@rebasepro/cli 0.23.0 → 0.24.1-canary.g19596ef

package/dist/pull-CrGYMEsy.js

@@ -0,0 +1,458 @@
+import { execa } from "execa";
+//#region src/dev-db/pull.ts
+/**
+* `rebase db pull` — copy a database's contents into local development.
+*
+* The common case is production into local, and the reason it exists is that
+* the alternative is worse: without it people hand-roll a `pg_dump | psql` and
+* get the flags wrong in ways that either fail loudly at 2am or, more often,
+* quietly restore half a schema.
+*
+* Three things this command insists on, because copying a production database
+* onto a laptop is a data-protection event whether or not anyone calls it one:
+*
+* 1. **It says what it is about to do, in full, before doing it** — which
+*    database it will read, which one it will overwrite, and where the data will
+*    come to rest on disk. The target path matters: people forget that
+*    `.rebase/pgdata` is a directory their backup software may be indexing.
+*
+* 2. **It refuses to run unattended without being told to.** The target is
+*    destroyed, so a mistyped `--from` with no confirmation would take the
+*    developer's working database with it.
+*
+* 3. **It will not write to a remote database.** The target is always the local
+*    development database; there is no flag that makes this push. A tool that
+*    can copy in both directions eventually copies in the wrong one.
+*
+* Anonymization is opt-in (`--anonymize`), which is a deliberate choice and not
+* an obviously safe one — the flag nobody types is the flag nobody gets. It is
+* a best-effort pass over columns whose *names* look like personal data, and
+* {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in
+* a column called `notes`, and this file says so rather than implying a
+* guarantee it cannot keep.
+*
+* What it does guarantee is that it never half-happens: {@link anonymizeCopy}
+* runs the pass in one transaction, and when the pass fails it empties the
+* tables it would have rewritten rather than leave their real values behind.
+*/
+/**
+* Column-name patterns the anonymizer overwrites.
+*
+* Names, not contents: inspecting values would be slower, and would still miss
+* the same things. This is a reasonable-effort measure for making a local copy
+* less dangerous, and it is not a compliance control.
+*/
+var ANONYMIZE_PATTERNS = [
+	{
+		pattern: /^(.*_)?e?mail(_.*)?$/i,
+		value: null,
+		prefix: "user-",
+		suffix: "@example.invalid"
+	},
+	{
+		pattern: /^(.*_)?(phone|mobile|tel|telephone)(_.*)?$/i,
+		value: "+10000000000",
+		prefix: "+1-",
+		suffix: ""
+	},
+	{
+		pattern: /^(.*_)?(first_name|last_name|full_name|surname|given_name)(_.*)?$/i,
+		value: "Redacted",
+		prefix: "Redacted-",
+		suffix: ""
+	},
+	{
+		pattern: /^(.*_)?(address|street|postcode|zip|zipcode)(_.*)?$/i,
+		value: "Redacted",
+		prefix: "Redacted-",
+		suffix: ""
+	},
+	{
+		pattern: /^(.*_)?(ssn|tax_id|national_id|passport)(_.*)?$/i,
+		value: "REDACTED",
+		prefix: "REDACTED-",
+		suffix: ""
+	},
+	{
+		pattern: /^(.*_)?(password|password_hash|secret|token|api_key|access_token|refresh_token)(_.*)?$/i,
+		value: "REDACTED",
+		prefix: "REDACTED-",
+		suffix: ""
+	},
+	{
+		pattern: /^(.*_)?(ip|ip_address|user_agent)(_.*)?$/i,
+		value: "REDACTED",
+		prefix: "REDACTED-",
+		suffix: ""
+	}
+];
+function shouldAnonymize(columnName) {
+	return ANONYMIZE_PATTERNS.some((rule) => rule.pattern.test(columnName));
+}
+/** Random hex of this length, per row. `gen_random_uuid()` is core since PostgreSQL 13. */
+function randomHex(length) {
+	return `left(replace(gen_random_uuid()::text, '-', ''), ${length})`;
+}
+function sqlLiteral(value) {
+	return `'${value.replace(/'/g, "''")}'`;
+}
+/**
+* Fewest random hex digits a unique replacement keeps. Twelve is 16^12 values:
+* a collision needs millions of rows, where eight would need tens of thousands.
+*/
+var MIN_UNIQUE_HEX = 12;
+/**
+* The SQL expression that overwrites one column, or null when no rule names it.
+*
+* Unique per row when an index makes the column unique, and always cut to the
+* column's declared length — `zip char(5)` refused `'Redacted'` outright, and a
+* failed statement now empties the tables rather than skip one. To fit a short
+* unique column the prefix goes first, then the suffix, and the random part is
+* kept to at least {@link MIN_UNIQUE_HEX} digits while there is room for them.
+* A NULL stays NULL: an empty optional field is not personal data.
+*/
+function replacementFor(column) {
+	const rule = ANONYMIZE_PATTERNS.find((candidate) => candidate.pattern.test(column.column));
+	if (!rule) return null;
+	const limit = typeof column.maxLength === "number" && column.maxLength > 0 ? column.maxLength : null;
+	let value;
+	if (rule.value !== null && !column.unique) value = sqlLiteral(limit === null ? rule.value : rule.value.slice(0, limit));
+	else {
+		const [prefix, suffix] = [
+			[rule.prefix, rule.suffix],
+			["", rule.suffix],
+			["", ""]
+		].find(([prefix, suffix]) => limit === null || limit - prefix.length - suffix.length >= MIN_UNIQUE_HEX) ?? ["", ""];
+		const hex = Math.min(32, limit === null ? 32 : limit - prefix.length - suffix.length);
+		value = `concat(${sqlLiteral(prefix)}, ${randomHex(Math.max(1, hex))}, ${sqlLiteral(suffix)})`;
+	}
+	return `CASE WHEN ${quoteIdentifier(column.column)} IS NULL THEN NULL ELSE ${value} END`;
+}
+/** A double-quoted identifier, with any `"` in it doubled — a table called `order` or `a"b` still works. */
+function quoteIdentifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/**
+* Anonymizable columns: name looks personal, and the type can hold the
+* replacement.
+*
+* The type check is what stops this generating `UPDATE … SET user_id =
+* 'Redacted'` for an integer column called `user_id_email_seq` and failing the
+* whole pass on a technicality.
+*/
+function anonymizableColumns(columns) {
+	const textual = /* @__PURE__ */ new Set([
+		"text",
+		"character varying",
+		"varchar",
+		"character",
+		"char",
+		"citext"
+	]);
+	return columns.filter((column) => shouldAnonymize(column.column) && textual.has(column.dataType.toLowerCase()));
+}
+/** `"schema"."table"` for each table the pass rewrites, sorted. */
+function anonymizedTables(columns) {
+	return [...new Set(anonymizableColumns(columns).map((column) => `${quoteIdentifier(column.schema)}.${quoteIdentifier(column.table)}`))].sort();
+}
+/** `UPDATE` statements for one anonymization pass, in a stable order. */
+function anonymizeStatements(columns) {
+	const byTable = /* @__PURE__ */ new Map();
+	for (const column of anonymizableColumns(columns)) {
+		const key = `${quoteIdentifier(column.schema)}.${quoteIdentifier(column.table)}`;
+		byTable.set(key, [...byTable.get(key) ?? [], column]);
+	}
+	return [...byTable.entries()].sort(([a], [b]) => a.localeCompare(b)).map(([table, cols]) => {
+		return `UPDATE ${table} SET ${[...cols].sort((a, b) => a.column.localeCompare(b.column)).map((column) => `${quoteIdentifier(column.column)} = ${replacementFor(column)}`).join(", ")};`;
+	});
+}
+/**
+* Every column the pass could overwrite, with what decides how.
+*
+* Base tables only — a view has an `email` column too, and is not something to
+* UPDATE. Generated columns are skipped for the same reason: `email_domain
+* GENERATED ALWAYS AS (…)` matches by name and refuses any value but DEFAULT,
+* and it follows the column it is generated from anyway. An extension type such
+* as `citext` reports `USER-DEFINED`, so its own name is what is compared.
+*
+* `unique` comes from the indexes, through `pg_depend` as well as `indkey`: a
+* unique index on `lower(email)` names no column in `indkey`, and is exactly
+* what a constant replacement would violate.
+*/
+var ANONYMIZE_COLUMNS_SQL = `
+WITH unique_columns AS (
+    SELECT DISTINCT i.indrelid AS relid, a.attname AS column_name
+      FROM pg_index i
+      JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum > 0 AND NOT a.attisdropped
+     WHERE i.indisunique
+       AND (a.attnum = ANY (i.indkey)
+            OR EXISTS (SELECT 1 FROM pg_depend d
+                        WHERE d.classid = 'pg_class'::regclass AND d.objid = i.indexrelid
+                          AND d.refclassid = 'pg_class'::regclass AND d.refobjid = i.indrelid
+                          AND d.refobjsubid = a.attnum))
+)
+SELECT c.table_schema AS "schema",
+       c.table_name AS "table",
+       c.column_name AS "column",
+       CASE WHEN c.data_type = 'USER-DEFINED' THEN c.udt_name ELSE c.data_type END AS "dataType",
+       c.character_maximum_length AS "maxLength",
+       (u.column_name IS NOT NULL) AS "unique"
+  FROM information_schema.columns c
+  JOIN information_schema.tables t ON t.table_schema = c.table_schema AND t.table_name = c.table_name
+  LEFT JOIN unique_columns u
+         ON u.relid = format('%I.%I', c.table_schema, c.table_name)::regclass AND u.column_name = c.column_name
+ WHERE t.table_type = 'BASE TABLE'
+   AND c.is_generated = 'NEVER'
+   AND c.table_schema NOT IN ('pg_catalog', 'information_schema')`;
+function errorText(error) {
+	return error instanceof Error && error.message ? error.message : String(error);
+}
+/**
+* Overwrite the personal-looking columns of a restored copy, all or nothing.
+*
+* One transaction, so a failure part-way leaves no table half done — the old
+* pass ran its UPDATEs one by one, so a failure on `rebase.refresh_tokens` left
+* `public.authors` anonymized and `rebase.users` holding every real email.
+*
+* A rollback alone would be worse than that, though: it puts back the real
+* value of every column, in a copy the developer asked to be anonymized. So on
+* failure the tables the pass would have rewritten are emptied (`TRUNCATE …
+* CASCADE`, which takes the rows that reference them too), and the outcome
+* says which — or, if even that failed, says the copy holds real data, so the
+* caller can say it louder.
+*
+* `row_security = off` makes a role that RLS would filter fail the pass instead
+* of rewriting only the rows its policies show it, which looked like success.
+*/
+async function anonymizeCopy(client) {
+	let listed = false;
+	let tables = [];
+	try {
+		const { rows } = await client.query(ANONYMIZE_COLUMNS_SQL);
+		tables = anonymizedTables(rows);
+		listed = true;
+		await client.query("BEGIN");
+		await client.query("SET LOCAL row_security = off");
+		for (const statement of anonymizeStatements(rows)) await client.query(statement);
+		await client.query("COMMIT");
+		return {
+			ok: true,
+			tables
+		};
+	} catch (error) {
+		const reason = errorText(error);
+		await client.query("ROLLBACK").catch(() => void 0);
+		if (!listed) return {
+			ok: false,
+			error: reason,
+			emptied: [],
+			emptyError: "the tables to empty could not be listed"
+		};
+		if (tables.length === 0) return {
+			ok: false,
+			error: reason,
+			emptied: [],
+			emptyError: null
+		};
+		try {
+			await client.query(`TRUNCATE TABLE ${tables.join(", ")} CASCADE`);
+			return {
+				ok: false,
+				error: reason,
+				emptied: tables,
+				emptyError: null
+			};
+		} catch (emptyError) {
+			return {
+				ok: false,
+				error: reason,
+				emptied: [],
+				emptyError: errorText(emptyError)
+			};
+		}
+	}
+}
+/**
+* Schemas the restored copy needs the app role provisioned on.
+*
+* `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives
+* with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no
+* privileges behind them. Measured on a 30-table project: 68 policies restored,
+* 14 tables with RLS on, and **0** grants to `rebase_user` — where the source
+* had 60. Reading one table as the role Rebase serves every request through:
+*
+*     source:  6
+*     copy:    ERROR: permission denied for table leads
+*
+* The dump flags are right and stay: without `--no-owner`/`--no-privileges`
+* every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails
+* against roles that do not exist on a laptop, and buries the real output. The
+* repair belongs after the restore, and belongs to `ensureAppRole` — the same
+* routine boot and `rebase db push` call — rather than to a second list of
+* grants written here.
+*
+* Which schemas: every non-system schema the restored database actually has.
+* Boot knows its `managedSchemas` from the collections; a restore knows only
+* what arrived, and a source may carry schemas this project does not declare.
+* `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to
+* grant on and PostgreSQL would refuse anyway.
+*/
+function provisionableSchemas(rows) {
+	const skip = (name) => name === "information_schema" || name.startsWith("pg_");
+	return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();
+}
+/** Host and database of a connection string, with no credentials in it. */
+function describeTarget(connectionString) {
+	try {
+		const url = new URL(connectionString);
+		const database = url.pathname.replace(/^\//, "") || "(default)";
+		return `${url.hostname}${url.port ? `:${url.port}` : ""}/${database}`;
+	} catch {
+		return "(unparseable connection string)";
+	}
+}
+/**
+* `pg_dump` arguments for the source.
+*
+* `--no-owner` and `--no-acl` because the roles on a production server do not
+* exist locally, and without them every `ALTER … OWNER TO` in the dump fails and
+* buries the real output in noise. `--format=custom` so `pg_restore` can be told
+* to continue past errors selectively rather than all-or-nothing.
+*/
+function dumpArgs(plan) {
+	const args = [
+		"--format=custom",
+		"--no-owner",
+		"--no-acl",
+		"--no-privileges"
+	];
+	for (const schema of plan.schemas) args.push("--schema", schema);
+	args.push("--dbname", splitPassword(plan.source).connectionString);
+	return args;
+}
+/** The environment `pg_dump` runs with: the source's password, if it has one. */
+function dumpEnv(plan) {
+	return passwordEnv(plan.source);
+}
+/** The environment `pg_restore` runs with: the target's password, if it has one. */
+function restoreEnv(plan) {
+	return passwordEnv(plan.target);
+}
+function passwordEnv(connectionString) {
+	const { password } = splitPassword(connectionString);
+	return password === null ? {} : { PGPASSWORD: password };
+}
+/**
+* A libpq connection string without its password, and the password.
+*
+* The password goes in `PGPASSWORD`, never on a command line, where every
+* process listing can read it and every failure prints it back (execa's error
+* repeats the command). The same rule `db backup` follows; this mirrors
+* `splitPassword` in `@rebasepro/server-postgres`'s connection-string utils,
+* which is not exported. Covers the user-info password and a `password=`
+* parameter; anything that does not parse as a postgres URL is left alone.
+*/
+function splitPassword(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return {
+			connectionString,
+			password: null
+		};
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return {
+		connectionString,
+		password: null
+	};
+	const fromUserInfo = url.password ? decodePercent(url.password) : null;
+	const fromParameter = url.searchParams.get("password");
+	if (fromUserInfo === null && fromParameter === null) return {
+		connectionString,
+		password: null
+	};
+	url.password = "";
+	if (fromParameter !== null) {
+		url.searchParams.delete("password");
+		url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	}
+	return {
+		connectionString: url.toString(),
+		password: fromUserInfo ?? fromParameter
+	};
+}
+function decodePercent(value) {
+	try {
+		return decodeURIComponent(value);
+	} catch {
+		return value;
+	}
+}
+/**
+* `pg_restore` arguments for the target.
+*
+* `--clean --if-exists` because a pull replaces what is there: restoring into a
+* database that already has the tables would otherwise fail on every one of
+* them. `--no-owner` for the same reason as the dump.
+*/
+function restoreArgs(plan, dumpFile) {
+	return [
+		"--clean",
+		"--if-exists",
+		"--no-owner",
+		"--no-privileges",
+		"--dbname",
+		splitPassword(plan.target).connectionString,
+		dumpFile
+	];
+}
+/**
+* Is this PostgreSQL client tool on PATH, and what version? Both are checked
+* before anything destructive: discovering `pg_restore` is missing after the
+* dump has been taken — or after `--clean` has emptied the target — is the
+* worst possible ordering.
+*/
+async function findPgTool(tool) {
+	try {
+		const { stdout } = await execa(tool, ["--version"]);
+		return stdout.trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* What a finished `pg_restore` says about the copy.
+*
+* `--clean` empties the target before anything is written, so every way this
+* can end short of exit 0 leaves a partial or empty local database, and none of
+* them may be reported as a copy. A non-zero exit is pg_restore saying it
+* skipped statements — "errors ignored on restore: N" — and whatever those
+* statements created (a table, its rows, an RLS policy) is missing locally.
+*
+* `started` says whether anything can have arrived, which is what decides
+* whether an anonymization pass still has data to redact.
+*/
+function restoreOutcome(run) {
+	if (run.signal) return {
+		started: true,
+		failure: `pg_restore was stopped by ${run.signal} before it finished.`
+	};
+	if (run.exitCode === void 0) return {
+		started: false,
+		failure: `pg_restore could not be started (${run.code ?? "unknown error"}).`
+	};
+	if (run.exitCode === 0) return {
+		started: true,
+		failure: null
+	};
+	const ignored = /errors ignored on restore: (\d+)/.exec(run.stderr ?? "");
+	return {
+		started: true,
+		failure: ignored ? `pg_restore could not restore ${ignored[1]} object(s) — the errors are above.` : `pg_restore exited with code ${run.exitCode}.`
+	};
+}
+//#endregion
+export { anonymizeCopy, describeTarget, dumpArgs, dumpEnv, findPgTool, provisionableSchemas, restoreArgs, restoreEnv, restoreOutcome };
+
+//# sourceMappingURL=pull-CrGYMEsy.js.map

package/dist/pull-CrGYMEsy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull-CrGYMEsy.js","names":[],"sources":["../src/dev-db/pull.ts"],"sourcesContent":["/**\n * `rebase db pull` — copy a database's contents into local development.\n *\n * The common case is production into local, and the reason it exists is that\n * the alternative is worse: without it people hand-roll a `pg_dump | psql` and\n * get the flags wrong in ways that either fail loudly at 2am or, more often,\n * quietly restore half a schema.\n *\n * Three things this command insists on, because copying a production database\n * onto a laptop is a data-protection event whether or not anyone calls it one:\n *\n * 1. **It says what it is about to do, in full, before doing it** — which\n *    database it will read, which one it will overwrite, and where the data will\n *    come to rest on disk. The target path matters: people forget that\n *    `.rebase/pgdata` is a directory their backup software may be indexing.\n *\n * 2. **It refuses to run unattended without being told to.** The target is\n *    destroyed, so a mistyped `--from` with no confirmation would take the\n *    developer's working database with it.\n *\n * 3. **It will not write to a remote database.** The target is always the local\n *    development database; there is no flag that makes this push. A tool that\n *    can copy in both directions eventually copies in the wrong one.\n *\n * Anonymization is opt-in (`--anonymize`), which is a deliberate choice and not\n * an obviously safe one — the flag nobody types is the flag nobody gets. It is\n * a best-effort pass over columns whose *names* look like personal data, and\n * {@link ANONYMIZE_PATTERNS} says exactly which. It cannot find personal data in\n * a column called `notes`, and this file says so rather than implying a\n * guarantee it cannot keep.\n *\n * What it does guarantee is that it never half-happens: {@link anonymizeCopy}\n * runs the pass in one transaction, and when the pass fails it empties the\n * tables it would have rewritten rather than leave their real values behind.\n */\n\nimport { execa } from \"execa\";\nimport type { Client } from \"pg\";\n\n/**\n * How one kind of personal-looking column is overwritten.\n *\n * Two forms, because a constant is the most readable replacement and is wrong\n * for exactly one kind of column: a unique one. Every `token_hash` becoming\n * `'REDACTED'` is what `UNIQUE(token_hash)` refused on the second row of\n * `rebase.refresh_tokens` — so on any project where someone had signed in twice.\n */\nexport interface AnonymizeRule {\n    pattern: RegExp;\n    /** The value for a column no unique index covers, or null to always use the unique form. */\n    value: string | null;\n    /** The unique form is `prefix` + random hex + `suffix`, cut to fit the column. */\n    prefix: string;\n    suffix: string;\n}\n\n/**\n * Column-name patterns the anonymizer overwrites.\n *\n * Names, not contents: inspecting values would be slower, and would still miss\n * the same things. This is a reasonable-effort measure for making a local copy\n * less dangerous, and it is not a compliance control.\n */\nexport const ANONYMIZE_PATTERNS: readonly AnonymizeRule[] = [\n    // Emails are unique in practice even where nothing enforces it, so they\n    // always get a value of their own.\n    { pattern: /^(.*_)?e?mail(_.*)?$/i, value: null, prefix: \"user-\", suffix: \"@example.invalid\" },\n    { pattern: /^(.*_)?(phone|mobile|tel|telephone)(_.*)?$/i, value: \"+10000000000\", prefix: \"+1-\", suffix: \"\" },\n    { pattern: /^(.*_)?(first_name|last_name|full_name|surname|given_name)(_.*)?$/i, value: \"Redacted\", prefix: \"Redacted-\", suffix: \"\" },\n    { pattern: /^(.*_)?(address|street|postcode|zip|zipcode)(_.*)?$/i, value: \"Redacted\", prefix: \"Redacted-\", suffix: \"\" },\n    { pattern: /^(.*_)?(ssn|tax_id|national_id|passport)(_.*)?$/i, value: \"REDACTED\", prefix: \"REDACTED-\", suffix: \"\" },\n    { pattern: /^(.*_)?(password|password_hash|secret|token|api_key|access_token|refresh_token)(_.*)?$/i, value: \"REDACTED\", prefix: \"REDACTED-\", suffix: \"\" },\n    { pattern: /^(.*_)?(ip|ip_address|user_agent)(_.*)?$/i, value: \"REDACTED\", prefix: \"REDACTED-\", suffix: \"\" }\n];\n\nexport function shouldAnonymize(columnName: string): boolean {\n    return ANONYMIZE_PATTERNS.some((rule) => rule.pattern.test(columnName));\n}\n\n/** A text-ish column the anonymizer can overwrite without a type error. */\nexport interface ColumnRef {\n    schema: string;\n    table: string;\n    column: string;\n    dataType: string;\n    /** `character_maximum_length`: null or absent for an unbounded type. */\n    maxLength?: number | null;\n    /** Covered by a unique index — a primary key, a UNIQUE constraint, or a unique expression index. */\n    unique?: boolean;\n}\n\n/** Random hex of this length, per row. `gen_random_uuid()` is core since PostgreSQL 13. */\nfunction randomHex(length: number): string {\n    return `left(replace(gen_random_uuid()::text, '-', ''), ${length})`;\n}\n\nfunction sqlLiteral(value: string): string {\n    return `'${value.replace(/'/g, \"''\")}'`;\n}\n\n/**\n * Fewest random hex digits a unique replacement keeps. Twelve is 16^12 values:\n * a collision needs millions of rows, where eight would need tens of thousands.\n */\nconst MIN_UNIQUE_HEX = 12;\n\n/**\n * The SQL expression that overwrites one column, or null when no rule names it.\n *\n * Unique per row when an index makes the column unique, and always cut to the\n * column's declared length — `zip char(5)` refused `'Redacted'` outright, and a\n * failed statement now empties the tables rather than skip one. To fit a short\n * unique column the prefix goes first, then the suffix, and the random part is\n * kept to at least {@link MIN_UNIQUE_HEX} digits while there is room for them.\n * A NULL stays NULL: an empty optional field is not personal data.\n */\nexport function replacementFor(column: ColumnRef): string | null {\n    const rule = ANONYMIZE_PATTERNS.find((candidate) => candidate.pattern.test(column.column));\n    if (!rule) return null;\n    const limit = typeof column.maxLength === \"number\" && column.maxLength > 0 ? column.maxLength : null;\n\n    let value: string;\n    if (rule.value !== null && !column.unique) {\n        value = sqlLiteral(limit === null ? rule.value : rule.value.slice(0, limit));\n    } else {\n        const shapes = [[rule.prefix, rule.suffix], [\"\", rule.suffix], [\"\", \"\"]];\n        const fitting = shapes.find(([prefix, suffix]) =>\n            limit === null || limit - prefix.length - suffix.length >= MIN_UNIQUE_HEX);\n        const [prefix, suffix] = fitting ?? [\"\", \"\"];\n        const hex = Math.min(32, limit === null ? 32 : limit - prefix.length - suffix.length);\n        value = `concat(${sqlLiteral(prefix)}, ${randomHex(Math.max(1, hex))}, ${sqlLiteral(suffix)})`;\n    }\n\n    const name = quoteIdentifier(column.column);\n    return `CASE WHEN ${name} IS NULL THEN NULL ELSE ${value} END`;\n}\n\n/** A double-quoted identifier, with any `\"` in it doubled — a table called `order` or `a\"b` still works. */\nexport function quoteIdentifier(name: string): string {\n    return `\"${name.replace(/\"/g, '\"\"')}\"`;\n}\n\n/**\n * Anonymizable columns: name looks personal, and the type can hold the\n * replacement.\n *\n * The type check is what stops this generating `UPDATE … SET user_id =\n * 'Redacted'` for an integer column called `user_id_email_seq` and failing the\n * whole pass on a technicality.\n */\nexport function anonymizableColumns(columns: readonly ColumnRef[]): ColumnRef[] {\n    const textual = new Set([\"text\", \"character varying\", \"varchar\", \"character\", \"char\", \"citext\"]);\n\n    return columns.filter((column) => shouldAnonymize(column.column) && textual.has(column.dataType.toLowerCase()));\n}\n\n/** `\"schema\".\"table\"` for each table the pass rewrites, sorted. */\nexport function anonymizedTables(columns: readonly ColumnRef[]): string[] {\n    return [...new Set(anonymizableColumns(columns).map((column) =>\n        `${quoteIdentifier(column.schema)}.${quoteIdentifier(column.table)}`))].sort();\n}\n\n/** `UPDATE` statements for one anonymization pass, in a stable order. */\nexport function anonymizeStatements(columns: readonly ColumnRef[]): string[] {\n    const byTable = new Map<string, ColumnRef[]>();\n    for (const column of anonymizableColumns(columns)) {\n        const key = `${quoteIdentifier(column.schema)}.${quoteIdentifier(column.table)}`;\n        byTable.set(key, [...(byTable.get(key) ?? []), column]);\n    }\n\n    return [...byTable.entries()]\n        .sort(([a], [b]) => a.localeCompare(b))\n        .map(([table, cols]) => {\n            const assignments = [...cols]\n                .sort((a, b) => a.column.localeCompare(b.column))\n                .map((column) => `${quoteIdentifier(column.column)} = ${replacementFor(column)}`)\n                .join(\", \");\n\n            return `UPDATE ${table} SET ${assignments};`;\n        });\n}\n\n/**\n * Every column the pass could overwrite, with what decides how.\n *\n * Base tables only — a view has an `email` column too, and is not something to\n * UPDATE. Generated columns are skipped for the same reason: `email_domain\n * GENERATED ALWAYS AS (…)` matches by name and refuses any value but DEFAULT,\n * and it follows the column it is generated from anyway. An extension type such\n * as `citext` reports `USER-DEFINED`, so its own name is what is compared.\n *\n * `unique` comes from the indexes, through `pg_depend` as well as `indkey`: a\n * unique index on `lower(email)` names no column in `indkey`, and is exactly\n * what a constant replacement would violate.\n */\nexport const ANONYMIZE_COLUMNS_SQL = `\nWITH unique_columns AS (\n    SELECT DISTINCT i.indrelid AS relid, a.attname AS column_name\n      FROM pg_index i\n      JOIN pg_attribute a ON a.attrelid = i.indrelid AND a.attnum > 0 AND NOT a.attisdropped\n     WHERE i.indisunique\n       AND (a.attnum = ANY (i.indkey)\n            OR EXISTS (SELECT 1 FROM pg_depend d\n                        WHERE d.classid = 'pg_class'::regclass AND d.objid = i.indexrelid\n                          AND d.refclassid = 'pg_class'::regclass AND d.refobjid = i.indrelid\n                          AND d.refobjsubid = a.attnum))\n)\nSELECT c.table_schema AS \"schema\",\n       c.table_name AS \"table\",\n       c.column_name AS \"column\",\n       CASE WHEN c.data_type = 'USER-DEFINED' THEN c.udt_name ELSE c.data_type END AS \"dataType\",\n       c.character_maximum_length AS \"maxLength\",\n       (u.column_name IS NOT NULL) AS \"unique\"\n  FROM information_schema.columns c\n  JOIN information_schema.tables t ON t.table_schema = c.table_schema AND t.table_name = c.table_name\n  LEFT JOIN unique_columns u\n         ON u.relid = format('%I.%I', c.table_schema, c.table_name)::regclass AND u.column_name = c.column_name\n WHERE t.table_type = 'BASE TABLE'\n   AND c.is_generated = 'NEVER'\n   AND c.table_schema NOT IN ('pg_catalog', 'information_schema')`;\n\n/** How {@link anonymizeCopy} ended. */\nexport type AnonymizeOutcome =\n    | { ok: true; tables: string[] }\n    | {\n        ok: false;\n        /** Why the pass failed. Nothing it wrote was kept. */\n        error: string;\n        /** The tables emptied instead, so none of their real values are left. */\n        emptied: string[];\n        /** Why they could not be emptied, when they could not: the copy then holds real data. */\n        emptyError: string | null;\n    };\n\nfunction errorText(error: unknown): string {\n    return error instanceof Error && error.message ? error.message : String(error);\n}\n\n/**\n * Overwrite the personal-looking columns of a restored copy, all or nothing.\n *\n * One transaction, so a failure part-way leaves no table half done — the old\n * pass ran its UPDATEs one by one, so a failure on `rebase.refresh_tokens` left\n * `public.authors` anonymized and `rebase.users` holding every real email.\n *\n * A rollback alone would be worse than that, though: it puts back the real\n * value of every column, in a copy the developer asked to be anonymized. So on\n * failure the tables the pass would have rewritten are emptied (`TRUNCATE …\n * CASCADE`, which takes the rows that reference them too), and the outcome\n * says which — or, if even that failed, says the copy holds real data, so the\n * caller can say it louder.\n *\n * `row_security = off` makes a role that RLS would filter fail the pass instead\n * of rewriting only the rows its policies show it, which looked like success.\n */\nexport async function anonymizeCopy(client: Client): Promise<AnonymizeOutcome> {\n    let listed = false;\n    let tables: string[] = [];\n    try {\n        const { rows } = await client.query<ColumnRef>(ANONYMIZE_COLUMNS_SQL);\n        tables = anonymizedTables(rows);\n        listed = true;\n        await client.query(\"BEGIN\");\n        await client.query(\"SET LOCAL row_security = off\");\n        for (const statement of anonymizeStatements(rows)) await client.query(statement);\n        await client.query(\"COMMIT\");\n\n        return { ok: true, tables };\n    } catch (error) {\n        const reason = errorText(error);\n        await client.query(\"ROLLBACK\").catch(() => undefined);\n        if (!listed) {\n            return { ok: false, error: reason, emptied: [], emptyError: \"the tables to empty could not be listed\" };\n        }\n        if (tables.length === 0) return { ok: false, error: reason, emptied: [], emptyError: null };\n        try {\n            await client.query(`TRUNCATE TABLE ${tables.join(\", \")} CASCADE`);\n\n            return { ok: false, error: reason, emptied: tables, emptyError: null };\n        } catch (emptyError) {\n            return { ok: false, error: reason, emptied: [], emptyError: errorText(emptyError) };\n        }\n    }\n}\n\n/**\n * Schemas the restored copy needs the app role provisioned on.\n *\n * `pg_dump --no-privileges` strips every GRANT, so a pulled database arrives\n * with its RLS policies and its `FORCE ROW LEVEL SECURITY` intact and no\n * privileges behind them. Measured on a 30-table project: 68 policies restored,\n * 14 tables with RLS on, and **0** grants to `rebase_user` — where the source\n * had 60. Reading one table as the role Rebase serves every request through:\n *\n *     source:  6\n *     copy:    ERROR: permission denied for table leads\n *\n * The dump flags are right and stay: without `--no-owner`/`--no-privileges`\n * every `ALTER … OWNER TO` and `GRANT … TO <prod role>` in the dump fails\n * against roles that do not exist on a laptop, and buries the real output. The\n * repair belongs after the restore, and belongs to `ensureAppRole` — the same\n * routine boot and `rebase db push` call — rather than to a second list of\n * grants written here.\n *\n * Which schemas: every non-system schema the restored database actually has.\n * Boot knows its `managedSchemas` from the collections; a restore knows only\n * what arrived, and a source may carry schemas this project does not declare.\n * `pg_catalog`, `information_schema` and the `pg_*` internals are never ours to\n * grant on and PostgreSQL would refuse anyway.\n */\nexport function provisionableSchemas(rows: readonly { schema: string }[]): string[] {\n    const skip = (name: string) => name === \"information_schema\" || name.startsWith(\"pg_\");\n\n    return [...new Set(rows.map((row) => row.schema))].filter((name) => !skip(name)).sort();\n}\n\n/** Host and database of a connection string, with no credentials in it. */\nexport function describeTarget(connectionString: string): string {\n    try {\n        const url = new URL(connectionString);\n        const database = url.pathname.replace(/^\\//, \"\") || \"(default)\";\n\n        return `${url.hostname}${url.port ? `:${url.port}` : \"\"}/${database}`;\n    } catch {\n        // Never echo the raw string: it carries a password, and this line is\n        // printed to a terminal people paste into issues.\n        return \"(unparseable connection string)\";\n    }\n}\n\nexport interface PullPlan {\n    /** Where the data comes from. */\n    source: string;\n    /** Where it lands. Always local. */\n    target: string;\n    anonymize: boolean;\n    /** Schemas to copy. Empty means every non-system schema. */\n    schemas: string[];\n}\n\n/**\n * `pg_dump` arguments for the source.\n *\n * `--no-owner` and `--no-acl` because the roles on a production server do not\n * exist locally, and without them every `ALTER … OWNER TO` in the dump fails and\n * buries the real output in noise. `--format=custom` so `pg_restore` can be told\n * to continue past errors selectively rather than all-or-nothing.\n */\nexport function dumpArgs(plan: PullPlan): string[] {\n    const args = [\"--format=custom\", \"--no-owner\", \"--no-acl\", \"--no-privileges\"];\n    for (const schema of plan.schemas) args.push(\"--schema\", schema);\n    args.push(\"--dbname\", splitPassword(plan.source).connectionString);\n\n    return args;\n}\n\n/** The environment `pg_dump` runs with: the source's password, if it has one. */\nexport function dumpEnv(plan: PullPlan): Record<string, string> {\n    return passwordEnv(plan.source);\n}\n\n/** The environment `pg_restore` runs with: the target's password, if it has one. */\nexport function restoreEnv(plan: PullPlan): Record<string, string> {\n    return passwordEnv(plan.target);\n}\n\nfunction passwordEnv(connectionString: string): Record<string, string> {\n    const { password } = splitPassword(connectionString);\n    return password === null ? {} : { PGPASSWORD: password };\n}\n\n/**\n * A libpq connection string without its password, and the password.\n *\n * The password goes in `PGPASSWORD`, never on a command line, where every\n * process listing can read it and every failure prints it back (execa's error\n * repeats the command). The same rule `db backup` follows; this mirrors\n * `splitPassword` in `@rebasepro/server-postgres`'s connection-string utils,\n * which is not exported. Covers the user-info password and a `password=`\n * parameter; anything that does not parse as a postgres URL is left alone.\n */\nfunction splitPassword(connectionString: string): { connectionString: string; password: string | null } {\n    let url: URL;\n    try {\n        url = new URL(connectionString);\n    } catch {\n        return { connectionString, password: null };\n    }\n    if (url.protocol !== \"postgres:\" && url.protocol !== \"postgresql:\") return { connectionString, password: null };\n\n    const fromUserInfo = url.password ? decodePercent(url.password) : null;\n    const fromParameter = url.searchParams.get(\"password\");\n    if (fromUserInfo === null && fromParameter === null) return { connectionString, password: null };\n\n    url.password = \"\";\n    if (fromParameter !== null) {\n        url.searchParams.delete(\"password\");\n        // By hand: URLSearchParams writes a space as `+`, which libpq reads literally.\n        url.search = Array.from(url.searchParams.entries())\n            .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)\n            .join(\"&\");\n    }\n    return { connectionString: url.toString(), password: fromUserInfo ?? fromParameter };\n}\n\nfunction decodePercent(value: string): string {\n    try {\n        return decodeURIComponent(value);\n    } catch {\n        return value;\n    }\n}\n\n/**\n * `pg_restore` arguments for the target.\n *\n * `--clean --if-exists` because a pull replaces what is there: restoring into a\n * database that already has the tables would otherwise fail on every one of\n * them. `--no-owner` for the same reason as the dump.\n */\nexport function restoreArgs(plan: PullPlan, dumpFile: string): string[] {\n    return [\"--clean\", \"--if-exists\", \"--no-owner\", \"--no-privileges\", \"--dbname\", splitPassword(plan.target).connectionString, dumpFile];\n}\n\n/**\n * Is this PostgreSQL client tool on PATH, and what version? Both are checked\n * before anything destructive: discovering `pg_restore` is missing after the\n * dump has been taken — or after `--clean` has emptied the target — is the\n * worst possible ordering.\n */\nexport async function findPgTool(tool: \"pg_dump\" | \"pg_restore\"): Promise<string | null> {\n    try {\n        const { stdout } = await execa(tool, [\"--version\"]);\n\n        return stdout.trim();\n    } catch {\n        return null;\n    }\n}\n\n/** The fields of a finished `pg_restore` run that decide {@link restoreOutcome}. */\nexport interface RestoreRun {\n    exitCode?: number;\n    signal?: string;\n    /** A spawn failure's code — `ENOENT` when the binary vanished. */\n    code?: string;\n    stderr?: string;\n}\n\n/**\n * What a finished `pg_restore` says about the copy.\n *\n * `--clean` empties the target before anything is written, so every way this\n * can end short of exit 0 leaves a partial or empty local database, and none of\n * them may be reported as a copy. A non-zero exit is pg_restore saying it\n * skipped statements — \"errors ignored on restore: N\" — and whatever those\n * statements created (a table, its rows, an RLS policy) is missing locally.\n *\n * `started` says whether anything can have arrived, which is what decides\n * whether an anonymization pass still has data to redact.\n */\nexport function restoreOutcome(run: RestoreRun): { started: boolean; failure: string | null } {\n    if (run.signal) {\n        return { started: true, failure: `pg_restore was stopped by ${run.signal} before it finished.` };\n    }\n    if (run.exitCode === undefined) {\n        return { started: false, failure: `pg_restore could not be started (${run.code ?? \"unknown error\"}).` };\n    }\n    if (run.exitCode === 0) return { started: true, failure: null };\n\n    const ignored = /errors ignored on restore: (\\d+)/.exec(run.stderr ?? \"\");\n\n    return {\n        started: true,\n        failure: ignored\n            ? `pg_restore could not restore ${ignored[1]} object(s) — the errors are above.`\n            : `pg_restore exited with code ${run.exitCode}.`\n    };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,IAAa,qBAA+C;CAGxD;EAAE,SAAS;EAAyB,OAAO;EAAM,QAAQ;EAAS,QAAQ;CAAmB;CAC7F;EAAE,SAAS;EAA+C,OAAO;EAAgB,QAAQ;EAAO,QAAQ;CAAG;CAC3G;EAAE,SAAS;EAAsE,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CACpI;EAAE,SAAS;EAAwD,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CACtH;EAAE,SAAS;EAAoD,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CAClH;EAAE,SAAS;EAA2F,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;CACzJ;EAAE,SAAS;EAA6C,OAAO;EAAY,QAAQ;EAAa,QAAQ;CAAG;AAC/G;AAEA,SAAgB,gBAAgB,YAA6B;CACzD,OAAO,mBAAmB,MAAM,SAAS,KAAK,QAAQ,KAAK,UAAU,CAAC;AAC1E;;AAeA,SAAS,UAAU,QAAwB;CACvC,OAAO,mDAAmD,OAAO;AACrE;AAEA,SAAS,WAAW,OAAuB;CACvC,OAAO,IAAI,MAAM,QAAQ,MAAM,IAAI,EAAE;AACzC;;;;;AAMA,IAAM,iBAAiB;;;;;;;;;;;AAYvB,SAAgB,eAAe,QAAkC;CAC7D,MAAM,OAAO,mBAAmB,MAAM,cAAc,UAAU,QAAQ,KAAK,OAAO,MAAM,CAAC;CACzF,IAAI,CAAC,MAAM,OAAO;CAClB,MAAM,QAAQ,OAAO,OAAO,cAAc,YAAY,OAAO,YAAY,IAAI,OAAO,YAAY;CAEhG,IAAI;CACJ,IAAI,KAAK,UAAU,QAAQ,CAAC,OAAO,QAC/B,QAAQ,WAAW,UAAU,OAAO,KAAK,QAAQ,KAAK,MAAM,MAAM,GAAG,KAAK,CAAC;MACxE;EAIH,MAAM,CAAC,QAAQ,UAFC;GADA,CAAC,KAAK,QAAQ,KAAK,MAAM;GAAG,CAAC,IAAI,KAAK,MAAM;GAAG,CAAC,IAAI,EAAE;EACtD,CAAA,CAAO,MAAM,CAAC,QAAQ,YAClC,UAAU,QAAQ,QAAQ,OAAO,SAAS,OAAO,UAAU,cACtC,KAAW,CAAC,IAAI,EAAE;EAC3C,MAAM,MAAM,KAAK,IAAI,IAAI,UAAU,OAAO,KAAK,QAAQ,OAAO,SAAS,OAAO,MAAM;EACpF,QAAQ,UAAU,WAAW,MAAM,EAAE,IAAI,UAAU,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,IAAI,WAAW,MAAM,EAAE;CAChG;CAGA,OAAO,aADM,gBAAgB,OAAO,MAChB,EAAK,0BAA0B,MAAM;AAC7D;;AAGA,SAAgB,gBAAgB,MAAsB;CAClD,OAAO,IAAI,KAAK,QAAQ,MAAM,MAAI,EAAE;AACxC;;;;;;;;;AAUA,SAAgB,oBAAoB,SAA4C;CAC5E,MAAM,0BAAU,IAAI,IAAI;EAAC;EAAQ;EAAqB;EAAW;EAAa;EAAQ;CAAQ,CAAC;CAE/F,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,SAAS,YAAY,CAAC,CAAC;AAClH;;AAGA,SAAgB,iBAAiB,SAAyC;CACtE,OAAO,CAAC,GAAG,IAAI,IAAI,oBAAoB,OAAO,CAAC,CAAC,KAAK,WACjD,GAAG,gBAAgB,OAAO,MAAM,EAAE,GAAG,gBAAgB,OAAO,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK;AACrF;;AAGA,SAAgB,oBAAoB,SAAyC;CACzE,MAAM,0BAAU,IAAI,IAAyB;CAC7C,KAAK,MAAM,UAAU,oBAAoB,OAAO,GAAG;EAC/C,MAAM,MAAM,GAAG,gBAAgB,OAAO,MAAM,EAAE,GAAG,gBAAgB,OAAO,KAAK;EAC7E,QAAQ,IAAI,KAAK,CAAC,GAAI,QAAQ,IAAI,GAAG,KAAK,CAAC,GAAI,MAAM,CAAC;CAC1D;CAEA,OAAO,CAAC,GAAG,QAAQ,QAAQ,CAAC,CAAC,CACxB,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC,CACtC,KAAK,CAAC,OAAO,UAAU;EAMpB,OAAO,UAAU,MAAM,OALH,CAAC,GAAG,IAAI,CAAC,CACxB,MAAM,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC,CAAC,CAChD,KAAK,WAAW,GAAG,gBAAgB,OAAO,MAAM,EAAE,KAAK,eAAe,MAAM,GAAG,CAAC,CAChF,KAAK,IAEoB,EAAY;CAC9C,CAAC;AACT;;;;;;;;;;;;;;AAeA,IAAa,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;AAuCrC,SAAS,UAAU,OAAwB;CACvC,OAAO,iBAAiB,SAAS,MAAM,UAAU,MAAM,UAAU,OAAO,KAAK;AACjF;;;;;;;;;;;;;;;;;;AAmBA,eAAsB,cAAc,QAA2C;CAC3E,IAAI,SAAS;CACb,IAAI,SAAmB,CAAC;CACxB,IAAI;EACA,MAAM,EAAE,SAAS,MAAM,OAAO,MAAiB,qBAAqB;EACpE,SAAS,iBAAiB,IAAI;EAC9B,SAAS;EACT,MAAM,OAAO,MAAM,OAAO;EAC1B,MAAM,OAAO,MAAM,8BAA8B;EACjD,KAAK,MAAM,aAAa,oBAAoB,IAAI,GAAG,MAAM,OAAO,MAAM,SAAS;EAC/E,MAAM,OAAO,MAAM,QAAQ;EAE3B,OAAO;GAAE,IAAI;GAAM;EAAO;CAC9B,SAAS,OAAO;EACZ,MAAM,SAAS,UAAU,KAAK;EAC9B,MAAM,OAAO,MAAM,UAAU,CAAC,CAAC,YAAY,KAAA,CAAS;EACpD,IAAI,CAAC,QACD,OAAO;GAAE,IAAI;GAAO,OAAO;GAAQ,SAAS,CAAC;GAAG,YAAY;EAA0C;EAE1G,IAAI,OAAO,WAAW,GAAG,OAAO;GAAE,IAAI;GAAO,OAAO;GAAQ,SAAS,CAAC;GAAG,YAAY;EAAK;EAC1F,IAAI;GACA,MAAM,OAAO,MAAM,kBAAkB,OAAO,KAAK,IAAI,EAAE,SAAS;GAEhE,OAAO;IAAE,IAAI;IAAO,OAAO;IAAQ,SAAS;IAAQ,YAAY;GAAK;EACzE,SAAS,YAAY;GACjB,OAAO;IAAE,IAAI;IAAO,OAAO;IAAQ,SAAS,CAAC;IAAG,YAAY,UAAU,UAAU;GAAE;EACtF;CACJ;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;AA2BA,SAAgB,qBAAqB,MAA+C;CAChF,MAAM,QAAQ,SAAiB,SAAS,wBAAwB,KAAK,WAAW,KAAK;CAErF,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,SAAS,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK;AAC1F;;AAGA,SAAgB,eAAe,kBAAkC;CAC7D,IAAI;EACA,MAAM,MAAM,IAAI,IAAI,gBAAgB;EACpC,MAAM,WAAW,IAAI,SAAS,QAAQ,OAAO,EAAE,KAAK;EAEpD,OAAO,GAAG,IAAI,WAAW,IAAI,OAAO,IAAI,IAAI,SAAS,GAAG,GAAG;CAC/D,QAAQ;EAGJ,OAAO;CACX;AACJ;;;;;;;;;AAoBA,SAAgB,SAAS,MAA0B;CAC/C,MAAM,OAAO;EAAC;EAAmB;EAAc;EAAY;CAAiB;CAC5E,KAAK,MAAM,UAAU,KAAK,SAAS,KAAK,KAAK,YAAY,MAAM;CAC/D,KAAK,KAAK,YAAY,cAAc,KAAK,MAAM,CAAC,CAAC,gBAAgB;CAEjE,OAAO;AACX;;AAGA,SAAgB,QAAQ,MAAwC;CAC5D,OAAO,YAAY,KAAK,MAAM;AAClC;;AAGA,SAAgB,WAAW,MAAwC;CAC/D,OAAO,YAAY,KAAK,MAAM;AAClC;AAEA,SAAS,YAAY,kBAAkD;CACnE,MAAM,EAAE,aAAa,cAAc,gBAAgB;CACnD,OAAO,aAAa,OAAO,CAAC,IAAI,EAAE,YAAY,SAAS;AAC3D;;;;;;;;;;;AAYA,SAAS,cAAc,kBAAiF;CACpG,IAAI;CACJ,IAAI;EACA,MAAM,IAAI,IAAI,gBAAgB;CAClC,QAAQ;EACJ,OAAO;GAAE;GAAkB,UAAU;EAAK;CAC9C;CACA,IAAI,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,OAAO;EAAE;EAAkB,UAAU;CAAK;CAE9G,MAAM,eAAe,IAAI,WAAW,cAAc,IAAI,QAAQ,IAAI;CAClE,MAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU;CACrD,IAAI,iBAAiB,QAAQ,kBAAkB,MAAM,OAAO;EAAE;EAAkB,UAAU;CAAK;CAE/F,IAAI,WAAW;CACf,IAAI,kBAAkB,MAAM;EACxB,IAAI,aAAa,OAAO,UAAU;EAElC,IAAI,SAAS,MAAM,KAAK,IAAI,aAAa,QAAQ,CAAC,CAAC,CAC9C,KAAK,CAAC,KAAK,WAAW,GAAG,mBAAmB,GAAG,EAAE,GAAG,mBAAmB,KAAK,GAAG,CAAC,CAChF,KAAK,GAAG;CACjB;CACA,OAAO;EAAE,kBAAkB,IAAI,SAAS;EAAG,UAAU,gBAAgB;CAAc;AACvF;AAEA,SAAS,cAAc,OAAuB;CAC1C,IAAI;EACA,OAAO,mBAAmB,KAAK;CACnC,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;AASA,SAAgB,YAAY,MAAgB,UAA4B;CACpE,OAAO;EAAC;EAAW;EAAe;EAAc;EAAmB;EAAY,cAAc,KAAK,MAAM,CAAC,CAAC;EAAkB;CAAQ;AACxI;;;;;;;AAQA,eAAsB,WAAW,MAAwD;CACrF,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,MAAM,CAAC,WAAW,CAAC;EAElD,OAAO,OAAO,KAAK;CACvB,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;;;AAuBA,SAAgB,eAAe,KAA+D;CAC1F,IAAI,IAAI,QACJ,OAAO;EAAE,SAAS;EAAM,SAAS,6BAA6B,IAAI,OAAO;CAAsB;CAEnG,IAAI,IAAI,aAAa,KAAA,GACjB,OAAO;EAAE,SAAS;EAAO,SAAS,oCAAoC,IAAI,QAAQ,gBAAgB;CAAI;CAE1G,IAAI,IAAI,aAAa,GAAG,OAAO;EAAE,SAAS;EAAM,SAAS;CAAK;CAE9D,MAAM,UAAU,mCAAmC,KAAK,IAAI,UAAU,EAAE;CAExE,OAAO;EACH,SAAS;EACT,SAAS,UACH,gCAAgC,QAAQ,GAAG,sCAC3C,+BAA+B,IAAI,SAAS;CACtD;AACJ"}

package/dist/resolve-B2O-wKKk.js

@@ -0,0 +1,2 @@
+import { r as resolveDevDatabase } from "./prepare-CDN6lSpz.js";
+export { resolveDevDatabase };