@abloatai/cli 0.47.0 → 0.48.0

package/dist/cli.cjs

@@ -4099,9 +4099,11 @@ async function loadSchema(schemaPath, exportName) {
 function maskKey(key) {
   return key ? `${key.slice(0, 12)}\u2026` : "(none)";
 }
-function schemaPushPlaneHint(code) {
-  if (code !== "test_database_not_registered") return null;
-  return `The key authenticated and already passed ${import_picocolors5.default.bold("schema:push")} authorization. This is a branch storage-provisioning error, not a key-scope error. Check the plane with ${import_picocolors5.default.bold("npx ablo branch status <branch>")}; a branch reported as hosted should not need a customer database.`;
+function schemaPushStorageHint(code) {
+  if (code === "no_data_source_registered") {
+    return `This branch is not connected to your database yet. Run ${import_picocolors5.default.bold("ablo connect")} for this branch, then retry the schema push.`;
+  }
+  return null;
 }
 function schemaGitState(schemaPath) {
   try {
@@ -4411,9 +4413,9 @@ async function push(argv) {
     const serverMsg = body.message ?? body.reason;
     console.error(import_picocolors5.default.red(`  Forbidden${code ? ` [${code}]` : ""}: ${serverMsg ?? "permission denied"}`));
     console.error(import_picocolors5.default.dim(`  Push used ${import_picocolors5.default.bold(maskKey(args.apiKey))} from ${describeKeySource(keySource)}.`));
-    const planeHint = schemaPushPlaneHint(code);
-    if (planeHint) {
-      console.error(import_picocolors5.default.dim(`  ${planeHint}`));
+    const storageHint = schemaPushStorageHint(code);
+    if (storageHint) {
+      console.error(import_picocolors5.default.dim(`  ${storageHint}`));
     } else if (code === "database_role_cannot_enforce_rls") {
       console.error(
         import_picocolors5.default.dim(
@@ -4702,7 +4704,7 @@ function connectSetupSql(input) {
   const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : import_footprint.ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
   const schema = input.schema ?? "public";
-  const publication = input.publication ?? import_footprint.ABLO_PUBLICATION;
+  const publication = input.publication;
   const qualifiedTables = tables.map((table) => `${quoteIdent(schema)}.${quoteIdent(table)}`);
   const publicationTarget = tables.length > 0 ? `FOR TABLE ${qualifiedTables.join(", ")}` : "FOR ALL TABLES";
   const tableList = qualifiedTables.join(", ");
@@ -4780,8 +4782,8 @@ BEGIN
 END $$;`
   ];
 }
-function reconcilePublicationPlan(current, desiredTables, opts = {}) {
-  const pub = quoteIdent(opts.publication ?? import_footprint.ABLO_PUBLICATION);
+function reconcilePublicationPlan(current, desiredTables, opts) {
+  const pub = quoteIdent(opts.publication);
   const schema = opts.schema ?? "public";
   const qualified = (table) => `${quoteIdent(schema)}.${quoteIdent(table)}`;
   const desiredAll = desiredTables.length === 0;
@@ -4817,8 +4819,8 @@ function reconcilePublicationPlan(current, desiredTables, opts = {}) {
     recreated: false
   };
 }
-async function readPublicationState(sql, opts = {}) {
-  const publication = opts.publication ?? import_footprint.ABLO_PUBLICATION;
+async function readPublicationState(sql, opts) {
+  const publication = opts.publication;
   const schema = opts.schema ?? "public";
   const pubRows = await sql.unsafe(
     `SELECT puballtables FROM pg_publication WHERE pubname = $1`,
@@ -4833,8 +4835,8 @@ async function readPublicationState(sql, opts = {}) {
   );
   return { exists: true, allTables: false, tables: tableRows.map((r2) => r2.tablename) };
 }
-async function probeReadiness(sql, opts = {}) {
-  const publication = opts.publication ?? import_footprint.ABLO_PUBLICATION;
+async function probeReadiness(sql, opts) {
+  const publication = opts.publication;
   const schema = opts.schema ?? "public";
   const coordinated = opts.coordinatedTables && opts.coordinatedTables.length > 0 ? new Set(opts.coordinatedTables) : null;
   const items = [];
@@ -5465,7 +5467,7 @@ function blockers(input) {
   }
   if (input.dataSource.kind === "none") {
     found.push({
-      problem: "no database is connected to this plane, so writes are held rather than routed",
+      problem: "this branch is not connected to a database, so writes are held",
       fix: "connect one with `ablo connect apply`"
     });
   }
@@ -5517,7 +5519,7 @@ function connectApplyPlan(input) {
   const writeRole = input.writeRole && input.writeRole.length > 0 ? input.writeRole : import_footprint.ABLO_WRITE_ROLE;
   const tables = input.tables ?? [];
   const schema = input.schema ?? "public";
-  const publication = input.publication ?? import_footprint.ABLO_PUBLICATION;
+  const publication = input.publication;
   const provider = input.provider ?? "generic";
   const recipe = connectSetupSql({ tables, role, writeRole, schema, publication });
   const isWal = (s) => s.startsWith("ALTER SYSTEM SET wal_level");
@@ -5733,7 +5735,7 @@ function rotateWithoutConnection(input) {
   }
   if (!input.known || input.planeHasConnection) return null;
   if (input.existingRoles.length > 0) return null;
-  return "This plane has no connected database and Ablo's roles are not in this database, so there is no credential to re-key. Connecting for the first time is `ablo connect apply`, which creates the roles and registers them in one run.";
+  return "This branch has no connected database and Ablo's roles are not in this database, so there is no credential to re-key. Connecting for the first time is `ablo connect apply`, which creates the roles and registers them in one run.";
 }
 async function locateExistingConnection(input) {
   const result = await tryControlPlane({
@@ -6409,12 +6411,15 @@ function parseConnectArgs(argv) {
     manual
   };
 }
-function printConnectRecipe(args) {
+function printConnectRecipe(args, footprint) {
+  const role = args.role === import_footprint.ABLO_REPLICATION_ROLE ? footprint.replicationRole : args.role;
+  const writeRole = args.writeRole === import_footprint.ABLO_WRITE_ROLE ? footprint.writeRole : args.writeRole;
   const sql = connectSetupSql({
     tables: args.tables,
-    role: args.role,
-    writeRole: args.writeRole,
-    schema: args.schema
+    role,
+    writeRole,
+    schema: args.schema,
+    publication: footprint.publication
   });
   console.log(
     `
@@ -6465,7 +6470,7 @@ function printConnectRecipe(args) {
   console.log(
     import_picocolors12.default.dim(
       `       On Amazon RDS, the REPLICATION attribute is granted, not set directly:
-       ${import_picocolors12.default.bold(`GRANT rds_replication TO ${quoteIdent(args.role)};`)}`
+       ${import_picocolors12.default.bold(`GRANT rds_replication TO ${quoteIdent(role)};`)}`
     )
   );
   console.log(
@@ -6489,8 +6494,8 @@ function printConnectRecipe(args) {
     `
   ${import_picocolors12.default.bold("5.")} Register the two roles with Ablo. Set them just long enough to register \u2014
      Ablo holds them from here, so your app keeps only ${import_picocolors12.default.bold("ABLO_API_KEY")}:
-       ${import_picocolors12.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors12.default.dim(`\u2192 ${args.role} (replication only)`)}
-       ${import_picocolors12.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors12.default.dim(`\u2192 ${args.writeRole} (DML only)`)}
+       ${import_picocolors12.default.bold("ABLO_REPLICATION_DATABASE_URL")}   ${import_picocolors12.default.dim(`\u2192 ${role} (replication only)`)}
+       ${import_picocolors12.default.bold("ABLO_WRITE_DATABASE_URL")}         ${import_picocolors12.default.dim(`\u2192 ${writeRole} (DML only)`)}
        ${import_picocolors12.default.cyan("npx ablo connect register")}
 `
   );
@@ -6518,9 +6523,9 @@ function printCheckItem(item) {
     }
   }
 }
-async function probeDirectWriteReadiness(sql, opts = {}) {
+async function probeDirectWriteReadiness(sql, opts) {
   const schema = opts.schema ?? "public";
-  const publication = opts.publication ?? import_footprint.ABLO_PUBLICATION;
+  const publication = opts.publication;
   const items = [];
   const roleRows = await sql.unsafe(
     `SELECT rolname, rolsuper, rolbypassrls, rolcreatedb, rolcreaterole, rolreplication
@@ -6635,6 +6640,12 @@ async function probeDirectWriteReadiness(sql, opts = {}) {
 }
 async function auditTenantSyncInfra(sql, opts = {}) {
   const artifacts = [];
+  const branchScopedTemplates = /* @__PURE__ */ new Set([
+    import_footprint.ABLO_PUBLICATION,
+    import_footprint3.ABLO_REPLICATION_SLOT,
+    import_footprint.ABLO_REPLICATION_ROLE,
+    import_footprint.ABLO_WRITE_ROLE
+  ]);
   for (const artifact of import_footprint3.ABLO_FOOTPRINT) {
     const name = opts.names ? artifact.name === import_footprint.ABLO_PUBLICATION ? opts.names.publication : artifact.name === import_footprint3.ABLO_REPLICATION_SLOT ? opts.names.slot : artifact.name === import_footprint.ABLO_REPLICATION_ROLE ? opts.names.replicationRole : artifact.name === import_footprint.ABLO_WRITE_ROLE ? opts.names.writeRole : artifact.name : artifact.name;
     const key = artifact.kind === "table" || artifact.kind === "type" ? `${artifact.retired ? "public" : opts.schema ?? "public"}.${name}` : name;
@@ -6647,7 +6658,7 @@ async function auditTenantSyncInfra(sql, opts = {}) {
       present: rows[0]?.present === true,
       purpose: artifact.purpose,
       ...artifact.hazard ? { hazard: artifact.hazard } : {},
-      ...artifact.retired ? { retired: true } : {}
+      ...artifact.retired || !opts.names && branchScopedTemplates.has(artifact.name) ? { retired: true } : {}
     });
   }
   return artifacts;
@@ -6672,7 +6683,7 @@ function requireScopedUrl(kind, verb) {
   );
   process.exit(1);
 }
-async function probeAndReport(dbUrl, kind = "replication", opts = {}) {
+async function probeAndReport(dbUrl, kind, opts) {
   const sql = src_default(dbUrl, { max: 1, prepare: false, connect_timeout: 10, onnotice: () => {
   } });
   let items;
@@ -6713,7 +6724,7 @@ ${ambient}` : ""}`,
   if (!result.ok) {
     if (result.code === "no_data_source_registered") {
       console.error(
-        `  ${import_picocolors12.default.yellow("\u2014")} No database is connected to this plane yet, so there's nothing to check.
+        `  ${import_picocolors12.default.yellow("\u2014")} This branch is not connected to a database yet, so there's nothing to check.
 ` + import_picocolors12.default.dim(
           `  Connect one with ${import_picocolors12.default.bold("ablo connect apply")}, then re-run ${import_picocolors12.default.bold("ablo connect check")}.
 `
@@ -6805,13 +6816,32 @@ ${ambient}` : ""}`,
   ${brand("ablo")} ${import_picocolors12.default.dim("connect register")}  ${import_picocolors12.default.dim("register a direct DataSource")}
 `
   );
+  const target = await resolveTarget({ url: apiBaseUrl(), apiKey, keySource: "env" });
+  const confirmed = target.confirmed;
+  if (!confirmed?.branchId) {
+    throw new import_errors10.AbloValidationError(
+      "This key is not bound to a branch, so Ablo cannot validate isolated database objects safely.",
+      { code: "cli_database_unreachable" }
+    );
+  }
+  const publication = (0, import_footprint3.footprintNamesFor)({
+    organizationId: confirmed.organizationId,
+    branchId: confirmed.branchId,
+    ...confirmed.projectId ? { projectId: confirmed.projectId } : {}
+  }).publication;
   console.log(`  ${import_picocolors12.default.bold("Replication role")}
 `);
-  const replication = await probeAndReport(dbUrl, "replication", { schema: args.schema });
+  const replication = await probeAndReport(dbUrl, "replication", {
+    schema: args.schema,
+    publication
+  });
   console.log(`
   ${import_picocolors12.default.bold("Direct-write role")}
 `);
-  const write = await probeAndReport(writeDbUrl, "write", { schema: args.schema });
+  const write = await probeAndReport(writeDbUrl, "write", {
+    schema: args.schema,
+    publication
+  });
   const noDial = [
     replication.kind === "no-dial" ? `replication: ${replication.reason}` : null,
     write.kind === "no-dial" ? `write: ${write.reason}` : null
@@ -6918,7 +6948,7 @@ async function runScan(args) {
 async function runLocate(args) {
   console.log(
     `
-  ${brand("ablo")} ${import_picocolors12.default.dim("connect locate")}  ${import_picocolors12.default.dim("which plane holds this database")}
+  ${brand("ablo")} ${import_picocolors12.default.dim("connect locate")}  ${import_picocolors12.default.dim("which branch is connected to this database")}
 `
   );
   const url = args.url ?? readProjectAdminDatabaseUrl();
@@ -6961,7 +6991,7 @@ ${ambient}` : ""}`,
   }
   if (!answer.held) {
     console.log(
-      `  ${import_picocolors12.default.green("\u2713")} No plane holds ${import_picocolors12.default.bold(`${label}/${args.schema}`)} \u2014 ${import_picocolors12.default.bold("ablo connect apply")} can register it here.
+      `  ${import_picocolors12.default.green("\u2713")} No branch is connected to ${import_picocolors12.default.bold(`${label}/${args.schema}`)} \u2014 ${import_picocolors12.default.bold("ablo connect apply")} can register it here.
 `
     );
     return;
@@ -6972,9 +7002,9 @@ ${ambient}` : ""}`,
   );
   console.log(
     import_picocolors12.default.dim(
-      `    Ablo binds one plane to each database schema. To move this schema, disconnect it there
+      `    Ablo connects one branch to each database schema. To move this schema, disconnect it there
     first \u2014 run `
-    ) + import_picocolors12.default.cyan("ablo connect deregister") + import_picocolors12.default.dim(` with a key for that plane, then connect here.
+    ) + import_picocolors12.default.cyan("ablo connect deregister") + import_picocolors12.default.dim(` with a key for that branch, then connect here.
 `) + import_picocolors12.default.dim(`    Confirm a candidate key first with `) + import_picocolors12.default.bold("ablo whoami --key-env <NAME>") + import_picocolors12.default.dim(`.
 `) + import_picocolors12.default.dim(`    Match the project id to a name with `) + import_picocolors12.default.bold("ablo projects list --json") + import_picocolors12.default.dim(".") + "\n"
   );
@@ -7065,7 +7095,29 @@ async function connect(argv) {
     await runConnectApply2(args);
     return;
   }
-  printConnectRecipe(args);
+  const apiKey = resolveRuntimeApiKey().key;
+  if (!apiKey) {
+    throw new import_errors10.AbloAuthenticationError(
+      "Ablo needs the branch key to derive isolated database object names. Set ABLO_API_KEY for this branch, then re-run `ablo connect --manual`.",
+      { code: "cli_api_key_missing" }
+    );
+  }
+  const target = await resolveTarget({ url: apiBaseUrl(), apiKey, keySource: "env" });
+  const confirmed = target.confirmed;
+  if (!confirmed?.branchId) {
+    throw new import_errors10.AbloValidationError(
+      "This key is not bound to a branch, so Ablo cannot derive isolated database object names safely.",
+      { code: "cli_database_unreachable" }
+    );
+  }
+  printConnectRecipe(
+    args,
+    (0, import_footprint3.footprintNamesFor)({
+      organizationId: confirmed.organizationId,
+      branchId: confirmed.branchId,
+      ...confirmed.projectId ? { projectId: confirmed.projectId } : {}
+    })
+  );
 }
 var import_errors10, import_picocolors12, import_footprint3, import_wire7, FOOTPRINT_LOOKUP, CONNECT_USAGE;
 var init_connect = __esm({
@@ -7105,7 +7157,7 @@ var init_connect = __esm({
     npx ablo connect rotate               New passwords for both logins, then re-register
     npx ablo connect resnapshot           Recreate only the slot and reload existing rows
     npx ablo connect scan                 List anything Ablo ever set up in your database (read-only, never drops)
-    npx ablo connect locate               See which plane holds this database (read-only; nothing is changed)
+    npx ablo connect locate               See which branch is connected to this database (read-only; nothing is changed)
 
   Running it: bare \`ablo connect\` sets everything up for you \u2014 creating the two
   scoped logins, sharing your tables, and registering \u2014 whenever it finds a
@@ -283584,7 +283636,7 @@ async function readStatus(ref, context = {}) {
   return import_branches.branchStatusResponseSchema.parse(response.body);
 }
 function printStatus(status2) {
-  const { branch, schema, data_source: source } = status2;
+  const { branch, schema, storage, data_source: source } = status2;
   console.log(`  ${import_picocolors14.default.bold(branch.slug)} ${import_picocolors14.default.dim(branch.id)}`);
   console.log(
     `  ${import_picocolors14.default.dim("state")}   ${branch.state === "ready" ? import_picocolors14.default.green(branch.state) : import_picocolors14.default.yellow(branch.state)}`
@@ -283600,7 +283652,7 @@ function printStatus(status2) {
       `  ${import_picocolors14.default.dim("parent")}  ${import_picocolors14.default.bold(schema.parent_compatibility)}${counts}`
     );
   }
-  const sourceLabel = source.kind === "hosted" ? "hosted branch plane" : `${source.kind} \xB7 ${source.host ?? "unknown host"}${source.database ? `/${source.database}` : ""} \xB7 ${source.status ?? "unknown"}`;
+  const sourceLabel = source ? `${source.connection} \xB7 ${source.host ?? "unknown host"}${source.database ? `/${source.database}` : ""} \xB7 ${source.status}` : storage.kind === "unbound" ? "not connected to a database" : storage.kind === "internal" ? `Ablo internal product storage \xB7 ${storage.implementation}` : storage.kind === "blocked" ? "storage configuration needs attention" : "customer database connection unavailable";
   console.log(`  ${import_picocolors14.default.dim("data")}    ${sourceLabel}`);
   if (status2.ready) {
     console.log(`
@@ -283747,11 +283799,15 @@ init_controlPlane();
 init_config();
 init_readiness();
 init_theme();
+init_dbRole();
+var import_source3 = require("@abloatai/transaction/source");
 function parseDevArgs(argv) {
   let schemaPath = DEFAULT_SCHEMA_PATH;
   let exportName = DEFAULT_EXPORT;
   let url = process.env.ABLO_API_URL ?? DEFAULT_URL;
   let watchEnabled = false;
+  let local = false;
+  let sourcePath = "ablo/data-source.ts";
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i];
     switch (arg) {
@@ -283770,6 +283826,12 @@ function parseDevArgs(argv) {
       case "--no-watch":
         watchEnabled = false;
         break;
+      case "--local":
+        local = true;
+        break;
+      case "--source":
+        sourcePath = argv[++i] ?? sourcePath;
+        break;
       default:
         throw new import_errors11.AbloValidationError(`unknown flag: ${arg}`, { code: "cli_invalid_arguments" });
     }
@@ -283781,9 +283843,55 @@ function parseDevArgs(argv) {
     url,
     apiKey: process.env.ABLO_API_KEY,
     watch: watchEnabled,
+    local,
+    sourcePath,
     planeLabel: "branch"
   };
 }
+async function loadLocalSourceHandler(sourcePath) {
+  const abs = (0, import_path5.resolve)(process.cwd(), sourcePath);
+  if (!(0, import_fs7.existsSync)(abs)) {
+    throw new import_errors11.AbloValidationError(
+      `local Data Source not found at ${import_picocolors15.default.bold(sourcePath)}. Add the signed Data Source handler described by ${import_picocolors15.default.bold("npx ablo docs data-sources")}, or pass ${import_picocolors15.default.bold("--source <path>")}.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
+  const { createJiti } = await import("jiti");
+  const jiti = createJiti(process.cwd());
+  const mod = await jiti.import(abs);
+  const nested = mod.default && typeof mod.default === "object" ? mod.default : void 0;
+  const handler = mod.POST ?? nested?.POST;
+  if (typeof handler !== "function") {
+    throw new import_errors11.AbloValidationError(
+      `${import_picocolors15.default.bold(sourcePath)} must export a ${import_picocolors15.default.bold("POST(request)")} Data Source handler.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
+  return handler;
+}
+async function registerLocalSource(args) {
+  const response = await fetch(`${args.url}/v1/datasources`, {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${args.apiKey}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      connection: "endpoint",
+      endpoint: "http://localhost/ablo-dev/reverse-channel",
+      signingKey: args.apiKey,
+      reverseChannel: true,
+      metadata: { managed_by: "ablo dev --local" }
+    })
+  });
+  if (!response.ok) {
+    const body = await response.text();
+    throw new import_errors11.AbloValidationError(
+      `Could not register the local Data Source (${response.status}): ${body}`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
+}
 function classifyKey(apiKey) {
   if (!apiKey) {
     return {
@@ -283921,7 +284029,7 @@ async function runPush(schema, args) {
   }
   if (status2 === 403) {
     const serverSays = body.message ?? body.reason;
-    const hint = schemaPushPlaneHint(body.code) ?? (body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a branch-bound ${import_picocolors15.default.bold("sk_")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`);
+    const hint = schemaPushStorageHint(body.code) ?? (body.code === "database_role_cannot_enforce_rls" ? `Run ${import_picocolors15.default.bold("npx ablo migrate")} \u2014 it creates the scoped role for you (your DB credential never leaves this machine).` : `Schema authoring needs a branch-bound ${import_picocolors15.default.bold("sk_")} key with ${import_picocolors15.default.bold("schema:push")} \u2014 manage keys at ${import_picocolors15.default.cyan("https://abloatai.com")}.`);
     return {
       ok: false,
       message: `${serverSays ?? "This key can't author schema (missing schema:push scope)."}
@@ -283929,6 +284037,11 @@ async function runPush(schema, args) {
     };
   }
   const serverMessage = String(body.message ?? body.reason ?? bodyText);
+  const storageHint = schemaPushStorageHint(body.code);
+  if (storageHint) {
+    return { ok: false, message: `${serverMessage}
+${import_picocolors15.default.dim(storageHint)}` };
+  }
   if (looksLikeCredentialRefusal(serverMessage)) {
     const pooled = await poolerExplanation(apiBaseUrl(), args.apiKey);
     if (pooled) {
@@ -283949,6 +284062,12 @@ async function dev(argv, runtime = {}) {
   if (runtime.apiKey) args.apiKey = runtime.apiKey;
   else if (!args.apiKey) args.apiKey = resolveRuntimeApiKey("sandbox").key;
   if (runtime.branch) args.planeLabel = runtime.branch.slug;
+  if (args.local && !args.watch) {
+    throw new import_errors11.AbloValidationError(
+      `${import_picocolors15.default.bold("--local")} opens a long-lived secure connector and cannot be combined with ${import_picocolors15.default.bold("--no-watch")}.`,
+      { code: "cli_invalid_arguments" }
+    );
+  }
   const key = classifyKey(args.apiKey);
   if (!key.ok) {
     console.error(import_picocolors15.default.red(`  ${key.reason}`));
@@ -283965,6 +284084,35 @@ async function dev(argv, runtime = {}) {
       `  ${import_picocolors15.default.dim("key")}     temporary \xB7 expires ${runtime.branch.expiresAt}`
     );
   }
+  let localAbort = null;
+  if (args.local) {
+    process.env.ABLO_API_KEY = args.apiKey;
+    if (!process.env.DATABASE_URL) {
+      const databaseUrl = readProjectEnvVariable("DATABASE_URL", process.cwd(), false);
+      if (databaseUrl) process.env.DATABASE_URL = databaseUrl.value;
+    }
+    const handler = await loadLocalSourceHandler(args.sourcePath);
+    await registerLocalSource(args);
+    localAbort = new AbortController();
+    const connector = (0, import_source3.createSourceConnector)({
+      apiKey: args.apiKey,
+      handler,
+      baseURL: args.url,
+      client: "ablo-dev",
+      onStatus(status2) {
+        if (status2 === "ready") {
+          console.log(`  ${import_picocolors15.default.green("\u2713")} local Postgres connected through the secure reverse channel`);
+        }
+      },
+      onError(error) {
+        console.error(import_picocolors15.default.yellow(`  local connector: ${error instanceof Error ? error.message : String(error)}`));
+      }
+    });
+    void connector.run(localAbort.signal).catch((error) => {
+      console.error(import_picocolors15.default.red(`  local connector stopped: ${error instanceof Error ? error.message : String(error)}`));
+    });
+    console.log(`  ${import_picocolors15.default.dim("source")}  ${args.sourcePath} ${import_picocolors15.default.dim("(outbound connector; no public URL)")}`);
+  }
   const schema = await loadSchema(args.schemaPath, args.exportName);
   const modelCount = Object.keys(schema.models).length;
   console.log(
@@ -283979,7 +284127,10 @@ async function dev(argv, runtime = {}) {
   s.start("Pushing schema definition (development branch)");
   const first = await runPush(schema, args);
   s.stop(first.message, first.ok ? 0 : 1);
-  if (!first.ok) process.exit(1);
+  if (!first.ok) {
+    localAbort?.abort();
+    process.exit(1);
+  }
   if (runtime.branch) {
     console.log(
       `
@@ -284033,6 +284184,7 @@ async function dev(argv, runtime = {}) {
   }
   const stop = () => {
     watcher.close();
+    localAbort?.abort();
     console.log(`
   ${import_picocolors15.default.dim("stopped.")}`);
     process.exit(0);
@@ -284048,6 +284200,7 @@ init_controlPlane();
 var BRANCH_DEV_USAGE = `Usage:
   ablo dev [--branch <slug>] [--branch-ttl-hours <1-168>]
            [--schema <path>] [--export <name>] [--url <url>]
+           [--local] [--source <path>]
   ablo dev --no-watch [branch options]
 
 By default, dev discovers the Git/CI branch, ensures its isolated Ablo branch,
@@ -284436,7 +284589,7 @@ var COMMANDS = [
         { run: "connect check", does: "Confirm your database is ready to share changes with Ablo" },
         { run: "connect resnapshot", does: "Reload existing rows without deregistering or rotating credentials" },
         { run: "connect scan", does: "List anything Ablo ever set up in your database (read-only)" },
-        { run: "connect locate", does: "See which plane holds a database before connecting it" },
+        { run: "connect locate", does: "See which branch is connected to a database before connecting it" },
         { run: "connect deregister", does: "Disconnect this project's database \u2014 Ablo stops reading and writing it" }
       ]
     }
@@ -285180,11 +285333,11 @@ async function status(args = []) {
     }
   } else if (dataSource.kind === "none") {
     console.log(
-      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.red("\u2717 no database connected to this plane")} ${import_picocolors19.default.dim("\u2014 writes are held")}`
+      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.red("\u2717 this branch is not connected to a database")} ${import_picocolors19.default.dim("\u2014 writes are held")}`
     );
   } else if (reachable) {
     console.log(
-      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`could not read the plane's databases (${dataSource.detail})`)}`
+      `  ${import_picocolors19.default.dim("data")}    ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim(`could not read this branch's database connection (${dataSource.detail})`)}`
     );
   }
   const pushed = reachable ? await fetchPushedSchema(apiUrl3, introspectKey) : null;
@@ -285230,7 +285383,7 @@ async function status(args = []) {
     }
   } else if (dataSource.kind === "unknown") {
     console.log(
-      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim("nothing is blocking a write, but this key could not read the plane's databases \u2014 some checks were skipped")}`
+      `  ${import_picocolors19.default.yellow("?")} ${import_picocolors19.default.dim("nothing is blocking a write, but this key could not read the branch's database connection \u2014 some checks were skipped")}`
     );
   } else {
     console.log(
@@ -285337,7 +285490,7 @@ async function doctor() {
     checks.push({
       label: "data",
       state: "fail",
-      detail: "no database connected to this plane \u2014 writes are held",
+      detail: "this branch is not connected to a database \u2014 writes are held",
       fix: "connect one with `ablo connect apply`"
     });
   } else {
@@ -285929,7 +286082,7 @@ async function reportReadSubject(dbUrl) {
   }
   if (state.kind === "none") {
     console.log(
-      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} no database is registered for this plane, so Ablo does not read this one`
+      `  ${import_picocolors23.default.dim("ablo")}    ${import_picocolors23.default.yellow("!")} this branch is not connected to a database, so Ablo does not read this one`
     );
     console.log(
       `           ${import_picocolors23.default.dim(`Connect it with ${import_picocolors23.default.bold("ablo connect apply")}. Until then a table here is invisible to the engine.`)}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abloatai/cli",
-  "version": "0.47.0",
+  "version": "0.48.0",
   "description": "The ablo command line: set up Ablo, connect your database, and push your schema from the terminal.",
   "license": "Apache-2.0",
   "type": "module",
@@ -30,10 +30,10 @@
     "directory": "packages/cli"
   },
   "dependencies": {
-    "@abloatai/transaction": "^0.47.0",
+    "@abloatai/transaction": "^0.48.0",
     "jiti": "^2.7.0",
     "zod": "^4.4.3",
-    "@abloatai/humans": "^0.47.0"
+    "@abloatai/humans": "^0.48.0"
   },
   "devDependencies": {
     "@clack/prompts": "^0.11.0",