@rebasepro/server-postgres 0.18.0 → 0.19.0

package/dist/backup-service-Br3tqwsy.js

@@ -0,0 +1,715 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
+import { C as resolveLocalBin, T as forLibpq, w as execa } from "./rls-bootstrap-sql-DLDnUjtx.js";
+import fs from "fs";
+import path from "path";
+import os from "os";
+//#region src/backup/pg-tools.ts
+/**
+* Pure helpers for the backup/restore commands.
+*
+* Everything in this file is side-effect free so it can be unit-tested
+* without a live Postgres server, matching the constraint that CI must
+* not require a database.
+*/
+/**
+* Extract the database name from a Postgres connection string.
+* Returns `null` when the URL has no database path (e.g. bare host).
+*/
+function parseDbNameFromUrl(connectionString) {
+	try {
+		const name = new URL(connectionString).pathname.replace(/^\//, "").trim();
+		return name.length > 0 ? name : null;
+	} catch {
+		const match = connectionString.match(/\/([^/?]+)(\?|$)/);
+		return match && match[1] ? match[1] : null;
+	}
+}
+/**
+* Swap the database name in a connection string, preserving credentials,
+* host, port and query params. Used by `--target-db` / `--create-db` so a
+* restore can target a fresh database instead of clobbering the live one.
+*/
+function withDatabaseName(connectionString, dbName) {
+	try {
+		const parsed = new URL(connectionString);
+		parsed.pathname = `/${dbName}`;
+		return parsed.toString();
+	} catch {
+		return connectionString.replace(/\/([^/?]+)(\?|$)/, `/${dbName}$2`);
+	}
+}
+/**
+* Parse the major version out of `pg_dump --version` / `pg_restore --version`
+* output, e.g. `"pg_dump (PostgreSQL) 16.2"` → `16`. Handles the pre-10
+* `9.6.x` scheme (returns `9`) and beta strings like `"17beta1"`.
+*/
+function parsePgToolMajor(versionOutput) {
+	const match = versionOutput.match(/(\d+)(?:\.(\d+))?/);
+	if (!match) return null;
+	const major = Number(match[1]);
+	if (!Number.isFinite(major)) return null;
+	if (major === 9 && match[2] !== void 0) return 9;
+	return major;
+}
+/**
+* Convert `SELECT current_setting('server_version_num')` (e.g. `160002`)
+* into a major version (`16`). Also accepts pre-10 encodings like `90603`
+* → `9`.
+*/
+function serverVersionNumToMajor(versionNum) {
+	const num = typeof versionNum === "string" ? Number(versionNum) : versionNum;
+	if (!Number.isFinite(num) || num <= 0) return null;
+	if (num < 1e5) return Math.floor(num / 1e4);
+	return Math.floor(num / 1e4);
+}
+/**
+* pg_dump / pg_restore must be **at least** as new as the server they talk
+* to. A newer client against an older server is supported; an older client
+* against a newer server is not and produces corrupt or rejected output.
+*/
+function checkToolServerCompatibility(toolMajor, serverMajor) {
+	if (toolMajor === null) return {
+		compatible: false,
+		reason: "Could not determine the client tool version."
+	};
+	if (serverMajor === null) return {
+		compatible: false,
+		reason: "Could not determine the Postgres server version."
+	};
+	if (toolMajor < serverMajor) return {
+		compatible: false,
+		reason: `Client tool is Postgres ${toolMajor} but the server is Postgres ${serverMajor}. pg_dump/pg_restore must be the same major version as the server or newer. Install Postgres ${serverMajor} client tools.`
+	};
+	return { compatible: true };
+}
+/**
+* Build a deterministic, sortable backup file name:
+*   `rebase-<db>-<YYYYMMDD>T<HHMMSS>Z.dump`
+*
+* The UTC timestamp is embedded so retention pruning can recover the
+* creation time from the object key alone, without extra metadata.
+*/
+function buildBackupFilename(dbName, date = /* @__PURE__ */ new Date()) {
+	const stamp = date.toISOString().replace(/\.\d+Z$/, "Z").replace(/[-:]/g, "");
+	return `rebase-${dbName.replace(/[^a-zA-Z0-9_-]/g, "_")}-${stamp}.dump`;
+}
+/**
+* Recover the creation timestamp encoded in a backup file name by
+* {@link buildBackupFilename}. Returns `null` for names that don't match,
+* so foreign objects in a shared prefix are never pruned.
+*/
+function parseBackupTimestamp(fileName) {
+	const match = (fileName.split("/").pop() ?? fileName).match(/-(\d{8})T(\d{6})Z\.dump$/);
+	if (!match) return null;
+	const [, ymd, hms] = match;
+	const iso = `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;
+	const date = new Date(iso);
+	return Number.isNaN(date.getTime()) ? null : date;
+}
+/**
+* Parse a destination string into a structured {@link BackupDestination}.
+* `s3://bucket/prefix` and `gs://bucket/prefix` map to object storage;
+* anything else is treated as a local path.
+*/
+function parseBackupDestination(out) {
+	const s3 = out.match(/^s3:\/\/([^/]+)\/?(.*)$/);
+	if (s3) return {
+		kind: "s3",
+		bucket: s3[1],
+		prefix: stripTrailingSlash(s3[2])
+	};
+	const gcs = out.match(/^gs:\/\/([^/]+)\/?(.*)$/);
+	if (gcs) return {
+		kind: "gcs",
+		bucket: gcs[1],
+		prefix: stripTrailingSlash(gcs[2])
+	};
+	return {
+		kind: "local",
+		path: out
+	};
+}
+function stripTrailingSlash(s) {
+	return s.replace(/\/+$/, "");
+}
+/**
+* Join a storage prefix and a file name without producing a leading or
+* doubled slash.
+*/
+function joinStorageKey(prefix, fileName) {
+	const clean = prefix.replace(/^\/+|\/+$/g, "");
+	return clean.length > 0 ? `${clean}/${fileName}` : fileName;
+}
+/**
+* `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
+* set a GUC.
+*
+* A backslash escape rather than quoting, which is what libpq's `-c` parsing
+* takes: a space inside a value ends the option otherwise, so a role list is
+* comma-joined and never spaced.
+*/
+function buildRowSecurityPgOptions(identity) {
+	const escape = (value) => value.replace(/([\\ ])/g, "\\$1");
+	return [
+		`-c app.uid=${escape(identity.uid)}`,
+		`-c app.user_id=${escape(identity.uid)}`,
+		`-c app.user_roles=${escape(identity.roles.join(","))}`
+	].join(" ");
+}
+/**
+* Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
+* which is compressed and restorable selectively via `pg_restore`.
+*/
+function buildPgDumpArgs(opts) {
+	const args = [
+		"--format=custom",
+		"--no-password",
+		`--file=${opts.outFile}`
+	];
+	if (opts.noOwner) args.push("--no-owner");
+	if (opts.rowSecurity) args.push("--enable-row-security");
+	for (const schema of opts.excludeSchemas ?? []) args.push(`--exclude-schema=${schema}`);
+	args.push(forLibpq(opts.connectionString));
+	return args;
+}
+/**
+* Whether a `pg_dump` failure is the row-security one, and what to do about it.
+*
+* The error text names the table and nothing else, so the first read of it is
+* "why would a backup be affected by RLS at all?" — the answer being that the
+* dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
+* normal state of the `postgres` user on Cloud SQL, RDS and every other managed
+* Postgres. Nothing about that is visible from the message.
+*
+* Returns `null` for any other failure, so the caller reports it unchanged.
+*/
+function diagnoseRowSecurityDumpFailure(error) {
+	const text = [error?.stderr, error?.message].map((part) => typeof part === "string" ? part : "").join("\n");
+	if (!/row-level security policy/i.test(text)) return null;
+	const table = text.match(/for table "([^"]+)"/)?.[1];
+	return [
+		`pg_dump cannot read ${table ? `"${table}"` : "one of the tables"} because row-level security applies to it.`,
+		"",
+		"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal",
+		"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is",
+		"  no superuser to hand out.",
+		"",
+		"  Two ways out:",
+		"",
+		"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The",
+		"      dump then contains every row, which is what a backup should mean.",
+		"",
+		"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase",
+		"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy",
+		"      admits the dump. Read the warning it prints: the result contains exactly the",
+		"      rows those policies admit, and any table whose policies do not include an",
+		"      admin rule comes out short — with no error.",
+		"",
+		"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the",
+		"  settings above it succeeds and silently omits rows."
+	].join("\n");
+}
+/**
+* Assemble the `pg_restore` argument vector for a custom-format dump.
+*/
+function buildPgRestoreArgs(opts) {
+	const args = [
+		"--format=custom",
+		"--no-password",
+		`--dbname=${forLibpq(opts.connectionString)}`
+	];
+	if (opts.clean) args.push("--clean", "--if-exists");
+	if (opts.noOwner) args.push("--no-owner");
+	if (opts.exitOnError !== false) args.push("--exit-on-error");
+	args.push(opts.inputFile);
+	return args;
+}
+/**
+* Assemble the `pg_restore --list` argument vector. Reading a dump's table
+* of contents parses the whole archive without touching a database, so it is
+* a cheap integrity check that the file isn't truncated or corrupt.
+*/
+function buildPgRestoreListArgs(inputFile) {
+	return ["--list", inputFile];
+}
+/**
+* Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+* cluster-wide objects) live outside any single database, so a per-database
+* `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+* statements in the main dump fail on restore and RLS is silently lost — so
+* every backup captures the globals into a sidecar `.globals.sql`.
+*
+* `--no-role-passwords` keeps role secrets out of the artifact (backups may
+* be shipped off-box); roles are recreated password-less and re-secured by
+* the operator.
+*/
+function buildPgDumpallGlobalsArgs(opts) {
+	return [
+		"--globals-only",
+		"--no-role-passwords",
+		"--no-password",
+		`--file=${opts.outFile}`,
+		`--dbname=${forLibpq(opts.connectionString)}`
+	];
+}
+/**
+* Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+* two artifacts adjacent so listing, uploading and pruning can find one from
+* the other. A name that doesn't end in `.dump` is returned unchanged with a
+* `.globals.sql` suffix appended.
+*/
+function globalsFileForDump(dumpPath) {
+	return dumpPath.endsWith(".dump") ? dumpPath.slice(0, -5) + ".globals.sql" : dumpPath + ".globals.sql";
+}
+/**
+* Split a `pg_dumpall --globals-only` script into individual statements.
+* Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+* can run independently and a benign "role already exists" on one doesn't
+* abort the rest. Drops `--` comment lines and blank statements.
+*/
+function splitGlobalsStatements(sql) {
+	return sql.split("\n").filter((line) => {
+		const trimmed = line.trim();
+		return !trimmed.startsWith("--") && !trimmed.startsWith("\\");
+	}).join("\n").split(";").map((s) => s.trim()).filter((s) => s.length > 0);
+}
+/**
+* Resolve the Postgres connection string the backup commands should use,
+* mirroring the precedence the branch command already relies on.
+*/
+function resolveConnectionString(env) {
+	return env.DATABASE_URL || env.ADMIN_CONNECTION_STRING || null;
+}
+//#endregion
+//#region src/backup/retention.ts
+/**
+* Retention pruning for scheduled backups. Pure logic — no I/O — so it can
+* be exhaustively unit-tested without touching a storage backend.
+*/
+/**
+* Decide which backups to delete under the given retention policy.
+*
+* Rules, applied in order:
+*  1. Objects whose key isn't a recognised rebase backup (no parseable
+*     timestamp and no `createdAt`) are never selected — foreign files in a
+*     shared bucket are left untouched.
+*  2. The `keepMinimum` newest backups are always retained.
+*  3. Of the remainder, any older than `retentionDays` are selected for
+*     deletion.
+*
+* Returns the keys to delete, oldest first.
+*/
+function selectBackupsToPrune(backups, options) {
+	const retentionDays = options.retentionDays ?? 0;
+	const keepMinimum = Math.max(0, options.keepMinimum ?? 0);
+	const now = options.now ?? /* @__PURE__ */ new Date();
+	if (retentionDays <= 0) return [];
+	const dated = backups.map((b) => {
+		const createdAt = b.createdAt ?? parseBackupTimestamp(b.key);
+		return createdAt ? {
+			key: b.key,
+			createdAt
+		} : null;
+	}).filter((b) => b !== null);
+	dated.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());
+	const cutoff = now.getTime() - retentionDays * 24 * 60 * 60 * 1e3;
+	const toDelete = dated.slice(keepMinimum).filter((b) => b.createdAt.getTime() < cutoff);
+	toDelete.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
+	return toDelete.map((b) => b.key);
+}
+//#endregion
+//#region src/backup/backup-logic.ts
+/**
+* Pure-ish orchestration for the backup/restore paths, kept free of `execa`
+* and `pg` value imports so it can be unit-tested under jest (the impure
+* edges — spawning processes, opening connections — live in
+* `backup-service.ts`, which is vitest/runtime only).
+*
+* The functions here take their side-effecting dependency as an argument
+* (a statement runner, an object deleter) so tests can inject fakes.
+*/
+/**
+* Replay a `pg_dumpall --globals-only` script one statement at a time,
+* tolerating per-statement failures. On a same-cluster restore the roles
+* usually already exist (`CREATE ROLE` → "already exists") and on a managed
+* provider an `ALTER ROLE <superuser>` may be refused; neither should abort
+* recreation of the roles that *are* missing. Returns how many statements
+* applied vs were skipped.
+*
+* `runStatement` executes one SQL statement and rejects on error.
+*/
+async function applyGlobalsWith(runStatement, globalsSql, log = () => {}) {
+	let applied = 0;
+	let skipped = 0;
+	for (const statement of splitGlobalsStatements(globalsSql)) try {
+		await runStatement(statement);
+		applied++;
+	} catch (err) {
+		skipped++;
+		log(`  • Skipped global: ${statement.split("\n")[0].slice(0, 80)} (${err instanceof Error ? err.message : String(err)})`);
+	}
+	return {
+		applied,
+		skipped
+	};
+}
+/**
+* Delete each pruned dump together with its `.globals.sql` roles sidecar, so
+* pruning never orphans the roles file. The sidecar is best-effort — older
+* backups predate it, so a missing-sidecar failure is swallowed while a
+* failure deleting the dump itself propagates.
+*
+* `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+*/
+async function pruneWith(keys, deleteObject) {
+	for (const key of keys) {
+		await deleteObject(key);
+		try {
+			await deleteObject(globalsFileForDump(key));
+		} catch {}
+	}
+}
+/**
+* Remove a dump artifact abandoned by a failed tool run.
+*
+* `pg_dump` creates its `--file=` target before it finishes connecting, so any
+* failure — a URL libpq rejects, a dropped connection, a full disk — leaves a
+* 0-byte file behind. That corpse is not inert: `rebase db backups list` used
+* to show it as an ordinary entry, and `selectBackupsToPrune` ranks by
+* timestamp alone, so it occupies a protected `keepMinimum` slot and can push
+* a real backup out of retention.
+*
+* Best-effort on purpose: the caller is already throwing, and a failed unlink
+* must not replace the real diagnosis with an ENOENT/EPERM from the cleanup.
+*
+* Lives here rather than in `backup-service.ts` for the reason at the top of
+* this file — that module's top-level `execa` import makes it unloadable under
+* jest, so anything placed there cannot be unit-tested.
+*
+* `remove` deletes one file and throws if it cannot; `exists` reports presence.
+*/
+function discardPartialDumpWith(exists, remove, file) {
+	try {
+		if (exists(file)) remove(file);
+	} catch {}
+}
+//#endregion
+//#region src/backup/backup-service.ts
+/**
+* Backup / restore orchestration: thin, well-typed wrappers around
+* `pg_dump` and `pg_restore`, plus binary detection, version pre-flight,
+* and upload/prune against a storage backend.
+*
+* The pure argument- and policy-logic lives in `pg-tools.ts` and
+* `retention.ts`; this module is the impure edge (spawns processes, talks
+* to Postgres and storage) and is intentionally kept small.
+*/
+var backup_service_exports = /* @__PURE__ */ __exportAll({
+	BackupToolError: () => BackupToolError,
+	applyGlobals: () => applyGlobals,
+	createDump: () => createDump,
+	detectToolMajor: () => detectToolMajor,
+	discardPartialDump: () => discardPartialDump,
+	ensureDatabaseExists: () => ensureDatabaseExists,
+	getServerVersionMajor: () => getServerVersionMajor,
+	listBackups: () => listBackups,
+	preflight: () => preflight,
+	pruneBackups: () => pruneBackups,
+	resolvePgBinary: () => resolvePgBinary,
+	restoreDump: () => restoreDump,
+	uploadBackup: () => uploadBackup,
+	validateDump: () => validateDump
+});
+/**
+* Remove a dump artifact abandoned by a failed tool run. See
+* {@link discardPartialDumpWith} for why this exists and why the logic lives
+* in the execa-free module.
+*/
+function discardPartialDump(file) {
+	discardPartialDumpWith((f) => fs.existsSync(f), (f) => fs.unlinkSync(f), file);
+}
+var BackupToolError = class extends Error {
+	hint;
+	constructor(message, hint) {
+		super(message);
+		this.hint = hint;
+		this.name = "BackupToolError";
+	}
+};
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+function resolvePgBinary(tool, env = process.env) {
+	const overrideVar = tool === "pg_dump" ? env.PG_DUMP_PATH : tool === "pg_restore" ? env.PG_RESTORE_PATH : env.PG_DUMPALL_PATH;
+	if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;
+	return resolveLocalBin(tool);
+}
+/** Run `<bin> --version` and extract the major version. */
+async function detectToolMajor(bin) {
+	try {
+		const { stdout } = await execa(bin, ["--version"]);
+		return parsePgToolMajor(stdout);
+	} catch {
+		return null;
+	}
+}
+/** Query the server for its major version via `server_version_num`. */
+async function getServerVersionMajor(connectionString) {
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString });
+	await client.connect();
+	try {
+		const raw = (await client.query("SHOW server_version_num")).rows?.[0]?.server_version_num;
+		return serverVersionNumToMajor(raw);
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Verify the requested client tool exists and its major version is
+* compatible with the live server. Throws {@link BackupToolError} — with a
+* doctor-style hint — when the binary is missing.
+*/
+async function preflight(tool, connectionString, env = process.env) {
+	const bin = resolvePgBinary(tool, env);
+	if (!bin) throw new BackupToolError(`Could not find the '${tool}' binary.`, `Install the PostgreSQL client tools (e.g. 'brew install libpq' or 'apt-get install postgresql-client'), or set ${tool === "pg_dump" ? "PG_DUMP_PATH" : "PG_RESTORE_PATH"} to its full path.`);
+	const [toolMajor, serverMajor] = await Promise.all([detectToolMajor(bin), getServerVersionMajor(connectionString)]);
+	return {
+		bin,
+		toolMajor,
+		serverMajor,
+		...checkToolServerCompatibility(toolMajor, serverMajor)
+	};
+}
+/**
+* Produce a custom-format dump on local disk. When `outDir` is omitted the
+* file is written to the OS temp directory (used by the upload path, which
+* cleans it up afterwards).
+*
+* Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+* `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+* depend on can be recreated on restore. Set `includeGlobals: false` to skip
+* it (e.g. when the caller has no privilege to read cluster globals).
+*/
+async function createDump(opts) {
+	const env = opts.env ?? process.env;
+	const bin = resolvePgBinary("pg_dump", env);
+	if (!bin) throw new BackupToolError("Could not find the 'pg_dump' binary.", "Install the PostgreSQL client tools or set PG_DUMP_PATH.");
+	const fileName = opts.fileName ?? buildBackupFilename(opts.dbName);
+	const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), "rebase-backup-"));
+	fs.mkdirSync(outDir, { recursive: true });
+	const localFile = path.join(outDir, fileName);
+	const args = buildPgDumpArgs({
+		connectionString: opts.connectionString,
+		outFile: localFile,
+		excludeSchemas: opts.excludeSchemas,
+		noOwner: opts.noOwner,
+		rowSecurity: opts.rowSecurity
+	});
+	const dumpEnv = { ...env };
+	if (opts.rowSecurity) dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)].filter(Boolean).join(" ");
+	try {
+		await execa(bin, args, {
+			stdio: opts.inheritStdio ? "inherit" : "pipe",
+			env: dumpEnv
+		});
+	} catch (error) {
+		discardPartialDump(localFile);
+		const diagnosis = diagnoseRowSecurityDumpFailure(error);
+		if (!diagnosis) throw error;
+		throw new BackupToolError(diagnosis, "Run `rebase db backup --help` for the flag, and read what it says about partial dumps.");
+	}
+	const result = {
+		localFile,
+		fileName,
+		sizeBytes: fs.existsSync(localFile) ? fs.statSync(localFile).size : 0
+	};
+	if (opts.includeGlobals !== false) {
+		const dumpallBin = resolvePgBinary("pg_dumpall", env);
+		if (!dumpallBin) throw new BackupToolError("Could not find the 'pg_dumpall' binary needed to capture cluster roles.", "Install the PostgreSQL client tools or set PG_DUMPALL_PATH. To take a role-incomplete backup anyway, pass includeGlobals: false.");
+		const globalsFile = globalsFileForDump(localFile);
+		try {
+			await execa(dumpallBin, buildPgDumpallGlobalsArgs({
+				connectionString: opts.connectionString,
+				outFile: globalsFile
+			}), {
+				stdio: opts.inheritStdio ? "inherit" : "pipe",
+				env: { ...env }
+			});
+		} catch (error) {
+			discardPartialDump(globalsFile);
+			discardPartialDump(localFile);
+			throw error;
+		}
+		result.globalsFile = globalsFile;
+		result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;
+	}
+	return result;
+}
+/**
+* Cheap integrity check on a freshly written dump: it must be non-empty and
+* `pg_restore --list` must parse its table of contents without error. Used
+* before pruning older backups so a corrupt-but-exit-0 dump never becomes
+* the reason the last good backup is deleted.
+*/
+async function validateDump(localFile, env = process.env) {
+	if (!fs.existsSync(localFile)) return {
+		ok: false,
+		reason: `Dump file does not exist: ${localFile}`
+	};
+	if (fs.statSync(localFile).size === 0) return {
+		ok: false,
+		reason: "Dump file is empty (0 bytes)."
+	};
+	const bin = resolvePgBinary("pg_restore", env);
+	if (!bin) return {
+		ok: false,
+		reason: "Could not find 'pg_restore' to verify the dump."
+	};
+	try {
+		await execa(bin, buildPgRestoreListArgs(localFile), {
+			stdio: "pipe",
+			env: { ...env }
+		});
+		return { ok: true };
+	} catch (err) {
+		return {
+			ok: false,
+			reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}`
+		};
+	}
+}
+/**
+* Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+* before a restore, so the dump's GRANT/RLS statements (which reference
+* `rebase_user` and any owner roles) actually apply. Runs statement by
+* statement and tolerates per-statement failures — on a same-cluster restore
+* the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+* a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+* should abort role recreation. Returns how many statements applied vs were
+* skipped.
+*/
+async function applyGlobals(connectionString, globalsSql, log = () => {}) {
+	const { Client } = await import("pg");
+	const client = new Client({ connectionString });
+	await client.connect();
+	try {
+		return await applyGlobalsWith(async (sql) => {
+			await client.query(sql);
+		}, globalsSql, log);
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Restore a custom-format dump into the database named by
+* `connectionString`. Destructive when `clean` is set (drops objects
+* first). Never called automatically — the CLI gates it behind explicit
+* confirmation.
+*
+* Runs with `--exit-on-error` by default: a restore that logs-and-continues
+* past a failed GRANT (because a role was missing) reports success with RLS
+* un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+* and only set `exitOnError: false` deliberately.
+*/
+async function restoreDump(opts) {
+	const env = opts.env ?? process.env;
+	const bin = resolvePgBinary("pg_restore", env);
+	if (!bin) throw new BackupToolError("Could not find the 'pg_restore' binary.", "Install the PostgreSQL client tools or set PG_RESTORE_PATH.");
+	await execa(bin, buildPgRestoreArgs({
+		connectionString: opts.connectionString,
+		inputFile: opts.inputFile,
+		clean: opts.clean,
+		noOwner: opts.noOwner,
+		exitOnError: opts.exitOnError
+	}), {
+		stdio: opts.inheritStdio ? "inherit" : "pipe",
+		env: { ...env }
+	});
+}
+/**
+* Create a database (if absent) by connecting to the maintenance
+* `postgres` database. Used by `restore --create-db`.
+*/
+async function ensureDatabaseExists(adminConnectionString, dbName) {
+	const { Client } = await import("pg");
+	const parsed = new URL(adminConnectionString);
+	parsed.pathname = "/postgres";
+	const client = new Client({ connectionString: parsed.toString() });
+	await client.connect();
+	try {
+		const existing = await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [dbName]);
+		if (existing.rowCount && existing.rowCount > 0) return false;
+		if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(dbName)) throw new BackupToolError(`Invalid database name: "${dbName}"`);
+		await client.query(`CREATE DATABASE "${dbName}"`);
+		return true;
+	} finally {
+		await client.end();
+	}
+}
+/**
+* Upload a local dump to object storage under the destination's prefix.
+* Backups may contain secrets/PII, so the object is written with a
+* private/octet-stream content type; bucket-level ACLs must stay private.
+*/
+async function uploadBackup(storage, localFile, dest) {
+	const fileName = path.basename(localFile);
+	const key = joinStorageKey(dest.prefix, fileName);
+	const buffer = fs.readFileSync(localFile);
+	const file = new File([buffer], fileName, { type: "application/octet-stream" });
+	return {
+		key,
+		storageUrl: (await storage.putObject({
+			file,
+			key,
+			bucket: dest.bucket,
+			metadata: { "rebase-backup": "1" }
+		})).storageUrl
+	};
+}
+/**
+* List existing backups at a destination. For local destinations reads the
+* directory; for object storage lists the prefix via the controller.
+*/
+async function listBackups(dest, storage) {
+	if (dest.kind === "local") {
+		if (!fs.existsSync(dest.path)) return [];
+		const dir = fs.statSync(dest.path).isDirectory() ? dest.path : path.dirname(dest.path);
+		return fs.readdirSync(dir).filter((f) => f.endsWith(".dump")).map((f) => {
+			const full = path.join(dir, f);
+			const stats = fs.statSync(full);
+			return {
+				key: full,
+				createdAt: parseBackupTimestamp(f) ?? stats.mtime,
+				sizeBytes: stats.size
+			};
+		}).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
+	}
+	if (!storage) throw new BackupToolError(`Listing ${dest.kind} backups requires a configured storage backend.`);
+	return (await storage.listObjects(dest.prefix ? `${dest.prefix}/` : "", {
+		bucket: dest.bucket,
+		maxResults: 1e3
+	})).items.map((item) => item.fullPath).filter((key) => key.endsWith(".dump")).map((key) => ({
+		key,
+		createdAt: parseBackupTimestamp(key) ?? void 0
+	})).sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));
+}
+/**
+* Apply a retention policy to a destination, deleting the backups selected
+* by {@link selectBackupsToPrune}. Returns the keys that were removed.
+*/
+async function pruneBackups(dest, options, storage) {
+	const toDelete = selectBackupsToPrune(await listBackups(dest, storage), options);
+	await pruneWith(toDelete, dest.kind === "local" ? async (key) => {
+		if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);
+		fs.unlinkSync(key);
+	} : async (key) => {
+		if (!storage) throw new BackupToolError("Storage backend required to prune object backups.");
+		await storage.deleteObject(key, dest.bucket);
+	});
+	return toDelete;
+}
+//#endregion
+export { parsePgToolMajor as A, checkToolServerCompatibility as C, parseBackupDestination as D, joinStorageKey as E, serverVersionNumToMajor as M, splitGlobalsStatements as N, parseBackupTimestamp as O, withDatabaseName as P, buildRowSecurityPgOptions as S, globalsFileForDump as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, getServerVersionMajor as c, pruneBackups as d, resolvePgBinary as f, selectBackupsToPrune as g, validateDump as h, createDump as i, resolveConnectionString as j, parseDbNameFromUrl as k, listBackups as l, uploadBackup as m, applyGlobals as n, discardPartialDump as o, restoreDump as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, preflight as u, buildPgDumpArgs as v, diagnoseRowSecurityDumpFailure as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
+
+//# sourceMappingURL=backup-service-Br3tqwsy.js.map