@rebasepro/server-postgres 0.17.3 → 0.18.1

package/dist/{backup-service-DCk7KhhL.js → rls-bootstrap-sql-DLDnUjtx.js}

@@ -1,12 +1,12 @@
 import { createRequire as __createRequire } from "module";
-import process from "process";
 __createRequire(import.meta.url);
-import { d as __require, f as __toESM, l as __commonJSMin, u as __exportAll } from "./connection-GOKU3Hu5.js";
-import "./collection-index-BRUg10H5.js";
-import "./src-DiB5RP2Z.js";
+import { a as __toESM, i as __require, n as __commonJSMin, r as __exportAll, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
+import { o as isRebaseIndexName } from "./collection-index-BHgT_TKd.js";
+import { r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
+import { t as chalk } from "./source-Br7L7GOI.js";
+import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA, isManyToMany } from "@rebasepro/types";
 import fs from "fs";
 import path from "path";
-import os from "os";
 import { fileURLToPath } from "node:url";
 import { ChildProcess, execFile, spawn, spawnSync } from "node:child_process";
 import { StringDecoder } from "node:string_decoder";
@@ -23,8 +23,8 @@ import { appendFileSync, createReadStream, createWriteStream, readFileSync, stat
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
-import "module";
-import { fileURLToPath as fileURLToPath$1 } from "url";
+import { createRequire } from "module";
+import { fileURLToPath as fileURLToPath$1, pathToFileURL } from "url";
 //#region src/utils/connection-string.ts
 /**
 * Connection-string rewrites for the tools Rebase shells out to.
@@ -80,321 +80,6 @@ function forLibpq(connectionString) {
 	return url.toString();
 }
 //#endregion
-//#region src/backup/pg-tools.ts
-/**
-* Pure helpers for the backup/restore commands.
-*
-* Everything in this file is side-effect free so it can be unit-tested
-* without a live Postgres server, matching the constraint that CI must
-* not require a database.
-*/
-/**
-* Extract the database name from a Postgres connection string.
-* Returns `null` when the URL has no database path (e.g. bare host).
-*/
-function parseDbNameFromUrl(connectionString) {
-	try {
-		const name = new URL(connectionString).pathname.replace(/^\//, "").trim();
-		return name.length > 0 ? name : null;
-	} catch {
-		const match = connectionString.match(/\/([^/?]+)(\?|$)/);
-		return match && match[1] ? match[1] : null;
-	}
-}
-/**
-* Swap the database name in a connection string, preserving credentials,
-* host, port and query params. Used by `--target-db` / `--create-db` so a
-* restore can target a fresh database instead of clobbering the live one.
-*/
-function withDatabaseName(connectionString, dbName) {
-	try {
-		const parsed = new URL(connectionString);
-		parsed.pathname = `/${dbName}`;
-		return parsed.toString();
-	} catch {
-		return connectionString.replace(/\/([^/?]+)(\?|$)/, `/${dbName}$2`);
-	}
-}
-/**
-* Parse the major version out of `pg_dump --version` / `pg_restore --version`
-* output, e.g. `"pg_dump (PostgreSQL) 16.2"` → `16`. Handles the pre-10
-* `9.6.x` scheme (returns `9`) and beta strings like `"17beta1"`.
-*/
-function parsePgToolMajor(versionOutput) {
-	const match = versionOutput.match(/(\d+)(?:\.(\d+))?/);
-	if (!match) return null;
-	const major = Number(match[1]);
-	if (!Number.isFinite(major)) return null;
-	if (major === 9 && match[2] !== void 0) return 9;
-	return major;
-}
-/**
-* Convert `SELECT current_setting('server_version_num')` (e.g. `160002`)
-* into a major version (`16`). Also accepts pre-10 encodings like `90603`
-* → `9`.
-*/
-function serverVersionNumToMajor(versionNum) {
-	const num = typeof versionNum === "string" ? Number(versionNum) : versionNum;
-	if (!Number.isFinite(num) || num <= 0) return null;
-	if (num < 1e5) return Math.floor(num / 1e4);
-	return Math.floor(num / 1e4);
-}
-/**
-* pg_dump / pg_restore must be **at least** as new as the server they talk
-* to. A newer client against an older server is supported; an older client
-* against a newer server is not and produces corrupt or rejected output.
-*/
-function checkToolServerCompatibility(toolMajor, serverMajor) {
-	if (toolMajor === null) return {
-		compatible: false,
-		reason: "Could not determine the client tool version."
-	};
-	if (serverMajor === null) return {
-		compatible: false,
-		reason: "Could not determine the Postgres server version."
-	};
-	if (toolMajor < serverMajor) return {
-		compatible: false,
-		reason: `Client tool is Postgres ${toolMajor} but the server is Postgres ${serverMajor}. pg_dump/pg_restore must be the same major version as the server or newer. Install Postgres ${serverMajor} client tools.`
-	};
-	return { compatible: true };
-}
-/**
-* Build a deterministic, sortable backup file name:
-*   `rebase-<db>-<YYYYMMDD>T<HHMMSS>Z.dump`
-*
-* The UTC timestamp is embedded so retention pruning can recover the
-* creation time from the object key alone, without extra metadata.
-*/
-function buildBackupFilename(dbName, date = /* @__PURE__ */ new Date()) {
-	const stamp = date.toISOString().replace(/\.\d+Z$/, "Z").replace(/[-:]/g, "");
-	return `rebase-${dbName.replace(/[^a-zA-Z0-9_-]/g, "_")}-${stamp}.dump`;
-}
-/**
-* Recover the creation timestamp encoded in a backup file name by
-* {@link buildBackupFilename}. Returns `null` for names that don't match,
-* so foreign objects in a shared prefix are never pruned.
-*/
-function parseBackupTimestamp(fileName) {
-	const match = (fileName.split("/").pop() ?? fileName).match(/-(\d{8})T(\d{6})Z\.dump$/);
-	if (!match) return null;
-	const [, ymd, hms] = match;
-	const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
-	const date = new Date(iso);
-	return Number.isNaN(date.getTime()) ? null : date;
-}
-/**
-* Parse a destination string into a structured {@link BackupDestination}.
-* `s3://bucket/prefix` and `gs://bucket/prefix` map to object storage;
-* anything else is treated as a local path.
-*/
-function parseBackupDestination(out) {
-	const s3 = out.match(/^s3:\/\/([^/]+)\/?(.*)$/);
-	if (s3) return {
-		kind: "s3",
-		bucket: s3[1],
-		prefix: stripTrailingSlash(s3[2])
-	};
-	const gcs = out.match(/^gs:\/\/([^/]+)\/?(.*)$/);
-	if (gcs) return {
-		kind: "gcs",
-		bucket: gcs[1],
-		prefix: stripTrailingSlash(gcs[2])
-	};
-	return {
-		kind: "local",
-		path: out
-	};
-}
-function stripTrailingSlash(s) {
-	return s.replace(/\/+$/, "");
-}
-/**
-* Join a storage prefix and a file name without producing a leading or
-* doubled slash.
-*/
-function joinStorageKey(prefix, fileName) {
-	const clean = prefix.replace(/^\/+|\/+$/g, "");
-	return clean.length > 0 ? `${clean}/${fileName}` : fileName;
-}
-/**
-* `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
-* set a GUC.
-*
-* A backslash escape rather than quoting, which is what libpq's `-c` parsing
-* takes: a space inside a value ends the option otherwise, so a role list is
-* comma-joined and never spaced.
-*/
-function buildRowSecurityPgOptions(identity) {
-	const escape = (value) => value.replace(/([\\ ])/g, "\\$1");
-	return [
-		`-c app.uid=${escape(identity.uid)}`,
-		`-c app.user_id=${escape(identity.uid)}`,
-		`-c app.user_roles=${escape(identity.roles.join(","))}`
-	].join(" ");
-}
-/**
-* Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
-* which is compressed and restorable selectively via `pg_restore`.
-*/
-function buildPgDumpArgs(opts) {
-	const args = [
-		"--format=custom",
-		"--no-password",
-		`--file=${opts.outFile}`
-	];
-	if (opts.noOwner) args.push("--no-owner");
-	if (opts.rowSecurity) args.push("--enable-row-security");
-	for (const schema of opts.excludeSchemas ?? []) args.push(`--exclude-schema=${schema}`);
-	args.push(forLibpq(opts.connectionString));
-	return args;
-}
-/**
-* Whether a `pg_dump` failure is the row-security one, and what to do about it.
-*
-* The error text names the table and nothing else, so the first read of it is
-* "why would a backup be affected by RLS at all?" — the answer being that the
-* dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
-* normal state of the `postgres` user on Cloud SQL, RDS and every other managed
-* Postgres. Nothing about that is visible from the message.
-*
-* Returns `null` for any other failure, so the caller reports it unchanged.
-*/
-function diagnoseRowSecurityDumpFailure(error) {
-	const text = [error?.stderr, error?.message].map((part) => typeof part === "string" ? part : "").join("\n");
-	if (!/row-level security policy/i.test(text)) return null;
-	const table = text.match(/for table "([^"]+)"/)?.[1];
-	return [
-		`pg_dump cannot read ${table ? `"${table}"` : "one of the tables"} because row-level security applies to it.`,
-		"",
-		"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal",
-		"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is",
-		"  no superuser to hand out.",
-		"",
-		"  Two ways out:",
-		"",
-		"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The",
-		"      dump then contains every row, which is what a backup should mean.",
-		"",
-		"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase",
-		"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy",
-		"      admits the dump. Read the warning it prints: the result contains exactly the",
-		"      rows those policies admit, and any table whose policies do not include an",
-		"      admin rule comes out short — with no error.",
-		"",
-		"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the",
-		"  settings above it succeeds and silently omits rows."
-	].join("\n");
-}
-/**
-* Assemble the `pg_restore` argument vector for a custom-format dump.
-*/
-function buildPgRestoreArgs(opts) {
-	const args = [
-		"--format=custom",
-		"--no-password",
-		`--dbname=${forLibpq(opts.connectionString)}`
-	];
-	if (opts.clean) args.push("--clean", "--if-exists");
-	if (opts.noOwner) args.push("--no-owner");
-	if (opts.exitOnError !== false) args.push("--exit-on-error");
-	args.push(opts.inputFile);
-	return args;
-}
-/**
-* Assemble the `pg_restore --list` argument vector. Reading a dump's table
-* of contents parses the whole archive without touching a database, so it is
-* a cheap integrity check that the file isn't truncated or corrupt.
-*/
-function buildPgRestoreListArgs(inputFile) {
-	return ["--list", inputFile];
-}
-/**
-* Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
-* cluster-wide objects) live outside any single database, so a per-database
-* `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
-* statements in the main dump fail on restore and RLS is silently lost — so
-* every backup captures the globals into a sidecar `.globals.sql`.
-*
-* `--no-role-passwords` keeps role secrets out of the artifact (backups may
-* be shipped off-box); roles are recreated password-less and re-secured by
-* the operator.
-*/
-function buildPgDumpallGlobalsArgs(opts) {
-	return [
-		"--globals-only",
-		"--no-role-passwords",
-		"--no-password",
-		`--file=${opts.outFile}`,
-		`--dbname=${forLibpq(opts.connectionString)}`
-	];
-}
-/**
-* Derive the globals sidecar path/key for a given `.dump` file. Keeps the
-* two artifacts adjacent so listing, uploading and pruning can find one from
-* the other. A name that doesn't end in `.dump` is returned unchanged with a
-* `.globals.sql` suffix appended.
-*/
-function globalsFileForDump(dumpPath) {
-	return dumpPath.endsWith(".dump") ? dumpPath.slice(0, -5) + ".globals.sql" : dumpPath + ".globals.sql";
-}
-/**
-* Split a `pg_dumpall --globals-only` script into individual statements.
-* Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
-* can run independently and a benign "role already exists" on one doesn't
-* abort the rest. Drops `--` comment lines and blank statements.
-*/
-function splitGlobalsStatements(sql) {
-	return sql.split("\n").filter((line) => {
-		const trimmed = line.trim();
-		return !trimmed.startsWith("--") && !trimmed.startsWith("\\");
-	}).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
-}
-/**
-* Resolve the Postgres connection string the backup commands should use,
-* mirroring the precedence the branch command already relies on.
-*/
-function resolveConnectionString(env) {
-	return env.DATABASE_URL || env.ADMIN_CONNECTION_STRING || null;
-}
-//#endregion
-//#region src/backup/retention.ts
-/**
-* Retention pruning for scheduled backups. Pure logic — no I/O — so it can
-* be exhaustively unit-tested without touching a storage backend.
-*/
-/**
-* Decide which backups to delete under the given retention policy.
-*
-* Rules, applied in order:
-*  1. Objects whose key isn't a recognised rebase backup (no parseable
-*     timestamp and no `createdAt`) are never selected — foreign files in a
-*     shared bucket are left untouched.
-*  2. The `keepMinimum` newest backups are always retained.
-*  3. Of the remainder, any older than `retentionDays` are selected for
-*     deletion.
-*
-* Returns the keys to delete, oldest first.
-*/
-function selectBackupsToPrune(backups, options) {
-	const retentionDays = options.retentionDays ?? 0;
-	const keepMinimum = Math.max(0, options.keepMinimum ?? 0);
-	const now = options.now ?? /* @__PURE__ */ new Date();
-	if (retentionDays <= 0) return [];
-	const dated = backups.map((b) => {
-		const createdAt = b.createdAt ?? parseBackupTimestamp(b.key);
-		return createdAt ? {
-			key: b.key,
-			createdAt
-		} : null;
-	}).filter((b) => b !== null);
-	dated.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
-	const cutoff = now.getTime() - retentionDays * 24 * 60 * 60 * 1e3;
-	const toDelete = dated.slice(keepMinimum).filter((b) => b.createdAt.getTime() < cutoff);
-	toDelete.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
-	return toDelete.map((b) => b.key);
-}
-//#endregion
 //#region ../../node_modules/.pnpm/is-plain-obj@4.1.0/node_modules/is-plain-obj/index.js
 function isPlainObject(value) {
 	if (typeof value !== "object" || value === null) return false;
@@ -6566,2065 +6251,149 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
-//#region __vite-browser-external
-var require___vite_browser_external = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = {};
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/color-name@1.1.4/node_modules/color-name/index.js
-var require_color_name = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = {
-		"aliceblue": [
-			240,
-			248,
-			255
-		],
-		"antiquewhite": [
-			250,
-			235,
-			215
-		],
-		"aqua": [
-			0,
-			255,
-			255
-		],
-		"aquamarine": [
-			127,
-			255,
-			212
-		],
-		"azure": [
-			240,
-			255,
-			255
-		],
-		"beige": [
-			245,
-			245,
-			220
-		],
-		"bisque": [
-			255,
-			228,
-			196
-		],
-		"black": [
-			0,
-			0,
-			0
-		],
-		"blanchedalmond": [
-			255,
-			235,
-			205
-		],
-		"blue": [
-			0,
-			0,
-			255
-		],
-		"blueviolet": [
-			138,
-			43,
-			226
-		],
-		"brown": [
-			165,
-			42,
-			42
-		],
-		"burlywood": [
-			222,
-			184,
-			135
-		],
-		"cadetblue": [
-			95,
-			158,
-			160
-		],
-		"chartreuse": [
-			127,
-			255,
-			0
-		],
-		"chocolate": [
-			210,
-			105,
-			30
-		],
-		"coral": [
-			255,
-			127,
-			80
-		],
-		"cornflowerblue": [
-			100,
-			149,
-			237
-		],
-		"cornsilk": [
-			255,
-			248,
-			220
-		],
-		"crimson": [
-			220,
-			20,
-			60
-		],
-		"cyan": [
-			0,
-			255,
-			255
-		],
-		"darkblue": [
-			0,
-			0,
-			139
-		],
-		"darkcyan": [
-			0,
-			139,
-			139
-		],
-		"darkgoldenrod": [
-			184,
-			134,
-			11
-		],
-		"darkgray": [
-			169,
-			169,
-			169
-		],
-		"darkgreen": [
-			0,
-			100,
-			0
-		],
-		"darkgrey": [
-			169,
-			169,
-			169
-		],
-		"darkkhaki": [
-			189,
-			183,
-			107
-		],
-		"darkmagenta": [
-			139,
-			0,
-			139
-		],
-		"darkolivegreen": [
-			85,
-			107,
-			47
-		],
-		"darkorange": [
-			255,
-			140,
-			0
-		],
-		"darkorchid": [
-			153,
-			50,
-			204
-		],
-		"darkred": [
-			139,
-			0,
-			0
-		],
-		"darksalmon": [
-			233,
-			150,
-			122
-		],
-		"darkseagreen": [
-			143,
-			188,
-			143
-		],
-		"darkslateblue": [
-			72,
-			61,
-			139
-		],
-		"darkslategray": [
-			47,
-			79,
-			79
-		],
-		"darkslategrey": [
-			47,
-			79,
-			79
-		],
-		"darkturquoise": [
-			0,
-			206,
-			209
-		],
-		"darkviolet": [
-			148,
-			0,
-			211
-		],
-		"deeppink": [
-			255,
-			20,
-			147
-		],
-		"deepskyblue": [
-			0,
-			191,
-			255
-		],
-		"dimgray": [
-			105,
-			105,
-			105
-		],
-		"dimgrey": [
-			105,
-			105,
-			105
-		],
-		"dodgerblue": [
-			30,
-			144,
-			255
-		],
-		"firebrick": [
-			178,
-			34,
-			34
-		],
-		"floralwhite": [
-			255,
-			250,
-			240
-		],
-		"forestgreen": [
-			34,
-			139,
-			34
-		],
-		"fuchsia": [
-			255,
-			0,
-			255
-		],
-		"gainsboro": [
-			220,
-			220,
-			220
-		],
-		"ghostwhite": [
-			248,
-			248,
-			255
-		],
-		"gold": [
-			255,
-			215,
-			0
-		],
-		"goldenrod": [
-			218,
-			165,
-			32
-		],
-		"gray": [
-			128,
-			128,
-			128
-		],
-		"green": [
-			0,
-			128,
-			0
-		],
-		"greenyellow": [
-			173,
-			255,
-			47
-		],
-		"grey": [
-			128,
-			128,
-			128
-		],
-		"honeydew": [
-			240,
-			255,
-			240
-		],
-		"hotpink": [
-			255,
-			105,
-			180
-		],
-		"indianred": [
-			205,
-			92,
-			92
-		],
-		"indigo": [
-			75,
-			0,
-			130
-		],
-		"ivory": [
-			255,
-			255,
-			240
-		],
-		"khaki": [
-			240,
-			230,
-			140
-		],
-		"lavender": [
-			230,
-			230,
-			250
-		],
-		"lavenderblush": [
-			255,
-			240,
-			245
-		],
-		"lawngreen": [
-			124,
-			252,
-			0
-		],
-		"lemonchiffon": [
-			255,
-			250,
-			205
-		],
-		"lightblue": [
-			173,
-			216,
-			230
-		],
-		"lightcoral": [
-			240,
-			128,
-			128
-		],
-		"lightcyan": [
-			224,
-			255,
-			255
-		],
-		"lightgoldenrodyellow": [
-			250,
-			250,
-			210
-		],
-		"lightgray": [
-			211,
-			211,
-			211
-		],
-		"lightgreen": [
-			144,
-			238,
-			144
-		],
-		"lightgrey": [
-			211,
-			211,
-			211
-		],
-		"lightpink": [
-			255,
-			182,
-			193
-		],
-		"lightsalmon": [
-			255,
-			160,
-			122
-		],
-		"lightseagreen": [
-			32,
-			178,
-			170
-		],
-		"lightskyblue": [
-			135,
-			206,
-			250
-		],
-		"lightslategray": [
-			119,
-			136,
-			153
-		],
-		"lightslategrey": [
-			119,
-			136,
-			153
-		],
-		"lightsteelblue": [
-			176,
-			196,
-			222
-		],
-		"lightyellow": [
-			255,
-			255,
-			224
-		],
-		"lime": [
-			0,
-			255,
-			0
-		],
-		"limegreen": [
-			50,
-			205,
-			50
-		],
-		"linen": [
-			250,
-			240,
-			230
-		],
-		"magenta": [
-			255,
-			0,
-			255
-		],
-		"maroon": [
-			128,
-			0,
-			0
-		],
-		"mediumaquamarine": [
-			102,
-			205,
-			170
-		],
-		"mediumblue": [
-			0,
-			0,
-			205
-		],
-		"mediumorchid": [
-			186,
-			85,
-			211
-		],
-		"mediumpurple": [
-			147,
-			112,
-			219
-		],
-		"mediumseagreen": [
-			60,
-			179,
-			113
-		],
-		"mediumslateblue": [
-			123,
-			104,
-			238
-		],
-		"mediumspringgreen": [
-			0,
-			250,
-			154
-		],
-		"mediumturquoise": [
-			72,
-			209,
-			204
-		],
-		"mediumvioletred": [
-			199,
-			21,
-			133
-		],
-		"midnightblue": [
-			25,
-			25,
-			112
-		],
-		"mintcream": [
-			245,
-			255,
-			250
-		],
-		"mistyrose": [
-			255,
-			228,
-			225
-		],
-		"moccasin": [
-			255,
-			228,
-			181
-		],
-		"navajowhite": [
-			255,
-			222,
-			173
-		],
-		"navy": [
-			0,
-			0,
-			128
-		],
-		"oldlace": [
-			253,
-			245,
-			230
-		],
-		"olive": [
-			128,
-			128,
-			0
-		],
-		"olivedrab": [
-			107,
-			142,
-			35
-		],
-		"orange": [
-			255,
-			165,
-			0
-		],
-		"orangered": [
-			255,
-			69,
-			0
-		],
-		"orchid": [
-			218,
-			112,
-			214
-		],
-		"palegoldenrod": [
-			238,
-			232,
-			170
-		],
-		"palegreen": [
-			152,
-			251,
-			152
-		],
-		"paleturquoise": [
-			175,
-			238,
-			238
-		],
-		"palevioletred": [
-			219,
-			112,
-			147
-		],
-		"papayawhip": [
-			255,
-			239,
-			213
-		],
-		"peachpuff": [
-			255,
-			218,
-			185
-		],
-		"peru": [
-			205,
-			133,
-			63
-		],
-		"pink": [
-			255,
-			192,
-			203
-		],
-		"plum": [
-			221,
-			160,
-			221
-		],
-		"powderblue": [
-			176,
-			224,
-			230
-		],
-		"purple": [
-			128,
-			0,
-			128
-		],
-		"rebeccapurple": [
-			102,
-			51,
-			153
-		],
-		"red": [
-			255,
-			0,
-			0
-		],
-		"rosybrown": [
-			188,
-			143,
-			143
-		],
-		"royalblue": [
-			65,
-			105,
-			225
-		],
-		"saddlebrown": [
-			139,
-			69,
-			19
-		],
-		"salmon": [
-			250,
-			128,
-			114
-		],
-		"sandybrown": [
-			244,
-			164,
-			96
-		],
-		"seagreen": [
-			46,
-			139,
-			87
-		],
-		"seashell": [
-			255,
-			245,
-			238
-		],
-		"sienna": [
-			160,
-			82,
-			45
-		],
-		"silver": [
-			192,
-			192,
-			192
-		],
-		"skyblue": [
-			135,
-			206,
-			235
-		],
-		"slateblue": [
-			106,
-			90,
-			205
-		],
-		"slategray": [
-			112,
-			128,
-			144
-		],
-		"slategrey": [
-			112,
-			128,
-			144
-		],
-		"snow": [
-			255,
-			250,
-			250
-		],
-		"springgreen": [
-			0,
-			255,
-			127
-		],
-		"steelblue": [
-			70,
-			130,
-			180
-		],
-		"tan": [
-			210,
-			180,
-			140
-		],
-		"teal": [
-			0,
-			128,
-			128
-		],
-		"thistle": [
-			216,
-			191,
-			216
-		],
-		"tomato": [
-			255,
-			99,
-			71
-		],
-		"turquoise": [
-			64,
-			224,
-			208
-		],
-		"violet": [
-			238,
-			130,
-			238
-		],
-		"wheat": [
-			245,
-			222,
-			179
-		],
-		"white": [
-			255,
-			255,
-			255
-		],
-		"whitesmoke": [
-			245,
-			245,
-			245
-		],
-		"yellow": [
-			255,
-			255,
-			0
-		],
-		"yellowgreen": [
-			154,
-			205,
-			50
-		]
-	};
-}));
+//#region src/module-dir.ts
+var import___vite_browser_external = /* @__PURE__ */ __toESM(require___vite_browser_external(), 1);
+var moduleDir = path.dirname(fileURLToPath$1(import.meta.url));
 //#endregion
-//#region ../../node_modules/.pnpm/color-convert@2.0.1/node_modules/color-convert/conversions.js
-var require_conversions = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var cssKeywords = require_color_name();
-	var reverseKeywords = {};
-	for (const key of Object.keys(cssKeywords)) reverseKeywords[cssKeywords[key]] = key;
-	var convert = {
-		rgb: {
-			channels: 3,
-			labels: "rgb"
-		},
-		hsl: {
-			channels: 3,
-			labels: "hsl"
-		},
-		hsv: {
-			channels: 3,
-			labels: "hsv"
-		},
-		hwb: {
-			channels: 3,
-			labels: "hwb"
-		},
-		cmyk: {
-			channels: 4,
-			labels: "cmyk"
-		},
-		xyz: {
-			channels: 3,
-			labels: "xyz"
-		},
-		lab: {
-			channels: 3,
-			labels: "lab"
-		},
-		lch: {
-			channels: 3,
-			labels: "lch"
-		},
-		hex: {
-			channels: 1,
-			labels: ["hex"]
-		},
-		keyword: {
-			channels: 1,
-			labels: ["keyword"]
-		},
-		ansi16: {
-			channels: 1,
-			labels: ["ansi16"]
-		},
-		ansi256: {
-			channels: 1,
-			labels: ["ansi256"]
-		},
-		hcg: {
-			channels: 3,
-			labels: [
-				"h",
-				"c",
-				"g"
-			]
-		},
-		apple: {
-			channels: 3,
-			labels: [
-				"r16",
-				"g16",
-				"b16"
-			]
-		},
-		gray: {
-			channels: 1,
-			labels: ["gray"]
-		}
-	};
-	module.exports = convert;
-	for (const model of Object.keys(convert)) {
-		if (!("channels" in convert[model])) throw new Error("missing channels property: " + model);
-		if (!("labels" in convert[model])) throw new Error("missing channel labels property: " + model);
-		if (convert[model].labels.length !== convert[model].channels) throw new Error("channel and label counts mismatch: " + model);
-		const { channels, labels } = convert[model];
-		delete convert[model].channels;
-		delete convert[model].labels;
-		Object.defineProperty(convert[model], "channels", { value: channels });
-		Object.defineProperty(convert[model], "labels", { value: labels });
-	}
-	convert.rgb.hsl = function(rgb) {
-		const r = rgb[0] / 255;
-		const g = rgb[1] / 255;
-		const b = rgb[2] / 255;
-		const min = Math.min(r, g, b);
-		const max = Math.max(r, g, b);
-		const delta = max - min;
-		let h;
-		let s;
-		if (max === min) h = 0;
-		else if (r === max) h = (g - b) / delta;
-		else if (g === max) h = 2 + (b - r) / delta;
-		else if (b === max) h = 4 + (r - g) / delta;
-		h = Math.min(h * 60, 360);
-		if (h < 0) h += 360;
-		const l = (min + max) / 2;
-		if (max === min) s = 0;
-		else if (l <= .5) s = delta / (max + min);
-		else s = delta / (2 - max - min);
-		return [
-			h,
-			s * 100,
-			l * 100
-		];
-	};
-	convert.rgb.hsv = function(rgb) {
-		let rdif;
-		let gdif;
-		let bdif;
-		let h;
-		let s;
-		const r = rgb[0] / 255;
-		const g = rgb[1] / 255;
-		const b = rgb[2] / 255;
-		const v = Math.max(r, g, b);
-		const diff = v - Math.min(r, g, b);
-		const diffc = function(c) {
-			return (v - c) / 6 / diff + 1 / 2;
-		};
-		if (diff === 0) {
-			h = 0;
-			s = 0;
-		} else {
-			s = diff / v;
-			rdif = diffc(r);
-			gdif = diffc(g);
-			bdif = diffc(b);
-			if (r === v) h = bdif - gdif;
-			else if (g === v) h = 1 / 3 + rdif - bdif;
-			else if (b === v) h = 2 / 3 + gdif - rdif;
-			if (h < 0) h += 1;
-			else if (h > 1) h -= 1;
-		}
-		return [
-			h * 360,
-			s * 100,
-			v * 100
-		];
-	};
-	convert.rgb.hwb = function(rgb) {
-		const r = rgb[0];
-		const g = rgb[1];
-		let b = rgb[2];
-		const h = convert.rgb.hsl(rgb)[0];
-		const w = 1 / 255 * Math.min(r, Math.min(g, b));
-		b = 1 - 1 / 255 * Math.max(r, Math.max(g, b));
-		return [
-			h,
-			w * 100,
-			b * 100
-		];
-	};
-	convert.rgb.cmyk = function(rgb) {
-		const r = rgb[0] / 255;
-		const g = rgb[1] / 255;
-		const b = rgb[2] / 255;
-		const k = Math.min(1 - r, 1 - g, 1 - b);
-		const c = (1 - r - k) / (1 - k) || 0;
-		const m = (1 - g - k) / (1 - k) || 0;
-		const y = (1 - b - k) / (1 - k) || 0;
-		return [
-			c * 100,
-			m * 100,
-			y * 100,
-			k * 100
-		];
-	};
-	function comparativeDistance(x, y) {
-		return (x[0] - y[0]) ** 2 + (x[1] - y[1]) ** 2 + (x[2] - y[2]) ** 2;
-	}
-	convert.rgb.keyword = function(rgb) {
-		const reversed = reverseKeywords[rgb];
-		if (reversed) return reversed;
-		let currentClosestDistance = Infinity;
-		let currentClosestKeyword;
-		for (const keyword of Object.keys(cssKeywords)) {
-			const value = cssKeywords[keyword];
-			const distance = comparativeDistance(rgb, value);
-			if (distance < currentClosestDistance) {
-				currentClosestDistance = distance;
-				currentClosestKeyword = keyword;
-			}
-		}
-		return currentClosestKeyword;
-	};
-	convert.keyword.rgb = function(keyword) {
-		return cssKeywords[keyword];
-	};
-	convert.rgb.xyz = function(rgb) {
-		let r = rgb[0] / 255;
-		let g = rgb[1] / 255;
-		let b = rgb[2] / 255;
-		r = r > .04045 ? ((r + .055) / 1.055) ** 2.4 : r / 12.92;
-		g = g > .04045 ? ((g + .055) / 1.055) ** 2.4 : g / 12.92;
-		b = b > .04045 ? ((b + .055) / 1.055) ** 2.4 : b / 12.92;
-		const x = r * .4124 + g * .3576 + b * .1805;
-		const y = r * .2126 + g * .7152 + b * .0722;
-		const z = r * .0193 + g * .1192 + b * .9505;
-		return [
-			x * 100,
-			y * 100,
-			z * 100
-		];
-	};
-	convert.rgb.lab = function(rgb) {
-		const xyz = convert.rgb.xyz(rgb);
-		let x = xyz[0];
-		let y = xyz[1];
-		let z = xyz[2];
-		x /= 95.047;
-		y /= 100;
-		z /= 108.883;
-		x = x > .008856 ? x ** (1 / 3) : 7.787 * x + 16 / 116;
-		y = y > .008856 ? y ** (1 / 3) : 7.787 * y + 16 / 116;
-		z = z > .008856 ? z ** (1 / 3) : 7.787 * z + 16 / 116;
-		return [
-			116 * y - 16,
-			500 * (x - y),
-			200 * (y - z)
-		];
-	};
-	convert.hsl.rgb = function(hsl) {
-		const h = hsl[0] / 360;
-		const s = hsl[1] / 100;
-		const l = hsl[2] / 100;
-		let t2;
-		let t3;
-		let val;
-		if (s === 0) {
-			val = l * 255;
-			return [
-				val,
-				val,
-				val
-			];
-		}
-		if (l < .5) t2 = l * (1 + s);
-		else t2 = l + s - l * s;
-		const t1 = 2 * l - t2;
-		const rgb = [
-			0,
-			0,
-			0
-		];
-		for (let i = 0; i < 3; i++) {
-			t3 = h + 1 / 3 * -(i - 1);
-			if (t3 < 0) t3++;
-			if (t3 > 1) t3--;
-			if (6 * t3 < 1) val = t1 + (t2 - t1) * 6 * t3;
-			else if (2 * t3 < 1) val = t2;
-			else if (3 * t3 < 2) val = t1 + (t2 - t1) * (2 / 3 - t3) * 6;
-			else val = t1;
-			rgb[i] = val * 255;
-		}
-		return rgb;
-	};
-	convert.hsl.hsv = function(hsl) {
-		const h = hsl[0];
-		let s = hsl[1] / 100;
-		let l = hsl[2] / 100;
-		let smin = s;
-		const lmin = Math.max(l, .01);
-		l *= 2;
-		s *= l <= 1 ? l : 2 - l;
-		smin *= lmin <= 1 ? lmin : 2 - lmin;
-		const v = (l + s) / 2;
-		return [
-			h,
-			(l === 0 ? 2 * smin / (lmin + smin) : 2 * s / (l + s)) * 100,
-			v * 100
-		];
-	};
-	convert.hsv.rgb = function(hsv) {
-		const h = hsv[0] / 60;
-		const s = hsv[1] / 100;
-		let v = hsv[2] / 100;
-		const hi = Math.floor(h) % 6;
-		const f = h - Math.floor(h);
-		const p = 255 * v * (1 - s);
-		const q = 255 * v * (1 - s * f);
-		const t = 255 * v * (1 - s * (1 - f));
-		v *= 255;
-		switch (hi) {
-			case 0: return [
-				v,
-				t,
-				p
-			];
-			case 1: return [
-				q,
-				v,
-				p
-			];
-			case 2: return [
-				p,
-				v,
-				t
-			];
-			case 3: return [
-				p,
-				q,
-				v
-			];
-			case 4: return [
-				t,
-				p,
-				v
-			];
-			case 5: return [
-				v,
-				p,
-				q
-			];
-		}
-	};
-	convert.hsv.hsl = function(hsv) {
-		const h = hsv[0];
-		const s = hsv[1] / 100;
-		const v = hsv[2] / 100;
-		const vmin = Math.max(v, .01);
-		let sl;
-		let l;
-		l = (2 - s) * v;
-		const lmin = (2 - s) * vmin;
-		sl = s * vmin;
-		sl /= lmin <= 1 ? lmin : 2 - lmin;
-		sl = sl || 0;
-		l /= 2;
-		return [
-			h,
-			sl * 100,
-			l * 100
-		];
-	};
-	convert.hwb.rgb = function(hwb) {
-		const h = hwb[0] / 360;
-		let wh = hwb[1] / 100;
-		let bl = hwb[2] / 100;
-		const ratio = wh + bl;
-		let f;
-		if (ratio > 1) {
-			wh /= ratio;
-			bl /= ratio;
-		}
-		const i = Math.floor(6 * h);
-		const v = 1 - bl;
-		f = 6 * h - i;
-		if ((i & 1) !== 0) f = 1 - f;
-		const n = wh + f * (v - wh);
-		let r;
-		let g;
-		let b;
-		switch (i) {
-			default:
-			case 6:
-			case 0:
-				r = v;
-				g = n;
-				b = wh;
-				break;
-			case 1:
-				r = n;
-				g = v;
-				b = wh;
-				break;
-			case 2:
-				r = wh;
-				g = v;
-				b = n;
-				break;
-			case 3:
-				r = wh;
-				g = n;
-				b = v;
-				break;
-			case 4:
-				r = n;
-				g = wh;
-				b = v;
-				break;
-			case 5:
-				r = v;
-				g = wh;
-				b = n;
-				break;
-		}
-		return [
-			r * 255,
-			g * 255,
-			b * 255
-		];
-	};
-	convert.cmyk.rgb = function(cmyk) {
-		const c = cmyk[0] / 100;
-		const m = cmyk[1] / 100;
-		const y = cmyk[2] / 100;
-		const k = cmyk[3] / 100;
-		const r = 1 - Math.min(1, c * (1 - k) + k);
-		const g = 1 - Math.min(1, m * (1 - k) + k);
-		const b = 1 - Math.min(1, y * (1 - k) + k);
-		return [
-			r * 255,
-			g * 255,
-			b * 255
-		];
-	};
-	convert.xyz.rgb = function(xyz) {
-		const x = xyz[0] / 100;
-		const y = xyz[1] / 100;
-		const z = xyz[2] / 100;
-		let r;
-		let g;
-		let b;
-		r = x * 3.2406 + y * -1.5372 + z * -.4986;
-		g = x * -.9689 + y * 1.8758 + z * .0415;
-		b = x * .0557 + y * -.204 + z * 1.057;
-		r = r > .0031308 ? 1.055 * r ** (1 / 2.4) - .055 : r * 12.92;
-		g = g > .0031308 ? 1.055 * g ** (1 / 2.4) - .055 : g * 12.92;
-		b = b > .0031308 ? 1.055 * b ** (1 / 2.4) - .055 : b * 12.92;
-		r = Math.min(Math.max(0, r), 1);
-		g = Math.min(Math.max(0, g), 1);
-		b = Math.min(Math.max(0, b), 1);
-		return [
-			r * 255,
-			g * 255,
-			b * 255
-		];
-	};
-	convert.xyz.lab = function(xyz) {
-		let x = xyz[0];
-		let y = xyz[1];
-		let z = xyz[2];
-		x /= 95.047;
-		y /= 100;
-		z /= 108.883;
-		x = x > .008856 ? x ** (1 / 3) : 7.787 * x + 16 / 116;
-		y = y > .008856 ? y ** (1 / 3) : 7.787 * y + 16 / 116;
-		z = z > .008856 ? z ** (1 / 3) : 7.787 * z + 16 / 116;
-		return [
-			116 * y - 16,
-			500 * (x - y),
-			200 * (y - z)
-		];
-	};
-	convert.lab.xyz = function(lab) {
-		const l = lab[0];
-		const a = lab[1];
-		const b = lab[2];
-		let x;
-		let y;
-		let z;
-		y = (l + 16) / 116;
-		x = a / 500 + y;
-		z = y - b / 200;
-		const y2 = y ** 3;
-		const x2 = x ** 3;
-		const z2 = z ** 3;
-		y = y2 > .008856 ? y2 : (y - 16 / 116) / 7.787;
-		x = x2 > .008856 ? x2 : (x - 16 / 116) / 7.787;
-		z = z2 > .008856 ? z2 : (z - 16 / 116) / 7.787;
-		x *= 95.047;
-		y *= 100;
-		z *= 108.883;
-		return [
-			x,
-			y,
-			z
-		];
-	};
-	convert.lab.lch = function(lab) {
-		const l = lab[0];
-		const a = lab[1];
-		const b = lab[2];
-		let h;
-		h = Math.atan2(b, a) * 360 / 2 / Math.PI;
-		if (h < 0) h += 360;
-		return [
-			l,
-			Math.sqrt(a * a + b * b),
-			h
-		];
-	};
-	convert.lch.lab = function(lch) {
-		const l = lch[0];
-		const c = lch[1];
-		const hr = lch[2] / 360 * 2 * Math.PI;
-		return [
-			l,
-			c * Math.cos(hr),
-			c * Math.sin(hr)
-		];
-	};
-	convert.rgb.ansi16 = function(args, saturation = null) {
-		const [r, g, b] = args;
-		let value = saturation === null ? convert.rgb.hsv(args)[2] : saturation;
-		value = Math.round(value / 50);
-		if (value === 0) return 30;
-		let ansi = 30 + (Math.round(b / 255) << 2 | Math.round(g / 255) << 1 | Math.round(r / 255));
-		if (value === 2) ansi += 60;
-		return ansi;
-	};
-	convert.hsv.ansi16 = function(args) {
-		return convert.rgb.ansi16(convert.hsv.rgb(args), args[2]);
-	};
-	convert.rgb.ansi256 = function(args) {
-		const r = args[0];
-		const g = args[1];
-		const b = args[2];
-		if (r === g && g === b) {
-			if (r < 8) return 16;
-			if (r > 248) return 231;
-			return Math.round((r - 8) / 247 * 24) + 232;
-		}
-		return 16 + 36 * Math.round(r / 255 * 5) + 6 * Math.round(g / 255 * 5) + Math.round(b / 255 * 5);
-	};
-	convert.ansi16.rgb = function(args) {
-		let color = args % 10;
-		if (color === 0 || color === 7) {
-			if (args > 50) color += 3.5;
-			color = color / 10.5 * 255;
-			return [
-				color,
-				color,
-				color
-			];
-		}
-		const mult = (~~(args > 50) + 1) * .5;
-		return [
-			(color & 1) * mult * 255,
-			(color >> 1 & 1) * mult * 255,
-			(color >> 2 & 1) * mult * 255
-		];
-	};
-	convert.ansi256.rgb = function(args) {
-		if (args >= 232) {
-			const c = (args - 232) * 10 + 8;
-			return [
-				c,
-				c,
-				c
-			];
-		}
-		args -= 16;
-		let rem;
-		return [
-			Math.floor(args / 36) / 5 * 255,
-			Math.floor((rem = args % 36) / 6) / 5 * 255,
-			rem % 6 / 5 * 255
-		];
-	};
-	convert.rgb.hex = function(args) {
-		const string = (((Math.round(args[0]) & 255) << 16) + ((Math.round(args[1]) & 255) << 8) + (Math.round(args[2]) & 255)).toString(16).toUpperCase();
-		return "000000".substring(string.length) + string;
-	};
-	convert.hex.rgb = function(args) {
-		const match = args.toString(16).match(/[a-f0-9]{6}|[a-f0-9]{3}/i);
-		if (!match) return [
-			0,
-			0,
-			0
-		];
-		let colorString = match[0];
-		if (match[0].length === 3) colorString = colorString.split("").map((char) => {
-			return char + char;
-		}).join("");
-		const integer = parseInt(colorString, 16);
-		return [
-			integer >> 16 & 255,
-			integer >> 8 & 255,
-			integer & 255
-		];
-	};
-	convert.rgb.hcg = function(rgb) {
-		const r = rgb[0] / 255;
-		const g = rgb[1] / 255;
-		const b = rgb[2] / 255;
-		const max = Math.max(Math.max(r, g), b);
-		const min = Math.min(Math.min(r, g), b);
-		const chroma = max - min;
-		let grayscale;
-		let hue;
-		if (chroma < 1) grayscale = min / (1 - chroma);
-		else grayscale = 0;
-		if (chroma <= 0) hue = 0;
-		else if (max === r) hue = (g - b) / chroma % 6;
-		else if (max === g) hue = 2 + (b - r) / chroma;
-		else hue = 4 + (r - g) / chroma;
-		hue /= 6;
-		hue %= 1;
-		return [
-			hue * 360,
-			chroma * 100,
-			grayscale * 100
-		];
-	};
-	convert.hsl.hcg = function(hsl) {
-		const s = hsl[1] / 100;
-		const l = hsl[2] / 100;
-		const c = l < .5 ? 2 * s * l : 2 * s * (1 - l);
-		let f = 0;
-		if (c < 1) f = (l - .5 * c) / (1 - c);
-		return [
-			hsl[0],
-			c * 100,
-			f * 100
-		];
-	};
-	convert.hsv.hcg = function(hsv) {
-		const s = hsv[1] / 100;
-		const v = hsv[2] / 100;
-		const c = s * v;
-		let f = 0;
-		if (c < 1) f = (v - c) / (1 - c);
-		return [
-			hsv[0],
-			c * 100,
-			f * 100
-		];
-	};
-	convert.hcg.rgb = function(hcg) {
-		const h = hcg[0] / 360;
-		const c = hcg[1] / 100;
-		const g = hcg[2] / 100;
-		if (c === 0) return [
-			g * 255,
-			g * 255,
-			g * 255
-		];
-		const pure = [
-			0,
-			0,
-			0
-		];
-		const hi = h % 1 * 6;
-		const v = hi % 1;
-		const w = 1 - v;
-		let mg = 0;
-		switch (Math.floor(hi)) {
-			case 0:
-				pure[0] = 1;
-				pure[1] = v;
-				pure[2] = 0;
-				break;
-			case 1:
-				pure[0] = w;
-				pure[1] = 1;
-				pure[2] = 0;
-				break;
-			case 2:
-				pure[0] = 0;
-				pure[1] = 1;
-				pure[2] = v;
-				break;
-			case 3:
-				pure[0] = 0;
-				pure[1] = w;
-				pure[2] = 1;
-				break;
-			case 4:
-				pure[0] = v;
-				pure[1] = 0;
-				pure[2] = 1;
-				break;
-			default:
-				pure[0] = 1;
-				pure[1] = 0;
-				pure[2] = w;
-		}
-		mg = (1 - c) * g;
-		return [
-			(c * pure[0] + mg) * 255,
-			(c * pure[1] + mg) * 255,
-			(c * pure[2] + mg) * 255
-		];
-	};
-	convert.hcg.hsv = function(hcg) {
-		const c = hcg[1] / 100;
-		const v = c + hcg[2] / 100 * (1 - c);
-		let f = 0;
-		if (v > 0) f = c / v;
-		return [
-			hcg[0],
-			f * 100,
-			v * 100
-		];
-	};
-	convert.hcg.hsl = function(hcg) {
-		const c = hcg[1] / 100;
-		const l = hcg[2] / 100 * (1 - c) + .5 * c;
-		let s = 0;
-		if (l > 0 && l < .5) s = c / (2 * l);
-		else if (l >= .5 && l < 1) s = c / (2 * (1 - l));
-		return [
-			hcg[0],
-			s * 100,
-			l * 100
-		];
-	};
-	convert.hcg.hwb = function(hcg) {
-		const c = hcg[1] / 100;
-		const v = c + hcg[2] / 100 * (1 - c);
-		return [
-			hcg[0],
-			(v - c) * 100,
-			(1 - v) * 100
-		];
-	};
-	convert.hwb.hcg = function(hwb) {
-		const w = hwb[1] / 100;
-		const v = 1 - hwb[2] / 100;
-		const c = v - w;
-		let g = 0;
-		if (c < 1) g = (v - c) / (1 - c);
-		return [
-			hwb[0],
-			c * 100,
-			g * 100
-		];
-	};
-	convert.apple.rgb = function(apple) {
-		return [
-			apple[0] / 65535 * 255,
-			apple[1] / 65535 * 255,
-			apple[2] / 65535 * 255
-		];
-	};
-	convert.rgb.apple = function(rgb) {
-		return [
-			rgb[0] / 255 * 65535,
-			rgb[1] / 255 * 65535,
-			rgb[2] / 255 * 65535
-		];
-	};
-	convert.gray.rgb = function(args) {
-		return [
-			args[0] / 100 * 255,
-			args[0] / 100 * 255,
-			args[0] / 100 * 255
-		];
-	};
-	convert.gray.hsl = function(args) {
-		return [
-			0,
-			0,
-			args[0]
+//#region src/cli-helpers.ts
+/**
+* Which package manager installed this project, read off its lockfile.
+*
+* Every remedy for a blocked build script is package-manager specific, and
+* naming the wrong one is the same failure as naming none: `pnpm approve-builds`
+* is not a thing an npm user can run, and `pnpm.onlyBuiltDependencies` is a key
+* npm does not read. This existed as a pnpm-only message for long enough that
+* npm 12 — which blocks dependency lifecycle scripts by default, the way pnpm 10
+* does — could ship and leave every npm reader three unfollowable commands deep.
+*
+* The lockfile, not `npm_config_user_agent`: the question is how the project's
+* `node_modules` was built, not which binary happens to be invoking us. Walks up
+* because commands run from `backend/` in a scaffolded project, and the lockfile
+* is at the workspace root.
+*/
+function detectProjectPackageManager(startDir = process.cwd()) {
+	const lockfiles = [
+		["pnpm-lock.yaml", "pnpm"],
+		["bun.lock", "bun"],
+		["bun.lockb", "bun"],
+		["yarn.lock", "yarn"],
+		["package-lock.json", "npm"]
+	];
+	let dir = path.resolve(startDir);
+	while (true) {
+		for (const [file, manager] of lockfiles) if (fs.existsSync(path.join(dir, file))) return manager;
+		const parent = path.dirname(dir);
+		if (parent === dir) return "unknown";
+		dir = parent;
+	}
+}
+/**
+* How to let `@ariga/atlas` run its `preinstall`, in the reader's own package
+* manager.
+*
+* Returns the lines to print after "the binary is missing but the package is
+* installed". Kept next to {@link detectProjectPackageManager} so the two move
+* together, and returned rather than printed so it can be asserted on.
+*/
+function describeBuildScriptRemedy(packageName, manager = detectProjectPackageManager()) {
+	switch (manager) {
+		case "npm": return [
+			`    npm install-scripts approve ${packageName}`,
+			"",
+			"  or, to record it in the project (what `rebase init` scaffolds):",
+			"",
+			"    // package.json",
+			`    "allowScripts": { "${packageName}": true }`,
+			"",
+			"  Then re-run `npm install`."
 		];
-	};
-	convert.gray.hsv = convert.gray.hsl;
-	convert.gray.hwb = function(gray) {
-		return [
-			0,
-			100,
-			gray[0]
+		case "yarn": return [
+			"    // .yarnrc.yml",
+			"    enableScripts: true",
+			"",
+			"  Then re-run `yarn install`."
 		];
-	};
-	convert.gray.cmyk = function(gray) {
-		return [
-			0,
-			0,
-			0,
-			gray[0]
+		case "bun": return [
+			"    // package.json",
+			`    "trustedDependencies": ["${packageName}"]`,
+			"",
+			"  Then re-run `bun install`."
 		];
-	};
-	convert.gray.lab = function(gray) {
-		return [
-			gray[0],
-			0,
-			0
+		default: return [
+			"    pnpm approve-builds",
+			"",
+			"  or, to record it in the project (what `rebase init` scaffolds):",
+			"",
+			"    // package.json",
+			`    "pnpm": { "onlyBuiltDependencies": ["${packageName}"] }`,
+			"",
+			"  Then re-run `pnpm install`."
 		];
-	};
-	convert.gray.hex = function(gray) {
-		const val = Math.round(gray[0] / 100 * 255) & 255;
-		const string = ((val << 16) + (val << 8) + val).toString(16).toUpperCase();
-		return "000000".substring(string.length) + string;
-	};
-	convert.rgb.gray = function(rgb) {
-		return [(rgb[0] + rgb[1] + rgb[2]) / 3 / 255 * 100];
-	};
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/color-convert@2.0.1/node_modules/color-convert/route.js
-var require_route = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var conversions = require_conversions();
-	function buildGraph() {
-		const graph = {};
-		const models = Object.keys(conversions);
-		for (let len = models.length, i = 0; i < len; i++) graph[models[i]] = {
-			distance: -1,
-			parent: null
-		};
-		return graph;
-	}
-	function deriveBFS(fromModel) {
-		const graph = buildGraph();
-		const queue = [fromModel];
-		graph[fromModel].distance = 0;
-		while (queue.length) {
-			const current = queue.pop();
-			const adjacents = Object.keys(conversions[current]);
-			for (let len = adjacents.length, i = 0; i < len; i++) {
-				const adjacent = adjacents[i];
-				const node = graph[adjacent];
-				if (node.distance === -1) {
-					node.distance = graph[current].distance + 1;
-					node.parent = current;
-					queue.unshift(adjacent);
-				}
-			}
-		}
-		return graph;
 	}
-	function link(from, to) {
-		return function(args) {
-			return to(from(args));
-		};
+}
+/**
+* "Install again, from scratch", in the reader's own package manager.
+*
+* For the `bin-link-missing` state: the tree is half-written, and re-resolving
+* it is what recreates the `.bin` shim. `--force` on pnpm is what makes it
+* relink rather than decide the tree is already up to date.
+*/
+function describeReinstallCommand(manager = detectProjectPackageManager()) {
+	switch (manager) {
+		case "npm": return "rm -rf node_modules && npm install";
+		case "yarn": return "yarn install --force";
+		case "bun": return "rm -rf node_modules && bun install";
+		default: return "pnpm install --force";
 	}
-	function wrapConversion(toModel, graph) {
-		const path = [graph[toModel].parent, toModel];
-		let fn = conversions[graph[toModel].parent][toModel];
-		let cur = graph[toModel].parent;
-		while (graph[cur].parent) {
-			path.unshift(graph[cur].parent);
-			fn = link(conversions[graph[cur].parent][cur], fn);
-			cur = graph[cur].parent;
-		}
-		fn.conversion = path;
-		return fn;
-	}
-	module.exports = function(fromModel) {
-		const graph = deriveBFS(fromModel);
-		const conversion = {};
-		const models = Object.keys(graph);
-		for (let len = models.length, i = 0; i < len; i++) {
-			const toModel = models[i];
-			if (graph[toModel].parent === null) continue;
-			conversion[toModel] = wrapConversion(toModel, graph);
-		}
-		return conversion;
-	};
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/color-convert@2.0.1/node_modules/color-convert/index.js
-var require_color_convert = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var conversions = require_conversions();
-	var route = require_route();
-	var convert = {};
-	var models = Object.keys(conversions);
-	function wrapRaw(fn) {
-		const wrappedFn = function(...args) {
-			const arg0 = args[0];
-			if (arg0 === void 0 || arg0 === null) return arg0;
-			if (arg0.length > 1) args = arg0;
-			return fn(args);
-		};
-		if ("conversion" in fn) wrappedFn.conversion = fn.conversion;
-		return wrappedFn;
-	}
-	function wrapRounded(fn) {
-		const wrappedFn = function(...args) {
-			const arg0 = args[0];
-			if (arg0 === void 0 || arg0 === null) return arg0;
-			if (arg0.length > 1) args = arg0;
-			const result = fn(args);
-			if (typeof result === "object") for (let len = result.length, i = 0; i < len; i++) result[i] = Math.round(result[i]);
-			return result;
-		};
-		if ("conversion" in fn) wrappedFn.conversion = fn.conversion;
-		return wrappedFn;
-	}
-	models.forEach((fromModel) => {
-		convert[fromModel] = {};
-		Object.defineProperty(convert[fromModel], "channels", { value: conversions[fromModel].channels });
-		Object.defineProperty(convert[fromModel], "labels", { value: conversions[fromModel].labels });
-		const routes = route(fromModel);
-		Object.keys(routes).forEach((toModel) => {
-			const fn = routes[toModel];
-			convert[fromModel][toModel] = wrapRounded(fn);
-			convert[fromModel][toModel].raw = wrapRaw(fn);
-		});
-	});
-	module.exports = convert;
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/ansi-styles@4.3.0/node_modules/ansi-styles/index.js
-var require_ansi_styles = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var wrapAnsi16 = (fn, offset) => (...args) => {
-		return `\u001B[${fn(...args) + offset}m`;
-	};
-	var wrapAnsi256 = (fn, offset) => (...args) => {
-		const code = fn(...args);
-		return `\u001B[${38 + offset};5;${code}m`;
-	};
-	var wrapAnsi16m = (fn, offset) => (...args) => {
-		const rgb = fn(...args);
-		return `\u001B[${38 + offset};2;${rgb[0]};${rgb[1]};${rgb[2]}m`;
-	};
-	var ansi2ansi = (n) => n;
-	var rgb2rgb = (r, g, b) => [
-		r,
-		g,
-		b
-	];
-	var setLazyProperty = (object, property, get) => {
-		Object.defineProperty(object, property, {
-			get: () => {
-				const value = get();
-				Object.defineProperty(object, property, {
-					value,
-					enumerable: true,
-					configurable: true
-				});
-				return value;
-			},
-			enumerable: true,
-			configurable: true
-		});
-	};
-	/** @type {typeof import('color-convert')} */
-	var colorConvert;
-	var makeDynamicStyles = (wrap, targetSpace, identity, isBackground) => {
-		if (colorConvert === void 0) colorConvert = require_color_convert();
-		const offset = isBackground ? 10 : 0;
-		const styles = {};
-		for (const [sourceSpace, suite] of Object.entries(colorConvert)) {
-			const name = sourceSpace === "ansi16" ? "ansi" : sourceSpace;
-			if (sourceSpace === targetSpace) styles[name] = wrap(identity, offset);
-			else if (typeof suite === "object") styles[name] = wrap(suite[targetSpace], offset);
-		}
-		return styles;
-	};
-	function assembleStyles() {
-		const codes = /* @__PURE__ */ new Map();
-		const styles = {
-			modifier: {
-				reset: [0, 0],
-				bold: [1, 22],
-				dim: [2, 22],
-				italic: [3, 23],
-				underline: [4, 24],
-				inverse: [7, 27],
-				hidden: [8, 28],
-				strikethrough: [9, 29]
-			},
-			color: {
-				black: [30, 39],
-				red: [31, 39],
-				green: [32, 39],
-				yellow: [33, 39],
-				blue: [34, 39],
-				magenta: [35, 39],
-				cyan: [36, 39],
-				white: [37, 39],
-				blackBright: [90, 39],
-				redBright: [91, 39],
-				greenBright: [92, 39],
-				yellowBright: [93, 39],
-				blueBright: [94, 39],
-				magentaBright: [95, 39],
-				cyanBright: [96, 39],
-				whiteBright: [97, 39]
-			},
-			bgColor: {
-				bgBlack: [40, 49],
-				bgRed: [41, 49],
-				bgGreen: [42, 49],
-				bgYellow: [43, 49],
-				bgBlue: [44, 49],
-				bgMagenta: [45, 49],
-				bgCyan: [46, 49],
-				bgWhite: [47, 49],
-				bgBlackBright: [100, 49],
-				bgRedBright: [101, 49],
-				bgGreenBright: [102, 49],
-				bgYellowBright: [103, 49],
-				bgBlueBright: [104, 49],
-				bgMagentaBright: [105, 49],
-				bgCyanBright: [106, 49],
-				bgWhiteBright: [107, 49]
-			}
-		};
-		styles.color.gray = styles.color.blackBright;
-		styles.bgColor.bgGray = styles.bgColor.bgBlackBright;
-		styles.color.grey = styles.color.blackBright;
-		styles.bgColor.bgGrey = styles.bgColor.bgBlackBright;
-		for (const [groupName, group] of Object.entries(styles)) {
-			for (const [styleName, style] of Object.entries(group)) {
-				styles[styleName] = {
-					open: `\u001B[${style[0]}m`,
-					close: `\u001B[${style[1]}m`
-				};
-				group[styleName] = styles[styleName];
-				codes.set(style[0], style[1]);
-			}
-			Object.defineProperty(styles, groupName, {
-				value: group,
-				enumerable: false
-			});
-		}
-		Object.defineProperty(styles, "codes", {
-			value: codes,
-			enumerable: false
-		});
-		styles.color.close = "\x1B[39m";
-		styles.bgColor.close = "\x1B[49m";
-		setLazyProperty(styles.color, "ansi", () => makeDynamicStyles(wrapAnsi16, "ansi16", ansi2ansi, false));
-		setLazyProperty(styles.color, "ansi256", () => makeDynamicStyles(wrapAnsi256, "ansi256", ansi2ansi, false));
-		setLazyProperty(styles.color, "ansi16m", () => makeDynamicStyles(wrapAnsi16m, "rgb", rgb2rgb, false));
-		setLazyProperty(styles.bgColor, "ansi", () => makeDynamicStyles(wrapAnsi16, "ansi16", ansi2ansi, true));
-		setLazyProperty(styles.bgColor, "ansi256", () => makeDynamicStyles(wrapAnsi256, "ansi256", ansi2ansi, true));
-		setLazyProperty(styles.bgColor, "ansi16m", () => makeDynamicStyles(wrapAnsi16m, "rgb", rgb2rgb, true));
-		return styles;
-	}
-	Object.defineProperty(module, "exports", {
-		enumerable: true,
-		get: assembleStyles
-	});
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/supports-color@7.2.0/node_modules/supports-color/browser.js
-var require_browser = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	module.exports = {
-		stdout: false,
-		stderr: false
-	};
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/chalk@4.1.2/node_modules/chalk/source/util.js
-var require_util = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var stringReplaceAll = (string, substring, replacer) => {
-		let index = string.indexOf(substring);
-		if (index === -1) return string;
-		const substringLength = substring.length;
-		let endIndex = 0;
-		let returnValue = "";
-		do {
-			returnValue += string.substr(endIndex, index - endIndex) + substring + replacer;
-			endIndex = index + substringLength;
-			index = string.indexOf(substring, endIndex);
-		} while (index !== -1);
-		returnValue += string.substr(endIndex);
-		return returnValue;
-	};
-	var stringEncaseCRLFWithFirstIndex = (string, prefix, postfix, index) => {
-		let endIndex = 0;
-		let returnValue = "";
-		do {
-			const gotCR = string[index - 1] === "\r";
-			returnValue += string.substr(endIndex, (gotCR ? index - 1 : index) - endIndex) + prefix + (gotCR ? "\r\n" : "\n") + postfix;
-			endIndex = index + 1;
-			index = string.indexOf("\n", endIndex);
-		} while (index !== -1);
-		returnValue += string.substr(endIndex);
-		return returnValue;
-	};
-	module.exports = {
-		stringReplaceAll,
-		stringEncaseCRLFWithFirstIndex
-	};
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/chalk@4.1.2/node_modules/chalk/source/templates.js
-var require_templates = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var TEMPLATE_REGEX = /(?:\\(u(?:[a-f\d]{4}|\{[a-f\d]{1,6}\})|x[a-f\d]{2}|.))|(?:\{(~)?(\w+(?:\([^)]*\))?(?:\.\w+(?:\([^)]*\))?)*)(?:[ \t]|(?=\r?\n)))|(\})|((?:.|[\r\n\f])+?)/gi;
-	var STYLE_REGEX = /(?:^|\.)(\w+)(?:\(([^)]*)\))?/g;
-	var STRING_REGEX = /^(['"])((?:\\.|(?!\1)[^\\])*)\1$/;
-	var ESCAPE_REGEX = /\\(u(?:[a-f\d]{4}|{[a-f\d]{1,6}})|x[a-f\d]{2}|.)|([^\\])/gi;
-	var ESCAPES = /* @__PURE__ */ new Map([
-		["n", "\n"],
-		["r", "\r"],
-		["t", "	"],
-		["b", "\b"],
-		["f", "\f"],
-		["v", "\v"],
-		["0", "\0"],
-		["\\", "\\"],
-		["e", "\x1B"],
-		["a", "\x07"]
-	]);
-	function unescape(c) {
-		const u = c[0] === "u";
-		const bracket = c[1] === "{";
-		if (u && !bracket && c.length === 5 || c[0] === "x" && c.length === 3) return String.fromCharCode(parseInt(c.slice(1), 16));
-		if (u && bracket) return String.fromCodePoint(parseInt(c.slice(2, -1), 16));
-		return ESCAPES.get(c) || c;
-	}
-	function parseArguments(name, arguments_) {
-		const results = [];
-		const chunks = arguments_.trim().split(/\s*,\s*/g);
-		let matches;
-		for (const chunk of chunks) {
-			const number = Number(chunk);
-			if (!Number.isNaN(number)) results.push(number);
-			else if (matches = chunk.match(STRING_REGEX)) results.push(matches[2].replace(ESCAPE_REGEX, (m, escape, character) => escape ? unescape(escape) : character));
-			else throw new Error(`Invalid Chalk template style argument: ${chunk} (in style '${name}')`);
-		}
-		return results;
-	}
-	function parseStyle(style) {
-		STYLE_REGEX.lastIndex = 0;
-		const results = [];
-		let matches;
-		while ((matches = STYLE_REGEX.exec(style)) !== null) {
-			const name = matches[1];
-			if (matches[2]) {
-				const args = parseArguments(name, matches[2]);
-				results.push([name].concat(args));
-			} else results.push([name]);
-		}
-		return results;
-	}
-	function buildStyle(chalk, styles) {
-		const enabled = {};
-		for (const layer of styles) for (const style of layer.styles) enabled[style[0]] = layer.inverse ? null : style.slice(1);
-		let current = chalk;
-		for (const [styleName, styles] of Object.entries(enabled)) {
-			if (!Array.isArray(styles)) continue;
-			if (!(styleName in current)) throw new Error(`Unknown Chalk style: ${styleName}`);
-			current = styles.length > 0 ? current[styleName](...styles) : current[styleName];
-		}
-		return current;
-	}
-	module.exports = (chalk, temporary) => {
-		const styles = [];
-		const chunks = [];
-		let chunk = [];
-		temporary.replace(TEMPLATE_REGEX, (m, escapeCharacter, inverse, style, close, character) => {
-			if (escapeCharacter) chunk.push(unescape(escapeCharacter));
-			else if (style) {
-				const string = chunk.join("");
-				chunk = [];
-				chunks.push(styles.length === 0 ? string : buildStyle(chalk, styles)(string));
-				styles.push({
-					inverse,
-					styles: parseStyle(style)
-				});
-			} else if (close) {
-				if (styles.length === 0) throw new Error("Found extraneous } in Chalk template literal");
-				chunks.push(buildStyle(chalk, styles)(chunk.join("")));
-				chunk = [];
-				styles.pop();
-			} else chunk.push(character);
-		});
-		chunks.push(chunk.join(""));
-		if (styles.length > 0) {
-			const errMessage = `Chalk template literal is missing ${styles.length} closing bracket${styles.length === 1 ? "" : "s"} (\`}\`)`;
-			throw new Error(errMessage);
-		}
-		return chunks.join("");
-	};
-}));
-//#endregion
-//#region ../../node_modules/.pnpm/chalk@4.1.2/node_modules/chalk/source/index.js
-var require_source = /* @__PURE__ */ __commonJSMin(((exports, module) => {
-	var ansiStyles = require_ansi_styles();
-	var { stdout: stdoutColor, stderr: stderrColor } = require_browser();
-	var { stringReplaceAll, stringEncaseCRLFWithFirstIndex } = require_util();
-	var { isArray } = Array;
-	var levelMapping = [
-		"ansi",
-		"ansi",
-		"ansi256",
-		"ansi16m"
-	];
-	var styles = Object.create(null);
-	var applyOptions = (object, options = {}) => {
-		if (options.level && !(Number.isInteger(options.level) && options.level >= 0 && options.level <= 3)) throw new Error("The `level` option should be an integer from 0 to 3");
-		const colorLevel = stdoutColor ? stdoutColor.level : 0;
-		object.level = options.level === void 0 ? colorLevel : options.level;
-	};
-	var ChalkClass = class {
-		constructor(options) {
-			return chalkFactory(options);
-		}
-	};
-	var chalkFactory = (options) => {
-		const chalk = {};
-		applyOptions(chalk, options);
-		chalk.template = (...arguments_) => chalkTag(chalk.template, ...arguments_);
-		Object.setPrototypeOf(chalk, Chalk.prototype);
-		Object.setPrototypeOf(chalk.template, chalk);
-		chalk.template.constructor = () => {
-			throw new Error("`chalk.constructor()` is deprecated. Use `new chalk.Instance()` instead.");
-		};
-		chalk.template.Instance = ChalkClass;
-		return chalk.template;
-	};
-	function Chalk(options) {
-		return chalkFactory(options);
+}
+/** `add <pkg>` as a dev dependency, in the reader's own package manager. */
+function describeDevAddCommand(packageName, manager = detectProjectPackageManager()) {
+	switch (manager) {
+		case "npm": return `npm install -D ${packageName}`;
+		case "yarn": return `yarn add -D ${packageName}`;
+		case "bun": return `bun add -d ${packageName}`;
+		default: return `pnpm add -D ${packageName}`;
 	}
-	for (const [styleName, style] of Object.entries(ansiStyles)) styles[styleName] = { get() {
-		const builder = createBuilder(this, createStyler(style.open, style.close, this._styler), this._isEmpty);
-		Object.defineProperty(this, styleName, { value: builder });
-		return builder;
-	} };
-	styles.visible = { get() {
-		const builder = createBuilder(this, this._styler, true);
-		Object.defineProperty(this, "visible", { value: builder });
-		return builder;
-	} };
-	var usedModels = [
-		"rgb",
-		"hex",
-		"keyword",
-		"hsl",
-		"hsv",
-		"hwb",
-		"ansi",
-		"ansi256"
-	];
-	for (const model of usedModels) styles[model] = { get() {
-		const { level } = this;
-		return function(...arguments_) {
-			const styler = createStyler(ansiStyles.color[levelMapping[level]][model](...arguments_), ansiStyles.color.close, this._styler);
-			return createBuilder(this, styler, this._isEmpty);
-		};
-	} };
-	for (const model of usedModels) {
-		const bgModel = "bg" + model[0].toUpperCase() + model.slice(1);
-		styles[bgModel] = { get() {
-			const { level } = this;
-			return function(...arguments_) {
-				const styler = createStyler(ansiStyles.bgColor[levelMapping[level]][model](...arguments_), ansiStyles.bgColor.close, this._styler);
-				return createBuilder(this, styler, this._isEmpty);
-			};
-		} };
-	}
-	var proto = Object.defineProperties(() => {}, {
-		...styles,
-		level: {
-			enumerable: true,
-			get() {
-				return this._generator.level;
-			},
-			set(level) {
-				this._generator.level = level;
-			}
-		}
-	});
-	var createStyler = (open, close, parent) => {
-		let openAll;
-		let closeAll;
-		if (parent === void 0) {
-			openAll = open;
-			closeAll = close;
-		} else {
-			openAll = parent.openAll + open;
-			closeAll = close + parent.closeAll;
-		}
-		return {
-			open,
-			close,
-			openAll,
-			closeAll,
-			parent
-		};
-	};
-	var createBuilder = (self, _styler, _isEmpty) => {
-		const builder = (...arguments_) => {
-			if (isArray(arguments_[0]) && isArray(arguments_[0].raw)) return applyStyle(builder, chalkTag(builder, ...arguments_));
-			return applyStyle(builder, arguments_.length === 1 ? "" + arguments_[0] : arguments_.join(" "));
-		};
-		Object.setPrototypeOf(builder, proto);
-		builder._generator = self;
-		builder._styler = _styler;
-		builder._isEmpty = _isEmpty;
-		return builder;
-	};
-	var applyStyle = (self, string) => {
-		if (self.level <= 0 || !string) return self._isEmpty ? "" : string;
-		let styler = self._styler;
-		if (styler === void 0) return string;
-		const { openAll, closeAll } = styler;
-		if (string.indexOf("\x1B") !== -1) while (styler !== void 0) {
-			string = stringReplaceAll(string, styler.close, styler.open);
-			styler = styler.parent;
-		}
-		const lfIndex = string.indexOf("\n");
-		if (lfIndex !== -1) string = stringEncaseCRLFWithFirstIndex(string, closeAll, openAll, lfIndex);
-		return openAll + string + closeAll;
-	};
-	var template;
-	var chalkTag = (chalk, ...strings) => {
-		const [firstString] = strings;
-		if (!isArray(firstString) || !isArray(firstString.raw)) return strings.join(" ");
-		const arguments_ = strings.slice(1);
-		const parts = [firstString.raw[0]];
-		for (let i = 1; i < firstString.length; i++) parts.push(String(arguments_[i - 1]).replace(/[{}\\]/g, "\\$&"), String(firstString.raw[i]));
-		if (template === void 0) template = require_templates();
-		return template(chalk, parts.join(""));
-	};
-	Object.defineProperties(Chalk.prototype, styles);
-	var chalk = Chalk();
-	chalk.supportsColor = stdoutColor;
-	chalk.stderr = Chalk({ level: stderrColor ? stderrColor.level : 0 });
-	chalk.stderr.supportsColor = stderrColor;
-	module.exports = chalk;
-}));
-require___vite_browser_external();
-require_source();
-var moduleDir = path.dirname(fileURLToPath$1(import.meta.url));
-//#endregion
-//#region src/cli-helpers.ts
+}
+/**
+* Where a package's own manifest lives, or null if it is not installed here.
+*
+* `package.json` rather than the package root: a package with an `exports` map
+* that omits `.` is unresolvable by name even when it is perfectly installed,
+* which would misreport it as absent.
+*/
+function resolvePackageManifest(packageName) {
+	const bases = [pathToFileURL(path.join(process.cwd(), "package.json")), pathToFileURL(path.join(moduleDir, "package.json"))];
+	for (const base of bases) try {
+		return createRequire(base).resolve(`${packageName}/package.json`);
+	} catch {}
+	return null;
+}
+/**
+* The binaries a package's own manifest declares, as absolute paths.
+*
+* `bin` is a string for a single binary named after the package, or a map.
+* Both forms appear in the wild and `@ariga/atlas` uses the map.
+*/
+function declaredBinaries(manifestPath) {
+	let manifest;
+	try {
+		manifest = JSON.parse(fs.readFileSync(manifestPath, "utf8"));
+	} catch {
+		return [];
+	}
+	const dir = path.dirname(manifestPath);
+	if (typeof manifest.bin === "string") return [path.resolve(dir, manifest.bin)];
+	if (manifest.bin && typeof manifest.bin === "object") return Object.values(manifest.bin).filter((target) => typeof target === "string").map((target) => path.resolve(dir, target));
+	return [];
+}
+function diagnoseMissingBin(packageName) {
+	const manifestPath = resolvePackageManifest(packageName);
+	if (!manifestPath) return "not-installed";
+	const binaries = declaredBinaries(manifestPath);
+	if (binaries.length === 0) return "build-script-blocked";
+	return binaries.some((file) => fs.existsSync(file)) ? "bin-link-missing" : "build-script-blocked";
+}
 function resolveLocalBin(binName) {
 	let dir = moduleDir;
 	while (true) {
@@ -8648,397 +6417,676 @@ function resolveLocalBin(binName) {
 	} catch {}
 	return null;
 }
-//#endregion
-//#region src/backup/backup-logic.ts
+async function getTableIncludesFromCollections(allCollections) {
+	const { getTableName, resolveCollectionRelations, relationalCollections } = await import("@rebasepro/common");
+	const { isPostgresCollectionConfig } = await import("@rebasepro/types");
+	const collections = relationalCollections(allCollections);
+	const includes = [];
+	for (const col of collections) {
+		const tableName = getTableName(col);
+		const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : "public";
+		if (tableName) includes.push(`${schema}.${tableName}`);
+		const resolvedRelations = resolveCollectionRelations(col);
+		for (const relation of Object.values(resolvedRelations)) if (isManyToMany(relation)) {
+			const junctionTableName = relation.through.table;
+			const targetCollection = relation.target();
+			const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+			includes.push(`${targetSchema}.${junctionTableName}`);
+		}
+	}
+	return Array.from(new Set(includes));
+}
+async function getTableIncludes(collectionsPath) {
+	return getTableIncludesFromCollections(await loadCollectionsForCli(collectionsPath));
+}
 /**
-* Pure-ish orchestration for the backup/restore paths, kept free of `execa`
-* and `pg` value imports so it can be unit-tested under jest (the impure
-* edges — spawning processes, opening connections — live in
-* `backup-service.ts`, which is vitest/runtime only).
+* Load a project's collections the way the Atlas-facing commands need them.
 *
-* The functions here take their side-effecting dependency as an argument
-* (a statement runner, an object deleter) so tests can inject fakes.
+* Deliberately forgiving — a file that fails to import is skipped rather than
+* fatal — because the callers use this to *narrow* what Atlas may touch, and a
+* hard failure here would block a push over an unrelated broken file. Callers
+* that cannot tolerate a partial answer (the table excludes, which fail closed)
+* check the result themselves.
 */
+/** Paths this process has already complained about. See {@link loadCollectionsForCli}. */
+var warnedMissingCollectionsPaths = /* @__PURE__ */ new Set();
+async function loadCollectionsForCli(collectionsPath) {
+	const resolvedPath = path.resolve(collectionsPath);
+	const collections = [];
+	if (!fs.existsSync(resolvedPath) && !warnedMissingCollectionsPaths.has(resolvedPath)) {
+		warnedMissingCollectionsPaths.add(resolvedPath);
+		outWarn(chalk.yellow(`  ⚠  Collections path not found: "${collectionsPath}"\n     Resolved to: ${resolvedPath}\n     (relative to cwd: ${process.cwd()})\n     Pass an absolute path, or a path relative to where you run the command.`));
+	}
+	if (fs.existsSync(resolvedPath)) {
+		if (fs.statSync(resolvedPath).isDirectory()) {
+			const files = fs.readdirSync(resolvedPath);
+			for (const file of files) if ((file.endsWith(".ts") || file.endsWith(".js")) && !file.includes(".test.") && !file.endsWith(".d.ts") && file !== "index.ts" && file !== "index.js") try {
+				const module = await import(pathToFileURL(path.join(resolvedPath, file)).href);
+				if (module && module.default) collections.push(module.default);
+			} catch {}
+		}
+	}
+	return collections;
+}
+function getDevDatabaseUrl(databaseUrl) {
+	try {
+		const parsed = new URL(databaseUrl);
+		parsed.pathname = `/${parsed.pathname.slice(1)}_dev_diff`;
+		return parsed.toString();
+	} catch {
+		return databaseUrl + "_dev_diff";
+	}
+}
 /**
-* Replay a `pg_dumpall --globals-only` script one statement at a time,
-* tolerating per-statement failures. On a same-cluster restore the roles
-* usually already exist (`CREATE ROLE` → "already exists") and on a managed
-* provider an `ALTER ROLE <superuser>` may be refused; neither should abort
-* recreation of the roles that *are* missing. Returns how many statements
-* applied vs were skipped.
+* Create the scratch database Atlas plans against, and say so when we cannot.
 *
-* `runStatement` executes one SQL statement and rejects on error.
+* Atlas needs a `--dev-url` — an empty database it can build the desired state
+* in — and this makes `<db>_dev_diff` next to the real one. The whole body used
+* to be wrapped in an empty catch commented "Ignore, let Atlas handle
+* connection failures", and Atlas's version of handling it is `postgres:
+* querying system variables: pq: database "app_dev_diff" does not exist
+* (3D000)` — the symptom, four frames downstream of the cause, with the cause
+* thrown away.
+*
+* The cause is almost always `42501`: `CREATE DATABASE` is a privilege managed
+* providers do not grant, so this is the first thing a hosted user hits and the
+* one they can do least with.
+*
+* @returns whether the scratch database was created by *this* call — the only
+*          case in which dropping it afterwards is ours to do.
 */
-async function applyGlobalsWith(runStatement, globalsSql, log = () => {}) {
-	let applied = 0;
-	let skipped = 0;
-	for (const statement of splitGlobalsStatements(globalsSql)) try {
-		await runStatement(statement);
-		applied++;
+async function ensureDevDatabaseExists(databaseUrl, devDatabaseUrl) {
+	let devDbName = "";
+	try {
+		const { Client } = await import("pg");
+		const parsed = new URL(databaseUrl);
+		devDbName = new URL(devDatabaseUrl).pathname.slice(1);
+		parsed.pathname = "/postgres";
+		const client = new Client({ connectionString: parsed.toString() });
+		await client.connect();
+		try {
+			if ((await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [devDbName])).rowCount === 0) {
+				await client.query(`CREATE DATABASE "${devDbName}"`);
+				out(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
+				return true;
+			}
+		} finally {
+			await client.end();
+		}
 	} catch (err) {
-		skipped++;
-		log(`  • Skipped global: ${statement.split("\n")[0].slice(0, 80)} (${err instanceof Error ? err.message : String(err)})`);
+		outWarn(describeDevDatabaseFailure(err, devDbName || "<db>_dev_diff"));
 	}
-	return {
-		applied,
-		skipped
-	};
+	return false;
 }
 /**
-* Delete each pruned dump together with its `.globals.sql` roles sidecar, so
-* pruning never orphans the roles file. The sidecar is best-effort — older
-* backups predate it, so a missing-sidecar failure is swallowed while a
-* failure deleting the dump itself propagates.
+* What went wrong creating the scratch database, and what to do about it.
 *
-* `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+* Exported for its test: the `42501` branch is the one that matters and it
+* cannot be provoked without a non-superuser role.
 */
-async function pruneWith(keys, deleteObject) {
-	for (const key of keys) {
-		await deleteObject(key);
-		try {
-			await deleteObject(globalsFileForDump(key));
-		} catch {}
-	}
+function describeDevDatabaseFailure(err, devDbName) {
+	const code = err?.code;
+	const message = err instanceof Error ? err.message : String(err);
+	const lines = [chalk.yellow(`  ⚠  Could not create the Atlas scratch database "${devDbName}": ${message}`)];
+	if (code === "42501") lines.push(chalk.gray(`     Atlas plans every change in a throwaway copy of the schema, and CREATE DATABASE
+     is a privilege most managed providers withhold. Two ways forward:
+       • GRANT the role CREATEDB:  ALTER ROLE "<role>" CREATEDB;
+       • or create it once by hand:  CREATE DATABASE "${devDbName}";`));
+	else lines.push(chalk.gray("     Atlas will fail next with `database \"" + devDbName + "\" does not exist (3D000)`, which is this."));
+	return lines.join("\n");
 }
 /**
-* Remove a dump artifact abandoned by a failed tool run.
-*
-* `pg_dump` creates its `--file=` target before it finishes connecting, so any
-* failure — a URL libpq rejects, a dropped connection, a full disk — leaves a
-* 0-byte file behind. That corpse is not inert: `rebase db backups list` used
-* to show it as an ordinary entry, and `selectBackupsToPrune` ranks by
-* timestamp alone, so it occupies a protected `keepMinimum` slot and can push
-* a real backup out of retention.
-*
-* Best-effort on purpose: the caller is already throwing, and a failed unlink
-* must not replace the real diagnosis with an ENOENT/EPERM from the cleanup.
+* Drop the scratch database again, after the command that needed it succeeded.
 *
-* Lives here rather than in `backup-service.ts` for the reason at the top of
-* this file — that module's top-level `execa` import makes it unloadable under
-* jest, so anything placed there cannot be unit-tested.
+* It is a full copy of the schema — no rows, but every table, type and index —
+* and it was left behind per target forever. The only notice anyone got was
+* `rebase db branch prune` reporting "3 Atlas scratch database(s) left over
+* from db push", and on a provider that bills per database it is a silent cost.
 *
-* `remove` deletes one file and throws if it cannot; `exists` reports presence.
+* Deliberately NOT called on the failure path: after a failed push the scratch
+* database holds the state Atlas was planning against, which is the one thing
+* worth inspecting.
 */
-function discardPartialDumpWith(exists, remove, file) {
+async function dropDevDatabase(databaseUrl, devDatabaseUrl) {
 	try {
-		if (exists(file)) remove(file);
-	} catch {}
+		const { Client } = await import("pg");
+		const parsed = new URL(databaseUrl);
+		const devDbName = new URL(devDatabaseUrl).pathname.slice(1);
+		parsed.pathname = "/postgres";
+		const client = new Client({ connectionString: parsed.toString() });
+		await client.connect();
+		try {
+			await client.query(`DROP DATABASE IF EXISTS "${devDbName}"`);
+			out(chalk.gray(`  ✓ Removed validation database "${devDbName}"`));
+		} finally {
+			await client.end();
+		}
+	} catch (err) {
+		outWarn(chalk.gray(`  ⚠  Could not remove the Atlas scratch database: ${err instanceof Error ? err.message : String(err)}\n     \`rebase db branch prune --include-dev-diff\` clears them.`));
+	}
 }
-//#endregion
-//#region src/backup/backup-service.ts
 /**
-* Backup / restore orchestration: thin, well-typed wrappers around
-* `pg_dump` and `pg_restore`, plus binary detection, version pre-flight,
-* and upload/prune against a storage backend.
+* The generated SQL for the project's `search` blocks, if it has any.
 *
-* The pure argument- and policy-logic lives in `pg-tools.ts` and
-* `retention.ts`; this module is the impure edge (spawns processes, talks
-* to Postgres and storage) and is intentionally kept small.
+* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
+*        under the working directory.
 */
-var backup_service_exports = /* @__PURE__ */ __exportAll({
-	BackupToolError: () => BackupToolError,
-	applyGlobals: () => applyGlobals,
-	createDump: () => createDump,
-	detectToolMajor: () => detectToolMajor,
-	discardPartialDump: () => discardPartialDump,
-	ensureDatabaseExists: () => ensureDatabaseExists,
-	getServerVersionMajor: () => getServerVersionMajor,
-	listBackups: () => listBackups,
-	preflight: () => preflight,
-	pruneBackups: () => pruneBackups,
-	resolvePgBinary: () => resolvePgBinary,
-	restoreDump: () => restoreDump,
-	uploadBackup: () => uploadBackup,
-	validateDump: () => validateDump
-});
+function readSearchDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
+	const searchFile = path.join(drizzleDir, "search.sql");
+	if (!fs.existsSync(searchFile)) return "";
+	return fs.readFileSync(searchFile, "utf-8").trim();
+}
 /**
-* Remove a dump artifact abandoned by a failed tool run. See
-* {@link discardPartialDumpWith} for why this exists and why the logic lives
-* in the execa-free module.
+* Bring the search column, its index and their helpers up to date.
+*
+* Runs *after* Atlas, not before: the statements are `ALTER TABLE ... ADD
+* COLUMN`, so the table has to exist. Atlas is told to ignore these objects
+* entirely (`getSearchExcludes`) — it cannot manage them, and left to itself it
+* would plan a `DROP COLUMN` for every one, since they are absent from the
+* desired state it was given.
+*
+* A no-op when no collection declared `search`. A failure is *not* swallowed:
+* silently pushing a schema whose search column never appeared is how a
+* collection ends up with search configured, no error anywhere, and no results.
 */
-function discardPartialDump(file) {
-	discardPartialDumpWith((f) => fs.existsSync(f), (f) => fs.unlinkSync(f), file);
-}
-var BackupToolError = class extends Error {
-	hint;
-	constructor(message, hint) {
-		super(message);
-		this.hint = hint;
-		this.name = "BackupToolError";
-	}
-};
-/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
-function resolvePgBinary(tool, env = process.env) {
-	const overrideVar = tool === "pg_dump" ? env.PG_DUMP_PATH : tool === "pg_restore" ? env.PG_RESTORE_PATH : env.PG_DUMPALL_PATH;
-	if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;
-	return resolveLocalBin(tool);
-}
-/** Run `<bin> --version` and extract the major version. */
-async function detectToolMajor(bin) {
-	try {
-		const { stdout } = await execa(bin, ["--version"]);
-		return parsePgToolMajor(stdout);
-	} catch {
-		return null;
-	}
-}
-/** Query the server for its major version via `server_version_num`. */
-async function getServerVersionMajor(connectionString) {
+async function applySearchDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
+	const sql = readSearchDdl(drizzleDir);
+	if (!sql) return;
 	const { Client } = await import("pg");
-	const client = new Client({ connectionString });
+	const client = new Client({ connectionString: databaseUrl });
 	await client.connect();
 	try {
-		const raw = (await client.query("SHOW server_version_num")).rows?.[0]?.server_version_num;
-		return serverVersionNumToMajor(raw);
+		await client.query(sql);
 	} finally {
 		await client.end();
 	}
+	out(chalk.gray("  ✓ Applied full-text search columns and indexes"));
 }
 /**
-* Verify the requested client tool exists and its major version is
-* compatible with the live server. Throws {@link BackupToolError} — with a
-* doctor-style hint — when the binary is missing.
+* Glob patterns keeping Atlas away from the search objects.
+*
+* Returns an empty list — and so changes nothing — for a project with no
+* `search` block, which is every project that has not opted in.
 */
-async function preflight(tool, connectionString, env = process.env) {
-	const bin = resolvePgBinary(tool, env);
-	if (!bin) throw new BackupToolError(`Could not find the '${tool}' binary.`, `Install the PostgreSQL client tools (e.g. 'brew install libpq' or 'apt-get install postgresql-client'), or set ${tool === "pg_dump" ? "PG_DUMP_PATH" : "PG_RESTORE_PATH"} to its full path.`);
-	const [toolMajor, serverMajor] = await Promise.all([detectToolMajor(bin), getServerVersionMajor(connectionString)]);
-	return {
-		bin,
-		toolMajor,
-		serverMajor,
-		...checkToolServerCompatibility(toolMajor, serverMajor)
-	};
+async function getSearchExcludes(collectionsPath) {
+	const { searchExcludePatterns } = await import("./generate-postgres-ddl-logic-CtnpIBVv.js").then((n) => n.o);
+	return searchExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
-* Produce a custom-format dump on local disk. When `outDir` is omitted the
-* file is written to the OS temp directory (used by the upload path, which
-* cleans it up afterwards).
+* The generated SQL for the project's `vector` properties, if it has any.
 *
-* Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
-* `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
-* depend on can be recreated on restore. Set `includeGlobals: false` to skip
-* it (e.g. when the caller has no privilege to read cluster globals).
+* @param drizzleDir directory holding the generated SQL. Defaults to `drizzle`
+*        under the working directory.
 */
-async function createDump(opts) {
-	const env = opts.env ?? process.env;
-	const bin = resolvePgBinary("pg_dump", env);
-	if (!bin) throw new BackupToolError("Could not find the 'pg_dump' binary.", "Install the PostgreSQL client tools or set PG_DUMP_PATH.");
-	const fileName = opts.fileName ?? buildBackupFilename(opts.dbName);
-	const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), "rebase-backup-"));
-	fs.mkdirSync(outDir, { recursive: true });
-	const localFile = path.join(outDir, fileName);
-	const args = buildPgDumpArgs({
-		connectionString: opts.connectionString,
-		outFile: localFile,
-		excludeSchemas: opts.excludeSchemas,
-		noOwner: opts.noOwner,
-		rowSecurity: opts.rowSecurity
-	});
-	const dumpEnv = { ...env };
-	if (opts.rowSecurity) dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)].filter(Boolean).join(" ");
-	try {
-		await execa(bin, args, {
-			stdio: opts.inheritStdio ? "inherit" : "pipe",
-			env: dumpEnv
-		});
-	} catch (error) {
-		discardPartialDump(localFile);
-		const diagnosis = diagnoseRowSecurityDumpFailure(error);
-		if (!diagnosis) throw error;
-		throw new BackupToolError(diagnosis, "Run `rebase db backup --help` for the flag, and read what it says about partial dumps.");
-	}
-	const result = {
-		localFile,
-		fileName,
-		sizeBytes: fs.existsSync(localFile) ? fs.statSync(localFile).size : 0
-	};
-	if (opts.includeGlobals !== false) {
-		const dumpallBin = resolvePgBinary("pg_dumpall", env);
-		if (!dumpallBin) throw new BackupToolError("Could not find the 'pg_dumpall' binary needed to capture cluster roles.", "Install the PostgreSQL client tools or set PG_DUMPALL_PATH. To take a role-incomplete backup anyway, pass includeGlobals: false.");
-		const globalsFile = globalsFileForDump(localFile);
-		try {
-			await execa(dumpallBin, buildPgDumpallGlobalsArgs({
-				connectionString: opts.connectionString,
-				outFile: globalsFile
-			}), {
-				stdio: opts.inheritStdio ? "inherit" : "pipe",
-				env: { ...env }
-			});
-		} catch (error) {
-			discardPartialDump(globalsFile);
-			discardPartialDump(localFile);
-			throw error;
-		}
-		result.globalsFile = globalsFile;
-		result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
-	}
-	return result;
+function readVectorDdl(drizzleDir = path.resolve(process.cwd(), "drizzle")) {
+	const vectorFile = path.join(drizzleDir, "vector.sql");
+	if (!fs.existsSync(vectorFile)) return "";
+	return fs.readFileSync(vectorFile, "utf-8").trim();
 }
 /**
-* Cheap integrity check on a freshly written dump: it must be non-empty and
-* `pg_restore --list` must parse its table of contents without error. Used
-* before pruning older backups so a corrupt-but-exit-0 dump never becomes
-* the reason the last good backup is deleted.
+* Install pgvector and bring the vector columns and their ANN indexes up to
+* date.
+*
+* Runs *after* Atlas, like {@link applySearchDdl} and for the same reason: the
+* statements are `ALTER TABLE … ADD COLUMN`, so the table has to exist. Atlas
+* is told to ignore these objects entirely ({@link getVectorExcludes}) — it
+* cannot manage a type its dev database is structurally incapable of having,
+* and left to itself it would plan a `DROP COLUMN` for every one.
+*
+* A no-op when no collection declares a `vector` property. A failure is *not*
+* swallowed: a push that reported success while the embedding column never
+* appeared is how a project ends up with vector search configured, no error
+* anywhere, and no results.
 */
-async function validateDump(localFile, env = process.env) {
-	if (!fs.existsSync(localFile)) return {
-		ok: false,
-		reason: `Dump file does not exist: ${localFile}`
-	};
-	if (fs.statSync(localFile).size === 0) return {
-		ok: false,
-		reason: "Dump file is empty (0 bytes)."
-	};
-	const bin = resolvePgBinary("pg_restore", env);
-	if (!bin) return {
-		ok: false,
-		reason: "Could not find 'pg_restore' to verify the dump."
-	};
+async function applyVectorDdl(databaseUrl, drizzleDir = path.resolve(process.cwd(), "drizzle")) {
+	const sql = readVectorDdl(drizzleDir);
+	if (!sql) return;
+	const { vectorExtensionHint } = await import("./vector-index-DkWxm2de.js").then((n) => n.f);
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString: databaseUrl });
+	await client.connect();
 	try {
-		await execa(bin, buildPgRestoreListArgs(localFile), {
-			stdio: "pipe",
-			env: { ...env }
-		});
-		return { ok: true };
+		await client.query(sql);
 	} catch (err) {
-		return {
-			ok: false,
-			reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}`
-		};
+		const message = err instanceof Error ? err.message : String(err);
+		const hint = vectorExtensionHint(message);
+		if (!hint) throw err;
+		throw new Error(`${message}${hint}`, { cause: err });
+	} finally {
+		await client.end();
 	}
+	out(chalk.gray("  ✓ Applied vector columns and ANN indexes"));
+}
+/**
+* Glob patterns keeping Atlas away from the vector objects.
+*
+* Returns an empty list — and so changes nothing — for a project with no
+* `vector` property, which is every project that has not opted in.
+*/
+async function getVectorExcludes(collectionsPath) {
+	const { vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-CtnpIBVv.js").then((n) => n.o);
+	return vectorExcludePatterns(await loadCollectionsForCli(collectionsPath));
 }
 /**
-* Replay a `pg_dumpall --globals-only` script to recreate cluster roles
-* before a restore, so the dump's GRANT/RLS statements (which reference
-* `rebase_user` and any owner roles) actually apply. Runs statement by
-* statement and tolerates per-statement failures — on a same-cluster restore
-* the roles usually already exist (`CREATE ROLE` → "already exists"), and on
-* a managed provider an `ALTER ROLE <superuser>` may be refused; neither
-* should abort role recreation. Returns how many statements applied vs were
-* skipped.
+* Query the live database for every user table/view outside the system
+* catalogs. Separated from {@link getTableExcludes} so its failure mode can
+* be handled explicitly (fail closed) and so tests can inject a stub.
+*/
+/**
+* Every index Postgres holds on a table Rebase manages, as
+* `schema.table.index`.
+*
+* Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
+* *constraint* to Atlas, diffed from the constraint declaration, and naming its
+* index in an exclude would shield the constraint itself.
 */
-async function applyGlobals(connectionString, globalsSql, log = () => {}) {
+async function queryExistingIndexes(databaseUrl) {
 	const { Client } = await import("pg");
-	const client = new Client({ connectionString });
+	const client = new Client({ connectionString: databaseUrl });
 	await client.connect();
 	try {
-		return await applyGlobalsWith(async (sql) => {
-			await client.query(sql);
-		}, globalsSql, log);
+		return (await client.query(`
+            SELECT n.nspname || '.' || t.relname || '.' || i.relname AS full_name
+            FROM pg_index x
+            JOIN pg_class i ON i.oid = x.indexrelid
+            JOIN pg_class t ON t.oid = x.indrelid
+            JOIN pg_namespace n ON n.oid = t.relnamespace
+            WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+              AND t.relkind IN ('r', 'p')
+              AND NOT EXISTS (
+                  SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid
+              );
+        `)).rows.map((row) => row.full_name);
 	} finally {
 		await client.end();
 	}
 }
 /**
-* Restore a custom-format dump into the database named by
-* `connectionString`. Destructive when `clean` is set (drops objects
-* first). Never called automatically — the CLI gates it behind explicit
-* confirmation.
+* Glob patterns keeping Atlas away from indexes that are not Rebase's.
+*
+* The problem this solves is live and predates the `indexes:` block. `db push`
+* is declarative, so an index on a managed table that is absent from
+* `schema.sql` is drift — and Atlas plans `DROP INDEX` for it. Verified
+* against atlas v1.2.3: create one by hand, re-run an unchanged push, and the
+* plan is a bare drop. `DROP INDEX` is not in `DESTRUCTIVE_PATTERNS`, so the
+* auto-approved apply took it without asking. Until now the only way to have
+* an index at all was to write it by hand, which made that the *only* outcome.
 *
-* Runs with `--exit-on-error` by default: a restore that logs-and-continues
-* past a failed GRANT (because a role was missing) reports success with RLS
-* un-enforced. Callers should recreate roles first (see {@link applyGlobals})
-* and only set `exitOnError: false` deliberately.
+* Ownership rather than a prompt, because once indexes are declarable a drop
+* is usually correct: removing one from the config should remove it from the
+* database, quietly. What must never be dropped is an index Rebase never
+* created — a hand-written one, or one an introspected database arrived with.
+* {@link isRebaseIndexName} is the test, the same arrangement
+* `isGeneratedPolicyName` uses to let policy reconciliation drop only what it
+* generated.
+*
+* The named-in-the-desired-state check comes first and is what makes removal
+* work: a declared index that the author has just deleted still matches the
+* name pattern, is no longer in the plan, and so is *not* excluded — Atlas
+* drops it, as intended.
+*
+* Three-part `schema.table.index`, never two: a two-part pattern reads as a
+* *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
+* reports no error — the trap already recorded for the search excludes.
 */
-async function restoreDump(opts) {
-	const env = opts.env ?? process.env;
-	const bin = resolvePgBinary("pg_restore", env);
-	if (!bin) throw new BackupToolError("Could not find the 'pg_restore' binary.", "Install the PostgreSQL client tools or set PG_RESTORE_PATH.");
-	await execa(bin, buildPgRestoreArgs({
-		connectionString: opts.connectionString,
-		inputFile: opts.inputFile,
-		clean: opts.clean,
-		noOwner: opts.noOwner,
-		exitOnError: opts.exitOnError
-	}), {
-		stdio: opts.inheritStdio ? "inherit" : "pipe",
-		env: { ...env }
+async function getForeignIndexExcludes(databaseUrl, collectionsPath, deps = {}) {
+	const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;
+	const managed = await (deps.getManagedIndexNames ?? managedIndexNames)(collectionsPath);
+	let existing;
+	try {
+		existing = await queryIndexes(databaseUrl);
+	} catch (err) {
+		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`, err);
+	}
+	return existing.filter((full) => {
+		const indexName = full.slice(full.lastIndexOf(".") + 1);
+		if (managed.has(indexName)) return false;
+		return !isRebaseIndexName(indexName);
 	});
 }
 /**
-* Create a database (if absent) by connecting to the maintenance
-* `postgres` database. Used by `restore --create-db`.
+* The index names the current collections would create — search, vector and
+* declared alike. Anything Atlas would emit is by definition not foreign.
 */
-async function ensureDatabaseExists(adminConnectionString, dbName) {
+async function managedIndexNames(collectionsPath) {
+	const collections = await loadCollectionsForCli(collectionsPath);
+	const { resolveColumnName, searchExcludePatterns, vectorExcludePatterns } = await import("./generate-postgres-ddl-logic-CtnpIBVv.js").then((n) => n.o);
+	const { buildCollectionIndexPlan } = await import("./collection-index-BHgT_TKd.js").then((n) => n.a);
+	const names = new Set(buildCollectionIndexPlan(collections, resolveColumnName).map((spec) => spec.indexName));
+	for (const pattern of [...searchExcludePatterns(collections), ...vectorExcludePatterns(collections)]) names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
+	return names;
+}
+async function queryExistingTables(databaseUrl) {
 	const { Client } = await import("pg");
-	const parsed = new URL(adminConnectionString);
-	parsed.pathname = "/postgres";
-	const client = new Client({ connectionString: parsed.toString() });
+	const client = new Client({ connectionString: databaseUrl });
 	await client.connect();
 	try {
-		const existing = await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [dbName]);
-		if (existing.rowCount && existing.rowCount > 0) return false;
-		if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(dbName)) throw new BackupToolError(`Invalid database name: "${dbName}"`);
-		await client.query(`CREATE DATABASE "${dbName}"`);
-		return true;
+		return (await client.query(`
+            SELECT table_schema || '.' || table_name AS full_name
+            FROM information_schema.tables
+            WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+              AND table_type IN ('BASE TABLE', 'VIEW');
+        `)).rows.map((row) => row.full_name);
 	} finally {
 		await client.end();
 	}
 }
 /**
-* Upload a local dump to object storage under the destination's prefix.
-* Backups may contain secrets/PII, so the object is written with a
-* private/octet-stream content type; bucket-level ACLs must stay private.
+* Raised when the exclude list could not be built. `db push` MUST abort on
+* this rather than continue: the exclude list is the only thing shielding
+* non-collection (user/system) tables from the auto-approved declarative
+* apply. A partial list — the old fail-open behaviour — meant a transient
+* introspection hiccup dropped every table not present in `schema.sql`.
 */
-async function uploadBackup(storage, localFile, dest) {
-	const fileName = path.basename(localFile);
-	const key = joinStorageKey(dest.prefix, fileName);
-	const buffer = fs.readFileSync(localFile);
-	const file = new File([buffer], fileName, { type: "application/octet-stream" });
-	return {
-		key,
-		storageUrl: (await storage.putObject({
-			file,
-			key,
-			bucket: dest.bucket,
-			metadata: { "rebase-backup": "1" }
-		})).storageUrl
-	};
-}
+var ExcludeIntrospectionError = class extends Error {
+	cause;
+	constructor(message, cause) {
+		super(message);
+		this.cause = cause;
+		this.name = "ExcludeIntrospectionError";
+	}
+};
 /**
-* List existing backups at a destination. For local destinations reads the
-* directory; for object storage lists the prefix via the controller.
+* Build the `--exclude` list that protects tables Rebase doesn't manage from
+* the declarative apply. Anything not backing a collection (or its M2M
+* junctions) is excluded so Atlas never drops it.
+*
+* Fails **closed**: if the database can't be introspected we cannot know
+* which tables to protect, so we throw {@link ExcludeIntrospectionError}
+* instead of returning a near-empty list and letting the caller drop
+* everything.
+*
+* `deps` is injectable for tests; production uses the real pg-backed queries.
 */
-async function listBackups(dest, storage) {
-	if (dest.kind === "local") {
-		if (!fs.existsSync(dest.path)) return [];
-		const dir = fs.statSync(dest.path).isDirectory() ? dest.path : path.dirname(dest.path);
-		return fs.readdirSync(dir).filter((f) => f.endsWith(".dump")).map((f) => {
-			const full = path.join(dir, f);
-			const stats = fs.statSync(full);
-			return {
-				key: full,
-				createdAt: parseBackupTimestamp(f) ?? stats.mtime,
-				sizeBytes: stats.size
-			};
-		}).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
-	}
-	if (!storage) throw new BackupToolError(`Listing ${dest.kind} backups requires a configured storage backend.`);
-	return (await storage.listObjects(dest.prefix ? `${dest.prefix}/` : "", {
-		bucket: dest.bucket,
-		maxResults: 1e3
-	})).items.map((item) => item.fullPath).filter((key) => key.endsWith(".dump")).map((key) => ({
-		key,
-		createdAt: parseBackupTimestamp(key) ?? void 0
-	})).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
+async function getTableExcludes(databaseUrl, collectionsPath, deps = {}) {
+	const getIncludes = deps.getIncludes ?? getTableIncludes;
+	const queryTables = deps.queryExistingTables ?? queryExistingTables;
+	const includes = await getIncludes(collectionsPath);
+	const excludes = [
+		"atlas_schema_revisions.*",
+		"auth",
+		"auth.*",
+		"rebase",
+		"rebase.*"
+	];
+	let existingTables;
+	try {
+		existingTables = await queryTables(databaseUrl);
+	} catch (err) {
+		throw new ExcludeIntrospectionError(`Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`, err);
+	}
+	for (const table of existingTables) if (!includes.includes(table)) excludes.push(table);
+	return excludes;
 }
 /**
-* Apply a retention policy to a destination, deleting the backups selected
-* by {@link selectBackupsToPrune}. Returns the keys that were removed.
+* Ask a yes/no question on an interactive terminal.
+*
+* The `isTTY` guard is the contract, not an optimisation: non-interactive
+* shells (CI, pipes, agents) can never answer, and `readline` on a
+* non-TTY stdin resolves with whatever the pipe happens to contain — or never
+* resolves at all. Returning false there is what makes an unattended
+* `db push` abort instead of auto-confirming a destructive change. Callers
+* should already have gone through {@link decidePushSafety}, which decides
+* whether interactive confirmation is even possible; this is the backstop.
+*
+* Lives here rather than in cli.ts so it is reachable from a test — cli.ts uses
+* `import.meta` and cannot be imported by the jest runner.
 */
-async function pruneBackups(dest, options, storage) {
-	const toDelete = selectBackupsToPrune(await listBackups(dest, storage), options);
-	await pruneWith(toDelete, dest.kind === "local" ? async (key) => {
-		if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);
-		fs.unlinkSync(key);
-	} : async (key) => {
-		if (!storage) throw new BackupToolError("Storage backend required to prune object backups.");
-		await storage.deleteObject(key, dest.bucket);
+async function promptConfirm(question) {
+	if (!process.stdin.isTTY) return false;
+	const rl = import___vite_browser_external.default.createInterface({
+		input: process.stdin,
+		output: process.stdout
 	});
-	return toDelete;
+	try {
+		const answer = await new Promise((resolve) => rl.question(question, resolve));
+		return /^y(es)?$/i.test(answer.trim());
+	} finally {
+		rl.close();
+	}
+}
+//#endregion
+//#region src/schema/rls-bootstrap-sql.ts
+var rls_bootstrap_sql_exports = /* @__PURE__ */ __exportAll({
+	DROP_LEGACY_AUTH_SCHEMA_SQL: () => DROP_LEGACY_AUTH_SCHEMA_SQL,
+	LEGACY_RLS_DEPENDENTS_SQL: () => LEGACY_RLS_DEPENDENTS_SQL,
+	LEGACY_RLS_FUNCTION_DEPENDENTS_SQL: () => LEGACY_RLS_FUNCTION_DEPENDENTS_SQL,
+	RLS_BOOTSTRAP_SQL: () => RLS_BOOTSTRAP_SQL,
+	RLS_BOOTSTRAP_STATEMENTS: () => RLS_BOOTSTRAP_STATEMENTS,
+	dropLegacyAuthSchema: () => dropLegacyAuthSchema
+});
+/**
+* Canonical SQL bootstrap for the RLS helper functions.
+*
+* Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /
+* `rebase.jwt()`, so any SQL stream that can contain policies must be
+* self-contained: it has to (re)create these helpers first. This matters for
+* the migration directory in particular — Atlas replays migrations against a
+* clean dev database where no out-of-band bootstrap has ever run, so a
+* migration carrying policies without this preamble fails with
+* "function rebase.uid() does not exist".
+*
+* Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every
+* policies block and re-applied freely. The runtime boot path
+* (`auth/ensure-tables.ts`) creates the same functions under an advisory lock
+* for HMR-safety; keep the definitions in sync.
+*
+* ## Creating the `rebase` schema here is now safe, and required
+*
+* It deliberately did not, once. These functions lived in a schema called
+* `auth`, and the note here read: creating `rebase` would leak it into Atlas's
+* replayed migration state, and — absent from the desired `schema.sql` — Atlas
+* would then plan `DROP SCHEMA "rebase" CASCADE`, taking the auth tables with
+* it. That reasoning still holds; what changed is the second half of it. The
+* DDL generator now emits `CREATE SCHEMA IF NOT EXISTS "rebase"`
+* unconditionally, so the schema is always in the desired state and the diff is
+* empty. (It used to appear only when some collection happened to declare
+* `schema: "rebase"` — true for the scaffold's users collection, and not a
+* property anything guaranteed.) `db push` additionally excludes the whole
+* schema from the declarative apply.
+*
+* See `@rebasepro/types`' `rls-functions` for why the functions moved out of
+* `auth` at all: the short version is that the name was Supabase's, and
+* `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over
+* Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be
+* swallowed.
+*/
+/**
+* The bootstrap as individual statements.
+*
+* Kept as an array because the two consumers need different shapes and only one
+* of them can take a multi-command string: the migration preamble is written to
+* a file and replayed by Atlas, but the boot path runs through drizzle, whose
+* node-postgres handle speaks the extended query protocol and rejects more than
+* one command per call. Splitting a joined string back apart on `$$;` would be
+* a parser for a problem that does not need one.
+*/
+var RLS_BOOTSTRAP_STATEMENTS = [
+	`CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.uid', true), ''),
+        NULLIF(current_setting('app.user_id', true), '')
+    );
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.jwt', true), ''),
+        '{}'
+    )::jsonb;
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$
+    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
+$$ LANGUAGE sql STABLE`,
+	`CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.is_anonymous() RETURNS boolean AS $$
+    SELECT COALESCE(NULLIF(current_setting('app.is_anonymous', true), ''), 'false')::boolean;
+$$ LANGUAGE sql STABLE`
+];
+/** The same statements as one script, for migration files and raw clients. */
+var RLS_BOOTSTRAP_SQL = "-- Rebase schema + RLS helper functions (required by the policies below)\n" + RLS_BOOTSTRAP_STATEMENTS.map((s) => `${s};`).join("\n\n") + "\n";
+/**
+* Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
+*
+* ## Why this is safe against a Supabase database
+*
+* Two independent guards, and both have to pass:
+*
+*  1. **Each function is identified before it is dropped.** Ours returns `text`
+*     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
+*     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
+*     so a Supabase database — where our `CREATE OR REPLACE` could never have
+*     succeeded in the first place, Postgres refusing to change a return type —
+*     matches nothing and this is a no-op.
+*  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
+*     lives in `auth` (Supabase's `users` table, its other helpers), the drop
+*     fails and the schema stays. CASCADE here would be unrecoverable.
+*
+* ## Why it cannot run too early
+*
+* Postgres records a dependency from every RLS policy to the functions its body
+* calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy
+* still references it. That is the interlock, and it is load-bearing: the drop
+* can only succeed once every policy has been recompiled to \`rebase.uid()\`.
+* Callers therefore run this *after* applying policies, and treat a failure as
+* "not yet — try again next boot" rather than as an error.
+*/
+var DROP_LEGACY_AUTH_SCHEMA_SQL = `
+DO $rebase_drop_legacy$
+DECLARE
+    dropped_any boolean := false;
+BEGIN
+    -- Each function is matched on its own result type and body, so a schema
+    -- that merely shares the name keeps everything it has.
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'uid'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.uid%'
+    ) THEN
+        DROP FUNCTION auth.uid();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
+          AND pg_get_function_result(p.oid) = 'jsonb'
+          AND p.prosrc LIKE '%app.jwt%'
+    ) THEN
+        DROP FUNCTION auth.jwt();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'roles'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.user_roles%'
+    ) THEN
+        DROP FUNCTION auth.roles();
+        dropped_any := true;
+    END IF;
+
+    -- RESTRICT: only an empty schema goes. Anything else in there — including a
+    -- Supabase installation left untouched above — keeps it.
+    IF dropped_any THEN
+        BEGIN
+            EXECUTE 'DROP SCHEMA auth RESTRICT';
+        EXCEPTION WHEN OTHERS THEN
+            NULL;
+        END;
+    END IF;
+END
+$rebase_drop_legacy$;
+`;
+/**
+* Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+*
+* Postgres will not drop a function a policy depends on, so this is exactly the
+* set standing between a database and losing the legacy schema. Rebase's own
+* policies leave the list on the next push or boot, when they are recompiled —
+* anything still here afterwards is hand-written, will never be recompiled by
+* anybody, and is the reason the drop keeps being skipped. Silence there would
+* leave an operator staring at a schema the release notes said would go.
+*/
+var LEGACY_RLS_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, c.relname AS "table", p.polname AS policy
+    FROM pg_policy p
+    JOIN pg_class c ON c.oid = p.polrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2, 3
+`;
+/**
+* Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+*
+* This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it
+* needs its own query. Postgres records a dependency for a *policy* that calls a
+* function, which is why the drop is safe against the policies above — but a
+* `LANGUAGE sql` function whose body is a **string literal** is not parsed when
+* it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.
+* The drop succeeds and the caller is left pointing at a function that no longer
+* exists, which fails at *query* time rather than at boot.
+*
+* A downstream project building on these helpers is not hypothetical: the Rebase
+* control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+* in this very schema, each calling `auth.uid()` in a string body, and eleven of
+* its row-level-security policies go through them. Every one of those would have
+* started failing the first time a recompile left no policy referencing
+* `auth.uid()` directly — the drop's own precondition.
+*
+* Matching on the body text is the only option available, and it is deliberately
+* broad: a false positive costs a schema that stays one release longer and says
+* why, while a false negative costs somebody their policies.
+*/
+var LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, p.proname AS function
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))
+      AND p.prosrc ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2
+`;
+/**
+* Retire the pre-1.0 `auth` schema, reporting what is holding it back.
+*
+* The shared implementation behind the CLI's post-push step and the runtime's
+* post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}
+* and swallow whatever came back, which is right for the ordinary case — a
+* table not recompiled *yet* — and wrong for the one that never resolves: a
+* hand-written policy nothing will ever rewrite. Then the schema stays forever
+* and nothing ever says why.
+*/
+async function dropLegacyAuthSchema(run, report) {
+	let blockers;
+	try {
+		blockers = await run(LEGACY_RLS_DEPENDENTS_SQL);
+	} catch {
+		return;
+	}
+	if (blockers.length > 0) {
+		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${blockers.length} ${blockers.length === 1 ? "policy still calls" : "policies still call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends, and Postgres will not drop a function a policy depends on. Rebase's own policies are rewritten automatically — anything listed here is hand-written SQL that has to be updated to \`${REBASE_SCHEMA}.uid()\` by hand, after which the schema goes on its own:\n` + blockers.map((b) => `  • ${b.schema}.${b.table} → "${b.policy}"`).join("\n"));
+		return;
+	}
+	let borrowers;
+	try {
+		borrowers = await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL);
+	} catch {
+		return;
+	}
+	if (borrowers.length > 0) {
+		report.warn(`The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ${borrowers.length === 1 ? "function calls" : "functions call"} \`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency for that — a SQL body written as a string literal is never parsed — so dropping the helpers would leave these pointing at nothing, and they would fail when a query reached them rather than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` + borrowers.map((b) => `  • ${b.schema}.${b.function}()`).join("\n"));
+		return;
+	}
+	try {
+		await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
+	} catch (err) {
+		report.info(`Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` + (err instanceof Error ? err.message : String(err)));
+	}
 }
 //#endregion
-export { parseDbNameFromUrl as A, buildRowSecurityPgOptions as C, joinStorageKey as D, globalsFileForDump as E, withDatabaseName as F, resolveConnectionString as M, serverVersionNumToMajor as N, parseBackupDestination as O, splitGlobalsStatements as P, buildPgRestoreListArgs as S, diagnoseRowSecurityDumpFailure as T, selectBackupsToPrune as _, detectToolMajor as a, buildPgDumpallGlobalsArgs as b, getServerVersionMajor as c, pruneBackups as d, resolvePgBinary as f, require_source as g, validateDump as h, createDump as i, parsePgToolMajor as j, parseBackupTimestamp as k, listBackups as l, uploadBackup as m, applyGlobals as n, discardPartialDump as o, restoreDump as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, preflight as u, buildBackupFilename as v, checkToolServerCompatibility as w, buildPgRestoreArgs as x, buildPgDumpArgs as y };
+export { resolveLocalBin as C, readVectorDdl as S, forLibpq as T, getSearchExcludes as _, ExcludeIntrospectionError as a, promptConfirm as b, describeBuildScriptRemedy as c, detectProjectPackageManager as d, diagnoseMissingBin as f, getForeignIndexExcludes as g, getDevDatabaseUrl as h, rls_bootstrap_sql_exports as i, describeDevAddCommand as l, ensureDevDatabaseExists as m, RLS_BOOTSTRAP_STATEMENTS as n, applySearchDdl as o, dropDevDatabase as p, dropLegacyAuthSchema as r, applyVectorDdl as s, RLS_BOOTSTRAP_SQL as t, describeReinstallCommand as u, getTableExcludes as v, execa as w, readSearchDdl as x, getVectorExcludes as y };
 
-//# sourceMappingURL=backup-service-DCk7KhhL.js.map
+//# sourceMappingURL=rls-bootstrap-sql-DLDnUjtx.js.map