runcloud 0.2.162 → 0.2.164

package/dist/commands/appStoreEvaluate.js

@@ -1,6 +1,8 @@
 import { existsSync, readFileSync, readdirSync, statSync, } from 'node:fs';
 import path from 'node:path';
 const PREVIEW_APP_ID = 'app.newly.preview';
+const SCAFFOLD_SCHEME = 'expobase';
+const INBOUND_LINK = /Linking\.createURL|makeRedirectUri|emailRedirectTo|\bredirectTo\s*:|expobase:\/\//;
 const PLACEHOLDER_COPY = /lorem ipsum|example\.com|\bTBD\b|\bTODO\b|\bplaceholder\b/i;
 const INPUT_PLACEHOLDER = /\bplaceholder\??\s*[=:]\s*(\{[^}]*\}|"[^"]*"|'[^']*'|`[^`]*`|[\w.$]+)/gi;
 const PLACEHOLDER_NAME = /\.placeholder\b|\bplaceholder\b(?=\s*[,})\]])/gi;
@@ -45,6 +47,9 @@ const LIVE_STORE_IDS = new Set([
     'apple_content_rights',
     'apple_age_rating',
     'apple_privacy_label',
+    'apple_review_notes',
+    'apple_review_contact',
+    'apple_review_recording',
     'apple_eu_trader_status',
     'google_play_title',
     'google_play_short_description',
@@ -87,6 +92,7 @@ const TEXT_EXTENSIONS = new Set([
     '.swift',
     '.ts',
     '.tsx',
+    '.xcprivacy',
     '.xml',
 ]);
 const SKIP_DIRS = new Set([
@@ -155,6 +161,8 @@ function activeItems(manifest) {
     return manifest.items.filter((item) => !item.deferred && item.resolvedBy !== 'card');
 }
 function evaluateLocalItem(root, appJson, item) {
+    if (item.id === 'scheme')
+        return evaluateScheme(root, appJson, item);
     const rule = CONFIG_RULES[item.id];
     if (rule)
         return evaluateConfigItem(appJson, item, rule);
@@ -201,7 +209,7 @@ function evaluateLocalItem(root, appJson, item) {
         case 'permission_descriptions':
             return evaluatePermissionDescriptions(root, appJson, item);
         case 'privacy_manifest':
-            return evaluatePrivacyManifest(root, item);
+            return evaluatePrivacyManifest(root, appJson, item);
         default:
             if (STORE_REMINDER_IDS.has(item.id)) {
                 return makeItem(item, 'info', 'Complete this declaration in Google Play Console.', 'Play Console questionnaire');
@@ -226,6 +234,14 @@ function evaluateConfigItem(appJson, item, rule) {
         return makeItem(item, 'pass', `${item.label} is set.`, evidence);
     return makeItem(item, rule.absent, `${item.label} is not set.`, evidence);
 }
+function evaluateScheme(root, appJson, item) {
+    const value = getPath(appJson, ['expo', 'scheme']);
+    const schemes = typeof value === 'string' ? [value] : arrayOfStrings(value);
+    const shared = schemes.includes(SCAFFOLD_SCHEME) ? scan(root, INBOUND_LINK, { dirs: ['app', 'src', 'components'] }) : [];
+    if (!shared.length)
+        return evaluateConfigItem(appJson, item, CONFIG_RULES['scheme']);
+    return makeItem(item, 'warning', `This app still uses the link name every new Newly app starts with (${SCAFFOLD_SCHEME}). A link back into the app, such as a sign-in email, can open another Newly-built app on the same phone. Give it its own scheme, and update any redirect address saved with your sign-in provider. The next preview then takes several minutes to rebuild.`, `app.json expo.scheme = ${JSON.stringify(value)}\n${evidence(shared)}`);
+}
 function evaluateEncryption(appJson, item) {
     const plist = getPath(appJson, ['expo', 'ios', 'infoPlist', 'ITSAppUsesNonExemptEncryption']);
     const config = getPath(appJson, ['expo', 'ios', 'config', 'usesNonExemptEncryption']);
@@ -289,16 +305,19 @@ function evaluatePermissionDescriptions(root, appJson, item) {
         return makeItem(item, 'pass', 'Used iOS capabilities have usage descriptions.', 'app.json ios.infoPlist cross-check');
     return makeItem(item, 'fail', 'Used iOS capability is missing an NS*UsageDescription.', missing.join('; '));
 }
-function evaluatePrivacyManifest(root, item) {
-    const hasManifest = findByName(root, 'PrivacyInfo.xcprivacy').length > 0;
-    const requiredReasonApi = scan(root, /NSUserDefaults|systemUptime|fileModificationDate|diskSpace|activeInputModes/i);
-    const tracking = scan(root, TRACKING_SDK);
-    if (hasManifest)
+function evaluatePrivacyManifest(root, appJson, item) {
+    if (findByName(root, 'PrivacyInfo.xcprivacy').length > 0)
         return makeItem(item, 'pass', 'PrivacyInfo.xcprivacy is present.', 'scan: PrivacyInfo.xcprivacy found');
-    if (tracking.length)
-        return makeItem(item, 'fail', 'Tracking SDK pattern found but no PrivacyInfo.xcprivacy file was found.', evidence(tracking));
-    if (requiredReasonApi.length)
-        return makeItem(item, 'warning', 'Required-reason API pattern found but no PrivacyInfo.xcprivacy file was found.', evidence(requiredReasonApi));
+    if (Object.keys(objectValue(getPath(appJson, ['expo', 'ios', 'privacyManifests']))).length > 0)
+        return makeItem(item, 'pass', 'app.json declares the privacy manifest.', 'app.json expo.ios.privacyManifests is set');
+    const tracking = scan(root, TRACKING_SDK);
+    if (tracking.length) {
+        return makeItem(item, 'warning', 'This app uses a tracking SDK and app.json declares no privacy manifest. Add expo.ios.privacyManifests with NSPrivacyTracking and the domains the SDK tracks through, so the manifest matches your App Privacy answers.', evidence(tracking));
+    }
+    const requiredReasonApi = scan(root, /NSUserDefaults|systemUptime|fileModificationDate|diskSpace|activeInputModes/i);
+    if (requiredReasonApi.length) {
+        return makeItem(item, 'warning', 'This code uses an API Apple wants a reason for, and app.json declares none. Add the reason under expo.ios.privacyManifests (NSPrivacyAccessedAPITypes).', evidence(requiredReasonApi));
+    }
     return makeItem(item, 'pass', 'No required-reason API patterns found and no tracking SDK patterns found.', 'scan: no required privacy manifest signals found');
 }
 function patternItem(root, item, regex, statusOnHit, messageOnHit, messageOnMiss, options = {}) {

package/dist/commands/database.js

@@ -0,0 +1,192 @@
+import { randomUUID } from 'node:crypto';
+import { ApiClient, friendlyApiError } from '../api.js';
+import { requireCredentials, resolveProject } from '../config.js';
+import { readLocalMigrations, compareMigrations } from '../migration-plan.js';
+import { authorizeDatabaseAction } from '../database-authorization.js';
+export async function runDatabaseOperation(client, projectId, env, operation, options = {}) {
+    const operationId = options.operationId ?? randomUUID();
+    const root = `/newly_backend/database/${encodeURIComponent(projectId)}/operations`;
+    options.onStarted?.(operationId);
+    await client.post(root, { ...operation, env, operation_id: operationId });
+    const deadline = Date.now() + (options.timeoutMs ?? 300_000);
+    const sleep = options.sleep ?? ((ms) => new Promise((done) => setTimeout(done, ms)));
+    for (;;) {
+        const result = await client.get(`${root}/${operationId}?env=${env}`);
+        if (result.status === 'succeeded' && result.data)
+            return result.data;
+        if (result.status === 'failed')
+            throw new Error(result.message ?? 'Database operation failed');
+        if (result.status !== 'pending')
+            throw new Error('Unexpected database operation response');
+        if (Date.now() >= deadline)
+            throw new Error(`Database operation ${operationId} is still pending. Check it with newly db operation ${operationId} --env ${env} --project ${projectId}`);
+        await sleep(2000);
+    }
+}
+function connection(opts) {
+    if (opts.env !== 'dev' && opts.env !== 'prod')
+        throw new Error('--env must be dev or prod');
+    const creds = requireCredentials();
+    return { client: new ApiClient(creds.apiUrl, creds.token), projectId: resolveProject(process.cwd(), opts.project) };
+}
+function common(command) {
+    return command.option('--env <env>', 'dev or prod (production requires the owner’s user credential)', 'dev').option('--project <id>', 'project id').option('--json', 'print structured JSON');
+}
+const handleError = (error) => { console.error(friendlyApiError(error)); process.exitCode = 1; };
+export function registerDatabaseHelpers(db) {
+    common(db.command('migrations').description('Compare live migration ledgers with this checkout; does not apply SQL'))
+        .option('--services <names>', 'comma-separated services from backend/newly.services.json')
+        .action(async (opts) => {
+        try {
+            const { client, projectId } = connection(opts);
+            const local = readLocalMigrations(process.cwd(), opts.services);
+            if (!local.length)
+                throw new Error('No selected service has a Drizzle migration journal and schema');
+            const data = await runDatabaseOperation(client, projectId, opts.env, { action: 'migrations', schemas: local.map((set) => set.schema) });
+            const ledgers = data.ledgers;
+            const services = local.map((set) => {
+                if (!ledgers?.[set.schema])
+                    throw new Error(`Inspection did not return ledger ${set.schema}`);
+                return compareMigrations(set, ledgers[set.schema]);
+            });
+            if (opts.json)
+                console.log(JSON.stringify({ observed_at: data.observed_at, env: opts.env, services }, null, 2));
+            else {
+                console.log(`Migration inspection (${opts.env}), observed ${String(data.observed_at)}`);
+                for (const service of services) {
+                    console.log(`\n${service.service} (${service.schema}): applied ${service.applied.length}, pending ${service.pending.length}`);
+                    console.log(`Applied: ${service.applied.map((row) => row.tag ?? row.created_at).join(', ') || 'none'}`);
+                    console.log(`Would execute from this checkout: ${service.would_execute?.join(', ') || (service.problems.length ? 'cannot determine — ledger differs' : 'none')}`);
+                    for (const problem of service.problems)
+                        console.log(`Problem: ${problem}`);
+                }
+                console.log('\nThis is a ledger comparison, not a deployment dry run or a compatibility check. Deployment uses the files submitted at that time.');
+            }
+            if (services.some((service) => service.problems.length))
+                process.exitCode = 1;
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    common(db.command('operation').argument('<id>', 'database operation id').description('Read the status or result of a database operation'))
+        .action(async (id, opts) => {
+        try {
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(id))
+                throw new Error('Operation id must be a lowercase UUID');
+            const { client, projectId } = connection(opts);
+            const result = await client.get(`/newly_backend/database/${encodeURIComponent(projectId)}/operations/${id}?env=${opts.env}`);
+            console.log(JSON.stringify(result, null, 2));
+            if (result.status === 'failed')
+                process.exitCode = 1;
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    const backup = db.command('backup').description('Inspect and create expiring database snapshots')
+        .addHelpText('after', '\nSnapshots are created on demand. Newly does not schedule backups or create predeployment snapshots.\nYou can run backup create from your own scheduler; production requires an owner user credential and Newly availability.');
+    for (const action of ['status', 'list']) {
+        common(backup.command(action).description(action === 'status' ? 'Show recovery history, snapshot availability and automation support' : 'List available database snapshots, including previous branches'))
+            .action(async (opts) => {
+            try {
+                const { client, projectId } = connection(opts);
+                console.log(JSON.stringify(await runDatabaseOperation(client, projectId, opts.env, { action: `backup-${action}` }), null, 2));
+            }
+            catch (error) {
+                handleError(error);
+            }
+        });
+    }
+    common(backup.command('create').description('Create a snapshot and wait for the provider to finish'))
+        .option('--name <name>', 'snapshot label (up to 80 characters)')
+        .option('--retention-hours <hours>', 'expires after 1 to 168 hours', '24')
+        .action(async (opts) => {
+        try {
+            const hours = Number(opts.retentionHours);
+            if (!Number.isInteger(hours) || hours < 1 || hours > 168)
+                throw new Error('--retention-hours must be an integer from 1 to 168');
+            if (opts.name !== undefined && (!opts.name.trim() || opts.name.length > 80 || [...opts.name].some((char) => char.charCodeAt(0) < 32)))
+                throw new Error('--name must be 1 to 80 characters without control characters');
+            const { client, projectId } = connection(opts);
+            const data = await runDatabaseOperation(client, projectId, opts.env, { action: 'backup-create', name: opts.name, retention_seconds: hours * 3600 }, { onStarted: (id) => console.error(`Backup operation: ${id}`) });
+            console.log(JSON.stringify(data, null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    const restore = db.command('restore').description('Prepare a restored copy, inspect it, and explicitly switch the database');
+    common(restore.command('prepare').argument('<snapshot-id>').description('Restore a snapshot into an isolated copy; keeps the live database in place'))
+        .option('--schemas <schemas>', 'comma-separated schemas whose migration ledgers to inspect', 'api,auth')
+        .action(async (snapshotId, opts) => {
+        try {
+            if (!/^[a-z0-9-]{1,60}$/.test(snapshotId))
+                throw new Error('Invalid snapshot id');
+            const { client, projectId } = connection(opts);
+            console.log(JSON.stringify(await runDatabaseOperation(client, projectId, opts.env, { action: 'restore-prepare', snapshot_id: snapshotId, schemas: opts.schemas.split(',').map((schema) => schema.trim()) }, { onStarted: (id) => console.error(`Restore preview operation: ${id}`) }), null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    common(restore.command('apply').argument('<preview-operation-id>').description('Switch the whole database to the prepared copy; discards later writes and restarts connections'))
+        .requiredOption('--confirm-project <id>', 'type the exact project id to confirm the database switch')
+        .option('--accept-data-loss', 'confirm that all writes since the snapshot can be lost')
+        .action(async (previewId, opts) => {
+        try {
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(previewId))
+                throw new Error('Invalid restore preview operation id');
+            const { client, projectId } = connection(opts);
+            if (opts.confirmProject !== projectId || opts.acceptDataLoss !== true)
+                throw new Error('Applying a restore requires --confirm-project matching the project id and --accept-data-loss');
+            const operationId = randomUUID();
+            const stepUp = opts.env === 'prod' ? await authorizeDatabaseAction(client, projectId, opts.env, 'restore-apply', operationId) : undefined;
+            console.log(JSON.stringify(await runDatabaseOperation(client, projectId, opts.env, { action: 'restore-apply', preview_operation_id: previewId, confirm_project: opts.confirmProject, accept_data_loss: true, step_up: stepUp }, { operationId, onStarted: (id) => console.error(`Restore apply operation: ${id}`) }), null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    common(restore.command('discard').argument('<preview-operation-id>').description('Delete an unapplied restored copy and its preview compute'))
+        .action(async (previewId, opts) => {
+        try {
+            if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/.test(previewId))
+                throw new Error('Invalid restore preview operation id');
+            const { client, projectId } = connection(opts);
+            console.log(JSON.stringify(await runDatabaseOperation(client, projectId, opts.env, { action: 'restore-discard', preview_operation_id: previewId }, { onStarted: (id) => console.error(`Restore discard operation: ${id}`) }), null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    common(restore.command('cleanup').argument('<preview-operation-id>').description('Remove the previous branch if an applied restore reported cleanup_required'))
+        .action(async (previewId, opts) => {
+        try {
+            const { client, projectId } = connection(opts);
+            const operationId = randomUUID();
+            const stepUp = await authorizeDatabaseAction(client, projectId, opts.env, 'restore-cleanup', operationId);
+            console.log(JSON.stringify(await runDatabaseOperation(client, projectId, opts.env, { action: 'restore-cleanup', preview_operation_id: previewId, step_up: stepUp }, { operationId }), null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+    const credentials = db.command('credentials').description('Manage the runtime owner credential shared by API and Auth');
+    common(credentials.command('rotate').description('Invalidate saved owner URLs and publish a new database password to API and Auth'))
+        .requiredOption('--confirm-project <id>', 'exact project id')
+        .option('--accept-connection-restart', 'accept that resetting the password restarts database connections')
+        .action(async (opts) => {
+        try {
+            const { client, projectId } = connection(opts);
+            if (opts.confirmProject !== projectId || !opts.acceptConnectionRestart)
+                throw new Error('Rotation requires --confirm-project matching the project and --accept-connection-restart');
+            const operationId = randomUUID();
+            const stepUp = await authorizeDatabaseAction(client, projectId, opts.env, 'credentials-rotate', operationId);
+            console.log(JSON.stringify(await runDatabaseOperation(client, projectId, opts.env, { action: 'credentials-rotate', confirm_project: projectId, accept_connection_restart: true, step_up: stepUp }, { operationId, onStarted: (id) => console.error(`Credential rotation operation: ${id}`) }), null, 2));
+        }
+        catch (error) {
+            handleError(error);
+        }
+    });
+}

package/dist/commands/misc.js

@@ -1,5 +1,6 @@
 import { ApiClient, friendlyApiError } from '../api.js';
 import { requireCredentials, resolveProject } from '../config.js';
+import { registerDatabaseHelpers } from './database.js';
 export function assertDevOnly(env, command) {
     if (env !== 'dev') {
         throw new Error(`\`newly ${command}\` is dev-only from the CLI. Prod ${command} requires the Newly web app (a browser session).`);
@@ -85,8 +86,16 @@ export async function setSecret(client, projectId, env, service, key, value) {
         value,
     });
 }
-export async function getDbUrl(client, projectId, env) {
-    const out = await client.get(`/newly_backend/readonly_db_url?project_id=${encodeURIComponent(projectId)}&env=${env}`);
+export async function getDbUrl(client, projectId, env, role = 'readonly') {
+    if (role === 'owner' || env === 'prod') {
+        const exportId = randomUUID();
+        const proof = await authorizeDatabaseAction(client, projectId, env, `${role}-export`, exportId);
+        const out = await client.post(`/newly_backend/database/${encodeURIComponent(projectId)}/connection`, { env, role, export_id: exportId, step_up: proof });
+        return out.database_url;
+    }
+    const out = await client.get(env === 'dev' && role === 'readonly'
+        ? `/newly_backend/readonly_db_url?project_id=${encodeURIComponent(projectId)}&env=${env}`
+        : `/newly_backend/database/${encodeURIComponent(projectId)}/connection?env=${env}&role=${role}`);
     return out.database_url ?? out.url ?? JSON.stringify(out);
 }
 function makeClient(project) {
@@ -162,15 +171,19 @@ export function registerMisc(program) {
         }
     });
     const db = program.command('db').description('Database helpers');
+    registerDatabaseHelpers(db);
     db.command('url')
-        .description('Print a readonly URL for the Newly DB')
+        .description('Print a direct database connection URL; owner role permits database management')
         .option('--env <env>', 'dev or prod', 'dev')
+        .option('--role <role>', 'readonly or owner (owner export requires the project owner’s user credential)', 'readonly')
         .option('--project <id>', 'project id')
         .action(async (opts) => {
         try {
-            assertDevOnly(opts.env, 'db url');
+            assertKnownEnv(opts.env, 'db url');
+            if (opts.role !== 'readonly' && opts.role !== 'owner')
+                throw new Error('--role must be readonly or owner');
             const { client, projectId } = makeClient(opts.project);
-            console.log(await getDbUrl(client, projectId, opts.env));
+            console.log(await getDbUrl(client, projectId, opts.env, opts.role));
         }
         catch (e) {
             console.error(friendlyApiError(e));
@@ -178,3 +191,5 @@ export function registerMisc(program) {
         }
     });
 }
+import { randomUUID } from 'node:crypto';
+import { authorizeDatabaseAction } from '../database-authorization.js';

package/dist/database-authorization.js

@@ -0,0 +1,23 @@
+import { createInterface } from 'node:readline/promises';
+export async function authorizeDatabaseAction(client, projectId, env, action, resourceId, readCode) {
+    const response = await client.post(`/newly_backend/database/${encodeURIComponent(projectId)}/step-up`, { env, action, resource_id: resourceId });
+    if (typeof response.challenge_id !== 'string')
+        throw new Error('Database authorization did not return a challenge id');
+    console.error(`Database authorization: ${response.challenge_id}`);
+    let code;
+    if (readCode)
+        code = await readCode();
+    else {
+        const input = createInterface({ input: process.stdin, output: process.stderr, terminal: false });
+        try {
+            code = await input.question('Enter the verification code sent to your account email: ');
+        }
+        finally {
+            input.close();
+        }
+    }
+    code = code.trim();
+    if (!/^\d{6}$/.test(code))
+        throw new Error('A six-digit email code is required. Credential export and production restore require fresh authorization.');
+    return { challenge_id: response.challenge_id, code };
+}

package/dist/migration-plan.js

@@ -0,0 +1,74 @@
+import { createHash } from 'node:crypto';
+import { existsSync, readFileSync } from 'node:fs';
+import { join, relative, resolve } from 'node:path';
+import { readBackendServices, assertKnownServices, parseServiceFilter } from './services-manifest.js';
+export function readLocalMigrations(dir, servicesFilter) {
+    const services = readBackendServices(dir);
+    const selected = parseServiceFilter(servicesFilter);
+    assertKnownServices(services, selected);
+    const root = resolve(dir, 'backend');
+    const seenSchemas = new Set();
+    return services.filter((service) => !selected.length || selected.includes(service.name)).flatMap((service) => {
+        const serviceDir = resolve(root, service.path);
+        const path = relative(root, serviceDir);
+        if (path.startsWith('..') || path === '')
+            throw new Error(`Service ${service.name} must have a path inside backend/`);
+        const drizzle = join(serviceDir, 'drizzle');
+        const journal = join(drizzle, 'meta', '_journal.json');
+        if (!existsSync(journal)) {
+            if (service.schema)
+                throw new Error(`Service ${service.name} declares a schema but has no migration journal`);
+            return [];
+        }
+        if (!service.schema || !/^[a-z_][a-z0-9_]{0,62}$/.test(service.schema) || service.schema.startsWith('pg_') || service.schema === 'information_schema')
+            throw new Error(`Service ${service.name} needs a valid migration schema`);
+        if (seenSchemas.has(service.schema))
+            throw new Error(`More than one migration journal targets schema ${service.schema}`);
+        seenSchemas.add(service.schema);
+        const parsed = JSON.parse(readFileSync(journal, 'utf8'));
+        if (!Array.isArray(parsed.entries))
+            throw new Error(`${journal} has no entries array`);
+        let previous = -1;
+        const tags = new Set();
+        const migrations = parsed.entries.map((entry) => {
+            if (typeof entry.tag !== 'string' || !/^[A-Za-z0-9_-]+$/.test(entry.tag) || tags.has(entry.tag) || typeof entry.when !== 'number' || !Number.isSafeInteger(entry.when) || entry.when <= previous)
+                throw new Error(`Invalid or unordered migration journal for ${service.name}`);
+            tags.add(entry.tag);
+            previous = entry.when;
+            const sql = readFileSync(join(drizzle, `${entry.tag}.sql`), 'utf8');
+            return { tag: entry.tag, when: entry.when, hash: createHash('sha256').update(sql).digest('hex') };
+        });
+        return [{ service: service.name, schema: service.schema, migrations }];
+    });
+}
+export function compareMigrations(local, ledger) {
+    const expected = new Map(local.migrations.map((migration) => [migration.when, migration]));
+    const applied = new Set(ledger.rows.map((row) => Number(row.created_at)));
+    const head = ledger.rows.length ? Math.max(...applied) : -1;
+    const problems = [];
+    const seen = new Set();
+    const rows = ledger.rows.map((row) => {
+        const when = Number(row.created_at);
+        if (!Number.isSafeInteger(when) || when < 0)
+            problems.push(`Invalid ledger timestamp: ${row.created_at}`);
+        if (seen.has(when))
+            problems.push(`Duplicate ledger timestamp: ${row.created_at}`);
+        seen.add(when);
+        const migration = expected.get(when);
+        if (!migration)
+            problems.push(`Applied migration is absent from this checkout: ${row.created_at}`);
+        else if (migration.hash !== row.hash)
+            problems.push(`Applied SQL hash differs: ${migration.tag}`);
+        return { ...row, tag: migration?.tag ?? null, hash_matches: migration ? migration.hash === row.hash : null };
+    });
+    const pending = local.migrations.filter((migration) => !applied.has(migration.when));
+    for (const migration of pending) {
+        if (migration.when <= head)
+            problems.push(`Migration was skipped before the applied head: ${migration.tag}`);
+    }
+    return {
+        service: local.service, schema: local.schema, ledger_exists: ledger.exists,
+        applied: rows, pending: pending.map((migration) => migration.tag), problems,
+        would_execute: problems.length ? null : pending.map((migration) => migration.tag),
+    };
+}

package/dist/version.js

@@ -1 +1 @@
-export const CLI_VERSION = '0.2.162';
+export const CLI_VERSION = '0.2.164';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "runcloud",
-  "version": "0.2.162",
+  "version": "0.2.164",
   "description": "Create and control run.cloud remote mobile simulators and cloud sandboxes",
   "license": "Apache-2.0",
   "keywords": [