@rebasepro/server-postgres 0.22.0 → 0.23.0

package/dist/{backup-service-CaMOS76G.js.map → backup-service-HQ9GC4tN.js.map}

@@ -1 +1 @@
-{"version":3,"file":"backup-service-CaMOS76G.js","names":[],"sources":["../src/backup/pg-tools.ts","../src/backup/retention.ts","../src/backup/backup-logic.ts","../src/backup/backup-service.ts"],"sourcesContent":["/**\n * Pure helpers for the backup/restore commands.\n *\n * Everything in this file is side-effect free so it can be unit-tested\n * without a live Postgres server, matching the constraint that CI must\n * not require a database.\n */\n\nimport { forLibpq } from \"../utils/connection-string\";\n\n/**\n * A parsed backup destination. `--out` (and the scheduled-backup config)\n * accepts either a local filesystem path or an object-storage URL.\n */\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/**\n * Extract the database name from a Postgres connection string.\n * Returns `null` when the URL has no database path (e.g. bare host).\n */\nexport function parseDbNameFromUrl(connectionString: string): string | null {\n    try {\n        const parsed = new URL(connectionString);\n        const name = parsed.pathname.replace(/^\\//, \"\").trim();\n        return name.length > 0 ? name : null;\n    } catch {\n        // Fall back to a permissive regex for non-URL DSNs.\n        const match = connectionString.match(/\\/([^/?]+)(\\?|$)/);\n        return match && match[1] ? match[1] : null;\n    }\n}\n\n/**\n * Swap the database name in a connection string, preserving credentials,\n * host, port and query params. Used by `--target-db` / `--create-db` so a\n * restore can target a fresh database instead of clobbering the live one.\n */\nexport function withDatabaseName(connectionString: string, dbName: string): string {\n    try {\n        const parsed = new URL(connectionString);\n        parsed.pathname = `/${dbName}`;\n        return parsed.toString();\n    } catch {\n        return connectionString.replace(/\\/([^/?]+)(\\?|$)/, `/${dbName}$2`);\n    }\n}\n\n/**\n * Parse the major version out of `pg_dump --version` / `pg_restore --version`\n * output, e.g. `\"pg_dump (PostgreSQL) 16.2\"` → `16`. Handles the pre-10\n * `9.6.x` scheme (returns `9`) and beta strings like `\"17beta1\"`.\n */\nexport function parsePgToolMajor(versionOutput: string): number | null {\n    const match = versionOutput.match(/(\\d+)(?:\\.(\\d+))?/);\n    if (!match) return null;\n    const major = Number(match[1]);\n    if (!Number.isFinite(major)) return null;\n    // Postgres 9.x used the first two numbers as the major (9.6, 9.4…).\n    if (major === 9 && match[2] !== undefined) {\n        return 9;\n    }\n    return major;\n}\n\n/**\n * Convert `SELECT current_setting('server_version_num')` (e.g. `160002`)\n * into a major version (`16`). Also accepts pre-10 encodings like `90603`\n * → `9`.\n */\nexport function serverVersionNumToMajor(versionNum: number | string): number | null {\n    const num = typeof versionNum === \"string\" ? Number(versionNum) : versionNum;\n    if (!Number.isFinite(num) || num <= 0) return null;\n    if (num < 100000) {\n        // 9.x scheme: 90603 = 9.6.3\n        return Math.floor(num / 10000);\n    }\n    return Math.floor(num / 10000);\n}\n\nexport interface VersionCompatibility {\n    compatible: boolean;\n    reason?: string;\n}\n\n/**\n * pg_dump / pg_restore must be **at least** as new as the server they talk\n * to. A newer client against an older server is supported; an older client\n * against a newer server is not and produces corrupt or rejected output.\n */\nexport function checkToolServerCompatibility(\n    toolMajor: number | null,\n    serverMajor: number | null\n): VersionCompatibility {\n    if (toolMajor === null) {\n        return { compatible: false, reason: \"Could not determine the client tool version.\" };\n    }\n    if (serverMajor === null) {\n        return { compatible: false, reason: \"Could not determine the Postgres server version.\" };\n    }\n    if (toolMajor < serverMajor) {\n        return {\n            compatible: false,\n            reason:\n                `Client tool is Postgres ${toolMajor} but the server is Postgres ${serverMajor}. ` +\n                `pg_dump/pg_restore must be the same major version as the server or newer. ` +\n                `Install Postgres ${serverMajor} client tools.`\n        };\n    }\n    return { compatible: true };\n}\n\n/**\n * Build a deterministic, sortable backup file name:\n *   `rebase-<db>-<YYYYMMDD>T<HHMMSS>Z.dump`\n *\n * The UTC timestamp is embedded so retention pruning can recover the\n * creation time from the object key alone, without extra metadata.\n */\nexport function buildBackupFilename(dbName: string, date: Date = new Date()): string {\n    const iso = date.toISOString(); // 2026-07-14T09:12:03.123Z\n    const stamp = iso.replace(/\\.\\d+Z$/, \"Z\").replace(/[-:]/g, \"\");\n    const safeDb = dbName.replace(/[^a-zA-Z0-9_-]/g, \"_\");\n    return `rebase-${safeDb}-${stamp}.dump`;\n}\n\n/**\n * Recover the creation timestamp encoded in a backup file name by\n * {@link buildBackupFilename}. Returns `null` for names that don't match,\n * so foreign objects in a shared prefix are never pruned.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * Parse a destination string into a structured {@link BackupDestination}.\n * `s3://bucket/prefix` and `gs://bucket/prefix` map to object storage;\n * anything else is treated as a local path.\n */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) {\n        return { kind: \"s3\", bucket: s3[1], prefix: stripTrailingSlash(s3[2]) };\n    }\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) {\n        return { kind: \"gcs\", bucket: gcs[1], prefix: stripTrailingSlash(gcs[2]) };\n    }\n    return { kind: \"local\", path: out };\n}\n\nfunction stripTrailingSlash(s: string): string {\n    return s.replace(/\\/+$/, \"\");\n}\n\n/**\n * Join a storage prefix and a file name without producing a leading or\n * doubled slash.\n */\nexport function joinStorageKey(prefix: string, fileName: string): string {\n    const clean = prefix.replace(/^\\/+|\\/+$/g, \"\");\n    return clean.length > 0 ? `${clean}/${fileName}` : fileName;\n}\n\n/**\n * The identity `pg_dump` reads rows as, when row security is left on.\n *\n * Not optional, and that is the whole design. `pg_dump --enable-row-security`\n * on its own is the dangerous command in this file: it turns the \"query would\n * be affected by row-level security policy\" *error* into a dump that exits 0\n * and is silently missing every row the dumping role's policies exclude. A\n * backup that looks fine and restores most of your data is worse than one that\n * refused to run.\n *\n * So the flag is unreachable without a subject to evaluate the policies\n * against. Rebase's generated policies read `app.uid` and `app.user_roles`;\n * supplying an admin role satisfies the `admin_full_access` rule and the dump\n * sees everything that rule sees.\n */\nexport interface RowSecurityIdentity {\n    /** Written to `app.uid`. Any non-empty value — it is only an audit trail. */\n    uid: string;\n    /** Written to `app.user_roles`. Must include a role the policies admit. */\n    roles: string[];\n}\n\n/**\n * `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to\n * set a GUC.\n *\n * A backslash escape rather than quoting, which is what libpq's `-c` parsing\n * takes: a space inside a value ends the option otherwise, so a role list is\n * comma-joined and never spaced.\n */\nexport function buildRowSecurityPgOptions(identity: RowSecurityIdentity): string {\n    const escape = (value: string) => value.replace(/([\\\\ ])/g, \"\\\\$1\");\n    return [\n        `-c app.uid=${escape(identity.uid)}`,\n        `-c app.user_id=${escape(identity.uid)}`,\n        `-c app.user_roles=${escape(identity.roles.join(\",\"))}`\n    ].join(\" \");\n}\n\n/**\n * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),\n * which is compressed and restorable selectively via `pg_restore`.\n */\nexport function buildPgDumpArgs(opts: {\n    connectionString: string;\n    outFile: string;\n    /** Extra schemas/tables to exclude, e.g. Atlas revision tables. */\n    excludeSchemas?: string[];\n    /** Number of parallel jobs (directory format only; ignored for -Fc). */\n    noOwner?: boolean;\n    /**\n     * Dump with row security on, as this identity. Omit — which is the default\n     * — and `pg_dump` errors rather than skipping rows it cannot see.\n     */\n    rowSecurity?: RowSecurityIdentity;\n}): string[] {\n    const args = [\"--format=custom\", \"--no-password\", `--file=${opts.outFile}`];\n    if (opts.noOwner) {\n        args.push(\"--no-owner\");\n    }\n    if (opts.rowSecurity) {\n        args.push(\"--enable-row-security\");\n    }\n    for (const schema of opts.excludeSchemas ?? []) {\n        args.push(`--exclude-schema=${schema}`);\n    }\n    args.push(forLibpq(opts.connectionString));\n    return args;\n}\n\n/**\n * Whether a `pg_dump` failure is the row-security one, and what to do about it.\n *\n * The error text names the table and nothing else, so the first read of it is\n * \"why would a backup be affected by RLS at all?\" — the answer being that the\n * dumping role is not the tables' owner and has no `BYPASSRLS`, which is the\n * normal state of the `postgres` user on Cloud SQL, RDS and every other managed\n * Postgres. Nothing about that is visible from the message.\n *\n * Returns `null` for any other failure, so the caller reports it unchanged.\n */\nexport function diagnoseRowSecurityDumpFailure(error: unknown): string | null {\n    const text = [\n        (error as { stderr?: unknown })?.stderr,\n        (error as { message?: unknown })?.message\n    ].map(part => (typeof part === \"string\" ? part : \"\")).join(\"\\n\");\n\n    if (!/row-level security policy/i.test(text)) return null;\n\n    const table = text.match(/for table \"([^\"]+)\"/)?.[1];\n\n    return [\n        `pg_dump cannot read ${table ? `\"${table}\"` : \"one of the tables\"} because row-level security applies to it.`,\n        \"\",\n        \"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal\",\n        \"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is\",\n        \"  no superuser to hand out.\",\n        \"\",\n        \"  Two ways out:\",\n        \"\",\n        \"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The\",\n        \"      dump then contains every row, which is what a backup should mean.\",\n        \"\",\n        \"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase\",\n        \"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy\",\n        \"      admits the dump. Read the warning it prints: the result contains exactly the\",\n        \"      rows those policies admit, and any table whose policies do not include an\",\n        \"      admin rule comes out short — with no error.\",\n        \"\",\n        \"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the\",\n        \"  settings above it succeeds and silently omits rows.\"\n    ].join(\"\\n\");\n}\n\n/**\n * Assemble the `pg_restore` argument vector for a custom-format dump.\n */\nexport function buildPgRestoreArgs(opts: {\n    connectionString: string;\n    inputFile: string;\n    /** Drop objects before recreating them (destructive but idempotent). */\n    clean?: boolean;\n    /**\n     * Abort on the first error instead of logging and continuing. Defaults\n     * ON: a restore that silently skips failed GRANT/RLS statements (because\n     * a role is missing) \"succeeds\" with RLS un-enforced — a security hole.\n     * Fail loudly instead so the operator knows the restore is incomplete.\n     */\n    exitOnError?: boolean;\n    noOwner?: boolean;\n}): string[] {\n    const args = [\"--format=custom\", \"--no-password\", `--dbname=${forLibpq(opts.connectionString)}`];\n    if (opts.clean) {\n        args.push(\"--clean\", \"--if-exists\");\n    }\n    if (opts.noOwner) {\n        args.push(\"--no-owner\");\n    }\n    // Default to --exit-on-error unless explicitly disabled.\n    if (opts.exitOnError !== false) {\n        args.push(\"--exit-on-error\");\n    }\n    args.push(opts.inputFile);\n    return args;\n}\n\n/**\n * Assemble the `pg_restore --list` argument vector. Reading a dump's table\n * of contents parses the whole archive without touching a database, so it is\n * a cheap integrity check that the file isn't truncated or corrupt.\n */\nexport function buildPgRestoreListArgs(inputFile: string): string[] {\n    return [\"--list\", inputFile];\n}\n\n/**\n * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other\n * cluster-wide objects) live outside any single database, so a per-database\n * `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT\n * statements in the main dump fail on restore and RLS is silently lost — so\n * every backup captures the globals into a sidecar `.globals.sql`.\n *\n * `--no-role-passwords` keeps role secrets out of the artifact (backups may\n * be shipped off-box); roles are recreated password-less and re-secured by\n * the operator.\n */\nexport function buildPgDumpallGlobalsArgs(opts: {\n    connectionString: string;\n    outFile: string;\n}): string[] {\n    return [\n        \"--globals-only\",\n        \"--no-role-passwords\",\n        \"--no-password\",\n        `--file=${opts.outFile}`,\n        `--dbname=${forLibpq(opts.connectionString)}`\n    ];\n}\n\n/**\n * Derive the globals sidecar path/key for a given `.dump` file. Keeps the\n * two artifacts adjacent so listing, uploading and pruning can find one from\n * the other. A name that doesn't end in `.dump` is returned unchanged with a\n * `.globals.sql` suffix appended.\n */\nexport function globalsFileForDump(dumpPath: string): string {\n    return dumpPath.endsWith(\".dump\")\n        ? dumpPath.slice(0, -\".dump\".length) + \".globals.sql\"\n        : dumpPath + \".globals.sql\";\n}\n\n/**\n * Split a `pg_dumpall --globals-only` script into individual statements.\n * Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`\n * can run independently and a benign \"role already exists\" on one doesn't\n * abort the rest. Drops `--` comment lines and blank statements.\n */\nexport function splitGlobalsStatements(sql: string): string[] {\n    const withoutComments = sql\n        .split(\"\\n\")\n        // `--` comments, and psql meta-commands. pg_dumpall 15+ wraps its output\n        // in `\\restrict <token>` / `\\unrestrict <token>`, which are instructions\n        // to psql, not SQL. This replay sends statements over a connection\n        // instead, so they arrived at the server as `\\restrict …` and came back\n        // as `syntax error at or near \"\\\"` — reported to the user as two skipped\n        // globals per restore, which reads like roles failed to apply when\n        // nothing did. They carry no state worth replaying: dropping them is\n        // exactly what a SQL-level consumer should do.\n        .filter((line) => {\n            const trimmed = line.trim();\n            return !trimmed.startsWith(\"--\") && !trimmed.startsWith(\"\\\\\");\n        })\n        .join(\"\\n\");\n    return withoutComments\n        .split(\";\")\n        .map((s) => s.trim())\n        .filter((s) => s.length > 0);\n}\n\n/**\n * Resolve the Postgres connection string the backup commands should use,\n * mirroring the precedence the branch command already relies on.\n */\nexport function resolveConnectionString(\n    env: Record<string, string | undefined>\n): string | null {\n    return env.DATABASE_URL || env.ADMIN_CONNECTION_STRING || null;\n}\n","/**\n * Retention pruning for scheduled backups. Pure logic — no I/O — so it can\n * be exhaustively unit-tested without touching a storage backend.\n */\nimport { parseBackupTimestamp } from \"./pg-tools\";\n\nexport interface BackupObject {\n    /** Storage key / file name. */\n    key: string;\n    /**\n     * Creation time. Optional — when absent it is recovered from the\n     * timestamp encoded in the key by `buildBackupFilename`.\n     */\n    createdAt?: Date;\n    /**\n     * Size on disk, when the lister knows it (local destinations always do).\n     *\n     * Reported so an empty artifact cannot masquerade as a backup in\n     * `rebase db backups list`. Deliberately NOT consulted by\n     * {@link selectBackupsToPrune}: retention decides by age, and a rule that\n     * silently skipped small files would make a genuinely tiny dump immortal.\n     * Visibility is the fix here; the artifacts themselves are now removed at\n     * the point of failure by `discardPartialDump`.\n     */\n    sizeBytes?: number;\n}\n\nexport interface RetentionOptions {\n    /** Delete backups older than this many days. `0`/negative disables age pruning. */\n    retentionDays?: number;\n    /**\n     * Always keep at least this many of the most recent backups, even if\n     * they are older than `retentionDays`. Guards against wiping every\n     * backup after a long outage. Default: 0 (no minimum).\n     */\n    keepMinimum?: number;\n    /** Reference \"now\" — injectable for deterministic tests. */\n    now?: Date;\n}\n\n/**\n * Decide which backups to delete under the given retention policy.\n *\n * Rules, applied in order:\n *  1. Objects whose key isn't a recognised rebase backup (no parseable\n *     timestamp and no `createdAt`) are never selected — foreign files in a\n *     shared bucket are left untouched.\n *  2. The `keepMinimum` newest backups are always retained.\n *  3. Of the remainder, any older than `retentionDays` are selected for\n *     deletion.\n *\n * Returns the keys to delete, oldest first.\n */\nexport function selectBackupsToPrune(\n    backups: BackupObject[],\n    options: RetentionOptions\n): string[] {\n    const retentionDays = options.retentionDays ?? 0;\n    const keepMinimum = Math.max(0, options.keepMinimum ?? 0);\n    const now = options.now ?? new Date();\n\n    if (retentionDays <= 0) {\n        return [];\n    }\n\n    // Resolve a timestamp for every object; drop the ones we can't date.\n    const dated = backups\n        .map((b) => {\n            const createdAt = b.createdAt ?? parseBackupTimestamp(b.key);\n            return createdAt ? { key: b.key, createdAt } : null;\n        })\n        .filter((b): b is { key: string; createdAt: Date } => b !== null);\n\n    // Newest first so the first `keepMinimum` are the protected ones.\n    dated.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n    const cutoff = now.getTime() - retentionDays * 24 * 60 * 60 * 1000;\n\n    const toDelete = dated\n        .slice(keepMinimum)\n        .filter((b) => b.createdAt.getTime() < cutoff);\n\n    // Return oldest first for predictable, readable logs.\n    toDelete.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());\n    return toDelete.map((b) => b.key);\n}\n","/**\n * Pure-ish orchestration for the backup/restore paths, kept free of `execa`\n * and `pg` value imports so it can be unit-tested under jest (the impure\n * edges — spawning processes, opening connections — live in\n * `backup-service.ts`, which is vitest/runtime only).\n *\n * The functions here take their side-effecting dependency as an argument\n * (a statement runner, an object deleter) so tests can inject fakes.\n */\nimport { globalsFileForDump, splitGlobalsStatements } from \"./pg-tools\";\n\n/**\n * Replay a `pg_dumpall --globals-only` script one statement at a time,\n * tolerating per-statement failures. On a same-cluster restore the roles\n * usually already exist (`CREATE ROLE` → \"already exists\") and on a managed\n * provider an `ALTER ROLE <superuser>` may be refused; neither should abort\n * recreation of the roles that *are* missing. Returns how many statements\n * applied vs were skipped.\n *\n * `runStatement` executes one SQL statement and rejects on error.\n */\nexport async function applyGlobalsWith(\n    runStatement: (sql: string) => Promise<void>,\n    globalsSql: string,\n    log: (message: string) => void = () => {}\n): Promise<{ applied: number; skipped: number }> {\n    let applied = 0;\n    let skipped = 0;\n    for (const statement of splitGlobalsStatements(globalsSql)) {\n        try {\n            await runStatement(statement);\n            applied++;\n        } catch (err) {\n            skipped++;\n            const firstLine = statement.split(\"\\n\")[0].slice(0, 80);\n            log(`  • Skipped global: ${firstLine} (${err instanceof Error ? err.message : String(err)})`);\n        }\n    }\n    return { applied, skipped };\n}\n\n/**\n * Delete each pruned dump together with its `.globals.sql` roles sidecar, so\n * pruning never orphans the roles file. The sidecar is best-effort — older\n * backups predate it, so a missing-sidecar failure is swallowed while a\n * failure deleting the dump itself propagates.\n *\n * `deleteObject` removes one key and rejects if it cannot (e.g. not found).\n */\nexport async function pruneWith(\n    keys: string[],\n    deleteObject: (key: string) => Promise<void>\n): Promise<void> {\n    for (const key of keys) {\n        await deleteObject(key);\n        try {\n            await deleteObject(globalsFileForDump(key));\n        } catch {\n            // Sidecar may not exist for older backups — ignore.\n        }\n    }\n}\n\n/**\n * Remove a dump artifact abandoned by a failed tool run.\n *\n * `pg_dump` creates its `--file=` target before it finishes connecting, so any\n * failure — a URL libpq rejects, a dropped connection, a full disk — leaves a\n * 0-byte file behind. That corpse is not inert: `rebase db backups list` used\n * to show it as an ordinary entry, and `selectBackupsToPrune` ranks by\n * timestamp alone, so it occupies a protected `keepMinimum` slot and can push\n * a real backup out of retention.\n *\n * Best-effort on purpose: the caller is already throwing, and a failed unlink\n * must not replace the real diagnosis with an ENOENT/EPERM from the cleanup.\n *\n * Lives here rather than in `backup-service.ts` for the reason at the top of\n * this file — that module's top-level `execa` import makes it unloadable under\n * jest, so anything placed there cannot be unit-tested.\n *\n * `remove` deletes one file and throws if it cannot; `exists` reports presence.\n */\nexport function discardPartialDumpWith(\n    exists: (file: string) => boolean,\n    remove: (file: string) => void,\n    file: string\n): void {\n    try {\n        if (exists(file)) remove(file);\n    } catch {\n        // Ignored: see above.\n    }\n}\n","/**\n * Backup / restore orchestration: thin, well-typed wrappers around\n * `pg_dump` and `pg_restore`, plus binary detection, version pre-flight,\n * and upload/prune against a storage backend.\n *\n * The pure argument- and policy-logic lives in `pg-tools.ts` and\n * `retention.ts`; this module is the impure edge (spawns processes, talks\n * to Postgres and storage) and is intentionally kept small.\n */\nimport fs from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\nimport { execa } from \"execa\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport { resolveLocalBin } from \"../cli-helpers\";\nimport {\n    BackupDestination,\n    buildBackupFilename,\n    buildPgDumpArgs,\n    buildPgDumpallGlobalsArgs,\n    buildRowSecurityPgOptions,\n    diagnoseRowSecurityDumpFailure,\n    type RowSecurityIdentity,\n    buildPgRestoreArgs,\n    buildPgRestoreListArgs,\n    checkToolServerCompatibility,\n    globalsFileForDump,\n    joinStorageKey,\n    parsePgToolMajor,\n    parseBackupTimestamp,\n    serverVersionNumToMajor,\n    VersionCompatibility\n} from \"./pg-tools\";\nimport { BackupObject, RetentionOptions, selectBackupsToPrune } from \"./retention\";\nimport { applyGlobalsWith, discardPartialDumpWith, pruneWith } from \"./backup-logic\";\n\n/**\n * Remove a dump artifact abandoned by a failed tool run. See\n * {@link discardPartialDumpWith} for why this exists and why the logic lives\n * in the execa-free module.\n */\nexport function discardPartialDump(file: string): void {\n    discardPartialDumpWith(\n        (f) => fs.existsSync(f),\n        (f) => fs.unlinkSync(f),\n        file\n    );\n}\n\nexport class BackupToolError extends Error {\n    constructor(message: string, readonly hint?: string) {\n        super(message);\n        this.name = \"BackupToolError\";\n    }\n}\n\n/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */\nexport function resolvePgBinary(\n    tool: \"pg_dump\" | \"pg_restore\" | \"pg_dumpall\",\n    env: Record<string, string | undefined> = process.env\n): string | null {\n    const overrideVar =\n        tool === \"pg_dump\" ? env.PG_DUMP_PATH\n        : tool === \"pg_restore\" ? env.PG_RESTORE_PATH\n        : env.PG_DUMPALL_PATH;\n    if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;\n    return resolveLocalBin(tool);\n}\n\n/** Run `<bin> --version` and extract the major version. */\nexport async function detectToolMajor(bin: string): Promise<number | null> {\n    try {\n        const { stdout } = await execa(bin, [\"--version\"]);\n        return parsePgToolMajor(stdout);\n    } catch {\n        return null;\n    }\n}\n\n/** Query the server for its major version via `server_version_num`. */\nexport async function getServerVersionMajor(connectionString: string): Promise<number | null> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString });\n    await client.connect();\n    try {\n        const res = await client.query(\"SHOW server_version_num\");\n        const raw = res.rows?.[0]?.server_version_num;\n        return serverVersionNumToMajor(raw);\n    } finally {\n        await client.end();\n    }\n}\n\nexport interface PreflightResult extends VersionCompatibility {\n    bin: string;\n    toolMajor: number | null;\n    serverMajor: number | null;\n}\n\n/**\n * Verify the requested client tool exists and its major version is\n * compatible with the live server. Throws {@link BackupToolError} — with a\n * doctor-style hint — when the binary is missing.\n */\nexport async function preflight(\n    tool: \"pg_dump\" | \"pg_restore\",\n    connectionString: string,\n    env: Record<string, string | undefined> = process.env\n): Promise<PreflightResult> {\n    const bin = resolvePgBinary(tool, env);\n    if (!bin) {\n        throw new BackupToolError(\n            `Could not find the '${tool}' binary.`,\n            `Install the PostgreSQL client tools (e.g. 'brew install libpq' or 'apt-get install postgresql-client'), ` +\n            `or set ${tool === \"pg_dump\" ? \"PG_DUMP_PATH\" : \"PG_RESTORE_PATH\"} to its full path.`\n        );\n    }\n    const [toolMajor, serverMajor] = await Promise.all([\n        detectToolMajor(bin),\n        getServerVersionMajor(connectionString)\n    ]);\n    const compat = checkToolServerCompatibility(toolMajor, serverMajor);\n    return { bin, toolMajor, serverMajor, ...compat };\n}\n\nexport interface BackupResult {\n    /** Absolute path of the produced dump file on local disk. */\n    localFile: string;\n    fileName: string;\n    sizeBytes: number;\n    /**\n     * Absolute path of the `.globals.sql` sidecar holding cluster-wide roles\n     * (present unless globals capture was disabled or unavailable).\n     */\n    globalsFile?: string;\n    globalsSizeBytes?: number;\n}\n\n/**\n * Produce a custom-format dump on local disk. When `outDir` is omitted the\n * file is written to the OS temp directory (used by the upload path, which\n * cleans it up afterwards).\n *\n * Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via\n * `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements\n * depend on can be recreated on restore. Set `includeGlobals: false` to skip\n * it (e.g. when the caller has no privilege to read cluster globals).\n */\nexport async function createDump(opts: {\n    connectionString: string;\n    dbName: string;\n    outDir?: string;\n    fileName?: string;\n    excludeSchemas?: string[];\n    noOwner?: boolean;\n    inheritStdio?: boolean;\n    includeGlobals?: boolean;\n    env?: Record<string, string | undefined>;\n    /**\n     * Dump with row security left on, reading as this identity.\n     *\n     * The escape hatch for a managed Postgres, where the dumping role owns\n     * nothing and has no `BYPASSRLS`. Off by default, and deliberately so: with\n     * row security on, `pg_dump` stops erroring on rows it cannot see and\n     * simply omits them. See {@link RowSecurityIdentity}.\n     */\n    rowSecurity?: RowSecurityIdentity;\n}): Promise<BackupResult> {\n    const env = opts.env ?? process.env;\n    const bin = resolvePgBinary(\"pg_dump\", env);\n    if (!bin) {\n        throw new BackupToolError(\n            \"Could not find the 'pg_dump' binary.\",\n            \"Install the PostgreSQL client tools or set PG_DUMP_PATH.\"\n        );\n    }\n\n    const fileName = opts.fileName ?? buildBackupFilename(opts.dbName);\n    const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-backup-\"));\n    fs.mkdirSync(outDir, { recursive: true });\n    const localFile = path.join(outDir, fileName);\n\n    const args = buildPgDumpArgs({\n        connectionString: opts.connectionString,\n        outFile: localFile,\n        excludeSchemas: opts.excludeSchemas,\n        noOwner: opts.noOwner,\n        rowSecurity: opts.rowSecurity\n    });\n\n    // `PGOPTIONS` is the only way to set a GUC on a tool that takes no SQL.\n    // Built from the same object that added `--enable-row-security`, so the\n    // flag cannot travel without the identity that makes it safe.\n    const dumpEnv: Record<string, string> = { ...(env as Record<string, string>) };\n    if (opts.rowSecurity) {\n        dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)]\n            .filter(Boolean).join(\" \");\n    }\n\n    try {\n        await execa(bin, args, {\n            stdio: opts.inheritStdio ? \"inherit\" : \"pipe\",\n            env: dumpEnv\n        });\n    } catch (error) {\n        // pg_dump creates its `--file=` target before it finishes connecting,\n        // so any failure here — a URL libpq rejects, a dropped connection, a\n        // full disk — leaves a 0-byte file behind that nothing else removed.\n        // That corpse is not inert: `rebase db backups list` shows it as an\n        // ordinary entry, and `selectBackupsToPrune` ranks by timestamp alone,\n        // so it occupies a protected `keepMinimum` slot and can push a real\n        // backup out of retention. A missing backup is honest; an empty file\n        // that reads as a backup is not.\n        discardPartialDump(localFile);\n        // The RLS failure names a table and no cause. Replace it with the\n        // cause and the two ways out; anything else is re-thrown untouched.\n        const diagnosis = diagnoseRowSecurityDumpFailure(error);\n        if (!diagnosis) throw error;\n        throw new BackupToolError(\n            diagnosis,\n            \"Run `rebase db backup --help` for the flag, and read what it says about partial dumps.\"\n        );\n    }\n\n    const sizeBytes = fs.existsSync(localFile) ? fs.statSync(localFile).size : 0;\n\n    const result: BackupResult = { localFile, fileName, sizeBytes };\n\n    if (opts.includeGlobals !== false) {\n        const dumpallBin = resolvePgBinary(\"pg_dumpall\", env);\n        if (!dumpallBin) {\n            throw new BackupToolError(\n                \"Could not find the 'pg_dumpall' binary needed to capture cluster roles.\",\n                \"Install the PostgreSQL client tools or set PG_DUMPALL_PATH. \" +\n                \"To take a role-incomplete backup anyway, pass includeGlobals: false.\"\n            );\n        }\n        const globalsFile = globalsFileForDump(localFile);\n        try {\n            await execa(\n                dumpallBin,\n                buildPgDumpallGlobalsArgs({ connectionString: opts.connectionString, outFile: globalsFile }),\n                { stdio: opts.inheritStdio ? \"inherit\" : \"pipe\", env: { ...(env as Record<string, string>) } }\n            );\n        } catch (error) {\n            // Same reasoning as the pg_dump catch above, and the dump goes with\n            // it: the pair is uploaded and pruned together, so a dump whose\n            // roles sidecar is missing restores without the roles its GRANT and\n            // RLS statements need — the exact failure the sidecar exists to\n            // prevent. Leaving half a pair on disk would look like a backup.\n            discardPartialDump(globalsFile);\n            discardPartialDump(localFile);\n            throw error;\n        }\n        result.globalsFile = globalsFile;\n        result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;\n    }\n\n    return result;\n}\n\n/**\n * Cheap integrity check on a freshly written dump: it must be non-empty and\n * `pg_restore --list` must parse its table of contents without error. Used\n * before pruning older backups so a corrupt-but-exit-0 dump never becomes\n * the reason the last good backup is deleted.\n */\nexport async function validateDump(\n    localFile: string,\n    env: Record<string, string | undefined> = process.env\n): Promise<{ ok: boolean; reason?: string }> {\n    if (!fs.existsSync(localFile)) {\n        return { ok: false, reason: `Dump file does not exist: ${localFile}` };\n    }\n    if (fs.statSync(localFile).size === 0) {\n        return { ok: false, reason: \"Dump file is empty (0 bytes).\" };\n    }\n    const bin = resolvePgBinary(\"pg_restore\", env);\n    if (!bin) {\n        // Can't verify without pg_restore; treat as inconclusive-but-fail so\n        // pruning doesn't proceed on an unverified dump.\n        return { ok: false, reason: \"Could not find 'pg_restore' to verify the dump.\" };\n    }\n    try {\n        await execa(bin, buildPgRestoreListArgs(localFile), {\n            stdio: \"pipe\",\n            env: { ...(env as Record<string, string>) }\n        });\n        return { ok: true };\n    } catch (err) {\n        return { ok: false, reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}` };\n    }\n}\n\n/**\n * Replay a `pg_dumpall --globals-only` script to recreate cluster roles\n * before a restore, so the dump's GRANT/RLS statements (which reference\n * `rebase_user` and any owner roles) actually apply. Runs statement by\n * statement and tolerates per-statement failures — on a same-cluster restore\n * the roles usually already exist (`CREATE ROLE` → \"already exists\"), and on\n * a managed provider an `ALTER ROLE <superuser>` may be refused; neither\n * should abort role recreation. Returns how many statements applied vs were\n * skipped.\n */\nexport async function applyGlobals(\n    connectionString: string,\n    globalsSql: string,\n    log: (message: string) => void = () => {}\n): Promise<{ applied: number; skipped: number }> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString });\n    await client.connect();\n    try {\n        return await applyGlobalsWith(\n            async (sql) => { await client.query(sql); },\n            globalsSql,\n            log\n        );\n    } finally {\n        await client.end();\n    }\n}\n\n/**\n * Restore a custom-format dump into the database named by\n * `connectionString`. Destructive when `clean` is set (drops objects\n * first). Never called automatically — the CLI gates it behind explicit\n * confirmation.\n *\n * Runs with `--exit-on-error` by default: a restore that logs-and-continues\n * past a failed GRANT (because a role was missing) reports success with RLS\n * un-enforced. Callers should recreate roles first (see {@link applyGlobals})\n * and only set `exitOnError: false` deliberately.\n */\nexport async function restoreDump(opts: {\n    connectionString: string;\n    inputFile: string;\n    clean?: boolean;\n    noOwner?: boolean;\n    exitOnError?: boolean;\n    inheritStdio?: boolean;\n    env?: Record<string, string | undefined>;\n}): Promise<void> {\n    const env = opts.env ?? process.env;\n    const bin = resolvePgBinary(\"pg_restore\", env);\n    if (!bin) {\n        throw new BackupToolError(\n            \"Could not find the 'pg_restore' binary.\",\n            \"Install the PostgreSQL client tools or set PG_RESTORE_PATH.\"\n        );\n    }\n    const args = buildPgRestoreArgs({\n        connectionString: opts.connectionString,\n        inputFile: opts.inputFile,\n        clean: opts.clean,\n        noOwner: opts.noOwner,\n        exitOnError: opts.exitOnError\n    });\n    await execa(bin, args, {\n        stdio: opts.inheritStdio ? \"inherit\" : \"pipe\",\n        env: { ...(env as Record<string, string>) }\n    });\n}\n\n/**\n * Create a database (if absent) by connecting to the maintenance\n * `postgres` database. Used by `restore --create-db`.\n */\nexport async function ensureDatabaseExists(\n    adminConnectionString: string,\n    dbName: string\n): Promise<boolean> {\n    const { Client } = await import(\"pg\");\n    const parsed = new URL(adminConnectionString);\n    parsed.pathname = \"/postgres\";\n    const client = new Client({ connectionString: parsed.toString() });\n    await client.connect();\n    try {\n        const existing = await client.query(\"SELECT 1 FROM pg_database WHERE datname = $1\", [dbName]);\n        if (existing.rowCount && existing.rowCount > 0) {\n            return false;\n        }\n        // Identifier can't be parameterised; guard against injection.\n        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(dbName)) {\n            throw new BackupToolError(`Invalid database name: \"${dbName}\"`);\n        }\n        await client.query(`CREATE DATABASE \"${dbName}\"`);\n        return true;\n    } finally {\n        await client.end();\n    }\n}\n\n/**\n * Upload a local dump to object storage under the destination's prefix.\n * Backups may contain secrets/PII, so the object is written with a\n * private/octet-stream content type; bucket-level ACLs must stay private.\n */\nexport async function uploadBackup(\n    storage: StorageController,\n    localFile: string,\n    dest: Extract<BackupDestination, { kind: \"s3\" | \"gcs\" }>\n): Promise<{ key: string; storageUrl: string }> {\n    const fileName = path.basename(localFile);\n    const key = joinStorageKey(dest.prefix, fileName);\n    const buffer = fs.readFileSync(localFile);\n    const file = new File([buffer], fileName, { type: \"application/octet-stream\" });\n    const result = await storage.putObject({\n        file,\n        key,\n        bucket: dest.bucket,\n        metadata: { \"rebase-backup\": \"1\" }\n    });\n    return { key, storageUrl: result.storageUrl };\n}\n\n/**\n * List existing backups at a destination. For local destinations reads the\n * directory; for object storage lists the prefix via the controller.\n */\nexport async function listBackups(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupObject[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f) => {\n                const full = path.join(dir, f);\n                const stats = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? stats.mtime;\n                return { key: full, createdAt, sizeBytes: stats.size };\n            })\n            .sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));\n    }\n\n    if (!storage) {\n        throw new BackupToolError(\n            `Listing ${dest.kind} backups requires a configured storage backend.`\n        );\n    }\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key) => ({ key, createdAt: parseBackupTimestamp(key) ?? undefined }))\n        .sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));\n}\n\n/**\n * Apply a retention policy to a destination, deleting the backups selected\n * by {@link selectBackupsToPrune}. Returns the keys that were removed.\n */\nexport async function pruneBackups(\n    dest: BackupDestination,\n    options: RetentionOptions,\n    storage?: StorageController\n): Promise<string[]> {\n    const backups = await listBackups(dest, storage);\n    const toDelete = selectBackupsToPrune(backups, options);\n\n    // Delete each dump together with its `.globals.sql` sidecar (pruneWith\n    // handles the pairing + best-effort sidecar). The deleter rejects on a\n    // missing key so pruneWith can swallow an absent sidecar.\n    const deleteObject =\n        dest.kind === \"local\"\n            ? async (key: string) => {\n                if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);\n                fs.unlinkSync(key);\n            }\n            : async (key: string) => {\n                if (!storage) throw new BackupToolError(\"Storage backend required to prune object backups.\");\n                await storage.deleteObject(key, dest.bucket);\n            };\n\n    await pruneWith(toDelete, deleteObject);\n    return toDelete;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,mBAAmB,kBAAyC;CACxE,IAAI;EAEA,MAAM,OAAO,IADM,IAAI,gBACV,CAAA,CAAO,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,KAAK;EACrD,OAAO,KAAK,SAAS,IAAI,OAAO;CACpC,QAAQ;EAEJ,MAAM,QAAQ,iBAAiB,MAAM,kBAAkB;EACvD,OAAO,SAAS,MAAM,KAAK,MAAM,KAAK;CAC1C;AACJ;;;;;;AAOA,SAAgB,iBAAiB,kBAA0B,QAAwB;CAC/E,IAAI;EACA,MAAM,SAAS,IAAI,IAAI,gBAAgB;EACvC,OAAO,WAAW,IAAI;EACtB,OAAO,OAAO,SAAS;CAC3B,QAAQ;EACJ,OAAO,iBAAiB,QAAQ,oBAAoB,IAAI,OAAO,GAAG;CACtE;AACJ;;;;;;AAOA,SAAgB,iBAAiB,eAAsC;CACnE,MAAM,QAAQ,cAAc,MAAM,mBAAmB;CACrD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,OAAO,MAAM,EAAE;CAC7B,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;CAEpC,IAAI,UAAU,KAAK,MAAM,OAAO,KAAA,GAC5B,OAAO;CAEX,OAAO;AACX;;;;;;AAOA,SAAgB,wBAAwB,YAA4C;CAChF,MAAM,MAAM,OAAO,eAAe,WAAW,OAAO,UAAU,IAAI;CAClE,IAAI,CAAC,OAAO,SAAS,GAAG,KAAK,OAAO,GAAG,OAAO;CAC9C,IAAI,MAAM,KAEN,OAAO,KAAK,MAAM,MAAM,GAAK;CAEjC,OAAO,KAAK,MAAM,MAAM,GAAK;AACjC;;;;;;AAYA,SAAgB,6BACZ,WACA,aACoB;CACpB,IAAI,cAAc,MACd,OAAO;EAAE,YAAY;EAAO,QAAQ;CAA+C;CAEvF,IAAI,gBAAgB,MAChB,OAAO;EAAE,YAAY;EAAO,QAAQ;CAAmD;CAE3F,IAAI,YAAY,aACZ,OAAO;EACH,YAAY;EACZ,QACI,2BAA2B,UAAU,8BAA8B,YAAY,+FAE3D,YAAY;CACxC;CAEJ,OAAO,EAAE,YAAY,KAAK;AAC9B;;;;;;;;AASA,SAAgB,oBAAoB,QAAgB,uBAAa,IAAI,KAAK,GAAW;CAEjF,MAAM,QADM,KAAK,YACH,CAAA,CAAI,QAAQ,WAAW,GAAG,CAAC,CAAC,QAAQ,SAAS,EAAE;CAE7D,OAAO,UADQ,OAAO,QAAQ,mBAAmB,GAChC,EAAO,GAAG,MAAM;AACrC;;;;;;AAOA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;;AAOA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IACA,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,mBAAmB,GAAG,EAAE;CAAE;CAE1E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KACA,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,mBAAmB,IAAI,EAAE;CAAE;CAE7E,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;AAEA,SAAS,mBAAmB,GAAmB;CAC3C,OAAO,EAAE,QAAQ,QAAQ,EAAE;AAC/B;;;;;AAMA,SAAgB,eAAe,QAAgB,UAA0B;CACrE,MAAM,QAAQ,OAAO,QAAQ,cAAc,EAAE;CAC7C,OAAO,MAAM,SAAS,IAAI,GAAG,MAAM,GAAG,aAAa;AACvD;;;;;;;;;AAgCA,SAAgB,0BAA0B,UAAuC;CAC7E,MAAM,UAAU,UAAkB,MAAM,QAAQ,YAAY,MAAM;CAClE,OAAO;EACH,cAAc,OAAO,SAAS,GAAG;EACjC,kBAAkB,OAAO,SAAS,GAAG;EACrC,qBAAqB,OAAO,SAAS,MAAM,KAAK,GAAG,CAAC;CACxD,CAAC,CAAC,KAAK,GAAG;AACd;;;;;AAMA,SAAgB,gBAAgB,MAYnB;CACT,MAAM,OAAO;EAAC;EAAmB;EAAiB,UAAU,KAAK;CAAS;CAC1E,IAAI,KAAK,SACL,KAAK,KAAK,YAAY;CAE1B,IAAI,KAAK,aACL,KAAK,KAAK,uBAAuB;CAErC,KAAK,MAAM,UAAU,KAAK,kBAAkB,CAAC,GACzC,KAAK,KAAK,oBAAoB,QAAQ;CAE1C,KAAK,KAAK,SAAS,KAAK,gBAAgB,CAAC;CACzC,OAAO;AACX;;;;;;;;;;;;AAaA,SAAgB,+BAA+B,OAA+B;CAC1E,MAAM,OAAO,CACR,OAAgC,QAChC,OAAiC,OACtC,CAAC,CAAC,KAAI,SAAS,OAAO,SAAS,WAAW,OAAO,EAAG,CAAC,CAAC,KAAK,IAAI;CAE/D,IAAI,CAAC,6BAA6B,KAAK,IAAI,GAAG,OAAO;CAErD,MAAM,QAAQ,KAAK,MAAM,qBAAqB,CAAC,GAAG;CAElD,OAAO;EACH,uBAAuB,QAAQ,IAAI,MAAM,KAAK,oBAAoB;EAClE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACJ,CAAC,CAAC,KAAK,IAAI;AACf;;;;AAKA,SAAgB,mBAAmB,MAatB;CACT,MAAM,OAAO;EAAC;EAAmB;EAAiB,YAAY,SAAS,KAAK,gBAAgB;CAAG;CAC/F,IAAI,KAAK,OACL,KAAK,KAAK,WAAW,aAAa;CAEtC,IAAI,KAAK,SACL,KAAK,KAAK,YAAY;CAG1B,IAAI,KAAK,gBAAgB,OACrB,KAAK,KAAK,iBAAiB;CAE/B,KAAK,KAAK,KAAK,SAAS;CACxB,OAAO;AACX;;;;;;AAOA,SAAgB,uBAAuB,WAA6B;CAChE,OAAO,CAAC,UAAU,SAAS;AAC/B;;;;;;;;;;;;AAaA,SAAgB,0BAA0B,MAG7B;CACT,OAAO;EACH;EACA;EACA;EACA,UAAU,KAAK;EACf,YAAY,SAAS,KAAK,gBAAgB;CAC9C;AACJ;;;;;;;AAQA,SAAgB,mBAAmB,UAA0B;CACzD,OAAO,SAAS,SAAS,OAAO,IAC1B,SAAS,MAAM,GAAG,EAAe,IAAI,iBACrC,WAAW;AACrB;;;;;;;AAQA,SAAgB,uBAAuB,KAAuB;CAgB1D,OAfwB,IACnB,MAAM,IAAI,CAAC,CASX,QAAQ,SAAS;EACd,MAAM,UAAU,KAAK,KAAK;EAC1B,OAAO,CAAC,QAAQ,WAAW,IAAI,KAAK,CAAC,QAAQ,WAAW,IAAI;CAChE,CAAC,CAAC,CACD,KAAK,IACH,CAAA,CACF,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,QAAQ,MAAM,EAAE,SAAS,CAAC;AACnC;;;;;AAMA,SAAgB,wBACZ,KACa;CACb,OAAO,IAAI,gBAAgB,IAAI,2BAA2B;AAC9D;;;;;;;;;;;;;;;;;;;;AC7VA,SAAgB,qBACZ,SACA,SACQ;CACR,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,cAAc,KAAK,IAAI,GAAG,QAAQ,eAAe,CAAC;CACxD,MAAM,MAAM,QAAQ,uBAAO,IAAI,KAAK;CAEpC,IAAI,iBAAiB,GACjB,OAAO,CAAC;CAIZ,MAAM,QAAQ,QACT,KAAK,MAAM;EACR,MAAM,YAAY,EAAE,aAAa,qBAAqB,EAAE,GAAG;EAC3D,OAAO,YAAY;GAAE,KAAK,EAAE;GAAK;EAAU,IAAI;CACnD,CAAC,CAAC,CACD,QAAQ,MAA6C,MAAM,IAAI;CAGpE,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,QAAQ,IAAI,EAAE,UAAU,QAAQ,CAAC;CAElE,MAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK,KAAK;CAE9D,MAAM,WAAW,MACZ,MAAM,WAAW,CAAC,CAClB,QAAQ,MAAM,EAAE,UAAU,QAAQ,IAAI,MAAM;CAGjD,SAAS,MAAM,GAAG,MAAM,EAAE,UAAU,QAAQ,IAAI,EAAE,UAAU,QAAQ,CAAC;CACrE,OAAO,SAAS,KAAK,MAAM,EAAE,GAAG;AACpC;;;;;;;;;;;;;;;;;;;;;;AChEA,eAAsB,iBAClB,cACA,YACA,YAAuC,CAAC,GACK;CAC7C,IAAI,UAAU;CACd,IAAI,UAAU;CACd,KAAK,MAAM,aAAa,uBAAuB,UAAU,GACrD,IAAI;EACA,MAAM,aAAa,SAAS;EAC5B;CACJ,SAAS,KAAK;EACV;EAEA,IAAI,uBADc,UAAU,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,EACzB,EAAU,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAAE;CAChG;CAEJ,OAAO;EAAE;EAAS;CAAQ;AAC9B;;;;;;;;;AAUA,eAAsB,UAClB,MACA,cACa;CACb,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,aAAa,GAAG;EACtB,IAAI;GACA,MAAM,aAAa,mBAAmB,GAAG,CAAC;EAC9C,QAAQ,CAER;CACJ;AACJ;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,uBACZ,QACA,QACA,MACI;CACJ,IAAI;EACA,IAAI,OAAO,IAAI,GAAG,OAAO,IAAI;CACjC,QAAQ,CAER;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACnDA,SAAgB,mBAAmB,MAAoB;CACnD,wBACK,MAAM,GAAG,WAAW,CAAC,IACrB,MAAM,GAAG,WAAW,CAAC,GACtB,IACJ;AACJ;AAEA,IAAa,kBAAb,cAAqC,MAAM;CACD;CAAtC,YAAY,SAAiB,MAAwB;EACjD,MAAM,OAAO;EADqB,KAAA,OAAA;EAElC,KAAK,OAAO;CAChB;AACJ;;AAGA,SAAgB,gBACZ,MACA,MAA0C,QAAQ,KACrC;CACb,MAAM,cACF,SAAS,YAAY,IAAI,eACvB,SAAS,eAAe,IAAI,kBAC5B,IAAI;CACV,IAAI,eAAe,GAAG,WAAW,WAAW,GAAG,OAAO;CACtD,OAAO,gBAAgB,IAAI;AAC/B;;AAGA,eAAsB,gBAAgB,KAAqC;CACvE,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,KAAK,CAAC,WAAW,CAAC;EACjD,OAAO,iBAAiB,MAAM;CAClC,QAAQ;EACJ,OAAO;CACX;AACJ;;AAGA,eAAsB,sBAAsB,kBAAkD;CAC1F,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,iBAAiB,CAAC;CAC9C,MAAM,OAAO,QAAQ;CACrB,IAAI;EAEA,MAAM,OAAM,MADM,OAAO,MAAM,yBAAyB,EAAA,CACxC,OAAO,EAAE,EAAE;EAC3B,OAAO,wBAAwB,GAAG;CACtC,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;AAaA,eAAsB,UAClB,MACA,kBACA,MAA0C,QAAQ,KAC1B;CACxB,MAAM,MAAM,gBAAgB,MAAM,GAAG;CACrC,IAAI,CAAC,KACD,MAAM,IAAI,gBACN,uBAAuB,KAAK,YAC5B,kHACU,SAAS,YAAY,iBAAiB,kBAAkB,mBACtE;CAEJ,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,gBAAgB,GAAG,GACnB,sBAAsB,gBAAgB,CAC1C,CAAC;CAED,OAAO;EAAE;EAAK;EAAW;EAAa,GADvB,6BAA6B,WAAW,WACd;CAAO;AACpD;;;;;;;;;;;AAyBA,eAAsB,WAAW,MAmBP;CACtB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,gBAAgB,WAAW,GAAG;CAC1C,IAAI,CAAC,KACD,MAAM,IAAI,gBACN,wCACA,0DACJ;CAGJ,MAAM,WAAW,KAAK,YAAY,oBAAoB,KAAK,MAAM;CACjE,MAAM,SAAS,KAAK,UAAU,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,gBAAgB,CAAC;CACrF,GAAG,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,YAAY,KAAK,KAAK,QAAQ,QAAQ;CAE5C,MAAM,OAAO,gBAAgB;EACzB,kBAAkB,KAAK;EACvB,SAAS;EACT,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,aAAa,KAAK;CACtB,CAAC;CAKD,MAAM,UAAkC,EAAE,GAAI,IAA+B;CAC7E,IAAI,KAAK,aACL,QAAQ,YAAY,CAAC,IAAI,WAAW,0BAA0B,KAAK,WAAW,CAAC,CAAC,CAC3E,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;CAGjC,IAAI;EACA,MAAM,MAAM,KAAK,MAAM;GACnB,OAAO,KAAK,eAAe,YAAY;GACvC,KAAK;EACT,CAAC;CACL,SAAS,OAAO;EASZ,mBAAmB,SAAS;EAG5B,MAAM,YAAY,+BAA+B,KAAK;EACtD,IAAI,CAAC,WAAW,MAAM;EACtB,MAAM,IAAI,gBACN,WACA,wFACJ;CACJ;CAIA,MAAM,SAAuB;EAAE;EAAW;EAAU,WAFlC,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,CAAC,OAAO;CAEb;CAE9D,IAAI,KAAK,mBAAmB,OAAO;EAC/B,MAAM,aAAa,gBAAgB,cAAc,GAAG;EACpD,IAAI,CAAC,YACD,MAAM,IAAI,gBACN,2EACA,kIAEJ;EAEJ,MAAM,cAAc,mBAAmB,SAAS;EAChD,IAAI;GACA,MAAM,MACF,YACA,0BAA0B;IAAE,kBAAkB,KAAK;IAAkB,SAAS;GAAY,CAAC,GAC3F;IAAE,OAAO,KAAK,eAAe,YAAY;IAAQ,KAAK,EAAE,GAAI,IAA+B;GAAE,CACjG;EACJ,SAAS,OAAO;GAMZ,mBAAmB,WAAW;GAC9B,mBAAmB,SAAS;GAC5B,MAAM;EACV;EACA,OAAO,cAAc;EACrB,OAAO,mBAAmB,GAAG,WAAW,WAAW,IAAI,GAAG,SAAS,WAAW,CAAC,CAAC,OAAO;CAC3F;CAEA,OAAO;AACX;;;;;;;AAQA,eAAsB,aAClB,WACA,MAA0C,QAAQ,KACT;CACzC,IAAI,CAAC,GAAG,WAAW,SAAS,GACxB,OAAO;EAAE,IAAI;EAAO,QAAQ,6BAA6B;CAAY;CAEzE,IAAI,GAAG,SAAS,SAAS,CAAC,CAAC,SAAS,GAChC,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAgC;CAEhE,MAAM,MAAM,gBAAgB,cAAc,GAAG;CAC7C,IAAI,CAAC,KAGD,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAkD;CAElF,IAAI;EACA,MAAM,MAAM,KAAK,uBAAuB,SAAS,GAAG;GAChD,OAAO;GACP,KAAK,EAAE,GAAI,IAA+B;EAC9C,CAAC;EACD,OAAO,EAAE,IAAI,KAAK;CACtB,SAAS,KAAK;EACV,OAAO;GAAE,IAAI;GAAO,QAAQ,6BAA6B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAI;CAChH;AACJ;;;;;;;;;;;AAYA,eAAsB,aAClB,kBACA,YACA,YAAuC,CAAC,GACK;CAC7C,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,iBAAiB,CAAC;CAC9C,MAAM,OAAO,QAAQ;CACrB,IAAI;EACA,OAAO,MAAM,iBACT,OAAO,QAAQ;GAAE,MAAM,OAAO,MAAM,GAAG;EAAG,GAC1C,YACA,GACJ;CACJ,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;;;;;;;AAaA,eAAsB,YAAY,MAQhB;CACd,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,gBAAgB,cAAc,GAAG;CAC7C,IAAI,CAAC,KACD,MAAM,IAAI,gBACN,2CACA,6DACJ;CASJ,MAAM,MAAM,KAPC,mBAAmB;EAC5B,kBAAkB,KAAK;EACvB,WAAW,KAAK;EAChB,OAAO,KAAK;EACZ,SAAS,KAAK;EACd,aAAa,KAAK;CACtB,CACiB,GAAM;EACnB,OAAO,KAAK,eAAe,YAAY;EACvC,KAAK,EAAE,GAAI,IAA+B;CAC9C,CAAC;AACL;;;;;AAMA,eAAsB,qBAClB,uBACA,QACgB;CAChB,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,IAAI,qBAAqB;CAC5C,OAAO,WAAW;CAClB,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,OAAO,SAAS,EAAE,CAAC;CACjE,MAAM,OAAO,QAAQ;CACrB,IAAI;EACA,MAAM,WAAW,MAAM,OAAO,MAAM,gDAAgD,CAAC,MAAM,CAAC;EAC5F,IAAI,SAAS,YAAY,SAAS,WAAW,GACzC,OAAO;EAGX,IAAI,CAAC,2BAA2B,KAAK,MAAM,GACvC,MAAM,IAAI,gBAAgB,2BAA2B,OAAO,EAAE;EAElE,MAAM,OAAO,MAAM,oBAAoB,OAAO,EAAE;EAChD,OAAO;CACX,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;AAOA,eAAsB,aAClB,SACA,WACA,MAC4C;CAC5C,MAAM,WAAW,KAAK,SAAS,SAAS;CACxC,MAAM,MAAM,eAAe,KAAK,QAAQ,QAAQ;CAChD,MAAM,SAAS,GAAG,aAAa,SAAS;CACxC,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,EAAE,MAAM,2BAA2B,CAAC;CAO9E,OAAO;EAAE;EAAK,aAAY,MANL,QAAQ,UAAU;GACnC;GACA;GACA,QAAQ,KAAK;GACb,UAAU,EAAE,iBAAiB,IAAI;EACrC,CAAC,EAAA,CACgC;CAAW;AAChD;;;;;AAMA,eAAsB,YAClB,MACA,SACuB;CACvB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAM;GACR,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,QAAQ,GAAG,SAAS,IAAI;GAE9B,OAAO;IAAE,KAAK;IAAM,WADF,qBAAqB,CAAC,KAAK,MAAM;IACpB,WAAW,MAAM;GAAK;EACzD,CAAC,CAAC,CACD,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,KAAK,MAAM,EAAE,WAAW,QAAQ,KAAK,EAAE;CACrF;CAEA,IAAI,CAAC,SACD,MAAM,IAAI,gBACN,WAAW,KAAK,KAAK,gDACzB;CAMJ,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,SAAS;EAAE;EAAK,WAAW,qBAAqB,GAAG,KAAK,KAAA;CAAU,EAAE,CAAC,CAC1E,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,KAAK,MAAM,EAAE,WAAW,QAAQ,KAAK,EAAE;AACrF;;;;;AAMA,eAAsB,aAClB,MACA,SACA,SACiB;CAEjB,MAAM,WAAW,qBAAqB,MADhB,YAAY,MAAM,OAAO,GACA,OAAO;CAgBtD,MAAM,UAAU,UAVZ,KAAK,SAAS,UACR,OAAO,QAAgB;EACrB,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,MAAM,IAAI,MAAM,cAAc,KAAK;EAC5D,GAAG,WAAW,GAAG;CACrB,IACE,OAAO,QAAgB;EACrB,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,mDAAmD;EAC3F,MAAM,QAAQ,aAAa,KAAK,KAAK,MAAM;CAC/C,CAE8B;CACtC,OAAO;AACX"}
+{"version":3,"file":"backup-service-HQ9GC4tN.js","names":[],"sources":["../src/backup/pg-tools.ts","../src/backup/retention.ts","../src/backup/backup-logic.ts","../src/backup/backup-service.ts"],"sourcesContent":["/**\n * Pure helpers for the backup/restore commands.\n *\n * Everything in this file is side-effect free so it can be unit-tested\n * without a live Postgres server, matching the constraint that CI must\n * not require a database.\n */\n\nimport { forLibpq } from \"../utils/connection-string\";\n\n/**\n * A parsed backup destination. `--out` (and the scheduled-backup config)\n * accepts either a local filesystem path or an object-storage URL.\n */\nexport type BackupDestination =\n    | { kind: \"local\"; path: string }\n    | { kind: \"s3\"; bucket: string; prefix: string }\n    | { kind: \"gcs\"; bucket: string; prefix: string };\n\n/**\n * Extract the database name from a Postgres connection string.\n * Returns `null` when the URL has no database path (e.g. bare host).\n */\nexport function parseDbNameFromUrl(connectionString: string): string | null {\n    try {\n        const parsed = new URL(connectionString);\n        const name = parsed.pathname.replace(/^\\//, \"\").trim();\n        return name.length > 0 ? name : null;\n    } catch {\n        // Fall back to a permissive regex for non-URL DSNs.\n        const match = connectionString.match(/\\/([^/?]+)(\\?|$)/);\n        return match && match[1] ? match[1] : null;\n    }\n}\n\n/**\n * Swap the database name in a connection string, preserving credentials,\n * host, port and query params. Used by `--target-db` / `--create-db` so a\n * restore can target a fresh database instead of clobbering the live one.\n */\nexport function withDatabaseName(connectionString: string, dbName: string): string {\n    try {\n        const parsed = new URL(connectionString);\n        parsed.pathname = `/${dbName}`;\n        return parsed.toString();\n    } catch {\n        return connectionString.replace(/\\/([^/?]+)(\\?|$)/, `/${dbName}$2`);\n    }\n}\n\n/**\n * Parse the major version out of `pg_dump --version` / `pg_restore --version`\n * output, e.g. `\"pg_dump (PostgreSQL) 16.2\"` → `16`. Handles the pre-10\n * `9.6.x` scheme (returns `9`) and beta strings like `\"17beta1\"`.\n */\nexport function parsePgToolMajor(versionOutput: string): number | null {\n    const match = versionOutput.match(/(\\d+)(?:\\.(\\d+))?/);\n    if (!match) return null;\n    const major = Number(match[1]);\n    if (!Number.isFinite(major)) return null;\n    // Postgres 9.x used the first two numbers as the major (9.6, 9.4…).\n    if (major === 9 && match[2] !== undefined) {\n        return 9;\n    }\n    return major;\n}\n\n/**\n * Convert `SELECT current_setting('server_version_num')` (e.g. `160002`)\n * into a major version (`16`). Also accepts pre-10 encodings like `90603`\n * → `9`.\n */\nexport function serverVersionNumToMajor(versionNum: number | string): number | null {\n    const num = typeof versionNum === \"string\" ? Number(versionNum) : versionNum;\n    if (!Number.isFinite(num) || num <= 0) return null;\n    if (num < 100000) {\n        // 9.x scheme: 90603 = 9.6.3\n        return Math.floor(num / 10000);\n    }\n    return Math.floor(num / 10000);\n}\n\nexport interface VersionCompatibility {\n    compatible: boolean;\n    reason?: string;\n}\n\n/**\n * pg_dump / pg_restore must be **at least** as new as the server they talk\n * to. A newer client against an older server is supported; an older client\n * against a newer server is not and produces corrupt or rejected output.\n */\nexport function checkToolServerCompatibility(\n    toolMajor: number | null,\n    serverMajor: number | null\n): VersionCompatibility {\n    if (toolMajor === null) {\n        return { compatible: false, reason: \"Could not determine the client tool version.\" };\n    }\n    if (serverMajor === null) {\n        return { compatible: false, reason: \"Could not determine the Postgres server version.\" };\n    }\n    if (toolMajor < serverMajor) {\n        return {\n            compatible: false,\n            reason:\n                `Client tool is Postgres ${toolMajor} but the server is Postgres ${serverMajor}. ` +\n                `pg_dump/pg_restore must be the same major version as the server or newer. ` +\n                `Install Postgres ${serverMajor} client tools.`\n        };\n    }\n    return { compatible: true };\n}\n\n/**\n * Build a deterministic, sortable backup file name:\n *   `rebase-<db>-<YYYYMMDD>T<HHMMSS>Z.dump`\n *\n * The UTC timestamp is embedded so retention pruning can recover the\n * creation time from the object key alone, without extra metadata.\n */\nexport function buildBackupFilename(dbName: string, date: Date = new Date()): string {\n    const iso = date.toISOString(); // 2026-07-14T09:12:03.123Z\n    const stamp = iso.replace(/\\.\\d+Z$/, \"Z\").replace(/[-:]/g, \"\");\n    const safeDb = dbName.replace(/[^a-zA-Z0-9_-]/g, \"_\");\n    return `rebase-${safeDb}-${stamp}.dump`;\n}\n\n/**\n * Recover the creation timestamp encoded in a backup file name by\n * {@link buildBackupFilename}. Returns `null` for names that don't match,\n * so foreign objects in a shared prefix are never pruned.\n */\nexport function parseBackupTimestamp(fileName: string): Date | null {\n    const base = fileName.split(\"/\").pop() ?? fileName;\n    const match = base.match(/-(\\d{8})T(\\d{6})Z\\.dump$/);\n    if (!match) return null;\n    const [, ymd, hms] = match;\n    const iso =\n        `${ymd.slice(0, 4)}-${ymd.slice(4, 6)}-${ymd.slice(6, 8)}` +\n        `T${hms.slice(0, 2)}:${hms.slice(2, 4)}:${hms.slice(4, 6)}Z`;\n    const date = new Date(iso);\n    return Number.isNaN(date.getTime()) ? null : date;\n}\n\n/**\n * Parse a destination string into a structured {@link BackupDestination}.\n * `s3://bucket/prefix` and `gs://bucket/prefix` map to object storage;\n * anything else is treated as a local path.\n */\nexport function parseBackupDestination(out: string): BackupDestination {\n    const s3 = out.match(/^s3:\\/\\/([^/]+)\\/?(.*)$/);\n    if (s3) {\n        return { kind: \"s3\", bucket: s3[1], prefix: stripTrailingSlash(s3[2]) };\n    }\n    const gcs = out.match(/^gs:\\/\\/([^/]+)\\/?(.*)$/);\n    if (gcs) {\n        return { kind: \"gcs\", bucket: gcs[1], prefix: stripTrailingSlash(gcs[2]) };\n    }\n    return { kind: \"local\", path: out };\n}\n\nfunction stripTrailingSlash(s: string): string {\n    return s.replace(/\\/+$/, \"\");\n}\n\n/**\n * Join a storage prefix and a file name without producing a leading or\n * doubled slash.\n */\nexport function joinStorageKey(prefix: string, fileName: string): string {\n    const clean = prefix.replace(/^\\/+|\\/+$/g, \"\");\n    return clean.length > 0 ? `${clean}/${fileName}` : fileName;\n}\n\n/**\n * The identity `pg_dump` reads rows as, when row security is left on.\n *\n * Not optional, and that is the whole design. `pg_dump --enable-row-security`\n * on its own is the dangerous command in this file: it turns the \"query would\n * be affected by row-level security policy\" *error* into a dump that exits 0\n * and is silently missing every row the dumping role's policies exclude. A\n * backup that looks fine and restores most of your data is worse than one that\n * refused to run.\n *\n * So the flag is unreachable without a subject to evaluate the policies\n * against. Rebase's generated policies read `app.uid` and `app.user_roles`;\n * supplying an admin role satisfies the `admin_full_access` rule and the dump\n * sees everything that rule sees.\n */\nexport interface RowSecurityIdentity {\n    /** Written to `app.uid`. Any non-empty value — it is only an audit trail. */\n    uid: string;\n    /** Written to `app.user_roles`. Must include a role the policies admit. */\n    roles: string[];\n}\n\n/**\n * `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to\n * set a GUC.\n *\n * A backslash escape rather than quoting, which is what libpq's `-c` parsing\n * takes: a space inside a value ends the option otherwise, so a role list is\n * comma-joined and never spaced.\n */\nexport function buildRowSecurityPgOptions(identity: RowSecurityIdentity): string {\n    const escape = (value: string) => value.replace(/([\\\\ ])/g, \"\\\\$1\");\n    return [\n        `-c app.uid=${escape(identity.uid)}`,\n        `-c app.user_id=${escape(identity.uid)}`,\n        `-c app.user_roles=${escape(identity.roles.join(\",\"))}`\n    ].join(\" \");\n}\n\n/**\n * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),\n * which is compressed and restorable selectively via `pg_restore`.\n */\nexport function buildPgDumpArgs(opts: {\n    connectionString: string;\n    outFile: string;\n    /** Extra schemas/tables to exclude, e.g. Atlas revision tables. */\n    excludeSchemas?: string[];\n    /** Number of parallel jobs (directory format only; ignored for -Fc). */\n    noOwner?: boolean;\n    /**\n     * Dump with row security on, as this identity. Omit — which is the default\n     * — and `pg_dump` errors rather than skipping rows it cannot see.\n     */\n    rowSecurity?: RowSecurityIdentity;\n}): string[] {\n    const args = [\"--format=custom\", \"--no-password\", `--file=${opts.outFile}`];\n    if (opts.noOwner) {\n        args.push(\"--no-owner\");\n    }\n    if (opts.rowSecurity) {\n        args.push(\"--enable-row-security\");\n    }\n    for (const schema of opts.excludeSchemas ?? []) {\n        args.push(`--exclude-schema=${schema}`);\n    }\n    args.push(forLibpq(opts.connectionString));\n    return args;\n}\n\n/**\n * Whether a `pg_dump` failure is the row-security one, and what to do about it.\n *\n * The error text names the table and nothing else, so the first read of it is\n * \"why would a backup be affected by RLS at all?\" — the answer being that the\n * dumping role is not the tables' owner and has no `BYPASSRLS`, which is the\n * normal state of the `postgres` user on Cloud SQL, RDS and every other managed\n * Postgres. Nothing about that is visible from the message.\n *\n * Returns `null` for any other failure, so the caller reports it unchanged.\n */\nexport function diagnoseRowSecurityDumpFailure(error: unknown): string | null {\n    const text = [\n        (error as { stderr?: unknown })?.stderr,\n        (error as { message?: unknown })?.message\n    ].map(part => (typeof part === \"string\" ? part : \"\")).join(\"\\n\");\n\n    if (!/row-level security policy/i.test(text)) return null;\n\n    const table = text.match(/for table \"([^\"]+)\"/)?.[1];\n\n    return [\n        `pg_dump cannot read ${table ? `\"${table}\"` : \"one of the tables\"} because row-level security applies to it.`,\n        \"\",\n        \"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal\",\n        \"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is\",\n        \"  no superuser to hand out.\",\n        \"\",\n        \"  Two ways out:\",\n        \"\",\n        \"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The\",\n        \"      dump then contains every row, which is what a backup should mean.\",\n        \"\",\n        \"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase\",\n        \"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy\",\n        \"      admits the dump. Read the warning it prints: the result contains exactly the\",\n        \"      rows those policies admit, and any table whose policies do not include an\",\n        \"      admin rule comes out short — with no error.\",\n        \"\",\n        \"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the\",\n        \"  settings above it succeeds and silently omits rows.\"\n    ].join(\"\\n\");\n}\n\n/**\n * Assemble the `pg_restore` argument vector for a custom-format dump.\n */\nexport function buildPgRestoreArgs(opts: {\n    connectionString: string;\n    inputFile: string;\n    /** Drop objects before recreating them (destructive but idempotent). */\n    clean?: boolean;\n    /**\n     * Abort on the first error instead of logging and continuing. Defaults\n     * ON: a restore that silently skips failed GRANT/RLS statements (because\n     * a role is missing) \"succeeds\" with RLS un-enforced — a security hole.\n     * Fail loudly instead so the operator knows the restore is incomplete.\n     */\n    exitOnError?: boolean;\n    noOwner?: boolean;\n}): string[] {\n    const args = [\"--format=custom\", \"--no-password\", `--dbname=${forLibpq(opts.connectionString)}`];\n    if (opts.clean) {\n        args.push(\"--clean\", \"--if-exists\");\n    }\n    if (opts.noOwner) {\n        args.push(\"--no-owner\");\n    }\n    // Default to --exit-on-error unless explicitly disabled.\n    if (opts.exitOnError !== false) {\n        args.push(\"--exit-on-error\");\n    }\n    args.push(opts.inputFile);\n    return args;\n}\n\n/**\n * Assemble the `pg_restore --list` argument vector. Reading a dump's table\n * of contents parses the whole archive without touching a database, so it is\n * a cheap integrity check that the file isn't truncated or corrupt.\n */\nexport function buildPgRestoreListArgs(inputFile: string): string[] {\n    return [\"--list\", inputFile];\n}\n\n/**\n * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other\n * cluster-wide objects) live outside any single database, so a per-database\n * `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT\n * statements in the main dump fail on restore and RLS is silently lost — so\n * every backup captures the globals into a sidecar `.globals.sql`.\n *\n * `--no-role-passwords` keeps role secrets out of the artifact (backups may\n * be shipped off-box); roles are recreated password-less and re-secured by\n * the operator.\n */\nexport function buildPgDumpallGlobalsArgs(opts: {\n    connectionString: string;\n    outFile: string;\n}): string[] {\n    return [\n        \"--globals-only\",\n        \"--no-role-passwords\",\n        \"--no-password\",\n        `--file=${opts.outFile}`,\n        `--dbname=${forLibpq(opts.connectionString)}`\n    ];\n}\n\n/**\n * Derive the globals sidecar path/key for a given `.dump` file. Keeps the\n * two artifacts adjacent so listing, uploading and pruning can find one from\n * the other. A name that doesn't end in `.dump` is returned unchanged with a\n * `.globals.sql` suffix appended.\n */\nexport function globalsFileForDump(dumpPath: string): string {\n    return dumpPath.endsWith(\".dump\")\n        ? dumpPath.slice(0, -\".dump\".length) + \".globals.sql\"\n        : dumpPath + \".globals.sql\";\n}\n\n/**\n * Split a `pg_dumpall --globals-only` script into individual statements.\n * Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`\n * can run independently and a benign \"role already exists\" on one doesn't\n * abort the rest. Drops `--` comment lines and blank statements.\n */\nexport function splitGlobalsStatements(sql: string): string[] {\n    const withoutComments = sql\n        .split(\"\\n\")\n        // `--` comments, and psql meta-commands. pg_dumpall 15+ wraps its output\n        // in `\\restrict <token>` / `\\unrestrict <token>`, which are instructions\n        // to psql, not SQL. This replay sends statements over a connection\n        // instead, so they arrived at the server as `\\restrict …` and came back\n        // as `syntax error at or near \"\\\"` — reported to the user as two skipped\n        // globals per restore, which reads like roles failed to apply when\n        // nothing did. They carry no state worth replaying: dropping them is\n        // exactly what a SQL-level consumer should do.\n        .filter((line) => {\n            const trimmed = line.trim();\n            return !trimmed.startsWith(\"--\") && !trimmed.startsWith(\"\\\\\");\n        })\n        .join(\"\\n\");\n    return withoutComments\n        .split(\";\")\n        .map((s) => s.trim())\n        .filter((s) => s.length > 0);\n}\n\n/**\n * Resolve the Postgres connection string the backup commands should use,\n * mirroring the precedence the branch command already relies on.\n */\nexport function resolveConnectionString(\n    env: Record<string, string | undefined>\n): string | null {\n    return env.DATABASE_URL || env.ADMIN_CONNECTION_STRING || null;\n}\n","/**\n * Retention pruning for scheduled backups. Pure logic — no I/O — so it can\n * be exhaustively unit-tested without touching a storage backend.\n */\nimport { parseBackupTimestamp } from \"./pg-tools\";\n\nexport interface BackupObject {\n    /** Storage key / file name. */\n    key: string;\n    /**\n     * Creation time. Optional — when absent it is recovered from the\n     * timestamp encoded in the key by `buildBackupFilename`.\n     */\n    createdAt?: Date;\n    /**\n     * Size on disk, when the lister knows it (local destinations always do).\n     *\n     * Reported so an empty artifact cannot masquerade as a backup in\n     * `rebase db backups list`. Deliberately NOT consulted by\n     * {@link selectBackupsToPrune}: retention decides by age, and a rule that\n     * silently skipped small files would make a genuinely tiny dump immortal.\n     * Visibility is the fix here; the artifacts themselves are now removed at\n     * the point of failure by `discardPartialDump`.\n     */\n    sizeBytes?: number;\n}\n\nexport interface RetentionOptions {\n    /** Delete backups older than this many days. `0`/negative disables age pruning. */\n    retentionDays?: number;\n    /**\n     * Always keep at least this many of the most recent backups, even if\n     * they are older than `retentionDays`. Guards against wiping every\n     * backup after a long outage. Default: 0 (no minimum).\n     */\n    keepMinimum?: number;\n    /** Reference \"now\" — injectable for deterministic tests. */\n    now?: Date;\n}\n\n/**\n * Decide which backups to delete under the given retention policy.\n *\n * Rules, applied in order:\n *  1. Objects whose key isn't a recognised rebase backup (no parseable\n *     timestamp and no `createdAt`) are never selected — foreign files in a\n *     shared bucket are left untouched.\n *  2. The `keepMinimum` newest backups are always retained.\n *  3. Of the remainder, any older than `retentionDays` are selected for\n *     deletion.\n *\n * Returns the keys to delete, oldest first.\n */\nexport function selectBackupsToPrune(\n    backups: BackupObject[],\n    options: RetentionOptions\n): string[] {\n    const retentionDays = options.retentionDays ?? 0;\n    const keepMinimum = Math.max(0, options.keepMinimum ?? 0);\n    const now = options.now ?? new Date();\n\n    if (retentionDays <= 0) {\n        return [];\n    }\n\n    // Resolve a timestamp for every object; drop the ones we can't date.\n    const dated = backups\n        .map((b) => {\n            const createdAt = b.createdAt ?? parseBackupTimestamp(b.key);\n            return createdAt ? { key: b.key, createdAt } : null;\n        })\n        .filter((b): b is { key: string; createdAt: Date } => b !== null);\n\n    // Newest first so the first `keepMinimum` are the protected ones.\n    dated.sort((a, b) => b.createdAt.getTime() - a.createdAt.getTime());\n\n    const cutoff = now.getTime() - retentionDays * 24 * 60 * 60 * 1000;\n\n    const toDelete = dated\n        .slice(keepMinimum)\n        .filter((b) => b.createdAt.getTime() < cutoff);\n\n    // Return oldest first for predictable, readable logs.\n    toDelete.sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());\n    return toDelete.map((b) => b.key);\n}\n","/**\n * Pure-ish orchestration for the backup/restore paths, kept free of `execa`\n * and `pg` value imports so it can be unit-tested under jest (the impure\n * edges — spawning processes, opening connections — live in\n * `backup-service.ts`, which is vitest/runtime only).\n *\n * The functions here take their side-effecting dependency as an argument\n * (a statement runner, an object deleter) so tests can inject fakes.\n */\nimport { globalsFileForDump, splitGlobalsStatements } from \"./pg-tools\";\n\n/**\n * Replay a `pg_dumpall --globals-only` script one statement at a time,\n * tolerating per-statement failures. On a same-cluster restore the roles\n * usually already exist (`CREATE ROLE` → \"already exists\") and on a managed\n * provider an `ALTER ROLE <superuser>` may be refused; neither should abort\n * recreation of the roles that *are* missing. Returns how many statements\n * applied vs were skipped.\n *\n * `runStatement` executes one SQL statement and rejects on error.\n */\nexport async function applyGlobalsWith(\n    runStatement: (sql: string) => Promise<void>,\n    globalsSql: string,\n    log: (message: string) => void = () => {}\n): Promise<{ applied: number; skipped: number }> {\n    let applied = 0;\n    let skipped = 0;\n    for (const statement of splitGlobalsStatements(globalsSql)) {\n        try {\n            await runStatement(statement);\n            applied++;\n        } catch (err) {\n            skipped++;\n            const firstLine = statement.split(\"\\n\")[0].slice(0, 80);\n            log(`  • Skipped global: ${firstLine} (${err instanceof Error ? err.message : String(err)})`);\n        }\n    }\n    return { applied, skipped };\n}\n\n/**\n * Delete each pruned dump together with its `.globals.sql` roles sidecar, so\n * pruning never orphans the roles file. The sidecar is best-effort — older\n * backups predate it, so a missing-sidecar failure is swallowed while a\n * failure deleting the dump itself propagates.\n *\n * `deleteObject` removes one key and rejects if it cannot (e.g. not found).\n */\nexport async function pruneWith(\n    keys: string[],\n    deleteObject: (key: string) => Promise<void>\n): Promise<void> {\n    for (const key of keys) {\n        await deleteObject(key);\n        try {\n            await deleteObject(globalsFileForDump(key));\n        } catch {\n            // Sidecar may not exist for older backups — ignore.\n        }\n    }\n}\n\n/**\n * Remove a dump artifact abandoned by a failed tool run.\n *\n * `pg_dump` creates its `--file=` target before it finishes connecting, so any\n * failure — a URL libpq rejects, a dropped connection, a full disk — leaves a\n * 0-byte file behind. That corpse is not inert: `rebase db backups list` used\n * to show it as an ordinary entry, and `selectBackupsToPrune` ranks by\n * timestamp alone, so it occupies a protected `keepMinimum` slot and can push\n * a real backup out of retention.\n *\n * Best-effort on purpose: the caller is already throwing, and a failed unlink\n * must not replace the real diagnosis with an ENOENT/EPERM from the cleanup.\n *\n * Lives here rather than in `backup-service.ts` for the reason at the top of\n * this file — that module's top-level `execa` import makes it unloadable under\n * jest, so anything placed there cannot be unit-tested.\n *\n * `remove` deletes one file and throws if it cannot; `exists` reports presence.\n */\nexport function discardPartialDumpWith(\n    exists: (file: string) => boolean,\n    remove: (file: string) => void,\n    file: string\n): void {\n    try {\n        if (exists(file)) remove(file);\n    } catch {\n        // Ignored: see above.\n    }\n}\n","/**\n * Backup / restore orchestration: thin, well-typed wrappers around\n * `pg_dump` and `pg_restore`, plus binary detection, version pre-flight,\n * and upload/prune against a storage backend.\n *\n * The pure argument- and policy-logic lives in `pg-tools.ts` and\n * `retention.ts`; this module is the impure edge (spawns processes, talks\n * to Postgres and storage) and is intentionally kept small.\n */\nimport fs from \"fs\";\nimport os from \"os\";\nimport path from \"path\";\nimport { execa } from \"execa\";\nimport type { StorageController } from \"@rebasepro/server\";\nimport { resolveLocalBin } from \"../cli-helpers\";\nimport {\n    BackupDestination,\n    buildBackupFilename,\n    buildPgDumpArgs,\n    buildPgDumpallGlobalsArgs,\n    buildRowSecurityPgOptions,\n    diagnoseRowSecurityDumpFailure,\n    type RowSecurityIdentity,\n    buildPgRestoreArgs,\n    buildPgRestoreListArgs,\n    checkToolServerCompatibility,\n    globalsFileForDump,\n    joinStorageKey,\n    parsePgToolMajor,\n    parseBackupTimestamp,\n    serverVersionNumToMajor,\n    VersionCompatibility\n} from \"./pg-tools\";\nimport { BackupObject, RetentionOptions, selectBackupsToPrune } from \"./retention\";\nimport { applyGlobalsWith, discardPartialDumpWith, pruneWith } from \"./backup-logic\";\n\n/**\n * Remove a dump artifact abandoned by a failed tool run. See\n * {@link discardPartialDumpWith} for why this exists and why the logic lives\n * in the execa-free module.\n */\nexport function discardPartialDump(file: string): void {\n    discardPartialDumpWith(\n        (f) => fs.existsSync(f),\n        (f) => fs.unlinkSync(f),\n        file\n    );\n}\n\nexport class BackupToolError extends Error {\n    constructor(message: string, readonly hint?: string) {\n        super(message);\n        this.name = \"BackupToolError\";\n    }\n}\n\n/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */\nexport function resolvePgBinary(\n    tool: \"pg_dump\" | \"pg_restore\" | \"pg_dumpall\",\n    env: Record<string, string | undefined> = process.env\n): string | null {\n    const overrideVar =\n        tool === \"pg_dump\" ? env.PG_DUMP_PATH\n        : tool === \"pg_restore\" ? env.PG_RESTORE_PATH\n        : env.PG_DUMPALL_PATH;\n    if (overrideVar && fs.existsSync(overrideVar)) return overrideVar;\n    return resolveLocalBin(tool);\n}\n\n/** Run `<bin> --version` and extract the major version. */\nexport async function detectToolMajor(bin: string): Promise<number | null> {\n    try {\n        const { stdout } = await execa(bin, [\"--version\"]);\n        return parsePgToolMajor(stdout);\n    } catch {\n        return null;\n    }\n}\n\n/** Query the server for its major version via `server_version_num`. */\nexport async function getServerVersionMajor(connectionString: string): Promise<number | null> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString });\n    await client.connect();\n    try {\n        const res = await client.query(\"SHOW server_version_num\");\n        const raw = res.rows?.[0]?.server_version_num;\n        return serverVersionNumToMajor(raw);\n    } finally {\n        await client.end();\n    }\n}\n\nexport interface PreflightResult extends VersionCompatibility {\n    bin: string;\n    toolMajor: number | null;\n    serverMajor: number | null;\n}\n\n/**\n * Verify the requested client tool exists and its major version is\n * compatible with the live server. Throws {@link BackupToolError} — with a\n * doctor-style hint — when the binary is missing.\n */\nexport async function preflight(\n    tool: \"pg_dump\" | \"pg_restore\",\n    connectionString: string,\n    env: Record<string, string | undefined> = process.env\n): Promise<PreflightResult> {\n    const bin = resolvePgBinary(tool, env);\n    if (!bin) {\n        throw new BackupToolError(\n            `Could not find the '${tool}' binary.`,\n            `Install the PostgreSQL client tools (e.g. 'brew install libpq' or 'apt-get install postgresql-client'), ` +\n            `or set ${tool === \"pg_dump\" ? \"PG_DUMP_PATH\" : \"PG_RESTORE_PATH\"} to its full path.`\n        );\n    }\n    const [toolMajor, serverMajor] = await Promise.all([\n        detectToolMajor(bin),\n        getServerVersionMajor(connectionString)\n    ]);\n    const compat = checkToolServerCompatibility(toolMajor, serverMajor);\n    return { bin, toolMajor, serverMajor, ...compat };\n}\n\nexport interface BackupResult {\n    /** Absolute path of the produced dump file on local disk. */\n    localFile: string;\n    fileName: string;\n    sizeBytes: number;\n    /**\n     * Absolute path of the `.globals.sql` sidecar holding cluster-wide roles\n     * (present unless globals capture was disabled or unavailable).\n     */\n    globalsFile?: string;\n    globalsSizeBytes?: number;\n}\n\n/**\n * Produce a custom-format dump on local disk. When `outDir` is omitted the\n * file is written to the OS temp directory (used by the upload path, which\n * cleans it up afterwards).\n *\n * Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via\n * `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements\n * depend on can be recreated on restore. Set `includeGlobals: false` to skip\n * it (e.g. when the caller has no privilege to read cluster globals).\n */\nexport async function createDump(opts: {\n    connectionString: string;\n    dbName: string;\n    outDir?: string;\n    fileName?: string;\n    excludeSchemas?: string[];\n    noOwner?: boolean;\n    inheritStdio?: boolean;\n    includeGlobals?: boolean;\n    env?: Record<string, string | undefined>;\n    /**\n     * Dump with row security left on, reading as this identity.\n     *\n     * The escape hatch for a managed Postgres, where the dumping role owns\n     * nothing and has no `BYPASSRLS`. Off by default, and deliberately so: with\n     * row security on, `pg_dump` stops erroring on rows it cannot see and\n     * simply omits them. See {@link RowSecurityIdentity}.\n     */\n    rowSecurity?: RowSecurityIdentity;\n}): Promise<BackupResult> {\n    const env = opts.env ?? process.env;\n    const bin = resolvePgBinary(\"pg_dump\", env);\n    if (!bin) {\n        throw new BackupToolError(\n            \"Could not find the 'pg_dump' binary.\",\n            \"Install the PostgreSQL client tools or set PG_DUMP_PATH.\"\n        );\n    }\n\n    const fileName = opts.fileName ?? buildBackupFilename(opts.dbName);\n    const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), \"rebase-backup-\"));\n    fs.mkdirSync(outDir, { recursive: true });\n    const localFile = path.join(outDir, fileName);\n\n    const args = buildPgDumpArgs({\n        connectionString: opts.connectionString,\n        outFile: localFile,\n        excludeSchemas: opts.excludeSchemas,\n        noOwner: opts.noOwner,\n        rowSecurity: opts.rowSecurity\n    });\n\n    // `PGOPTIONS` is the only way to set a GUC on a tool that takes no SQL.\n    // Built from the same object that added `--enable-row-security`, so the\n    // flag cannot travel without the identity that makes it safe.\n    const dumpEnv: Record<string, string> = { ...(env as Record<string, string>) };\n    if (opts.rowSecurity) {\n        dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)]\n            .filter(Boolean).join(\" \");\n    }\n\n    try {\n        await execa(bin, args, {\n            stdio: opts.inheritStdio ? \"inherit\" : \"pipe\",\n            env: dumpEnv\n        });\n    } catch (error) {\n        // pg_dump creates its `--file=` target before it finishes connecting,\n        // so any failure here — a URL libpq rejects, a dropped connection, a\n        // full disk — leaves a 0-byte file behind that nothing else removed.\n        // That corpse is not inert: `rebase db backups list` shows it as an\n        // ordinary entry, and `selectBackupsToPrune` ranks by timestamp alone,\n        // so it occupies a protected `keepMinimum` slot and can push a real\n        // backup out of retention. A missing backup is honest; an empty file\n        // that reads as a backup is not.\n        discardPartialDump(localFile);\n        // The RLS failure names a table and no cause. Replace it with the\n        // cause and the two ways out; anything else is re-thrown untouched.\n        const diagnosis = diagnoseRowSecurityDumpFailure(error);\n        if (!diagnosis) throw error;\n        throw new BackupToolError(\n            diagnosis,\n            \"Run `rebase db backup --help` for the flag, and read what it says about partial dumps.\"\n        );\n    }\n\n    const sizeBytes = fs.existsSync(localFile) ? fs.statSync(localFile).size : 0;\n\n    const result: BackupResult = { localFile, fileName, sizeBytes };\n\n    if (opts.includeGlobals !== false) {\n        const dumpallBin = resolvePgBinary(\"pg_dumpall\", env);\n        if (!dumpallBin) {\n            throw new BackupToolError(\n                \"Could not find the 'pg_dumpall' binary needed to capture cluster roles.\",\n                \"Install the PostgreSQL client tools or set PG_DUMPALL_PATH. \" +\n                \"To take a role-incomplete backup anyway, pass includeGlobals: false.\"\n            );\n        }\n        const globalsFile = globalsFileForDump(localFile);\n        try {\n            await execa(\n                dumpallBin,\n                buildPgDumpallGlobalsArgs({ connectionString: opts.connectionString, outFile: globalsFile }),\n                { stdio: opts.inheritStdio ? \"inherit\" : \"pipe\", env: { ...(env as Record<string, string>) } }\n            );\n        } catch (error) {\n            // Same reasoning as the pg_dump catch above, and the dump goes with\n            // it: the pair is uploaded and pruned together, so a dump whose\n            // roles sidecar is missing restores without the roles its GRANT and\n            // RLS statements need — the exact failure the sidecar exists to\n            // prevent. Leaving half a pair on disk would look like a backup.\n            discardPartialDump(globalsFile);\n            discardPartialDump(localFile);\n            throw error;\n        }\n        result.globalsFile = globalsFile;\n        result.globalsSizeBytes = fs.existsSync(globalsFile) ? fs.statSync(globalsFile).size : 0;\n    }\n\n    return result;\n}\n\n/**\n * Cheap integrity check on a freshly written dump: it must be non-empty and\n * `pg_restore --list` must parse its table of contents without error. Used\n * before pruning older backups so a corrupt-but-exit-0 dump never becomes\n * the reason the last good backup is deleted.\n */\nexport async function validateDump(\n    localFile: string,\n    env: Record<string, string | undefined> = process.env\n): Promise<{ ok: boolean; reason?: string }> {\n    if (!fs.existsSync(localFile)) {\n        return { ok: false, reason: `Dump file does not exist: ${localFile}` };\n    }\n    if (fs.statSync(localFile).size === 0) {\n        return { ok: false, reason: \"Dump file is empty (0 bytes).\" };\n    }\n    const bin = resolvePgBinary(\"pg_restore\", env);\n    if (!bin) {\n        // Can't verify without pg_restore; treat as inconclusive-but-fail so\n        // pruning doesn't proceed on an unverified dump.\n        return { ok: false, reason: \"Could not find 'pg_restore' to verify the dump.\" };\n    }\n    try {\n        await execa(bin, buildPgRestoreListArgs(localFile), {\n            stdio: \"pipe\",\n            env: { ...(env as Record<string, string>) }\n        });\n        return { ok: true };\n    } catch (err) {\n        return { ok: false, reason: `pg_restore --list failed: ${err instanceof Error ? err.message : String(err)}` };\n    }\n}\n\n/**\n * Replay a `pg_dumpall --globals-only` script to recreate cluster roles\n * before a restore, so the dump's GRANT/RLS statements (which reference\n * `rebase_user` and any owner roles) actually apply. Runs statement by\n * statement and tolerates per-statement failures — on a same-cluster restore\n * the roles usually already exist (`CREATE ROLE` → \"already exists\"), and on\n * a managed provider an `ALTER ROLE <superuser>` may be refused; neither\n * should abort role recreation. Returns how many statements applied vs were\n * skipped.\n */\nexport async function applyGlobals(\n    connectionString: string,\n    globalsSql: string,\n    log: (message: string) => void = () => {}\n): Promise<{ applied: number; skipped: number }> {\n    const { Client } = await import(\"pg\");\n    const client = new Client({ connectionString });\n    await client.connect();\n    try {\n        return await applyGlobalsWith(\n            async (sql) => { await client.query(sql); },\n            globalsSql,\n            log\n        );\n    } finally {\n        await client.end();\n    }\n}\n\n/**\n * Restore a custom-format dump into the database named by\n * `connectionString`. Destructive when `clean` is set (drops objects\n * first). Never called automatically — the CLI gates it behind explicit\n * confirmation.\n *\n * Runs with `--exit-on-error` by default: a restore that logs-and-continues\n * past a failed GRANT (because a role was missing) reports success with RLS\n * un-enforced. Callers should recreate roles first (see {@link applyGlobals})\n * and only set `exitOnError: false` deliberately.\n */\nexport async function restoreDump(opts: {\n    connectionString: string;\n    inputFile: string;\n    clean?: boolean;\n    noOwner?: boolean;\n    exitOnError?: boolean;\n    inheritStdio?: boolean;\n    env?: Record<string, string | undefined>;\n}): Promise<void> {\n    const env = opts.env ?? process.env;\n    const bin = resolvePgBinary(\"pg_restore\", env);\n    if (!bin) {\n        throw new BackupToolError(\n            \"Could not find the 'pg_restore' binary.\",\n            \"Install the PostgreSQL client tools or set PG_RESTORE_PATH.\"\n        );\n    }\n    const args = buildPgRestoreArgs({\n        connectionString: opts.connectionString,\n        inputFile: opts.inputFile,\n        clean: opts.clean,\n        noOwner: opts.noOwner,\n        exitOnError: opts.exitOnError\n    });\n    await execa(bin, args, {\n        stdio: opts.inheritStdio ? \"inherit\" : \"pipe\",\n        env: { ...(env as Record<string, string>) }\n    });\n}\n\n/**\n * Create a database (if absent) by connecting to the maintenance\n * `postgres` database. Used by `restore --create-db`.\n */\nexport async function ensureDatabaseExists(\n    adminConnectionString: string,\n    dbName: string\n): Promise<boolean> {\n    const { Client } = await import(\"pg\");\n    const parsed = new URL(adminConnectionString);\n    parsed.pathname = \"/postgres\";\n    const client = new Client({ connectionString: parsed.toString() });\n    await client.connect();\n    try {\n        const existing = await client.query(\"SELECT 1 FROM pg_database WHERE datname = $1\", [dbName]);\n        if (existing.rowCount && existing.rowCount > 0) {\n            return false;\n        }\n        // Identifier can't be parameterised; guard against injection.\n        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(dbName)) {\n            throw new BackupToolError(`Invalid database name: \"${dbName}\"`);\n        }\n        await client.query(`CREATE DATABASE \"${dbName}\"`);\n        return true;\n    } finally {\n        await client.end();\n    }\n}\n\n/**\n * Upload a local dump to object storage under the destination's prefix.\n * Backups may contain secrets/PII, so the object is written with a\n * private/octet-stream content type; bucket-level ACLs must stay private.\n */\nexport async function uploadBackup(\n    storage: StorageController,\n    localFile: string,\n    dest: Extract<BackupDestination, { kind: \"s3\" | \"gcs\" }>\n): Promise<{ key: string; storageUrl: string }> {\n    const fileName = path.basename(localFile);\n    const key = joinStorageKey(dest.prefix, fileName);\n    const buffer = fs.readFileSync(localFile);\n    const file = new File([buffer], fileName, { type: \"application/octet-stream\" });\n    const result = await storage.putObject({\n        file,\n        key,\n        bucket: dest.bucket,\n        metadata: { \"rebase-backup\": \"1\" }\n    });\n    return { key, storageUrl: result.storageUrl };\n}\n\n/**\n * List existing backups at a destination. For local destinations reads the\n * directory; for object storage lists the prefix via the controller.\n */\nexport async function listBackups(\n    dest: BackupDestination,\n    storage?: StorageController\n): Promise<BackupObject[]> {\n    if (dest.kind === \"local\") {\n        if (!fs.existsSync(dest.path)) return [];\n        const stat = fs.statSync(dest.path);\n        const dir = stat.isDirectory() ? dest.path : path.dirname(dest.path);\n        return fs\n            .readdirSync(dir)\n            .filter((f) => f.endsWith(\".dump\"))\n            .map((f) => {\n                const full = path.join(dir, f);\n                const stats = fs.statSync(full);\n                const createdAt = parseBackupTimestamp(f) ?? stats.mtime;\n                return { key: full, createdAt, sizeBytes: stats.size };\n            })\n            .sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));\n    }\n\n    if (!storage) {\n        throw new BackupToolError(\n            `Listing ${dest.kind} backups requires a configured storage backend.`\n        );\n    }\n    const result = await storage.listObjects(dest.prefix ? `${dest.prefix}/` : \"\", {\n        bucket: dest.bucket,\n        maxResults: 1000\n    });\n    return result.items\n        .map((item) => item.fullPath)\n        .filter((key) => key.endsWith(\".dump\"))\n        .map((key) => ({ key, createdAt: parseBackupTimestamp(key) ?? undefined }))\n        .sort((a, b) => (b.createdAt?.getTime() ?? 0) - (a.createdAt?.getTime() ?? 0));\n}\n\n/**\n * Apply a retention policy to a destination, deleting the backups selected\n * by {@link selectBackupsToPrune}. Returns the keys that were removed.\n */\nexport async function pruneBackups(\n    dest: BackupDestination,\n    options: RetentionOptions,\n    storage?: StorageController\n): Promise<string[]> {\n    const backups = await listBackups(dest, storage);\n    const toDelete = selectBackupsToPrune(backups, options);\n\n    // Delete each dump together with its `.globals.sql` sidecar (pruneWith\n    // handles the pairing + best-effort sidecar). The deleter rejects on a\n    // missing key so pruneWith can swallow an absent sidecar.\n    const deleteObject =\n        dest.kind === \"local\"\n            ? async (key: string) => {\n                if (!fs.existsSync(key)) throw new Error(`not found: ${key}`);\n                fs.unlinkSync(key);\n            }\n            : async (key: string) => {\n                if (!storage) throw new BackupToolError(\"Storage backend required to prune object backups.\");\n                await storage.deleteObject(key, dest.bucket);\n            };\n\n    await pruneWith(toDelete, deleteObject);\n    return toDelete;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAuBA,SAAgB,mBAAmB,kBAAyC;CACxE,IAAI;EAEA,MAAM,OAAO,IADM,IAAI,gBACV,CAAA,CAAO,SAAS,QAAQ,OAAO,EAAE,CAAC,CAAC,KAAK;EACrD,OAAO,KAAK,SAAS,IAAI,OAAO;CACpC,QAAQ;EAEJ,MAAM,QAAQ,iBAAiB,MAAM,kBAAkB;EACvD,OAAO,SAAS,MAAM,KAAK,MAAM,KAAK;CAC1C;AACJ;;;;;;AAOA,SAAgB,iBAAiB,kBAA0B,QAAwB;CAC/E,IAAI;EACA,MAAM,SAAS,IAAI,IAAI,gBAAgB;EACvC,OAAO,WAAW,IAAI;EACtB,OAAO,OAAO,SAAS;CAC3B,QAAQ;EACJ,OAAO,iBAAiB,QAAQ,oBAAoB,IAAI,OAAO,GAAG;CACtE;AACJ;;;;;;AAOA,SAAgB,iBAAiB,eAAsC;CACnE,MAAM,QAAQ,cAAc,MAAM,mBAAmB;CACrD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,QAAQ,OAAO,MAAM,EAAE;CAC7B,IAAI,CAAC,OAAO,SAAS,KAAK,GAAG,OAAO;CAEpC,IAAI,UAAU,KAAK,MAAM,OAAO,KAAA,GAC5B,OAAO;CAEX,OAAO;AACX;;;;;;AAOA,SAAgB,wBAAwB,YAA4C;CAChF,MAAM,MAAM,OAAO,eAAe,WAAW,OAAO,UAAU,IAAI;CAClE,IAAI,CAAC,OAAO,SAAS,GAAG,KAAK,OAAO,GAAG,OAAO;CAC9C,IAAI,MAAM,KAEN,OAAO,KAAK,MAAM,MAAM,GAAK;CAEjC,OAAO,KAAK,MAAM,MAAM,GAAK;AACjC;;;;;;AAYA,SAAgB,6BACZ,WACA,aACoB;CACpB,IAAI,cAAc,MACd,OAAO;EAAE,YAAY;EAAO,QAAQ;CAA+C;CAEvF,IAAI,gBAAgB,MAChB,OAAO;EAAE,YAAY;EAAO,QAAQ;CAAmD;CAE3F,IAAI,YAAY,aACZ,OAAO;EACH,YAAY;EACZ,QACI,2BAA2B,UAAU,8BAA8B,YAAY,+FAE3D,YAAY;CACxC;CAEJ,OAAO,EAAE,YAAY,KAAK;AAC9B;;;;;;;;AASA,SAAgB,oBAAoB,QAAgB,uBAAa,IAAI,KAAK,GAAW;CAEjF,MAAM,QADM,KAAK,YACH,CAAA,CAAI,QAAQ,WAAW,GAAG,CAAC,CAAC,QAAQ,SAAS,EAAE;CAE7D,OAAO,UADQ,OAAO,QAAQ,mBAAmB,GAChC,EAAO,GAAG,MAAM;AACrC;;;;;;AAOA,SAAgB,qBAAqB,UAA+B;CAEhE,MAAM,SADO,SAAS,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,SAAA,CACvB,MAAM,0BAA0B;CACnD,IAAI,CAAC,OAAO,OAAO;CACnB,MAAM,GAAG,KAAK,OAAO;CACrB,MAAM,MACF,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAA,GACnD,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE;CAC9D,MAAM,OAAO,IAAI,KAAK,GAAG;CACzB,OAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AACjD;;;;;;AAOA,SAAgB,uBAAuB,KAAgC;CACnE,MAAM,KAAK,IAAI,MAAM,yBAAyB;CAC9C,IAAI,IACA,OAAO;EAAE,MAAM;EAAM,QAAQ,GAAG;EAAI,QAAQ,mBAAmB,GAAG,EAAE;CAAE;CAE1E,MAAM,MAAM,IAAI,MAAM,yBAAyB;CAC/C,IAAI,KACA,OAAO;EAAE,MAAM;EAAO,QAAQ,IAAI;EAAI,QAAQ,mBAAmB,IAAI,EAAE;CAAE;CAE7E,OAAO;EAAE,MAAM;EAAS,MAAM;CAAI;AACtC;AAEA,SAAS,mBAAmB,GAAmB;CAC3C,OAAO,EAAE,QAAQ,QAAQ,EAAE;AAC/B;;;;;AAMA,SAAgB,eAAe,QAAgB,UAA0B;CACrE,MAAM,QAAQ,OAAO,QAAQ,cAAc,EAAE;CAC7C,OAAO,MAAM,SAAS,IAAI,GAAG,MAAM,GAAG,aAAa;AACvD;;;;;;;;;AAgCA,SAAgB,0BAA0B,UAAuC;CAC7E,MAAM,UAAU,UAAkB,MAAM,QAAQ,YAAY,MAAM;CAClE,OAAO;EACH,cAAc,OAAO,SAAS,GAAG;EACjC,kBAAkB,OAAO,SAAS,GAAG;EACrC,qBAAqB,OAAO,SAAS,MAAM,KAAK,GAAG,CAAC;CACxD,CAAC,CAAC,KAAK,GAAG;AACd;;;;;AAMA,SAAgB,gBAAgB,MAYnB;CACT,MAAM,OAAO;EAAC;EAAmB;EAAiB,UAAU,KAAK;CAAS;CAC1E,IAAI,KAAK,SACL,KAAK,KAAK,YAAY;CAE1B,IAAI,KAAK,aACL,KAAK,KAAK,uBAAuB;CAErC,KAAK,MAAM,UAAU,KAAK,kBAAkB,CAAC,GACzC,KAAK,KAAK,oBAAoB,QAAQ;CAE1C,KAAK,KAAK,SAAS,KAAK,gBAAgB,CAAC;CACzC,OAAO;AACX;;;;;;;;;;;;AAaA,SAAgB,+BAA+B,OAA+B;CAC1E,MAAM,OAAO,CACR,OAAgC,QAChC,OAAiC,OACtC,CAAC,CAAC,KAAI,SAAS,OAAO,SAAS,WAAW,OAAO,EAAG,CAAC,CAAC,KAAK,IAAI;CAE/D,IAAI,CAAC,6BAA6B,KAAK,IAAI,GAAG,OAAO;CAErD,MAAM,QAAQ,KAAK,MAAM,qBAAqB,CAAC,GAAG;CAElD,OAAO;EACH,uBAAuB,QAAQ,IAAI,MAAM,KAAK,oBAAoB;EAClE;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;CACJ,CAAC,CAAC,KAAK,IAAI;AACf;;;;AAKA,SAAgB,mBAAmB,MAatB;CACT,MAAM,OAAO;EAAC;EAAmB;EAAiB,YAAY,SAAS,KAAK,gBAAgB;CAAG;CAC/F,IAAI,KAAK,OACL,KAAK,KAAK,WAAW,aAAa;CAEtC,IAAI,KAAK,SACL,KAAK,KAAK,YAAY;CAG1B,IAAI,KAAK,gBAAgB,OACrB,KAAK,KAAK,iBAAiB;CAE/B,KAAK,KAAK,KAAK,SAAS;CACxB,OAAO;AACX;;;;;;AAOA,SAAgB,uBAAuB,WAA6B;CAChE,OAAO,CAAC,UAAU,SAAS;AAC/B;;;;;;;;;;;;AAaA,SAAgB,0BAA0B,MAG7B;CACT,OAAO;EACH;EACA;EACA;EACA,UAAU,KAAK;EACf,YAAY,SAAS,KAAK,gBAAgB;CAC9C;AACJ;;;;;;;AAQA,SAAgB,mBAAmB,UAA0B;CACzD,OAAO,SAAS,SAAS,OAAO,IAC1B,SAAS,MAAM,GAAG,EAAe,IAAI,iBACrC,WAAW;AACrB;;;;;;;AAQA,SAAgB,uBAAuB,KAAuB;CAgB1D,OAfwB,IACnB,MAAM,IAAI,CAAC,CASX,QAAQ,SAAS;EACd,MAAM,UAAU,KAAK,KAAK;EAC1B,OAAO,CAAC,QAAQ,WAAW,IAAI,KAAK,CAAC,QAAQ,WAAW,IAAI;CAChE,CAAC,CAAC,CACD,KAAK,IACH,CAAA,CACF,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,CACpB,QAAQ,MAAM,EAAE,SAAS,CAAC;AACnC;;;;;AAMA,SAAgB,wBACZ,KACa;CACb,OAAO,IAAI,gBAAgB,IAAI,2BAA2B;AAC9D;;;;;;;;;;;;;;;;;;;;AC7VA,SAAgB,qBACZ,SACA,SACQ;CACR,MAAM,gBAAgB,QAAQ,iBAAiB;CAC/C,MAAM,cAAc,KAAK,IAAI,GAAG,QAAQ,eAAe,CAAC;CACxD,MAAM,MAAM,QAAQ,uBAAO,IAAI,KAAK;CAEpC,IAAI,iBAAiB,GACjB,OAAO,CAAC;CAIZ,MAAM,QAAQ,QACT,KAAK,MAAM;EACR,MAAM,YAAY,EAAE,aAAa,qBAAqB,EAAE,GAAG;EAC3D,OAAO,YAAY;GAAE,KAAK,EAAE;GAAK;EAAU,IAAI;CACnD,CAAC,CAAC,CACD,QAAQ,MAA6C,MAAM,IAAI;CAGpE,MAAM,MAAM,GAAG,MAAM,EAAE,UAAU,QAAQ,IAAI,EAAE,UAAU,QAAQ,CAAC;CAElE,MAAM,SAAS,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK,KAAK;CAE9D,MAAM,WAAW,MACZ,MAAM,WAAW,CAAC,CAClB,QAAQ,MAAM,EAAE,UAAU,QAAQ,IAAI,MAAM;CAGjD,SAAS,MAAM,GAAG,MAAM,EAAE,UAAU,QAAQ,IAAI,EAAE,UAAU,QAAQ,CAAC;CACrE,OAAO,SAAS,KAAK,MAAM,EAAE,GAAG;AACpC;;;;;;;;;;;;;;;;;;;;;;AChEA,eAAsB,iBAClB,cACA,YACA,YAAuC,CAAC,GACK;CAC7C,IAAI,UAAU;CACd,IAAI,UAAU;CACd,KAAK,MAAM,aAAa,uBAAuB,UAAU,GACrD,IAAI;EACA,MAAM,aAAa,SAAS;EAC5B;CACJ,SAAS,KAAK;EACV;EAEA,IAAI,uBADc,UAAU,MAAM,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,GAAG,EACzB,EAAU,IAAI,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAAE;CAChG;CAEJ,OAAO;EAAE;EAAS;CAAQ;AAC9B;;;;;;;;;AAUA,eAAsB,UAClB,MACA,cACa;CACb,KAAK,MAAM,OAAO,MAAM;EACpB,MAAM,aAAa,GAAG;EACtB,IAAI;GACA,MAAM,aAAa,mBAAmB,GAAG,CAAC;EAC9C,QAAQ,CAER;CACJ;AACJ;;;;;;;;;;;;;;;;;;;;AAqBA,SAAgB,uBACZ,QACA,QACA,MACI;CACJ,IAAI;EACA,IAAI,OAAO,IAAI,GAAG,OAAO,IAAI;CACjC,QAAQ,CAER;AACJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACnDA,SAAgB,mBAAmB,MAAoB;CACnD,wBACK,MAAM,GAAG,WAAW,CAAC,IACrB,MAAM,GAAG,WAAW,CAAC,GACtB,IACJ;AACJ;AAEA,IAAa,kBAAb,cAAqC,MAAM;CACD;CAAtC,YAAY,SAAiB,MAAwB;EACjD,MAAM,OAAO;EADqB,KAAA,OAAA;EAElC,KAAK,OAAO;CAChB;AACJ;;AAGA,SAAgB,gBACZ,MACA,MAA0C,QAAQ,KACrC;CACb,MAAM,cACF,SAAS,YAAY,IAAI,eACvB,SAAS,eAAe,IAAI,kBAC5B,IAAI;CACV,IAAI,eAAe,GAAG,WAAW,WAAW,GAAG,OAAO;CACtD,OAAO,gBAAgB,IAAI;AAC/B;;AAGA,eAAsB,gBAAgB,KAAqC;CACvE,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,MAAM,KAAK,CAAC,WAAW,CAAC;EACjD,OAAO,iBAAiB,MAAM;CAClC,QAAQ;EACJ,OAAO;CACX;AACJ;;AAGA,eAAsB,sBAAsB,kBAAkD;CAC1F,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,iBAAiB,CAAC;CAC9C,MAAM,OAAO,QAAQ;CACrB,IAAI;EAEA,MAAM,OAAM,MADM,OAAO,MAAM,yBAAyB,EAAA,CACxC,OAAO,EAAE,EAAE;EAC3B,OAAO,wBAAwB,GAAG;CACtC,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;AAaA,eAAsB,UAClB,MACA,kBACA,MAA0C,QAAQ,KAC1B;CACxB,MAAM,MAAM,gBAAgB,MAAM,GAAG;CACrC,IAAI,CAAC,KACD,MAAM,IAAI,gBACN,uBAAuB,KAAK,YAC5B,kHACU,SAAS,YAAY,iBAAiB,kBAAkB,mBACtE;CAEJ,MAAM,CAAC,WAAW,eAAe,MAAM,QAAQ,IAAI,CAC/C,gBAAgB,GAAG,GACnB,sBAAsB,gBAAgB,CAC1C,CAAC;CAED,OAAO;EAAE;EAAK;EAAW;EAAa,GADvB,6BAA6B,WAAW,WACd;CAAO;AACpD;;;;;;;;;;;AAyBA,eAAsB,WAAW,MAmBP;CACtB,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,gBAAgB,WAAW,GAAG;CAC1C,IAAI,CAAC,KACD,MAAM,IAAI,gBACN,wCACA,0DACJ;CAGJ,MAAM,WAAW,KAAK,YAAY,oBAAoB,KAAK,MAAM;CACjE,MAAM,SAAS,KAAK,UAAU,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,gBAAgB,CAAC;CACrF,GAAG,UAAU,QAAQ,EAAE,WAAW,KAAK,CAAC;CACxC,MAAM,YAAY,KAAK,KAAK,QAAQ,QAAQ;CAE5C,MAAM,OAAO,gBAAgB;EACzB,kBAAkB,KAAK;EACvB,SAAS;EACT,gBAAgB,KAAK;EACrB,SAAS,KAAK;EACd,aAAa,KAAK;CACtB,CAAC;CAKD,MAAM,UAAkC,EAAE,GAAI,IAA+B;CAC7E,IAAI,KAAK,aACL,QAAQ,YAAY,CAAC,IAAI,WAAW,0BAA0B,KAAK,WAAW,CAAC,CAAC,CAC3E,OAAO,OAAO,CAAC,CAAC,KAAK,GAAG;CAGjC,IAAI;EACA,MAAM,MAAM,KAAK,MAAM;GACnB,OAAO,KAAK,eAAe,YAAY;GACvC,KAAK;EACT,CAAC;CACL,SAAS,OAAO;EASZ,mBAAmB,SAAS;EAG5B,MAAM,YAAY,+BAA+B,KAAK;EACtD,IAAI,CAAC,WAAW,MAAM;EACtB,MAAM,IAAI,gBACN,WACA,wFACJ;CACJ;CAIA,MAAM,SAAuB;EAAE;EAAW;EAAU,WAFlC,GAAG,WAAW,SAAS,IAAI,GAAG,SAAS,SAAS,CAAC,CAAC,OAAO;CAEb;CAE9D,IAAI,KAAK,mBAAmB,OAAO;EAC/B,MAAM,aAAa,gBAAgB,cAAc,GAAG;EACpD,IAAI,CAAC,YACD,MAAM,IAAI,gBACN,2EACA,kIAEJ;EAEJ,MAAM,cAAc,mBAAmB,SAAS;EAChD,IAAI;GACA,MAAM,MACF,YACA,0BAA0B;IAAE,kBAAkB,KAAK;IAAkB,SAAS;GAAY,CAAC,GAC3F;IAAE,OAAO,KAAK,eAAe,YAAY;IAAQ,KAAK,EAAE,GAAI,IAA+B;GAAE,CACjG;EACJ,SAAS,OAAO;GAMZ,mBAAmB,WAAW;GAC9B,mBAAmB,SAAS;GAC5B,MAAM;EACV;EACA,OAAO,cAAc;EACrB,OAAO,mBAAmB,GAAG,WAAW,WAAW,IAAI,GAAG,SAAS,WAAW,CAAC,CAAC,OAAO;CAC3F;CAEA,OAAO;AACX;;;;;;;AAQA,eAAsB,aAClB,WACA,MAA0C,QAAQ,KACT;CACzC,IAAI,CAAC,GAAG,WAAW,SAAS,GACxB,OAAO;EAAE,IAAI;EAAO,QAAQ,6BAA6B;CAAY;CAEzE,IAAI,GAAG,SAAS,SAAS,CAAC,CAAC,SAAS,GAChC,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAgC;CAEhE,MAAM,MAAM,gBAAgB,cAAc,GAAG;CAC7C,IAAI,CAAC,KAGD,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAkD;CAElF,IAAI;EACA,MAAM,MAAM,KAAK,uBAAuB,SAAS,GAAG;GAChD,OAAO;GACP,KAAK,EAAE,GAAI,IAA+B;EAC9C,CAAC;EACD,OAAO,EAAE,IAAI,KAAK;CACtB,SAAS,KAAK;EACV,OAAO;GAAE,IAAI;GAAO,QAAQ,6BAA6B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;EAAI;CAChH;AACJ;;;;;;;;;;;AAYA,eAAsB,aAClB,kBACA,YACA,YAAuC,CAAC,GACK;CAC7C,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,OAAO,EAAE,iBAAiB,CAAC;CAC9C,MAAM,OAAO,QAAQ;CACrB,IAAI;EACA,OAAO,MAAM,iBACT,OAAO,QAAQ;GAAE,MAAM,OAAO,MAAM,GAAG;EAAG,GAC1C,YACA,GACJ;CACJ,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;;;;;;;AAaA,eAAsB,YAAY,MAQhB;CACd,MAAM,MAAM,KAAK,OAAO,QAAQ;CAChC,MAAM,MAAM,gBAAgB,cAAc,GAAG;CAC7C,IAAI,CAAC,KACD,MAAM,IAAI,gBACN,2CACA,6DACJ;CASJ,MAAM,MAAM,KAPC,mBAAmB;EAC5B,kBAAkB,KAAK;EACvB,WAAW,KAAK;EAChB,OAAO,KAAK;EACZ,SAAS,KAAK;EACd,aAAa,KAAK;CACtB,CACiB,GAAM;EACnB,OAAO,KAAK,eAAe,YAAY;EACvC,KAAK,EAAE,GAAI,IAA+B;CAC9C,CAAC;AACL;;;;;AAMA,eAAsB,qBAClB,uBACA,QACgB;CAChB,MAAM,EAAE,WAAW,MAAM,OAAO;CAChC,MAAM,SAAS,IAAI,IAAI,qBAAqB;CAC5C,OAAO,WAAW;CAClB,MAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,OAAO,SAAS,EAAE,CAAC;CACjE,MAAM,OAAO,QAAQ;CACrB,IAAI;EACA,MAAM,WAAW,MAAM,OAAO,MAAM,gDAAgD,CAAC,MAAM,CAAC;EAC5F,IAAI,SAAS,YAAY,SAAS,WAAW,GACzC,OAAO;EAGX,IAAI,CAAC,2BAA2B,KAAK,MAAM,GACvC,MAAM,IAAI,gBAAgB,2BAA2B,OAAO,EAAE;EAElE,MAAM,OAAO,MAAM,oBAAoB,OAAO,EAAE;EAChD,OAAO;CACX,UAAU;EACN,MAAM,OAAO,IAAI;CACrB;AACJ;;;;;;AAOA,eAAsB,aAClB,SACA,WACA,MAC4C;CAC5C,MAAM,WAAW,KAAK,SAAS,SAAS;CACxC,MAAM,MAAM,eAAe,KAAK,QAAQ,QAAQ;CAChD,MAAM,SAAS,GAAG,aAAa,SAAS;CACxC,MAAM,OAAO,IAAI,KAAK,CAAC,MAAM,GAAG,UAAU,EAAE,MAAM,2BAA2B,CAAC;CAO9E,OAAO;EAAE;EAAK,aAAY,MANL,QAAQ,UAAU;GACnC;GACA;GACA,QAAQ,KAAK;GACb,UAAU,EAAE,iBAAiB,IAAI;EACrC,CAAC,EAAA,CACgC;CAAW;AAChD;;;;;AAMA,eAAsB,YAClB,MACA,SACuB;CACvB,IAAI,KAAK,SAAS,SAAS;EACvB,IAAI,CAAC,GAAG,WAAW,KAAK,IAAI,GAAG,OAAO,CAAC;EAEvC,MAAM,MADO,GAAG,SAAS,KAAK,IAClB,CAAA,CAAK,YAAY,IAAI,KAAK,OAAO,KAAK,QAAQ,KAAK,IAAI;EACnE,OAAO,GACF,YAAY,GAAG,CAAC,CAChB,QAAQ,MAAM,EAAE,SAAS,OAAO,CAAC,CAAC,CAClC,KAAK,MAAM;GACR,MAAM,OAAO,KAAK,KAAK,KAAK,CAAC;GAC7B,MAAM,QAAQ,GAAG,SAAS,IAAI;GAE9B,OAAO;IAAE,KAAK;IAAM,WADF,qBAAqB,CAAC,KAAK,MAAM;IACpB,WAAW,MAAM;GAAK;EACzD,CAAC,CAAC,CACD,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,KAAK,MAAM,EAAE,WAAW,QAAQ,KAAK,EAAE;CACrF;CAEA,IAAI,CAAC,SACD,MAAM,IAAI,gBACN,WAAW,KAAK,KAAK,gDACzB;CAMJ,QAAO,MAJc,QAAQ,YAAY,KAAK,SAAS,GAAG,KAAK,OAAO,KAAK,IAAI;EAC3E,QAAQ,KAAK;EACb,YAAY;CAChB,CAAC,EAAA,CACa,MACT,KAAK,SAAS,KAAK,QAAQ,CAAC,CAC5B,QAAQ,QAAQ,IAAI,SAAS,OAAO,CAAC,CAAC,CACtC,KAAK,SAAS;EAAE;EAAK,WAAW,qBAAqB,GAAG,KAAK,KAAA;CAAU,EAAE,CAAC,CAC1E,MAAM,GAAG,OAAO,EAAE,WAAW,QAAQ,KAAK,MAAM,EAAE,WAAW,QAAQ,KAAK,EAAE;AACrF;;;;;AAMA,eAAsB,aAClB,MACA,SACA,SACiB;CAEjB,MAAM,WAAW,qBAAqB,MADhB,YAAY,MAAM,OAAO,GACA,OAAO;CAgBtD,MAAM,UAAU,UAVZ,KAAK,SAAS,UACR,OAAO,QAAgB;EACrB,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG,MAAM,IAAI,MAAM,cAAc,KAAK;EAC5D,GAAG,WAAW,GAAG;CACrB,IACE,OAAO,QAAgB;EACrB,IAAI,CAAC,SAAS,MAAM,IAAI,gBAAgB,mDAAmD;EAC3F,MAAM,QAAQ,aAAa,KAAK,KAAK,MAAM;CAC/C,CAE8B;CACtC,OAAO;AACX"}

package/dist/{cli-errors-Dka89exj.js → cli-errors-B8qHg02P.js}

@@ -270,6 +270,11 @@ function pgErrorToFriendlyMessage(pgError, context, options = {}) {
 			code,
 			violations
 		};
+		case "23001": return {
+			message: `Cannot complete operation: rows in "${table ?? "another table"}" still reference this row in "${context}", and their foreign key${constraint ? ` (${constraint})` : ""} does not allow it to be deleted or its key changed. Delete or reassign those rows first.${detail ? ` ${detail}` : ""}${suffix}`,
+			code,
+			violations
+		};
 		case "23505": return {
 			message: detail ? `Duplicate value: ${detail}${suffix}` : `Cannot complete operation: a unique constraint${constraint ? ` (${constraint})` : ""} was violated in "${context}".${suffix}`,
 			code,
@@ -790,4 +795,4 @@ async function diagnoseAtlasFailure(context) {
 //#endregion
 export { formatForeignGeneratedColumnBanner as a, reportCommandFailure as c, extractPgError as d, isRoleSwitchingPermissionError as f, sanitizeErrorForClient as g, reachedDatabase as h, diagnoseDbError as i, classifyConnectFailure as l, pgErrorToFriendlyMessage as m, deepestErrorMessage as n, isEconnrefused as o, isRowLevelSecurityDenial as p, diagnoseAtlasFailure as r, parseHostInfo as s, checkDatabaseConnectivity as t, extractCauseMessage as u };
 
-//# sourceMappingURL=cli-errors-Dka89exj.js.map
+//# sourceMappingURL=cli-errors-B8qHg02P.js.map

package/dist/cli-errors-B8qHg02P.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-errors-B8qHg02P.js","names":[],"sources":["../src/utils/pg-error-utils.ts","../src/cli-errors.ts"],"sourcesContent":["/**\n * Shared PostgreSQL error extraction and user-friendly message formatting.\n *\n * Drizzle wraps native PG errors in a `.cause` chain. These utilities\n * unwrap that chain to get the real PostgreSQL error (identified by a\n * 5-character alphanumeric `code` such as `42P01`) and translate it into\n * a message that is safe and helpful to show to end-users.\n */\n\nimport { declaredErrorAnswer, logger } from \"@rebasepro/server\";\nimport type { CollectionConfig } from \"@rebasepro/types\";\nimport { fieldKeyForColumn, getTableName } from \"@rebasepro/common\";\n\n/**\n * Shape of a deliberate client-facing error — `ApiError` from\n * `@rebasepro/server`, `RebaseApiError` from `@rebasepro/types`, or anything\n * else carrying a 4xx `statusCode`.\n *\n * Matched structurally rather than with `instanceof`: `@rebasepro/server` can\n * be loaded twice (published dist vs. workspace source), which breaks class\n * identity — `PersistService` hedges against the same thing by also accepting\n * `name === \"ApiError\"`.\n */\ninterface ClientFacingError extends Error {\n    statusCode?: number;\n    code?: string;\n    /** See `ApiError.expected` — routine outcomes log at debug, not warn. */\n    expected?: boolean;\n}\n\n/**\n * Return the error when it is a deliberate 4xx, otherwise null.\n *\n * A thrown `ApiError` is a decision the server made about the request, not a\n * database failure: its message and code are already written for the client.\n *\n * So is a `RebaseApiError` — what a collection callback throws, since a\n * collection file cannot import the server package. It spells its status\n * `status`, and reading only `statusCode` here turned an `afterRead` that\n * refused with a 403 into \"Could not load data … Check server logs\" on a\n * subscription, where REST and the socket's own requests answer the 403.\n * Recognised by the predicate those doors use, `declaredErrorAnswer`.\n */\nfunction asClientFacingError(error: unknown): Pick<ClientFacingError, \"statusCode\" | \"code\" | \"message\" | \"expected\"> | null {\n    const answer = declaredErrorAnswer(error);\n    if (answer) {\n        if (answer.status < 400 || answer.status >= 500) return null;\n        return { statusCode: answer.status, code: answer.code, message: answer.message, expected: answer.expected };\n    }\n    if (!(error instanceof Error)) return null;\n    const e = error as ClientFacingError;\n    if (typeof e.statusCode !== \"number\" || e.statusCode < 400 || e.statusCode >= 500) return null;\n    return e;\n}\n\n/** Shape of PostgreSQL errors with diagnostic metadata. */\nexport interface PostgresError extends Error {\n    code?: string;\n    detail?: string;\n    hint?: string;\n    constraint?: string;\n    column?: string;\n    table?: string;\n    dataType?: string;\n    cause?: unknown;\n}\n\n/**\n * Extract the underlying PostgreSQL error from a Drizzle wrapper.\n * Drizzle wraps PG errors in a `cause` property — this function\n * recursively walks the chain until it finds an object with a PG\n * error code (5-char alphanumeric, e.g. `42P01`).\n */\nexport function extractPgError(error: unknown): PostgresError | null {\n    if (!error || typeof error !== \"object\") return null;\n    if (!(error instanceof Error)) {\n        // Check non-Error objects for a cause chain (Drizzle sometimes wraps oddly)\n        if (\"cause\" in error && (error as Record<string, unknown>).cause && typeof (error as Record<string, unknown>).cause === \"object\") {\n            return extractPgError((error as Record<string, unknown>).cause);\n        }\n        return null;\n    }\n\n    // Check if the error itself has a PG error code\n    if (\"code\" in error && typeof (error as PostgresError).code === \"string\" && /^[0-9A-Z]{5}$/.test((error as PostgresError).code!)) {\n        return error as PostgresError;\n    }\n\n    // Check the cause chain (Drizzle wraps PG errors)\n    if (error.cause && typeof error.cause === \"object\") {\n        return extractPgError(error.cause);\n    }\n\n    return null;\n}\n\n/**\n * Whether the failure came back from Postgres rather than from building the\n * query — which decides whether a fallback query is worth issuing.\n *\n * Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds\n * RLS). Once a statement raises, that transaction is aborted, and every later\n * statement on it returns `25P02` — \"current transaction is aborted, commands\n * ignored until end of transaction block\". So a retry after a database error\n * cannot succeed, and it replaces a precise diagnosis (\"invalid input syntax\n * for type uuid\") with a generic one. Rethrow instead.\n *\n * A query the driver could not even build — a missing reciprocal relation, say\n * — never reached Postgres, leaves the transaction usable, and is exactly what\n * the fallback paths exist for.\n */\nexport function reachedDatabase(error: unknown): boolean {\n    return extractPgError(error) !== null;\n}\n\n/**\n * Walk the error cause chain and return the deepest meaningful message.\n */\nexport function extractCauseMessage(error: unknown): string | null {\n    if (!error || typeof error !== \"object\") return null;\n    if (!(error instanceof Error)) return null;\n\n    if (error.cause && typeof error.cause === \"object\") {\n        const deeper = extractCauseMessage(error.cause);\n        if (deeper) return deeper;\n        // The cause itself has a message\n        if (error.cause instanceof Error && error.cause.message) {\n            return error.cause.message;\n        }\n    }\n    return null;\n}\n\n/**\n * Codes that mean \"this connection will never work as configured\".\n *\n * A wrong password or a database that does not exist is a settled fact about\n * the connection string, not a transient fault — retrying produces the same\n * answer forever.\n */\nconst UNRECOVERABLE_CONNECT_CODES = new Set([\n    \"28P01\", // invalid_password\n    \"28000\", // invalid_authorization_specification\n    \"3D000\", // invalid_catalog_name — the database does not exist\n    \"42501\"  // insufficient_privilege\n]);\n\nexport interface ConnectFailure {\n    /** True when retrying cannot help: the connection string itself is wrong. */\n    fatal: boolean;\n    /** The deepest message available — the Postgres one where there is one. */\n    reason: string;\n    /** The `SQLSTATE`, when the failure came from Postgres rather than the socket. */\n    code?: string;\n}\n\n/**\n * Describe a failed connection attempt in terms a developer can act on.\n *\n * The error a caller catches is Drizzle's wrapper: its message is\n * `Failed query: SELECT 1` and its stack runs through drizzle internals, while\n * the sentence that says what is actually wrong — \"password authentication\n * failed for user …\", \"database … does not exist\" — sits in `.cause`. Logging\n * the wrapper, as the bootstrapper used to, tells a developer with a typo in\n * their `DATABASE_URL` nothing at all.\n */\nexport function classifyConnectFailure(error: unknown): ConnectFailure {\n    const pgError = extractPgError(error);\n    const reason =\n        pgError?.message ??\n        extractCauseMessage(error) ??\n        (error instanceof Error ? error.message : String(error));\n    return {\n        fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),\n        reason,\n        code: pgError?.code\n    };\n}\n\n/**\n * Detect whether an error is specifically a role-switching permission failure\n * (e.g. \"permission denied to set role\" or \"must be member of role\"),\n * as opposed to a table-level permission denial.\n *\n * This is used by the backend driver to auto-disable role switching when the\n * connection user lacks SET ROLE privileges, rather than surfacing a confusing\n * error to the Studio SQL Editor user.\n */\nexport function isRoleSwitchingPermissionError(error: unknown): boolean {\n    const pgError = extractPgError(error);\n    if (!pgError || pgError.code !== \"42501\") return false;\n    const msg = pgError.message.toLowerCase();\n    return msg.includes(\"set role\") || msg.includes(\"member of role\");\n}\n\n/**\n * Was this `42501` the *caller* being refused by a policy, rather than the\n * server lacking a privilege?\n *\n * Both arrive as `insufficient_privilege`, and they are opposite kinds of\n * problem. A row-level-security refusal is a working access-control system\n * doing its job: the caller asked for something their policies do not permit,\n * which is a 403 and nobody's bug. A missing `GRANT` is the deployment being\n * wrong — the connection role cannot touch the table at all, no policy is\n * involved, and nothing the caller changes about the request will help.\n *\n * Postgres distinguishes them in the message, so this does too:\n *\n *     new row violates row-level security policy for table \"notes\"  → the caller\n *     permission denied for table notes                             → the server\n *\n * Only writes reach this. A read that RLS excludes is not an error — the rows\n * are filtered and the caller gets an empty page — so the erroring case is\n * specifically an `INSERT`/`UPDATE` whose row fails a policy's `WITH CHECK`.\n *\n * Matched on the message because that is the only thing carrying the\n * distinction; the SQLSTATE is identical either way. Narrow by design: anything\n * not naming row-level security stays the server's problem, since reporting a\n * genuine privilege misconfiguration as \"forbidden\" would send an operator\n * hunting for a policy bug that does not exist.\n */\nexport function isRowLevelSecurityDenial(error: unknown): boolean {\n    const pgError = extractPgError(error);\n    if (!pgError || pgError.code !== \"42501\") return false;\n    return pgError.message.toLowerCase().includes(\"row-level security policy\");\n}\n\n/**\n * One constraint the database refused, named in the caller's vocabulary.\n *\n * `field` is the **wire** name, derived from the physical column: `author_id`\n * on the table is `authorId` on the row and in the request body, and telling a\n * caller their `author_id` is missing sends them looking for a key their client\n * has never seen. `code` is the SQLSTATE, which is stable, documented by\n * Postgres and the same in every environment — unlike the message, which is\n * deliberately thinner in production.\n *\n * Deliberately no `value`. The column name is safe to publish: it is already in\n * the OpenAPI, the generated SDK and the caller's own request. The *value* is\n * not — `23505`'s detail reads `Key (email)=(a@b.c) already exists.`, which\n * answers \"is this person registered?\" for any address on a table whose rows\n * RLS is otherwise hiding completely.\n */\nexport interface PgFieldViolation {\n    field: string;\n    code: string;\n}\n\n/**\n * The physical column names a Postgres error is about.\n *\n * Postgres puts one in `column` for `23502` and nowhere else, so the rest are\n * read out of the two places that do carry them:\n *\n * - `detail` — `Key (author_id)=(9) is not present in table \"authors\".` and\n *   `Key (email, tenant_id)=(…) already exists.` Only the parenthesised column\n *   list is read; the values after `=` are never touched.\n * - `constraint` — `users_email_key`, `posts_author_id_fkey`. The table prefix\n *   and the constraint suffix are stripped, leaving the columns joined by `_`,\n *   which is ambiguous for multi-column constraints and is therefore only used\n *   when `detail` gave nothing.\n *\n * `22P02` carries neither, because an invalid literal fails during parse rather\n * than against a constraint. Its message names the *type*, and an enum type is\n * generated as `<table>_<column>` — which is the one case worth decoding,\n * because a value outside an enum's labels is the most common 22P02 anyone\n * hits and the least legible one.\n */\nfunction offendingColumns(pgError: PostgresError, collection?: CollectionConfig): string[] {\n    if (pgError.column) return [pgError.column];\n\n    const detail = pgError.detail;\n    if (detail) {\n        const keyed = /Key \\(([^)]+)\\)=/.exec(detail);\n        if (keyed) {\n            return keyed[1].split(\",\").map(part => part.trim().replace(/^\"|\"$/g, \"\")).filter(Boolean);\n        }\n    }\n\n    if (pgError.code === \"22P02\") {\n        // `invalid input value for enum posts_status: \"archived\"`\n        const enumType = /invalid input value for enum ([^:\\s]+)/i.exec(pgError.message ?? \"\");\n        if (enumType && collection) {\n            const typeName = enumType[1].replace(/^.*\\./, \"\").replace(/\"/g, \"\");\n            const table = getTableName(collection);\n            if (typeName.startsWith(`${table}_`)) return [typeName.slice(table.length + 1)];\n        }\n        return [];\n    }\n\n    const constraint = pgError.constraint;\n    if (constraint && collection) {\n        const table = getTableName(collection);\n        const stripped = constraint\n            .replace(new RegExp(`^${table}_`), \"\")\n            .replace(/_(pkey|key|fkey|unique|check|excl|idx)$/, \"\");\n        // Only when it names something the collection actually has: a\n        // hand-written constraint name is not a column list, and guessing at one\n        // would put a field in the response that does not exist.\n        if (stripped && stripped !== constraint) {\n            const columns = new Set<string>();\n            for (const [key, prop] of Object.entries(collection.properties ?? {})) {\n                columns.add((prop as { columnName?: string })?.columnName ?? key);\n            }\n            if (columns.has(stripped)) return [stripped];\n            const wire = fieldKeyForColumn(collection, stripped);\n            if (collection.properties && wire in collection.properties) return [stripped];\n        }\n    }\n\n    return [];\n}\n\n/**\n * The fields a Postgres error is about, for `details.violations`.\n *\n * Only the four SQLSTATEs that describe *the caller's data*: a missing value, a\n * duplicate, a bad literal, a foreign key pointing at nothing. Everything else\n * — a dropped connection, a missing table, a privilege problem — is the\n * deployment's, and naming a field for it would send the reader to the wrong\n * place.\n *\n * Empty when the collection is unknown or the column cannot be recovered. An\n * empty list is the honest answer; inventing a field is worse than saying\n * nothing, because a form will mark the wrong input red.\n */\nexport function pgFieldViolations(\n    pgError: PostgresError,\n    collection?: CollectionConfig\n): PgFieldViolation[] {\n    const code = pgError.code;\n    if (code !== \"23502\" && code !== \"23505\" && code !== \"22P02\" && code !== \"23503\") return [];\n    // Without the collection there is no mapping, only a guess. `toWireKey`\n    // would get the default case right and silently invent a field for any\n    // property carrying an explicit `columnName` — and a form pointed at an\n    // input that does not exist is worse off than one shown the raw column.\n    if (!collection) return [];\n    const columns = offendingColumns(pgError, collection);\n    if (columns.length === 0) return [];\n    return columns.map(column => ({\n        field: fieldKeyForColumn(collection, column),\n        code\n    }));\n}\n\n/**\n * Translate a raw PostgreSQL error into a user-friendly message.\n *\n * @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})\n * @param context  - A human-readable context string (e.g. collection slug or path)\n * @returns An object with a `message` safe for the client and the PG `code`.\n */\nexport function pgErrorToFriendlyMessage(\n    pgError: PostgresError,\n    context: string,\n    options: { verbose?: boolean; collection?: CollectionConfig } = {}\n): { message: string; code: string; violations: PgFieldViolation[] } {\n    // Postgres's own `DETAIL` and `HINT`, and the raw driver message, are what\n    // make these errors useful while you are building — and what makes them an\n    // oracle once the server is answering strangers.\n    //\n    // The sharp one is `23505`: its detail reads `Key (email)=(a@b.c) already\n    // exists.`, which answers \"is this person registered?\" for any address, on\n    // a table whose rows RLS is otherwise hiding completely. The rest leak\n    // physical column and constraint names, which are the map for the next\n    // question. So in production the shape of the failure is served — what\n    // rule was broken, and where — and the values are not.\n    //\n    // The full text is not lost: the caller logs the original error. This\n    // decides what crosses the wire, not what is recorded.\n    const verbose = options.verbose ?? process.env.NODE_ENV !== \"production\";\n\n    const detail = verbose ? (pgError.detail as string | undefined) : undefined;\n    const hint = verbose ? (pgError.hint as string | undefined) : undefined;\n    const constraint = pgError.constraint as string | undefined;\n    const column = pgError.column as string | undefined;\n    const table = pgError.table as string | undefined;\n    const dataType = verbose ? (pgError.dataType as string | undefined) : undefined;\n    const rawMessage = pgError.message || \"Unknown database error\";\n    const pgMessage = verbose ? rawMessage : \"\";\n    const code = pgError.code || \"UNKNOWN\";\n\n    // Which *field* the caller has to fix, derived from the column. Safe in\n    // production — a column name is already published in the OpenAPI and the\n    // generated SDK — where the value that broke the rule is not, and is never\n    // included. See `pgFieldViolations`.\n    const violations = pgFieldViolations(pgError, options.collection);\n\n    const suffix = hint ? ` Hint: ${hint}` : \"\";\n    const tableRef = table ?? context;\n\n    /** `\": <postgres said>\"`, or nothing when the details are withheld. */\n    const said = pgMessage ? `: ${pgMessage}` : \"\";\n\n    switch (pgError.code) {\n        case \"23503\": // foreign_key_violation\n            return {\n                message: detail\n                    ? `Foreign key constraint violated: ${detail}${suffix}`\n                    : `Cannot complete operation: a foreign key constraint${constraint ? ` (${constraint})` : \"\"} was violated in \"${context}\".${suffix}`,\n                code,\n                violations\n            };\n        case \"23001\": // restrict_violation\n            // A row other rows still point at, under `ON DELETE RESTRICT` — the\n            // default for a required link. `table` is the *referencing* table,\n            // which is the one the caller has to clear or reassign first.\n            return {\n                message: `Cannot complete operation: rows in \"${table ?? \"another table\"}\" still reference this row in ` +\n                    `\"${context}\", and their foreign key${constraint ? ` (${constraint})` : \"\"} does not allow it to be ` +\n                    `deleted or its key changed. Delete or reassign those rows first.${detail ? ` ${detail}` : \"\"}${suffix}`,\n                code,\n                violations\n            };\n        case \"23505\": // unique_violation\n            return {\n                message: detail\n                    ? `Duplicate value: ${detail}${suffix}`\n                    : `Cannot complete operation: a unique constraint${constraint ? ` (${constraint})` : \"\"} was violated in \"${context}\".${suffix}`,\n                code,\n                violations\n            };\n        case \"23502\": {\n            // not_null_violation. The message names the *field* when the\n            // collection is known, because that is the key the caller sent and\n            // the only one they can act on: told `author_id` is missing, they go\n            // looking for a key their generated client has never mentioned.\n            const named = violations[0]?.field ?? column ?? \"unknown\";\n            return {\n                message: `Missing required field: \"${named}\" in \"${tableRef}\" cannot be empty.${suffix}`,\n                code,\n                violations\n            };\n        }\n        case \"23514\": // check_violation\n            return {\n                message: `Validation failed: a check constraint${constraint ? ` (${constraint})` : \"\"} was violated in \"${context}\".${suffix}`,\n                code,\n                violations\n            };\n        case \"22P02\": // invalid_text_representation (e.g. invalid UUID, wrong enum value)\n            return {\n                message: `Invalid data format in \"${context}\"${said}.${suffix}`,\n                code,\n                violations\n            };\n        case \"22001\": // string_data_right_truncation (value too long)\n            return {\n                message: `Value too long for column \"${column ?? \"unknown\"}\" in \"${tableRef}\"${said}.${suffix}`,\n                code,\n                violations\n            };\n        case \"22003\": // numeric_value_out_of_range\n            return {\n                message: `Numeric value out of range for column \"${column ?? \"unknown\"}\" in \"${tableRef}\"${said}.${suffix}`,\n                code,\n                violations\n            };\n        case \"42703\": // undefined_column\n            return {\n                message: `Unknown column in \"${tableRef}\"${said}. Check if your schema is up to date (run migrations).${suffix}`,\n                code,\n                violations\n            };\n        case \"42P01\": // undefined_table\n            return {\n                message: `Table not found for \"${context}\"${said}. Check if your schema is up to date (run migrations).${suffix}`,\n                code,\n                violations\n            };\n        case \"42501\": // insufficient_privilege\n            // Two unrelated failures share this SQLSTATE, and the old message\n            // named both causes because it could not tell them apart — which\n            // meant it was half wrong whichever one had happened, and sent the\n            // reader to check the other. Postgres says which in its own message.\n            return rawMessage.toLowerCase().includes(\"row-level security policy\")\n                ? {\n                    // The caller. Their policies do not permit this row; the\n                    // deployment is working exactly as configured.\n                    message: `Not permitted to write this row in \"${tableRef}\": it does not satisfy the row-level security policy.${suffix}`,\n                    code,\n                    violations\n                }\n                : {\n                    // The deployment. No policy is involved — the connecting\n                    // role cannot touch the table at all.\n                    message: `Permission denied on \"${tableRef}\": the database role this server connects as lacks privileges on it.${suffix}`,\n                    code,\n                    violations\n                };\n        case \"28000\": // invalid_authorization_specification\n            return {\n                message: `Authorization failed for \"${context}\". Check your database credentials.${suffix}`,\n                code,\n                violations\n            };\n        default: {\n            // Unhandled PG code — still surface the actual database message\n            const parts = [`Database error in \"${context}\" [${code}]${said}`];\n            if (detail) parts.push(`Detail: ${detail}`);\n            if (column) parts.push(`Column: ${column}`);\n            if (dataType) parts.push(`Data type: ${dataType}`);\n            if (constraint) parts.push(`Constraint: ${constraint}`);\n            if (hint) parts.push(`Hint: ${hint}`);\n            return { message: parts.join(\". \"), code, violations };\n        }\n    }\n}\n\n/**\n * Sanitize any error into a message safe and helpful for the client.\n *\n * A deliberate 4xx (`ApiError`) passes through untouched — the server already\n * decided what the client should read. Otherwise the PG error is extracted\n * from the Drizzle cause chain, falling back to a generic message that\n * doesn't leak SQL.\n *\n * @param error   - The raw caught error\n * @param context - A human-readable context string (e.g. collection path)\n * @returns An object with `message` (user-friendly) and optional `code`\n *          (the `ApiError` code, or the PG SQLSTATE).\n */\nexport function sanitizeErrorForClient(\n    error: unknown,\n    context: string,\n    options: { collection?: CollectionConfig } = {}\n): { message: string; code?: string; violations?: PgFieldViolation[] } {\n    // ── A deliberate 4xx is not a database failure ──────────────────\n    // Its message and code are written for the client; replacing them with\n    // \"Check server logs\" would discard the only diagnosis the caller gets\n    // (e.g. the offending filter field and the collection's valid ones).\n    // Log level follows the same convention as the HTTP error handler in\n    // @rebasepro/server: routine outcomes at debug, everything else at warn.\n    const clientError = asClientFacingError(error);\n    if (clientError) {\n        const line = `[API ${clientError.statusCode} ${clientError.code ?? \"BAD_REQUEST\"}] in \"${context}\": ${clientError.message}`;\n        if (clientError.expected) {\n            logger.debug(line);\n        } else {\n            logger.warn(`⚠️ ${line}`);\n        }\n        return { message: clientError.message, ...(clientError.code && { code: clientError.code }) };\n    }\n\n    // ── Always log the full, unsanitized error server-side ──────────\n    const pgError = extractPgError(error);\n\n    if (pgError) {\n        logger.error(`[PG ${pgError.code}] Error in \"${context}\"`, {\n            code: pgError.code,\n            message: pgError.message,\n            detail: pgError.detail,\n            hint: pgError.hint,\n            column: pgError.column,\n            table: pgError.table,\n            constraint: pgError.constraint,\n            dataType: pgError.dataType\n            // The outer Drizzle wrapper message used to be logged here \"for\n            // full context\": it is `Failed query: <sql>\\nparams: <values>`, so\n            // it published the statement and every bound value (an email, a\n            // password hash) on every realtime data failure. The SQLSTATE,\n            // detail, table, column and constraint above are the diagnostic\n            // value; the wrapper added only the leak. `logger` strips the\n            // wrapper as well, but the field itself carried nothing else.\n        });\n        const { message, code, violations } = pgErrorToFriendlyMessage(pgError, context, { collection: options.collection });\n        return { message, code, ...(violations.length > 0 && { violations }) };\n    }\n\n    // No PG error found — log the raw error as-is\n    logger.error(`Database error in \"${context}\" (no PG error extracted)`, {\n        error: error instanceof Error ? error.message : String(error),\n        stack: error instanceof Error ? error.stack : undefined,\n        cause: error instanceof Error && error.cause\n            ? (error.cause instanceof Error ? error.cause.message : String(error.cause))\n            : undefined\n    });\n\n    // Try to get the deepest cause message\n    const causeMessage = extractCauseMessage(error);\n    if (causeMessage) {\n        return { message: `Database error in \"${context}\": ${causeMessage}` };\n    }\n\n    // Last resort — generic message, never leak raw SQL\n    return { message: `Could not load data for \"${context}\". Check server logs for details.` };\n}\n","import chalk from \"chalk\";\nimport { outWarn, outError } from \"./cli-output\";\nimport { extractCauseMessage } from \"./utils/pg-error-utils\";\n\n/**\n * Detect whether an error (or AggregateError wrapping multiple attempts)\n * represents an ECONNREFUSED — i.e. the database is simply not running.\n *\n * Handles:\n * - Direct `{ code: \"ECONNREFUSED\" }` errors from Node `net`\n * - `AggregateError` from dual-stack IPv4+IPv6 connection attempts\n * - Drizzle's `cause`-wrapped pg errors\n */\nexport function isEconnrefused(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { code?: string; cause?: unknown; errors?: unknown[] };\n    if (e.code === \"ECONNREFUSED\") return true;\n    // AggregateError from Node net (dual-stack IPv4 + IPv6)\n    if (Array.isArray(e.errors)) {\n        return e.errors.some(inner =>\n            inner && typeof inner === \"object\" && (inner as { code?: string }).code === \"ECONNREFUSED\"\n        );\n    }\n    // Drizzle wraps the pg error in `cause`\n    if (e.cause && typeof e.cause === \"object\") {\n        return isEconnrefused(e.cause);\n    }\n    return false;\n}\n\n/**\n * Detect PostgreSQL authentication failures.\n * PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)\n */\nexport function isAuthFailure(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { code?: string; cause?: unknown };\n    if (e.code === \"28P01\" || e.code === \"28000\") return true;\n    if (e.cause && typeof e.cause === \"object\") {\n        return isAuthFailure(e.cause);\n    }\n    // Also check the message for common pg auth failure text\n    if (\"message\" in e && typeof (e as { message?: string }).message === \"string\") {\n        const msg = (e as { message: string }).message.toLowerCase();\n        if (msg.includes(\"password authentication failed\") || msg.includes(\"no pg_hba.conf entry\")) {\n            return true;\n        }\n    }\n    return false;\n}\n\n/**\n * Detect the \"SSL is not enabled on the server\" failure — the client attempted\n * an SSL handshake against a Postgres server that doesn't support it (common\n * with a plain local dev database). The fix is `?sslmode=disable` on the URL.\n */\nexport function isSslNotEnabled(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { message?: string; cause?: unknown };\n    if (typeof e.message === \"string\" && e.message.toLowerCase().includes(\"ssl is not enabled on the server\")) {\n        return true;\n    }\n    if (e.cause && typeof e.cause === \"object\") {\n        return isSslNotEnabled(e.cause);\n    }\n    return false;\n}\n\n/**\n * Detect PostgreSQL \"cannot drop ... because other objects depend on it\"\n * (error code 2BP01, dependent_objects_still_exist). This is the failure that\n * strands a declarative `db push` half-applied when a collection is removed but\n * an enum type it defined is still referenced by another object.\n */\nexport function isDependencyDropError(err: unknown): boolean {\n    if (!err || typeof err !== \"object\") return false;\n    const e = err as { code?: string; message?: string; cause?: unknown };\n    if (e.code === \"2BP01\") return true;\n    if (typeof e.message === \"string\") {\n        const msg = e.message.toLowerCase();\n        if (msg.includes(\"other objects depend on it\") || msg.includes(\"cannot drop type\")) {\n            return true;\n        }\n    }\n    if (e.cause && typeof e.cause === \"object\") {\n        return isDependencyDropError(e.cause);\n    }\n    return false;\n}\n\n/**\n * Parse host:port from a DATABASE_URL for display purposes.\n *\n * Exported because every message about a connection has to name the thing it\n * could not reach, and the boot path needs the same rendering the CLI banners\n * use — including the same refusal to print the URL itself, which carries the\n * password.\n */\nexport function parseHostInfo(databaseUrl: string): string {\n    try {\n        const parsed = new URL(databaseUrl);\n        return `${parsed.hostname}:${parsed.port || 5432}`;\n    } catch {\n        return \"unknown\";\n    }\n}\n\n/**\n * The sentence the operating system actually produced, dug out of the wrappers.\n *\n * `connect ECONNREFUSED 127.0.0.1:5432` is written by `net`, then wrapped by\n * `pg`, then wrapped again by Drizzle as `Failed query: …` — and on a\n * dual-stack host it is not in `.cause` at all but inside the\n * `AggregateError.errors` array of one attempt per resolved address. Printing\n * the banner without it loses the one token every search engine, runbook and\n * colleague recognises.\n */\nexport function deepestErrorMessage(err: unknown): string | null {\n    if (!err || typeof err !== \"object\") return null;\n    const e = err as { message?: string; code?: string; cause?: unknown; errors?: unknown[] };\n\n    if (Array.isArray(e.errors)) {\n        for (const inner of e.errors) {\n            const deeper = deepestErrorMessage(inner);\n            if (deeper) return deeper;\n        }\n    }\n    if (e.cause) {\n        const deeper = deepestErrorMessage(e.cause);\n        if (deeper) return deeper;\n    }\n    if (typeof e.message === \"string\" && e.message && !e.message.startsWith(\"Failed query:\")) {\n        return e.code ? `${e.message} (${e.code})` : e.message;\n    }\n    return null;\n}\n\n/** One indented line naming the driver's own reason, or nothing. */\nfunction driverReasonLine(err: unknown): string {\n    const reason = err === undefined ? null : deepestErrorMessage(err);\n    return reason ? `  The driver said: ${reason}\\n\\n` : \"\";\n}\n\n/**\n * Format a diagnostic banner for ECONNREFUSED errors.\n */\nfunction formatConnectionRefusedBanner(databaseUrl: string, err?: unknown): string {\n    const hostInfo = parseHostInfo(databaseUrl);\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Cannot connect to PostgreSQL at ${hostInfo}\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        driverReasonLine(err) +\n        `  The database server is not running or is not accepting\\n` +\n        `  connections. Common fixes:\\n` +\n        `\\n` +\n        `    • docker compose up -d db          (the service a Rebase scaffold ships)\\n` +\n        `    • brew services start postgresql@18\\n` +\n        `    • Verify DATABASE_URL in your .env file\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Format a diagnostic banner for authentication failures.\n */\nfunction formatAuthFailureBanner(databaseUrl: string, err?: unknown): string {\n    const hostInfo = parseHostInfo(databaseUrl);\n    let username = \"unknown\";\n    try {\n        username = new URL(databaseUrl).username || \"unknown\";\n    } catch { /* ignore */ }\n\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Authentication failed for user \"${username}\" at ${hostInfo}\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        driverReasonLine(err) +\n        `  PostgreSQL rejected the credentials. Common fixes:\\n` +\n        `\\n` +\n        `    • Check the username and password in DATABASE_URL\\n` +\n        `    • Verify the user exists:  psql -c \"\\\\du\"\\n` +\n        `    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Format a diagnostic banner for \"SSL is not enabled on the server\".\n */\nfunction formatSslNotEnabledBanner(databaseUrl: string): string {\n    const hostInfo = parseHostInfo(databaseUrl);\n    const suggestion = databaseUrl.includes(\"?\") ? \"&sslmode=disable\" : \"?sslmode=disable\";\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  SSL is not enabled on the PostgreSQL server at ${hostInfo}\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  The client tried to connect over SSL, but the server does not\\n` +\n        `  support it. This is normal for a plain local dev database.\\n` +\n        `\\n` +\n        `  Fix: append ${chalk.bold(\"sslmode=disable\")} to DATABASE_URL, e.g.\\n` +\n        `\\n` +\n        `    DATABASE_URL=...${suggestion}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Format a diagnostic banner for a dependency-drop failure during `db push`.\n * Explains that the database may be left partially migrated and how to recover.\n */\nfunction formatDependencyDropBanner(): string {\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Schema push failed: a type/table could not be dropped\\n` +\n        `      because other objects still depend on it.\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  ${chalk.yellow(\"The database may now be partially migrated.\")} Atlas applies\\n` +\n        `  statements individually, so earlier changes in this push may\\n` +\n        `  already be committed while later ones failed.\\n` +\n        `\\n` +\n        `  This commonly happens when a collection is removed but an enum\\n` +\n        `  type it defined is still referenced. To recover:\\n` +\n        `\\n` +\n        `    1. Inspect the leftover object named in the error above.\\n` +\n        `    2. Drop it with CASCADE, e.g.:\\n` +\n        `         psql \"$DATABASE_URL\" -c 'DROP TYPE \"<name>\" CASCADE;'\\n` +\n        `    3. Re-run:  ${chalk.bold.green(\"rebase db push\")}\\n` +\n        `\\n` +\n        `  Prefer a safe, versioned workflow? Use ${chalk.bold(\"rebase db generate\")}\\n` +\n        `  + ${chalk.bold(\"rebase db migrate\")} instead of push for destructive changes.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * Pre-flight check: verify that the database is reachable before running\n * a heavy subprocess (Atlas, migrations, etc.).\n *\n * Exits with code 1 and a friendly banner on known failure modes.\n * On unknown errors, logs a warning and allows the caller to proceed.\n */\nexport async function checkDatabaseConnectivity(databaseUrl: string): Promise<void> {\n    let client: import(\"pg\").Client | undefined;\n    try {\n        const { Client } = await import(\"pg\");\n        client = new Client({\n            connectionString: databaseUrl,\n            connectionTimeoutMillis: 5000\n        });\n        await client.connect();\n        await client.query(\"SELECT 1\");\n    } catch (err: unknown) {\n        if (isEconnrefused(err)) {\n            outError(formatConnectionRefusedBanner(databaseUrl, err));\n            process.exit(1);\n        }\n        if (isAuthFailure(err)) {\n            outError(formatAuthFailureBanner(databaseUrl, err));\n            process.exit(1);\n        }\n        if (isSslNotEnabled(err)) {\n            outError(formatSslNotEnabledBanner(databaseUrl));\n            process.exit(1);\n        }\n        // Unknown error — warn but don't block; let the downstream tool surface details\n        outWarn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));\n        outWarn(chalk.gray(\"    Proceeding anyway — the command may fail if the database is unreachable.\"));\n    } finally {\n        try {\n            await client?.end();\n        } catch {\n            // ignore cleanup errors\n        }\n    }\n}\n\n/**\n * Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).\n * Returns a formatted diagnostic string if the error matches a known pattern,\n * or null if unrecognized.\n */\nexport function diagnoseDbError(err: unknown, databaseUrl?: string): string | null {\n    if (isEconnrefused(err)) {\n        return formatConnectionRefusedBanner(databaseUrl || \"\", err);\n    }\n    if (isAuthFailure(err)) {\n        return formatAuthFailureBanner(databaseUrl || \"\", err);\n    }\n    if (isSslNotEnabled(err)) {\n        return formatSslNotEnabledBanner(databaseUrl || \"\");\n    }\n    if (isDependencyDropError(err)) {\n        return formatDependencyDropBanner();\n    }\n    return null;\n}\n\n/**\n * Say why the command failed, on the way out.\n *\n * The entry point below used to be `.catch(() => process.exit(1))`, which threw\n * the error away. Every message this file and its services raise — \"Branch\n * \\\"x\\\" already exists.\", \"the source database has active connections\", \"Branch\n * name is too long\" — was written, wrapped in the right PG error code, and then\n * discarded one frame before it reached a terminal. What a developer saw was a\n * header line, no error, and exit 1.\n *\n * Two shapes are deliberately kept quiet:\n *\n * - **A child process that already spoke.** Atlas, `pg_dump` and `psql` run\n *   with inherited stdio, so their diagnosis is on the terminal already and\n *   execa's wrapper adds only `Command failed with exit code 1: atlas …`.\n *   `packages/cli` filters exactly these two phrasings one level up\n *   (`runDbCommand`), and this is that filter, for the process that is actually\n *   throwing.\n *\n * - **A message that is only a query.** Drizzle reports failures as\n *   `Failed query: <sql> params:` and hides the real PostgreSQL error in\n *   `cause`, so the wrapper alone tells a reader nothing they can act on. The\n *   cause is appended when it says something the message does not.\n *\n * - **An error that has already printed its own diagnosis**, marked\n *   `alreadyReported`. `CollectionsPathMissing` is one: it prints the path, what\n *   it resolved to and the cwd it resolved against, and then throws so the entry\n *   point owns the exit code. Repeating its one-line summary underneath would\n *   undo the \"printed once\" this whole path exists for.\n */\nexport function reportCommandFailure(error: unknown): void {\n    const message = error instanceof Error ? error.message : String(error ?? \"\");\n\n    if ((error as { alreadyReported?: boolean } | null)?.alreadyReported) return;\n    if (!message || /Command failed|exited with code/i.test(message)) return;\n\n    outError(\"\");\n    outError(chalk.red(`  ✗ ${message}`));\n\n    const cause = extractCauseMessage(error);\n    if (cause && !message.includes(cause)) {\n        outError(chalk.gray(`    ${cause}`));\n    }\n    outError(\"\");\n}\n\n/* ------------------------------------------------------------------------- *\n * Atlas failures that have a remedy\n *\n * Atlas runs with a teed stderr, so what reaches these is its output as text,\n * not a `pg` error object carrying a `code`. They are deliberately NOT part of\n * `diagnoseDbError`: that one is shared with the boot path, and \"record a\n * baseline with `rebase db migrate`\" is advice for somebody standing at a\n * terminal, not for a container that has just failed to start.\n * ------------------------------------------------------------------------- */\n\n/**\n * `migrate apply` refusing because the database already has the schema.\n *\n * `42710` (duplicate_object) and `42P07` (duplicate_table) are what a migration\n * hits when boot-ensure — or a `db push` — has already provisioned the objects\n * it was going to create. Since boot-ensure provisions *every* production\n * database, this is the normal case rather than the exotic one, and the raw\n * failure (`pq: type \"posts_status\" already exists (42710)`, then `sql/migrate:\n * write revision: … current transaction is aborted`) names no way forward.\n */\nexport function parseAlreadyProvisioned(text: string): { object: string; code: string } | null {\n    const withCode = /(?:type|relation|constraint|schema) \"([^\"]+)\" already exists \\((42710|42P07)\\)/.exec(text);\n    if (withCode) return { object: withCode[1], code: withCode[2] };\n    // Some Atlas builds keep the SQLSTATE on a following line instead.\n    const bare = /(?:type|relation|constraint|schema) \"([^\"]+)\" already exists/.exec(text);\n    if (bare && /42710|42P07/.test(text)) return { object: bare[1], code: /42P07/.test(text) ? \"42P07\" : \"42710\" };\n    return null;\n}\n\n/**\n * What to do about it: tell Atlas the database is already at a version.\n *\n * Atlas's own mechanism (`migrate apply --baseline <version>`), not a ledger of\n * ours — it writes the revision row Atlas reads, so every later `rebase db\n * migrate` is an ordinary one.\n */\nexport function formatBaselineRemedy(version: string | null, object?: string): string {\n    const versionToken = version ?? \"<version>\";\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  This database already has the schema this migration creates\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        (object ? `  ${chalk.gray(`\"${object}\" is already there, so the migration cannot create it.`)}\\n\\n` : \"\") +\n        `  Nothing is wrong with the migration — the database was provisioned\\n` +\n        `  another way. Every Rebase boot ensures the schema, and ${chalk.bold(\"rebase db push\")}\\n` +\n        `  applies it directly, so a database that has ever run either one is\\n` +\n        `  ahead of a migration history that was never recorded.\\n` +\n        `\\n` +\n        `  Record where it already is, then migrate normally:\\n` +\n        `\\n` +\n        `    ${chalk.bold.green(`rebase db migrate --baseline ${versionToken}`)}\\n` +\n        `    ${chalk.bold.green(\"rebase db migrate\")}\\n` +\n        `\\n` +\n        `  The baseline is the version already applied — the numeric prefix of\\n` +\n        `  the migration file describing what is in the database now. Migrations\\n` +\n        `  after it run; it and everything before it are marked done.\\n` +\n        `\\n` +\n        `  On a database nothing has ever booted against, none of this is needed.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/** `ALTER TABLE … SET NOT NULL` on a table that already holds rows (23502). */\nexport function parseNotNullViolation(text: string): { table: string; column: string } | null {\n    const match = /column \"([^\"]+)\" of relation \"([^\"]+)\" contains null values/.exec(text);\n    return match ? { table: match[2], column: match[1] } : null;\n}\n\n/**\n * The three ways out, because there is no fourth.\n *\n * Boot-ensure handles this case — it adds the column nullable and sets NOT NULL\n * only when the table is empty — so a push that dies here is strictly worse\n * than the boot that would have run instead, and the developer deserves to be\n * told which of the three they want rather than left with `pq: … contains null\n * values (23502)` and no next step.\n */\nexport function formatNotNullViolationBanner(\n    violation: { table: string; column: string },\n    rowCount: number | null\n): string {\n    const { table, column } = violation;\n    const rows = rowCount === null\n        ? `  \"${table}\" already holds rows, and none of them has a value for \"${column}\".\\n`\n        : `  \"${table}\" already holds ${rowCount} row${rowCount === 1 ? \"\" : \"s\"}, and they have no value for \"${column}\".\\n`;\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  Cannot make \"${table}\".\"${column}\" required: existing rows are null\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        rows +\n        `  PostgreSQL will not add the NOT NULL until every one of them does.\\n` +\n        `\\n` +\n        `  Three ways forward:\\n` +\n        `\\n` +\n        `    1. Give the property a default, so the push can backfill:\\n` +\n        `         ${chalk.gray(`{ type: \"string\", defaultValue: \"…\", validation: { required: true } }`)}\\n` +\n        `    2. Backfill by hand first, then push again:\\n` +\n        `         ${chalk.gray(`psql \"$DATABASE_URL\" -c 'UPDATE \"${table}\" SET \"${column}\" = … WHERE \"${column}\" IS NULL;'`)}\\n` +\n        `    3. Leave it optional — take \\`validation.required\\` off the property.\\n` +\n        `\\n` +\n        `  ${chalk.gray(\"Nothing was applied for this column. `rebase dev` would have added it\")}\\n` +\n        `  ${chalk.gray(\"nullable instead: boot sets NOT NULL only when it is safe.\")}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/** Atlas refusing to remove a label from an enum — a renamed `enum` option id. */\nexport function parseEnumLabelDrop(text: string): { label: string; enumType: string } | null {\n    const match = /dropping (?:enum )?value \"([^\"]+)\" from enum \"([^\"]+)\" is not supported/.exec(text);\n    return match ? { label: match[1], enumType: match[2] } : null;\n}\n\n/**\n * Why the two paths disagree, and what retiring an option id actually costs.\n *\n * Boot-ensure adds enum labels and never removes one, so `rebase dev` accepts\n * the very edit that stops `db push` dead. PostgreSQL has no `ALTER TYPE …\n * DROP VALUE`: a label goes only by rewriting the type, which is a data\n * migration and not a schema push.\n */\nexport function formatEnumLabelDropBanner(drop: { label: string; enumType: string }): string {\n    const { label, enumType } = drop;\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  \"${label}\" cannot be removed from the enum \"${enumType}\"\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        `  PostgreSQL has no ALTER TYPE … DROP VALUE. An option id can be added\\n` +\n        `  to an enum but never taken out of one, so renaming an id reads as a\\n` +\n        `  removal and a push cannot carry it.\\n` +\n        `\\n` +\n        `  ${chalk.yellow(\"Nothing was applied.\")} ${chalk.bold(\"rebase dev\")} accepts this same edit — boot adds\\n` +\n        `  new labels and never removes one — so the two paths disagree by\\n` +\n        `  design, and the old label would simply have stayed behind, unused.\\n` +\n        `\\n` +\n        `  To keep the id: put \"${label}\" back and change only its label text.\\n` +\n        `\\n` +\n        `  To retire it for real, it is a data migration:\\n` +\n        `\\n` +\n        `    1. Add the new id alongside the old one, and push.\\n` +\n        `    2. Move the rows:  ${chalk.gray(`UPDATE … SET … = '<new>' WHERE … = '${label}';`)}\\n` +\n        `    3. Rewrite the type, which is what actually drops the label:\\n` +\n        `       ${chalk.gray(\"rebase db generate retire_option && rebase db migrate\")}\\n` +\n        `       ${chalk.gray(\"(a migration can CREATE TYPE …, ALTER TABLE … TYPE … USING, DROP TYPE)\")}\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/** How many rows a table holds, or `null` when we cannot say. */\nasync function countRows(databaseUrl: string | undefined, table: string): Promise<number | null> {\n    if (!databaseUrl) return null;\n    try {\n        const { Client } = await import(\"pg\");\n        const client = new Client({ connectionString: databaseUrl, connectionTimeoutMillis: 5000 });\n        await client.connect();\n        try {\n            // Identifier interpolation, and it has to be: the name comes from\n            // PostgreSQL's own error text, and `count(*)` takes no parameter in\n            // that position. Quoted, with any embedded quote doubled.\n            const res = await client.query(`SELECT count(*)::int AS n FROM \"${table.replace(/\"/g, \"\\\"\\\"\")}\"`);\n            return (res.rows[0] as { n: number } | undefined)?.n ?? null;\n        } finally {\n            await client.end();\n        }\n    } catch {\n        return null;\n    }\n}\n\n/**\n * A hand-written generated column reading a column the plan wants to retype or\n * drop.\n *\n * Rebase's own generated columns are dropped and rebuilt around the apply — it\n * holds their definition in `search.sql`. This one it does not: PostgreSQL\n * stores a generated expression only in the catalogue, so dropping it to let\n * the apply through would destroy the only copy. Refuse instead, and say what\n * the operator can do about it.\n */\nexport function formatForeignGeneratedColumnBanner(\n    conflicts: { schema: string; table: string; column: string; blocking: { column: string; kind: string }[] }[]\n): string {\n    const lines = conflicts.map(c => {\n        const reads = c.blocking.map(b => `\"${b.column}\"`).join(\", \");\n        return `    ${chalk.bold(`${c.schema}.${c.table}.${c.column}`)} reads ${reads}`;\n    });\n    const first = conflicts[0];\n    return (\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `  ❌  A generated column depends on a column this push changes\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n` +\n        `\\n` +\n        lines.join(\"\\n\") + `\\n` +\n        `\\n` +\n        `  PostgreSQL refuses to retype or drop a column while a GENERATED\\n` +\n        `  ALWAYS AS … STORED expression reads it, and an Atlas apply is one\\n` +\n        `  transaction — so this refusal would roll back every other statement\\n` +\n        `  in the push with it.\\n` +\n        `\\n` +\n        `  ${chalk.yellow(\"Nothing was applied.\")} Rebase rebuilds the generated columns it made\\n` +\n        `  itself (a collection's ${chalk.bold(\"search\")} block) around the apply. It has no\\n` +\n        `  definition for this one, and a dropped generated expression is not\\n` +\n        `  recoverable from anywhere but your own migration.\\n` +\n        `\\n` +\n        `  Drop it, push, and put it back:\\n` +\n        `\\n` +\n        `    ${chalk.gray(`ALTER TABLE \"${first.schema}\".\"${first.table}\" DROP COLUMN \"${first.column}\";`)}\\n` +\n        `    ${chalk.gray(\"rebase db push\")}\\n` +\n        `    ${chalk.gray(\"-- then re-create the column with its original expression\")}\\n` +\n        `\\n` +\n        `  Or declare it through a ${chalk.bold(\"search\")} block, and Rebase will own it.\\n` +\n        `\\n` +\n        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\\n`\n    );\n}\n\n/**\n * The remedy for an Atlas invocation that failed, or `null`.\n *\n * Scoped by the invocation, because the same database state means different\n * things to different subcommands: \"already exists\" under `migrate apply` wants\n * a baseline, while under `schema apply` it is a genuine conflict.\n */\nexport async function diagnoseAtlasFailure(context: {\n    domain: string;\n    args: string[];\n    stderr: string;\n    databaseUrl?: string;\n    /** The newest migration version on disk, named in the baseline remedy. */\n    latestMigrationVersion?: string | null;\n}): Promise<string | null> {\n    const { domain, args, stderr, databaseUrl } = context;\n\n    if (domain === \"migrate\" && args.includes(\"apply\")) {\n        const provisioned = parseAlreadyProvisioned(stderr);\n        if (provisioned) {\n            return formatBaselineRemedy(context.latestMigrationVersion ?? null, provisioned.object);\n        }\n    }\n\n    if (domain === \"schema\" && args.includes(\"apply\")) {\n        const enumDrop = parseEnumLabelDrop(stderr);\n        if (enumDrop) return formatEnumLabelDropBanner(enumDrop);\n\n        const notNull = parseNotNullViolation(stderr);\n        if (notNull) return formatNotNullViolationBanner(notNull, await countRows(databaseUrl, notNull.table));\n    }\n\n    return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AA2CA,SAAS,oBAAoB,OAAgG;CACzH,MAAM,SAAS,oBAAoB,KAAK;CACxC,IAAI,QAAQ;EACR,IAAI,OAAO,SAAS,OAAO,OAAO,UAAU,KAAK,OAAO;EACxD,OAAO;GAAE,YAAY,OAAO;GAAQ,MAAM,OAAO;GAAM,SAAS,OAAO;GAAS,UAAU,OAAO;EAAS;CAC9G;CACA,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CACtC,MAAM,IAAI;CACV,IAAI,OAAO,EAAE,eAAe,YAAY,EAAE,aAAa,OAAO,EAAE,cAAc,KAAK,OAAO;CAC1F,OAAO;AACX;;;;;;;AAoBA,SAAgB,eAAe,OAAsC;CACjE,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,IAAI,EAAE,iBAAiB,QAAQ;EAE3B,IAAI,WAAW,SAAU,MAAkC,SAAS,OAAQ,MAAkC,UAAU,UACpH,OAAO,eAAgB,MAAkC,KAAK;EAElE,OAAO;CACX;CAGA,IAAI,UAAU,SAAS,OAAQ,MAAwB,SAAS,YAAY,gBAAgB,KAAM,MAAwB,IAAK,GAC3H,OAAO;CAIX,IAAI,MAAM,SAAS,OAAO,MAAM,UAAU,UACtC,OAAO,eAAe,MAAM,KAAK;CAGrC,OAAO;AACX;;;;;;;;;;;;;;;;AAiBA,SAAgB,gBAAgB,OAAyB;CACrD,OAAO,eAAe,KAAK,MAAM;AACrC;;;;AAKA,SAAgB,oBAAoB,OAA+B;CAC/D,IAAI,CAAC,SAAS,OAAO,UAAU,UAAU,OAAO;CAChD,IAAI,EAAE,iBAAiB,QAAQ,OAAO;CAEtC,IAAI,MAAM,SAAS,OAAO,MAAM,UAAU,UAAU;EAChD,MAAM,SAAS,oBAAoB,MAAM,KAAK;EAC9C,IAAI,QAAQ,OAAO;EAEnB,IAAI,MAAM,iBAAiB,SAAS,MAAM,MAAM,SAC5C,OAAO,MAAM,MAAM;CAE3B;CACA,OAAO;AACX;;;;;;;;AASA,IAAM,8CAA8B,IAAI,IAAI;CACxC;CACA;CACA;CACA;AACJ,CAAC;;;;;;;;;;;AAqBD,SAAgB,uBAAuB,OAAgC;CACnE,MAAM,UAAU,eAAe,KAAK;CACpC,MAAM,SACF,SAAS,WACT,oBAAoB,KAAK,MACxB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;CAC1D,OAAO;EACH,OAAO,QAAQ,SAAS,QAAQ,4BAA4B,IAAI,QAAQ,IAAI,CAAC;EAC7E;EACA,MAAM,SAAS;CACnB;AACJ;;;;;;;;;;AAWA,SAAgB,+BAA+B,OAAyB;CACpE,MAAM,UAAU,eAAe,KAAK;CACpC,IAAI,CAAC,WAAW,QAAQ,SAAS,SAAS,OAAO;CACjD,MAAM,MAAM,QAAQ,QAAQ,YAAY;CACxC,OAAO,IAAI,SAAS,UAAU,KAAK,IAAI,SAAS,gBAAgB;AACpE;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4BA,SAAgB,yBAAyB,OAAyB;CAC9D,MAAM,UAAU,eAAe,KAAK;CACpC,IAAI,CAAC,WAAW,QAAQ,SAAS,SAAS,OAAO;CACjD,OAAO,QAAQ,QAAQ,YAAY,CAAC,CAAC,SAAS,2BAA2B;AAC7E;;;;;;;;;;;;;;;;;;;;;AA2CA,SAAS,iBAAiB,SAAwB,YAAyC;CACvF,IAAI,QAAQ,QAAQ,OAAO,CAAC,QAAQ,MAAM;CAE1C,MAAM,SAAS,QAAQ;CACvB,IAAI,QAAQ;EACR,MAAM,QAAQ,mBAAmB,KAAK,MAAM;EAC5C,IAAI,OACA,OAAO,MAAM,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,KAAI,SAAQ,KAAK,KAAK,CAAC,CAAC,QAAQ,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,OAAO;CAEhG;CAEA,IAAI,QAAQ,SAAS,SAAS;EAE1B,MAAM,WAAW,0CAA0C,KAAK,QAAQ,WAAW,EAAE;EACrF,IAAI,YAAY,YAAY;GACxB,MAAM,WAAW,SAAS,EAAE,CAAC,QAAQ,SAAS,EAAE,CAAC,CAAC,QAAQ,MAAM,EAAE;GAClE,MAAM,QAAQ,aAAa,UAAU;GACrC,IAAI,SAAS,WAAW,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,MAAM,MAAM,SAAS,CAAC,CAAC;EAClF;EACA,OAAO,CAAC;CACZ;CAEA,MAAM,aAAa,QAAQ;CAC3B,IAAI,cAAc,YAAY;EAC1B,MAAM,QAAQ,aAAa,UAAU;EACrC,MAAM,WAAW,WACZ,QAAQ,IAAI,OAAO,IAAI,MAAM,EAAE,GAAG,EAAE,CAAC,CACrC,QAAQ,2CAA2C,EAAE;EAI1D,IAAI,YAAY,aAAa,YAAY;GACrC,MAAM,0BAAU,IAAI,IAAY;GAChC,KAAK,MAAM,CAAC,KAAK,SAAS,OAAO,QAAQ,WAAW,cAAc,CAAC,CAAC,GAChE,QAAQ,IAAK,MAAkC,cAAc,GAAG;GAEpE,IAAI,QAAQ,IAAI,QAAQ,GAAG,OAAO,CAAC,QAAQ;GAC3C,MAAM,OAAO,kBAAkB,YAAY,QAAQ;GACnD,IAAI,WAAW,cAAc,QAAQ,WAAW,YAAY,OAAO,CAAC,QAAQ;EAChF;CACJ;CAEA,OAAO,CAAC;AACZ;;;;;;;;;;;;;;AAeA,SAAgB,kBACZ,SACA,YACkB;CAClB,MAAM,OAAO,QAAQ;CACrB,IAAI,SAAS,WAAW,SAAS,WAAW,SAAS,WAAW,SAAS,SAAS,OAAO,CAAC;CAK1F,IAAI,CAAC,YAAY,OAAO,CAAC;CACzB,MAAM,UAAU,iBAAiB,SAAS,UAAU;CACpD,IAAI,QAAQ,WAAW,GAAG,OAAO,CAAC;CAClC,OAAO,QAAQ,KAAI,YAAW;EAC1B,OAAO,kBAAkB,YAAY,MAAM;EAC3C;CACJ,EAAE;AACN;;;;;;;;AASA,SAAgB,yBACZ,SACA,SACA,UAAgE,CAAC,GACA;CAcjE,MAAM,UAAU,QAAQ,WAAA,QAAA,IAAA,aAAoC;CAE5D,MAAM,SAAS,UAAW,QAAQ,SAAgC,KAAA;CAClE,MAAM,OAAO,UAAW,QAAQ,OAA8B,KAAA;CAC9D,MAAM,aAAa,QAAQ;CAC3B,MAAM,SAAS,QAAQ;CACvB,MAAM,QAAQ,QAAQ;CACtB,MAAM,WAAW,UAAW,QAAQ,WAAkC,KAAA;CACtE,MAAM,aAAa,QAAQ,WAAW;CACtC,MAAM,YAAY,UAAU,aAAa;CACzC,MAAM,OAAO,QAAQ,QAAQ;CAM7B,MAAM,aAAa,kBAAkB,SAAS,QAAQ,UAAU;CAEhE,MAAM,SAAS,OAAO,UAAU,SAAS;CACzC,MAAM,WAAW,SAAS;;CAG1B,MAAM,OAAO,YAAY,KAAK,cAAc;CAE5C,QAAQ,QAAQ,MAAhB;EACI,KAAK,SACD,OAAO;GACH,SAAS,SACH,oCAAoC,SAAS,WAC7C,sDAAsD,aAAa,KAAK,WAAW,KAAK,GAAG,oBAAoB,QAAQ,IAAI;GACjI;GACA;EACJ;EACJ,KAAK,SAID,OAAO;GACH,SAAS,uCAAuC,SAAS,gBAAgB,iCACjE,QAAQ,0BAA0B,aAAa,KAAK,WAAW,KAAK,GAAG,2FACR,SAAS,IAAI,WAAW,KAAK;GACpG;GACA;EACJ;EACJ,KAAK,SACD,OAAO;GACH,SAAS,SACH,oBAAoB,SAAS,WAC7B,iDAAiD,aAAa,KAAK,WAAW,KAAK,GAAG,oBAAoB,QAAQ,IAAI;GAC5H;GACA;EACJ;EACJ,KAAK,SAMD,OAAO;GACH,SAAS,4BAFC,WAAW,EAAE,EAAE,SAAS,UAAU,UAED,QAAQ,SAAS,oBAAoB;GAChF;GACA;EACJ;EAEJ,KAAK,SACD,OAAO;GACH,SAAS,wCAAwC,aAAa,KAAK,WAAW,KAAK,GAAG,oBAAoB,QAAQ,IAAI;GACtH;GACA;EACJ;EACJ,KAAK,SACD,OAAO;GACH,SAAS,2BAA2B,QAAQ,GAAG,KAAK,GAAG;GACvD;GACA;EACJ;EACJ,KAAK,SACD,OAAO;GACH,SAAS,8BAA8B,UAAU,UAAU,QAAQ,SAAS,GAAG,KAAK,GAAG;GACvF;GACA;EACJ;EACJ,KAAK,SACD,OAAO;GACH,SAAS,0CAA0C,UAAU,UAAU,QAAQ,SAAS,GAAG,KAAK,GAAG;GACnG;GACA;EACJ;EACJ,KAAK,SACD,OAAO;GACH,SAAS,sBAAsB,SAAS,GAAG,KAAK,wDAAwD;GACxG;GACA;EACJ;EACJ,KAAK,SACD,OAAO;GACH,SAAS,wBAAwB,QAAQ,GAAG,KAAK,wDAAwD;GACzG;GACA;EACJ;EACJ,KAAK,SAKD,OAAO,WAAW,YAAY,CAAC,CAAC,SAAS,2BAA2B,IAC9D;GAGE,SAAS,uCAAuC,SAAS,uDAAuD;GAChH;GACA;EACJ,IACE;GAGE,SAAS,yBAAyB,SAAS,sEAAsE;GACjH;GACA;EACJ;EACR,KAAK,SACD,OAAO;GACH,SAAS,6BAA6B,QAAQ,qCAAqC;GACnF;GACA;EACJ;EACJ,SAAS;GAEL,MAAM,QAAQ,CAAC,sBAAsB,QAAQ,KAAK,KAAK,GAAG,MAAM;GAChE,IAAI,QAAQ,MAAM,KAAK,WAAW,QAAQ;GAC1C,IAAI,QAAQ,MAAM,KAAK,WAAW,QAAQ;GAC1C,IAAI,UAAU,MAAM,KAAK,cAAc,UAAU;GACjD,IAAI,YAAY,MAAM,KAAK,eAAe,YAAY;GACtD,IAAI,MAAM,MAAM,KAAK,SAAS,MAAM;GACpC,OAAO;IAAE,SAAS,MAAM,KAAK,IAAI;IAAG;IAAM;GAAW;EACzD;CACJ;AACJ;;;;;;;;;;;;;;AAeA,SAAgB,uBACZ,OACA,SACA,UAA6C,CAAC,GACqB;CAOnE,MAAM,cAAc,oBAAoB,KAAK;CAC7C,IAAI,aAAa;EACb,MAAM,OAAO,QAAQ,YAAY,WAAW,GAAG,YAAY,QAAQ,cAAc,QAAQ,QAAQ,KAAK,YAAY;EAClH,IAAI,YAAY,UACZ,OAAO,MAAM,IAAI;OAEjB,OAAO,KAAK,MAAM,MAAM;EAE5B,OAAO;GAAE,SAAS,YAAY;GAAS,GAAI,YAAY,QAAQ,EAAE,MAAM,YAAY,KAAK;EAAG;CAC/F;CAGA,MAAM,UAAU,eAAe,KAAK;CAEpC,IAAI,SAAS;EACT,OAAO,MAAM,OAAO,QAAQ,KAAK,cAAc,QAAQ,IAAI;GACvD,MAAM,QAAQ;GACd,SAAS,QAAQ;GACjB,QAAQ,QAAQ;GAChB,MAAM,QAAQ;GACd,QAAQ,QAAQ;GAChB,OAAO,QAAQ;GACf,YAAY,QAAQ;GACpB,UAAU,QAAQ;EAQtB,CAAC;EACD,MAAM,EAAE,SAAS,MAAM,eAAe,yBAAyB,SAAS,SAAS,EAAE,YAAY,QAAQ,WAAW,CAAC;EACnH,OAAO;GAAE;GAAS;GAAM,GAAI,WAAW,SAAS,KAAK,EAAE,WAAW;EAAG;CACzE;CAGA,OAAO,MAAM,sBAAsB,QAAQ,4BAA4B;EACnE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;EAC5D,OAAO,iBAAiB,QAAQ,MAAM,QAAQ,KAAA;EAC9C,OAAO,iBAAiB,SAAS,MAAM,QAChC,MAAM,iBAAiB,QAAQ,MAAM,MAAM,UAAU,OAAO,MAAM,KAAK,IACxE,KAAA;CACV,CAAC;CAGD,MAAM,eAAe,oBAAoB,KAAK;CAC9C,IAAI,cACA,OAAO,EAAE,SAAS,sBAAsB,QAAQ,KAAK,eAAe;CAIxE,OAAO,EAAE,SAAS,4BAA4B,QAAQ,mCAAmC;AAC7F;;;;;;;;;;;;AC7jBA,SAAgB,eAAe,KAAuB;CAClD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,gBAAgB,OAAO;CAEtC,IAAI,MAAM,QAAQ,EAAE,MAAM,GACtB,OAAO,EAAE,OAAO,MAAK,UACjB,SAAS,OAAO,UAAU,YAAa,MAA4B,SAAS,cAChF;CAGJ,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,eAAe,EAAE,KAAK;CAEjC,OAAO;AACX;;;;;AAMA,SAAgB,cAAc,KAAuB;CACjD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,WAAW,EAAE,SAAS,SAAS,OAAO;CACrD,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,cAAc,EAAE,KAAK;CAGhC,IAAI,aAAa,KAAK,OAAQ,EAA2B,YAAY,UAAU;EAC3E,MAAM,MAAO,EAA0B,QAAQ,YAAY;EAC3D,IAAI,IAAI,SAAS,gCAAgC,KAAK,IAAI,SAAS,sBAAsB,GACrF,OAAO;CAEf;CACA,OAAO;AACX;;;;;;AAOA,SAAgB,gBAAgB,KAAuB;CACnD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,YAAY,CAAC,CAAC,SAAS,kCAAkC,GACpG,OAAO;CAEX,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,gBAAgB,EAAE,KAAK;CAElC,OAAO;AACX;;;;;;;AAQA,SAAgB,sBAAsB,KAAuB;CACzD,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CACV,IAAI,EAAE,SAAS,SAAS,OAAO;CAC/B,IAAI,OAAO,EAAE,YAAY,UAAU;EAC/B,MAAM,MAAM,EAAE,QAAQ,YAAY;EAClC,IAAI,IAAI,SAAS,4BAA4B,KAAK,IAAI,SAAS,kBAAkB,GAC7E,OAAO;CAEf;CACA,IAAI,EAAE,SAAS,OAAO,EAAE,UAAU,UAC9B,OAAO,sBAAsB,EAAE,KAAK;CAExC,OAAO;AACX;;;;;;;;;AAUA,SAAgB,cAAc,aAA6B;CACvD,IAAI;EACA,MAAM,SAAS,IAAI,IAAI,WAAW;EAClC,OAAO,GAAG,OAAO,SAAS,GAAG,OAAO,QAAQ;CAChD,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AAYA,SAAgB,oBAAoB,KAA6B;CAC7D,IAAI,CAAC,OAAO,OAAO,QAAQ,UAAU,OAAO;CAC5C,MAAM,IAAI;CAEV,IAAI,MAAM,QAAQ,EAAE,MAAM,GACtB,KAAK,MAAM,SAAS,EAAE,QAAQ;EAC1B,MAAM,SAAS,oBAAoB,KAAK;EACxC,IAAI,QAAQ,OAAO;CACvB;CAEJ,IAAI,EAAE,OAAO;EACT,MAAM,SAAS,oBAAoB,EAAE,KAAK;EAC1C,IAAI,QAAQ,OAAO;CACvB;CACA,IAAI,OAAO,EAAE,YAAY,YAAY,EAAE,WAAW,CAAC,EAAE,QAAQ,WAAW,eAAe,GACnF,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,IAAI,EAAE,KAAK,KAAK,EAAE;CAEnD,OAAO;AACX;;AAGA,SAAS,iBAAiB,KAAsB;CAC5C,MAAM,SAAS,QAAQ,KAAA,IAAY,OAAO,oBAAoB,GAAG;CACjE,OAAO,SAAS,sBAAsB,OAAO,QAAQ;AACzD;;;;AAKA,SAAS,8BAA8B,aAAqB,KAAuB;CAE/E,OACI;;uCAFa,cAAc,WAIa,EAAS,sEAGjD,iBAAiB,GAAG,IACpB;AASR;;;;AAKA,SAAS,wBAAwB,aAAqB,KAAuB;CACzE,MAAM,WAAW,cAAc,WAAW;CAC1C,IAAI,WAAW;CACf,IAAI;EACA,WAAW,IAAI,IAAI,WAAW,CAAC,CAAC,YAAY;CAChD,QAAQ,CAAe;CAEvB,OACI;;uCAEwC,SAAS,OAAO,SAAS,sEAGjE,iBAAiB,GAAG,IACpB;;;;wCAIyC,SAAS;AAI1D;;;;AAKA,SAAS,0BAA0B,aAA6B;CAC5D,MAAM,WAAW,cAAc,WAAW;CAC1C,MAAM,aAAa,YAAY,SAAS,GAAG,IAAI,qBAAqB;CACpE,OACI;;sDAEuD,SAAS,mNAM/C,MAAM,KAAK,iBAAiB,EAAE,gDAExB,WAAW;AAI1C;;;;;AAMA,SAAS,6BAAqC;CAC1C,OACI;;;;;;IAMK,MAAM,OAAO,6CAA6C,EAAE,+aAU9C,MAAM,KAAK,MAAM,gBAAgB,EAAE,+CAEV,MAAM,KAAK,oBAAoB,EAAE,QACtE,MAAM,KAAK,mBAAmB,EAAE;AAI/C;;;;;;;;AASA,eAAsB,0BAA0B,aAAoC;CAChF,IAAI;CACJ,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,SAAS,IAAI,OAAO;GAChB,kBAAkB;GAClB,yBAAyB;EAC7B,CAAC;EACD,MAAM,OAAO,QAAQ;EACrB,MAAM,OAAO,MAAM,UAAU;CACjC,SAAS,KAAc;EACnB,IAAI,eAAe,GAAG,GAAG;GACrB,SAAS,8BAA8B,aAAa,GAAG,CAAC;GACxD,QAAQ,KAAK,CAAC;EAClB;EACA,IAAI,cAAc,GAAG,GAAG;GACpB,SAAS,wBAAwB,aAAa,GAAG,CAAC;GAClD,QAAQ,KAAK,CAAC;EAClB;EACA,IAAI,gBAAgB,GAAG,GAAG;GACtB,SAAS,0BAA0B,WAAW,CAAC;GAC/C,QAAQ,KAAK,CAAC;EAClB;EAEA,QAAQ,MAAM,OAAO,gDAAgD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,GAAG,CAAC;EACxH,QAAQ,MAAM,KAAK,8EAA8E,CAAC;CACtG,UAAU;EACN,IAAI;GACA,MAAM,QAAQ,IAAI;EACtB,QAAQ,CAER;CACJ;AACJ;;;;;;AAOA,SAAgB,gBAAgB,KAAc,aAAqC;CAC/E,IAAI,eAAe,GAAG,GAClB,OAAO,8BAA8B,eAAe,IAAI,GAAG;CAE/D,IAAI,cAAc,GAAG,GACjB,OAAO,wBAAwB,eAAe,IAAI,GAAG;CAEzD,IAAI,gBAAgB,GAAG,GACnB,OAAO,0BAA0B,eAAe,EAAE;CAEtD,IAAI,sBAAsB,GAAG,GACzB,OAAO,2BAA2B;CAEtC,OAAO;AACX;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAgB,qBAAqB,OAAsB;CACvD,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,SAAS,EAAE;CAE3E,IAAK,OAAgD,iBAAiB;CACtE,IAAI,CAAC,WAAW,mCAAmC,KAAK,OAAO,GAAG;CAElE,SAAS,EAAE;CACX,SAAS,MAAM,IAAI,OAAO,SAAS,CAAC;CAEpC,MAAM,QAAQ,oBAAoB,KAAK;CACvC,IAAI,SAAS,CAAC,QAAQ,SAAS,KAAK,GAChC,SAAS,MAAM,KAAK,OAAO,OAAO,CAAC;CAEvC,SAAS,EAAE;AACf;;;;;;;;;;;AAsBA,SAAgB,wBAAwB,MAAuD;CAC3F,MAAM,WAAW,iFAAiF,KAAK,IAAI;CAC3G,IAAI,UAAU,OAAO;EAAE,QAAQ,SAAS;EAAI,MAAM,SAAS;CAAG;CAE9D,MAAM,OAAO,+DAA+D,KAAK,IAAI;CACrF,IAAI,QAAQ,cAAc,KAAK,IAAI,GAAG,OAAO;EAAE,QAAQ,KAAK;EAAI,MAAM,QAAQ,KAAK,IAAI,IAAI,UAAU;CAAQ;CAC7G,OAAO;AACX;;;;;;;;AASA,SAAgB,qBAAqB,SAAwB,QAAyB;CAClF,MAAM,eAAe,WAAW;CAChC,OACI,wMAKC,SAAS,KAAK,MAAM,KAAK,IAAI,OAAO,uDAAuD,EAAE,QAAQ,MACtG,kIAC4D,MAAM,KAAK,gBAAgB,EAAE,iMAMlF,MAAM,KAAK,MAAM,gCAAgC,cAAc,EAAE,QACjE,MAAM,KAAK,MAAM,mBAAmB,EAAE;AAUrD;;AAGA,SAAgB,sBAAsB,MAAwD;CAC1F,MAAM,QAAQ,8DAA8D,KAAK,IAAI;CACrF,OAAO,QAAQ;EAAE,OAAO,MAAM;EAAI,QAAQ,MAAM;CAAG,IAAI;AAC3D;;;;;;;;;;AAWA,SAAgB,6BACZ,WACA,UACM;CACN,MAAM,EAAE,OAAO,WAAW;CAC1B,MAAM,OAAO,aAAa,OACpB,MAAM,MAAM,0DAA0D,OAAO,QAC7E,MAAM,MAAM,kBAAkB,SAAS,MAAM,aAAa,IAAI,KAAK,IAAI,gCAAgC,OAAO;CACpH,OACI;;oBAEqB,MAAM,KAAK,OAAO,wGAGvC,OACA;;;;;WAKY,MAAM,KAAK,uEAAuE,EAAE,8DAEpF,MAAM,KAAK,oCAAoC,MAAM,SAAS,OAAO,eAAe,OAAO,YAAY,EAAE,mFAGhH,MAAM,KAAK,uEAAuE,EAAE,MACpF,MAAM,KAAK,4DAA4D,EAAE;AAItF;;AAGA,SAAgB,mBAAmB,MAA0D;CACzF,MAAM,QAAQ,0EAA0E,KAAK,IAAI;CACjG,OAAO,QAAQ;EAAE,OAAO,MAAM;EAAI,UAAU,MAAM;CAAG,IAAI;AAC7D;;;;;;;;;AAUA,SAAgB,0BAA0B,MAAmD;CACzF,MAAM,EAAE,OAAO,aAAa;CAC5B,OACI;;QAES,MAAM,qCAAqC,SAAS,+PAOxD,MAAM,OAAO,sBAAsB,EAAE,GAAG,MAAM,KAAK,YAAY,EAAE,yMAI5C,MAAM,+KAKN,MAAM,KAAK,uCAAuC,MAAM,GAAG,EAAE,6EAE7E,MAAM,KAAK,uDAAuD,EAAE,WACpE,MAAM,KAAK,wEAAwE,EAAE;AAIvG;;AAGA,eAAe,UAAU,aAAiC,OAAuC;CAC7F,IAAI,CAAC,aAAa,OAAO;CACzB,IAAI;EACA,MAAM,EAAE,WAAW,MAAM,OAAO;EAChC,MAAM,SAAS,IAAI,OAAO;GAAE,kBAAkB;GAAa,yBAAyB;EAAK,CAAC;EAC1F,MAAM,OAAO,QAAQ;EACrB,IAAI;GAKA,QAAQ,MADU,OAAO,MAAM,mCAAmC,MAAM,QAAQ,MAAM,MAAM,EAAE,EAAE,EAAA,CACpF,KAAK,EAAE,EAAgC,KAAK;EAC5D,UAAU;GACN,MAAM,OAAO,IAAI;EACrB;CACJ,QAAQ;EACJ,OAAO;CACX;AACJ;;;;;;;;;;;AAYA,SAAgB,mCACZ,WACM;CACN,MAAM,QAAQ,UAAU,KAAI,MAAK;EAC7B,MAAM,QAAQ,EAAE,SAAS,KAAI,MAAK,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,IAAI;EAC5D,OAAO,OAAO,MAAM,KAAK,GAAG,EAAE,OAAO,GAAG,EAAE,MAAM,GAAG,EAAE,QAAQ,EAAE,SAAS;CAC5E,CAAC;CACD,MAAM,QAAQ,UAAU;CACxB,OACI,oMAKA,MAAM,KAAK,IAAI,IAAI;;;;;;;IAOd,MAAM,OAAO,sBAAsB,EAAE,2EACd,MAAM,KAAK,QAAQ,EAAE,6MAM1C,MAAM,KAAK,gBAAgB,MAAM,OAAO,KAAK,MAAM,MAAM,iBAAiB,MAAM,OAAO,GAAG,EAAE,QAC5F,MAAM,KAAK,gBAAgB,EAAE,QAC7B,MAAM,KAAK,2DAA2D,EAAE,gCAElD,MAAM,KAAK,QAAQ,EAAE;AAI1D;;;;;;;;AASA,eAAsB,qBAAqB,SAOhB;CACvB,MAAM,EAAE,QAAQ,MAAM,QAAQ,gBAAgB;CAE9C,IAAI,WAAW,aAAa,KAAK,SAAS,OAAO,GAAG;EAChD,MAAM,cAAc,wBAAwB,MAAM;EAClD,IAAI,aACA,OAAO,qBAAqB,QAAQ,0BAA0B,MAAM,YAAY,MAAM;CAE9F;CAEA,IAAI,WAAW,YAAY,KAAK,SAAS,OAAO,GAAG;EAC/C,MAAM,WAAW,mBAAmB,MAAM;EAC1C,IAAI,UAAU,OAAO,0BAA0B,QAAQ;EAEvD,MAAM,UAAU,sBAAsB,MAAM;EAC5C,IAAI,SAAS,OAAO,6BAA6B,SAAS,MAAM,UAAU,aAAa,QAAQ,KAAK,CAAC;CACzG;CAEA,OAAO;AACX"}

package/dist/cli-flags-BglvpjHv.js

@@ -0,0 +1,138 @@
+import { createRequire as __createRequire } from "module";
+__createRequire(import.meta.url);
+import { a as __toESM } from "./__vite-browser-external-BnuHet1e.js";
+import { t as require_arg } from "./arg-Dni7MzLB.js";
+//#region src/cli-flags.ts
+var import_arg = /* @__PURE__ */ __toESM(require_arg(), 1);
+/**
+* Flags that reach this process on a line it did not compose.
+*
+* `rebase db …` hands the driver the user's whole line: the CLI *reads*
+* `--database-url` and `--docker` to resolve the database and then relays them
+* verbatim, and `--debug` is what `bin/rebase.js` prints after every failure as
+* the thing to re-run with. Rejecting any of the three would make the driver
+* refuse commands the CLI documents.
+*/
+var RELAYED_FLAGS = {
+	"--database-url": String,
+	"--docker": Boolean,
+	"--debug": Boolean,
+	"--help": Boolean,
+	"-h": "--help"
+};
+/**
+* Parse a driver command's line — `["db", "<subcommand>", …]` — with the
+* relayed flags declared alongside the command's own.
+*
+* Every driver parser is permissive, and an undeclared flag in a permissive
+* parse is a positional. The positionals are what `db migrate` hands
+* `atlas migrate apply`, what `db generate` names its migration after and
+* which backup `db restore` restores, so a relayed flag left undeclared was
+* read as one of those: `rebase db migrate --docker` died on Atlas's
+* `unknown flag: --docker` after it had already written the auth schema.
+*/
+function parseDriverLine(spec, args) {
+	return (0, import_arg.default)({
+		...RELAYED_FLAGS,
+		...spec
+	}, {
+		argv: args.slice(2),
+		permissive: true
+	});
+}
+/** Keyed by `"<domain> <subcommand>"`, the way the user types it. */
+var DRIVER_FLAG_SPECS = {
+	"db push": {
+		"--collections": String,
+		"-c": "--collections",
+		"--dry-run": Boolean,
+		"--allow-destructive": Boolean,
+		"--yes": Boolean,
+		"-y": "--yes"
+	},
+	"db generate": {
+		"--collections": String,
+		"-c": "--collections"
+	},
+	"db migrate": { "--baseline": String },
+	"schema generate": {
+		"--collections": String,
+		"-c": "--collections",
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--watch": Boolean,
+		"-w": "--watch"
+	},
+	"schema introspect": {
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--collections": String,
+		"-c": "--collections",
+		"--force": Boolean,
+		"-f": "--force",
+		"--schema": String
+	},
+	"schema stale": {
+		"--collections": String,
+		"-c": "--collections",
+		"--output": String,
+		"-o": "--output",
+		"--out": "--output",
+		"--fix": Boolean
+	}
+};
+/**
+* The `--collections` path the user typed, or `null` if they typed none.
+*
+* Read once, at the entry point, because every command that takes it re-enters
+* the generators with the same line and each of them resolved it again — which
+* is how "Collections path not found" came to be printed four times before the
+* real output, and how a path that does not exist got as far as *writing* an
+* empty schema.
+*
+* Permissive, and it has to be: {@link assertKnownFlags} has already judged the
+* line, and `db push` carries flags the `--collections` spec does not name.
+*/
+function collectionsPathIn(args) {
+	try {
+		return (0, import_arg.default)({
+			"--collections": String,
+			"-c": "--collections"
+		}, {
+			argv: args.slice(2),
+			permissive: true
+		})["--collections"] ?? null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Reject a flag the named command does not take.
+*
+* `args` is the driver's whole line — `["db", "push", …]` — so the flags are
+* read from `args.slice(2)`, past the two command words.
+*
+* Throws rather than exiting: `runPluginCommand`'s caller already turns a
+* thrown error into one red line and exit 1, and a thrown error is what the
+* tests can see.
+*/
+function assertKnownFlags(domain, subcommand, args) {
+	if (!subcommand) return;
+	const spec = DRIVER_FLAG_SPECS[`${domain} ${subcommand}`];
+	if (!spec) return;
+	try {
+		(0, import_arg.default)({
+			...RELAYED_FLAGS,
+			...spec
+		}, { argv: args.slice(2) });
+	} catch (err) {
+		if (err instanceof Error && err.code === "ARG_UNKNOWN_OPTION") throw new Error(`${err.message} — run \`rebase ${domain} --help\` for the options \`${domain} ${subcommand}\` takes.`);
+		throw err;
+	}
+}
+//#endregion
+export { collectionsPathIn as n, parseDriverLine as r, assertKnownFlags as t };
+
+//# sourceMappingURL=cli-flags-BglvpjHv.js.map