@apso/cli 0.31.0 → 0.33.1

package/dist/commands/import/data.d.ts

@@ -0,0 +1,22 @@
+/// <reference types="node" />
+import BaseCommand from "../../lib/base-command";
+import { CopyResult } from "../../lib/import";
+/** Resolve the target connection string from flag/env, else undefined. */
+export declare function resolveTargetConnectionString(flagValue: string | undefined, env?: NodeJS.ProcessEnv): string | undefined;
+/** Render a copy result (or dry-run plan) as a human-readable summary. */
+export declare function formatCopyResult(result: CopyResult): string;
+export default class ImportData extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        source: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        target: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        schema: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        tables: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        "batch-size": import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces/parser").CustomOptions>;
+        "dry-run": import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    private promptConnection;
+    run(): Promise<void>;
+}

package/dist/commands/import/data.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatCopyResult = exports.resolveTargetConnectionString = void 0;
+const tslib_1 = require("tslib");
+const core_1 = require("@oclif/core");
+const inquirer_1 = tslib_1.__importDefault(require("inquirer"));
+const base_command_1 = tslib_1.__importDefault(require("../../lib/base-command"));
+const import_1 = require("../../lib/import");
+const supabase_1 = require("./supabase");
+/** Resolve the target connection string from flag/env, else undefined. */
+function resolveTargetConnectionString(flagValue, env = process.env) {
+    return flagValue || env.TARGET_DATABASE_URL || env.APSO_DATABASE_URL || undefined;
+}
+exports.resolveTargetConnectionString = resolveTargetConnectionString;
+/** Render a copy result (or dry-run plan) as a human-readable summary. */
+function formatCopyResult(result) {
+    const lines = [];
+    const total = result.perTable.reduce((sum, t) => sum + t.rows, 0);
+    lines.push(result.dryRun
+        ? `Plan: ${result.perTable.length} table(s), ${total} source row(s) to copy.`
+        : `Copied ${total} row(s) across ${result.perTable.length} table(s).`);
+    for (const t of result.perTable) {
+        lines.push(`  ${t.table}: ${t.rows} row(s)`);
+    }
+    if (result.missingTargetTables.length > 0) {
+        lines.push(`  Skipped (no matching target table): ${result.missingTargetTables.join(", ")}`);
+    }
+    if (result.cyclicTables.length > 0) {
+        lines.push(`  FK cycle (copied best-effort, may need a second pass): ${result.cyclicTables.join(", ")}`);
+    }
+    if (result.skippedColumns.length > 0) {
+        lines.push("  Skipped columns:");
+        for (const s of result.skippedColumns) {
+            lines.push(`    - ${s.table}.${s.column} (${s.reason})`);
+        }
+    }
+    if (result.dryRun && result.blockedTables.length > 0) {
+        lines.push(`  WARNING: target table(s) already have rows and would block a real run: ${result.blockedTables.join(", ")}`);
+    }
+    return lines.join("\n");
+}
+exports.formatCopyResult = formatCopyResult;
+class ImportData extends base_command_1.default {
+    async promptConnection(role) {
+        const answer = await inquirer_1.default.prompt([
+            {
+                type: "password",
+                name: "value",
+                mask: "*",
+                message: `${role} Postgres connection string:`,
+                validate: (input) => input.trim().length > 0 || "A connection string is required",
+            },
+        ]);
+        return answer.value.trim();
+    }
+    async run() {
+        const { flags } = await this.parse(ImportData);
+        const sourceConn = (0, supabase_1.resolveConnectionString)(flags.source) ||
+            (await this.promptConnection("Source"));
+        const targetConn = resolveTargetConnectionString(flags.target) ||
+            (await this.promptConnection("Target"));
+        const tableFilter = flags.tables
+            ? flags.tables.split(",").map((t) => t.trim()).filter(Boolean)
+            : undefined;
+        let sourceReader;
+        let targetWriter;
+        try {
+            this.log("Introspecting source and target schemas...");
+            const sourceSchema = await new import_1.PgIntrospector(sourceConn).introspect(flags.schema);
+            const targetSchema = await new import_1.PgIntrospector(targetConn).introspect(flags.schema);
+            const plan = (0, import_1.planCopy)(sourceSchema, (0, import_1.targetColumnsFromSchema)(targetSchema), tableFilter);
+            if (plan.tables.length === 0) {
+                this.warn("No tables to copy (no source/target table overlap).");
+                return;
+            }
+            sourceReader = await import_1.PgSourceReader.connect(sourceConn, flags.schema);
+            targetWriter = await import_1.PgTargetWriter.connect(targetConn, flags.schema);
+            if (flags["dry-run"]) {
+                const result = await (0, import_1.executeCopy)(plan, sourceReader, targetWriter, {
+                    batchSize: flags["batch-size"],
+                    dryRun: true,
+                });
+                this.log("");
+                this.log(formatCopyResult(result));
+                this.log("");
+                this.log("Dry run — no rows written.");
+                return;
+            }
+            if (!flags.yes) {
+                const tableList = plan.tables.map((t) => t.targetTable).join(", ");
+                const { confirm } = await inquirer_1.default.prompt([
+                    {
+                        type: "confirm",
+                        name: "confirm",
+                        message: `Copy data into ${plan.tables.length} target table(s) (${tableList})?`,
+                        default: false,
+                    },
+                ]);
+                if (!confirm) {
+                    this.log("Data copy cancelled.");
+                    return;
+                }
+            }
+            this.log("Copying data...");
+            const result = await (0, import_1.executeCopy)(plan, sourceReader, targetWriter, {
+                batchSize: flags["batch-size"],
+            });
+            this.log("");
+            this.log(formatCopyResult(result));
+            this.log("Done.");
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            const redacted = (0, import_1.redactConnectionString)(message.split(sourceConn).join("****").split(targetConn).join("****"));
+            this.error(redacted);
+        }
+        finally {
+            if (sourceReader)
+                await sourceReader.close();
+            if (targetWriter)
+                await targetWriter.close();
+        }
+    }
+}
+ImportData.description = "Copy table data from a source Supabase (Postgres) database into the target database rebuilt from the imported schema. Reads the source read-only; inserts into empty target tables.";
+ImportData.examples = [
+    `$ apso import data -s "postgresql://...source..." -t "postgresql://...target..."`,
+    `$ apso import data --dry-run`,
+    `$ apso import data --tables users,orders`,
+];
+ImportData.flags = {
+    source: core_1.Flags.string({
+        char: "s",
+        description: "Source connection string. Falls back to SUPABASE_DB_URL or DATABASE_URL, then prompts.",
+    }),
+    target: core_1.Flags.string({
+        char: "t",
+        description: "Target connection string. Falls back to TARGET_DATABASE_URL or APSO_DATABASE_URL, then prompts.",
+    }),
+    schema: core_1.Flags.string({ description: "Database schema", default: "public" }),
+    tables: core_1.Flags.string({
+        description: "Comma-separated list of source tables to copy (default: all)",
+    }),
+    "batch-size": core_1.Flags.integer({
+        description: "Rows per insert batch",
+        default: 500,
+    }),
+    "dry-run": core_1.Flags.boolean({
+        description: "Plan and report row counts without writing",
+        default: false,
+    }),
+    yes: core_1.Flags.boolean({
+        char: "y",
+        description: "Skip the confirmation prompt",
+        default: false,
+    }),
+};
+exports.default = ImportData;

package/dist/lib/api/client.js

@@ -287,7 +287,14 @@ async function apiRequest(path, options = {}) {
             }
             // Handle server errors with retry
             if (response.status >= 500) {
-                lastError = new ApiClientError(errorData.message || "Server error", response.status, errorData.details);
+                // The BFF returns its message in `.error`; the backend uses `.message`.
+                const errObj = errorData;
+                const serverMsg = errorData.message ||
+                    (typeof errObj.error === "string"
+                        ? errObj.error
+                        : undefined) ||
+                    "Server error";
+                lastError = new ApiClientError(serverMsg, response.status, errorData.details);
                 await sleep(getBackoffDelay(attempt));
                 continue;
             }

package/dist/lib/api/services.d.ts

@@ -138,5 +138,16 @@ export declare const codeApi: {
         bucket?: string;
         key?: string;
     }>;
+    /**
+     * Record S3 metadata after the presigned PUT completes. Without this the
+     * service row's s3_code_key stays null and a server-side push fails with
+     * "No S3 code found". Mirrors the browser upload flow (upload-url -> PUT ->
+     * finalize).
+     */
+    finalize(serviceId: string): Promise<{
+        success: boolean;
+        version?: string;
+        size?: number;
+    }>;
 };
 export {};

package/dist/lib/api/services.js

@@ -377,4 +377,13 @@ exports.codeApi = {
     async getUploadUrl(serviceId) {
         return client_1.api.get(`/api/services/${serviceId}/code/upload-url`);
     },
+    /**
+     * Record S3 metadata after the presigned PUT completes. Without this the
+     * service row's s3_code_key stays null and a server-side push fails with
+     * "No S3 code found". Mirrors the browser upload flow (upload-url -> PUT ->
+     * finalize).
+     */
+    async finalize(serviceId) {
+        return client_1.api.post(`/api/services/${serviceId}/code/finalize`, {});
+    },
 };

package/dist/lib/deploy/server-push.d.ts

@@ -1,6 +1,6 @@
 /// <reference types="node" />
 /// <reference types="node" />
-/** Zip the project source into a buffer, skipping build/vcs/dependency dirs. */
+/** Zip the project source into a buffer, skipping build/vcs/dependency/secret files. */
 export declare function zipProject(cwd: string): Buffer;
 /**
  * Server-side push: upload the project zip to S3 and have the platform push it

package/dist/lib/deploy/server-push.js

@@ -15,12 +15,28 @@ const EXCLUDE_DIRS = new Set([
     ".apso",
     "coverage",
 ]);
-/** Zip the project source into a buffer, skipping build/vcs/dependency dirs. */
+/**
+ * Never push local secrets to the repo. `.env` and `.env.*` (e.g. `.env.local`)
+ * routinely hold DB passwords and session secrets; `.env.example` is the one
+ * env file that is meant to be committed. The backend injects real production
+ * env at runtime, so these are never needed in the pushed code.
+ */
+function isSecretEnvFile(basename) {
+    if (basename === ".env.example" || basename === ".env.sample")
+        return false;
+    return basename === ".env" || basename.startsWith(".env.");
+}
+/** Zip the project source into a buffer, skipping build/vcs/dependency/secret files. */
 function zipProject(cwd) {
     const zip = new adm_zip_1.default();
     zip.addLocalFolder(cwd, "", (filename) => {
         const parts = filename.split(path.sep);
-        return !parts.some((p) => EXCLUDE_DIRS.has(p));
+        if (parts.some((p) => EXCLUDE_DIRS.has(p)))
+            return false;
+        const base = parts[parts.length - 1];
+        if (isSecretEnvFile(base))
+            return false;
+        return true;
     });
     return zip.toBuffer();
 }
@@ -41,6 +57,11 @@ async function serverSidePush(opts) {
     if (!res.ok) {
         throw new Error(`Code upload failed (${res.status}). ${await res.text().catch(() => "")}`);
     }
+    // Record the S3 metadata (bucket/key/version) on the service row. The
+    // presigned PUT lands the zip in S3 but does NOT persist where it went; the
+    // backend push reads s3_code_key from the DB, so without this it fails with
+    // "No S3 code found". Same three-step flow the browser upload uses.
+    await services_1.codeApi.finalize(opts.serviceId);
     await services_1.githubApi.push(opts.serviceId, opts.connectionId, {
         branch: opts.branch,
         message: opts.message,

package/dist/lib/import/copy-data.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Database Import — data copy (phase 2)
+ *
+ * Plans and executes a row copy from a source Postgres/Supabase database into a
+ * target database that was rebuilt from the imported schema (phase 1). The
+ * planning logic is pure and fully unit-testable; the actual reads/writes go
+ * through the injectable `SourceReader` / `TargetWriter` interfaces so the
+ * executor can be tested with fakes (mirroring phase 1's `Introspector`).
+ *
+ * Mapping rules mirror phase 1 exactly:
+ *  - target table name  = snakeCase(entity name) = snakeCase(source table name)
+ *  - single-column FK   = renamed to the platform's camelCase `<ref>Id`
+ *  - every other column = copied under its original name
+ */
+import { IntrospectedSchema, IntrospectedTable } from "./types";
+export interface ColumnMapping {
+    sourceColumn: string;
+    targetColumn: string;
+}
+export interface TableCopyPlan {
+    sourceTable: string;
+    targetTable: string;
+    /** Kept source columns (those whose mapped target column exists), in order. */
+    sourceColumns: string[];
+    /** Target column names, parallel to sourceColumns. */
+    targetColumns: string[];
+    /** Source PK column used to order paged reads (null when there is no PK). */
+    orderBy: string | null;
+    /** Target PK column whose sequence to reset after copy (null if not serial). */
+    serialPkColumn: string | null;
+}
+export interface CopyPlan {
+    tables: TableCopyPlan[];
+    skippedColumns: Array<{
+        table: string;
+        column: string;
+        reason: string;
+    }>;
+    /** Source tables with no corresponding target table (skipped entirely). */
+    missingTargetTables: string[];
+    /** Tables involved in a FK cycle (copied best-effort, after acyclic tables). */
+    cyclicTables: string[];
+}
+/** The target table name the generator produces for a given source table. */
+export declare function targetTableName(sourceTable: string): string;
+/** Map every source column to its target column name (FK rename or identity). */
+export declare function buildColumnMapping(table: IntrospectedTable): ColumnMapping[];
+/**
+ * Order tables so each is copied after the tables it references via FK
+ * (parents before children). Self-references are ignored; tables in a cycle are
+ * reported and appended best-effort at the end.
+ */
+export declare function topoSortTables(tables: IntrospectedTable[]): {
+    order: string[];
+    cyclic: string[];
+};
+/**
+ * Build a full copy plan from the source schema and the set of columns that
+ * actually exist in each target table. Source columns whose mapped target
+ * column is missing are dropped (and reported); source tables with no target
+ * table are skipped entirely.
+ */
+export declare function planCopy(source: IntrospectedSchema, targetColumnsByTable: Map<string, Set<string>>, tableFilter?: string[]): CopyPlan;
+/** Coerce a value read from pg into something safe to bind on insert. */
+export declare function coerceValue(value: unknown): unknown;
+/** Build a parameterized multi-row INSERT statement for a batch. */
+export declare function buildInsertSql(table: string, columns: string[], rows: unknown[][], schema?: string): {
+    text: string;
+    values: unknown[];
+};
+export interface SourceReader {
+    totalRows(table: string): Promise<number>;
+    readBatch(table: string, columns: string[], orderBy: string | null, offset: number, limit: number): Promise<unknown[][]>;
+}
+export interface TargetWriter {
+    rowCount(table: string): Promise<number>;
+    insertBatch(table: string, columns: string[], rows: unknown[][]): Promise<void>;
+    resetSequence(table: string, column: string): Promise<void>;
+    begin(): Promise<void>;
+    commit(): Promise<void>;
+    rollback(): Promise<void>;
+}
+export interface CopyResult {
+    dryRun: boolean;
+    perTable: Array<{
+        table: string;
+        rows: number;
+    }>;
+    skippedColumns: CopyPlan["skippedColumns"];
+    missingTargetTables: string[];
+    cyclicTables: string[];
+    /** Target tables that already had rows (blocks a real, insert-only run). */
+    blockedTables: string[];
+}
+export interface ExecuteOptions {
+    batchSize?: number;
+    dryRun?: boolean;
+}
+/**
+ * Execute a copy plan. Insert-only: if any target table already has rows the
+ * run aborts before writing anything. The whole copy runs in one transaction
+ * on the target, so a failure rolls everything back.
+ */
+export declare function executeCopy(plan: CopyPlan, source: SourceReader, target: TargetWriter, options?: ExecuteOptions): Promise<CopyResult>;
+/** Build the target column lookup used by planCopy from an introspected target. */
+export declare function targetColumnsFromSchema(target: IntrospectedSchema): Map<string, Set<string>>;

package/dist/lib/import/copy-data.js

@@ -0,0 +1,266 @@
+"use strict";
+/**
+ * Database Import — data copy (phase 2)
+ *
+ * Plans and executes a row copy from a source Postgres/Supabase database into a
+ * target database that was rebuilt from the imported schema (phase 1). The
+ * planning logic is pure and fully unit-testable; the actual reads/writes go
+ * through the injectable `SourceReader` / `TargetWriter` interfaces so the
+ * executor can be tested with fakes (mirroring phase 1's `Introspector`).
+ *
+ * Mapping rules mirror phase 1 exactly:
+ *  - target table name  = snakeCase(entity name) = snakeCase(source table name)
+ *  - single-column FK   = renamed to the platform's camelCase `<ref>Id`
+ *  - every other column = copied under its original name
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.targetColumnsFromSchema = exports.executeCopy = exports.buildInsertSql = exports.coerceValue = exports.planCopy = exports.topoSortTables = exports.buildColumnMapping = exports.targetTableName = void 0;
+const casing_1 = require("../utils/casing");
+const relationships_1 = require("../utils/relationships");
+const pg_to_apsorc_1 = require("./pg-to-apsorc");
+const INTEGER_PK_UDTS = new Set(["int2", "int4", "int8"]);
+/** The target table name the generator produces for a given source table. */
+function targetTableName(sourceTable) {
+    return (0, casing_1.snakeCase)(sourceTable);
+}
+exports.targetTableName = targetTableName;
+/** Map every source column to its target column name (FK rename or identity). */
+function buildColumnMapping(table) {
+    const fkRefByColumn = new Map();
+    for (const fk of table.foreignKeys) {
+        if (fk.columns.length === 1) {
+            fkRefByColumn.set(fk.columns[0], fk.referencedTable);
+        }
+    }
+    return [...table.columns]
+        .sort((a, b) => a.ordinal - b.ordinal)
+        .map((col) => {
+        const refTable = fkRefByColumn.get(col.name);
+        if (refTable) {
+            const { toName } = (0, pg_to_apsorc_1.deriveToName)(col.name, refTable);
+            const targetColumn = (0, relationships_1.getRelationshipIdField)({
+                name: refTable,
+                type: "ManyToOne",
+                referenceName: toName,
+            });
+            return { sourceColumn: col.name, targetColumn };
+        }
+        return { sourceColumn: col.name, targetColumn: col.name };
+    });
+}
+exports.buildColumnMapping = buildColumnMapping;
+/**
+ * Order tables so each is copied after the tables it references via FK
+ * (parents before children). Self-references are ignored; tables in a cycle are
+ * reported and appended best-effort at the end.
+ */
+function topoSortTables(tables) {
+    const names = new Set(tables.map((t) => t.name));
+    const deps = new Map();
+    for (const t of tables) {
+        const d = new Set();
+        for (const fk of t.foreignKeys) {
+            if (fk.referencedTable !== t.name && names.has(fk.referencedTable)) {
+                d.add(fk.referencedTable);
+            }
+        }
+        deps.set(t.name, d);
+    }
+    const order = [];
+    const visited = new Set();
+    let progress = true;
+    while (order.length < tables.length && progress) {
+        progress = false;
+        for (const t of tables) {
+            if (visited.has(t.name))
+                continue;
+            if ([...deps.get(t.name)].every((x) => visited.has(x))) {
+                order.push(t.name);
+                visited.add(t.name);
+                progress = true;
+            }
+        }
+    }
+    const cyclic = tables
+        .filter((t) => !visited.has(t.name))
+        .map((t) => t.name);
+    for (const c of cyclic)
+        order.push(c); // best-effort append
+    return { order, cyclic };
+}
+exports.topoSortTables = topoSortTables;
+/**
+ * Build a full copy plan from the source schema and the set of columns that
+ * actually exist in each target table. Source columns whose mapped target
+ * column is missing are dropped (and reported); source tables with no target
+ * table are skipped entirely.
+ */
+function planCopy(source, targetColumnsByTable, tableFilter) {
+    var _a;
+    const filter = tableFilter && tableFilter.length > 0 ? new Set(tableFilter) : null;
+    const consideredTables = source.tables.filter((t) => !filter || filter.has(t.name));
+    const { order, cyclic } = topoSortTables(consideredTables);
+    const byName = new Map(consideredTables.map((t) => [t.name, t]));
+    const tables = [];
+    const skippedColumns = [];
+    const missingTargetTables = [];
+    for (const sourceTable of order) {
+        const table = byName.get(sourceTable);
+        const targetTable = targetTableName(sourceTable);
+        const targetColumns = targetColumnsByTable.get(targetTable);
+        if (!targetColumns) {
+            missingTargetTables.push(sourceTable);
+            continue;
+        }
+        const mapping = buildColumnMapping(table);
+        const keptSource = [];
+        const keptTarget = [];
+        for (const m of mapping) {
+            if (targetColumns.has(m.targetColumn)) {
+                keptSource.push(m.sourceColumn);
+                keptTarget.push(m.targetColumn);
+            }
+            else {
+                skippedColumns.push({
+                    table: sourceTable,
+                    column: m.sourceColumn,
+                    reason: `target column "${m.targetColumn}" not found in ${targetTable}`,
+                });
+            }
+        }
+        // Determine ordering + serial PK handling from a single-column PK.
+        let orderBy = null;
+        let serialPkColumn = null;
+        if (table.primaryKey.length === 1) {
+            const pkCol = table.primaryKey[0];
+            orderBy = pkCol;
+            const pk = table.columns.find((c) => c.name === pkCol);
+            const targetPk = (_a = mapping.find((m) => m.sourceColumn === pkCol)) === null || _a === void 0 ? void 0 : _a.targetColumn;
+            if (pk && targetPk && INTEGER_PK_UDTS.has(pk.udtName)) {
+                serialPkColumn = targetPk;
+            }
+        }
+        tables.push({
+            sourceTable,
+            targetTable,
+            sourceColumns: keptSource,
+            targetColumns: keptTarget,
+            orderBy,
+            serialPkColumn,
+        });
+    }
+    return { tables, skippedColumns, missingTargetTables, cyclicTables: cyclic };
+}
+exports.planCopy = planCopy;
+/** Coerce a value read from pg into something safe to bind on insert. */
+function coerceValue(value) {
+    if (value === null || value === undefined)
+        return null;
+    if (value instanceof Date)
+        return value;
+    if (Buffer.isBuffer(value))
+        return value;
+    if (typeof value === "object")
+        return JSON.stringify(value);
+    return value;
+}
+exports.coerceValue = coerceValue;
+/** Build a parameterized multi-row INSERT statement for a batch. */
+function buildInsertSql(table, columns, rows, schema) {
+    const tableRef = schema ? `"${schema}"."${table}"` : `"${table}"`;
+    const colList = columns.map((c) => `"${c}"`).join(", ");
+    const values = [];
+    const tuples = rows.map((row) => {
+        const placeholders = row.map((val) => {
+            values.push(coerceValue(val));
+            return `$${values.length}`;
+        });
+        return `(${placeholders.join(", ")})`;
+    });
+    return {
+        text: `INSERT INTO ${tableRef} (${colList}) VALUES ${tuples.join(", ")}`,
+        values,
+    };
+}
+exports.buildInsertSql = buildInsertSql;
+/**
+ * Execute a copy plan. Insert-only: if any target table already has rows the
+ * run aborts before writing anything. The whole copy runs in one transaction
+ * on the target, so a failure rolls everything back.
+ */
+async function executeCopy(plan, source, target, options = {}) {
+    var _a, _b;
+    const batchSize = (_a = options.batchSize) !== null && _a !== void 0 ? _a : 500;
+    const dryRun = (_b = options.dryRun) !== null && _b !== void 0 ? _b : false;
+    // Pre-flight: detect non-empty target tables.
+    const blockedTables = [];
+    for (const t of plan.tables) {
+        // eslint-disable-next-line no-await-in-loop
+        const count = await target.rowCount(t.targetTable);
+        if (count > 0)
+            blockedTables.push(t.targetTable);
+    }
+    const perTable = [];
+    if (dryRun) {
+        for (const t of plan.tables) {
+            // eslint-disable-next-line no-await-in-loop
+            const rows = await source.totalRows(t.sourceTable);
+            perTable.push({ table: t.targetTable, rows });
+        }
+        return {
+            dryRun: true,
+            perTable,
+            skippedColumns: plan.skippedColumns,
+            missingTargetTables: plan.missingTargetTables,
+            cyclicTables: plan.cyclicTables,
+            blockedTables,
+        };
+    }
+    if (blockedTables.length > 0) {
+        throw new Error(`Aborting: target table(s) already contain rows: ${blockedTables.join(", ")}. Use a fresh target or clear these tables first.`);
+    }
+    await target.begin();
+    try {
+        for (const t of plan.tables) {
+            let offset = 0;
+            let copied = 0;
+            // eslint-disable-next-line no-constant-condition
+            while (true) {
+                // eslint-disable-next-line no-await-in-loop
+                const rows = await source.readBatch(t.sourceTable, t.sourceColumns, t.orderBy, offset, batchSize);
+                if (rows.length === 0)
+                    break;
+                // eslint-disable-next-line no-await-in-loop
+                await target.insertBatch(t.targetTable, t.targetColumns, rows);
+                copied += rows.length;
+                offset += rows.length;
+                if (rows.length < batchSize)
+                    break;
+            }
+            if (t.serialPkColumn && copied > 0) {
+                // eslint-disable-next-line no-await-in-loop
+                await target.resetSequence(t.targetTable, t.serialPkColumn);
+            }
+            perTable.push({ table: t.targetTable, rows: copied });
+        }
+        await target.commit();
+    }
+    catch (error) {
+        await target.rollback();
+        throw error;
+    }
+    return {
+        dryRun: false,
+        perTable,
+        skippedColumns: plan.skippedColumns,
+        missingTargetTables: plan.missingTargetTables,
+        cyclicTables: plan.cyclicTables,
+        blockedTables,
+    };
+}
+exports.executeCopy = executeCopy;
+/** Build the target column lookup used by planCopy from an introspected target. */
+function targetColumnsFromSchema(target) {
+    return new Map(target.tables.map((t) => [t.name, new Set(t.columns.map((c) => c.name))]));
+}
+exports.targetColumnsFromSchema = targetColumnsFromSchema;

package/dist/lib/import/index.d.ts

@@ -2,3 +2,6 @@ export * from "./types";
 export { pgToApsorc, findUnknownEmittedTypes } from "./pg-to-apsorc";
 export type { ApsorcImportOutput, ApsorcImportEntityOutput, ApsorcImportFieldOutput, ApsorcImportRelationshipOutput, } from "./pg-to-apsorc";
 export { PgIntrospector, redactConnectionString, buildSchema, SYSTEM_SCHEMAS } from "./introspect";
+export { planCopy, executeCopy, buildColumnMapping, topoSortTables, targetTableName, targetColumnsFromSchema, buildInsertSql, coerceValue, } from "./copy-data";
+export type { CopyPlan, CopyResult, TableCopyPlan, ColumnMapping, SourceReader, TargetWriter, ExecuteOptions, } from "./copy-data";
+export { PgSourceReader, PgTargetWriter } from "./pg-data";

package/dist/lib/import/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SYSTEM_SCHEMAS = exports.buildSchema = exports.redactConnectionString = exports.PgIntrospector = exports.findUnknownEmittedTypes = exports.pgToApsorc = void 0;
+exports.PgTargetWriter = exports.PgSourceReader = exports.coerceValue = exports.buildInsertSql = exports.targetColumnsFromSchema = exports.targetTableName = exports.topoSortTables = exports.buildColumnMapping = exports.executeCopy = exports.planCopy = exports.SYSTEM_SCHEMAS = exports.buildSchema = exports.redactConnectionString = exports.PgIntrospector = exports.findUnknownEmittedTypes = exports.pgToApsorc = void 0;
 const tslib_1 = require("tslib");
 tslib_1.__exportStar(require("./types"), exports);
 var pg_to_apsorc_1 = require("./pg-to-apsorc");
@@ -11,3 +11,15 @@ Object.defineProperty(exports, "PgIntrospector", { enumerable: true, get: functi
 Object.defineProperty(exports, "redactConnectionString", { enumerable: true, get: function () { return introspect_1.redactConnectionString; } });
 Object.defineProperty(exports, "buildSchema", { enumerable: true, get: function () { return introspect_1.buildSchema; } });
 Object.defineProperty(exports, "SYSTEM_SCHEMAS", { enumerable: true, get: function () { return introspect_1.SYSTEM_SCHEMAS; } });
+var copy_data_1 = require("./copy-data");
+Object.defineProperty(exports, "planCopy", { enumerable: true, get: function () { return copy_data_1.planCopy; } });
+Object.defineProperty(exports, "executeCopy", { enumerable: true, get: function () { return copy_data_1.executeCopy; } });
+Object.defineProperty(exports, "buildColumnMapping", { enumerable: true, get: function () { return copy_data_1.buildColumnMapping; } });
+Object.defineProperty(exports, "topoSortTables", { enumerable: true, get: function () { return copy_data_1.topoSortTables; } });
+Object.defineProperty(exports, "targetTableName", { enumerable: true, get: function () { return copy_data_1.targetTableName; } });
+Object.defineProperty(exports, "targetColumnsFromSchema", { enumerable: true, get: function () { return copy_data_1.targetColumnsFromSchema; } });
+Object.defineProperty(exports, "buildInsertSql", { enumerable: true, get: function () { return copy_data_1.buildInsertSql; } });
+Object.defineProperty(exports, "coerceValue", { enumerable: true, get: function () { return copy_data_1.coerceValue; } });
+var pg_data_1 = require("./pg-data");
+Object.defineProperty(exports, "PgSourceReader", { enumerable: true, get: function () { return pg_data_1.PgSourceReader; } });
+Object.defineProperty(exports, "PgTargetWriter", { enumerable: true, get: function () { return pg_data_1.PgTargetWriter; } });

package/dist/lib/import/pg-data.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Database Import — pg-backed data access for the copy executor.
+ *
+ * Thin wrappers around `pg` implementing the SourceReader / TargetWriter
+ * interfaces from copy-data.ts. `pg` is imported lazily and SSL is enabled by
+ * default (Supabase requires it). Integration-level: covered by manual/E2E
+ * runs, while the copy logic itself is unit-tested with fakes.
+ */
+import { SourceReader, TargetWriter } from "./copy-data";
+/** Reads rows from the source database (read-only). */
+export declare class PgSourceReader implements SourceReader {
+    private readonly client;
+    private readonly schema;
+    private constructor();
+    static connect(connectionString: string, schema: string): Promise<PgSourceReader>;
+    totalRows(table: string): Promise<number>;
+    readBatch(table: string, columns: string[], orderBy: string | null, offset: number, limit: number): Promise<unknown[][]>;
+    close(): Promise<void>;
+}
+/** Writes rows into the target database within a single transaction. */
+export declare class PgTargetWriter implements TargetWriter {
+    private readonly client;
+    private readonly schema;
+    private constructor();
+    static connect(connectionString: string, schema: string): Promise<PgTargetWriter>;
+    rowCount(table: string): Promise<number>;
+    insertBatch(table: string, columns: string[], rows: unknown[][]): Promise<void>;
+    resetSequence(table: string, column: string): Promise<void>;
+    begin(): Promise<void>;
+    commit(): Promise<void>;
+    rollback(): Promise<void>;
+    close(): Promise<void>;
+}

package/dist/lib/import/pg-data.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Database Import — pg-backed data access for the copy executor.
+ *
+ * Thin wrappers around `pg` implementing the SourceReader / TargetWriter
+ * interfaces from copy-data.ts. `pg` is imported lazily and SSL is enabled by
+ * default (Supabase requires it). Integration-level: covered by manual/E2E
+ * runs, while the copy logic itself is unit-tested with fakes.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PgTargetWriter = exports.PgSourceReader = void 0;
+async function createClient(connectionString) {
+    var _a, _b;
+    const pg = await Promise.resolve().then(() => __importStar(require("pg")));
+    const Client = (_a = pg.Client) !== null && _a !== void 0 ? _a : (_b = pg.default) === null || _b === void 0 ? void 0 : _b.Client;
+    const client = new Client({
+        connectionString,
+        ssl: { rejectUnauthorized: false },
+    });
+    await client.connect();
+    return client;
+}
+function qualified(schema, table) {
+    return `"${schema}"."${table}"`;
+}
+/** Reads rows from the source database (read-only). */
+class PgSourceReader {
+    constructor(client, schema) {
+        this.client = client;
+        this.schema = schema;
+    }
+    static async connect(connectionString, schema) {
+        return new PgSourceReader(await createClient(connectionString), schema);
+    }
+    async totalRows(table) {
+        const res = await this.client.query(`SELECT count(*)::int AS n FROM ${qualified(this.schema, table)}`);
+        return res.rows[0].n;
+    }
+    async readBatch(table, columns, orderBy, offset, limit) {
+        const cols = columns.map((c) => `"${c}"`).join(", ");
+        const order = orderBy ? ` ORDER BY "${orderBy}"` : "";
+        const res = await this.client.query(`SELECT ${cols} FROM ${qualified(this.schema, table)}${order} OFFSET $1 LIMIT $2`, [offset, limit]);
+        return res.rows.map((row) => columns.map((c) => row[c]));
+    }
+    async close() {
+        await this.client.end();
+    }
+}
+exports.PgSourceReader = PgSourceReader;
+/** Writes rows into the target database within a single transaction. */
+class PgTargetWriter {
+    constructor(client, schema) {
+        this.client = client;
+        this.schema = schema;
+    }
+    static async connect(connectionString, schema) {
+        return new PgTargetWriter(await createClient(connectionString), schema);
+    }
+    async rowCount(table) {
+        const res = await this.client.query(`SELECT count(*)::int AS n FROM ${qualified(this.schema, table)}`);
+        return res.rows[0].n;
+    }
+    async insertBatch(table, columns, rows) {
+        const { buildInsertSql } = await Promise.resolve().then(() => __importStar(require("./copy-data")));
+        const { text, values } = buildInsertSql(table, columns, rows, this.schema);
+        await this.client.query(text, values);
+    }
+    async resetSequence(table, column) {
+        // Advance the column's owned sequence past the max value just inserted.
+        await this.client.query(`SELECT setval(
+         pg_get_serial_sequence($1, $2),
+         (SELECT COALESCE(MAX("${column}"), 0) FROM ${qualified(this.schema, table)}),
+         true
+       )`, [`${this.schema}.${table}`, column]);
+    }
+    async begin() {
+        await this.client.query("BEGIN");
+    }
+    async commit() {
+        await this.client.query("COMMIT");
+    }
+    async rollback() {
+        await this.client.query("ROLLBACK");
+    }
+    async close() {
+        await this.client.end();
+    }
+}
+exports.PgTargetWriter = PgTargetWriter;

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.31.0",
+  "version": "0.33.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.31.0",
+      "version": "0.33.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@biomejs/biome": "^1.9.4",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.31.0",
+  "version": "0.33.1",
   "commands": {
     "config": {
       "id": "config",
@@ -627,6 +627,71 @@
       },
       "args": {}
     },
+    "import:data": {
+      "id": "import:data",
+      "description": "Copy table data from a source Supabase (Postgres) database into the target database rebuilt from the imported schema. Reads the source read-only; inserts into empty target tables.",
+      "strict": true,
+      "pluginName": "@apso/cli",
+      "pluginAlias": "@apso/cli",
+      "pluginType": "core",
+      "aliases": [],
+      "hiddenAliases": [],
+      "examples": [
+        "$ apso import data -s \"postgresql://...source...\" -t \"postgresql://...target...\"",
+        "$ apso import data --dry-run",
+        "$ apso import data --tables users,orders"
+      ],
+      "flags": {
+        "source": {
+          "name": "source",
+          "type": "option",
+          "char": "s",
+          "description": "Source connection string. Falls back to SUPABASE_DB_URL or DATABASE_URL, then prompts.",
+          "multiple": false
+        },
+        "target": {
+          "name": "target",
+          "type": "option",
+          "char": "t",
+          "description": "Target connection string. Falls back to TARGET_DATABASE_URL or APSO_DATABASE_URL, then prompts.",
+          "multiple": false
+        },
+        "schema": {
+          "name": "schema",
+          "type": "option",
+          "description": "Database schema",
+          "multiple": false,
+          "default": "public"
+        },
+        "tables": {
+          "name": "tables",
+          "type": "option",
+          "description": "Comma-separated list of source tables to copy (default: all)",
+          "multiple": false
+        },
+        "batch-size": {
+          "name": "batch-size",
+          "type": "option",
+          "description": "Rows per insert batch",
+          "multiple": false,
+          "default": 500
+        },
+        "dry-run": {
+          "name": "dry-run",
+          "type": "boolean",
+          "description": "Plan and report row counts without writing",
+          "allowNo": false
+        },
+        "yes": {
+          "name": "yes",
+          "type": "boolean",
+          "char": "y",
+          "description": "Skip the confirmation prompt",
+          "allowNo": false
+        }
+      },
+      "args": {}
+    },
     "import:supabase": {
       "id": "import:supabase",
       "description": "Introspect an existing Supabase (Postgres) database and generate a local .apsorc schema. Read-only: it never writes to the source database.",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.31.0",
+  "version": "0.33.1",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",