@abloatai/cli 0.46.0 → 0.48.0

package/dist/cli.cjs

@@ -3755,7 +3755,8 @@ async function confirmFromServer(opts) {
   }
 }
 async function nameProject(projectId, organizationId, opts) {
-  const listed = await listProjects(opts.apiKey, opts.url);
+  const namingKey = resolveOrgManagementKey() ?? opts.apiKey;
+  const listed = await listProjects(namingKey, opts.url);
   const match = listed.ok ? listed.projects.find((p2) => p2.id === projectId) : void 0;
   if (match) {
     return { id: match.id, slug: match.slug, name: match.name, isDefault: match.default };
@@ -4098,6 +4099,12 @@ async function loadSchema(schemaPath, exportName) {
 function maskKey(key) {
   return key ? `${key.slice(0, 12)}\u2026` : "(none)";
 }
+function schemaPushStorageHint(code) {
+  if (code === "no_data_source_registered") {
+    return `This branch is not connected to your database yet. Run ${import_picocolors5.default.bold("ablo connect")} for this branch, then retry the schema push.`;
+  }
+  return null;
+}
 function schemaGitState(schemaPath) {
   try {
     const out = (0, import_child_process.execFileSync)("git", ["status", "--porcelain", "--", schemaPath], {
@@ -4406,7 +4413,10 @@ async function push(argv) {
     const serverMsg = body.message ?? body.reason;
     console.error(import_picocolors5.default.red(`  Forbidden${code ? ` [${code}]` : ""}: ${serverMsg ?? "permission denied"}`));
     console.error(import_picocolors5.default.dim(`  Push used ${import_picocolors5.default.bold(maskKey(args.apiKey))} from ${describeKeySource(keySource)}.`));
-    if (code === "database_role_cannot_enforce_rls") {
+    const storageHint = schemaPushStorageHint(code);
+    if (storageHint) {
+      console.error(import_picocolors5.default.dim(`  ${storageHint}`));
+    } else if (code === "database_role_cannot_enforce_rls") {
       console.error(
         import_picocolors5.default.dim(
           `  Your database role bypasses row-level security. Run ${import_picocolors5.default.bold("npx ablo migrate")} to create a scoped (NOBYPASSRLS) role and repoint DATABASE_URL, then re-push.`
@@ -4566,11 +4576,13 @@ var init_remoteValidation = __esm({
       wal_level: () => `your database isn't set up to share changes as they happen yet`,
       publication: () => `none of your tables are shared with Ablo yet`,
       replication_role: () => `the login Ablo reads with can't follow your changes yet`,
+      replication_slot_capacity: (f) => withActual(`this database has no remaining change-stream capacity for this binding`, f.actual),
       replica_identity: (f) => withActual(
         `some shared tables don't record enough for Ablo to track edits and deletes`,
         f.actual
       ),
       table_select: (f) => withActual(`the login Ablo reads with can't read some shared tables`, f.actual),
+      snapshot_row_security: (f) => withActual(`row-level security hides historical rows from Ablo's initial load`, f.actual),
       write_role: () => `the login Ablo writes with isn't set up yet`,
       row_security: () => `the writer login isn't set to honor your row-level security`,
       database_privileges: () => `the writer login can still create things in your database`,
@@ -4670,7 +4682,7 @@ function quoteIdent(id) {
 function quoteLiteral(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }
-function scopedSequenceGrant(tables, writeRole) {
+function scopedSequenceGrant(tables, writeRole, schema) {
   const names = tables.map(quoteLiteral).join(", ");
   return `DO $$
 DECLARE seq regclass;
@@ -4681,7 +4693,7 @@ BEGIN
     JOIN pg_class s ON s.oid = d.objid AND s.relkind = 'S'
     JOIN pg_class t ON t.oid = d.refobjid
     JOIN pg_namespace n ON n.oid = t.relnamespace
-    WHERE d.deptype IN ('a', 'i') AND n.nspname = 'public' AND t.relname IN (${names})
+    WHERE d.deptype IN ('a', 'i') AND n.nspname = ${quoteLiteral(schema)} AND t.relname IN (${names})
   LOOP
     EXECUTE format('GRANT USAGE, SELECT ON SEQUENCE %s TO ${quoteIdent(writeRole)}', seq);
   END LOOP;
@@ -4691,24 +4703,29 @@ function connectSetupSql(input) {
   const role = input.role && input.role.length > 0 ? input.role : import_footprint.ABLO_REPLICATION_ROLE;
   const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : import_footprint.ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
-  const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map(quoteIdent).join(", ")}` : "FOR ALL TABLES";
-  const tableList = tables.map(quoteIdent).join(", ");
+  const schema = input.schema ?? "public";
+  const publication = input.publication;
+  const qualifiedTables = tables.map((table) => `${quoteIdent(schema)}.${quoteIdent(table)}`);
+  const publicationTarget = tables.length > 0 ? `FOR TABLE ${qualifiedTables.join(", ")}` : "FOR ALL TABLES";
+  const tableList = qualifiedTables.join(", ");
   const scoped = tables.length > 0;
-  const applicationGrant = scoped ? `GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE ${tableList} TO ${quoteIdent(writeRole)};` : `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${quoteIdent(writeRole)};`;
+  const applicationGrant = scoped ? `GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE ${tableList} TO ${quoteIdent(writeRole)};` : `GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(writeRole)};`;
   const replicationReadGrants = scoped ? [`GRANT SELECT ON TABLE ${tableList} TO ${quoteIdent(role)};`] : [
-    `GRANT SELECT ON ALL TABLES IN SCHEMA public TO ${quoteIdent(role)};`,
-    `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO ${quoteIdent(role)};`
+    `GRANT SELECT ON ALL TABLES IN SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(role)};`,
+    `ALTER DEFAULT PRIVILEGES IN SCHEMA ${quoteIdent(schema)} GRANT SELECT ON TABLES TO ${quoteIdent(role)};`
   ];
-  const writerSequenceGrants = scoped ? [scopedSequenceGrant(tables, writeRole)] : [`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${quoteIdent(writeRole)};`];
-  const ledger = (0, import_source2.idempotencyLedgerMigrations)().map((migration) => migration.up);
+  const writerSequenceGrants = scoped ? [scopedSequenceGrant(tables, writeRole, schema)] : [`GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(writeRole)};`];
+  const ledger = (0, import_source2.idempotencyLedgerMigrations)(schema).map((migration) => migration.up);
   return [
     // 1. Turn on logical decoding. Requires a restart (it's not reloadable).
     `ALTER SYSTEM SET wal_level = 'logical';`,
     // 2. Publish the tables Ablo should read.
-    `CREATE PUBLICATION ${quoteIdent(import_footprint.ABLO_PUBLICATION)} ${publicationTarget};`,
+    `CREATE PUBLICATION ${quoteIdent(publication)} ${publicationTarget};`,
     // 3. A least-privilege role: it can stream replication and SELECT the
-    // published tables, nothing more.
-    `CREATE ROLE ${quoteIdent(role)} WITH REPLICATION LOGIN PASSWORD '<password>';`,
+    // published tables, including the initial snapshot of RLS-protected tables.
+    // Logical decoding already exposes every published row independently of
+    // RLS; BYPASSRLS makes the ordinary SELECT snapshot match that same scope.
+    `CREATE ROLE ${quoteIdent(role)} WITH NOSUPERUSER BYPASSRLS NOCREATEDB NOCREATEROLE REPLICATION NOINHERIT LOGIN PASSWORD '<password>';`,
     ...replicationReadGrants,
     // 4. A distinct DML role: no replication, role administration, ownership,
     // schema creation, or DDL. It runs NOBYPASSRLS with row_security on, so on a
@@ -4729,20 +4746,20 @@ function connectSetupSql(input) {
 DO $$ BEGIN
   EXECUTE format('REVOKE TEMPORARY, CREATE ON DATABASE %I FROM PUBLIC', current_database());
 END $$;`,
-    `GRANT USAGE ON SCHEMA public TO ${quoteIdent(writeRole)};`,
+    `GRANT USAGE ON SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(writeRole)};`,
     applicationGrant,
     ...writerSequenceGrants,
     ...scoped ? [] : [
       // "All tables" mode only: keep future tables/sequences writable so the
       // publication doesn't outgrow the grant.
-      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quoteIdent(writeRole)};`,
-      `ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO ${quoteIdent(writeRole)};`
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA ${quoteIdent(schema)} GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${quoteIdent(writeRole)};`,
+      `ALTER DEFAULT PRIVILEGES IN SCHEMA ${quoteIdent(schema)} GRANT USAGE, SELECT ON SEQUENCES TO ${quoteIdent(writeRole)};`
     ],
     // 5. Direct uses the durable replay ledger but deliberately no outbox.
     ...ledger,
-    `REVOKE ALL ON TABLE public.ablo_idempotency FROM PUBLIC;`,
-    `GRANT SELECT, INSERT, UPDATE ON TABLE public.ablo_idempotency TO ${quoteIdent(writeRole)};`,
-    `REVOKE DELETE ON TABLE public.ablo_idempotency FROM ${quoteIdent(writeRole)};`,
+    `REVOKE ALL ON TABLE ${quoteIdent(schema)}.${quoteIdent("ablo_idempotency")} FROM PUBLIC;`,
+    `GRANT SELECT, INSERT, UPDATE ON TABLE ${quoteIdent(schema)}.${quoteIdent("ablo_idempotency")} TO ${quoteIdent(writeRole)};`,
+    `REVOKE DELETE ON TABLE ${quoteIdent(schema)}.${quoteIdent("ablo_idempotency")} FROM ${quoteIdent(writeRole)};`,
     // The writer emits a transactional marker on your WAL so Ablo can correlate
     // the committed row back to the originating write and confirm it — this
     // EXECUTE grant is what makes that confirmation possible. Granted by lookup
@@ -4765,10 +4782,12 @@ BEGIN
 END $$;`
   ];
 }
-function reconcilePublicationPlan(current, desiredTables) {
-  const pub = quoteIdent(import_footprint.ABLO_PUBLICATION);
+function reconcilePublicationPlan(current, desiredTables, opts) {
+  const pub = quoteIdent(opts.publication);
+  const schema = opts.schema ?? "public";
+  const qualified = (table) => `${quoteIdent(schema)}.${quoteIdent(table)}`;
   const desiredAll = desiredTables.length === 0;
-  const target = desiredAll ? "FOR ALL TABLES" : `FOR TABLE ${desiredTables.map(quoteIdent).join(", ")}`;
+  const target = desiredAll ? "FOR ALL TABLES" : `FOR TABLE ${desiredTables.map(qualified).join(", ")}`;
   if (!current.exists) {
     return {
       sql: [`CREATE PUBLICATION ${pub} ${target};`],
@@ -4794,28 +4813,31 @@ function reconcilePublicationPlan(current, desiredTables) {
     return { sql: [], added: [], removed: [], recreated: false };
   }
   return {
-    sql: [`ALTER PUBLICATION ${pub} SET TABLE ${desiredTables.map(quoteIdent).join(", ")};`],
+    sql: [`ALTER PUBLICATION ${pub} SET TABLE ${desiredTables.map(qualified).join(", ")};`],
     added,
     removed,
     recreated: false
   };
 }
-async function readPublicationState(sql) {
+async function readPublicationState(sql, opts) {
+  const publication = opts.publication;
+  const schema = opts.schema ?? "public";
   const pubRows = await sql.unsafe(
     `SELECT puballtables FROM pg_publication WHERE pubname = $1`,
-    [import_footprint.ABLO_PUBLICATION]
+    [publication]
   );
   const pubRow = pubRows[0];
   if (!pubRow) return { exists: false, allTables: false, tables: [] };
   if (pubRow.puballtables) return { exists: true, allTables: true, tables: [] };
   const tableRows = await sql.unsafe(
-    `SELECT tablename FROM pg_publication_tables WHERE pubname = $1 AND schemaname = 'public' ORDER BY tablename`,
-    [import_footprint.ABLO_PUBLICATION]
+    `SELECT tablename FROM pg_publication_tables WHERE pubname = $1 AND schemaname = $2 ORDER BY tablename`,
+    [publication, schema]
   );
   return { exists: true, allTables: false, tables: tableRows.map((r2) => r2.tablename) };
 }
-async function probeReadiness(sql, opts = {}) {
-  const publication = opts.publication ?? import_footprint.ABLO_PUBLICATION;
+async function probeReadiness(sql, opts) {
+  const publication = opts.publication;
+  const schema = opts.schema ?? "public";
   const coordinated = opts.coordinatedTables && opts.coordinatedTables.length > 0 ? new Set(opts.coordinatedTables) : null;
   const items = [];
   const walRows = await sql.unsafe(
@@ -4847,7 +4869,7 @@ On Neon enable Logical Replication in the project (Console \u2192 Settings \u219
     }
   );
   const roleRows = await sql.unsafe(
-    `SELECT rolreplication, rolsuper FROM pg_roles WHERE rolname = current_user`
+    `SELECT rolreplication, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user`
   );
   const role = roleRows[0];
   const hasReplication = Boolean(role && (role.rolreplication || role.rolsuper));
@@ -4863,12 +4885,31 @@ On RDS: GRANT rds_replication TO <your_role>;`
     }
   );
   if (pubRows.length > 0) {
+    const rlsRows = await sql.unsafe(
+      `SELECT DISTINCT pt.tablename AS table_name
+         FROM pg_publication_tables pt
+         JOIN pg_namespace n ON n.nspname = pt.schemaname
+         JOIN pg_class c ON c.relnamespace = n.oid AND c.relname = pt.tablename
+        WHERE pt.pubname = $1 AND pt.schemaname = $2
+          AND row_security_active(c.oid)
+        ORDER BY table_name`,
+      [publication, schema]
+    );
+    const rlsRelevant = coordinated ? rlsRows.filter((row) => coordinated.has(row.table_name)) : rlsRows;
+    items.push(
+      rlsRelevant.length === 0 ? { ok: true, label: "the initial snapshot can read every published row" } : {
+        ok: false,
+        label: `${rlsRelevant.length} published table${rlsRelevant.length === 1 ? "" : "s"} hide historical rows behind RLS`,
+        fix: `ALTER ROLE current_user WITH BYPASSRLS;
+Logical replication already exposes every published row; this lets the ordinary initial SELECT read that same scope.`
+      }
+    );
     const badRows = await sql.unsafe(
       `SELECT c.relname AS table_name, c.relreplident
          FROM pg_publication_tables pt
          JOIN pg_class c ON c.relname = pt.tablename
          JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = pt.schemaname
-        WHERE pt.pubname = $1
+        WHERE pt.pubname = $1 AND pt.schemaname = $2
           AND (
             c.relreplident = 'n'
             OR (
@@ -4879,7 +4920,7 @@ On RDS: GRANT rds_replication TO <your_role>;`
               )
             )
           )`,
-      [publication]
+      [publication, schema]
     );
     const relevant = coordinated ? badRows.filter((row) => coordinated.has(row.table_name)) : badRows;
     items.push(
@@ -4887,7 +4928,7 @@ On RDS: GRANT rds_replication TO <your_role>;`
         ok: false,
         label: `${relevant.length} published table${relevant.length === 1 ? "" : "s"} cannot replicate UPDATE/DELETE`,
         fix: relevant.map(
-          (r2) => `${r2.table_name}: add a PRIMARY KEY, or ALTER TABLE ${quoteIdent(r2.table_name)} REPLICA IDENTITY FULL;`
+          (r2) => `${r2.table_name}: add a PRIMARY KEY, or ALTER TABLE ${quoteIdent(schema)}.${quoteIdent(r2.table_name)} REPLICA IDENTITY FULL;`
         ).join("\n")
       }
     );
@@ -4904,7 +4945,10 @@ async function registerDirectDataSource(opts) {
       connection: "direct",
       connectionString: opts.replicationUrl,
       writeConnectionString: opts.writeUrl,
-      route: opts.route
+      route: opts.route,
+      ...opts.schema ? { schema: opts.schema } : {},
+      ...opts.replicationSlot ? { replicationSlot: opts.replicationSlot } : {},
+      ...opts.publication ? { publication: opts.publication } : {}
     },
     responseSchema: import_wire3.datasourceSummarySchema
   });
@@ -5218,26 +5262,27 @@ function ownershipRemediation(blockers2, admin) {
   const unresolved = blockers2.filter((blocker) => !resolvedOwners.has(blocker.owner));
   return { inheritGrants, unresolved };
 }
-async function publishedTableBlockers(sql, tables) {
+async function publishedTableBlockers(sql, tables, schema = "public") {
   const scoped = tables.length > 0;
   const raw = await sql.unsafe(
     `SELECT format('%I.%I', n.nspname, c.relname) AS relation, ${OWNERSHIP_COLUMNS}
      ${OWNERSHIP_FROM}
       WHERE c.relkind = 'r'
-        AND n.nspname = 'public'
+        AND n.nspname = $${scoped ? "2" : "1"}
         AND c.relname <> 'ablo_idempotency'
         ${scoped ? "AND c.relname = ANY($1)" : ""}`,
-    scoped ? [tables] : []
+    scoped ? [tables, schema] : [schema]
   );
   return ownershipBlockers(import_zod3.z.array(ownedRelationRowSchema).parse(raw));
 }
-async function ledgerBlocker(sql) {
+async function ledgerBlocker(sql, schema = "public") {
   const raw = await sql.unsafe(
     `SELECT format('%I.%I', n.nspname, c.relname) AS relation, ${OWNERSHIP_COLUMNS}
      ${OWNERSHIP_FROM}
       WHERE c.relkind = 'r'
-        AND n.nspname = 'public'
-        AND c.relname = 'ablo_idempotency'`
+        AND n.nspname = $1
+        AND c.relname = 'ablo_idempotency'`,
+    [schema]
   );
   const rows = import_zod3.z.array(ownedRelationRowSchema).parse(raw);
   const row = rows[0];
@@ -5422,7 +5467,7 @@ function blockers(input) {
   }
   if (input.dataSource.kind === "none") {
     found.push({
-      problem: "no database is connected to this plane, so writes are held rather than routed",
+      problem: "this branch is not connected to a database, so writes are held",
       fix: "connect one with `ablo connect apply`"
     });
   }
@@ -5473,13 +5518,15 @@ function connectApplyPlan(input) {
   const role = input.role && input.role.length > 0 ? input.role : import_footprint.ABLO_REPLICATION_ROLE;
   const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : import_footprint.ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
+  const schema = input.schema ?? "public";
+  const publication = input.publication;
   const provider = input.provider ?? "generic";
-  const recipe = connectSetupSql({ tables, role, writeRole });
+  const recipe = connectSetupSql({ tables, role, writeRole, schema, publication });
   const isWal = (s) => s.startsWith("ALTER SYSTEM SET wal_level");
   const isPublication = (s) => s.startsWith("CREATE PUBLICATION");
   const isRoleCreate = (s) => s.startsWith("CREATE ROLE ");
   const grants = recipe.filter((s) => !isWal(s) && !isPublication(s) && !isRoleCreate(s));
-  const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map(quoteIdent).join(", ")}` : "FOR ALL TABLES";
+  const publicationTarget = tables.length > 0 ? `FOR TABLE ${tables.map((table) => `${quoteIdent(schema)}.${quoteIdent(table)}`).join(", ")}` : "FOR ALL TABLES";
   const affectsOthers = effectsOnOthers({ grants, allTables: tables.length === 0 });
   const walStep = input.walAlreadyLogical ? [] : [
     provider === "generic" ? {
@@ -5494,10 +5541,10 @@ function connectApplyPlan(input) {
       sql: []
     }
   ];
-  const reconcile2 = input.existingPublication ? reconcilePublicationPlan(input.existingPublication, tables) : null;
+  const reconcile2 = input.existingPublication ? reconcilePublicationPlan(input.existingPublication, tables, { schema, publication }) : null;
   const publicationSql = reconcile2 ? reconcile2.sql : [
     `DO $$ BEGIN
-  CREATE PUBLICATION ${quoteIdent(import_footprint.ABLO_PUBLICATION)} ${publicationTarget};
+  CREATE PUBLICATION ${quoteIdent(publication)} ${publicationTarget};
 EXCEPTION WHEN duplicate_object THEN NULL;
 END $$;`
   ];
@@ -5522,14 +5569,19 @@ END $$;`
     {
       key: "replication-role",
       title: "Create the read-only login Ablo reads with",
-      detail: `${role} \u2014 it can follow your changes and read, nothing else`,
+      detail: `${role} \u2014 it can follow your changes and snapshot the same published rows, including through RLS`,
       sql: [
         idempotentRole(
           role,
-          "REPLICATION",
+          "NOSUPERUSER BYPASSRLS NOCREATEDB NOCREATEROLE REPLICATION NOINHERIT",
           input.credentials.replicationClause,
           input.rotate === true
-        )
+        ),
+        // Unlike a password, this is a required invariant rather than secret
+        // material owned by one plane. Re-assert it for an existing pre-snapshot
+        // role so `connect apply` repairs the exact upgrade gap that otherwise
+        // certifies an RLS-filtered empty snapshot as complete.
+        `ALTER ROLE ${quoteIdent(role)} WITH BYPASSRLS;`
       ]
     },
     {
@@ -5683,7 +5735,7 @@ function rotateWithoutConnection(input) {
   }
   if (!input.known || input.planeHasConnection) return null;
   if (input.existingRoles.length > 0) return null;
-  return "This plane has no connected database and Ablo's roles are not in this database, so there is no credential to re-key. Connecting for the first time is `ablo connect apply`, which creates the roles and registers them in one run.";
+  return "This branch has no connected database and Ablo's roles are not in this database, so there is no credential to re-key. Connecting for the first time is `ablo connect apply`, which creates the roles and registers them in one run.";
 }
 async function locateExistingConnection(input) {
   const result = await tryControlPlane({
@@ -5691,16 +5743,23 @@ async function locateExistingConnection(input) {
     method: "POST",
     baseUrl: input.apiUrl,
     apiKey: input.apiKey,
-    body: { connectionString: input.connectionString },
+    body: {
+      connectionString: input.connectionString,
+      ...input.schema ? { schema: input.schema } : {}
+    },
     responseSchema: import_wire6.datasourceLocationResponseSchema
   });
   if (!result.ok) return null;
-  return result.value.held;
+  if (result.value.held) return result.value.held;
+  return result.value.available === false ? { private: true } : null;
 }
 function alreadyConnectedElsewhere(held) {
   if (!held) return null;
+  if ("private" in held) {
+    return "This database schema is already connected to another Ablo organization. Ablo does not reveal that organization\u2019s project or branch.";
+  }
   const where = held.project ? `project ${held.project}, branch ${held.branch}` : `branch ${held.branch}`;
-  return `This database is already connected to ${where}. Ablo streams a database from one plane at a time, so registering it here would take the change stream over from the plane that has it.`;
+  return `This database schema is already connected to ${where}. A (database, schema) binding belongs to one plane at a time.`;
 }
 var import_wire6, import_schema5;
 var init_connectPreflight = __esm({
@@ -5849,12 +5908,18 @@ ${ambient}` : ""}`,
       )
     );
   }
-  const tables = args.tables;
   const coordinatedTables = await schemaDeclaredTables() ?? [];
+  const tables = args.tables.length > 0 ? args.tables : coordinatedTables;
+  if (tables.length === 0) {
+    throw new import_errors9.AbloValidationError(
+      `No mapped tables were found for schema ${args.schema}. Push the Ablo schema first, or pass --tables a,b,c. A project binding must enumerate its own schema-qualified tables; it cannot publish every table in a shared database.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
   if (args.tables.length === 0) {
     console.log(
       import_picocolors11.default.dim(
-        `  publishing every table${coordinatedTables.length > 0 ? `; readiness judged on the ${coordinatedTables.length} your schema declares` : ""} (${import_picocolors11.default.bold("--tables")} to publish only some)
+        `  publishing the ${tables.length} table${tables.length === 1 ? "" : "s"} declared by your Ablo schema in ${import_picocolors11.default.bold(args.schema)} (${import_picocolors11.default.bold("--tables")} to override)
 `
       )
     );
@@ -5869,8 +5934,28 @@ ${ambient}` : ""}`,
     console.log(`  ${import_picocolors11.default.yellow("!")} ${mismatch}
 `);
   }
+  const confirmed = connectTarget?.confirmed;
+  if (!confirmed?.branchId) {
+    throw new import_errors9.AbloConnectionError(
+      "Ablo could not confirm the branch this key targets, so it cannot derive an isolated database footprint safely. Check the API URL/key and re-run.",
+      { code: "cli_database_unreachable" }
+    );
+  }
+  const footprint = (0, import_footprint2.footprintNamesFor)({
+    organizationId: confirmed.organizationId,
+    branchId: confirmed.branchId,
+    ...confirmed.projectId ? { projectId: confirmed.projectId } : {}
+  });
+  const role = args.role === import_footprint.ABLO_REPLICATION_ROLE ? footprint.replicationRole : args.role;
+  const writeRole = args.writeRole === import_footprint.ABLO_WRITE_ROLE ? footprint.writeRole : args.writeRole;
+  const publication = footprint.publication;
   const heldElsewhere = alreadyConnectedElsewhere(
-    await locateExistingConnection({ apiUrl: apiBaseUrl(), apiKey, connectionString: adminUrl })
+    await locateExistingConnection({
+      apiUrl: apiBaseUrl(),
+      apiKey,
+      connectionString: adminUrl,
+      schema: args.schema
+    })
   );
   if (heldElsewhere) {
     console.error(`  ${import_picocolors11.default.yellow("!")} ${heldElsewhere}
@@ -5930,8 +6015,8 @@ ${ambient}` : ""}`,
     );
     process.exit(1);
   }
-  const ledger = await ledgerBlocker(admin).catch(() => null);
-  const foreignTables = await publishedTableBlockers(admin, tables).catch(() => []);
+  const ledger = await ledgerBlocker(admin, args.schema).catch(() => null);
+  const foreignTables = await publishedTableBlockers(admin, tables, args.schema).catch(() => []);
   const { inheritGrants, unresolved } = ownershipRemediation(
     [...ledger ? [ledger] : [], ...foreignTables],
     capability.rolname
@@ -5955,12 +6040,16 @@ ${ambient}` : ""}`,
     );
     process.exit(1);
   }
-  const existingPublication = await readPublicationState(admin).catch(
+  const existingPublication = await readPublicationState(admin, {
+    schema: args.schema,
+    publication
+  }).catch(
     () => ({ exists: false, allTables: false, tables: [] })
   );
-  const pubReconcile = reconcilePublicationPlan(existingPublication, tables);
-  const role = args.role && args.role.length > 0 ? args.role : import_footprint.ABLO_REPLICATION_ROLE;
-  const writeRole = args.writeRole && args.writeRole.length > 0 ? args.writeRole : import_footprint.ABLO_WRITE_ROLE;
+  const pubReconcile = reconcilePublicationPlan(existingPublication, tables, {
+    schema: args.schema,
+    publication
+  });
   const existingRoles = await presentRoles(admin, [role, writeRole]).catch(() => []);
   if (rotatePlane) {
     const refusal = rotateWithoutConnection({ rotating, ...rotatePlane, existingRoles });
@@ -6001,8 +6090,10 @@ ${ambient}` : ""}`,
   const writePassword = generateRolePassword();
   const buildPlan = (mode) => connectApplyPlan({
     tables,
-    role: args.role,
-    writeRole: args.writeRole,
+    role,
+    writeRole,
+    schema: args.schema,
+    publication,
     rotate: rotating,
     credentials: {
       replicationClause: passwordClause(replicationPassword, mode),
@@ -6016,7 +6107,7 @@ ${ambient}` : ""}`,
   const steps = buildPlan("scram-verifier");
   if (pubReconcile.removed.length > 0 || pubReconcile.recreated) {
     console.log(
-      `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(import_footprint.ABLO_PUBLICATION)} already publishes a different set; reconciling to your ${import_picocolors11.default.bold("--tables")}:`
+      `  ${import_picocolors11.default.yellow("!")} ${import_picocolors11.default.bold(publication)} already publishes a different set; reconciling to your mapped tables:`
     );
     for (const t of pubReconcile.added) console.log(`      ${import_picocolors11.default.green("+")} ${t}`);
     for (const t of pubReconcile.removed)
@@ -6093,9 +6184,12 @@ ${ambient}` : ""}`,
   }
   const replicationProbe = await probeAsRole(
     replicationUrl,
-    (sql) => probeReadiness(sql, { coordinatedTables })
+    (sql) => probeReadiness(sql, { coordinatedTables, schema: args.schema, publication })
+  );
+  const writeProbe = await probeAsRole(
+    writeUrl,
+    (sql) => probeDirectWriteReadiness(sql, { schema: args.schema, publication })
   );
-  const writeProbe = await probeAsRole(writeUrl, probeDirectWriteReadiness);
   const refused = [
     ...replicationProbe.credentialRefused ? [role] : [],
     ...writeProbe.credentialRefused ? [writeRole] : []
@@ -6150,7 +6244,10 @@ ${ambient}` : ""}`,
     apiKey,
     replicationUrl,
     writeUrl,
-    route: args.route
+    route: args.route,
+    schema: args.schema,
+    replicationSlot: footprint.slot,
+    publication
   });
   process.off("SIGINT", onRotateInterrupt);
   process.off("SIGTERM", onRotateInterrupt);
@@ -6162,7 +6259,7 @@ ${ambient}` : ""}`,
   }
   process.exit(outcome.exitCode);
 }
-var import_picocolors11, import_errors9, ROTATE_STRANDED_CREDENTIALS_NOTICE;
+var import_picocolors11, import_errors9, import_footprint2, ROTATE_STRANDED_CREDENTIALS_NOTICE;
 var init_connectApply = __esm({
   "src/connectApply.ts"() {
     "use strict";
@@ -6171,6 +6268,7 @@ var init_connectApply = __esm({
     init_src();
     init_dist2();
     import_errors9 = require("@abloatai/transaction/errors");
+    import_footprint2 = require("@abloatai/transaction/footprint");
     init_connectSetup();
     init_connectOwnership();
     init_connect();
@@ -6194,6 +6292,7 @@ function parseConnectArgs(argv) {
   let register = false;
   let apply = false;
   let rotate = false;
+  let resnapshot = false;
   let url;
   let envFile;
   let yes = false;
@@ -6202,6 +6301,7 @@ function parseConnectArgs(argv) {
   let locate = false;
   let manual = false;
   let tables = [];
+  let schema = "public";
   let role = import_footprint.ABLO_REPLICATION_ROLE;
   let writeRole = import_footprint.ABLO_WRITE_ROLE;
   let route = "public-allowlist";
@@ -6221,6 +6321,9 @@ function parseConnectArgs(argv) {
       case "rotate":
         rotate = true;
         break;
+      case "resnapshot":
+        resnapshot = true;
+        break;
       case "scan":
         scan = true;
         break;
@@ -6229,7 +6332,7 @@ function parseConnectArgs(argv) {
         break;
       default:
         throw new import_errors10.AbloValidationError(
-          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, scan, locate)`,
+          `unknown connect subcommand: ${lead} (expected register, deregister, check, apply, rotate, resnapshot, scan, locate)`,
           { code: "cli_invalid_arguments" }
         );
     }
@@ -6259,6 +6362,9 @@ function parseConnectArgs(argv) {
         tables = value.split(",").map((t) => t.trim()).filter((t) => t.length > 0);
         break;
       }
+      case "--schema":
+        schema = argv[++i] ?? schema;
+        break;
       case "--role":
         role = argv[++i] ?? role;
         break;
@@ -6290,6 +6396,7 @@ function parseConnectArgs(argv) {
     register,
     apply,
     rotate,
+    resnapshot,
     url,
     envFile,
     yes,
@@ -6297,17 +6404,22 @@ function parseConnectArgs(argv) {
     scan,
     locate,
     tables,
+    schema,
     role,
     writeRole,
     route,
     manual
   };
 }
-function printConnectRecipe(args) {
+function printConnectRecipe(args, footprint) {
+  const role = args.role === import_footprint.ABLO_REPLICATION_ROLE ? footprint.replicationRole : args.role;
+  const writeRole = args.writeRole === import_footprint.ABLO_WRITE_ROLE ? footprint.writeRole : args.writeRole;
   const sql = connectSetupSql({
     tables: args.tables,
-    role: args.role,
-    writeRole: args.writeRole
+    role,
+    writeRole,
+    schema: args.schema,
+    publication: footprint.publication
   });
   console.log(
     `
@@ -6358,7 +6470,7 @@ function printConnectRecipe(args) {
   console.log(
     import_picocolors12.default.dim(
       `       On Amazon RDS, the REPLICATION attribute is granted, not set directly:
-       ${import_picocolors12.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
+       ${import_picocolors12.default.bold(`GRANT rds_replication TO ${quoteIdent(role)};`)}`
     )
   );
   console.log(
@@ -6382,8 +6494,8 @@ function printConnectRecipe(args) {
     `
   ${import_picocolors12.default.bold("5.")} Register the two roles with Ablo. Set them just long enough to register \u2014
      Ablo holds them from here, so your app keeps only ${import_picocolors12.default.bold("ABLO_API_KEY")}:
-       ${import_picocolors12.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors12.default.dim(`\u2192 ${args.role} (replication only)`)}
-       ${import_picocolors12.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors12.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
+       ${import_picocolors12.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors12.default.dim(`\u2192 ${role} (replication only)`)}
+       ${import_picocolors12.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors12.default.dim(`\u2192 ${writeRole} (DML only)`)}
        ${import_picocolors12.default.cyan("npx ablo connect register")}
 `
   );
@@ -6411,9 +6523,9 @@ function printCheckItem(item) {
     }
   }
 }
-async function probeDirectWriteReadiness(sql, opts = {}) {
+async function probeDirectWriteReadiness(sql, opts) {
   const schema = opts.schema ?? "public";
-  const publication = opts.publication ?? import_footprint.ABLO_PUBLICATION;
+  const publication = opts.publication;
   const items = [];
   const roleRows = await sql.unsafe(
     `SELECT rolname, rolsuper, rolbypassrls, rolcreatedb, rolcreaterole, rolreplication
@@ -6526,20 +6638,27 @@ async function probeDirectWriteReadiness(sql, opts = {}) {
   );
   return items;
 }
-async function auditTenantSyncInfra(sql) {
+async function auditTenantSyncInfra(sql, opts = {}) {
   const artifacts = [];
-  for (const artifact of import_footprint2.ABLO_FOOTPRINT) {
-    const key = artifact.kind === "table" || artifact.kind === "type" ? `public.${artifact.name}` : artifact.name;
+  const branchScopedTemplates = /* @__PURE__ */ new Set([
+    import_footprint.ABLO_PUBLICATION,
+    import_footprint3.ABLO_REPLICATION_SLOT,
+    import_footprint.ABLO_REPLICATION_ROLE,
+    import_footprint.ABLO_WRITE_ROLE
+  ]);
+  for (const artifact of import_footprint3.ABLO_FOOTPRINT) {
+    const name = opts.names ? artifact.name === import_footprint.ABLO_PUBLICATION ? opts.names.publication : artifact.name === import_footprint3.ABLO_REPLICATION_SLOT ? opts.names.slot : artifact.name === import_footprint.ABLO_REPLICATION_ROLE ? opts.names.replicationRole : artifact.name === import_footprint.ABLO_WRITE_ROLE ? opts.names.writeRole : artifact.name : artifact.name;
+    const key = artifact.kind === "table" || artifact.kind === "type" ? `${artifact.retired ? "public" : opts.schema ?? "public"}.${name}` : name;
     const rows = await sql.unsafe(FOOTPRINT_LOOKUP[artifact.kind], [
       key
     ]);
     artifacts.push({
       kind: artifact.kind,
-      name: artifact.name,
+      name,
       present: rows[0]?.present === true,
       purpose: artifact.purpose,
       ...artifact.hazard ? { hazard: artifact.hazard } : {},
-      ...artifact.retired ? { retired: true } : {}
+      ...artifact.retired || !opts.names && branchScopedTemplates.has(artifact.name) ? { retired: true } : {}
     });
   }
   return artifacts;
@@ -6564,12 +6683,12 @@ function requireScopedUrl(kind, verb) {
   );
   process.exit(1);
 }
-async function probeAndReport(dbUrl, kind = "replication") {
+async function probeAndReport(dbUrl, kind, opts) {
   const sql = src_default(dbUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
   } });
   let items;
   try {
-    items = kind === "replication" ? await probeReadiness(sql) : await probeDirectWriteReadiness(sql);
+    items = kind === "replication" ? await probeReadiness(sql, opts) : await probeDirectWriteReadiness(sql, opts);
   } catch (err) {
     await sql.end({ timeout: 2 }).catch(() => void 0);
     const dial = dialFailureReason(err);
@@ -6605,7 +6724,7 @@ ${ambient}` : ""}`,
   if (!result.ok) {
     if (result.code === "no_data_source_registered") {
       console.error(
-        `  ${import_picocolors12.default.yellow("\u2014")} No database is connected to this plane yet, so there's nothing to check.
+        `  ${import_picocolors12.default.yellow("\u2014")} This branch is not connected to a database yet, so there's nothing to check.
 ` + import_picocolors12.default.dim(
           `  Connect one with ${import_picocolors12.default.bold("ablo connect apply")}, then re-run ${import_picocolors12.default.bold("ablo connect check")}.
 `
@@ -6697,13 +6816,32 @@ ${ambient}` : ""}`,
   ${brand("ablo")} ${import_picocolors12.default.dim("connect register")}  ${import_picocolors12.default.dim("register a direct DataSource")}
 `
   );
+  const target = await resolveTarget({ url: apiBaseUrl(), apiKey, keySource: "env" });
+  const confirmed = target.confirmed;
+  if (!confirmed?.branchId) {
+    throw new import_errors10.AbloValidationError(
+      "This key is not bound to a branch, so Ablo cannot validate isolated database objects safely.",
+      { code: "cli_database_unreachable" }
+    );
+  }
+  const publication = (0, import_footprint3.footprintNamesFor)({
+    organizationId: confirmed.organizationId,
+    branchId: confirmed.branchId,
+    ...confirmed.projectId ? { projectId: confirmed.projectId } : {}
+  }).publication;
   console.log(`  ${import_picocolors12.default.bold("Replication role")}
 `);
-  const replication = await probeAndReport(dbUrl, "replication");
+  const replication = await probeAndReport(dbUrl, "replication", {
+    schema: args.schema,
+    publication
+  });
   console.log(`
   ${import_picocolors12.default.bold("Direct-write role")}
 `);
-  const write = await probeAndReport(writeDbUrl, "write");
+  const write = await probeAndReport(writeDbUrl, "write", {
+    schema: args.schema,
+    publication
+  });
   const noDial = [
     replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
     write.kind === "no-dial" ? `write: ${write.reason}` : null
@@ -6731,17 +6869,35 @@ ${ambient}` : ""}`,
     apiKey,
     replicationUrl: dbUrl,
     writeUrl: writeDbUrl,
-    route: args.route
+    route: args.route,
+    schema: args.schema
   });
   process.exit(registered ? 0 : 1);
 }
-async function runScan() {
+async function runScan(args) {
   const dbUrl = requireScopedUrl("replication", "scan");
   const sql = src_default(dbUrl, { max: 1, prepare: false, onnotice: () => {
   } });
   let artifacts;
   try {
-    artifacts = await auditTenantSyncInfra(sql);
+    const apiKey = resolveRuntimeApiKey().key;
+    const target = apiKey ? await resolveTarget({ url: apiBaseUrl(), apiKey, keySource: "env" }).catch(() => null) : null;
+    const confirmed = target?.confirmed;
+    const names = confirmed?.branchId ? (0, import_footprint3.footprintNamesFor)({
+      organizationId: confirmed.organizationId,
+      branchId: confirmed.branchId,
+      ...confirmed.projectId ? { projectId: confirmed.projectId } : {}
+    }) : void 0;
+    const isolated = await auditTenantSyncInfra(sql, {
+      schema: args.schema,
+      ...names ? { names } : {}
+    });
+    const legacy = names ? await auditTenantSyncInfra(sql, { schema: args.schema }) : [];
+    artifacts = [...isolated, ...legacy].filter(
+      (artifact, index, all) => all.findIndex(
+        (candidate) => candidate.kind === artifact.kind && candidate.name === artifact.name
+      ) === index
+    );
   } catch (err) {
     const pg = err ?? {};
     await sql.end({ timeout: 2 });
@@ -6792,7 +6948,7 @@ async function runScan() {
 async function runLocate(args) {
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors12.default.dim("connect locate")}  ${import_picocolors12.default.dim("which plane holds this database")}
+  ${brand("ablo")} ${import_picocolors12.default.dim("connect locate")}  ${import_picocolors12.default.dim("which branch is connected to this database")}
 `
   );
   const url = args.url ?? readProjectAdminDatabaseUrl();
@@ -6822,12 +6978,20 @@ ${ambient}` : ""}`,
     path: "/v1/datasources/locate",
     method: "POST",
     apiKey,
-    body: { connectionString: url },
+    body: { connectionString: url, schema: args.schema },
     responseSchema: import_wire7.datasourceLocationResponseSchema
   });
+  if (answer.available === false && !answer.held) {
+    console.log(
+      `  ${import_picocolors12.default.yellow("!")} ${import_picocolors12.default.bold(label)} schema ${import_picocolors12.default.bold(args.schema)} is connected to another organization.
+` + import_picocolors12.default.dim(`    Its project and branch are private. Use another schema or provider database URL.
+`)
+    );
+    return;
+  }
   if (!answer.held) {
     console.log(
-      `  ${import_picocolors12.default.green("\u2713")} No plane holds ${import_picocolors12.default.bold(label)} \u2014 ${import_picocolors12.default.bold("ablo connect apply")} can register it here.
+      `  ${import_picocolors12.default.green("\u2713")} No branch is connected to ${import_picocolors12.default.bold(`${label}/${args.schema}`)} \u2014 ${import_picocolors12.default.bold("ablo connect apply")} can register it here.
 `
     );
     return;
@@ -6838,13 +7002,50 @@ ${ambient}` : ""}`,
   );
   console.log(
     import_picocolors12.default.dim(
-      `    Ablo streams a database from one plane at a time. To move it, disconnect it there
+      `    Ablo connects one branch to each database schema. To move this schema, disconnect it there
     first \u2014 run `
-    ) + import_picocolors12.default.cyan("ablo connect deregister") + import_picocolors12.default.dim(` with a key for that plane, then connect here.
+    ) + import_picocolors12.default.cyan("ablo connect deregister") + import_picocolors12.default.dim(` with a key for that branch, then connect here.
 `) + import_picocolors12.default.dim(`    Confirm a candidate key first with `) + import_picocolors12.default.bold("ablo whoami --key-env <NAME>") + import_picocolors12.default.dim(`.
 `) + import_picocolors12.default.dim(`    Match the project id to a name with `) + import_picocolors12.default.bold("ablo projects list --json") + import_picocolors12.default.dim(".") + "\n"
   );
 }
+async function runResnapshot() {
+  const apiKey = resolveMutationApiKey();
+  if (!apiKey) {
+    throw new import_errors10.AbloAuthenticationError(
+      "No branch-bound secret key found. Set ABLO_API_KEY to the sk_ key for the branch to resnapshot.",
+      { code: "cli_api_key_missing" }
+    );
+  }
+  console.log(
+    `
+  ${brand("ablo")} ${import_picocolors12.default.dim("connect resnapshot")}  ${import_picocolors12.default.dim("reload existing rows")}
+`
+  );
+  const result = await requestControlPlane({
+    path: "/v1/datasources/resnapshot",
+    method: "POST",
+    apiKey,
+    body: {},
+    responseSchema: import_wire7.datasourceResnapshotResponseSchema
+  });
+  if (result.replication_slot?.released === false) {
+    console.log(`  ${import_picocolors12.default.yellow("\u2014")} Snapshot reset recorded, but the old slot is still active.`);
+    if (result.replication_slot.detail) console.log(`  ${import_picocolors12.default.dim(result.replication_slot.detail)}`);
+    if (result.replication_slot.remove_with) {
+      console.log(`  ${import_picocolors12.default.dim("Remove it with:")} ${import_picocolors12.default.bold(result.replication_slot.remove_with)}`);
+    }
+    console.log(`
+  Re-run ${import_picocolors12.default.bold("ablo connect resnapshot")} after releasing it.
+`);
+    process.exit(1);
+  }
+  console.log(
+    `  ${import_picocolors12.default.green("\u2713")} Fresh snapshot requested. The DataSource and credentials were kept.
+  ${import_picocolors12.default.dim(`Run ${import_picocolors12.default.bold("ablo connect check")} until the existing-row load is complete.`)}
+`
+  );
+}
 async function connect(argv) {
   if (argv[0] === "deregister") {
     const { disconnect: disconnect2 } = await Promise.resolve().then(() => (init_disconnect(), disconnect_exports));
@@ -6871,12 +7072,16 @@ async function connect(argv) {
     await runCheck();
     return;
   }
+  if (args.resnapshot) {
+    await runResnapshot();
+    return;
+  }
   if (args.register) {
     await runRegister(args);
     return;
   }
   if (args.scan) {
-    await runScan();
+    await runScan(args);
     return;
   }
   if (args.locate) {
@@ -6890,9 +7095,31 @@ async function connect(argv) {
     await runConnectApply2(args);
     return;
   }
-  printConnectRecipe(args);
+  const apiKey = resolveRuntimeApiKey().key;
+  if (!apiKey) {
+    throw new import_errors10.AbloAuthenticationError(
+      "Ablo needs the branch key to derive isolated database object names. Set ABLO_API_KEY for this branch, then re-run `ablo connect --manual`.",
+      { code: "cli_api_key_missing" }
+    );
+  }
+  const target = await resolveTarget({ url: apiBaseUrl(), apiKey, keySource: "env" });
+  const confirmed = target.confirmed;
+  if (!confirmed?.branchId) {
+    throw new import_errors10.AbloValidationError(
+      "This key is not bound to a branch, so Ablo cannot derive isolated database object names safely.",
+      { code: "cli_database_unreachable" }
+    );
+  }
+  printConnectRecipe(
+    args,
+    (0, import_footprint3.footprintNamesFor)({
+      organizationId: confirmed.organizationId,
+      branchId: confirmed.branchId,
+      ...confirmed.projectId ? { projectId: confirmed.projectId } : {}
+    })
+  );
 }
-var import_errors10, import_picocolors12, import_footprint2, import_wire7, FOOTPRINT_LOOKUP, CONNECT_USAGE;
+var import_errors10, import_picocolors12, import_footprint3, import_wire7, FOOTPRINT_LOOKUP, CONNECT_USAGE;
 var init_connect = __esm({
   "src/connect.ts"() {
     "use strict";
@@ -6900,12 +7127,13 @@ var init_connect = __esm({
     import_errors10 = require("@abloatai/transaction/errors");
     import_picocolors12 = __toESM(require_picocolors(), 1);
     init_src();
-    import_footprint2 = require("@abloatai/transaction/footprint");
+    import_footprint3 = require("@abloatai/transaction/footprint");
     init_dbRole();
     init_config();
     init_controlPlane();
     import_wire7 = require("@abloatai/transaction/wire");
     init_theme();
+    init_target();
     init_remoteValidation();
     init_connectSetup();
     FOOTPRINT_LOOKUP = {
@@ -6927,8 +7155,9 @@ var init_connect = __esm({
     npx ablo connect deregister           Disconnect this project's database \u2014 Ablo stops reading and writing it
     npx ablo connect check                Confirm the connected database is ready, from Ablo's side (needs only ABLO_API_KEY)
     npx ablo connect rotate               New passwords for both logins, then re-register
+    npx ablo connect resnapshot           Recreate only the slot and reload existing rows
     npx ablo connect scan                 List anything Ablo ever set up in your database (read-only, never drops)
-    npx ablo connect locate               See which plane holds this database (read-only; nothing is changed)
+    npx ablo connect locate               See which branch is connected to this database (read-only; nothing is changed)
 
   Running it: bare \`ablo connect\` sets everything up for you \u2014 creating the two
   scoped logins, sharing your tables, and registering \u2014 whenever it finds a
@@ -6941,6 +7170,7 @@ var init_connect = __esm({
     --url <admin-conn>   Admin connection used once to set up (else DATABASE_URL); never stored
     --env-file <path>    Explicitly load DATABASE_URL and ABLO_API_KEY from this file
     --tables a,b,c       Publish only these tables (default: all tables)
+    --schema <name>      Bind this project to one database schema (default: public)
     --role <name>        Name the replication role (default: ablo_replicator)
     --write-role <name>  Name the DML role (default: ablo_writer)
     --route <route>      public-allowlist | privatelink | peering | vpn
@@ -283406,7 +283636,7 @@ async function readStatus(ref, context = {}) {
   return import_branches.branchStatusResponseSchema.parse(response.body);
 }
 function printStatus(status2) {
-  const { branch, schema, data_source: source } = status2;
+  const { branch, schema, storage, data_source: source } = status2;
   console.log(`  ${import_picocolors14.default.bold(branch.slug)} ${import_picocolors14.default.dim(branch.id)}`);
   console.log(
     `  ${import_picocolors14.default.dim("state")}   ${branch.state === "ready" ? import_picocolors14.default.green(branch.state) : import_picocolors14.default.yellow(branch.state)}`
@@ -283422,7 +283652,7 @@ function printStatus(status2) {
       `  ${import_picocolors14.default.dim("parent")}  ${import_picocolors14.default.bold(schema.parent_compatibility)}${counts}`
     );
   }
-  const sourceLabel = source.kind === "hosted" ? "hosted branch plane" : `${source.kind} \xB7 ${source.host ?? "unknown host"}${source.database ? `/${source.database}` : ""} \xB7 ${source.status ?? "unknown"}`;
+  const sourceLabel = source ? `${source.connection} \xB7 ${source.host ?? "unknown host"}${source.database ? `/${source.database}` : ""} \xB7 ${source.status}` : storage.kind === "unbound" ? "not connected to a database" : storage.kind === "internal" ? `Ablo internal product storage \xB7 ${storage.implementation}` : storage.kind === "blocked" ? "storage configuration needs attention" : "customer database connection unavailable";
   console.log(`  ${import_picocolors14.default.dim("data")}    ${sourceLabel}`);
   if (status2.ready) {
     console.log(`
@@ -283569,11 +283799,15 @@ init_controlPlane();
 init_config();
 init_readiness();
 init_theme();
+init_dbRole();
+var import_source3 = require("@abloatai/transaction/source");
 function parseDevArgs(argv) {
   let schemaPath = DEFAULT_SCHEMA_PATH;
   let exportName = DEFAULT_EXPORT;
   let url = process.env.ABLO_API_URL ?? DEFAULT_URL;
   let watchEnabled = false;
+  let local = false;
+  let sourcePath = "ablo/data-source.ts";
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     switch (arg) {
@@ -283592,6 +283826,12 @@ function parseDevArgs(argv) {
       case "--no-watch":
         watchEnabled = false;
         break;
+      case "--local":
+        local = true;
+        break;
+      case "--source":
+        sourcePath = argv[++i] ?? sourcePath;
+        break;
       default:
         throw new import_errors11.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
@@ -283603,9 +283843,55 @@ function parseDevArgs(argv) {
     url,
     apiKey: process.env.ABLO_API_KEY,
     watch: watchEnabled,
+    local,
+    sourcePath,
     planeLabel: "branch"
   };
 }
+async function loadLocalSourceHandler(sourcePath) {
+  const abs = (0, import_path5.resolve)(process.cwd(), sourcePath);
+  if (!(0, import_fs7.existsSync)(abs)) {
+    throw new import_errors11.AbloValidationError(
+      `local Data Source not found at ${import_picocolors15.default.bold(sourcePath)}. Add the signed Data Source handler described by ${import_picocolors15.default.bold("npx ablo docs data-sources")}, or pass ${import_picocolors15.default.bold("--source <path>")}.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
+  const { createJiti } = await import("jiti");
+  const jiti = createJiti(process.cwd());
+  const mod = await jiti.import(abs);
+  const nested = mod.default && typeof mod.default === "object" ? mod.default : void 0;
+  const handler = mod.POST ?? nested?.POST;
+  if (typeof handler !== "function") {
+    throw new import_errors11.AbloValidationError(
+      `${import_picocolors15.default.bold(sourcePath)} must export a ${import_picocolors15.default.bold("POST(request)")} Data Source handler.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
+  return handler;
+}
+async function registerLocalSource(args) {
+  const response = await fetch(`${args.url}/v1/datasources`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${args.apiKey}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      connection: "endpoint",
+      endpoint: "http://localhost/ablo-dev/reverse-channel",
+      signingKey: args.apiKey,
+      reverseChannel: true,
+      metadata: { managed_by: "ablo dev --local" }
+    })
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new import_errors11.AbloValidationError(
+      `Could not register the local Data Source (${response.status}): ${body}`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
+}
 function classifyKey(apiKey) {
   if (!apiKey) {
     return {
@@ -283625,13 +283911,21 @@ function classifyKey(apiKey) {
     reason: `${import_picocolors15.default.bold("ABLO_API_KEY")} is not a secret Ablo key. Expected a branch-bound ${import_picocolors15.default.bold("sk_\u2026")} credential. Run ${import_picocolors15.default.bold("npx ablo dev")} to prepare a development branch.`
   };
 }
-function wireEnvLocal(apiKey, cwd = process.cwd()) {
+function wireEnvLocal(apiKey, cwd = process.cwd(), projectId, branchId) {
   const envPath = (0, import_path5.resolve)(cwd, ".env.local");
   const line = `ABLO_API_KEY=${apiKey}`;
+  const projectLine = projectId ? `ABLO_PROJECT_ID=${projectId}` : null;
+  const branchLine = branchId ? `ABLO_BRANCH_ID=${branchId}` : null;
   let action;
   if (!(0, import_fs7.existsSync)(envPath)) {
-    (0, import_fs7.writeFileSync)(envPath, `${line}
-`, { mode: 384 });
+    (0, import_fs7.writeFileSync)(
+      envPath,
+      `${line}
+${projectLine ? `${projectLine}
+` : ""}${branchLine ? `${branchLine}
+` : ""}`,
+      { mode: 384 }
+    );
     action = `Created ${import_picocolors15.default.bold(".env.local")} with ${import_picocolors15.default.bold("ABLO_API_KEY")}`;
   } else {
     const content = (0, import_fs7.readFileSync)(envPath, "utf8");
@@ -283647,6 +283941,24 @@ function wireEnvLocal(apiKey, cwd = process.cwd()) {
       (0, import_fs7.writeFileSync)(envPath, content.replace(/^ABLO_API_KEY=.*$/m, line));
       action = `Updated ${import_picocolors15.default.bold("ABLO_API_KEY")} in ${import_picocolors15.default.bold(".env.local")} ${import_picocolors15.default.dim(`(was ${existing.slice(0, 12)}\u2026)`)}`;
     }
+    if (projectLine) {
+      const next = (0, import_fs7.readFileSync)(envPath, "utf8");
+      if (/^ABLO_PROJECT_ID=.*$/m.test(next)) {
+        (0, import_fs7.writeFileSync)(envPath, next.replace(/^ABLO_PROJECT_ID=.*$/m, projectLine));
+      } else {
+        (0, import_fs7.appendFileSync)(envPath, `${next.endsWith("\n") || next.length === 0 ? "" : "\n"}${projectLine}
+`);
+      }
+    }
+    if (branchLine) {
+      const next = (0, import_fs7.readFileSync)(envPath, "utf8");
+      if (/^ABLO_BRANCH_ID=.*$/m.test(next)) {
+        (0, import_fs7.writeFileSync)(envPath, next.replace(/^ABLO_BRANCH_ID=.*$/m, branchLine));
+      } else {
+        (0, import_fs7.appendFileSync)(envPath, `${next.endsWith("\n") || next.length === 0 ? "" : "\n"}${branchLine}
+`);
+      }
+    }
   }
   const gitignorePath = (0, import_path5.resolve)(cwd, ".gitignore");
   const gitignore = (0, import_fs7.existsSync)(gitignorePath) ? (0, import_fs7.readFileSync)(gitignorePath, "utf8") : "";
@@ -283717,7 +284029,7 @@ async function runPush(schema, args) {
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a branch-bound ${import_picocolors15.default.bold("sk_")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`;
+    const hint = schemaPushStorageHint(body.code) ?? (body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a branch-bound ${import_picocolors15.default.bold("sk_")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`);
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
@@ -283725,6 +284037,11 @@ async function runPush(schema, args) {
     };
   }
   const serverMessage = String(body.message ?? body.reason ?? bodyText);
+  const storageHint = schemaPushStorageHint(body.code);
+  if (storageHint) {
+    return { ok: false, message: `${serverMessage}
+${import_picocolors15.default.dim(storageHint)}` };
+  }
   if (looksLikeCredentialRefusal(serverMessage)) {
     const pooled = await poolerExplanation(apiBaseUrl(), args.apiKey);
     if (pooled) {
@@ -283745,6 +284062,12 @@ async function dev(argv, runtime = {}) {
   if (runtime.apiKey) args.apiKey = runtime.apiKey;
   else if (!args.apiKey) args.apiKey = resolveRuntimeApiKey("sandbox").key;
   if (runtime.branch) args.planeLabel = runtime.branch.slug;
+  if (args.local && !args.watch) {
+    throw new import_errors11.AbloValidationError(
+      `${import_picocolors15.default.bold("--local")} opens a long-lived secure connector and cannot be combined with ${import_picocolors15.default.bold("--no-watch")}.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
   const key = classifyKey(args.apiKey);
   if (!key.ok) {
     console.error(import_picocolors15.default.red(`  ${key.reason}`));
@@ -283761,6 +284084,35 @@ async function dev(argv, runtime = {}) {
       `  ${import_picocolors15.default.dim("key")}     temporary \xB7 expires ${runtime.branch.expiresAt}`
     );
   }
+  let localAbort = null;
+  if (args.local) {
+    process.env.ABLO_API_KEY = args.apiKey;
+    if (!process.env.DATABASE_URL) {
+      const databaseUrl = readProjectEnvVariable("DATABASE_URL", process.cwd(), false);
+      if (databaseUrl) process.env.DATABASE_URL = databaseUrl.value;
+    }
+    const handler = await loadLocalSourceHandler(args.sourcePath);
+    await registerLocalSource(args);
+    localAbort = new AbortController();
+    const connector = (0, import_source3.createSourceConnector)({
+      apiKey: args.apiKey,
+      handler,
+      baseURL: args.url,
+      client: "ablo-dev",
+      onStatus(status2) {
+        if (status2 === "ready") {
+          console.log(`  ${import_picocolors15.default.green("\u2713")} local Postgres connected through the secure reverse channel`);
+        }
+      },
+      onError(error) {
+        console.error(import_picocolors15.default.yellow(`  local connector: ${error instanceof Error ? error.message : String(error)}`));
+      }
+    });
+    void connector.run(localAbort.signal).catch((error) => {
+      console.error(import_picocolors15.default.red(`  local connector stopped: ${error instanceof Error ? error.message : String(error)}`));
+    });
+    console.log(`  ${import_picocolors15.default.dim("source")}  ${args.sourcePath} ${import_picocolors15.default.dim("(outbound connector; no public URL)")}`);
+  }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
@@ -283775,10 +284127,15 @@ async function dev(argv, runtime = {}) {
   s.start("Pushing schema definition (development branch)");
   const first = await runPush(schema, args);
   s.stop(first.message, first.ok ? 0 : 1);
-  if (!first.ok) process.exit(1);
+  if (!first.ok) {
+    localAbort?.abort();
+    process.exit(1);
+  }
   if (runtime.branch) {
-    console.log(`
-  ${import_picocolors15.default.green("\u2713")} ${wireEnvLocal(args.apiKey)}`);
+    console.log(
+      `
+  ${import_picocolors15.default.green("\u2713")} ${wireEnvLocal(args.apiKey, process.cwd(), runtime.branch.projectId, runtime.branch.id)}`
+    );
     console.log(
       `  ${import_picocolors15.default.dim(`Temporary branch credential expires ${runtime.branch.expiresAt}; rerun ablo dev to rotate it.`)}`
     );
@@ -283827,6 +284184,7 @@ async function dev(argv, runtime = {}) {
   }
   const stop = () => {
     watcher.close();
+    localAbort?.abort();
     console.log(`
   ${import_picocolors15.default.dim("stopped.")}`);
     process.exit(0);
@@ -283842,6 +284200,7 @@ init_controlPlane();
 var BRANCH_DEV_USAGE = `Usage:
   ablo dev [--branch <slug>] [--branch-ttl-hours <1-168>]
            [--schema <path>] [--export <name>] [--url <url>]
+           [--local] [--source <path>]
   ablo dev --no-watch [branch options]
 
 By default, dev discovers the Git/CI branch, ensures its isolated Ablo branch,
@@ -283953,6 +284312,7 @@ async function runBranchDev(argv, dependencies = {}) {
     apiKey: result.credential.api_key,
     branch: {
       id: result.branch.id,
+      projectId: result.branch.project_id,
       slug: result.branch.slug,
       expiresAt: result.credential.expires_at
     }
@@ -284227,8 +284587,9 @@ var COMMANDS = [
         { run: "connect", does: "Connect your database \u2014 shows the setup to run, or applies it for you" },
         { run: "connect apply", does: "Run that setup for you, from a one-time admin URL" },
         { run: "connect check", does: "Confirm your database is ready to share changes with Ablo" },
+        { run: "connect resnapshot", does: "Reload existing rows without deregistering or rotating credentials" },
         { run: "connect scan", does: "List anything Ablo ever set up in your database (read-only)" },
-        { run: "connect locate", does: "See which plane holds a database before connecting it" },
+        { run: "connect locate", does: "See which branch is connected to a database before connecting it" },
         { run: "connect deregister", does: "Disconnect this project's database \u2014 Ablo stops reading and writing it" }
       ]
     }
@@ -284972,11 +285333,11 @@ async function status(args = []) {
     }
   } else if (dataSource.kind === "none") {
     console.log(
-      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.red("\u2717 no database connected to this plane")} ${import_picocolors19.default.dim("\u2014 writes are held")}`
+      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.red("\u2717 this branch is not connected to a database")} ${import_picocolors19.default.dim("\u2014 writes are held")}`
     );
   } else if (reachable) {
     console.log(
-      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`could not read the plane's databases (${dataSource.detail})`)}`
+      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`could not read this branch's database connection (${dataSource.detail})`)}`
     );
   }
   const pushed = reachable ? await fetchPushedSchema(apiUrl3, introspectKey) : null;
@@ -285022,7 +285383,7 @@ async function status(args = []) {
     }
   } else if (dataSource.kind === "unknown") {
     console.log(
-      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim("nothing is blocking a write, but this key could not read the plane's databases \u2014 some checks were skipped")}`
+      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim("nothing is blocking a write, but this key could not read the branch's database connection \u2014 some checks were skipped")}`
     );
   } else {
     console.log(
@@ -285129,7 +285490,7 @@ async function doctor() {
     checks.push({
       label: "data",
       state: "fail",
-      detail: "no database connected to this plane \u2014 writes are held",
+      detail: "this branch is not connected to a database \u2014 writes are held",
       fix: "connect one with `ablo connect apply`"
     });
   } else {
@@ -285721,7 +286082,7 @@ async function reportReadSubject(dbUrl) {
   }
   if (state.kind === "none") {
     console.log(
-      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} no database is registered for this plane, so Ablo does not read this one`
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} this branch is not connected to a database, so Ablo does not read this one`
     );
     console.log(
       `           ${import_picocolors23.default.dim(`Connect it with ${import_picocolors23.default.bold("ablo connect apply")}. Until then a table here is invisible to the engine.`)}
@@ -287138,6 +287499,8 @@ import { schema } from './schema';
 // via the session route and never touches the key.
 export const sync = Ablo({
   apiKey: process.env.ABLO_API_KEY,${authLine}
+  projectId: process.env.ABLO_PROJECT_ID,
+  branchId: process.env.ABLO_BRANCH_ID,
   schema,
 });
 
@@ -287163,7 +287526,7 @@ function generateEnv(storage, opts = {}) {
   const { includeApiKey = true } = opts;
   const databaseBlock = storage === "replication" ? "# Used by `npx ablo connect` to set up + register logical replication \u2014 the\n# DIRECT (un-pooled) endpoint. Ablo TAILS your WAL from here; it never writes.\n# The client never sees it; the browser never sees it. Your DB stays yours.\nDATABASE_URL=postgres://user:password@host:5432/db\n" : "# Used by ablo/data-source.ts (your DB endpoint) + `ablo migrate` \u2014 NOT the client.\n# Ablo never sees it; the browser never sees it. Your DB stays in your app.\nDATABASE_URL=postgres://user:password@host:5432/db\n";
   const webhookBlock = storage === "endpoint" ? "# Signing secret for the webhook receiver (app/api/ablo/webhooks/route.ts).\n# Ablo mints this when you register the endpoint's URL (POST /v1/webhook_endpoints\n# or the dashboard) and returns it once \u2014 paste it here.\nABLO_WEBHOOK_SECRET=whsec_your_endpoint_secret_here\n" : "";
-  const apiKeyBlock = includeApiKey ? "# Ablo: a branch-bound sk_ key (`npx ablo dev` wires a development branch for you)\nABLO_API_KEY=sk_your_key_here\n" : "";
+  const apiKeyBlock = includeApiKey ? "# Ablo: a branch-bound sk_ key (`npx ablo dev` wires both values for you).\n# Project + branch are assertions: the SDK rejects a key for another app or environment.\nABLO_API_KEY=sk_your_key_here\nABLO_PROJECT_ID=proj_your_project_id\nABLO_BRANCH_ID=br_your_branch_id\n" : "";
   return `${apiKeyBlock}${webhookBlock}${databaseBlock}`;
 }
 function generateDataSource(orm) {
@@ -287324,8 +287687,7 @@ export async function POST(req: Request): Promise<Response> {
 `;
 }
 function generateAgent() {
-  return `import Ablo from '@abloatai/ablo';
-import { schema } from './schema';
+  return `import { sync as ablo } from './sync';
 
 /**
  * An AI "teammate" that works the same synced tasks a human does.
@@ -287335,8 +287697,6 @@ import { schema } from './schema';
  * \`npx ablo logs\`. That's the whole idea: agents and people on one typed,
  * synced dataset.
  */
-const ablo = Ablo({ schema, apiKey: process.env.ABLO_API_KEY });
-
 async function main() {
   await ablo.ready();
 
@@ -287354,7 +287714,6 @@ async function main() {
     data: { priority: 10 },
     readAt: snap.stamp,
     onStale: 'reject',
-    wait: 'confirmed',
   });
   console.log('prioritized:', urgent.title);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/cli",
-  "version": "0.46.0",
+  "version": "0.48.0",
   "description": "The ablo command line: set up Ablo, connect your database, and push your schema from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -30,10 +30,10 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@abloatai/transaction": "^0.46.0",
+    "@abloatai/transaction": "^0.48.0",
     "jiti": "^2.7.0",
     "zod": "^4.4.3",
-    "@abloatai/humans": "^0.46.0"
+    "@abloatai/humans": "^0.48.0"
   },
   "devDependencies": {
     "@clack/prompts": "^0.11.0",