@rebasepro/server-postgres 0.10.1-canary.18115ba → 0.10.1-canary.6f89f77

package/dist/backup/backup-logic.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Replay a `pg_dumpall --globals-only` script one statement at a time,
+ * tolerating per-statement failures. On a same-cluster restore the roles
+ * usually already exist (`CREATE ROLE` → "already exists") and on a managed
+ * provider an `ALTER ROLE <superuser>` may be refused; neither should abort
+ * recreation of the roles that *are* missing. Returns how many statements
+ * applied vs were skipped.
+ *
+ * `runStatement` executes one SQL statement and rejects on error.
+ */
+export declare function applyGlobalsWith(runStatement: (sql: string) => Promise<void>, globalsSql: string, log?: (message: string) => void): Promise<{
+    applied: number;
+    skipped: number;
+}>;
+/**
+ * Delete each pruned dump together with its `.globals.sql` roles sidecar, so
+ * pruning never orphans the roles file. The sidecar is best-effort — older
+ * backups predate it, so a missing-sidecar failure is swallowed while a
+ * failure deleting the dump itself propagates.
+ *
+ * `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+ */
+export declare function pruneWith(keys: string[], deleteObject: (key: string) => Promise<void>): Promise<void>;

package/dist/backup/backup-service.d.ts

@@ -5,8 +5,8 @@ export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
     constructor(message: string, hint?: string | undefined);
 }
-/** Locate `pg_dump` / `pg_restore`, honouring an env override. */
-export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore", env?: Record<string, string | undefined>): string | null;
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore" | "pg_dumpall", env?: Record<string, string | undefined>): string | null;
 /** Run `<bin> --version` and extract the major version. */
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */
@@ -27,11 +27,22 @@ export interface BackupResult {
     localFile: string;
     fileName: string;
     sizeBytes: number;
+    /**
+     * Absolute path of the `.globals.sql` sidecar holding cluster-wide roles
+     * (present unless globals capture was disabled or unavailable).
+     */
+    globalsFile?: string;
+    globalsSizeBytes?: number;
 }
 /**
  * Produce a custom-format dump on local disk. When `outDir` is omitted the
  * file is written to the OS temp directory (used by the upload path, which
  * cleans it up afterwards).
+ *
+ * Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+ * `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+ * depend on can be recreated on restore. Set `includeGlobals: false` to skip
+ * it (e.g. when the caller has no privilege to read cluster globals).
  */
 export declare function createDump(opts: {
     connectionString: string;
@@ -41,19 +52,50 @@ export declare function createDump(opts: {
     excludeSchemas?: string[];
     noOwner?: boolean;
     inheritStdio?: boolean;
+    includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<BackupResult>;
+/**
+ * Cheap integrity check on a freshly written dump: it must be non-empty and
+ * `pg_restore --list` must parse its table of contents without error. Used
+ * before pruning older backups so a corrupt-but-exit-0 dump never becomes
+ * the reason the last good backup is deleted.
+ */
+export declare function validateDump(localFile: string, env?: Record<string, string | undefined>): Promise<{
+    ok: boolean;
+    reason?: string;
+}>;
+/**
+ * Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+ * before a restore, so the dump's GRANT/RLS statements (which reference
+ * `rebase_user` and any owner roles) actually apply. Runs statement by
+ * statement and tolerates per-statement failures — on a same-cluster restore
+ * the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+ * a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+ * should abort role recreation. Returns how many statements applied vs were
+ * skipped.
+ */
+export declare function applyGlobals(connectionString: string, globalsSql: string, log?: (message: string) => void): Promise<{
+    applied: number;
+    skipped: number;
+}>;
 /**
  * Restore a custom-format dump into the database named by
  * `connectionString`. Destructive when `clean` is set (drops objects
  * first). Never called automatically — the CLI gates it behind explicit
  * confirmation.
+ *
+ * Runs with `--exit-on-error` by default: a restore that logs-and-continues
+ * past a failed GRANT (because a role was missing) reports success with RLS
+ * un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+ * and only set `exitOnError: false` deliberately.
  */
 export declare function restoreDump(opts: {
     connectionString: string;
     inputFile: string;
     clean?: boolean;
     noOwner?: boolean;
+    exitOnError?: boolean;
     inheritStdio?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<void>;

package/dist/backup/pg-tools.d.ts

@@ -99,10 +99,50 @@ export declare function buildPgRestoreArgs(opts: {
     inputFile: string;
     /** Drop objects before recreating them (destructive but idempotent). */
     clean?: boolean;
-    /** Continue past individual errors instead of aborting. */
+    /**
+     * Abort on the first error instead of logging and continuing. Defaults
+     * ON: a restore that silently skips failed GRANT/RLS statements (because
+     * a role is missing) "succeeds" with RLS un-enforced — a security hole.
+     * Fail loudly instead so the operator knows the restore is incomplete.
+     */
     exitOnError?: boolean;
     noOwner?: boolean;
 }): string[];
+/**
+ * Assemble the `pg_restore --list` argument vector. Reading a dump's table
+ * of contents parses the whole archive without touching a database, so it is
+ * a cheap integrity check that the file isn't truncated or corrupt.
+ */
+export declare function buildPgRestoreListArgs(inputFile: string): string[];
+/**
+ * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+ * cluster-wide objects) live outside any single database, so a per-database
+ * `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+ * statements in the main dump fail on restore and RLS is silently lost — so
+ * every backup captures the globals into a sidecar `.globals.sql`.
+ *
+ * `--no-role-passwords` keeps role secrets out of the artifact (backups may
+ * be shipped off-box); roles are recreated password-less and re-secured by
+ * the operator.
+ */
+export declare function buildPgDumpallGlobalsArgs(opts: {
+    connectionString: string;
+    outFile: string;
+}): string[];
+/**
+ * Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+ * two artifacts adjacent so listing, uploading and pruning can find one from
+ * the other. A name that doesn't end in `.dump` is returned unchanged with a
+ * `.globals.sql` suffix appended.
+ */
+export declare function globalsFileForDump(dumpPath: string): string;
+/**
+ * Split a `pg_dumpall --globals-only` script into individual statements.
+ * Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+ * can run independently and a benign "role already exists" on one doesn't
+ * abort the rest. Drops `--` comment lines and blank statements.
+ */
+export declare function splitGlobalsStatements(sql: string): string[];
 /**
  * Resolve the Postgres connection string the backup commands should use,
  * mirroring the precedence the branch command already relies on.

package/dist/cli-helpers.d.ts

@@ -4,4 +4,36 @@ export declare function getTableIncludesFromCollections(collections: CollectionC
 export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
 export declare function getDevDatabaseUrl(databaseUrl: string): string;
 export declare function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
-export declare function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]>;
+/**
+ * Query the live database for every user table/view outside the system
+ * catalogs. Separated from {@link getTableExcludes} so its failure mode can
+ * be handled explicitly (fail closed) and so tests can inject a stub.
+ */
+export declare function queryExistingTables(databaseUrl: string): Promise<string[]>;
+/**
+ * Raised when the exclude list could not be built. `db push` MUST abort on
+ * this rather than continue: the exclude list is the only thing shielding
+ * non-collection (user/system) tables from the auto-approved declarative
+ * apply. A partial list — the old fail-open behaviour — meant a transient
+ * introspection hiccup dropped every table not present in `schema.sql`.
+ */
+export declare class ExcludeIntrospectionError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Build the `--exclude` list that protects tables Rebase doesn't manage from
+ * the declarative apply. Anything not backing a collection (or its M2M
+ * junctions) is excluded so Atlas never drops it.
+ *
+ * Fails **closed**: if the database can't be introspected we cannot know
+ * which tables to protect, so we throw {@link ExcludeIntrospectionError}
+ * instead of returning a near-empty list and letting the caller drop
+ * everything.
+ *
+ * `deps` is injectable for tests; production uses the real pg-backed queries.
+ */
+export declare function getTableExcludes(databaseUrl: string, collectionsPath: string, deps?: {
+    queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+    getIncludes?: (collectionsPath: string) => Promise<string[]>;
+}): Promise<string[]>;

package/dist/index.es.js

@@ -518,6 +518,25 @@ function getDataSourceCapabilities(engine) {
 	if (!engine) return POSTGRES_CAPABILITIES;
 	return CAPABILITIES_REGISTRY[engine] ?? DEFAULT_CAPABILITIES;
 }
+/**
+* Resolve a client-supplied list `limit` into a safe, always-defined value.
+*
+* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
+*   so `0`, negatives, and absurd values can never bypass the cap.
+* - An absent / blank / non-numeric limit falls back to the mode default:
+*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
+*
+* The return is never `undefined` — no ingress that routes its client limit
+* through this can produce an unbounded read.
+*/
+function resolveClientListLimit(rawLimit, opts = {}) {
+	const maxLimit = opts.maxLimit ?? 1e3;
+	if (rawLimit != null && String(rawLimit).trim() !== "") {
+		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
+		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
+	}
+	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
+}
 var snakeCaseRegex = /[A-Z]{2,}(?=[A-Z][a-z]|\b)|[A-Z]?[a-z]+|[0-9]+(?:[a-z](?![a-z]))?|[A-Z]/g;
 var toSnakeCase = (str) => {
 	if (!str || typeof str !== "string") return "";
@@ -10857,6 +10876,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				this.sendError(clientId, msg, subscriptionId);
 				return;
 			}
+			const boundedLimit = resolveClientListLimit(request.limit, { vectorSearch: !!request.vectorSearch });
 			this._subscriptions.set(subscriptionId, {
 				clientId,
 				type: "collection",
@@ -10865,7 +10885,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 					filter: request.filter,
 					orderBy: request.orderBy,
 					order: request.order,
-					limit: request.limit,
+					limit: boundedLimit,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
 					searchString: request.searchString
@@ -10876,7 +10896,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				filter: request.filter,
 				orderBy: request.orderBy,
 				order: request.order,
-				limit: request.limit,
+				limit: boundedLimit,
 				startAfter: request.startAfter,
 				searchString: request.searchString
 			}, authContext);
@@ -12501,11 +12521,57 @@ function buildPgRestoreArgs(opts) {
 	];
 	if (opts.clean) args.push("--clean", "--if-exists");
 	if (opts.noOwner) args.push("--no-owner");
-	if (opts.exitOnError) args.push("--exit-on-error");
+	if (opts.exitOnError !== false) args.push("--exit-on-error");
 	args.push(opts.inputFile);
 	return args;
 }
 /**
+* Assemble the `pg_restore --list` argument vector. Reading a dump's table
+* of contents parses the whole archive without touching a database, so it is
+* a cheap integrity check that the file isn't truncated or corrupt.
+*/
+function buildPgRestoreListArgs(inputFile) {
+	return ["--list", inputFile];
+}
+/**
+* Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+* cluster-wide objects) live outside any single database, so a per-database
+* `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+* statements in the main dump fail on restore and RLS is silently lost — so
+* every backup captures the globals into a sidecar `.globals.sql`.
+*
+* `--no-role-passwords` keeps role secrets out of the artifact (backups may
+* be shipped off-box); roles are recreated password-less and re-secured by
+* the operator.
+*/
+function buildPgDumpallGlobalsArgs(opts) {
+	return [
+		"--globals-only",
+		"--no-role-passwords",
+		"--no-password",
+		`--file=${opts.outFile}`,
+		`--dbname=${opts.connectionString}`
+	];
+}
+/**
+* Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+* two artifacts adjacent so listing, uploading and pruning can find one from
+* the other. A name that doesn't end in `.dump` is returned unchanged with a
+* `.globals.sql` suffix appended.
+*/
+function globalsFileForDump(dumpPath) {
+	return dumpPath.endsWith(".dump") ? dumpPath.slice(0, -5) + ".globals.sql" : dumpPath + ".globals.sql";
+}
+/**
+* Split a `pg_dumpall --globals-only` script into individual statements.
+* Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+* can run independently and a benign "role already exists" on one doesn't
+* abort the rest. Drops `--` comment lines and blank statements.
+*/
+function splitGlobalsStatements(sql) {
+	return sql.split("\n").filter((line) => !line.trim().startsWith("--")).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/**
 * Resolve the Postgres connection string the backup commands should use,
 * mirroring the precedence the branch command already relies on.
 */
@@ -20794,6 +20860,58 @@ function resolveLocalBin(binName) {
 	return null;
 }
 //#endregion
+//#region src/backup/backup-logic.ts
+/**
+* Pure-ish orchestration for the backup/restore paths, kept free of `execa`
+* and `pg` value imports so it can be unit-tested under jest (the impure
+* edges — spawning processes, opening connections — live in
+* `backup-service.ts`, which is vitest/runtime only).
+*
+* The functions here take their side-effecting dependency as an argument
+* (a statement runner, an object deleter) so tests can inject fakes.
+*/
+/**
+* Replay a `pg_dumpall --globals-only` script one statement at a time,
+* tolerating per-statement failures. On a same-cluster restore the roles
+* usually already exist (`CREATE ROLE` → "already exists") and on a managed
+* provider an `ALTER ROLE <superuser>` may be refused; neither should abort
+* recreation of the roles that *are* missing. Returns how many statements
+* applied vs were skipped.
+*
+* `runStatement` executes one SQL statement and rejects on error.
+*/
+async function applyGlobalsWith(runStatement, globalsSql, log = () => {}) {
+	let applied = 0;
+	let skipped = 0;
+	for (const statement of splitGlobalsStatements(globalsSql)) try {
+		await runStatement(statement);
+		applied++;
+	} catch (err) {
+		skipped++;
+		log(`  • Skipped global: ${statement.split("\n")[0].slice(0, 80)} (${err instanceof Error ? err.message : String(err)})`);
+	}
+	return {
+		applied,
+		skipped
+	};
+}
+/**
+* Delete each pruned dump together with its `.globals.sql` roles sidecar, so
+* pruning never orphans the roles file. The sidecar is best-effort — older
+* backups predate it, so a missing-sidecar failure is swallowed while a
+* failure deleting the dump itself propagates.
+*
+* `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+*/
+async function pruneWith(keys, deleteObject) {
+	for (const key of keys) {
+		await deleteObject(key);
+		try {
+			await deleteObject(globalsFileForDump(key));
+		} catch {}
+	}
+}
+//#endregion
 //#region src/backup/backup-service.ts
 /**
 * Backup / restore orchestration: thin, well-typed wrappers around
@@ -20806,6 +20924,7 @@ function resolveLocalBin(binName) {
 */
 var backup_service_exports = /* @__PURE__ */ __exportAll({
 	BackupToolError: () => BackupToolError,
+	applyGlobals: () => applyGlobals,
 	createDump: () => createDump,
 	detectToolMajor: () => detectToolMajor,
 	ensureDatabaseExists: () => ensureDatabaseExists,
@@ -20815,7 +20934,8 @@ var backup_service_exports = /* @__PURE__ */ __exportAll({
 	pruneBackups: () => pruneBackups,
 	resolvePgBinary: () => resolvePgBinary,
 	restoreDump: () => restoreDump,
-	uploadBackup: () => uploadBackup
+	uploadBackup: () => uploadBackup,
+	validateDump: () => validateDump
 });
 var BackupToolError = class extends Error {
 	hint;
@@ -20825,10 +20945,10 @@ var BackupToolError = class extends Error {
 		this.name = "BackupToolError";
 	}
 };
-/** Locate `pg_dump` / `pg_restore`, honouring an env override. */
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
 function resolvePgBinary(tool, env = process.env) {
-	const override = tool === "pg_dump" ? env.PG_DUMP_PATH : env.PG_RESTORE_PATH;
-	if (override && fs.existsSync(override)) return override;
+	const overrideVar = tool === "pg_dump" ? env.PG_DUMP_PATH : tool === "pg_restore" ? env.PG_RESTORE_PATH : env.PG_DUMPALL_PATH;
+	if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;
 	return resolveLocalBin(tool);
 }
 /** Run `<bin> --version` and extract the major version. */
@@ -20872,6 +20992,11 @@ async function preflight(tool, connectionString, env = process.env) {
 * Produce a custom-format dump on local disk. When `outDir` is omitted the
 * file is written to the OS temp directory (used by the upload path, which
 * cleans it up afterwards).
+*
+* Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+* `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+* depend on can be recreated on restore. Set `includeGlobals: false` to skip
+* it (e.g. when the caller has no privilege to read cluster globals).
 */
 async function createDump(opts) {
 	const env = opts.env ?? process.env;
@@ -20890,17 +21015,92 @@ async function createDump(opts) {
 		stdio: opts.inheritStdio ? "inherit" : "pipe",
 		env: { ...env }
 	});
-	return {
+	const result = {
 		localFile,
 		fileName,
 		sizeBytes: fs.existsSync(localFile) ? fs.statSync(localFile).size : 0
 	};
+	if (opts.includeGlobals !== false) {
+		const dumpallBin = resolvePgBinary("pg_dumpall", env);
+		if (!dumpallBin) throw new BackupToolError("Could not find the 'pg_dumpall' binary needed to capture cluster roles.", "Install the PostgreSQL client tools or set PG_DUMPALL_PATH. To take a role-incomplete backup anyway, pass includeGlobals: false.");
+		const globalsFile = globalsFileForDump(localFile);
+		await execa(dumpallBin, buildPgDumpallGlobalsArgs({
+			connectionString: opts.connectionString,
+			outFile: globalsFile
+		}), {
+			stdio: opts.inheritStdio ? "inherit" : "pipe",
+			env: { ...env }
+		});
+		result.globalsFile = globalsFile;
+		result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
+	}
+	return result;
+}
+/**
+* Cheap integrity check on a freshly written dump: it must be non-empty and
+* `pg_restore --list` must parse its table of contents without error. Used
+* before pruning older backups so a corrupt-but-exit-0 dump never becomes
+* the reason the last good backup is deleted.
+*/
+async function validateDump(localFile, env = process.env) {
+	if (!fs.existsSync(localFile)) return {
+		ok: false,
+		reason: `Dump file does not exist: ${localFile}`
+	};
+	if (fs.statSync(localFile).size === 0) return {
+		ok: false,
+		reason: "Dump file is empty (0 bytes)."
+	};
+	const bin = resolvePgBinary("pg_restore", env);
+	if (!bin) return {
+		ok: false,
+		reason: "Could not find 'pg_restore' to verify the dump."
+	};
+	try {
+		await execa(bin, buildPgRestoreListArgs(localFile), {
+			stdio: "pipe",
+			env: { ...env }
+		});
+		return { ok: true };
+	} catch (err) {
+		return {
+			ok: false,
+			reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+}
+/**
+* Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+* before a restore, so the dump's GRANT/RLS statements (which reference
+* `rebase_user` and any owner roles) actually apply. Runs statement by
+* statement and tolerates per-statement failures — on a same-cluster restore
+* the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+* a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+* should abort role recreation. Returns how many statements applied vs were
+* skipped.
+*/
+async function applyGlobals(connectionString, globalsSql, log = () => {}) {
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString });
+	await client.connect();
+	try {
+		return await applyGlobalsWith(async (sql) => {
+			await client.query(sql);
+		}, globalsSql, log);
+	} finally {
+		await client.end();
+	}
 }
 /**
 * Restore a custom-format dump into the database named by
 * `connectionString`. Destructive when `clean` is set (drops objects
 * first). Never called automatically — the CLI gates it behind explicit
 * confirmation.
+*
+* Runs with `--exit-on-error` by default: a restore that logs-and-continues
+* past a failed GRANT (because a role was missing) reports success with RLS
+* un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+* and only set `exitOnError: false` deliberately.
 */
 async function restoreDump(opts) {
 	const env = opts.env ?? process.env;
@@ -20910,7 +21110,8 @@ async function restoreDump(opts) {
 		connectionString: opts.connectionString,
 		inputFile: opts.inputFile,
 		clean: opts.clean,
-		noOwner: opts.noOwner
+		noOwner: opts.noOwner,
+		exitOnError: opts.exitOnError
 	}), {
 		stdio: opts.inheritStdio ? "inherit" : "pipe",
 		env: { ...env }
@@ -20987,9 +21188,13 @@ async function listBackups(dest, storage) {
 */
 async function pruneBackups(dest, options, storage) {
 	const toDelete = selectBackupsToPrune(await listBackups(dest, storage), options);
-	for (const key of toDelete) if (dest.kind === "local") {
-		if (fs.existsSync(key)) fs.unlinkSync(key);
-	} else if (storage) await storage.deleteObject(key, dest.bucket);
+	await pruneWith(toDelete, dest.kind === "local" ? async (key) => {
+		if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);
+		fs.unlinkSync(key);
+	} : async (key) => {
+		if (!storage) throw new BackupToolError("Storage backend required to prune object backups.");
+		await storage.deleteObject(key, dest.bucket);
+	});
 	return toDelete;
 }
 //#endregion
@@ -21054,7 +21259,7 @@ function createBackupCron(config) {
 		enabled: config.enabled ?? true,
 		timeoutSeconds: 3600,
 		async handler({ log }) {
-			const { createDump, pruneBackups, uploadBackup } = await Promise.resolve().then(() => backup_service_exports);
+			const { createDump, pruneBackups, uploadBackup, validateDump } = await Promise.resolve().then(() => backup_service_exports);
 			const { destination } = config;
 			if (destination.kind !== "local" && !config.storage) throw new Error(`Backup destination is ${destination.kind} but no storage controller was provided. Pass the backend's configured StorageController to createBackupCron({ storage }).`);
 			log(`Starting backup of "${dbName}"…`);
@@ -21066,15 +21271,23 @@ function createBackupCron(config) {
 				excludeSchemas
 			});
 			log(`Dump created: ${dump.fileName} (${formatBytes(dump.sizeBytes)})`);
+			const check = await validateDump(dump.localFile);
+			if (!check.ok) {
+				if (destination.kind !== "local" && fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
+				if (dump.globalsFile && destination.kind !== "local" && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
+				throw new Error(`New backup failed validation — skipping upload and pruning to protect existing backups. ${check.reason}`);
+			}
 			let storedKey = dump.localFile;
 			try {
 				if (destination.kind !== "local") {
 					const uploaded = await uploadBackup(config.storage, dump.localFile, destination);
 					storedKey = uploaded.storageUrl;
 					log(`Uploaded to ${uploaded.storageUrl}`);
+					if (dump.globalsFile && fs.existsSync(dump.globalsFile)) log(`Uploaded roles sidecar to ${(await uploadBackup(config.storage, dump.globalsFile, destination)).storageUrl}`);
 				}
 			} finally {
 				if (destination.kind !== "local" && fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);
+				if (dump.globalsFile && destination.kind !== "local" && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);
 			}
 			let pruned = [];
 			if (config.retentionDays && config.retentionDays > 0) {
@@ -23657,6 +23870,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, applyGlobals, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgDumpallGlobalsArgs, buildPgRestoreArgs, buildPgRestoreListArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, globalsFileForDump, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, splitGlobalsStatements, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, validateDump, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map