@rebasepro/server-postgres 0.19.1 → 0.19.2-canary.g09316f6

package/dist/{BranchService-ByLfM_Tt.js → BranchService-W3DMfcZZ.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
-import { l as extractCauseMessage, u as extractPgError } from "./cli-errors-DxN4yzdH.js";
+import { d as extractPgError, u as extractCauseMessage } from "./cli-errors-C3g_kHBw.js";
 import { sql } from "drizzle-orm";
 import { revokeInternalTableSql } from "@rebasepro/common";
 //#region src/services/BranchService.ts
@@ -357,4 +357,4 @@ var BranchService = class {
 //#endregion
 export { BranchService_exports as n, BranchingUnsupportedError as r, BranchService as t };
 
-//# sourceMappingURL=BranchService-ByLfM_Tt.js.map
+//# sourceMappingURL=BranchService-W3DMfcZZ.js.map

package/dist/{BranchService-ByLfM_Tt.js.map → BranchService-W3DMfcZZ.js.map}

@@ -1 +1 @@
-{"version":3,"file":"BranchService-ByLfM_Tt.js","names":[],"sources":["../src/services/BranchService.ts"],"sourcesContent":["/**\n * BranchService\n *\n * Manages database branching by creating/deleting PostgreSQL databases\n * using `CREATE DATABASE ... TEMPLATE`. Branch metadata is stored in the\n * `rebase.branches` table in the default (main) database, following the\n * same `rebase` schema convention used by entity_history, auth, etc.\n */\n\nimport { sql } from \"drizzle-orm\";\nimport { BranchInfo } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { DrizzleClient } from \"../interfaces\";\nimport { BranchRow } from \"../branch-prune\";\nimport { DatabasePoolManager } from \"../databasePoolManager\";\nimport { extractPgError, extractCauseMessage } from \"../utils/pg-error-utils\";\n\n/** Internal prefix applied to branch database names to avoid collisions. */\nconst BRANCH_DB_PREFIX = \"rb_\";\n\n/** `duplicate_database` — the target database name is already taken. */\nconst PG_DUPLICATE_DATABASE = \"42P04\";\n\n/** `object_in_use` — the database still has connections attached. */\nconst PG_OBJECT_IN_USE = \"55006\";\n\n/**\n * Describe a failed branch DDL statement in terms a user can act on.\n *\n * Drizzle reports failures as `Failed query: <sql> params:` and hides the real\n * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees\n * the actual problem. Match on the PG error code instead — it survives wrapping\n * and, unlike the message text, is not locale-dependent.\n */\nfunction describeBranchDdlError(err: unknown, fallbackContext: string): Error {\n    const pgError = extractPgError(err);\n\n    if (pgError?.code === PG_DUPLICATE_DATABASE) {\n        return new Error(`Database \"${fallbackContext}\" already exists on the server. Choose a different branch name.`);\n    }\n    if (pgError?.code === PG_OBJECT_IN_USE) {\n        return new Error(\n            `Cannot complete the operation: the database \"${fallbackContext}\" has active connections. ` +\n            \"Close other clients or connections and try again.\"\n        );\n    }\n\n    // Unknown failure: surface the real PG message rather than the Drizzle\n    // wrapper, which would otherwise show the raw SQL and no reason at all.\n    const detail = pgError?.message ?? extractCauseMessage(err);\n    if (detail) return new Error(detail);\n    return err instanceof Error ? err : new Error(String(err));\n}\n\n/** Fully-qualified metadata table in the rebase schema. */\nconst BRANCHES_TABLE = \"rebase.branches\";\n\n/**\n * The connected server cannot branch, so nothing was done.\n *\n * A refusal, not a fault: typed so the transports can forward it intact.\n * `websocket.ts` answers it with its own code and message rather than letting\n * it fall into the generic handler, which suppresses the text in production —\n * and the text is the only part that says what to do instead.\n */\nexport class BranchingUnsupportedError extends Error {\n    /** Wire code, forwarded verbatim to the client. */\n    readonly code = \"BRANCHING_UNSUPPORTED\";\n\n    constructor(message: string) {\n        super(message);\n        this.name = \"BranchingUnsupportedError\";\n    }\n}\n\n/**\n * What to say when the server serves one database.\n *\n * Deliberately the same argument the CLI's `refuseBranchOnManagedDatabase`\n * makes, because it is the same refusal — it just used to be available only to\n * whoever came in through argv. One paragraph, because this one has to fit in a\n * toast as well as a terminal.\n */\nconst BRANCHING_UNSUPPORTED_MESSAGE =\n    \"Branching does not work on the managed development database. It copies a database with \"\n    + \"CREATE DATABASE ... TEMPLATE, and the managed database is PGlite, which serves exactly one — \"\n    + \"the copy would be the original, and every write you meant to sandbox would land in it. \"\n    + \"Branching needs a real Postgres: run `rebase dev --docker`, or uncomment DATABASE_URL in .env \"\n    + \"to point at your own.\";\n\n/**\n * Validate that a user-provided identifier only contains safe characters.\n * Throws if the value contains characters outside [a-zA-Z0-9_-].\n */\nfunction validateIdentifier(value: string, label: string): void {\n    if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n        throw new Error(`Invalid ${label}: only letters, digits, underscores, and hyphens are allowed.`);\n    }\n}\n\n/**\n * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it\n * silently. The prefix comes out of the same budget.\n */\nconst MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;\n\n/**\n * Check a user-provided branch name, and otherwise leave it exactly as given.\n *\n * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was\n * quietly created as `myfeature`: the name you typed was not the name `list`\n * gave back. Nothing ever needed that. Every identifier this service builds is\n * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen\n * safe, and `validateIdentifier` has always accepted hyphens for the `--from`\n * source database — the two disagreed about the same character class.\n *\n * Refusing a name we cannot represent is better than representing a different\n * one, which is also why the length is checked here rather than left to\n * Postgres, whose answer to an over-long identifier is a silent rename.\n */\nfunction assertValidBranchName(name: string): void {\n    validateIdentifier(name, \"branch name\");\n    if (name.length > MAX_BRANCH_NAME_LENGTH) {\n        throw new Error(\n            `Branch name \"${name}\" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +\n            \"Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose.\"\n        );\n    }\n}\n\n/**\n * Convert a user-facing branch name to the actual PostgreSQL database name.\n */\nfunction toBranchDbName(name: string): string {\n    assertValidBranchName(name);\n    return `${BRANCH_DB_PREFIX}${name}`;\n}\n\nexport class BranchService {\n    constructor(\n        private db: DrizzleClient,\n        private poolManager: DatabasePoolManager\n    ) {}\n\n    /**\n     * Refuse a branch mutation the connected server cannot honour.\n     *\n     * The check lives here rather than in the CLI's argv parsing because the\n     * CLI is not the only caller: Studio reaches `createBranch` over the\n     * websocket, and before this it got \"Branch created successfully\" and a\n     * detail pane promising isolation for a database that is the parent.\n     *\n     * Reads only, and only mutations are guarded: `listBranches` on a managed\n     * database is an honest empty list, and refusing it would turn the Branches\n     * pane into a failure with a \"Try again\" that can never succeed.\n     */\n    private async assertBranchingSupported(): Promise<void> {\n        if (await this.poolManager.servesOneDatabase()) {\n            throw new BranchingUnsupportedError(BRANCHING_UNSUPPORTED_MESSAGE);\n        }\n    }\n\n    /**\n     * Ensure the `rebase.branches` metadata table exists in the default database.\n     * Idempotent — safe to call on every startup.\n     */\n    async ensureBranchMetadataTable(): Promise<void> {\n        // Create the rebase schema (idempotent — may already exist from auth/history init)\n        await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n        await this.db.execute(sql.raw(`\n            CREATE TABLE IF NOT EXISTS ${BRANCHES_TABLE} (\n                name         TEXT PRIMARY KEY,\n                db_name      TEXT NOT NULL UNIQUE,\n                parent_db    TEXT NOT NULL,\n                created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n                metadata     JSONB DEFAULT '{}'\n            );\n        `));\n\n        // Not a collection, so no RLS — and it names every branch database on\n        // this server. The driver's schema-wide grant reaches it, so revoke.\n        await this.db.execute(sql.raw(revokeInternalTableSql(\"rebase\", \"branches\")));\n    }\n\n    /**\n     * Create a new branch database by templating the source database.\n     *\n     * Uses `CREATE DATABASE ... TEMPLATE` for an instant, full-fidelity copy\n     * of both schema and data.\n     *\n     * @param name   User-facing branch name (e.g., \"feature_auth\")\n     * @param options.source  Source database to clone; defaults to the main database.\n     */\n    async createBranch(\n        name: string,\n        options?: { source?: string; force?: boolean }\n    ): Promise<BranchInfo> {\n        await this.assertBranchingSupported();\n\n        if (options?.source) {\n            validateIdentifier(options.source, \"source database name\");\n        }\n\n        const dbName = toBranchDbName(name);\n        const sourceDb = options?.source || this.poolManager.defaultDatabaseName;\n\n        // Check if branch already exists\n        const existing = await this.db.execute(\n            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`\n        );\n        if ((existing.rows as unknown[]).length > 0) {\n            throw new Error(`Branch \"${name}\" already exists.`);\n        }\n\n        // Disconnect any idle pools to the source DB so TEMPLATE works.\n        // CREATE DATABASE ... TEMPLATE requires no other connections to the template.\n        //\n        // This only reaches pools inside *this* process. The CLI runs as its own\n        // process, so a `rebase dev` holding the database open is untouched by\n        // it — which is why the failure below has to name what is connected, and\n        // why `--force` exists.\n        await this.poolManager.disconnectDatabase(sourceDb);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(sourceDb);\n            if (closed > 0) {\n                // Postgres reports the backend as gone before its slot is\n                // actually free, and CREATE DATABASE then fails on a connection\n                // that no longer exists. One short settle beats a confusing retry.\n                await new Promise((resolve) => setTimeout(resolve, 250));\n            }\n        }\n\n        // Create the database using the source as a template.\n        // Note: Identifiers must be double-quoted, not parameterized.\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        const safeSourceDb = sourceDb.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(\n                sql.raw(`CREATE DATABASE \"${safeDbName}\" TEMPLATE \"${safeSourceDb}\"`)\n            );\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                // The template — not the new database — is the one still in use.\n                throw new Error(\n                    `Cannot create branch: the source database \"${sourceDb}\" has active connections.\\n`\n                    + await this.describeBlockingConnections(sourceDb)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Record metadata in the default database\n        const now = new Date();\n        await this.db.execute(\n            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)\n                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`\n        );\n\n        return {\n            name,\n            parentDatabase: sourceDb,\n            createdAt: now\n        };\n    }\n\n    /**\n     * Delete a branch database and remove its metadata.\n     * Cannot delete the main/default database.\n     */\n    async deleteBranch(name: string, options?: { force?: boolean }): Promise<void> {\n        await this.assertBranchingSupported();\n\n        assertValidBranchName(name);\n\n        // Safety, first pass: a request that would target the default database\n        // is refused before any metadata is read, so the answer costs nothing\n        // and cannot depend on what a row happens to say.\n        if (toBranchDbName(name) === this.poolManager.defaultDatabaseName) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Verify the branch exists, and take the database name from the row\n        // rather than deriving it again. A branch created before names stopped\n        // being stripped is recorded as `rb_myfeature` while `my-feature` now\n        // derives `rb_my-feature`; re-deriving would drop a database this row\n        // never named — or, if that name happened to exist, somebody else's.\n        // The stored value is the only one that is true by construction.\n        const existing = await this.db.execute(\n            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`\n        );\n        const existingRows = existing.rows as Record<string, unknown>[];\n        if (existingRows.length === 0) {\n            throw new Error(`Branch \"${name}\" not found.`);\n        }\n        const dbName = existingRows[0].db_name as string;\n\n        // Safety, second pass: the first checked a name we derived, this checks\n        // the one we are about to drop. They differ for any row written under\n        // the old scheme, and it is this one that governs.\n        if (dbName === this.poolManager.defaultDatabaseName) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Disconnect any pools to this branch before dropping. Same limit as\n        // `createBranch`: in-process pools only.\n        await this.poolManager.disconnectDatabase(dbName);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(dbName);\n            if (closed > 0) await new Promise((resolve) => setTimeout(resolve, 250));\n        }\n\n        // Drop the database\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${safeDbName}\"`));\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                throw new Error(\n                    `Cannot delete branch \"${name}\": the database has active connections.\\n`\n                    + await this.describeBlockingConnections(dbName)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Remove metadata\n        await this.db.execute(\n            sql`DELETE FROM rebase.branches WHERE name = ${name}`\n        );\n    }\n\n    /**\n     * Who is holding the database open, in words a developer can act on.\n     *\n     * `CREATE DATABASE ... TEMPLATE` and `DROP DATABASE` both require that no\n     * other session is connected, and the one thing the old message could not\n     * say is the only thing worth knowing: *which* session. \"Close other\n     * clients or connections and try again\" is advice you cannot follow when\n     * you do not know there is a `rebase dev` in another terminal — and that is\n     * the common case, because wanting a branch and running the app are the\n     * same moment.\n     *\n     * `application_name` is the useful column: node-postgres sends none by\n     * default, so a Rebase process shows as `(unnamed)` while DBeaver, pgAdmin\n     * and psql all name themselves. Counting by it separates \"my own dev\n     * server\" from \"the GUI I forgot about\" without any guessing.\n     *\n     * Best-effort by construction: this runs while reporting a failure, and a\n     * diagnostic that throws would replace a real error with its own.\n     */\n    private async describeBlockingConnections(dbName: string): Promise<string> {\n        try {\n            const result = await this.db.execute(sql`\n                SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,\n                       count(*)::int AS n\n                  FROM pg_stat_activity\n                 WHERE datname = ${dbName}\n                   AND pid <> pg_backend_pid()\n                 GROUP BY 1\n                 ORDER BY 2 DESC, 1\n            `);\n            const rows = result.rows as Record<string, unknown>[];\n            if (rows.length === 0) {\n                // The blocker went away between the failure and this query, or\n                // it is a session Postgres does not attribute to this database.\n                return \"  Retry — whatever was connected has since disconnected.\";\n            }\n\n            const listed = rows\n                .map((row) => `    ${row.n} × ${String(row.app)}`)\n                .join(\"\\n\");\n\n            return `  Connected right now:\\n${listed}\\n`\n                + \"  A running `rebase dev` is the usual one — stop it, or re-run with --force to\\n\"\n                + \"  disconnect them for you.\";\n        } catch {\n            return \"  Close other clients and connections, or re-run with --force.\";\n        }\n    }\n\n    /**\n     * Disconnect every other session on a database, and say how many.\n     *\n     * `pg_terminate_backend` rather than `pg_cancel_backend`: cancelling a\n     * query leaves the session connected, and a connected session is exactly\n     * what blocks the operation.\n     *\n     * The current backend is excluded — terminating the connection running this\n     * statement would abort the command that asked for it.\n     */\n    private async terminateConnections(dbName: string): Promise<number> {\n        const result = await this.db.execute(sql`\n            SELECT pg_terminate_backend(pid)\n              FROM pg_stat_activity\n             WHERE datname = ${dbName}\n               AND pid <> pg_backend_pid()\n        `);\n\n        return (result.rows as unknown[]).length;\n    }\n\n    /**\n     * Everything prune needs to decide, in two queries.\n     *\n     * Reads the rows and the server's database list rather than joining them,\n     * so the *disagreements* between the two are visible — a row whose database\n     * is gone and a database with no row are the two things prune exists to\n     * find, and a join hides both.\n     */\n    async pruneCandidates(): Promise<{ rows: BranchRow[]; databases: string[] }> {\n        const rowResult = await this.db.execute(sql.raw(`\n            SELECT name, db_name, created_at FROM ${BRANCHES_TABLE} ORDER BY created_at\n        `));\n        const rows = (rowResult.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            dbName: row.db_name as string,\n            createdAt: new Date(row.created_at as string)\n        }));\n\n        const dbResult = await this.db.execute(sql`\n            SELECT datname FROM pg_database WHERE NOT datistemplate\n        `);\n        const databases = (dbResult.rows as Record<string, unknown>[]).map((row) => String(row.datname));\n\n        return { rows, databases };\n    }\n\n    /** Remove a metadata row whose database is already gone. */\n    async forgetBranchRow(name: string): Promise<void> {\n        await this.db.execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);\n    }\n\n    /**\n     * Drop a database by name, with no metadata row required.\n     *\n     * `deleteBranch` deliberately takes its database name from the row, because\n     * the row is the only value that is true by construction. Prune has the\n     * opposite job — the cases it handles are exactly the ones where row and\n     * database disagree — so it needs to name a database directly. Guarded the\n     * same way regardless: the main database is never droppable.\n     */\n    async dropDatabase(dbName: string): Promise<void> {\n        validateIdentifier(dbName, \"database name\");\n        if (dbName === this.poolManager.defaultDatabaseName) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        await this.poolManager.disconnectDatabase(dbName);\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${dbName.replace(/\"/g, '\"\"')}\"`));\n        } catch (err) {\n            throw describeBranchDdlError(err, dbName);\n        }\n    }\n\n    /**\n     * List all branches recorded in the metadata table.\n     * Optionally fetches database sizes from pg_database.\n     */\n    async listBranches(): Promise<BranchInfo[]> {\n        const result = await this.db.execute(sql.raw(`\n            SELECT \n                b.name,\n                b.parent_db,\n                b.created_at,\n                pg_database_size(b.db_name) as size_bytes\n            FROM ${BRANCHES_TABLE} b\n            JOIN pg_database d ON d.datname = b.db_name\n            ORDER BY b.created_at DESC\n        `));\n\n        return (result.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes: row.size_bytes != null ? Number(row.size_bytes) : undefined\n        }));\n    }\n\n    /**\n     * Get info about a specific branch.\n     */\n    async getBranchInfo(name: string): Promise<BranchInfo | undefined> {\n        assertValidBranchName(name);\n\n        const result = await this.db.execute(sql`\n            SELECT\n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at\n            FROM rebase.branches b\n            WHERE b.name = ${name}\n        `);\n\n        const rows = result.rows as Record<string, unknown>[];\n        if (rows.length === 0) return undefined;\n\n        const row = rows[0];\n\n        // Attempt to get size — may fail if the DB was externally dropped.\n        // Same reason as `deleteBranch`: the size of a re-derived name is the\n        // size of some other database, or of nothing.\n        let sizeBytes: number | undefined;\n        try {\n            const dbName = row.db_name as string;\n            const sizeResult = await this.db.execute(\n                sql`SELECT pg_database_size(${dbName}) as size_bytes`\n            );\n            const sizeRows = sizeResult.rows as Record<string, unknown>[];\n            if (sizeRows.length > 0 && sizeRows[0].size_bytes != null) {\n                sizeBytes = Number(sizeRows[0].size_bytes);\n            }\n        } catch {\n            // Database might not exist anymore\n        }\n\n        return {\n            name: row.name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkBA,IAAM,mBAAmB;;AAGzB,IAAM,wBAAwB;;AAG9B,IAAM,mBAAmB;;;;;;;;;AAUzB,SAAS,uBAAuB,KAAc,iBAAgC;CAC1E,MAAM,UAAU,eAAe,GAAG;CAElC,IAAI,SAAS,SAAS,uBAClB,uBAAO,IAAI,MAAM,aAAa,gBAAgB,gEAAgE;CAElH,IAAI,SAAS,SAAS,kBAClB,uBAAO,IAAI,MACP,gDAAgD,gBAAgB,4EAEpE;CAKJ,MAAM,SAAS,SAAS,WAAW,oBAAoB,GAAG;CAC1D,IAAI,QAAQ,OAAO,IAAI,MAAM,MAAM;CACnC,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC7D;;AAGA,IAAM,iBAAiB;;;;;;;;;AAUvB,IAAa,4BAAb,cAA+C,MAAM;;CAEjD,OAAgB;CAEhB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;AAUA,IAAM,gCACF;;;;;AAUJ,SAAS,mBAAmB,OAAe,OAAqB;CAC5D,IAAI,CAAC,mBAAmB,KAAK,KAAK,GAC9B,MAAM,IAAI,MAAM,WAAW,MAAM,8DAA8D;AAEvG;;;;;AAMA,IAAM,yBAAyB;;;;;;;;;;;;;;;AAgB/B,SAAS,sBAAsB,MAAoB;CAC/C,mBAAmB,MAAM,aAAa;CACtC,IAAI,KAAK,SAAS,wBACd,MAAM,IAAI,MACN,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,uBAAuB,uBAAuB,uGAEpG;AAER;;;;AAKA,SAAS,eAAe,MAAsB;CAC1C,sBAAsB,IAAI;CAC1B,OAAO,GAAG,mBAAmB;AACjC;AAEA,IAAa,gBAAb,MAA2B;CAEX;CACA;CAFZ,YACI,IACA,aACF;EAFU,KAAA,KAAA;EACA,KAAA,cAAA;CACT;;;;;;;;;;;;;CAcH,MAAc,2BAA0C;EACpD,IAAI,MAAM,KAAK,YAAY,kBAAkB,GACzC,MAAM,IAAI,0BAA0B,6BAA6B;CAEzE;;;;;CAMA,MAAM,4BAA2C;EAE7C,MAAM,KAAK,GAAG,QAAQ,GAAG,oCAAoC;EAE7D,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI;yCACG,eAAe;;;;;;;SAO/C,CAAC;EAIF,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,uBAAuB,UAAU,UAAU,CAAC,CAAC;CAC/E;;;;;;;;;;CAWA,MAAM,aACF,MACA,SACmB;EACnB,MAAM,KAAK,yBAAyB;EAEpC,IAAI,SAAS,QACT,mBAAmB,QAAQ,QAAQ,sBAAsB;EAG7D,MAAM,SAAS,eAAe,IAAI;EAClC,MAAM,WAAW,SAAS,UAAU,KAAK,YAAY;EAMrD,KAAK,MAHkB,KAAK,GAAG,QAC3B,GAAG,iDAAiD,KAAK,gBAAgB,QAC7E,EAAA,CACc,KAAmB,SAAS,GACtC,MAAM,IAAI,MAAM,WAAW,KAAK,kBAAkB;EAUtD,MAAM,KAAK,YAAY,mBAAmB,QAAQ;EAElD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,QAAQ,IAC1C,GAIT,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAM/D,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,eAAe,SAAS,QAAQ,MAAM,MAAI;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QACV,IAAI,IAAI,oBAAoB,WAAW,cAAc,aAAa,EAAE,CACxE;EACJ,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAElB,MAAM,IAAI,MACN,8CAA8C,SAAS,+BACrD,MAAM,KAAK,4BAA4B,QAAQ,CACrD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,KAAK,GAAG,QACV,GAAG;0BACW,KAAK,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,YAAY,EAAE,EACrE;EAEA,OAAO;GACH;GACA,gBAAgB;GAChB,WAAW;EACf;CACJ;;;;;CAMA,MAAM,aAAa,MAAc,SAA8C;EAC3E,MAAM,KAAK,yBAAyB;EAEpC,sBAAsB,IAAI;EAK1B,IAAI,eAAe,IAAI,MAAM,KAAK,YAAY,qBAC1C,MAAM,IAAI,MAAM,kCAAkC;EAYtD,MAAM,gBAAe,MAHE,KAAK,GAAG,QAC3B,GAAG,oDAAoD,MAC3D,EAAA,CAC8B;EAC9B,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;EAEjD,MAAM,SAAS,aAAa,EAAE,CAAC;EAK/B,IAAI,WAAW,KAAK,YAAY,qBAC5B,MAAM,IAAI,MAAM,kCAAkC;EAKtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAEhD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,MAAM,IACxC,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAI3E,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,WAAW,EAAE,CAAC;EAClE,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAClB,MAAM,IAAI,MACN,yBAAyB,KAAK,6CAC5B,MAAM,KAAK,4BAA4B,MAAM,CACnD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,MAAM,KAAK,GAAG,QACV,GAAG,4CAA4C,MACnD;CACJ;;;;;;;;;;;;;;;;;;;;CAqBA,MAAc,4BAA4B,QAAiC;EACvE,IAAI;GAUA,MAAM,QAAO,MATQ,KAAK,GAAG,QAAQ,GAAG;;;;mCAIjB,OAAO;;;;aAI7B,EAAA,CACmB;GACpB,IAAI,KAAK,WAAW,GAGhB,OAAO;GAOX,OAAO,2BAJQ,KACV,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,OAAO,IAAI,GAAG,GAAG,CAAC,CACjD,KAAK,IAEwB,EAAO;;EAG7C,QAAQ;GACJ,OAAO;EACX;CACJ;;;;;;;;;;;CAYA,MAAc,qBAAqB,QAAiC;EAQhE,QAAQ,MAPa,KAAK,GAAG,QAAQ,GAAG;;;+BAGjB,OAAO;;SAE7B,EAAA,CAEc,KAAmB;CACtC;;;;;;;;;CAUA,MAAM,kBAAuE;EAezE,OAAO;GAAE,OAXK,MAHU,KAAK,GAAG,QAAQ,IAAI,IAAI;oDACJ,eAAe;SAC1D,CAAC,EAAA,CACsB,KAAmC,KAAK,SAAS;IACrE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI,KAAK,IAAI,UAAoB;GAChD,EAOS;GAAM,YAFI,MAHI,KAAK,GAAG,QAAQ,GAAG;;SAEzC,EAAA,CAC2B,KAAmC,KAAK,QAAQ,OAAO,IAAI,OAAO,CAE/E;EAAU;CAC7B;;CAGA,MAAM,gBAAgB,MAA6B;EAC/C,MAAM,KAAK,GAAG,QAAQ,GAAG,4CAA4C,MAAM;CAC/E;;;;;;;;;;CAWA,MAAM,aAAa,QAA+B;EAC9C,mBAAmB,QAAQ,eAAe;EAC1C,IAAI,WAAW,KAAK,YAAY,qBAC5B,MAAM,IAAI,MAAM,kCAAkC;EAGtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,OAAO,QAAQ,MAAM,MAAI,EAAE,EAAE,CAAC;EAClF,SAAS,KAAK;GACV,MAAM,uBAAuB,KAAK,MAAM;EAC5C;CACJ;;;;;CAMA,MAAM,eAAsC;EAYxC,QAAQ,MAXa,KAAK,GAAG,QAAQ,IAAI,IAAI;;;;;;mBAMlC,eAAe;;;SAGzB,CAAC,EAAA,CAEa,KAAmC,KAAK,SAAS;GAC5D,MAAM,IAAI;GACV,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,IAAI,KAAA;EACjE,EAAE;CACN;;;;CAKA,MAAM,cAAc,MAA+C;EAC/D,sBAAsB,IAAI;EAY1B,MAAM,QAAO,MAVQ,KAAK,GAAG,QAAQ,GAAG;;;;;;;6BAOnB,KAAK;SACzB,EAAA,CAEmB;EACpB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,MAAM,KAAK;EAKjB,IAAI;EACJ,IAAI;GACA,MAAM,SAAS,IAAI;GAInB,MAAM,YAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,2BAA2B,OAAO,gBACzC,EAAA,CAC4B;GAC5B,IAAI,SAAS,SAAS,KAAK,SAAS,EAAE,CAAC,cAAc,MACjD,YAAY,OAAO,SAAS,EAAE,CAAC,UAAU;EAEjD,QAAQ,CAER;EAEA,OAAO;GACH,MAAM,IAAI;GACV,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C;EACJ;CACJ;AACJ"}
+{"version":3,"file":"BranchService-W3DMfcZZ.js","names":[],"sources":["../src/services/BranchService.ts"],"sourcesContent":["/**\n * BranchService\n *\n * Manages database branching by creating/deleting PostgreSQL databases\n * using `CREATE DATABASE ... TEMPLATE`. Branch metadata is stored in the\n * `rebase.branches` table in the default (main) database, following the\n * same `rebase` schema convention used by entity_history, auth, etc.\n */\n\nimport { sql } from \"drizzle-orm\";\nimport { BranchInfo } from \"@rebasepro/types\";\nimport { revokeInternalTableSql } from \"@rebasepro/common\";\nimport { DrizzleClient } from \"../interfaces\";\nimport { BranchRow } from \"../branch-prune\";\nimport { DatabasePoolManager } from \"../databasePoolManager\";\nimport { extractPgError, extractCauseMessage } from \"../utils/pg-error-utils\";\n\n/** Internal prefix applied to branch database names to avoid collisions. */\nconst BRANCH_DB_PREFIX = \"rb_\";\n\n/** `duplicate_database` — the target database name is already taken. */\nconst PG_DUPLICATE_DATABASE = \"42P04\";\n\n/** `object_in_use` — the database still has connections attached. */\nconst PG_OBJECT_IN_USE = \"55006\";\n\n/**\n * Describe a failed branch DDL statement in terms a user can act on.\n *\n * Drizzle reports failures as `Failed query: <sql> params:` and hides the real\n * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees\n * the actual problem. Match on the PG error code instead — it survives wrapping\n * and, unlike the message text, is not locale-dependent.\n */\nfunction describeBranchDdlError(err: unknown, fallbackContext: string): Error {\n    const pgError = extractPgError(err);\n\n    if (pgError?.code === PG_DUPLICATE_DATABASE) {\n        return new Error(`Database \"${fallbackContext}\" already exists on the server. Choose a different branch name.`);\n    }\n    if (pgError?.code === PG_OBJECT_IN_USE) {\n        return new Error(\n            `Cannot complete the operation: the database \"${fallbackContext}\" has active connections. ` +\n            \"Close other clients or connections and try again.\"\n        );\n    }\n\n    // Unknown failure: surface the real PG message rather than the Drizzle\n    // wrapper, which would otherwise show the raw SQL and no reason at all.\n    const detail = pgError?.message ?? extractCauseMessage(err);\n    if (detail) return new Error(detail);\n    return err instanceof Error ? err : new Error(String(err));\n}\n\n/** Fully-qualified metadata table in the rebase schema. */\nconst BRANCHES_TABLE = \"rebase.branches\";\n\n/**\n * The connected server cannot branch, so nothing was done.\n *\n * A refusal, not a fault: typed so the transports can forward it intact.\n * `websocket.ts` answers it with its own code and message rather than letting\n * it fall into the generic handler, which suppresses the text in production —\n * and the text is the only part that says what to do instead.\n */\nexport class BranchingUnsupportedError extends Error {\n    /** Wire code, forwarded verbatim to the client. */\n    readonly code = \"BRANCHING_UNSUPPORTED\";\n\n    constructor(message: string) {\n        super(message);\n        this.name = \"BranchingUnsupportedError\";\n    }\n}\n\n/**\n * What to say when the server serves one database.\n *\n * Deliberately the same argument the CLI's `refuseBranchOnManagedDatabase`\n * makes, because it is the same refusal — it just used to be available only to\n * whoever came in through argv. One paragraph, because this one has to fit in a\n * toast as well as a terminal.\n */\nconst BRANCHING_UNSUPPORTED_MESSAGE =\n    \"Branching does not work on the managed development database. It copies a database with \"\n    + \"CREATE DATABASE ... TEMPLATE, and the managed database is PGlite, which serves exactly one — \"\n    + \"the copy would be the original, and every write you meant to sandbox would land in it. \"\n    + \"Branching needs a real Postgres: run `rebase dev --docker`, or uncomment DATABASE_URL in .env \"\n    + \"to point at your own.\";\n\n/**\n * Validate that a user-provided identifier only contains safe characters.\n * Throws if the value contains characters outside [a-zA-Z0-9_-].\n */\nfunction validateIdentifier(value: string, label: string): void {\n    if (!/^[a-zA-Z0-9_-]+$/.test(value)) {\n        throw new Error(`Invalid ${label}: only letters, digits, underscores, and hyphens are allowed.`);\n    }\n}\n\n/**\n * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it\n * silently. The prefix comes out of the same budget.\n */\nconst MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;\n\n/**\n * Check a user-provided branch name, and otherwise leave it exactly as given.\n *\n * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was\n * quietly created as `myfeature`: the name you typed was not the name `list`\n * gave back. Nothing ever needed that. Every identifier this service builds is\n * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen\n * safe, and `validateIdentifier` has always accepted hyphens for the `--from`\n * source database — the two disagreed about the same character class.\n *\n * Refusing a name we cannot represent is better than representing a different\n * one, which is also why the length is checked here rather than left to\n * Postgres, whose answer to an over-long identifier is a silent rename.\n */\nfunction assertValidBranchName(name: string): void {\n    validateIdentifier(name, \"branch name\");\n    if (name.length > MAX_BRANCH_NAME_LENGTH) {\n        throw new Error(\n            `Branch name \"${name}\" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +\n            \"Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose.\"\n        );\n    }\n}\n\n/**\n * Convert a user-facing branch name to the actual PostgreSQL database name.\n */\nfunction toBranchDbName(name: string): string {\n    assertValidBranchName(name);\n    return `${BRANCH_DB_PREFIX}${name}`;\n}\n\nexport class BranchService {\n    constructor(\n        private db: DrizzleClient,\n        private poolManager: DatabasePoolManager\n    ) {}\n\n    /**\n     * Refuse a branch mutation the connected server cannot honour.\n     *\n     * The check lives here rather than in the CLI's argv parsing because the\n     * CLI is not the only caller: Studio reaches `createBranch` over the\n     * websocket, and before this it got \"Branch created successfully\" and a\n     * detail pane promising isolation for a database that is the parent.\n     *\n     * Reads only, and only mutations are guarded: `listBranches` on a managed\n     * database is an honest empty list, and refusing it would turn the Branches\n     * pane into a failure with a \"Try again\" that can never succeed.\n     */\n    private async assertBranchingSupported(): Promise<void> {\n        if (await this.poolManager.servesOneDatabase()) {\n            throw new BranchingUnsupportedError(BRANCHING_UNSUPPORTED_MESSAGE);\n        }\n    }\n\n    /**\n     * Ensure the `rebase.branches` metadata table exists in the default database.\n     * Idempotent — safe to call on every startup.\n     */\n    async ensureBranchMetadataTable(): Promise<void> {\n        // Create the rebase schema (idempotent — may already exist from auth/history init)\n        await this.db.execute(sql`CREATE SCHEMA IF NOT EXISTS rebase`);\n\n        await this.db.execute(sql.raw(`\n            CREATE TABLE IF NOT EXISTS ${BRANCHES_TABLE} (\n                name         TEXT PRIMARY KEY,\n                db_name      TEXT NOT NULL UNIQUE,\n                parent_db    TEXT NOT NULL,\n                created_at   TIMESTAMPTZ NOT NULL DEFAULT NOW(),\n                metadata     JSONB DEFAULT '{}'\n            );\n        `));\n\n        // Not a collection, so no RLS — and it names every branch database on\n        // this server. The driver's schema-wide grant reaches it, so revoke.\n        await this.db.execute(sql.raw(revokeInternalTableSql(\"rebase\", \"branches\")));\n    }\n\n    /**\n     * Create a new branch database by templating the source database.\n     *\n     * Uses `CREATE DATABASE ... TEMPLATE` for an instant, full-fidelity copy\n     * of both schema and data.\n     *\n     * @param name   User-facing branch name (e.g., \"feature_auth\")\n     * @param options.source  Source database to clone; defaults to the main database.\n     */\n    async createBranch(\n        name: string,\n        options?: { source?: string; force?: boolean }\n    ): Promise<BranchInfo> {\n        await this.assertBranchingSupported();\n\n        if (options?.source) {\n            validateIdentifier(options.source, \"source database name\");\n        }\n\n        const dbName = toBranchDbName(name);\n        const sourceDb = options?.source || this.poolManager.defaultDatabaseName;\n\n        // Check if branch already exists\n        const existing = await this.db.execute(\n            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`\n        );\n        if ((existing.rows as unknown[]).length > 0) {\n            throw new Error(`Branch \"${name}\" already exists.`);\n        }\n\n        // Disconnect any idle pools to the source DB so TEMPLATE works.\n        // CREATE DATABASE ... TEMPLATE requires no other connections to the template.\n        //\n        // This only reaches pools inside *this* process. The CLI runs as its own\n        // process, so a `rebase dev` holding the database open is untouched by\n        // it — which is why the failure below has to name what is connected, and\n        // why `--force` exists.\n        await this.poolManager.disconnectDatabase(sourceDb);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(sourceDb);\n            if (closed > 0) {\n                // Postgres reports the backend as gone before its slot is\n                // actually free, and CREATE DATABASE then fails on a connection\n                // that no longer exists. One short settle beats a confusing retry.\n                await new Promise((resolve) => setTimeout(resolve, 250));\n            }\n        }\n\n        // Create the database using the source as a template.\n        // Note: Identifiers must be double-quoted, not parameterized.\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        const safeSourceDb = sourceDb.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(\n                sql.raw(`CREATE DATABASE \"${safeDbName}\" TEMPLATE \"${safeSourceDb}\"`)\n            );\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                // The template — not the new database — is the one still in use.\n                throw new Error(\n                    `Cannot create branch: the source database \"${sourceDb}\" has active connections.\\n`\n                    + await this.describeBlockingConnections(sourceDb)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Record metadata in the default database\n        const now = new Date();\n        await this.db.execute(\n            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)\n                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`\n        );\n\n        return {\n            name,\n            parentDatabase: sourceDb,\n            createdAt: now\n        };\n    }\n\n    /**\n     * Delete a branch database and remove its metadata.\n     * Cannot delete the main/default database.\n     */\n    async deleteBranch(name: string, options?: { force?: boolean }): Promise<void> {\n        await this.assertBranchingSupported();\n\n        assertValidBranchName(name);\n\n        // Safety, first pass: a request that would target the default database\n        // is refused before any metadata is read, so the answer costs nothing\n        // and cannot depend on what a row happens to say.\n        if (toBranchDbName(name) === this.poolManager.defaultDatabaseName) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Verify the branch exists, and take the database name from the row\n        // rather than deriving it again. A branch created before names stopped\n        // being stripped is recorded as `rb_myfeature` while `my-feature` now\n        // derives `rb_my-feature`; re-deriving would drop a database this row\n        // never named — or, if that name happened to exist, somebody else's.\n        // The stored value is the only one that is true by construction.\n        const existing = await this.db.execute(\n            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`\n        );\n        const existingRows = existing.rows as Record<string, unknown>[];\n        if (existingRows.length === 0) {\n            throw new Error(`Branch \"${name}\" not found.`);\n        }\n        const dbName = existingRows[0].db_name as string;\n\n        // Safety, second pass: the first checked a name we derived, this checks\n        // the one we are about to drop. They differ for any row written under\n        // the old scheme, and it is this one that governs.\n        if (dbName === this.poolManager.defaultDatabaseName) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        // Disconnect any pools to this branch before dropping. Same limit as\n        // `createBranch`: in-process pools only.\n        await this.poolManager.disconnectDatabase(dbName);\n\n        if (options?.force) {\n            const closed = await this.terminateConnections(dbName);\n            if (closed > 0) await new Promise((resolve) => setTimeout(resolve, 250));\n        }\n\n        // Drop the database\n        const safeDbName = dbName.replace(/\"/g, '\"\"');\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${safeDbName}\"`));\n        } catch (err) {\n            const pgError = extractPgError(err);\n            if (pgError?.code === PG_OBJECT_IN_USE) {\n                throw new Error(\n                    `Cannot delete branch \"${name}\": the database has active connections.\\n`\n                    + await this.describeBlockingConnections(dbName)\n                );\n            }\n            throw describeBranchDdlError(err, dbName);\n        }\n\n        // Remove metadata\n        await this.db.execute(\n            sql`DELETE FROM rebase.branches WHERE name = ${name}`\n        );\n    }\n\n    /**\n     * Who is holding the database open, in words a developer can act on.\n     *\n     * `CREATE DATABASE ... TEMPLATE` and `DROP DATABASE` both require that no\n     * other session is connected, and the one thing the old message could not\n     * say is the only thing worth knowing: *which* session. \"Close other\n     * clients or connections and try again\" is advice you cannot follow when\n     * you do not know there is a `rebase dev` in another terminal — and that is\n     * the common case, because wanting a branch and running the app are the\n     * same moment.\n     *\n     * `application_name` is the useful column: node-postgres sends none by\n     * default, so a Rebase process shows as `(unnamed)` while DBeaver, pgAdmin\n     * and psql all name themselves. Counting by it separates \"my own dev\n     * server\" from \"the GUI I forgot about\" without any guessing.\n     *\n     * Best-effort by construction: this runs while reporting a failure, and a\n     * diagnostic that throws would replace a real error with its own.\n     */\n    private async describeBlockingConnections(dbName: string): Promise<string> {\n        try {\n            const result = await this.db.execute(sql`\n                SELECT coalesce(nullif(application_name, ''), '(unnamed)') AS app,\n                       count(*)::int AS n\n                  FROM pg_stat_activity\n                 WHERE datname = ${dbName}\n                   AND pid <> pg_backend_pid()\n                 GROUP BY 1\n                 ORDER BY 2 DESC, 1\n            `);\n            const rows = result.rows as Record<string, unknown>[];\n            if (rows.length === 0) {\n                // The blocker went away between the failure and this query, or\n                // it is a session Postgres does not attribute to this database.\n                return \"  Retry — whatever was connected has since disconnected.\";\n            }\n\n            const listed = rows\n                .map((row) => `    ${row.n} × ${String(row.app)}`)\n                .join(\"\\n\");\n\n            return `  Connected right now:\\n${listed}\\n`\n                + \"  A running `rebase dev` is the usual one — stop it, or re-run with --force to\\n\"\n                + \"  disconnect them for you.\";\n        } catch {\n            return \"  Close other clients and connections, or re-run with --force.\";\n        }\n    }\n\n    /**\n     * Disconnect every other session on a database, and say how many.\n     *\n     * `pg_terminate_backend` rather than `pg_cancel_backend`: cancelling a\n     * query leaves the session connected, and a connected session is exactly\n     * what blocks the operation.\n     *\n     * The current backend is excluded — terminating the connection running this\n     * statement would abort the command that asked for it.\n     */\n    private async terminateConnections(dbName: string): Promise<number> {\n        const result = await this.db.execute(sql`\n            SELECT pg_terminate_backend(pid)\n              FROM pg_stat_activity\n             WHERE datname = ${dbName}\n               AND pid <> pg_backend_pid()\n        `);\n\n        return (result.rows as unknown[]).length;\n    }\n\n    /**\n     * Everything prune needs to decide, in two queries.\n     *\n     * Reads the rows and the server's database list rather than joining them,\n     * so the *disagreements* between the two are visible — a row whose database\n     * is gone and a database with no row are the two things prune exists to\n     * find, and a join hides both.\n     */\n    async pruneCandidates(): Promise<{ rows: BranchRow[]; databases: string[] }> {\n        const rowResult = await this.db.execute(sql.raw(`\n            SELECT name, db_name, created_at FROM ${BRANCHES_TABLE} ORDER BY created_at\n        `));\n        const rows = (rowResult.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            dbName: row.db_name as string,\n            createdAt: new Date(row.created_at as string)\n        }));\n\n        const dbResult = await this.db.execute(sql`\n            SELECT datname FROM pg_database WHERE NOT datistemplate\n        `);\n        const databases = (dbResult.rows as Record<string, unknown>[]).map((row) => String(row.datname));\n\n        return { rows, databases };\n    }\n\n    /** Remove a metadata row whose database is already gone. */\n    async forgetBranchRow(name: string): Promise<void> {\n        await this.db.execute(sql`DELETE FROM rebase.branches WHERE name = ${name}`);\n    }\n\n    /**\n     * Drop a database by name, with no metadata row required.\n     *\n     * `deleteBranch` deliberately takes its database name from the row, because\n     * the row is the only value that is true by construction. Prune has the\n     * opposite job — the cases it handles are exactly the ones where row and\n     * database disagree — so it needs to name a database directly. Guarded the\n     * same way regardless: the main database is never droppable.\n     */\n    async dropDatabase(dbName: string): Promise<void> {\n        validateIdentifier(dbName, \"database name\");\n        if (dbName === this.poolManager.defaultDatabaseName) {\n            throw new Error(\"Cannot delete the main database.\");\n        }\n\n        await this.poolManager.disconnectDatabase(dbName);\n        try {\n            await this.db.execute(sql.raw(`DROP DATABASE \"${dbName.replace(/\"/g, '\"\"')}\"`));\n        } catch (err) {\n            throw describeBranchDdlError(err, dbName);\n        }\n    }\n\n    /**\n     * List all branches recorded in the metadata table.\n     * Optionally fetches database sizes from pg_database.\n     */\n    async listBranches(): Promise<BranchInfo[]> {\n        const result = await this.db.execute(sql.raw(`\n            SELECT \n                b.name,\n                b.parent_db,\n                b.created_at,\n                pg_database_size(b.db_name) as size_bytes\n            FROM ${BRANCHES_TABLE} b\n            JOIN pg_database d ON d.datname = b.db_name\n            ORDER BY b.created_at DESC\n        `));\n\n        return (result.rows as Record<string, unknown>[]).map((row) => ({\n            name: row.name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes: row.size_bytes != null ? Number(row.size_bytes) : undefined\n        }));\n    }\n\n    /**\n     * Get info about a specific branch.\n     */\n    async getBranchInfo(name: string): Promise<BranchInfo | undefined> {\n        assertValidBranchName(name);\n\n        const result = await this.db.execute(sql`\n            SELECT\n                b.name,\n                b.db_name,\n                b.parent_db,\n                b.created_at\n            FROM rebase.branches b\n            WHERE b.name = ${name}\n        `);\n\n        const rows = result.rows as Record<string, unknown>[];\n        if (rows.length === 0) return undefined;\n\n        const row = rows[0];\n\n        // Attempt to get size — may fail if the DB was externally dropped.\n        // Same reason as `deleteBranch`: the size of a re-derived name is the\n        // size of some other database, or of nothing.\n        let sizeBytes: number | undefined;\n        try {\n            const dbName = row.db_name as string;\n            const sizeResult = await this.db.execute(\n                sql`SELECT pg_database_size(${dbName}) as size_bytes`\n            );\n            const sizeRows = sizeResult.rows as Record<string, unknown>[];\n            if (sizeRows.length > 0 && sizeRows[0].size_bytes != null) {\n                sizeBytes = Number(sizeRows[0].size_bytes);\n            }\n        } catch {\n            // Database might not exist anymore\n        }\n\n        return {\n            name: row.name as string,\n            parentDatabase: row.parent_db as string,\n            createdAt: new Date(row.created_at as string),\n            sizeBytes\n        };\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkBA,IAAM,mBAAmB;;AAGzB,IAAM,wBAAwB;;AAG9B,IAAM,mBAAmB;;;;;;;;;AAUzB,SAAS,uBAAuB,KAAc,iBAAgC;CAC1E,MAAM,UAAU,eAAe,GAAG;CAElC,IAAI,SAAS,SAAS,uBAClB,uBAAO,IAAI,MAAM,aAAa,gBAAgB,gEAAgE;CAElH,IAAI,SAAS,SAAS,kBAClB,uBAAO,IAAI,MACP,gDAAgD,gBAAgB,4EAEpE;CAKJ,MAAM,SAAS,SAAS,WAAW,oBAAoB,GAAG;CAC1D,IAAI,QAAQ,OAAO,IAAI,MAAM,MAAM;CACnC,OAAO,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC;AAC7D;;AAGA,IAAM,iBAAiB;;;;;;;;;AAUvB,IAAa,4BAAb,cAA+C,MAAM;;CAEjD,OAAgB;CAEhB,YAAY,SAAiB;EACzB,MAAM,OAAO;EACb,KAAK,OAAO;CAChB;AACJ;;;;;;;;;AAUA,IAAM,gCACF;;;;;AAUJ,SAAS,mBAAmB,OAAe,OAAqB;CAC5D,IAAI,CAAC,mBAAmB,KAAK,KAAK,GAC9B,MAAM,IAAI,MAAM,WAAW,MAAM,8DAA8D;AAEvG;;;;;AAMA,IAAM,yBAAyB;;;;;;;;;;;;;;;AAgB/B,SAAS,sBAAsB,MAAoB;CAC/C,mBAAmB,MAAM,aAAa;CACtC,IAAI,KAAK,SAAS,wBACd,MAAM,IAAI,MACN,gBAAgB,KAAK,iBAAiB,KAAK,OAAO,uBAAuB,uBAAuB,uGAEpG;AAER;;;;AAKA,SAAS,eAAe,MAAsB;CAC1C,sBAAsB,IAAI;CAC1B,OAAO,GAAG,mBAAmB;AACjC;AAEA,IAAa,gBAAb,MAA2B;CAEX;CACA;CAFZ,YACI,IACA,aACF;EAFU,KAAA,KAAA;EACA,KAAA,cAAA;CACT;;;;;;;;;;;;;CAcH,MAAc,2BAA0C;EACpD,IAAI,MAAM,KAAK,YAAY,kBAAkB,GACzC,MAAM,IAAI,0BAA0B,6BAA6B;CAEzE;;;;;CAMA,MAAM,4BAA2C;EAE7C,MAAM,KAAK,GAAG,QAAQ,GAAG,oCAAoC;EAE7D,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI;yCACG,eAAe;;;;;;;SAO/C,CAAC;EAIF,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,uBAAuB,UAAU,UAAU,CAAC,CAAC;CAC/E;;;;;;;;;;CAWA,MAAM,aACF,MACA,SACmB;EACnB,MAAM,KAAK,yBAAyB;EAEpC,IAAI,SAAS,QACT,mBAAmB,QAAQ,QAAQ,sBAAsB;EAG7D,MAAM,SAAS,eAAe,IAAI;EAClC,MAAM,WAAW,SAAS,UAAU,KAAK,YAAY;EAMrD,KAAK,MAHkB,KAAK,GAAG,QAC3B,GAAG,iDAAiD,KAAK,gBAAgB,QAC7E,EAAA,CACc,KAAmB,SAAS,GACtC,MAAM,IAAI,MAAM,WAAW,KAAK,kBAAkB;EAUtD,MAAM,KAAK,YAAY,mBAAmB,QAAQ;EAElD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,QAAQ,IAC1C,GAIT,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAM/D,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,MAAM,eAAe,SAAS,QAAQ,MAAM,MAAI;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QACV,IAAI,IAAI,oBAAoB,WAAW,cAAc,aAAa,EAAE,CACxE;EACJ,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAElB,MAAM,IAAI,MACN,8CAA8C,SAAS,+BACrD,MAAM,KAAK,4BAA4B,QAAQ,CACrD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,MAAM,sBAAM,IAAI,KAAK;EACrB,MAAM,KAAK,GAAG,QACV,GAAG;0BACW,KAAK,IAAI,OAAO,IAAI,SAAS,IAAI,IAAI,YAAY,EAAE,EACrE;EAEA,OAAO;GACH;GACA,gBAAgB;GAChB,WAAW;EACf;CACJ;;;;;CAMA,MAAM,aAAa,MAAc,SAA8C;EAC3E,MAAM,KAAK,yBAAyB;EAEpC,sBAAsB,IAAI;EAK1B,IAAI,eAAe,IAAI,MAAM,KAAK,YAAY,qBAC1C,MAAM,IAAI,MAAM,kCAAkC;EAYtD,MAAM,gBAAe,MAHE,KAAK,GAAG,QAC3B,GAAG,oDAAoD,MAC3D,EAAA,CAC8B;EAC9B,IAAI,aAAa,WAAW,GACxB,MAAM,IAAI,MAAM,WAAW,KAAK,aAAa;EAEjD,MAAM,SAAS,aAAa,EAAE,CAAC;EAK/B,IAAI,WAAW,KAAK,YAAY,qBAC5B,MAAM,IAAI,MAAM,kCAAkC;EAKtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAEhD,IAAI,SAAS;OAEL,MADiB,KAAK,qBAAqB,MAAM,IACxC,GAAG,MAAM,IAAI,SAAS,YAAY,WAAW,SAAS,GAAG,CAAC;EAAA;EAI3E,MAAM,aAAa,OAAO,QAAQ,MAAM,MAAI;EAC5C,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,WAAW,EAAE,CAAC;EAClE,SAAS,KAAK;GAEV,IADgB,eAAe,GAC3B,CAAA,EAAS,SAAS,kBAClB,MAAM,IAAI,MACN,yBAAyB,KAAK,6CAC5B,MAAM,KAAK,4BAA4B,MAAM,CACnD;GAEJ,MAAM,uBAAuB,KAAK,MAAM;EAC5C;EAGA,MAAM,KAAK,GAAG,QACV,GAAG,4CAA4C,MACnD;CACJ;;;;;;;;;;;;;;;;;;;;CAqBA,MAAc,4BAA4B,QAAiC;EACvE,IAAI;GAUA,MAAM,QAAO,MATQ,KAAK,GAAG,QAAQ,GAAG;;;;mCAIjB,OAAO;;;;aAI7B,EAAA,CACmB;GACpB,IAAI,KAAK,WAAW,GAGhB,OAAO;GAOX,OAAO,2BAJQ,KACV,KAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,OAAO,IAAI,GAAG,GAAG,CAAC,CACjD,KAAK,IAEwB,EAAO;;EAG7C,QAAQ;GACJ,OAAO;EACX;CACJ;;;;;;;;;;;CAYA,MAAc,qBAAqB,QAAiC;EAQhE,QAAQ,MAPa,KAAK,GAAG,QAAQ,GAAG;;;+BAGjB,OAAO;;SAE7B,EAAA,CAEc,KAAmB;CACtC;;;;;;;;;CAUA,MAAM,kBAAuE;EAezE,OAAO;GAAE,OAXK,MAHU,KAAK,GAAG,QAAQ,IAAI,IAAI;oDACJ,eAAe;SAC1D,CAAC,EAAA,CACsB,KAAmC,KAAK,SAAS;IACrE,MAAM,IAAI;IACV,QAAQ,IAAI;IACZ,WAAW,IAAI,KAAK,IAAI,UAAoB;GAChD,EAOS;GAAM,YAFI,MAHI,KAAK,GAAG,QAAQ,GAAG;;SAEzC,EAAA,CAC2B,KAAmC,KAAK,QAAQ,OAAO,IAAI,OAAO,CAE/E;EAAU;CAC7B;;CAGA,MAAM,gBAAgB,MAA6B;EAC/C,MAAM,KAAK,GAAG,QAAQ,GAAG,4CAA4C,MAAM;CAC/E;;;;;;;;;;CAWA,MAAM,aAAa,QAA+B;EAC9C,mBAAmB,QAAQ,eAAe;EAC1C,IAAI,WAAW,KAAK,YAAY,qBAC5B,MAAM,IAAI,MAAM,kCAAkC;EAGtD,MAAM,KAAK,YAAY,mBAAmB,MAAM;EAChD,IAAI;GACA,MAAM,KAAK,GAAG,QAAQ,IAAI,IAAI,kBAAkB,OAAO,QAAQ,MAAM,MAAI,EAAE,EAAE,CAAC;EAClF,SAAS,KAAK;GACV,MAAM,uBAAuB,KAAK,MAAM;EAC5C;CACJ;;;;;CAMA,MAAM,eAAsC;EAYxC,QAAQ,MAXa,KAAK,GAAG,QAAQ,IAAI,IAAI;;;;;;mBAMlC,eAAe;;;SAGzB,CAAC,EAAA,CAEa,KAAmC,KAAK,SAAS;GAC5D,MAAM,IAAI;GACV,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C,WAAW,IAAI,cAAc,OAAO,OAAO,IAAI,UAAU,IAAI,KAAA;EACjE,EAAE;CACN;;;;CAKA,MAAM,cAAc,MAA+C;EAC/D,sBAAsB,IAAI;EAY1B,MAAM,QAAO,MAVQ,KAAK,GAAG,QAAQ,GAAG;;;;;;;6BAOnB,KAAK;SACzB,EAAA,CAEmB;EACpB,IAAI,KAAK,WAAW,GAAG,OAAO,KAAA;EAE9B,MAAM,MAAM,KAAK;EAKjB,IAAI;EACJ,IAAI;GACA,MAAM,SAAS,IAAI;GAInB,MAAM,YAAW,MAHQ,KAAK,GAAG,QAC7B,GAAG,2BAA2B,OAAO,gBACzC,EAAA,CAC4B;GAC5B,IAAI,SAAS,SAAS,KAAK,SAAS,EAAE,CAAC,cAAc,MACjD,YAAY,OAAO,SAAS,EAAE,CAAC,UAAU;EAEjD,QAAQ,CAER;EAEA,OAAO;GACH,MAAM,IAAI;GACV,gBAAgB,IAAI;GACpB,WAAW,IAAI,KAAK,IAAI,UAAoB;GAC5C;EACJ;CACJ;AACJ"}

package/dist/PostgresBackendDriver.d.ts

@@ -3,7 +3,7 @@ import { BranchService } from "./services/BranchService.js";
 import { RealtimeService } from "./services/realtimeService.js";
 import { DatabasePoolManager } from "./databasePoolManager.js";
 import { DrizzleClient } from "./interfaces.js";
-import { DatabaseAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseClient, RebaseSdkData, RestFetchService, SaveManyProps, SaveProps, UpdateManyProps, DeleteManyProps, TableMetadata, User } from "@rebasepro/types";
+import { DatabaseAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseClient, RebaseSdkData, RestFetchService, BatchWriteProps, SaveManyProps, SaveProps, UpdateManyProps, DeleteManyProps, TableMetadata, User } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry.js";
 import { HistoryService } from "./history/HistoryService.js";
 /**
@@ -160,9 +160,44 @@ export declare class PostgresBackendDriver implements DataDriver {
     applyAfterReadForRest(rows: Record<string, unknown>[], path: string): Promise<Record<string, unknown>[]>;
     fetchCollection<M extends Record<string, unknown>>({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, vectorSearch }: FetchCollectionProps<M>): Promise<Record<string, unknown>[]>;
     listenCollection<M extends Record<string, unknown>>({ path, collection, filter, limit, offset, startAfter, orderBy, searchString, order, onUpdate, onError }: ListenCollectionProps<M>): () => void;
-    fetchOne<M extends Record<string, unknown>>({ path, id, databaseId, collection }: FetchOneProps<M>): Promise<Record<string, unknown> | undefined>;
+    fetchOne<M extends Record<string, unknown>>({ path, id, databaseId, collection, withDeleted }: FetchOneProps<M>): Promise<Record<string, unknown> | undefined>;
     listenOne<M extends Record<string, unknown>>({ path, id, collection, onUpdate, onError }: ListenOneProps<M>): () => void;
-    save<M extends Record<string, unknown>>({ path, id, values, collection, status, upsert }: SaveProps<M>): Promise<Record<string, unknown>>;
+    /**
+     * How many membership rows a single write will read to answer "which
+     * tenants is this caller in".
+     *
+     * A cap, not a limit on the feature: past it the API-level check stops
+     * being able to prove a tenant is *not* the caller's, and defers to the
+     * policy's `WITH CHECK`, which decides either way. The alternative — an
+     * uncapped read of a membership table on every insert — makes the cost of a
+     * write depend on how many organizations one user happens to belong to.
+     */
+    private static readonly TENANT_MEMBERSHIP_CAP;
+    /**
+     * Stamp, or refuse, the tenant on a write to a `tenant`-scoped collection.
+     *
+     * A no-op for every collection that declares no tenancy, which is the
+     * common case and costs one property read.
+     */
+    private applyTenantScope;
+    /**
+     * The tenants this caller may write into.
+     *
+     * Two sources, and they answer at different costs. A `claim` is already on
+     * the request — no query. A `membership` is rows in a table, and reading
+     * them is a real query, so it is capped (see
+     * {@link PostgresBackendDriver.TENANT_MEMBERSHIP_CAP}) and `complete` says
+     * whether the cap was hit.
+     *
+     * The membership read runs in the caller's own context, so the membership
+     * collection's RLS applies to it — exactly as it does inside the generated
+     * policy's subquery. That is deliberate: if the two disagreed, the API
+     * would refuse writes the database would have accepted, or accept writes it
+     * refuses. `validateCollectionConfig` is what makes sure the membership
+     * collection is readable by its own members in the first place.
+     */
+    private resolveCallerTenants;
+    save<M extends Record<string, unknown>>({ path, id, values, collection, status, upsert, onConflict }: SaveProps<M>): Promise<Record<string, unknown>>;
     /**
      * Write many rows through the same pipeline as {@link save}.
      *
@@ -175,7 +210,8 @@ export declare class PostgresBackendDriver implements DataDriver {
      * Rows are applied in order, so a batch that touches the same key twice ends
      * with the last write winning, exactly as separate calls would.
      */
-    saveMany<M extends Record<string, unknown>>({ path, rows, collection, upsert }: SaveManyProps<M>): Promise<Record<string, unknown>[]>;
+    private bindToTransaction;
+    saveMany<M extends Record<string, unknown>>({ path, rows, collection, upsert, onConflict }: SaveManyProps<M>): Promise<Record<string, unknown>[]>;
     /**
      * Update many rows through the same pipeline as {@link save}, in one
      * transaction.
@@ -203,11 +239,28 @@ export declare class PostgresBackendDriver implements DataDriver {
      * dependents would behave differently depending on how many rows the caller
      * happened to delete at once. Same pipeline, one transaction.
      */
-    deleteMany<M extends Record<string, unknown>>({ path, ids, collection }: DeleteManyProps<M>): Promise<void>;
-    delete<M extends Record<string, unknown>>({ row, collection }: DeleteProps<M>): Promise<void>;
+    deleteMany<M extends Record<string, unknown>>({ path, ids, collection, hard }: DeleteManyProps<M>): Promise<void>;
+    /**
+     * A mixed list of writes across collections, as one unit of work.
+     *
+     * Same transaction, same tx-bound sub-driver and same per-entry error
+     * labelling as {@link saveMany} — deliberately the same plumbing rather
+     * than a second copy of it, because the three ways this could drift
+     * (notifications not deferred, the sub-driver not bound, an error losing
+     * its status) are all silent.
+     *
+     * The one thing this adds is `$ref`. An operation may name itself, and a
+     * later one may stand a `{ "$ref": "order.id" }` where a value goes; the
+     * substitution happens here because inside the transaction is the only
+     * place the row the reference points at exists. Backward references only —
+     * the REST layer refuses a forward one before the transaction opens, so a
+     * body that cannot work never costs a rollback.
+     */
+    batchWrite<M extends Record<string, unknown>>({ operations }: BatchWriteProps<M>): Promise<(Record<string, unknown> | null)[]>;
+    delete<M extends Record<string, unknown>>({ row, collection, hard }: DeleteProps<M>): Promise<void>;
     deleteAll(path: string): Promise<void>;
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;
-    count<M extends Record<string, unknown>>({ path, collection, filter, logical, searchString, vectorSearch }: FetchCollectionProps<M>): Promise<number>;
+    count<M extends Record<string, unknown>>({ path, collection, filter, logical, searchString, vectorSearch, withDeleted }: FetchCollectionProps<M>): Promise<number>;
     private getTargetDb;
     /**
      * Build one statement, binding `$n` placeholders as real parameters.
@@ -294,6 +347,27 @@ export declare class AuthenticatedPostgresBackendDriver implements DataDriver {
      * `withTransaction`, so a batch does not flood subscribers mid-flight.
      */
     saveMany<M extends Record<string, unknown>>(props: SaveManyProps<M>): Promise<Record<string, unknown>[]>;
+    /**
+     * Present for the same reason `saveMany` is, and absent until now.
+     *
+     * Every request that reaches the REST layer is served by *this* class — the
+     * base driver never sees one — and the routes ask `if (!driver.updateMany)`
+     * before doing anything. So `PATCH /api/data/<c>/bulk` and
+     * `POST /api/data/<c>/bulk/delete` answered `BULK_UNSUPPORTED` on Postgres,
+     * the one backend that implements them, for every authenticated caller.
+     * The methods existed one class down and nothing forwarded to them.
+     */
+    updateMany<M extends Record<string, unknown>>(props: UpdateManyProps<M>): Promise<Record<string, unknown>[]>;
+    deleteMany<M extends Record<string, unknown>>(props: DeleteManyProps<M>): Promise<void>;
+    /**
+     * One transaction, one RLS context, every collection the batch touches.
+     *
+     * The whole point is that it runs as the caller: a batch that dropped to
+     * the base driver would write across collections with row-level security
+     * switched off, which is the opposite of what a cross-collection write
+     * needs.
+     */
+    batchWrite<M extends Record<string, unknown>>(props: BatchWriteProps<M>): Promise<(Record<string, unknown> | null)[]>;
     delete<M extends Record<string, unknown>>(props: DeleteProps<M>): Promise<void>;
     deleteAll(path: string): Promise<void>;
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;

package/dist/PostgresBootstrapper.d.ts

@@ -16,6 +16,16 @@ export interface PostgresDriverConfig {
     adminConnectionString?: string;
     readConnectionString?: string;
     connection?: unknown;
+    /**
+     * The project's generated Drizzle module, for **diagnostics only**.
+     *
+     * The tables this driver serves are read from `information_schema` at boot
+     * (see `catalogue-schema.ts`); the only thing this is used for is telling
+     * the developer that their committed `schema.generated.ts` no longer
+     * describes the database, which still matters for Atlas, `db push`, `eject`
+     * and any code importing it. Leaving it out costs the warning and nothing
+     * else.
+     */
     schema?: {
         tables?: Record<string, unknown>;
         enums?: Record<string, unknown>;

package/dist/{backup-cli-oM9WQVlV.js → backup-cli-DSpQyqcG.js}

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { a as __toESM, t as require___vite_browser_external } from "./__vite-browser-external-BnuHet1e.js";
 import { n as outError, r as outWarn, t as out } from "./cli-output-CNdMql-L.js";
-import { D as parseBackupDestination, P as withDatabaseName, T as globalsFileForDump, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-Br3tqwsy.js";
+import { D as parseBackupDestination, P as withDatabaseName, T as globalsFileForDump, h as validateDump, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as listBackups, m as uploadBackup, n as applyGlobals, o as discardPartialDump, p as restoreDump, s as ensureDatabaseExists, t as BackupToolError, u as preflight } from "./backup-service-DA7a6SUV.js";
 import { t as chalk } from "./source-Br7L7GOI.js";
 import { t as require_arg } from "./arg-Dni7MzLB.js";
 import fs from "fs";
@@ -405,4 +405,4 @@ ${chalk.green.bold("Usage")}
 //#endregion
 export { backupCommand, backupsCommand, restoreCommand };
 
-//# sourceMappingURL=backup-cli-oM9WQVlV.js.map
+//# sourceMappingURL=backup-cli-DSpQyqcG.js.map

package/dist/{backup-cli-oM9WQVlV.js.map → backup-cli-DSpQyqcG.js.map}

@@ -1 +1 @@
-{"version":3,"file":"backup-cli-oM9WQVlV.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport readline from \"readline\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    listBackups,\n    preflight,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/**\n * Build a StorageController for an object-storage destination from the same\n * `S3_*` env vars the backend uses. Returns `null` for local destinations.\n */\nasync function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    if (dest.kind === \"gcs\") {\n        const { GCSStorageController } = await import(\"@rebasepro/server\");\n        return new GCSStorageController({ type: \"gcs\", bucket: dest.bucket });\n    }\n    // s3 (also covers R2/MinIO/Hetzner/GCS-interop via S3_ENDPOINT)\n    if (!env.S3_ACCESS_KEY_ID || !env.S3_SECRET_ACCESS_KEY) {\n        throw new BackupToolError(\n            \"S3 destination requires S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY in the environment.\",\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n    const { S3StorageController } = await import(\"@rebasepro/server\");\n    return new S3StorageController({\n        type: \"s3\",\n        bucket: dest.bucket,\n        region: env.S3_REGION || \"auto\",\n        accessKeyId: env.S3_ACCESS_KEY_ID,\n        secretAccessKey: env.S3_SECRET_ACCESS_KEY,\n        endpoint: env.S3_ENDPOINT,\n        forcePathStyle: env.S3_FORCE_PATH_STYLE === \"true\"\n    });\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\nasync function promptConfirm(question: string): Promise<boolean> {\n    // Non-interactive shells (CI, pipes) can't answer — treat as \"no\".\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--out\": String,\n            // The same alias `build` and `cloud env pull` carry. `--output` is\n            // the canonical spelling in this CLI and this command took only\n            // `--out`, so `rebase db backup --output ./backups` wrote to\n            // ./backups *and* to the default directory — the flag was ignored\n            // and its value became a positional.\n            \"--output\": \"--out\",\n            \"--exclude-schema\": [String],\n            \"--no-owner\": Boolean,\n            \"--enable-row-security\": Boolean,\n            \"--row-security-role\": String,\n            \"-o\": \"--out\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    if (args._.includes(\"--help\") || rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--target-db\": String,\n            \"--create-db\": Boolean,\n            \"--clean\": Boolean,\n            \"--no-owner\": Boolean,\n            \"--continue-on-error\": Boolean,\n            \"--yes\": Boolean,\n            \"-y\": \"--yes\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    const backupArg = args._[0];\n    if (!backupArg || rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        if (!backupArg && !rawArgs.includes(\"--help\")) process.exit(1);\n        return;\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db (or --create-db's\n    // implied fresh db) swaps the database name so the live one isn't clobbered.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const file = await storage.getObject(key, bucket);\n            if (!file) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            fs.writeFileSync(localFile, Buffer.from(await file.arrayBuffer()));\n            cleanupTemp = true;\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(backupArg);\n            if (!fs.existsSync(localFile)) {\n                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));\n                process.exit(1);\n            }\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) {\n            outError(chalk.red(`  ✗ ${pf.reason}`));\n            process.exit(1);\n        }\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            outError(chalk.red(\"  ✗ --create-db requires a resolvable target database name (use --target-db).\"));\n            process.exit(1);\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        if (!args[\"--yes\"]) {\n            outWarn(chalk.yellow(\n                `  ⚠️  This will restore into \"${targetDb ?? \"the target database\"}\" and may overwrite existing data.`\n            ));\n            const confirmed = await promptConfirm(chalk.yellow(\"     Type 'yes' to continue: \"));\n            if (!confirmed) {\n                print(chalk.gray(\"  Aborted. No changes were made.\"));\n                process.exit(1);\n            }\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        await restoreDump({\n            connectionString: targetConnection,\n            inputFile: localFile,\n            clean: args[\"--clean\"],\n            noOwner: args[\"--no-owner\"],\n            // Fail loudly by default so a skipped GRANT never leaves RLS off.\n            exitOnError: !args[\"--continue-on-error\"],\n            inheritStdio: true\n        });\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`Unknown backups action: \"${action}\". Valid: list`));\n        process.exit(1);\n    }\n\n    const args = arg({ \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" }, { argv: rawArgs.slice(3), permissive: true });\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${err.message}`));\n        if (err.hint) outError(chalk.gray(`    ${err.hint}`));\n    } else {\n        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  requires an interactive 'yes'. Prefer --create-db/--target-db to restore\n  into a fresh database rather than overwriting a live one.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;;;;AAMA,eAAe,6BACX,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,IAAI,KAAK,SAAS,OAAO;EACrB,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,OAAO,IAAI,qBAAqB;GAAE,MAAM;GAAO,QAAQ,KAAK;EAAO,CAAC;CACxE;CAEA,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,sBAC9B,MAAM,IAAI,gBACN,yFACA,4DACJ;CAEJ,MAAM,EAAE,wBAAwB,MAAM,OAAO;CAC7C,OAAO,IAAI,oBAAoB;EAC3B,MAAM;EACN,QAAQ,KAAK;EACb,QAAQ,IAAI,aAAa;EACzB,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,UAAU,IAAI;EACd,gBAAgB,IAAI,wBAAwB;CAChD,CAAC;AACL;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAEA,eAAe,cAAc,UAAoC;CAE7D,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;AAKA,eAAsB,cAAc,SAAkC;CAClE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,SAAS;EAMT,YAAY;EACZ,oBAAoB,CAAC,MAAM;EAC3B,cAAc;EACd,yBAAyB;EACzB,uBAAuB;EACvB,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,IAAI,KAAK,EAAE,SAAS,QAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG;EACzD,gBAAgB;EAChB;CACJ;CAEA,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,KAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAGR,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,eAAe;EACf,eAAe;EACf,WAAW;EACX,cAAc;EACd,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,aAAa,QAAQ,SAAS,QAAQ,GAAG;EAC1C,iBAAiB;EACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,SAAS,QAAQ,GAAG,QAAQ,KAAK,CAAC;EAC7D;CACJ;CAEA,MAAM,iBAAiB,kBAAkB;CAIzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAMR,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,MAAM;GAChD,IAAI,CAAC,MAAM,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAChF,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,GAAG,cAAc,WAAW,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,CAAC;GACjE,cAAc;GACd,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,SAAS;GAClC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;IAC3B,SAAS,MAAM,IAAI,8BAA8B,WAAW,CAAC;IAC7D,QAAQ,KAAK,CAAC;GAClB;GACA,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAKA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY;GAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;GACtC,QAAQ,KAAK,CAAC;EAClB;EAGA,IAAI,KAAK,kBAAkB,CAAC,UAAU;GAClC,SAAS,MAAM,IAAI,+EAA+E,CAAC;GACnG,QAAQ,KAAK,CAAC;EAClB;EAWA,IAAI,CAAC,KAAK,UAAU;GAChB,QAAQ,MAAM,OACV,iCAAiC,YAAY,sBAAsB,mCACvE,CAAC;GAED,IAAI,CAAC,MADmB,cAAc,MAAM,OAAO,+BAA+B,CAAC,GACnE;IACZ,IAAM,MAAM,KAAK,kCAAkC,CAAC;IACpD,QAAQ,KAAK,CAAC;GAClB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,MAAM,YAAY;GACd,kBAAkB;GAClB,WAAW;GACX,OAAO,KAAK;GACZ,SAAS,KAAK;GAEd,aAAa,CAAC,KAAK;GACnB,cAAc;EAClB,CAAC;EAED,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,4BAA4B,OAAO,eAAe,CAAC;EACtE,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,SAAA,GAAA,WAAA,QAAA,CADW;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CACzG,CAAA,CAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GACnB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;OAC9C;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;AAEA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,IAAI,SAAS,CAAC;EACxC,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;CACxD,OACI,SAAS,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;AAErF;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;CAS3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}
+{"version":3,"file":"backup-cli-DSpQyqcG.js","names":[],"sources":["../src/backup/backup-cli.ts"],"sourcesContent":["/**\n * CLI handlers for `rebase db backup`, `rebase db restore`, and\n * `rebase db backups list`. Kept out of the main `cli.ts` dispatcher so the\n * backup surface stays self-contained.\n */\nimport arg from \"arg\";\nimport path from \"path\";\nimport fs from \"fs\";\nimport os from \"os\";\nimport readline from \"readline\";\nimport chalk from \"chalk\";\n// Aliased: `out` is already a local in two of the commands below (the `--out`\n// backup destination).\nimport { out as print, outWarn, outError } from \"../cli-output\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport {\n    BackupDestination,\n    globalsFileForDump,\n    parseBackupDestination,\n    parseDbNameFromUrl,\n    resolveConnectionString,\n    withDatabaseName\n} from \"./pg-tools\";\nimport {\n    applyGlobals,\n    BackupToolError,\n    createDump,\n    discardPartialDump,\n    ensureDatabaseExists,\n    listBackups,\n    preflight,\n    restoreDump,\n    uploadBackup,\n    validateDump\n} from \"./backup-service\";\n\nfunction formatBytes(bytes: number): string {\n    if (bytes < 1024) return `${bytes} B`;\n    if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;\n    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;\n    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)} GB`;\n}\n\n/**\n * Build a StorageController for an object-storage destination from the same\n * `S3_*` env vars the backend uses. Returns `null` for local destinations.\n */\nasync function resolveStorageForDestination(\n    dest: BackupDestination,\n    env: Record<string, string | undefined>\n): Promise<StorageController | null> {\n    if (dest.kind === \"local\") return null;\n    if (dest.kind === \"gcs\") {\n        const { GCSStorageController } = await import(\"@rebasepro/server\");\n        return new GCSStorageController({ type: \"gcs\", bucket: dest.bucket });\n    }\n    // s3 (also covers R2/MinIO/Hetzner/GCS-interop via S3_ENDPOINT)\n    if (!env.S3_ACCESS_KEY_ID || !env.S3_SECRET_ACCESS_KEY) {\n        throw new BackupToolError(\n            \"S3 destination requires S3_ACCESS_KEY_ID and S3_SECRET_ACCESS_KEY in the environment.\",\n            \"Set the same S3_* variables your backend uses for storage.\"\n        );\n    }\n    const { S3StorageController } = await import(\"@rebasepro/server\");\n    return new S3StorageController({\n        type: \"s3\",\n        bucket: dest.bucket,\n        region: env.S3_REGION || \"auto\",\n        accessKeyId: env.S3_ACCESS_KEY_ID,\n        secretAccessKey: env.S3_SECRET_ACCESS_KEY,\n        endpoint: env.S3_ENDPOINT,\n        forcePathStyle: env.S3_FORCE_PATH_STYLE === \"true\"\n    });\n}\n\nfunction requireConnection(): string {\n    const conn = resolveConnectionString(process.env);\n    if (!conn) {\n        outError(chalk.red(\"✗ DATABASE_URL is not set. Make sure your .env file is configured.\"));\n        process.exit(1);\n    }\n    return conn;\n}\n\nasync function promptConfirm(question: string): Promise<boolean> {\n    // Non-interactive shells (CI, pipes) can't answer — treat as \"no\".\n    if (!process.stdin.isTTY) return false;\n    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });\n    try {\n        const answer: string = await new Promise((resolve) => rl.question(question, resolve));\n        return /^y(es)?$/i.test(answer.trim());\n    } finally {\n        rl.close();\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backup\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--out\": String,\n            // The same alias `build` and `cloud env pull` carry. `--output` is\n            // the canonical spelling in this CLI and this command took only\n            // `--out`, so `rebase db backup --output ./backups` wrote to\n            // ./backups *and* to the default directory — the flag was ignored\n            // and its value became a positional.\n            \"--output\": \"--out\",\n            \"--exclude-schema\": [String],\n            \"--no-owner\": Boolean,\n            \"--enable-row-security\": Boolean,\n            \"--row-security-role\": String,\n            \"-o\": \"--out\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    if (args._.includes(\"--help\") || rawArgs.includes(\"--help\")) {\n        printBackupHelp();\n        return;\n    }\n\n    const connectionString = requireConnection();\n    const dbName = parseDbNameFromUrl(connectionString) ?? \"database\";\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    print(\"\");\n    print(chalk.bold(\"  💾 Rebase DB Backup\"));\n    print(chalk.gray(`  Database:    ${dbName}`));\n    print(chalk.gray(`  Destination: ${out}`));\n    print(\"\");\n\n    // Version pre-flight (doctor-style).\n    const pf = await preflight(\"pg_dump\", connectionString);\n    if (!pf.compatible) {\n        outError(chalk.red(`  ✗ ${pf.reason}`));\n        process.exit(1);\n    }\n    print(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));\n\n    // Opt-in, and loud. With row security on, pg_dump stops refusing to read\n    // rows it cannot see and starts leaving them out — an exit-0 backup that\n    // is quietly short. Anyone choosing that should know they chose it.\n    const rowSecurity = args[\"--enable-row-security\"]\n        ? { uid: \"rebase-db-backup\", roles: [args[\"--row-security-role\"] || \"admin\"] }\n        : undefined;\n\n    if (rowSecurity) {\n        outWarn(\"\");\n        outWarn(chalk.yellow(\"  ⚠  Dumping with row-level security ON.\"));\n        outWarn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(\", \")}], which satisfies the generated`));\n        outWarn(chalk.gray(\"     `admin_full_access` policy. This backup contains exactly the rows those\"));\n        outWarn(chalk.gray(\"     policies admit — a table whose policies have no admin rule comes out short,\"));\n        outWarn(chalk.gray(\"     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS.\"));\n        outWarn(\"\");\n    }\n\n    try {\n        if (dest.kind === \"local\") {\n            // Honour an explicit `…/name.dump` path; otherwise treat it as a\n            // directory and auto-name the file.\n            const explicitFile = dest.path.endsWith(\".dump\");\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                outDir: explicitFile ? path.dirname(dest.path) : dest.path,\n                fileName: explicitFile ? path.basename(dest.path) : undefined,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            await assertDumpValid(dump.localFile);\n            print(\"\");\n            print(chalk.green(`  ✓ Backup written to ${dump.localFile} (${formatBytes(dump.sizeBytes)})`));\n            if (dump.globalsFile) {\n                print(chalk.gray(`    ✓ Roles captured to ${dump.globalsFile} (needed so RLS survives a restore).`));\n            }\n        } else {\n            const storage = await resolveStorageForDestination(dest, process.env);\n            const dump = await createDump({\n                connectionString,\n                dbName,\n                excludeSchemas: args[\"--exclude-schema\"],\n                noOwner: args[\"--no-owner\"],\n                inheritStdio: true,\n                rowSecurity\n            });\n            try {\n                await assertDumpValid(dump.localFile);\n                const uploaded = await uploadBackup(storage!, dump.localFile, dest);\n                print(\"\");\n                print(chalk.green(`  ✓ Backup uploaded to ${uploaded.storageUrl} (${formatBytes(dump.sizeBytes)})`));\n                // Upload the roles sidecar next to the dump so a restore can\n                // recreate roles the dump's GRANT/RLS statements depend on.\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) {\n                    const globalsUpload = await uploadBackup(storage!, dump.globalsFile, dest);\n                    print(chalk.gray(`    ✓ Roles uploaded to ${globalsUpload.storageUrl} (needed so RLS survives a restore).`));\n                }\n                print(chalk.gray(\"    Ensure this bucket is private — backups may contain secrets and PII.\"));\n            } finally {\n                if (fs.existsSync(dump.localFile)) fs.unlinkSync(dump.localFile);\n                if (dump.globalsFile && fs.existsSync(dump.globalsFile)) fs.unlinkSync(dump.globalsFile);\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db restore <backup>\n// ─────────────────────────────────────────────────────────────────────────\nexport async function restoreCommand(rawArgs: string[]): Promise<void> {\n    const args = arg(\n        {\n            \"--target-db\": String,\n            \"--create-db\": Boolean,\n            \"--clean\": Boolean,\n            \"--no-owner\": Boolean,\n            \"--continue-on-error\": Boolean,\n            \"--yes\": Boolean,\n            \"-y\": \"--yes\"\n        },\n        { argv: rawArgs.slice(2), permissive: true }\n    );\n\n    const backupArg = args._[0];\n    if (!backupArg || rawArgs.includes(\"--help\")) {\n        printRestoreHelp();\n        if (!backupArg && !rawArgs.includes(\"--help\")) process.exit(1);\n        return;\n    }\n\n    const baseConnection = requireConnection();\n\n    // Choose the target connection: an explicit --target-db (or --create-db's\n    // implied fresh db) swaps the database name so the live one isn't clobbered.\n    const targetDb = args[\"--target-db\"] ?? parseDbNameFromUrl(baseConnection) ?? undefined;\n    const targetConnection = args[\"--target-db\"]\n        ? withDatabaseName(baseConnection, args[\"--target-db\"])\n        : baseConnection;\n\n    print(\"\");\n    print(chalk.bold(\"  ♻️  Rebase DB Restore\"));\n    print(chalk.gray(`  Source:  ${backupArg}`));\n    print(chalk.gray(`  Target:  ${targetDb ?? \"(from DATABASE_URL)\"}`));\n    print(\"\");\n\n    // Resolve the local file to restore from (download object-storage keys).\n    // Also resolve the `.globals.sql` roles sidecar so cluster roles can be\n    // recreated before the restore — without them the dump's GRANT/RLS\n    // statements fail and RLS is silently lost.\n    let localFile: string;\n    let globalsSql: string | null = null;\n    let cleanupTemp = false;\n    try {\n        if (/^(s3|gs):\\/\\//.test(backupArg)) {\n            const dest = parseBackupDestination(backupArg.replace(/\\/[^/]+$/, \"\"));\n            const storage = await resolveStorageForDestination(dest, process.env);\n            if (!storage) throw new BackupToolError(\"Could not resolve storage for the given URL.\");\n            const key = backupArg.replace(/^(s3|gs):\\/\\/[^/]+\\//, \"\");\n            const bucket = backupArg.replace(/^(s3|gs):\\/\\/([^/]+)\\/.*$/, \"$2\");\n            const file = await storage.getObject(key, bucket);\n            if (!file) throw new BackupToolError(`Backup not found in storage: ${backupArg}`);\n            const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-restore-\"));\n            localFile = path.join(tmpDir, path.basename(key));\n            fs.writeFileSync(localFile, Buffer.from(await file.arrayBuffer()));\n            cleanupTemp = true;\n            const globalsObj = await storage.getObject(globalsFileForDump(key), bucket);\n            if (globalsObj) globalsSql = Buffer.from(await globalsObj.arrayBuffer()).toString(\"utf-8\");\n        } else {\n            localFile = path.resolve(backupArg);\n            if (!fs.existsSync(localFile)) {\n                outError(chalk.red(`  ✗ Backup file not found: ${localFile}`));\n                process.exit(1);\n            }\n            const globalsPath = globalsFileForDump(localFile);\n            if (fs.existsSync(globalsPath)) globalsSql = fs.readFileSync(globalsPath, \"utf-8\");\n        }\n\n        // Version pre-flight. Check against the base connection — the server\n        // version is identical for every database, and the target may not\n        // exist yet when --create-db is used.\n        const pf = await preflight(\"pg_restore\", baseConnection);\n        if (!pf.compatible) {\n            outError(chalk.red(`  ✗ ${pf.reason}`));\n            process.exit(1);\n        }\n\n        // `--create-db` needs a name before anything else can be decided.\n        if (args[\"--create-db\"] && !targetDb) {\n            outError(chalk.red(\"  ✗ --create-db requires a resolvable target database name (use --target-db).\"));\n            process.exit(1);\n        }\n\n        // Destructive-action gate. Restores overwrite data; never run without\n        // an explicit yes (interactive confirmation or --yes).\n        //\n        // Ahead of `--create-db`, not after it. Creating the database first\n        // meant an aborted run had already changed the cluster, while printing\n        // \"No changes were made\" — and it left an empty database behind that a\n        // second, confirmed run then reported as \"already exists\". The gate is\n        // now the first thing that can stop the command, so its own message is\n        // true whichever way the answer goes.\n        if (!args[\"--yes\"]) {\n            outWarn(chalk.yellow(\n                `  ⚠️  This will restore into \"${targetDb ?? \"the target database\"}\" and may overwrite existing data.`\n            ));\n            const confirmed = await promptConfirm(chalk.yellow(\"     Type 'yes' to continue: \"));\n            if (!confirmed) {\n                print(chalk.gray(\"  Aborted. No changes were made.\"));\n                process.exit(1);\n            }\n        }\n\n        // Create the target database when requested.\n        if (args[\"--create-db\"]) {\n            const created = await ensureDatabaseExists(baseConnection, targetDb!);\n            print(chalk.gray(created ? `  ✓ Created database \"${targetDb}\".` : `  • Database \"${targetDb}\" already exists.`));\n        }\n\n        // Recreate cluster roles before restoring so GRANT/RLS statements in\n        // the dump apply. Best-effort and idempotent (see applyGlobals).\n        if (globalsSql) {\n            print(chalk.gray(\"  Recreating cluster roles from the backup's roles sidecar…\"));\n            const { applied, skipped } = await applyGlobals(\n                targetConnection,\n                globalsSql,\n                (m) => print(chalk.gray(m))\n            );\n            print(chalk.gray(`  ✓ Roles: ${applied} applied, ${skipped} skipped (already present or not permitted).`));\n        } else {\n            outWarn(chalk.yellow(\"  ⚠️  No roles sidecar (.globals.sql) accompanies this backup.\"));\n            outWarn(chalk.yellow(\"     If the dump grants to roles that don't exist (e.g. rebase_user), the restore\"));\n            outWarn(chalk.yellow(\"     will fail — recreate those roles first, or use a backup that includes its globals.\"));\n        }\n\n        await restoreDump({\n            connectionString: targetConnection,\n            inputFile: localFile,\n            clean: args[\"--clean\"],\n            noOwner: args[\"--no-owner\"],\n            // Fail loudly by default so a skipped GRANT never leaves RLS off.\n            exitOnError: !args[\"--continue-on-error\"],\n            inheritStdio: true\n        });\n\n        print(\"\");\n        print(chalk.green(`  ✓ Restore completed into \"${targetDb ?? \"the target database\"}\".`));\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    } finally {\n        if (cleanupTemp && typeof localFile! === \"string\" && fs.existsSync(localFile!)) {\n            fs.rmSync(path.dirname(localFile!), { recursive: true, force: true });\n        }\n    }\n}\n\n// ─────────────────────────────────────────────────────────────────────────\n// rebase db backups list\n// ─────────────────────────────────────────────────────────────────────────\nexport async function backupsCommand(rawArgs: string[]): Promise<void> {\n    const action = rawArgs[2];\n    if (!action || action === \"--help\") {\n        printBackupsHelp();\n        return;\n    }\n    if (action !== \"list\") {\n        outError(chalk.red(`Unknown backups action: \"${action}\". Valid: list`));\n        process.exit(1);\n    }\n\n    const args = arg({ \"--out\": String, \"--output\": \"--out\", \"-o\": \"--out\" }, { argv: rawArgs.slice(3), permissive: true });\n    const out = args[\"--out\"] || process.env.BACKUP_DESTINATION || path.join(process.cwd(), \"backups\");\n    const dest = parseBackupDestination(out);\n\n    try {\n        const storage = await resolveStorageForDestination(dest, process.env);\n        const backups = await listBackups(dest, storage ?? undefined);\n        print(\"\");\n        if (backups.length === 0) {\n            print(chalk.gray(`  No backups found at ${out}.`));\n        } else {\n            print(chalk.bold(`  💾 ${backups.length} backup(s) at ${out}:`));\n            print(\"\");\n            for (const b of backups) {\n                const when = b.createdAt ? b.createdAt.toISOString() : \"unknown date\";\n                const name = dest.kind === \"local\" ? path.basename(b.key) : b.key;\n                // An empty file is called out rather than listed as a peer of\n                // the real ones. Older failures could leave a 0-byte dump here\n                // (fixed at the source now), and retention protects the newest\n                // by date whatever they contain — so a corpse left in place can\n                // hold a `keepMinimum` slot against a backup that matters.\n                const empty = b.sizeBytes === 0;\n                const size = b.sizeBytes === undefined ? \"\" : ` — ${formatBytes(b.sizeBytes)}`;\n                if (empty) {\n                    print(`  ${chalk.red(\"○\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}`)}${chalk.red(\" — EMPTY, not restorable\")}`);\n                } else {\n                    print(`  ${chalk.green(\"●\")} ${chalk.bold(name)} ${chalk.gray(`— ${when}${size}`)}`);\n                }\n            }\n            if (backups.some(b => b.sizeBytes === 0)) {\n                print(\"\");\n                print(chalk.yellow(\"  ⚠  Empty files above are leftovers from a failed backup. Delete them:\"));\n                print(chalk.gray(\"     they count as recent backups for retention but restore nothing.\"));\n            }\n        }\n        print(\"\");\n    } catch (err) {\n        reportError(err);\n        process.exit(1);\n    }\n}\n\n/**\n * Verify a freshly written dump; abort the command if it looks corrupt.\n *\n * Discards the artifact on the way out. Refusing to *report* success was never\n * enough on its own: the file stayed on disk, `rebase db backups list` showed\n * it as an ordinary entry, and retention — which ranks by timestamp and never\n * looks at size — would protect it as one of the `keepMinimum` newest while\n * pruning a real backup underneath it. The roles sidecar goes too; the two are\n * uploaded and pruned as a pair, so half a pair is not a backup either.\n */\nasync function assertDumpValid(localFile: string): Promise<void> {\n    const check = await validateDump(localFile);\n    if (!check.ok) {\n        discardPartialDump(globalsFileForDump(localFile));\n        discardPartialDump(localFile);\n        throw new BackupToolError(\n            `The backup failed validation and was discarded: ${check.reason}`,\n            \"The dump was corrupt or truncated, so nothing was kept. Investigate before relying on this destination.\"\n        );\n    }\n}\n\nfunction reportError(err: unknown): void {\n    if (err instanceof BackupToolError) {\n        outError(chalk.red(`  ✗ ${err.message}`));\n        if (err.hint) outError(chalk.gray(`    ${err.hint}`));\n    } else {\n        outError(chalk.red(`  ✗ ${err instanceof Error ? err.message : String(err)}`));\n    }\n}\n\nfunction printBackupHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backup\")} — Create a database backup (pg_dump, custom format)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backup [--out <path|s3://bucket/prefix>] [options]\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--out, -o\")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)\n  ${chalk.blue(\"--exclude-schema\")} <s>    Exclude a schema (repeatable)\n  ${chalk.blue(\"--no-owner\")}              Omit ownership commands from the dump\n  ${chalk.blue(\"--enable-row-security\")}   Dump as an admin subject instead of failing on RLS\n                             ${chalk.red(\"(may produce a partial dump — see below)\")}\n  ${chalk.blue(\"--row-security-role\")} <r> Role to read as with the flag above (default: admin)\n\n${chalk.green.bold(\"Row-level security\")}\n  On a managed Postgres the dumping role usually owns nothing and has no\n  BYPASSRLS, so pg_dump refuses:\n\n    ERROR: query would be affected by row-level security policy for table \"...\"\n\n  That refusal is the safe behaviour. --enable-row-security replaces it by\n  reading as an admin subject: Rebase sets app.uid/app.user_roles so the\n  generated admin_full_access policy admits the dump. The dump then contains\n  exactly what those policies admit ${chalk.red(\"and no error is raised for what they do not\")} —\n  a table whose policies lack an admin rule comes out short, silently.\n\n  Granting the dumping role BYPASSRLS is the option that keeps a backup\n  meaning \"every row\".\n\n${chalk.green.bold(\"Notes\")}\n  Backups may contain secrets and PII. Use private storage destinations and\n  enable encryption-at-rest. See docs/backups.md.\n`);\n}\n\nfunction printRestoreHelp(): void {\n    print(`\n${chalk.bold(\"rebase db restore\")} — Restore a database from a backup (pg_restore)\n\n${chalk.green.bold(\"Usage\")}\n  rebase db restore <backup> [options]\n\n${chalk.green.bold(\"Arguments\")}\n  <backup>                   Local .dump file, or s3://…/gs://… object key\n\n${chalk.green.bold(\"Options\")}\n  ${chalk.blue(\"--target-db\")} <name>      Restore into this database instead of DATABASE_URL's\n  ${chalk.blue(\"--create-db\")}             Create the target database first if it doesn't exist\n  ${chalk.blue(\"--clean\")}                 Drop existing objects before recreating them\n  ${chalk.blue(\"--no-owner\")}              Ignore ownership from the dump\n  ${chalk.blue(\"--continue-on-error\")}     Log and continue past errors ${chalk.red(\"(may leave RLS un-enforced!)\")}\n  ${chalk.blue(\"--yes, -y\")}               Skip the interactive confirmation ${chalk.red(\"(destructive!)\")}\n\n${chalk.red.bold(\"Warning\")}\n  Restore is destructive and never runs automatically. Without --yes it\n  requires an interactive 'yes'. Prefer --create-db/--target-db to restore\n  into a fresh database rather than overwriting a live one.\n\n  By default the restore aborts on the first error (--exit-on-error) so a\n  skipped GRANT never silently leaves RLS un-enforced. Roles are recreated\n  from the backup's .globals.sql sidecar first; keep that file next to the\n  dump. Use --continue-on-error only when you understand the consequences.\n`);\n}\n\nfunction printBackupsHelp(): void {\n    print(`\n${chalk.bold(\"rebase db backups\")} — Manage stored backups\n\n${chalk.green.bold(\"Usage\")}\n  rebase db backups list [--out <path|s3://bucket/prefix>]\n  rebase db backup list  [--out <path|s3://bucket/prefix>]   ${chalk.gray(\"(the same thing)\")}\n`);\n}\n"],"mappings":";;;;;;;;;;;;;AAoCA,SAAS,YAAY,OAAuB;CACxC,IAAI,QAAQ,MAAM,OAAO,GAAG,MAAM;CAClC,IAAI,QAAQ,OAAO,MAAM,OAAO,IAAI,QAAQ,KAAA,CAAM,QAAQ,CAAC,EAAE;CAC7D,IAAI,QAAQ,OAAO,OAAO,MAAM,OAAO,IAAI,SAAS,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;CAC7E,OAAO,IAAI,SAAS,OAAO,OAAO,MAAA,CAAO,QAAQ,CAAC,EAAE;AACxD;;;;;AAMA,eAAe,6BACX,MACA,KACiC;CACjC,IAAI,KAAK,SAAS,SAAS,OAAO;CAClC,IAAI,KAAK,SAAS,OAAO;EACrB,MAAM,EAAE,yBAAyB,MAAM,OAAO;EAC9C,OAAO,IAAI,qBAAqB;GAAE,MAAM;GAAO,QAAQ,KAAK;EAAO,CAAC;CACxE;CAEA,IAAI,CAAC,IAAI,oBAAoB,CAAC,IAAI,sBAC9B,MAAM,IAAI,gBACN,yFACA,4DACJ;CAEJ,MAAM,EAAE,wBAAwB,MAAM,OAAO;CAC7C,OAAO,IAAI,oBAAoB;EAC3B,MAAM;EACN,QAAQ,KAAK;EACb,QAAQ,IAAI,aAAa;EACzB,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,UAAU,IAAI;EACd,gBAAgB,IAAI,wBAAwB;CAChD,CAAC;AACL;AAEA,SAAS,oBAA4B;CACjC,MAAM,OAAO,wBAAwB,QAAQ,GAAG;CAChD,IAAI,CAAC,MAAM;EACP,SAAS,MAAM,IAAI,oEAAoE,CAAC;EACxF,QAAQ,KAAK,CAAC;CAClB;CACA,OAAO;AACX;AAEA,eAAe,cAAc,UAAoC;CAE7D,IAAI,CAAC,QAAQ,MAAM,OAAO,OAAO;CACjC,MAAM,KAAK,+BAAA,QAAS,gBAAgB;EAAE,OAAO,QAAQ;EAAO,QAAQ,QAAQ;CAAO,CAAC;CACpF,IAAI;EACA,MAAM,SAAiB,MAAM,IAAI,SAAS,YAAY,GAAG,SAAS,UAAU,OAAO,CAAC;EACpF,OAAO,YAAY,KAAK,OAAO,KAAK,CAAC;CACzC,UAAU;EACN,GAAG,MAAM;CACb;AACJ;AAKA,eAAsB,cAAc,SAAkC;CAClE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,SAAS;EAMT,YAAY;EACZ,oBAAoB,CAAC,MAAM;EAC3B,cAAc;EACd,yBAAyB;EACzB,uBAAuB;EACvB,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,IAAI,KAAK,EAAE,SAAS,QAAQ,KAAK,QAAQ,SAAS,QAAQ,GAAG;EACzD,gBAAgB;EAChB;CACJ;CAEA,MAAM,mBAAmB,kBAAkB;CAC3C,MAAM,SAAS,mBAAmB,gBAAgB,KAAK;CACvD,MAAM,QAAM,KAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,uBAAuB,CAAC;CACzC,IAAM,MAAM,KAAK,kBAAkB,QAAQ,CAAC;CAC5C,IAAM,MAAM,KAAK,kBAAkB,OAAK,CAAC;CACzC,IAAM,EAAE;CAGR,MAAM,KAAK,MAAM,UAAU,WAAW,gBAAgB;CACtD,IAAI,CAAC,GAAG,YAAY;EAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;EACtC,QAAQ,KAAK,CAAC;CAClB;CACA,IAAM,MAAM,KAAK,mBAAmB,GAAG,UAAU,kBAAkB,GAAG,YAAY,EAAE,CAAC;CAKrF,MAAM,cAAc,KAAK,2BACnB;EAAE,KAAK;EAAoB,OAAO,CAAC,KAAK,0BAA0B,OAAO;CAAE,IAC3E,KAAA;CAEN,IAAI,aAAa;EACb,QAAQ,EAAE;EACV,QAAQ,MAAM,OAAO,0CAA0C,CAAC;EAChE,QAAQ,MAAM,KAAK,0BAA0B,YAAY,MAAM,KAAK,IAAI,EAAE,iCAAiC,CAAC;EAC5G,QAAQ,MAAM,KAAK,8EAA8E,CAAC;EAClG,QAAQ,MAAM,KAAK,kFAAkF,CAAC;EACtG,QAAQ,MAAM,KAAK,+EAA+E,CAAC;EACnG,QAAQ,EAAE;CACd;CAEA,IAAI;EACA,IAAI,KAAK,SAAS,SAAS;GAGvB,MAAM,eAAe,KAAK,KAAK,SAAS,OAAO;GAC/C,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,QAAQ,eAAe,KAAK,QAAQ,KAAK,IAAI,IAAI,KAAK;IACtD,UAAU,eAAe,KAAK,SAAS,KAAK,IAAI,IAAI,KAAA;IACpD,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,MAAM,gBAAgB,KAAK,SAAS;GACpC,IAAM,EAAE;GACR,IAAM,MAAM,MAAM,yBAAyB,KAAK,UAAU,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;GAC7F,IAAI,KAAK,aACL,IAAM,MAAM,KAAK,2BAA2B,KAAK,YAAY,qCAAqC,CAAC;EAE3G,OAAO;GACH,MAAM,UAAU,MAAM,6BAA6B,MAAM,QAAQ,GAAG;GACpE,MAAM,OAAO,MAAM,WAAW;IAC1B;IACA;IACA,gBAAgB,KAAK;IACrB,SAAS,KAAK;IACd,cAAc;IACd;GACJ,CAAC;GACD,IAAI;IACA,MAAM,gBAAgB,KAAK,SAAS;IACpC,MAAM,WAAW,MAAM,aAAa,SAAU,KAAK,WAAW,IAAI;IAClE,IAAM,EAAE;IACR,IAAM,MAAM,MAAM,0BAA0B,SAAS,WAAW,IAAI,YAAY,KAAK,SAAS,EAAE,EAAE,CAAC;IAGnG,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG;KACrD,MAAM,gBAAgB,MAAM,aAAa,SAAU,KAAK,aAAa,IAAI;KACzE,IAAM,MAAM,KAAK,2BAA2B,cAAc,WAAW,qCAAqC,CAAC;IAC/G;IACA,IAAM,MAAM,KAAK,0EAA0E,CAAC;GAChG,UAAU;IACN,IAAI,GAAG,WAAW,KAAK,SAAS,GAAG,GAAG,WAAW,KAAK,SAAS;IAC/D,IAAI,KAAK,eAAe,GAAG,WAAW,KAAK,WAAW,GAAG,GAAG,WAAW,KAAK,WAAW;GAC3F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,QAAA,GAAA,WAAA,QAAA,CACF;EACI,eAAe;EACf,eAAe;EACf,WAAW;EACX,cAAc;EACd,uBAAuB;EACvB,SAAS;EACT,MAAM;CACV,GACA;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CAC/C;CAEA,MAAM,YAAY,KAAK,EAAE;CACzB,IAAI,CAAC,aAAa,QAAQ,SAAS,QAAQ,GAAG;EAC1C,iBAAiB;EACjB,IAAI,CAAC,aAAa,CAAC,QAAQ,SAAS,QAAQ,GAAG,QAAQ,KAAK,CAAC;EAC7D;CACJ;CAEA,MAAM,iBAAiB,kBAAkB;CAIzC,MAAM,WAAW,KAAK,kBAAkB,mBAAmB,cAAc,KAAK,KAAA;CAC9E,MAAM,mBAAmB,KAAK,iBACxB,iBAAiB,gBAAgB,KAAK,cAAc,IACpD;CAEN,IAAM,EAAE;CACR,IAAM,MAAM,KAAK,yBAAyB,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,WAAW,CAAC;CAC3C,IAAM,MAAM,KAAK,cAAc,YAAY,uBAAuB,CAAC;CACnE,IAAM,EAAE;CAMR,IAAI;CACJ,IAAI,aAA4B;CAChC,IAAI,cAAc;CAClB,IAAI;EACA,IAAI,gBAAgB,KAAK,SAAS,GAAG;GAEjC,MAAM,UAAU,MAAM,6BADT,uBAAuB,UAAU,QAAQ,YAAY,EAAE,CACjB,GAAM,QAAQ,GAAG;GACpE,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,8CAA8C;GACtF,MAAM,MAAM,UAAU,QAAQ,wBAAwB,EAAE;GACxD,MAAM,SAAS,UAAU,QAAQ,6BAA6B,IAAI;GAClE,MAAM,OAAO,MAAM,QAAQ,UAAU,KAAK,MAAM;GAChD,IAAI,CAAC,MAAM,MAAM,IAAI,gBAAgB,gCAAgC,WAAW;GAChF,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,iBAAiB,CAAC;GACvE,YAAY,KAAK,KAAK,QAAQ,KAAK,SAAS,GAAG,CAAC;GAChD,GAAG,cAAc,WAAW,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC,CAAC;GACjE,cAAc;GACd,MAAM,aAAa,MAAM,QAAQ,UAAU,mBAAmB,GAAG,GAAG,MAAM;GAC1E,IAAI,YAAY,aAAa,OAAO,KAAK,MAAM,WAAW,YAAY,CAAC,CAAC,CAAC,SAAS,OAAO;EAC7F,OAAO;GACH,YAAY,KAAK,QAAQ,SAAS;GAClC,IAAI,CAAC,GAAG,WAAW,SAAS,GAAG;IAC3B,SAAS,MAAM,IAAI,8BAA8B,WAAW,CAAC;IAC7D,QAAQ,KAAK,CAAC;GAClB;GACA,MAAM,cAAc,mBAAmB,SAAS;GAChD,IAAI,GAAG,WAAW,WAAW,GAAG,aAAa,GAAG,aAAa,aAAa,OAAO;EACrF;EAKA,MAAM,KAAK,MAAM,UAAU,cAAc,cAAc;EACvD,IAAI,CAAC,GAAG,YAAY;GAChB,SAAS,MAAM,IAAI,OAAO,GAAG,QAAQ,CAAC;GACtC,QAAQ,KAAK,CAAC;EAClB;EAGA,IAAI,KAAK,kBAAkB,CAAC,UAAU;GAClC,SAAS,MAAM,IAAI,+EAA+E,CAAC;GACnG,QAAQ,KAAK,CAAC;EAClB;EAWA,IAAI,CAAC,KAAK,UAAU;GAChB,QAAQ,MAAM,OACV,iCAAiC,YAAY,sBAAsB,mCACvE,CAAC;GAED,IAAI,CAAC,MADmB,cAAc,MAAM,OAAO,+BAA+B,CAAC,GACnE;IACZ,IAAM,MAAM,KAAK,kCAAkC,CAAC;IACpD,QAAQ,KAAK,CAAC;GAClB;EACJ;EAGA,IAAI,KAAK,gBAAgB;GACrB,MAAM,UAAU,MAAM,qBAAqB,gBAAgB,QAAS;GACpE,IAAM,MAAM,KAAK,UAAU,yBAAyB,SAAS,MAAM,iBAAiB,SAAS,kBAAkB,CAAC;EACpH;EAIA,IAAI,YAAY;GACZ,IAAM,MAAM,KAAK,6DAA6D,CAAC;GAC/E,MAAM,EAAE,SAAS,YAAY,MAAM,aAC/B,kBACA,aACC,MAAM,IAAM,MAAM,KAAK,CAAC,CAAC,CAC9B;GACA,IAAM,MAAM,KAAK,cAAc,QAAQ,YAAY,QAAQ,6CAA6C,CAAC;EAC7G,OAAO;GACH,QAAQ,MAAM,OAAO,gEAAgE,CAAC;GACtF,QAAQ,MAAM,OAAO,mFAAmF,CAAC;GACzG,QAAQ,MAAM,OAAO,yFAAyF,CAAC;EACnH;EAEA,MAAM,YAAY;GACd,kBAAkB;GAClB,WAAW;GACX,OAAO,KAAK;GACZ,SAAS,KAAK;GAEd,aAAa,CAAC,KAAK;GACnB,cAAc;EAClB,CAAC;EAED,IAAM,EAAE;EACR,IAAM,MAAM,MAAM,+BAA+B,YAAY,sBAAsB,GAAG,CAAC;EACvF,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB,UAAU;EACN,IAAI,eAAe,OAAO,cAAe,YAAY,GAAG,WAAW,SAAU,GACzE,GAAG,OAAO,KAAK,QAAQ,SAAU,GAAG;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CAE5E;AACJ;AAKA,eAAsB,eAAe,SAAkC;CACnE,MAAM,SAAS,QAAQ;CACvB,IAAI,CAAC,UAAU,WAAW,UAAU;EAChC,iBAAiB;EACjB;CACJ;CACA,IAAI,WAAW,QAAQ;EACnB,SAAS,MAAM,IAAI,4BAA4B,OAAO,eAAe,CAAC;EACtE,QAAQ,KAAK,CAAC;CAClB;CAGA,MAAM,SAAA,GAAA,WAAA,QAAA,CADW;EAAE,SAAS;EAAQ,YAAY;EAAS,MAAM;CAAQ,GAAG;EAAE,MAAM,QAAQ,MAAM,CAAC;EAAG,YAAY;CAAK,CACzG,CAAA,CAAK,YAAY,QAAQ,IAAI,sBAAsB,KAAK,KAAK,QAAQ,IAAI,GAAG,SAAS;CACjG,MAAM,OAAO,uBAAuB,KAAG;CAEvC,IAAI;EAEA,MAAM,UAAU,MAAM,YAAY,MAAM,MADlB,6BAA6B,MAAM,QAAQ,GAAG,KACjB,KAAA,CAAS;EAC5D,IAAM,EAAE;EACR,IAAI,QAAQ,WAAW,GACnB,IAAM,MAAM,KAAK,yBAAyB,MAAI,EAAE,CAAC;OAC9C;GACH,IAAM,MAAM,KAAK,QAAQ,QAAQ,OAAO,gBAAgB,MAAI,EAAE,CAAC;GAC/D,IAAM,EAAE;GACR,KAAK,MAAM,KAAK,SAAS;IACrB,MAAM,OAAO,EAAE,YAAY,EAAE,UAAU,YAAY,IAAI;IACvD,MAAM,OAAO,KAAK,SAAS,UAAU,KAAK,SAAS,EAAE,GAAG,IAAI,EAAE;IAM9D,MAAM,QAAQ,EAAE,cAAc;IAC9B,MAAM,OAAO,EAAE,cAAc,KAAA,IAAY,KAAK,MAAM,YAAY,EAAE,SAAS;IAC3E,IAAI,OACA,IAAM,KAAK,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAAI,MAAM,IAAI,0BAA0B,GAAG;SAElH,IAAM,KAAK,MAAM,MAAM,GAAG,EAAE,GAAG,MAAM,KAAK,IAAI,EAAE,GAAG,MAAM,KAAK,KAAK,OAAO,MAAM,GAAG;GAE3F;GACA,IAAI,QAAQ,MAAK,MAAK,EAAE,cAAc,CAAC,GAAG;IACtC,IAAM,EAAE;IACR,IAAM,MAAM,OAAO,yEAAyE,CAAC;IAC7F,IAAM,MAAM,KAAK,sEAAsE,CAAC;GAC5F;EACJ;EACA,IAAM,EAAE;CACZ,SAAS,KAAK;EACV,YAAY,GAAG;EACf,QAAQ,KAAK,CAAC;CAClB;AACJ;;;;;;;;;;;AAYA,eAAe,gBAAgB,WAAkC;CAC7D,MAAM,QAAQ,MAAM,aAAa,SAAS;CAC1C,IAAI,CAAC,MAAM,IAAI;EACX,mBAAmB,mBAAmB,SAAS,CAAC;EAChD,mBAAmB,SAAS;EAC5B,MAAM,IAAI,gBACN,mDAAmD,MAAM,UACzD,yGACJ;CACJ;AACJ;AAEA,SAAS,YAAY,KAAoB;CACrC,IAAI,eAAe,iBAAiB;EAChC,SAAS,MAAM,IAAI,OAAO,IAAI,SAAS,CAAC;EACxC,IAAI,IAAI,MAAM,SAAS,MAAM,KAAK,OAAO,IAAI,MAAM,CAAC;CACxD,OACI,SAAS,MAAM,IAAI,OAAO,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;AAErF;AAEA,SAAS,kBAAwB;CAC7B,IAAM;EACR,MAAM,KAAK,kBAAkB,EAAE;;EAE/B,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,WAAW,EAAE;IACxB,MAAM,KAAK,kBAAkB,EAAE;IAC/B,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,uBAAuB,EAAE;+BACT,MAAM,IAAI,0CAA0C,EAAE;IACjF,MAAM,KAAK,qBAAqB,EAAE;;EAEpC,MAAM,MAAM,KAAK,oBAAoB,EAAE;;;;;;;;;sCASH,MAAM,IAAI,6CAA6C,EAAE;;;;;;EAM7F,MAAM,MAAM,KAAK,OAAO,EAAE;;;CAG3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;;EAG1B,MAAM,MAAM,KAAK,WAAW,EAAE;;;EAG9B,MAAM,MAAM,KAAK,SAAS,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,aAAa,EAAE;IAC1B,MAAM,KAAK,SAAS,EAAE;IACtB,MAAM,KAAK,YAAY,EAAE;IACzB,MAAM,KAAK,qBAAqB,EAAE,oCAAoC,MAAM,IAAI,8BAA8B,EAAE;IAChH,MAAM,KAAK,WAAW,EAAE,mDAAmD,MAAM,IAAI,gBAAgB,EAAE;;EAEzG,MAAM,IAAI,KAAK,SAAS,EAAE;;;;;;;;;CAS3B;AACD;AAEA,SAAS,mBAAyB;CAC9B,IAAM;EACR,MAAM,KAAK,mBAAmB,EAAE;;EAEhC,MAAM,MAAM,KAAK,OAAO,EAAE;;+DAEmC,MAAM,KAAK,kBAAkB,EAAE;CAC7F;AACD"}

package/dist/{backup-service-Br3tqwsy.js → backup-service-DA7a6SUV.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 __createRequire(import.meta.url);
 import { r as __exportAll } from "./__vite-browser-external-BnuHet1e.js";
-import { C as resolveLocalBin, T as forLibpq, w as execa } from "./rls-bootstrap-sql-DLDnUjtx.js";
+import { A as execa, j as forLibpq, k as resolveLocalBin } from "./rls-bootstrap-sql-BlzsOUtz.js";
 import fs from "fs";
 import path from "path";
 import os from "os";
@@ -712,4 +712,4 @@ async function pruneBackups(dest, options, storage) {
 //#endregion
 export { parsePgToolMajor as A, checkToolServerCompatibility as C, parseBackupDestination as D, joinStorageKey as E, serverVersionNumToMajor as M, splitGlobalsStatements as N, parseBackupTimestamp as O, withDatabaseName as P, buildRowSecurityPgOptions as S, globalsFileForDump as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, getServerVersionMajor as c, pruneBackups as d, resolvePgBinary as f, selectBackupsToPrune as g, validateDump as h, createDump as i, resolveConnectionString as j, parseDbNameFromUrl as k, listBackups as l, uploadBackup as m, applyGlobals as n, discardPartialDump as o, restoreDump as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, preflight as u, buildPgDumpArgs as v, diagnoseRowSecurityDumpFailure as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
 
-//# sourceMappingURL=backup-service-Br3tqwsy.js.map
+//# sourceMappingURL=backup-service-DA7a6SUV.js.map