -3527,7 +3527,7 @@ ${s.map(Ow).join(`
 `))}async function cp(t,e,r=Or){let n=[...new Set(t.map(a=>a.trim()).filter(Boolean))];n.length===0&&w("name at least one skill slug. `turbobase skills list` shows them.");let s=await Nr(e,r);if(!await Vs(`Publish ${n.length} skill(s)?`,"Yes \u2014 publish them","their text is injected into every matching turn from now on",e))return;let i;try{i=await J("publishing",()=>s.skillsPublish(n))}catch(a){G(a,"skills:publish","publish a skill"),w(`publish failed: ${a instanceof Error?a.message:String(a)}`)}y(f.green(`published ${i.published.length} skill(s) \u2014 live now.`)),i.unknown.length>0&&(L(f.yellow(`no such skill: ${i.unknown.join(", ")}`)),process.exitCode=1),L(f.dim(`release v${i.version.version_no} \xB7 undo with: turbobase skills unpublish ${i.published.join(" ")}`))}async function dp(t,e,r=Or){let n=[...new Set(t.map(a=>a.trim()).filter(Boolean))];n.length===0&&w("name at least one skill slug. `turbobase skills list` shows them.");let s=await Nr(e,r);if(!await Vs(`Move ${n.length} skill(s) back to draft?`,"Yes \u2014 unpublish them","they stop being injected immediately; the text and its history are kept",e))return;let i;try{i=await J("unpublishing",()=>s.skillsUnpublish(n))}catch(a){G(a,"skills:publish","unpublish a skill"),w(`unpublish failed: ${a instanceof Error?a.message:String(a)}`)}y(f.green(`unpublished ${i.unpublished.length} skill(s) \u2014 retracted now.`)),L(f.dim(`release v${i.version.version_no} \xB7 re-publish with: turbobase skills publish ${i.unpublished.join(" ")}`)),i.unknown.length>0&&(L(f.yellow(`no such skill: ${i.unknown.join(", ")}`)),process.exitCode=1)}async function up(t,e,r=Or){let n=Number(t);(!Number.isInteger(n)||n<1)&&w(`--version must be a release number (got '${t}'). \`turbobase skills releases\` lists them.`);let s=await Nr(e,r);if(await Vs(`Roll the skills back to release v${n}?`,"Yes \u2014 restore that release","content only: a skill an operator has since unpublished stays off",e))try{let i=await J("rolling back",()=>s.skillsRollback(n));y(f.green(`rolled back to v${i.version.version_no}.`))}catch(i){G(i,"skills:publish","roll back a skills release"),w(`rollback failed: ${i instanceof Error?i.message:String(i)}`)}}async function pp(t,e=Or){let r=await Nr(t,e),n;try{n=await J("reading the releases",()=>r.skillsReleases())}catch(s){G(s,"skills:publish","read the skills releases"),w(`could not read the releases: ${s instanceof Error?s.message:String(s)}`)}if(n.items.length===0){L("no releases yet.");return}for(let s of n.items){let o=s.is_current?f.green("*"):" ",i=s.release_note?` \u2014 ${s.release_note}`:"";y(`${o} v${s.version_no}  ${s.skill_count} skill(s)  ${f.dim(s.published_at)}${s.published_by?f.dim(` by ${s.published_by}`):""}${f.dim(i)}`)}}async function hp(t,e,r=Or){let n=[...new Set((t??[]).map(u=>u.trim()).filter(Boolean))];n.length===0&&w("name at least one skill to delete. `turbobase skills list` shows the slugs.");let s=await Nr(e,r);if(!await Vs(n.length===1?`Delete the skill '${n[0]}'?`:`Delete ${n.length} skills?
   ${n.join(`
   `)}`,"Yes \u2014 delete them","permanent: the rows and their text are removed. Prior releases keep their own copy.",e))return;let i=[],a=[];for(let u of n)try{i.push(await J(`deleting ${u}`,()=>s.skillsDelete(u)))}catch(p){if(p instanceof X&&p.status===404){a.push(u);continue}i.length>0&&L(f.dim(`deleted before the error: ${i.map(g=>g.slug).join(", ")}`)),G(p,"skills:publish","delete a skill"),w(`delete failed on '${u}': ${p instanceof Error?p.message:String(p)}`)}i.length>0&&y(f.green(`deleted ${i.length} skill(s).`));let l=i.filter(u=>u.wasPublished).map(u=>u.slug);l.length>0&&L(f.yellow(`Published until now, so no longer injected: ${l.join(", ")}`)),a.length>0&&(L(f.yellow(`no such skill: ${a.join(", ")}`)),process.exitCode=1)}import{promises as fp}from"node:fs";import{join as iv,relative as av,resolve as lv,sep as cv}from"node:path";var dv=new Set(["node_modules","dist","build","coverage",".git",".claude",".turbobase",".next",".svelte-kit",".vercel",".cache"]),uv=new Set([".mcp.json",".env"]);function pv(t){return uv.has(t)||t.startsWith(".env.")&&t!==".env.example"}function hv(t){return Buffer.compare(Buffer.from(t.toString("utf8"),"utf8"),t)===0}function fv(t){return t.includes(0)}async function mp(t){let e=lv(t),r={},n=[],s=[],o=[];async function i(a){let l=await fp.readdir(a,{withFileTypes:!0});for(let u of l){let p=iv(a,u.name);if(dv.has(u.name))continue;if(u.isDirectory()){await i(p);continue}if(!u.isFile())continue;let g=av(e,p).split(cv).join("/");if(pv(u.name)){s.push(g);continue}let $=await fp.readFile(p);if(!hv($)){n.push(g);continue}fv($)&&o.push(g),r[g]=$.toString("utf8")}}return await i(e),{files:r,skipped:n,secrets:s,unstorable:o}}import{randomBytes as mv}from"node:crypto";var gv="/_tb/app-assets",bv=16,yv=/^[0-9a-f]{32}$/;function gp(){return mv(bv).toString("hex")}function wv(t){return yv.test(t)}function bp(t){if(!wv(t))throw new Error(`not a build id: ${t}`);return`${gv}/${t}/`}var yp=7;import Gs from"node:fs/promises";import _n from"node:path";var ca={esbuild:"0.28.1","isolated-vm":"6.1.2"},da="@turbobase/isolated-vm-prebuilds";function ua(t,e){return`${t}-${e}`}function pa(t=process.versions){return`abi${t.modules}`}var wp=["darwin-x64","win32-arm64"];async function vp(t){let e=t.platform??process.platform,r=t.arch??process.arch,n=ua(e,r),s=_n.join(t.home,"node_modules"),o=_n.join(s,...da.split("/"),"prebuilds",n),i=_n.join(s,"isolated-vm","prebuilds",n),a;try{a=await Gs.readdir(o)}catch{return[]}let l=[];await Gs.mkdir(i,{recursive:!0});for(let u of a){if(!u.endsWith(".node"))continue;let p=_n.join(i,u);try{await Gs.copyFile(_n.join(o,u),p,Gs.constants?.COPYFILE_EXCL??1),l.push(u)}catch{}}return l}import{homedir as vv}from"node:os";import{join as kp}from"node:path";import{promises as ha}from"node:fs";function _p(){let t=process.env.TURBOBASE_HOME??kp(vv(),".turbobase");return{dir:t,file:kp(t,"sandboxes.json")}}var kv={s:1e3,m:6e4,h:36e5,d:864e5};function Sv(t){let e=/^\s*(\d+)\s*([smhd])\s*$/.exec(t);if(!e)throw new Error(`invalid --ttl '${t}': expected <number><unit> where unit is s|m|h|d (e.g. 72h, 30m, 7d).`);let r=Number(e[1]);if(!Number.isFinite(r)||r<=0)throw new Error(`invalid --ttl '${t}': duration must be a positive integer.`);return r*kv[e[2]]}function _v(t,e=Date.now()){return new Date(e+Sv(t)).toISOString()}function $v(t,e=Date.now()){let r=Date.parse(t);return Number.isNaN(r)?!0:r<=e}function xv(t){let e=/^\s*(\d+(?:\.\d+)?)\s*%?\s*$/.exec(t);if(!e)throw new Error(`invalid --sample '${t}': expected a percent like 2% (or a bare number).`);let r=Number(e[1]);if(!Number.isFinite(r)||r<0||r>100)throw new Error(`invalid --sample '${t}': percent must be between 0 and 100.`);return r/100}function Tv(t,e){if(e>=1)return[...t];if(e<=0||t.length===0)return[];let r=Math.max(1,Math.round(1/e)),n=[];for(let s=0;s<t.length;s+=r)n.push(t[s]);return n}var Rv="[REDACTED]",$n=class extends Error{constructor(e){super(e),this.name="SandboxDataCopyUnavailableError"}},fa=class extends Error{table;column;constructor(e,r,n){super(`Refusing to copy ${e}.${r} into a sandbox: ${n}. A sandbox must never hold un-redacted PII \u2014 classify the column 'safe' (non-PII) or let redaction mask it, then retry.`),this.name="UnredactedPiiError",this.table=e,this.column=r}};function Ev(t,e,r){let n={};for(let[s,o]of Object.entries(e)){let i=r[s];if(i===void 0)throw new fa(t,s,"column has no PII classification (unknown = unsafe)");i==="pii"?n[s]=o==null?o:Rv:n[s]=o}return n}function Pv(t,e,r){return e.map(n=>Ev(t,n,r))}var Sp=new Set(["localhost","127.0.0.1","::1","0.0.0.0"]),Av=["oraclecloud.com","us-ashburn-1","amazonaws.com","rds.","supabase.co","turbobase.app","turbobase.io"];function Iv(t){let e=t.trim();try{let s=new URL(e);if(s.hostname)return s.hostname.toLowerCase()}catch{}let r=e.replace(/^[a-z]+:\/\//i,""),n=(r.split("/")[0]??r).split("@").pop()??r;return(n.split(":")[0]??n).toLowerCase()}function ma(t){if(!t||!t.trim())throw new Error("local-only guard: empty database target \u2014 refusing to proceed.");let e=t.toLowerCase();for(let n of Av)if(e.includes(n))throw new Error(`local-only guard: target '${t}' looks like a cloud/prod context (matched '${n}'). \`turbobase sandbox create\` is LOCAL-ONLY and will never touch a cloud database.`);let r=Iv(t);if(!Sp.has(r))throw new Error(`local-only guard: target host '${r}' is not a recognised local Postgres (${[...Sp].join(", ")}). \`turbobase sandbox create\` is LOCAL-ONLY.`)}function Cv(t,e=Ov){return`sbx-${t.toLowerCase().replace(/[^a-z0-9]+/g,"-").replace(/^-+|-+$/g,"").slice(0,24)||"tenant"}-${e()}`}function Ov(){return Math.floor(Math.random()*16777215).toString(16).padStart(6,"0")}function Nv(t){return`turbobase_${t.replace(/[^a-z0-9]+/gi,"_").toLowerCase()}`}function Lv(t,e){return`${(e??process.env.TURBOBASE_SANDBOX_BASE_URL??"http://localhost:5173").replace(/\/+$/,"")}/?sandbox=${encodeURIComponent(t)}`}async function ga(){let{file:t}=_p();try{let e=await ha.readFile(t,"utf8"),r=JSON.parse(e);return Array.isArray(r)?r:[]}catch(e){if(e.code==="ENOENT")return[];throw e}}async function $p(t){let{dir:e,file:r}=_p();await ha.mkdir(e,{recursive:!0}),await ha.writeFile(r,`${JSON.stringify(t,null,2)}
-`,{mode:384})}async function jv(t){let e=await ga();e.push(t),await $p(e)}async function xp(t){let e=await ga(),r=e.findIndex(s=>s.name===t);if(r===-1)return null;let[n]=e.splice(r,1);return await $p(e),n??null}async function Ws(){return ga()}function ba(t,e=Date.now()){let r=[],n=[];for(let s of t)$v(s.expiresAt,e)?n.push(s):r.push(s);return{active:r,expired:n}}async function Tp(t,e){ma(t.target());let r=t.dataCopyUnavailable?.();if(r)throw new $n(r);let n=xv(e.sample),s=e.now??Date.now(),o=(e.nameGen??(u=>Cv(u)))(e.fromTenant),i=Nv(o);await t.createDatabase(i),await t.replayMigrations(i);let a=await t.readSourceTables(e.fromTenant);for(let u of a){let p=Tv(u.rows,n),g=Pv(u.table,p,u.classification);g.length>0&&await t.copyRows(i,u.table,g)}let l={name:o,fromTenant:e.fromTenant,database:i,createdAt:new Date(s).toISOString(),expiresAt:_v(e.ttl,s),sampleFraction:n,url:Lv(o,e.baseUrl)};return await jv(l),l}async function Rp(t,e){ma(t.target());let n=(await Ws()).find(s=>s.name===e);return n?(await t.dropDatabase(n.database),await xp(e),n):null}async function ya(t,e=Date.now()){ma(t.target());let r=await Ws(),{expired:n}=ba(r,e),s=[];for(let o of n){try{await t.dropDatabase(o.database)}catch{continue}await xp(o.name),s.push(o)}return s}var xn={pat:{prefix:"tb_pat_",defaultScopes:["extensions:deploy"],allowedScopes:["extensions:deploy","catalog:read","mcp:authoring","analyzer:run","releases:write","solutions:write","skills:publish","docs:publish"],defaultTtlDays:90,mintable:!0,label:"Personal access token"},catalog:{prefix:"tb_cat_",defaultScopes:["catalog:read"],allowedScopes:["catalog:read"],defaultTtlDays:null,mintable:!0,label:"AI / catalog token"}},tI=Object.keys(xn).filter(t=>xn[t].mintable);var sI=xn.pat.prefix,Uv=Object.entries(xn).map(([t,e])=>[e.prefix,t]),Dv=/^[A-Za-z0-9_-]{20,}$/;function qv(t){if(typeof t!="string")return null;for(let[e,r]of Uv)if(t.startsWith(e)&&Dv.test(t.slice(e.length)))return r;return null}function Ep(t){return qv(t)==="pat"}hn();var Mv=8e3,zv={revoked:"the instance REVOKED this token \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",expired:"this token has EXPIRED \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",unknown:"this instance has never seen this token \u2014 it was deleted, or it belongs to a DIFFERENT instance; check the base-url before minting a new PAT",suspended:"the user this token belongs to is SUSPENDED \u2014 an instance administrator has to restore the account; a new token will not help",malformed:"the stored credential is not shaped like a Turbobase PAT (tb_pat_\u2026) \u2014 sign in again",missing:"no token reached the instance \u2014 sign in again",transient:"the instance could not verify the token right now (a storage error, not a decision about the token) \u2014 retry"};function Bv(t){return zv[t]??`the instance rejected this token (${t}) \u2014 run \`turbobase auth login\` to store a fresh PAT`}async function Fv(t,e,r=fetch){let n;try{n=await r(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(Mv)})}catch(o){return{state:"unreachable",detail:o instanceof Error?o.message:String(o)}}if(n.status===200||n.status===403)return{state:"accepted"};if(n.status===401){let o=await n.json().catch(()=>null);return{state:"rejected",reason:typeof o?.reason=="string"&&o.reason?o.reason:"unknown"}}return(n.headers.get("content-type")??"").includes("application/json")?{state:"accepted"}:{state:"unreachable",detail:`HTTP ${n.status} \u2014 this host does not serve the /v1 API`}}function Pp(t){return t.state==="accepted"?Ee()?f.green("accepted"):"accepted":t.state==="rejected"?Ee()?f.red(`rejected \xB7 ${t.reason}`):`rejected \xB7 ${t.reason}`:Ee()?f.yellow("unreachable"):"unreachable"}async function Ap(t={},e=fetch){let r=await Rt(),{file:n}=Ts();if(r.length===0){y("not signed in. Run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),L(f.dim(`no sign-ins stored in ${n}.`));return}let s=await ut(),o=await Promise.all(r.map(async i=>({baseUrl:i.baseUrl,active:!!s&&i.baseUrl===s.baseUrl,updatedAt:i.updatedAt,check:t.probe===!1?{state:"accepted"}:await Fv(i.baseUrl,i.token,e)})));if(t.probe===!1)for(let i of o)y(`${i.active?"* ":"  "}${i.baseUrl}  (updated ${i.updatedAt})`);else if(Ee())y(pt(o.map(i=>[i.active?f.green("*"):" ",f.bold(i.baseUrl),Pp(i.check),f.dim(i.updatedAt)]),{head:["","instance","token","updated"]}));else for(let i of o)y(`${i.active?"* ":"  "}${i.baseUrl}  ${Pp(i.check)}  (updated ${i.updatedAt})`);L(f.dim(`tokens read from ${n}`));for(let i of o)i.check.state==="rejected"?(L(f.red(`${i.baseUrl}: ${Bv(i.check.reason)}.`)),L(f.dim("  then re-run `turbobase project init` \u2014 .mcp.json holds its own copy of the token, and until it is rewritten the authoring MCP tools stay absent from your session."))):i.check.state==="unreachable"&&L(f.yellow(`${i.baseUrl}: could not reach the instance (${i.check.detail}).`));s||L("no active default \u2014 run `turbobase auth use <base-url>` or pass --base-url.")}async function a0(t){let e=await Rt();e.length===0&&w("no stored sign-ins \u2014 run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),qe()||w("this command needs an explicit <base-url> in a non-interactive shell.");try{return await Me(t,e.map(r=>({value:r.baseUrl,label:r.baseUrl,description:`updated ${r.updatedAt}`})))}catch{w("cancelled.")}}async function l0(t,e){let r;try{r=await fetch(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(8e3)})}catch(s){return{ok:!1,kind:"unreachable",detail:s instanceof Error?s.message:String(s)}}let n=(r.headers.get("content-type")??"").includes("application/json");return r.status===200||r.status===403?{ok:!0}:r.status===401?{ok:!1,kind:"bad-token",detail:`HTTP ${r.status}`}:n?{ok:!0}:{ok:!1,kind:"wrong-host",detail:`HTTP ${r.status}`}}function c0(t){L(""),L("Sharing is ON. Two things reach the Turbobase product team from this instance:"),L("  \xB7 anonymized pattern cards from your proposals, solutions and INSTANCE-LEARNINGS.md \u2014"),L("    a pattern label, a record class, a fix shape, an outcome. No scripts, values or ids."),L("  \xB7 redacted prose from your projects\u2019 TURBOBASE-FEEDBACK.md \u2014 the findings you write"),L("    about OUR platform, with instance name, user names and ids masked before they leave."),L(`Turn it off: ${t}/admin/settings \u2192 Telemetry \u2192 "Share learnings and platform feedback".`),L("")}async function d0(t,e,r){let n=await Fd({baseUrl:t,token:e}),s=(await Rt()).length-1;if(y(`signed in to ${n.baseUrl} \u2014 now the active instance`+(s>0?` (${s} other${s===1?"":"s"} stored; commands default here).`:".")),c0(n.baseUrl),!r)return;let o=await l0(n.baseUrl,e);o.ok||(o.kind==="wrong-host"?(L(`warning: ${n.baseUrl} did not respond to the Turbobase API (/v1) \u2014 got ${o.detail}.`),L("  In local dev the Turbobase API is on :4100, not the app dev-server port (e.g. :5173)."),L("  The token is stored, but commands will fail against this base-url until it points at the API.")):o.kind==="bad-token"?L(`warning: ${n.baseUrl} rejected the token (401) \u2014 the PAT may be stale, revoked, or for a different instance.`):L(`warning: could not reach ${n.baseUrl} to verify the token (${o.detail}). Stored anyway.`))}async function u0(t){let e=await bn(t),r=ra(e);if(!r){let n=/\bdefineConduit\s*[<(]/.test(e);w(n?`could not parse id/on/from.source/from.recordType from ${t} \u2014 is it a defineConduit({...}) file?`:`could not parse id/recordType/event from ${t} \u2014 is it a defineHook({...}) file?`)}return{...r,sourceCode:e}}async function ln(t,e,r,n){try{return await se.access(t),"skipped"}catch{}return await se.mkdir(an(t),{recursive:!0}),await se.writeFile(t,e,{mode:n??(r?493:420)}),n!==void 0&&await se.chmod(t,n),"wrote"}async function Cb(t,e){if(Ob(t)!==".gitignore")return ln(t,e.content,e.executable,e.mode);let r=await se.readFile(t,"utf8").catch(()=>null);if(r===null)return ln(t,e.content,e.executable,e.mode);let n=$u(r);return n===null?"skipped":(await se.writeFile(t,n,"utf8"),"merged")}function md(t){if(t!==void 0){if(t==="junit"||t==="json")return t;w(`unknown --reporter '${t}' (expected 'junit' or 'json').`)}}function wi(t){process.exit(t)}function p0(t){return{name:"turbobase ext test",cases:t.map(r=>{if(r.pass)return{name:r.name,status:"passed"};let n=r.error?"error":r.rejection?.code??"mismatch",s=r.error?`error: ${r.error}`:r.observed!==r.expected?`expected ${r.expected}, observed ${r.observed}`+(r.rejection?` (rejected: ${r.rejection.code??"rejected"}${r.rejection.message?` \u2014 ${r.rejection.message}`:""})`:""):`rejected: ${r.rejection?.code??"rejected"}${r.rejection?.message?` \u2014 ${r.rejection.message}`:""}`;return{name:r.name,status:"failed",detail:s,type:n}})}}function h0(t,e){let r=e.warnings.length===0?[{name:`${t} (${e.kind})`,status:"passed"}]:e.warnings.map(n=>({name:`${t}: ${n.rule}`,status:"failed",type:n.rule,detail:`${n.message} \u2192 fix: ${n.fix}`}));return{name:`turbobase ext lint ${t}`,cases:r}}function f0(t){let e=[];if(t.error)return e.push({name:`replay ${t.fixtureName}`,status:"failed",type:"error",detail:t.error}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e};for(let r of t.guards)e.push(r.status==="failed"?{name:`guard: ${r.name}`,status:"failed",type:r.name,detail:r.detail}:{name:`guard: ${r.name}`,status:"passed",detail:r.status==="skipped-offline"?`skipped-offline: ${r.detail}`:void 0});return t.whenPassed&&t.applyBranch&&e.push({name:`apply-branch: ${t.applyBranch}`,status:"passed",detail:`${t.masterAction??""} (${t.wouldWriteBindings.length} binding(s) would be written)`.trim()}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e}}function kd({includeInternal:t=!0}={}){let e=new i0;e.name("turbobase").description("Build apps, author extensions, and drive your Turbobase instance.").version("1.6.4").option("--no-color","Disable ANSI colour + animations (also honoured via NO_COLOR / non-TTY)."),e.addHelpText("beforeAll",d=>d.command.parent?"":`${Yi()}
+`,{mode:384})}async function jv(t){let e=await ga();e.push(t),await $p(e)}async function xp(t){let e=await ga(),r=e.findIndex(s=>s.name===t);if(r===-1)return null;let[n]=e.splice(r,1);return await $p(e),n??null}async function Ws(){return ga()}function ba(t,e=Date.now()){let r=[],n=[];for(let s of t)$v(s.expiresAt,e)?n.push(s):r.push(s);return{active:r,expired:n}}async function Tp(t,e){ma(t.target());let r=t.dataCopyUnavailable?.();if(r)throw new $n(r);let n=xv(e.sample),s=e.now??Date.now(),o=(e.nameGen??(u=>Cv(u)))(e.fromTenant),i=Nv(o);await t.createDatabase(i),await t.replayMigrations(i);let a=await t.readSourceTables(e.fromTenant);for(let u of a){let p=Tv(u.rows,n),g=Pv(u.table,p,u.classification);g.length>0&&await t.copyRows(i,u.table,g)}let l={name:o,fromTenant:e.fromTenant,database:i,createdAt:new Date(s).toISOString(),expiresAt:_v(e.ttl,s),sampleFraction:n,url:Lv(o,e.baseUrl)};return await jv(l),l}async function Rp(t,e){ma(t.target());let n=(await Ws()).find(s=>s.name===e);return n?(await t.dropDatabase(n.database),await xp(e),n):null}async function ya(t,e=Date.now()){ma(t.target());let r=await Ws(),{expired:n}=ba(r,e),s=[];for(let o of n){try{await t.dropDatabase(o.database)}catch{continue}await xp(o.name),s.push(o)}return s}var xn={pat:{prefix:"tb_pat_",defaultScopes:["extensions:deploy"],allowedScopes:["extensions:deploy","catalog:read","mcp:authoring","analyzer:run","releases:write","solutions:write","skills:publish","docs:publish"],defaultTtlDays:90,mintable:!0,label:"Personal access token"},catalog:{prefix:"tb_cat_",defaultScopes:["catalog:read"],allowedScopes:["catalog:read"],defaultTtlDays:null,mintable:!0,label:"AI / catalog token"}},tI=Object.keys(xn).filter(t=>xn[t].mintable);var sI=xn.pat.prefix,Uv=Object.entries(xn).map(([t,e])=>[e.prefix,t]),Dv=/^[A-Za-z0-9_-]{20,}$/;function qv(t){if(typeof t!="string")return null;for(let[e,r]of Uv)if(t.startsWith(e)&&Dv.test(t.slice(e.length)))return r;return null}function Ep(t){return qv(t)==="pat"}hn();var Mv=8e3,zv={revoked:"the instance REVOKED this token \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",expired:"this token has EXPIRED \u2014 mint a new PAT (Settings \u203A Access tokens) and run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`",unknown:"this instance has never seen this token \u2014 it was deleted, or it belongs to a DIFFERENT instance; check the base-url before minting a new PAT",suspended:"the user this token belongs to is SUSPENDED \u2014 an instance administrator has to restore the account; a new token will not help",malformed:"the stored credential is not shaped like a Turbobase PAT (tb_pat_\u2026) \u2014 sign in again",missing:"no token reached the instance \u2014 sign in again",transient:"the instance could not verify the token right now (a storage error, not a decision about the token) \u2014 retry"};function Bv(t){return zv[t]??`the instance rejected this token (${t}) \u2014 run \`turbobase auth login\` to store a fresh PAT`}async function Fv(t,e,r=fetch){let n;try{n=await r(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(Mv)})}catch(o){return{state:"unreachable",detail:o instanceof Error?o.message:String(o)}}if(n.status===200||n.status===403)return{state:"accepted"};if(n.status===401){let o=await n.json().catch(()=>null);return{state:"rejected",reason:typeof o?.reason=="string"&&o.reason?o.reason:"unknown"}}return(n.headers.get("content-type")??"").includes("application/json")?{state:"accepted"}:{state:"unreachable",detail:`HTTP ${n.status} \u2014 this host does not serve the /v1 API`}}function Pp(t){return t.state==="accepted"?Ee()?f.green("accepted"):"accepted":t.state==="rejected"?Ee()?f.red(`rejected \xB7 ${t.reason}`):`rejected \xB7 ${t.reason}`:Ee()?f.yellow("unreachable"):"unreachable"}async function Ap(t={},e=fetch){let r=await Rt(),{file:n}=Ts();if(r.length===0){y("not signed in. Run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),L(f.dim(`no sign-ins stored in ${n}.`));return}let s=await ut(),o=await Promise.all(r.map(async i=>({baseUrl:i.baseUrl,active:!!s&&i.baseUrl===s.baseUrl,updatedAt:i.updatedAt,check:t.probe===!1?{state:"accepted"}:await Fv(i.baseUrl,i.token,e)})));if(t.probe===!1)for(let i of o)y(`${i.active?"* ":"  "}${i.baseUrl}  (updated ${i.updatedAt})`);else if(Ee())y(pt(o.map(i=>[i.active?f.green("*"):" ",f.bold(i.baseUrl),Pp(i.check),f.dim(i.updatedAt)]),{head:["","instance","token","updated"]}));else for(let i of o)y(`${i.active?"* ":"  "}${i.baseUrl}  ${Pp(i.check)}  (updated ${i.updatedAt})`);L(f.dim(`tokens read from ${n}`));for(let i of o)i.check.state==="rejected"?(L(f.red(`${i.baseUrl}: ${Bv(i.check.reason)}.`)),L(f.dim("  then re-run `turbobase project init` \u2014 .mcp.json holds its own copy of the token, and until it is rewritten the authoring MCP tools stay absent from your session."))):i.check.state==="unreachable"&&L(f.yellow(`${i.baseUrl}: could not reach the instance (${i.check.detail}).`));s||L("no active default \u2014 run `turbobase auth use <base-url>` or pass --base-url.")}async function a0(t){let e=await Rt();e.length===0&&w("no stored sign-ins \u2014 run `turbobase auth login --base-url <instance> --token tb_pat_\u2026`."),qe()||w("this command needs an explicit <base-url> in a non-interactive shell.");try{return await Me(t,e.map(r=>({value:r.baseUrl,label:r.baseUrl,description:`updated ${r.updatedAt}`})))}catch{w("cancelled.")}}async function l0(t,e){let r;try{r=await fetch(`${t}/v1/catalog/records`,{method:"GET",headers:{Authorization:`Bearer ${e}`,Accept:"application/json"},signal:AbortSignal.timeout(8e3)})}catch(s){return{ok:!1,kind:"unreachable",detail:s instanceof Error?s.message:String(s)}}let n=(r.headers.get("content-type")??"").includes("application/json");return r.status===200||r.status===403?{ok:!0}:r.status===401?{ok:!1,kind:"bad-token",detail:`HTTP ${r.status}`}:n?{ok:!0}:{ok:!1,kind:"wrong-host",detail:`HTTP ${r.status}`}}function c0(t){L(""),L("Sharing is ON. Two things reach the Turbobase product team from this instance:"),L("  \xB7 anonymized pattern cards from your proposals, solutions and INSTANCE-LEARNINGS.md \u2014"),L("    a pattern label, a record class, a fix shape, an outcome. No scripts, values or ids."),L("  \xB7 redacted prose from your projects\u2019 TURBOBASE-FEEDBACK.md \u2014 the findings you write"),L("    about OUR platform, with instance name, user names and ids masked before they leave."),L(`Turn it off: ${t}/admin/settings \u2192 Telemetry \u2192 "Share learnings and platform feedback".`),L("")}async function d0(t,e,r){let n=await Fd({baseUrl:t,token:e}),s=(await Rt()).length-1;if(y(`signed in to ${n.baseUrl} \u2014 now the active instance`+(s>0?` (${s} other${s===1?"":"s"} stored; commands default here).`:".")),c0(n.baseUrl),!r)return;let o=await l0(n.baseUrl,e);o.ok||(o.kind==="wrong-host"?(L(`warning: ${n.baseUrl} did not respond to the Turbobase API (/v1) \u2014 got ${o.detail}.`),L("  In local dev the Turbobase API is on :4100, not the app dev-server port (e.g. :5173)."),L("  The token is stored, but commands will fail against this base-url until it points at the API.")):o.kind==="bad-token"?L(`warning: ${n.baseUrl} rejected the token (401) \u2014 the PAT may be stale, revoked, or for a different instance.`):L(`warning: could not reach ${n.baseUrl} to verify the token (${o.detail}). Stored anyway.`))}async function u0(t){let e=await bn(t),r=ra(e);if(!r){let n=/\bdefineConduit\s*[<(]/.test(e);w(n?`could not parse id/on/from.source/from.recordType from ${t} \u2014 is it a defineConduit({...}) file?`:`could not parse id/recordType/event from ${t} \u2014 is it a defineHook({...}) file?`)}return{...r,sourceCode:e}}async function ln(t,e,r,n){try{return await se.access(t),"skipped"}catch{}return await se.mkdir(an(t),{recursive:!0}),await se.writeFile(t,e,{mode:n??(r?493:420)}),n!==void 0&&await se.chmod(t,n),"wrote"}async function Cb(t,e){if(Ob(t)!==".gitignore")return ln(t,e.content,e.executable,e.mode);let r=await se.readFile(t,"utf8").catch(()=>null);if(r===null)return ln(t,e.content,e.executable,e.mode);let n=$u(r);return n===null?"skipped":(await se.writeFile(t,n,"utf8"),"merged")}function md(t){if(t!==void 0){if(t==="junit"||t==="json")return t;w(`unknown --reporter '${t}' (expected 'junit' or 'json').`)}}function wi(t){process.exit(t)}function p0(t){return{name:"turbobase ext test",cases:t.map(r=>{if(r.pass)return{name:r.name,status:"passed"};let n=r.error?"error":r.rejection?.code??"mismatch",s=r.error?`error: ${r.error}`:r.observed!==r.expected?`expected ${r.expected}, observed ${r.observed}`+(r.rejection?` (rejected: ${r.rejection.code??"rejected"}${r.rejection.message?` \u2014 ${r.rejection.message}`:""})`:""):`rejected: ${r.rejection?.code??"rejected"}${r.rejection?.message?` \u2014 ${r.rejection.message}`:""}`;return{name:r.name,status:"failed",detail:s,type:n}})}}function h0(t,e){let r=e.warnings.length===0?[{name:`${t} (${e.kind})`,status:"passed"}]:e.warnings.map(n=>({name:`${t}: ${n.rule}`,status:"failed",type:n.rule,detail:`${n.message} \u2192 fix: ${n.fix}`}));return{name:`turbobase ext lint ${t}`,cases:r}}function f0(t){let e=[];if(t.error)return e.push({name:`replay ${t.fixtureName}`,status:"failed",type:"error",detail:t.error}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e};for(let r of t.guards)e.push(r.status==="failed"?{name:`guard: ${r.name}`,status:"failed",type:r.name,detail:r.detail}:{name:`guard: ${r.name}`,status:"passed",detail:r.status==="skipped-offline"?`skipped-offline: ${r.detail}`:void 0});return t.whenPassed&&t.applyBranch&&e.push({name:`apply-branch: ${t.applyBranch}`,status:"passed",detail:`${t.masterAction??""} (${t.wouldWriteBindings.length} binding(s) would be written)`.trim()}),{name:`turbobase ext replay ${t.fixtureName}`,cases:e}}function kd({includeInternal:t=!0}={}){let e=new i0;e.name("turbobase").description("Build apps, author extensions, and drive your Turbobase instance.").version("1.6.5").option("--no-color","Disable ANSI colour + animations (also honoured via NO_COLOR / non-TTY)."),e.addHelpText("beforeAll",d=>d.command.parent?"":`${Yi()}
 `),e.hook("preAction",(d,h)=>{ju(e.opts(),h.opts())});let r=e.command("auth").description("Sign in to an instance and manage stored credentials."),n=e.command("project").description("Set up the local project and the files an agent session reads."),s=e.command("ext").description("Author, test, ship, and observe extensions \u2014 hooks and conduits."),o=e.command("kb").description("Write into the instance's knowledge base."),i=e.command("skills").description("Write standing rules into the instance's agent skills.");r.command("login").description("Sign in to an instance by pasting a personal access token (PAT), stored in ~/.turbobase/credentials.").requiredOption("--base-url <url>","Instance base URL, e.g. https://acme.turbobase.app").option("--token <tb_pat_\u2026>","The PAT to store. Mint one in your app under Settings \u203A Access tokens.").option("--no-verify","Skip the post-login connectivity/token probe.").action(async d=>{let h=Xe(d.baseUrl);d.token||w(`auth login needs --token. Mint a PAT in your Turbobase app (Settings \u203A Access tokens), then:
   ${vn} auth login --base-url ${h} --token tb_pat_\u2026`),Ep(d.token)||w("--token does not look like a Turbobase PAT (tb_pat_\u2026)."),await d0(h,d.token,d.verify)}),r.command("status").description("Show every stored sign-in, where its token was read from, and whether the instance still accepts it.").option("--no-probe","List the stored sign-ins without asking each instance about its token.").action(async d=>Ap({probe:d.probe})),r.command("use [base-url]").description("Make an already-stored instance the active default (omit the arg to pick interactively).").action(async d=>{let h=d??await a0("Pick the active instance:"),b=await Rs(h);if(!b){let x=await Rt();w(`no stored sign-in for ${Xe(h)}.`+(x.length?` Stored: ${x.map(k=>k.baseUrl).join(", ")}.`:"")+` Run \`turbobase auth login --base-url ${Xe(h)} --token tb_pat_\u2026\`.`)}y(`active instance \u2192 ${b.baseUrl}.`)}),r.command("logout").description("Remove a stored sign-in (defaults to the active instance).").option("--base-url <url>","Which instance to remove (defaults to the active/single one).").option("--all","Remove every stored sign-in.").action(async d=>{if(d.all){let x=await Rt();for(let k of x)await qi(k.baseUrl);y(`removed ${x.length} stored sign-in${x.length===1?"":"s"}.`);return}let h=await qi(d.baseUrl);h||w(d.baseUrl?`no stored sign-in for ${Xe(d.baseUrl)}.`:"nothing to sign out of (or ambiguous \u2014 pass --base-url / --all).");let b=await ut();y(`signed out of ${h}.`+(b?` Active instance \u2192 ${b.baseUrl}.`:""))}),n.command("types").description("Generate types.ts from the signed-in instance's catalog.").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("-o, --out <file>","Output file","types.ts").option("--records-only","Emit only record-shape interfaces (skip the OpenAPI half).").action(async d=>{let{baseUrl:h,token:b}=await V(d.baseUrl),x;try{x=await ir({baseUrl:h,token:b,recordsOnly:d.recordsOnly})}catch(m){let _=m instanceof Error?m.message:String(m);if(!d.recordsOnly&&/openapi\.json failed \(401/.test(_)){L("types-gen: /v1/catalog/openapi.json needs a browser session \u2014 emitting record shapes only. The record shapes are the half apps generate against; for the OpenAPI half, run it from a signed-in browser session.");try{x=await ir({baseUrl:h,token:b,recordsOnly:!0})}catch(R){w(`types generation failed: ${R instanceof Error?R.message:String(R)}`)}}else w(`types generation failed: ${_}`)}let k=le(process.cwd(),d.out);await se.writeFile(k,x,"utf8"),y(`wrote ${k} (${x.split(`
 `).length} lines).`)}),qu(n),n.command("grounding").description("Write the instance's grounding brief (source primer + record anatomy + KB retrieval) to a file for agent sessions.").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--records <list>","Comma-separated record types to focus, e.g. purchaseOrder,itemReceipt.").option("--query <text>","Retrieval question for the knowledge base (e.g. what the app is about).").option("-o, --out <file>","Output file","INSTANCE.md").action(async d=>{let{baseUrl:h,token:b}=await V(d.baseUrl),x=new URLSearchParams;d.records&&x.set("records",d.records),d.query&&x.set("query",d.query);let k=x.toString(),m=await fetch(`${h}/v1/catalog/grounding${k?`?${k}`:""}`,{headers:{Authorization:`Bearer ${b}`,Accept:"application/json"}});m.ok||w(`grounding fetch failed: GET /v1/catalog/grounding \u2192 ${m.status}`);let R=((await m.json()).markdown??"").trim(),A=le(process.cwd(),d.out),I=d.records?` records=${d.records}`:"",C=`<!-- GENERATED by \`turbobase project grounding\` against ${h}${I} \u2014 do not edit; re-run to refresh. -->
@@ -3557,7 +3557,7 @@ samples init: ${R} written, ${A} skipped.`)});let Ze=e.command("guardrails").des
 `+f.dim("create one with `turbobase guardrails create <name> --source <s> --record <r>`"));y(pt(k.map(dn),{head:bs})),y(f.dim("  first match wins; lower PRIO is evaluated first."))}),Ze.command("create <name>").description("Create a rule gating PG\u2192source writes that match it.").option("--source <system>","Adapter id to scope to, or '*' for every source.","*").option("--record <type>","Record type to scope to, or '*' for every record.","*").option("--op <glob>","Raw op glob, when gating something other than a record write.").option("--target <glob>","Row address glob, e.g. 'salesOrder.12345'.").option("--actor <glob>","Only match this caller, e.g. 'agent:*' to gate AI writes but not human ones.").option("--decision <d>","allow | allow_with_audit | require_confirm | deny.","deny").option("--priority <n>","Lower is evaluated first (default 100).",d=>Number(d)).option("--when <expr>","Row predicate, e.g. 'total gt 10000'. Omit to match every row.").option("--reason <text>","Why this rule exists \u2014 shown to a blocked writer and in `list`.").option("--disabled","Create the rule parked, so it takes effect only when activated.").option("--confirm-freeze-all","Required for an unconditional deny across '*'/'*'.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{let{baseUrl:b,token:x}=await V(h.baseUrl),k=new F({baseUrl:b,token:x}),m;try{m=await k.guardrailCreate({name:d,source:h.source,record:h.record,decision:h.decision,...h.op?{op:h.op}:{},...h.target?{target:h.target}:{},...h.actor?{actor:h.actor}:{},...Number.isFinite(h.priority)?{priority:Number(h.priority)}:{},...h.when?{when:h.when}:{},...h.reason?{reason:h.reason}:{},...h.disabled?{enabled:!1}:{},...h.confirmFreezeAll?{confirmFreezeAll:!0}:{}})}catch(_){G(_,"extensions:deploy","create a guardrail"),w(`create guardrail failed: ${_ instanceof Error?_.message:String(_)}`)}y(`${f.green("\u2713")} guardrail ${f.bold(m.name??m.id)} created${m.status==="active"?"":f.dim(` (${m.status} \u2014 activate it to take effect)`)}`),y(f.dim(`  ${m.decision} ${m.source}/${m.record??m.op}${m.actor?` actor=${m.actor}`:""}${m.when?` where ${m.when}`:""} @prio ${m.priority}`)),y(f.dim(`  verify with: turbobase guardrails test --source ${m.source==="*"?"<source>":m.source} --record <record>`))}),Ze.command("edit <name>").description("Change a rule \u2014 its decision, priority, predicate or reason.").option("--decision <d>","allow | allow_with_audit | require_confirm | deny.").option("--priority <n>","Lower is evaluated first.",d=>Number(d)).option("--when <expr>","New row predicate. Pass '' to match every row.").option("--reason <text>","Why this rule exists.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{h.decision===void 0&&h.priority===void 0&&h.when===void 0&&h.reason===void 0&&w("edit: nothing to change \u2014 pass --decision, --priority, --when or --reason.");let{baseUrl:b,token:x}=await V(h.baseUrl),k=new F({baseUrl:b,token:x}),m;try{m=await k.guardrailUpdate(d,{...h.decision!==void 0?{decision:h.decision}:{},...Number.isFinite(h.priority)?{priority:Number(h.priority)}:{},...h.when!==void 0?{when:h.when}:{},...h.reason!==void 0?{reason:h.reason}:{}})}catch(_){G(_,"extensions:deploy","edit a guardrail"),w(`edit guardrail failed: ${_ instanceof Error?_.message:String(_)}`)}y(`${f.green("\u2713")} guardrail ${f.bold(m.name??m.id)} updated`),y(f.dim(`  ${m.decision} ${m.source}/${m.record??m.op}${m.when?` where ${m.when}`:""} @prio ${m.priority}`))});for(let[d,h,b]of[["activate","active","activated"],["deactivate","inactive","deactivated"]])Ze.command(`${d} <name>`).description(h==="active"?"Arm a parked or proposed rule.":"Park a rule without deleting it \u2014 the reversible move mid-rollout.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(x,k)=>{let{baseUrl:m,token:_}=await V(k.baseUrl),R=new F({baseUrl:m,token:_});try{await R.guardrailUpdate(x,{status:h})}catch(A){G(A,"extensions:deploy",`${d} a guardrail`),w(`${d} guardrail failed: ${A instanceof Error?A.message:String(A)}`)}y(`${f.green("\u2713")} guardrail ${f.bold(x)} ${b}`),h==="inactive"&&y(f.dim("  writes it was gating now fall through to the other rules."))});Ze.command("delete <name>").description("Remove a rule. Prefer `deactivate` if you may want it back.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{let{baseUrl:b,token:x}=await V(h.baseUrl),k=new F({baseUrl:b,token:x});try{await k.guardrailDelete(d)}catch(m){G(m,"extensions:deploy","delete a guardrail"),w(`delete guardrail failed: ${m instanceof Error?m.message:String(m)}`)}y(`${f.green("\u2713")} guardrail ${f.bold(d)} deleted`)}),Ze.command("posture [mode]").description("Show or set the GLOBAL default. 'allow' = deny-list (unmatched writes allowed, carve with deny rules). 'deny' = allow-list (unmatched writes denied, open with allow rules).").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{let{baseUrl:b,token:x}=await V(h.baseUrl),k=new F({baseUrl:b,token:x}),m=A=>A==="deny"?"deny-by-default (allow-list)":"allow-by-default (deny-list)";if(d===void 0){let A;try{A=await k.guardrailPostureGet()}catch(I){G(I,"extensions:deploy","read the guardrail posture"),w(`read posture failed: ${I instanceof Error?I.message:String(I)}`)}y(`guardrail posture: ${f.bold(m(A.mode))}`),y(f.dim(A.mode==="deny"?"  Unmatched writes are DENIED. Open records with `guardrails create <name> --decision allow`.":"  Unmatched writes are allowed-with-audit. Freeze records with `guardrails create <name> --decision deny`."));return}let _=d.trim().toLowerCase();_!=="allow"&&_!=="deny"&&w("posture must be 'allow' or 'deny'.");let R;try{R=await k.guardrailPostureSet(_)}catch(A){G(A,"extensions:deploy","set the guardrail posture"),w(`set posture failed: ${A instanceof Error?A.message:String(A)}`)}y(`${f.green("\u2713")} guardrail posture set to ${f.bold(m(R.mode))}`),R.mode==="deny"&&y(f.dim("  Every record with no active ALLOW rule is now frozen for write-back. Verify with `guardrails test --source <s> --record <r>`."))}),Ze.command("test").description("What happens to this write? Runs the real evaluator; writes nothing.").requiredOption("--source <system>","Adapter id the write targets.").requiredOption("--record <type>","Record type the write targets.").option("--actor <actor>","Caller to simulate, e.g. 'agent:ai' or 'user:<id>'.").option("--external-id <id>","Source-side row id, for target-scoped rules.").option("--fields <json>","A candidate row as JSON, so `when` predicates can be decided.").option("--op <op>","Write op: 'delete' tests <record>.delete; omitted tests <record>.write.").option("--phase <phase>","boundary | cdc | worker | adapter. Defaults to worker (the last gate).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--json","Emit raw JSON.").action(async d=>{let h;if(d.fields)try{h=JSON.parse(d.fields)}catch(R){w(`--fields must be valid JSON: ${R instanceof Error?R.message:String(R)}`)}let{baseUrl:b,token:x}=await V(d.baseUrl),k=new F({baseUrl:b,token:x}),m;try{m=await k.guardrailTest({source:d.source,record:d.record,...d.actor?{actor:d.actor}:{},...d.externalId?{externalId:d.externalId}:{},...h?{fields:h}:{},...d.op?{op:d.op}:{},...d.phase?{phase:d.phase}:{}})}catch(R){G(R,"extensions:deploy","test guardrails"),w(`guardrails test failed: ${R instanceof Error?R.message:String(R)}`)}if(d.json)return y(JSON.stringify(m,null,2));let _=`${d.source}/${m.op??d.record}`;m.degraded?(y(`${f.red("\u2717")} ${_} \u2014 guardrail policy is UNREADABLE; writes fail closed`),y(f.dim(`  ${m.reason}`))):m.allowed?y(`${f.green("\u2713")} ${_} \u2014 ${m.decision}`+(m.blockedBy?f.dim(` (rule ${m.blockedBy})`):f.dim(" (no rule matched)"))):(y(`${f.red("\u2717")} ${_} \u2014 ${m.decision} by ${f.bold(m.blockedBy??"?")} at the ${m.phase} gate`),m.message&&y(f.dim(`  ${m.message}`))),m.decision==="require_confirm"&&y(f.yellow("  this write is HELD for operator approval, not refused.")),m.allowed||(process.exitCode=1)});let Ut=e.command("tables").description("Author custom tables on your instance (create, evolve, inspect)."),Sr=(d,h={})=>{let b=`${f.bold(d.table)}  ${f.dim(d.displayName)}`;y(d.exists===!1?`${b}  ${f.dim("(new)")}`:b);for(let x of d.fields){let k=[x.required?"required":null].filter(Boolean).join(", "),m=h.showClaimants&&x.claimedBy?.length?`  ${f.dim(`\u2190 ${x.claimedBy.join(", ")}`)}`:"";y(`  ${x.column.padEnd(28)} ${x.type}${k?` (${k})`:""}${m}`)}h.showClaimants&&d.claimants.length>1&&y(f.dim(`  claimed by ${d.claimants.join(", ")}`))};function ys(d){if(d instanceof X&&d.status===409){let h=d.body;h?.error==="table_conflict"&&h.message&&(L(h.message),process.exit(1))}w(`tables: ${d instanceof Error?d.message:String(d)}`)}let Sd=async d=>{let h=Ye(le(process.cwd(),d),"public","turbobase.json"),b=await se.readFile(h,"utf8").catch(()=>null);if(b===null)return null;let x;try{x=JSON.parse(b)}catch(m){w(`${h} is not valid JSON: ${m instanceof Error?m.message:String(m)}`)}let k=x.tables;return k===void 0?{tables:[],manifestPath:h}:(Array.isArray(k)||w(`${h}: "tables" must be an array.`),{tables:k,manifestPath:h})};Ut.command("list").description("List the custom tables on your instance and who claims each one.").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--json","Emit raw JSON instead of a table.").action(async d=>{let{baseUrl:h,token:b}=await V(d.baseUrl),x=new F({baseUrl:h,token:b}),k;try{k=await x.tablesList()}catch(m){G(m,"extensions:deploy","list tables"),w(`list tables failed: ${m instanceof Error?m.message:String(m)}`)}if(d.json)return y(JSON.stringify(k,null,2));if(k.length===0)return y("no custom tables yet \u2014 create one with `turbobase tables create <slug>`.");y(pt(k.map(m=>[m.table,m.displayName,String(m.fields.length),m.status,m.claimedBy.join(", ")||"\u2014"]),{head:["TABLE","NAME","FIELDS","STATUS","CLAIMED BY"]}))}),Ut.command("plan").description("Preview what this project's declared tables would do. Writes nothing; exits 1 on a conflict.").argument("[dir]","Project directory holding public/turbobase.json (default ./).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--as <claimant>","Claim as `cli` or `app:<slug>` (default: the app slug in .turbobase, else cli).").action(async(d,h)=>{let b=await Sd(d??".");if(b||w(`no public/turbobase.json under ${le(process.cwd(),d??".")}.`),b.tables.length===0)return y(`${b.manifestPath} declares no tables \u2014 nothing to plan.`);let{baseUrl:x,token:k}=await V(h.baseUrl),m=new F({baseUrl:x,token:k}),_;try{_=await J("planning tables",()=>m.tablesPlan({claimedBy:h.as,tables:b.tables}))}catch(R){G(R,"extensions:deploy","plan tables"),ys(R)}y(`claiming as ${f.bold(_.claimedBy)}`);for(let R of _.tables)Sr(R,{showClaimants:!0});y(""),y(f.dim("nothing was applied \u2014 run `turbobase tables apply` (or deploy the app) to make it so."))}),Ut.command("apply").description("Apply this project's declared tables to the instance.").argument("[dir]","Project directory holding public/turbobase.json (default ./).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--as <claimant>","Claim as `cli` or `app:<slug>` (default: cli).").action(async(d,h)=>{let b=await Sd(d??".");if(b||w(`no public/turbobase.json under ${le(process.cwd(),d??".")}.`),b.tables.length===0)return y(`${b.manifestPath} declares no tables \u2014 nothing to apply.`);let{baseUrl:x,token:k}=await V(h.baseUrl),m=new F({baseUrl:x,token:k}),_;try{_=await J("applying tables",()=>m.tablesApply({claimedBy:h.as,tables:b.tables}))}catch(R){G(R,"extensions:deploy","apply tables"),ys(R)}for(let R of _.tables)Sr(R,{showClaimants:!0});y(`applied ${_.tables.length} table${_.tables.length===1?"":"s"} as ${_.claimedBy}.`)}),Ut.command("create").description('Create a single table without a manifest (the CLI twin of "New custom table").').argument("<slug>","Table slug; the physical table is cr_<slug>.").requiredOption("-f, --field <name:type>","Field as name:type[:required] \u2014 text|number|date|bool|select. Repeatable.",(d,h)=>[...h??[],d],[]).option("--name <displayName>","Human label for the table (defaults to the slug).").option("--restrict-to-owner","Non-admins see only rows they created.").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{let b=h.field.map(R=>{let[A,I,C]=R.split(":");return(!A||!I)&&w(`--field "${R}" must be name:type[:required] (e.g. title:text:required).`),C!==void 0&&C!=="required"&&w(`--field "${R}": the third part may only be "required".`),{name:A,type:I,...C==="required"?{required:!0}:{}}}),{baseUrl:x,token:k}=await V(h.baseUrl),m=new F({baseUrl:x,token:k}),_;try{_=await J(`creating cr_${d}`,()=>m.tablesApply({tables:[{slug:d,displayName:h.name??d,fields:b,...h.restrictToOwner?{rowLevelOwner:!0}:{}}]}))}catch(R){G(R,"extensions:deploy","create a table"),ys(R)}for(let R of _.tables)Sr(R);y(""),y(f.dim("grant access under Settings \u203A Users, or in the Records page permissions matrix."))}),Ut.command("drop").description("Drop a table and everything in it. Irreversible.").argument("<slug>","Table slug (without the cr_ prefix).").requiredOption("--confirm <slug>","Type the EXACT slug to confirm (fail-closed).").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{h.confirm!==d&&w(`drop refused: --confirm "${h.confirm}" does not match "${d}".`);let{baseUrl:b,token:x}=await V(h.baseUrl),k=new F({baseUrl:b,token:x}),m;try{m=await J(`dropping cr_${d}`,()=>k.tablesDrop(d,h.confirm))}catch(_){G(_,"extensions:deploy","drop a table"),w(`drop failed: ${_ instanceof Error?_.message:String(_)}`)}if(!m.removed)return y(`no table named "${d}" on this instance \u2014 nothing dropped.`);y(`dropped ${m.table} and every row in it.`)});let ki=e.command("sandbox").description("Ephemeral local authoring sandboxes.");ki.command("create").description("Stand up a fresh local sandbox seeded with a sampled+redacted slice of an instance.").requiredOption("--from <instance>","Source instance to clone the data slice from.").option("--ttl <duration>","Time-to-live before reaping (e.g. 72h, 30m, 7d).","72h").option("--sample <pct>","Percent of each table to copy (e.g. 2%).","2%").option("--base-url <url>","Local base URL the sandbox is reachable at.").action(async d=>{process.env.TURBOBASE_SANDBOX="1";let h=bd(),b;try{b=await Tp(h,{fromTenant:d.from,ttl:d.ttl,sample:d.sample,baseUrl:d.baseUrl})}catch(x){x instanceof $n&&w(x.message),w(`sandbox create failed: ${x instanceof Error?x.message:String(x)}`)}y(`sandbox ${b.name} ready.`),y(`  source:  ${b.fromTenant} (sampled ${Math.round(b.sampleFraction*100)}%, redacted)`),y(`  url:     ${b.url}`),y(`  expires: ${b.expiresAt}`)}),ki.command("destroy").argument("<name>","The sandbox name to tear down.").description("Drop a sandbox database and remove it from the registry.").action(async d=>{let h=bd();await ya(h).catch(()=>[]);let b;try{b=await Rp(h,d)}catch(x){w(`sandbox destroy failed: ${x instanceof Error?x.message:String(x)}`)}b||w(`no sandbox named '${d}'.`),y(`destroyed sandbox ${b.name} (dropped ${b.database}).`)}),ki.command("list").description("List active sandboxes with TTL/expiry; reaps any past their TTL.").action(async()=>{let d=bd(),h=await ya(d).catch(()=>[]),b=await Ws(),{active:x}=ba(b);if(x.length===0)y("no active sandboxes.");else{for(let k of x)y(`  ${k.name}  from=${k.fromTenant}  expires=${k.expiresAt}  ${k.url}`);y(`
 ${x.length} active sandbox(es).`)}h.length>0&&y(`(reaped ${h.length} expired sandbox(es).)`)}),s.command("export").description("Pull the live instance into turbobase/bundle.json (adopt an instance into a repo).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--out <dir>","Directory to write the bundle into.",Us).action(async d=>{let{baseUrl:h,token:b}=await V(d.baseUrl),x=new F({baseUrl:h,token:b}),k;try{k=await J("exporting instance config",()=>x.configExport())}catch(R){R instanceof X&&(R.status===401||R.status===403)&&w("ext export forbidden \u2014 the stored PAT lacks extensions:deploy. Re-run `turbobase auth login`."),w(`ext export failed: ${R instanceof Error?R.message:String(R)}`)}let m=typeof k.serialized=="string"?k.serialized:`${JSON.stringify(k.manifest??k,null,2)}
 `,_=le(process.cwd(),d.out,wn);await se.mkdir(an(_),{recursive:!0}),await se.writeFile(_,m,"utf8"),y(`wrote ${d.out}/${wn} (${m.split(`
-`).length} lines).`)});let _d=s.command("extras").description("Manage the optional native packages `ext test` and `ext replay` need."),Nb=[{name:"esbuild",needs:"compiling an extension (`test`, `replay`)"},{name:"isolated-vm",needs:"executing an extension in the sandbox (`test`, `replay`)"}],$d=()=>process.env.TURBOBASE_HOME?.trim()||Ye(o0(),".turbobase"),Lb=()=>"1.6.4",ws=async()=>Promise.all(Nb.map(async d=>{try{return await import(d.name),{...d,present:!0}}catch{return{...d,present:!1}}}));_d.command("status").description("Report which optional native packages are installed.").action(async()=>{let d=await ws();for(let h of d)y(`${h.present?ve.success("installed"):ve.warn("missing")}  ${f.bold(h.name)} \u2014 ${h.needs}`);d.some(h=>!h.present)&&y(`
+`).length} lines).`)});let _d=s.command("extras").description("Manage the optional native packages `ext test` and `ext replay` need."),Nb=[{name:"esbuild",needs:"compiling an extension (`test`, `replay`)"},{name:"isolated-vm",needs:"executing an extension in the sandbox (`test`, `replay`)"}],$d=()=>process.env.TURBOBASE_HOME?.trim()||Ye(o0(),".turbobase"),Lb=()=>"1.6.5",ws=async()=>Promise.all(Nb.map(async d=>{try{return await import(d.name),{...d,present:!0}}catch{return{...d,present:!1}}}));_d.command("status").description("Report which optional native packages are installed.").action(async()=>{let d=await ws();for(let h of d)y(`${h.present?ve.success("installed"):ve.warn("missing")}  ${f.bold(h.name)} \u2014 ${h.needs}`);d.some(h=>!h.present)&&y(`
 run \`${vn} ext extras install\` to fetch them into ${$d()}.`)}),_d.command("install").description("Install the optional native packages into $TURBOBASE_HOME (needs npm).").action(async()=>{let d=await ws();if(d.every(A=>A.present)){y(ve.success("extras already installed \u2014 nothing to do."));return}let h=$d();await se.mkdir(h,{recursive:!0});let b=d.filter(A=>!A.present).map(A=>A.name),x=ua(process.platform,process.arch),k=async(A,I)=>{let{code:C,stderr:q}=await gs("npm",["install","--prefix",h,"--no-audit","--no-fund",...A]);C!==0&&w(`extras install failed while installing ${I} (npm exited ${C}).
 ${q.trim()}
 These are native packages \u2014 they need npm and a working toolchain. Everything except \`test\` and \`replay\` works without them.`)},m=b.filter(A=>A!=="isolated-vm");if(m.length>0){let A=m.map(I=>`${I}@${ca[I]??"latest"}`);y(`installing ${A.join(", ")} \u2192 ${h}/node_modules \u2026`),await k(A,m.join(", "))}if(b.includes("isolated-vm")){let A=`isolated-vm@${ca["isolated-vm"]}`;if(y(`installing ${A} \u2192 ${h}/node_modules \u2026`),await k(["--ignore-scripts",A],"isolated-vm"),wp.includes(x)){let C=`${da}@${Lb()}`;y(`fetching ${C} (no upstream binary for ${x}) \u2026`);let{code:q}=await gs("npm",["install","--prefix",h,"--no-audit","--no-fund","--ignore-scripts",C]);q!==0&&y(ve.warn(`could not fetch ${C} \u2014 falling back to a source build.`))}let I=await vp({home:h});I.length>0&&y(`  ${ve.success("prebuilt")} ${I.join(", ")} \u2192 isolated-vm/prebuilds/${x}`)}let _=await ws(),R=_.filter(A=>!A.present).map(A=>A.name);if(R.includes("isolated-vm")){y(ve.warn(`no prebuilt isolated-vm for ${x} / Node ${process.versions.node} (${pa()}) \u2014 building from source. This needs Python and a C++ toolchain, and takes a few minutes.`));let{code:A}=await gs("npm",["rebuild","--prefix",h,"isolated-vm"]);A===0&&(_=await ws(),R=_.filter(I=>!I.present).map(I=>I.name))}R.length>0&&w(`npm succeeded but ${R.join(", ")} still will not load \u2014 no prebuilt binary for ${x} / Node ${process.versions.node} (${pa()}), and the source build did not produce one either. Everything except \`test\` and \`replay\` works without them.`),y(ve.success("extras installed \u2014 `turbobase ext test` and `turbobase ext replay` are ready."))});let _r=e.command("release").description("Ship a release to your instance: deploy | status | rollback | list.");return _r.command("deploy").description("Enqueue a server-side release deploy. UPLOADS the SDF project src/ from the checkout (the producer swap) when present; else a solution-only live-fetch deploy. An approved target requires --approved-by.").requiredOption("--target <mode>","Deploy posture: auto (apply now) | approved (needs a recorded approval).").option("--solution <id>","The solution id the release delivers (omit for an upload-only deploy).").option("--project <dir>","SDF project dir whose src/ is uploaded (default: cwd).").option("--git-repo <repo>","Git provenance LINK: source repo (default $GITHUB_REPOSITORY or `git remote get-url origin`).").option("--git-ref <ref>","Git provenance LINK: ref/branch/tag (default $GITHUB_REF).").option("--ref <committish>","Git provenance: the ref/branch/tag/sha the upload was built from; resolved to a commit sha via `git rev-parse` (default $GITHUB_SHA or HEAD).").option("--pr-url <url>","Git provenance LINK: the PR this deploy came from (default $PR_URL).").option("--approved-by <email>","Record the approval (REQUIRED for --target approved).").option("--base-url <url>","Instance base URL (defaults to the active instance).").option("--follow","Poll the release deploy to completion (exit non-zero on failure).").option("--interval-ms <ms>","Poll interval for --follow (default 2000).").action(async d=>{let h=d.target==="approved"?"approved":d.target==="auto"?"auto":null;h||w(`--target must be 'auto' or 'approved' (got '${d.target}').`);let b=await v0(le(process.cwd(),d.project??".")),x=Object.keys(b).length;!d.solution&&x===0&&w("release deploy needs --solution <id> (live-fetch) or an SDF project (a src/ dir under --project, default cwd) to upload.");let m=(d.ref?await yd(["rev-parse",d.ref])??d.ref:null)??process.env.GITHUB_SHA??await yd(["rev-parse","HEAD"]),_=d.gitRepo??process.env.GITHUB_REPOSITORY??await yd(["remote","get-url","origin"]),R=d.gitRef??process.env.GITHUB_REF??null,A=d.prUrl??process.env.PR_URL??null,{baseUrl:I,token:C}=await V(d.baseUrl),q=new F({baseUrl:I,token:C}),N;try{N=await q.releaseDeploy({solutionId:d.solution??null,target:h,approvedBy:d.approvedBy??null,files:x>0?b:null,gitRepo:_,gitRef:R,gitSha:m,prUrl:A})}catch(K){G(K,"releases:write","release deploy"),K instanceof X&&K.status===404&&w("solution_not_found \u2014 no solution with that id."),w(`release deploy failed: ${K instanceof Error?K.message:String(K)}`)}y(`release ${N.releaseId} enqueued \u2192 taskId=${N.taskId} (target=${h}`+(x>0?`, uploaded ${x} bundle file(s)`:", live-fetch")+")."),d.follow&&await sa(()=>q.releaseStatus(N.releaseId),`release ${N.releaseId}`,d.intervalMs)}),_r.command("pull").argument("<id>","The release id").description("Write the SDF project a FAILED release built into <dir>: owned/ (yours, editable) and context/ (the rest of the bundle, read-only). Edit owned/, then `release push`.").requiredOption("--dir <path>","Directory to write the project into (created if absent).").option("--base-url <url>","Instance base URL (defaults to the active instance).").action(async(d,h)=>{let{baseUrl:b,token:x}=await V(h.baseUrl),k=new F({baseUrl:b,token:x}),m;try{m=await k.releaseFiles(d)}catch(A){A instanceof X&&A.status===404&&w(`release ${d} not found.`),A instanceof X&&A.status===409&&w(`no built project was retained for release ${d}. Files are kept for a FAILED attempt only \u2014 a shipped bundle is recoverable from the account.`),G(A,"releases:write","pull a release"),w(`release pull failed: ${A instanceof Error?A.message:String(A)}`)}let _=le(process.cwd(),h.dir),R=0;for(let[A,I]of[["owned",m.owned],["context",m.context]])for(let[C,q]of Object.entries(I)){let N=Ye(_,A,C);await se.mkdir(an(N),{recursive:!0}),await se.writeFile(N,q,"utf8"),R++}await se.writeFile(Ye(_,".turbobase-release.json"),JSON.stringify({releaseId:m.releaseId,version:m.version,contentDigest:m.contentDigest},null,2),"utf8"),y(`pulled release ${m.releaseId} (${m.status}) \u2192 ${_}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@turbobase/cli",
-  "version": "1.6.4",
+  "version": "1.6.5",
   "description": "Author, test, and deploy Turbobase extensions (hooks + conduits) against a tenant over HTTP + a personal access token.",
   "type": "module",
   "license": "SEE LICENSE IN LICENSE",